161212_COMBINED_SYNOPSIS_SOLICITATION.docx

COMBINED SYNOPSIS/SOLICITATION

SEXUAL ASSAULT PREVENTION AND RESPONSE OFFICE (SAPRO)

DEFENSE SEXUAL ASSAULT INCIDENT DATABASE (DSAID) SUPPORT

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

(ii) The solicitation number is H98210-17-R-0001 and the solicitation is issued as request for proposal (RFP).

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-92 effective 18 Nov 2016.

(iv) This requirement is being advertised on an unrestricted basis; there is no set-aside. The associated NAICS code is 541512 and the small business size standard is $27.5M.

(v) A list of contract line item numbers, quantities and units of measure, (including options) is provided below:

BASE PERIOD

OPTIONAL

Development of the DSAID

OPTION PERIOD 1

OPTIONAL

Operations and Maintenance of the DSAID

OPTIONAL

Development of the DSAID

OPTION PERIOD 2

OPTIONAL

Operations and Maintenance of the DSAID

OPTIONAL

Development of the DSAID

(vi) The contemplated contract will be a Firm-Fixed Price (FFP), requirements-type contract. The overarching Basic Contract Performance Work Statement (PWS) at Attachment A describes the types of recurring services that the Government requires at varying times throughout the contract’s performance period.

Individual Task Orders issued against this contract will include a PWS that identifies which of those tasks are required under the order. SAPRO has historically issued approximately six total Task Orders per year. This RFP includes a Task Order PWS of work expected to be completed under this contract (see Attachment B). The Government anticipates awarding Task Order 1 at the time the Basic Contract is awarded.

(vii) The period of performance for the base and option periods shall be:

(viii) The provision at 52.212-1, Instructions to Offerors -- Commercial, applies to this acquisition. An addendum to the provision is provided as Attachment C.

(ix) The provision at 52.212-2, Evaluation -- Commercial Items, applies to this acquisition and the specific evaluation criteria to be included in paragraph (a) of that provision are provided as Attachment D.

(x) Offerors shall include a completed copy of the provision at 52.212-3, Offeror Representations and Certifications -- Commercial Items, with its offer. See Attachment C.

(xi) The clause at 52.212-4, Contract Terms and Conditions -- Commercial Items, applies to this acquisition.

(xii) The clause at 52.212-5, Contract Terms and Conditions Required To Implement Statutes Or Executive Orders -- Commercial Items, applies to this acquisition.

(xiii) Additionally, the following provisions/clauses apply to this acquisition: 52.204-16, 52.204-18, 52.204-21, 52.209-5, 52.209-7, 52.209-9, 52.209-11, 52.222-50, and 52.232-40. The following provisions/clauses also apply and are provided via full text:

52.216-19 ORDER LIMITATIONS. (OCT 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than N/A, the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor:

(1) Any order for a single item in excess of N/A;

(2) Any order for a combination of items in excess of N/A; or

(3) A series of orders from the same ordering office within N/A days that together call for quantities exceeding the limitation in subparagraph (1) or (2) above.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph (b) above.

(d) Notwithstanding paragraphs (b) and (c) above, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within fivedays after issuance, with written notice stating the Contractor's intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source.

(End of clause)

52.216-21 REQUIREMENTS (OCT 1995)

(a) This is a requirements contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies or services specified in the Schedule are estimates only and are not purchased by this contract. Except as this contract may otherwise provide, if the Government's requirements do not result in orders in the quantities described as "estimated'' or "maximum" in the Schedule, that fact shall not constitute the basis for an equitable price adjustment.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. Subject to any limitations in the Order Limitations clause or elsewhere in this contract, the Contractor shall furnish to the Government all supplies or services specified in the Schedule and called for by orders issued in accordance with the Ordering clause. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(c) Except as this contract otherwise provides, the Government shall order from the Contractor all the supplies or services specified in the Schedule that are required to be purchased by the Government activity or activities specified in the Schedule.

(d) The Government is not required to purchase from the Contractor requirements in excess of any limit on total orders under this contract.

(e) If the Government urgently requires delivery of any quantity of an item before the earliest date that delivery may be specified under this contract, and if the Contractor will not accept an order providing for the accelerated delivery, the Government may acquire the urgently required goods or services from another source.

(f) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the Contractor's and Government's rights and obligations with respect to that order to the same extent as if the order were completed during the contract's effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after date of contract expiration.

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of the contract’s expiration date.

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days of the contract’s expiration date; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed three years.

(End of clause)

252.216-7006 ORDERING (MAY 2011)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in the contract schedule. Such orders may be issued from effective date of contract award through the contract’s expiration date.

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

(c)(1) If issued electronically, the order is considered ``issued'' when a copy has been posted to the Electronic Document Access system, and notice has been sent to the Contractor.

(2) If mailed or transmitted by facsimile, a delivery order or task order is considered ``issued'' when the Government deposits the order in the mail or transmits by facsimile. Mailing includes transmittal by U.S. mail or private delivery services.

(3) Orders may be issued orally only if authorized in the schedule.

(End of Clause)

(xiv) The Defense Priorities and Allocations System (DPAS) is not applicable and there is no assigned rating.

(xv) All proposal submissions in response to this RFP must be received no later than (NLT) 10:00AM Eastern on 01 Feb 2017.

a. For mailed submissions, Offerors must submit notification to the Contract Specialist via email at least five business days in advance of proposal delivery. This email notification shall also include a tracking number for the package. Submit proposals to the address below:

Defense Human Resources Activity Contracting Directorate Attn: John Rowland Solicitation No. H98210-17-R-0001 4800 Mark Center Drive, Suite 06J25-01 Alexandria, VA 22350

b. For hand delivery, Offerors must contact the Contract Specialist via email at least five business days prior to the due date for delivery instructions.

c. No electronic submissions (e.g. emailed proposals) will be accepted.

(xvi) An Offeror may email written questions about the RFP to the Contract Specialist, John Rowland, at john.r.rowland10.civ@mail.mil. No information concerning this solicitation or requests for clarification will be provided in response to telephone calls. Questions will be received up to 10:00 AM Eastern on 19 Dec 2016. Questions received after this time and date may not be answered.

(xvii) Administrative Information:

SECTION 508 COMPLIANCE

1. The following Section 508 Accessibility Standard(s) are applicable to this acquisition.

Technical Standards

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.41 - Information, Documentation and Support

2. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance.

Functional Performance Criteria

1194.31 - Functional Performance Criteria

COMMON ACCESS CARDS (CACS) FOR CONTRACTOR PERSONNEL

The contractor shall obtain CACs for all personnel requiring access to Government facilities in accordance with the following:

(a) For installation(s)/location(s) cited in the contract, contractors shall ensure Common Access Cards (CACs) are obtained by all contract or subcontract personnel who meet one or both of the following criteria:

(1) Require logical access to Department of Defense computer networks and systems in either:

(i) the unclassified environment; or

(ii) the classified environment where authorized by governing security directives.

(2) Perform work which requires the use of a CAC for installation entry control or physical access to facilities and buildings.

(b) Contractors and their personnel shall use the following procedures to obtain CACs:

(1) Contractors shall provide a listing of personnel authorized a CAC to the COR. The COR will provide a copy of the listing to the government representative in the local organization designated to authorize issuance of contractor CACs (i.e., “authorizing official”).

(2) Contractor personnel on the listing shall each complete and submit a DD Form 1172-2 or other authorized DoD electronic form to the authorizing official. The authorizing official will verify the applicant’s name against the contractor’s listing and return the DD Form 1172-2 to the contractor personnel.

(3) Contractor personnel will proceed to the nearest CAC issuance workstation with the DD Form 1172-2 and appropriate documentation to support their identification and/or citizenship. The CAC issuance workstation will then issue the CAC.

(c) While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy.

(d) During the performance period of the contract, the contractor shall:

(1) Within 7 working days of any changes to the listing of the contract personnel authorized a CAC, provide an updated listing to the COR who will provide the updated listing to the authorizing official;

(2) Return CACs in accordance with local policy/directives within 7 working days of a change in status for contractor personnel who no longer require logical or physical access;

(3) Return CACs in accordance with local policy/directives within 7 working days following a CACs expiration date; and

(4) Report lost or stolen CACs in accordance with local policy/directives.

(e) Within 7 working days following completion/termination of the contract, the contractor shall return all CACs issued to their personnel to the issuing office or the location specified by local policy/directives.

(f) Failure to comply with these requirements may result in withholding of final payment.

ATTACHMENT A

PERFORMANCE WORK STATEMENT

BASIC CONTRACT

1.0 INTRODUCTION

The Department of Defense (DoD) Sexual Assault Prevention and Response Office (SAPRO) has a requirement for support services for the continued maintenance, operation, and further development for the Defense Sexual Assault Incident Database (DSAID). With the ever increasing number of requests for information and requirements from Congress and Senior Leaders within the DoD, it is imperative that DSAID continues to deliver a high level of confidence with the data it maintains, as well as fosters efficiencies in operations.

2.0 BACKGROUND

2.1 The Duncan Hunter National Defense Authorization Act (NDAA) for Fiscal Year 2009 mandated that the Secretary of Defense implement a permanent, centralized, case-level database for the collection, maintenance, and reporting of information regarding sexual assaults involving members of the Armed Forces.

2.2 Now implemented, DSAID encompasses five functional capabilities to include, reporting, data entry, data interface, case management, and business management. Reporting functionality allows SAPRO the ability to electronically develop and execute congressionally mandated reporting, facilitate trend analysis, perform data validation, and respond to ad hoc requests. Data entry and interfaces enable DSAID to receive case-level information from Sexual Assault Response Coordinators (SARCs), Sexual Assault Prevention and Response (SAPR) Service Program Managers (PMs), Service Legal Officers (LOs) and/or other Service data systems. This approach allows for timely responses to departmental and Congressional inquiries and alleviates redundant data entry and unnecessary data calls to the field. The case management functionality enables all the Military Department SARCs, National Guard SARCs, and Coast Guard SARCs to input and maintain sexual assault case data directly into DSAID. Finally, business management functionality provides administrative and oversight capability through case management reviews, meeting minutes, SARC and SAPR Victim Advocate (VA) management, and User Access permissions. The Department also uses DSAID to meet document storage requirements associated with sexual assault reports.

3.0 SCOPE

The Contractor shall provide the personnel to perform system management, further development, and support for DSAID. The contractor must maintain the system to ensure continued operations and continued maintenance and development of the Enhanced Reporting Capability (ERC). Henceforth, the term DSAID includes the ERC. As requested by the Government, provide licenses for maintenance and upgrades to the application and software; and respond to task orders for increased functionality as a result of additional requirements to include Congressional mandates.

4.0 REQUIREMENTS The Contractor shall:

4.1 Maintain all DSAID functional capabilities to comply with the system management definition as specified within the “DSAID Requirements Package” (see Appendix A). See section 11.0 for location of documents.

4.1.1 Maintain all current DSAID operations to include hardware and software, development, migration, training, test and production environments, software changes/updates/maintenance, configuration/customization changes, ERC data Extract Transform and Load (ETL) process, and help desk support.

4.1.2 Develop change requests relating to retaliation, file locker, additional functionality to ERC, interface development and modernization, and additional DSAID changes as approved by Change Control Board (CCB).

4.2 Execute Project Management Activities.

4.2.1 Provide a Project Management Plan (PMP) that addresses the technical and project management approaches, and timeline for maintaining DSAID applications and configuration (software upgrades and patching) required.

4.2.2 Provide a Task Order Management Plan (TOMP) that describes the technical approach, implementation plan, program management approach, risk management plan, system engineering plan, and quality control plan to be employed to meet the cost, performance, and schedule requirements for this effort. The TOMP shall detail the technical solution, methods for configuring and customizing the technical solution, and the timeline for producing the technical solution.

4.2.3 The contractor shall be at least Capability Maturity Model Integration (CMMI) level 3 certified to provide project management that ensures responsiveness, efficient and effective service, and innovation in meeting the Government’s responsibilities.

4.2.4 Participate in ad-hoc meetings as requested by SAPRO.

4.2.5 Submit status reports that document current task order status, risks, mitigations, issues, concerns, recommendations, and future tasks.

4.2.6 Conduct weekly In Progress Reviews (IPR) to inform the Government of DSAID’s status and obtain guidance on any modifications that may be required due to the Contractor and client’s interpretation of the capabilities. Submit meeting minutes after each IPR conducted.

4.2.7 Conduct a Phase End Review Session at the end of each phase based upon the functionality breakdown, to obtain the approval from the government in order to proceed to the next phase. Deliver a Phase End Report that details the scope of functionality within each Phase.

4.3 Execute Configuration Management Activities.

4.3.1 Develop, maintain, and deliver a Configuration Management (CM) Plan to address major components of CM.

4.3.2 Update and maintain existing documentation, to be defined at the task order level, to reflect the current release of DSAID.

4.3.3 Document and deliver the traceability matrix from the requirements of task orders to the technical design, and development/configuration of DSAID prior to the start of development, and to the test cases prior to the start of system testing.

4.4 Execute System Management Activities.

4.4.1 Software Development Process and Approach. The contractor shall define a software development approach appropriate for the computer software effort to be performed under this solicitation. This approach shall be documented in a Software Development Plan (SDP). The contractor shall follow this SDP for all computer software to be developed or maintained under this effort. The SDP shall define the contractor’s proposed life cycle model and the processes used as a part of that model. In this context, the term “life cycle model” is as defined in IEEE/EIA Std. 12207.0.

4.4.1.1 Requirements Analysis. The contractor shall analyze each functional and non-functional requirement provided by the government to ensure the complete understanding of the intent of the requirement. If an agile approach is used, the contractor shall transform the requirements into user stories and use them to drive software development.

4.4.1.2 Technical Reviews. The contractor shall conduct IPRs and Phase End Reviews for each software releases or iterations. The contractor shall conduct the technical reviews in accordance with the SDP and this PWS. At each technical review, the contractor, in addition to providing process, methodology, and recommendation details, shall provide the analyses and methodologies used to arrive at specific recommendations and conclusions for a design approach. The contractor shall make available all captured technical review data following event completion to include specifications, design, test documentation, and other documentation as appropriate.

4.4.2 Assist with Help Desk operations as outlined in the DSAID Help Desk Management Plan (see Appendix B). Designate Help Desk primary and alternate points of contact. The points of contact will receive, field, and answer problems and questions related to DSAID, and redirect to other appropriate Tier Level support when necessary.

4.4.3 Execute Issue Management Activities in accordance with the DSAID Enterprise Information Technology Services Directorate (EITSD) Contingency Plan (see Appendix B).

4.4.4 Execute Risk Management Activities in accordance with the DSAID Risk Management Plan (see Appendix B).

4.5 Execute Change Management Activities.

4.5.1 Analyze proposed changes to DSAID functional capabilities and/or data elements. Prepare and deliver Change Request Functional Analysis reports that code changes/impacts, level of effort, and/or proposed solution(s).

4.5.2 Execute functional changes. DSAID capabilities will be comprised from approved CRs. Changes and/or additions to the capabilities, as a result of collaborative review between the Contractor and SAPRO may occur. Requirements for the CRs will be reflected and made in the “DSAID Requirements Package” based upon agreed discussions between the Government, the Contractor, and other required parties. All changes must be approved by the Government prior to implementation.

4.6 Execute Hardware and Software Maintenance Activities.

4.6.1 Fully deploy, maintain and operate the MicroStrategy® based DSAID Enhanced Reporting Capability.

4.6.2 Maintain and operate the DSAID customized Entellitrak® COTS functionality.

4.6.3 Maintain, operate, and update a single sign on capability that directs users to role based access in accordance with approved functional capabilities.

4.6.4 Provide a maintenance and upgrade schedule for all applications and specific application components and software (include COTS upgrade schedule).

4.6.5 Deploy approved application upgrades and software patches.

4.6.6 Verify all hardware and software changes are functioning properly and are appropriately documented in release notes.

4.6.7 During the option periods, the contractor shall renew license needs for the DSAID as applicable. The contractor shall participate in discussions and recommend license needs to meet business needs.

4.6.8 The contractor shall maintain all hardware and software necessary to ensure DSAID remains operational. This will include the operation of Entellitrak and MicroStrategy applications, software patching as required, and server maintenance (e.g. Tomcat, Apache, Internet Information Services, and SQL 2012).

4.7 Execute Software Testing Activities

4.7.1 The contractor shall conduct Unit Testing, System Testing, Regression Testing, and Performance Testing for each software release or iteration before delivery to the government for User Acceptance Testing (UAT). Develop a set of Test Plans and Test Cases that identify critical issues, assess perceived quality risks, identify Information Assurance (IA) impacts, verify requirements, and document the testing strategies, testing scenarios and testing activities, prior to the start of each type of testing.

4.7.2 Evaluate each test to compare expected outcomes to actual outcomes for the DSAID functionality. Document and deliver the testing execution results metrics indicating the pass or fail for each testing scenario or activity, in the Testing Evaluation Reports for Unit Testing, System Testing, Regression Testing and Performance Testing once completed on the test environment and prior to UAT; deliver updated and final testing execution results metrics prior to pushing to the production environment.

4.7.3 The contractor shall fully verify the system software requirements. The contractor shall capture issues arising from contractor testing and assign a Software Trouble Report (STR) Severity (i.e., Severity 1, 2, 3, 4, or 5) and Priority (i.e., Priority 1, 2, 3, 4, or 5) to each issue. The contractor shall submit in their STR the severity and priority assigned for review and solicits approval by the government. Delivered software releases shall be free of Priority 1, 2, and 3 STRs, as determined by the Government. Software Trouble Report (STR) severity definitions are as follows:

Access to critical/primary system functions denied;

System design does not comply with system functional requirements.

Users are no longer able to continue the operation;

Jeopardizes personnel safety, security, or other requirements deemed “critical”.

Access to key system modules, services, functions, and interfaces denied or impacted.

Negative impact on agreed-to requirements, business rules, and processes;

No reasonable system workarounds exist;

System does not function as expected;

Irrecoverable corruption of database occurs and no work around solution exists;

System processes transactions incorrectly;

System refuses legitimate transactions;

System loses transaction data or logs;

To adhere to regulatory compliance, action required;

Adversely affects technical, costs or schedule risks.

Access to key system modules, services, functions, and interfaces denied or impacted.

Negative impact on agreed to requirements, business rules, and processes;

System does not function as expected;

Reasonable workarounds exist;

Adversely affects technical, costs or schedule risks.

Access to key system modules, services, functions, and interfaces not denied or impacted.

Impact on agreed to requirements, business rules, and processes is limited to minor inconveniences or annoyances to users;

Identified errors are cosmetic in nature (i.e. spelling, grammar, punctuation, screen/text layout and color, window sizing and other front end errors).

Access to key system modules, services, functions, and interfaces not denied or impacted.

No impact on agreed to requirements, business rules, and processes.

The priority level corresponds to the timeline the defect needs to be fixed and should be carefully classified according to the following criteria:

The criteria for accepting the System for delivery to the production environment will be based on the following criteria:

· The system has no severity levels of 1, 2, 3, or 4 issues.

· All core test scenario are executed and passed.

· STRs and discrepancies are documented, resolved, verified, or designated as future changes.

4.7.4 The contractor shall provide support to the Government’s DSAID UAT that includes: UAT environment technical support, environments dedicated for UAT, helps seeding the test data, retrieve and load interface test file, and a demonstration by the contractor for the Government testers to ensure the appropriate use of the product for UAT purposes. Record UAT issues identified during Government UAT in STR, assign priorities according to the STR Priority definitions, and provide status updates to the issue resolution.

4.7.5 Provide weekly STR of all issues and/or defects to include: STR Unique ID; a detailed description and type; Status; which type of testing/situation (e.g., Unit, System, Regression, Performance, UAT, helpdesk) the defect was identified in; STR Severity and Priority, the impacted system’s requirements it maps to; identification date; an estimated completion date; and resolution as agreed upon by the Government PM. Resolve issues and/or defects, as well as any security issues, adverse accreditation risks, or data inaccuracies, etc. prior to release to the Government for additional testing and acceptance. Resolve any issues and/or defects identified during the Government’s User Acceptance Testing (UAT) or ad hoc testing.

4.8 Execute Performance Management Activities.

4.8.1 Generate DSAID routine and ad hoc reports, and data queries. These data requests shall be run on the backend and are not part of the DSAID report or query functionality identified in the functional capabilities.

4.8.2 Implement procedures for addressing and correcting those areas where DSAID performance levels are not compliant (e.g., Key Performance Parameters (KPP)).

4.8.3 Deliver performance measurements report to include the DSAID KPP listed below.

4.9 Execute Corrective Maintenance Activities.

4.9.1 Perform corrective maintenance on DSAID and provide estimated time of completion. Corrective maintenance will be performed to remove errors and bugs from the application, procedures, data structures, and documentation. Corrective maintenance will be performed to streamline data validation as well. Corrective maintenance activities include both emergency repairs and preventive repairs.

4.9.2 Report scheduled outages no less than two business days before the scheduled outage date and notify the DSAID Support Team as outlined in the DSAID EITSD Contingency Plan.

4.9.3 Report unscheduled outages as soon as the outage is discovered and notify the DSAID Support Team as outlined in the DSAID EITSD Contingency Plan.

4.10 Execute Interface Management Activities.

4.10.1 Perform interface data transfers between DSAID and interfacing systems (e.g., Investigative Information Management System) per established Memorandums of Understanding (MOU) and interface data mapping documents.

4.10.2 Maintain and update interface data transfer functionality.

4.10.3 Extract, transform, and load data from DSAID to the DSAID Enhanced Reporting Capability module.

4.11 Execute Technical Training Environment Support Activities.

4.11.1 Maintain and operate a DSAID training environment to mirror the DSAID production environment. Update the training environment to reflect the new changes within two days of a new release to the production environment.

4.11.2 Ensure the training environment can be used by approximately 30 users simultaneously.

4.11.3 Deploy approved application upgrades and software patches to training environment.

4.11.4 Prepare the training environment with training data, on-call support, and environment monitoring for SAPRO lead training sessions. The Government will provide training data (e.g. number of cases and the associated locations).

4.11.5 The contractor shall make available qualified technical Subject Matter Experts (SMEs) to assist in the training curriculum development process as applicable. For ERC, the contractor shall provide data schema and description of schema level objects to include attributes and metrics.

4.11.6 Provide support for DSAID demonstration(s) to Congress, GAO, DoD leadership or other government entities that includes setting up demonstration environment and seeding data.

4.12 Execute Cybersecurity Risk Management Framework (RMF) Activities.

4.12.1 The contractor shall produce software-release deliverables that meet applicable RMF requirements as defined in the Department of Defense Instructions (DoDI) 8500.01 and 8510.01, Security Technical Implementation Guides (STIGs), and National Security Telecommunications and Information Systems Security Policy (NSTISSP) No. 11. The contractor shall engineer and develop secure system releases that meet all applicable cybersecurity and system security requirements. The contractor shall build in and test for security requirement compliance during system development to ensure the release and iterations can obtain accreditations.

4.12.2 RMF Implementation. The contractor shall work closely with government cybersecurity representatives to progress through RMF implementation. This includes developing a plan to determine cybersecurity and system security requirements, implementing those requirements, verifying and validating that the solution satisfied those requirements, and document the implementation status using the RMF. The contractor shall develop and deliver a security plan that contains the following:

· The security controls in accordance with the STIGs, and Information Assurance Vulnerability Management (IAVM) requirements

· An annotation of software differences between the classified and unclassified systems

· The implementation plan to guide the implementation of the system’s security controls

· The validation plan to guide the verification and validation of security controls

· Artifacts that document security control implementation.

The contractor shall submit a combined Plan of Action and Milestones (POA&M) for the classified and unclassified systems using the results of the security control analysis in accordance with the security plan. The contractor shall conduct security testing concurrent with each iteration and software release delivery. The contractor shall conduct security testing at least once for each iteration/release cycle during development to determine effective implementation of security controls. The contractor shall conduct final release security testing on the final version of the release to verify and validate release compliance with Cybersecurity regulations and requirements. The contractor shall document these results and include them in the STR.

4.12.3 System Authorization. The contractor shall support the government’s system authorization process per the DoDI 8510.01. The contractor shall support the government in creating authorization artifacts as required. The contractor shall support the government’s authorization efforts with the goal of achieving and maintaining an Authority to Operate (ATO) in accordance with DoDI 8510.01 shortly after delivery and acceptance of final contract deliverables. For new development and for modification of re-used capability, the contractor shall correct CAT I and CAT II findings or institute an Operational Designated Approval Authority (ODAA)-approved mitigation if a fix does not exist so that the finding can/will be reported as a CAT III. This will exclude third party software. Mitigations may include operational policies and procedures.

4.12.4 Information Assurance Vulnerability Management (IAVM). The contractor shall establish and execute a process to implement security updates to the system releases and monitor security scan results provided by the hosting provider. The contractor shall develop and implement an IAVM process to ensure each software release remains current with security updates including Information Assurance Vulnerability Alert (IAVA) and Information Assurance Vulnerability Bulletin (IAVB). If any gaps are discovered through monitoring security scan results, the contractor shall communicate to the Government and assist or execute in resolving the issue.

4.13 Provide the necessary support and information and/or documentation to the Government to ensure Information Assurance requirements are met as a result of the Defense Information Assurance Certification and Accreditation Process (DIACAP) until the transition to RMF is complete.

4.14 Provide system models, documentation, and information that will assist the Government in developing the required Enterprise Architecture (EA) products for acquisition and business modeling activities (IAW Title 10, Sec 2222). Provide validation support of the developed EA products.

4.15 Perform data quality analysis. Prepare and deliver Data Quality analysis and reports to include system metrics on the data residing in DSAID and consistency checks between data in DSAID and interfaced Service systems.

4.16 Provide 30-day Transition of Contract Services. Within five business days of contract award, provide a plan for transition in and out services to ensure minimum disruption to vital Government business. This plan shall address how the Contractor will work with the incumbent, successor contractor and Government personnel to ensure that there will be no service degradation during and after the transition-out period. The Contractor shall perform the following transition requirements when exercised by the Government:

4.16.1 Identify all software development and test resources (hardware and software) that will be needed to fulfill the software support concept;

4.16.2 Develop and record plans identifying these resources and describing the approach to be followed for transitioning deliverable items. These plans shall consist of an installation and checkout plan for the development and test environments and the executable software and a demonstration plan that provides the steps to produce an executable product that is identical to what the Contractor produces when using deliverable software;

4.16.3 Prepare the development and test environment and executable software to be transitioned per the plan;

4.16.4 Install and check out the development and test hardware/software in the support environment per the plan;

4.16.5 Demonstrate to the Government that the deliverable software can be regenerated (compiled/ linked/loaded into an executable product) and maintained using the delivered software and hardware per the plan;

4.16.6 Provide software development and test familiarization training;

4.16.7 Provide other assistance, as needed;

4.16.8 Update the design description of each software item to match the "as built" software; and,

4.16.9 Define and record the methods to be used to verify copies of the software, the measured computer hardware resource utilization for the software item, and the information needed to maintain the software.

4.17 Participate in a Post-Award Conference. This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post-Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all capabilities, and identify and resolve any potential issues. The Government will provide a baseline of the DSAID functional capabilities for the meeting. Be prepared to discuss any items requiring clarification and gather information to support each deliverable. Provide a written summary of the Post-Award Conference.

5.0 DELIVERABLES

A summary of deliverables follows. Deliverables are to be provided in electronic file, and/or hard copy, as required. Additional deliverables will be provided in follow on task orders.

Updated and final prior to pushing to the production environment

For new resources, delivered within 5 business days of beginning the project

6.0 CONTRACTOR MANPOWER REPORTING

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for SAPRO via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Office of the Under Secretary of Defense (Personnel and Readiness). Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil

7.0 SECURITY The Contractor shall:

7.1 Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall:

7.1.1 The Contractor shall develop, maintain, prepare, and deliver a breach mitigation plan in the event a breach occurs and provide a copy of the plan to the SAPRO COR.

7.1.2 The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall comply with:

DoD Instruction (DoDI) 8500.1, Cybersecurity The Privacy Act (5 U.S.C. 552a) DoD 5400.11-R, and DoD Directive 5400.11, DoD Privacy Program DoD 6025.18-R, DoD Health Information Privacy Regulation DoD 5200.2-R, Personnel Security Program HSPD-12, Homeland Security Presidential Directive.

7.1.3 Comply with HSPD-12 Personal Identity Verification (PIV) issuance capabilities, known as the CAC for DMDC and:

7.1.3.1 Be CAC or PIV ready prior to reporting for work. At minimum all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing.

7.1.3.2 Be citizens of the United States.

7.1.3.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

7.1.4 Ensure that all staff having access to sexual assault case and business management information in the production environment has signed a non-disclosure agreement and provide copies to the Government.

7.2 If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the DMDC Information Systems Security Group (DISSG) remove such person from work under this contract.

7.3 Immediately report to the discovery of any Privacy breach first to the DMDC CIO/ Privacy Office and secondly to the COR.

7.4 Perform offsite work with Personally Identifiable Information (PII) only on systems and platform information technology systems (PIT) that meet RMF (formerly DIACAP) for DoD Information Technology (IT) capabilities. Systems previously certified under DIACAP must be current but cannot exceed an authority to operate (ATO) date later than April 2018. Such information systems and PIT systems will be updated on an on-going basis to continue to meet applicable RMF capabilities. Systems must have and maintain an Authority to Operate (ATO) or if acceptable to the Government, if under DIACAP an Interim Authority to Operate (IATO) not to exceed the April 2018 time frame.

7.5 Contractor systems and information networks that receive, transmit, store, or process nonpublic Government data must be accredited according to DoDI 8510.01 "Risk Management Framework for DoD IT” (RMF) (formally DIACAP) and comply with annual Federal Information Security Management Act (FISMA) security control testing. All systems subject to RMF must present evidence of authorization in the security plan, Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has successfully went through the Risk Management Framework Process in order to integrate information security and risk management activities into the system’s life cycle. The RMF decision must be current and cannot exceed a 3 year timeframe. Evidence FISMA compliance must be presented in the form of a POA&M. The Contractor will be responsible for the cost of RMF processes and FISMA testing required for any Contractor owned and operated network, facility, and/or application processing DoD information.

8.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)

The Government will provide adequate office space for a maximum of four (4) on-site contractors and normal office supplies such as paper, pens, and other office equipment, such as telephone service, computer and software, standard office equipment and furniture as required for a normal office setting.

9.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the capabilities under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

10.0 QUALITY ASSURANCE

10.1 The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the capabilities in the PWS. The Government will make every effort to ensure that the surveillance methods described below are conducted in an objective, fair, and consistent manner.

10.1.1 Periodic Surveillance. This action occurs when the COR or other Government official observes a deficiency. Examples include evidence from accidents, incidents, or delays.