Performance_Work_Statement.docx

Performance Work Statement Defense Sexual Assault Incident Database (DSAID)

1.0. INTRODUCTION

The Sexual Assault Prevention and Response Office (SAPRO) requires continued maintenance and operational support services for the Defense Sexual Assault Incident Database (DSAID). With the ever increasing number of requests for information and requirements from Congress and Senior Leaders within the Department of Defense (DoD), it is imperative that DSAID continues to deliver a high level of confidence with the data it maintains.

2.0. BACKGROUND

2.1. The NDAA FY09 mandated that the Secretary of Defense implement a centralized, case-level database for the collection, maintenance, and reporting of information regarding sexual assaults involving members of the Armed Forces (Ref. P.L. 110-417 Section 563 (a)). In August 2010, contract #H98210-10-D-0002 was awarded to develop and implement DSAID to comply with this mandate and in December 2012, DSAID received full deployment capability to operate.

2.2. Now implemented, DSAID encompasses five functional capabilities to include, reporting, data entry, data interface, case management, and business management. Reporting functionality allows SAPRO the ability to electronically develop and implement congressionally mandated reports (Ref. P.L. 110-417 Section 563 (d)), facilitate trend analysis, perform data validation, and respond to ad hoc requests. Data entry and data interfaces enable DSAID to receive case-level data from Sexual Assault Response Coordinators (SARCs), Sexual Assault Prevention and Response (SAPR) Service Program Managers (PMs), Service Legal Officers (LOs) and/or Service systems which will allow for timely responses to departmental and Congressional inquiries and alleviate redundant data entry and unnecessary data calls. This capability helps ensure that DSAID meets the Congressional mandate requiring the implementation of a “centralized, case-level database.” The case management functionality enables all the Military Department SARCs, National Guard SARCs, and Coast Guard SARCs to input and maintain victim data pertaining to a sexual assault directly into DSAID. Finally, business management functionality provides SARCs and PMs administrative and a management capability through case management reviews, meeting minutes, SARC and SAPR Victim Advocate (VA) management, and User Access permissions.

3.0. SCOPE

The Contractor shall provide the personnel to perform system management and support for the Defense Sexual Assault Incident Database (DSAID).

4.0. REQUIREMENTS The Contractor shall:

4.1. Maintain all DSAID functional capabilities that comply with the system management definition as specified within the “DSAID Requirements Package” (see Appendix A).

4.2. Maintain all current DSAID system operations to include:

· DSAID Hardware and Software

· DSAID migration, training, test and production environments

· Software Changes/Updates/Maintenance

· Configuration/Customization Changes

· Help Desk Support

4.3. Demonstrations. The contractor may be required to support SAPRO at any demonstrations required by Congress, DoD Leadership, or other government entities.

4.4. If applicable, provide 30 day Transition of Contract Services. Within five business days of contract award, provide a plan for transition out services to ensure minimum disruption to vital Government business. This plan shall address how the Contractor will work with the successor contractor and Government personnel to ensure that there will be no service degradation during and after the transition-out period.

5.0. DELIVERABLES

5.1. Monthly Status Reports. The contractor shall deliver a Monthly Status Report that will document status of each task order, issues or concerns, recommendations, risks, and future tasks.

5.2. Final DSAID Data Dictionary. The contractor shall provide a final DSAID Data Dictionary derived from each task order data dictionary.

6.0. TASK ORDER DELIVERABLES

6.1. Task Orders may require any or all of the following deliverables:

6.1.1. Task Order Management Plan (TOMP). The contractor shall provide a TOMP that describes the technical approach, implementation plan, program management approach, risk management plan, system engineering plan, and quality control plan to be employed to meet the cost, performance, and schedule requirements for this effort. The TOMP shall detail the technical solution, methods for configuring and customizing the technical solution, and a timeline for producing the technical solution.

6.1.2. Test Plan. The contractor shall develop a Task Order specific Test Plan that identifies critical issues, assesses perceived quality risks, identifies Information Assurance (IA) impact, verifies requirements, and demonstrates progress for Unit Testing, System Testing, Regression Testing and Performance Testing, and deliver Test Plan, procedures, and results as specified by each Task Order.

6.1.3. DSAID Capabilities. The contractor shall deliver a technical solution that provides reporting, data entry, data interface, case management, and business management capabilities as described in the DSAID Requirements Package.

6.1.4. Interfaces. The contractor shall interface with multiple Service systems with differing technologies and platforms required to provide data to DSAID.

6.1.5. Reports and Documents:

6.1.5.1. Status reports. The contractor shall submit status reports that document current status, issues or concerns, recommendations, risks and future tasks.

6.1.5.2. Data Quality Analysis and Reports. The contractor shall perform data quality analysis and prepare reports to include system metrics on the data residing in DSAID and consistency checks between data in DSAID and data in Service systems.

6.1.5.3. DSAID Requested Changes Analysis and Reports. The contractor shall analyze requested changes to DSAID functional capabilities and/or data elements and prepare reports to document analysis and/or proposed solution(s).

6.1.5.4. Design/Configuration Document. The contractor shall document and deliver the linkage from the approved requirements to the design of DSAID.

6.1.5.5. Data Dictionary. The contractor shall develop a data dictionary specific to the task order.

7.0. Delivery Schedule

A summary of deliverables follows. Deliverables are to be provided in electronic file, and/or hard copy, as required.

8.0 SECURITY

8.1 Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall:

8.1.1 Comply with:

DoD Instruction (DoDI) 8500.1, Cybersecurity The Privacy Act (5 U.S.C. 552a) DoD 5400.11-R, and DoD Directive 5400.11, DoD Privacy Program DoD 6025.18-R, DoD Health Information Privacy Regulation DoD 5200.2-R, Personnel Security Program HSPD-12, Homeland Security Presidential Directive.

8.1.2 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) for DMDC and:

8.1.2.1 Be responsible for obtaining CAC or PIV ready status prior to reporting for work. At a minimum, all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing.

8.1.2.2 Be citizens of the United States.

8.1.2.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

8.2 If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the DMDC Information Systems Security Group (DISSG) and remove such person from work under this contract.

8.3 Immediately report the discovery of any Privacy breach first to the SAPRO CIO/ Privacy Office and secondly to the COR.

8.4 All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01 "Risk Management Framework (RMF) for DoD Information Technology (DIT)” issued March 12, 2014 (formerly the DOD Information Assurance Certification and Accreditation Process (DIACAP)). IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

8.5 DoD-Controlled IS and PIT Systems operated by a Contractor or other entity on behalf of the DOD; to include contractor owned IS and PIT systems that are dedicated to DoD processing, must be authorized as DoD IS or PIT systems. SAPRO Authorizing Official (AO) must render an authorization decision for this type of a DoD system prior to DoD use of the capability.

8.6 IT services provided by a commercial or other non-federal government entity under this requirement must ensure the security protections of the IS delivering the service is appropriate to the confidentiality, integrity, and availability needs of SAPRO information and mission in order to be approved for acceptable use. SAPRO will assess the adequacy of security proposed by potential service providers, and accept the proposed approach, negotiate changes to the approach to meet DoD needs, or reject the offer. The accepted security approach will be documented and included as attachments to the resulting contract.

8.7 Any commercial cloud computing services used for this requirement must comply with DoD cloud computing policy and procedural guidance as published.

8.8 Information security continuous monitoring (ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. All IS and PIT under this requirement must maintain ongoing monitoring, analysis and incident response procedures as defined and documented in NIST SP800-137 as a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. In addition, all systems under this requirement must comply with all annual Federal Information Security Management Act (FISMA) security control testing and reporting requirements. The contractor shall provide evidence of these compliance activities.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)

The Government will provide property, equipment or information, e.g. computers, desks, data, etc for up to three individuals at the Mark Center in Alexandria, VA.

10.0. APPLICABLE DOCUMENTS

· DoD Directive 5400.11, DoD Privacy Program

· DoD Directive 5400.11-R, DoD Privacy Program

· DoD 5220.22-M, National Industrial Security Program Operating Manual

· DoDD 6495.01, Sexual Assault Prevention and Response Program

· DoD 5400.7-R, DoD Freedom of Information Act Program