Amendment_01.pdf

H9821017R0030

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

A. To Correct Attachment numbers in Instructions to Offerors and add Past Performance Questionnaire (PPQ) Cover Letter and questionnaire to attachments.

B. To inform offerors that the period of performance w ill be adjusted if aw ard is made a little earlier or later, but w ill be for the same numer of months.

C. To revise the PWS to add transition period language (4.7).

1. CONTRACT ID CODE PAGE OF PAGES

J 1 18

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 21-Dec-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X H9821017R0030

X 9B. DATED (SEE ITEM 11)

15-Dec-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

21-Dec-2017

CODE

DEFENSE HUMAN RESOURCES ACTIVITY

4800 MARK CENTER DRIVE,

SUITE 06J25-01

ALEXANDRIA VA 22350-4000

H98210 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

TABLE OF CONTENTS

The below Table of Contents has been added

Exhibit/Attachment Table of Contents

DOCUMENT TYPE DESCRIPTION PAGES DATE

Attachment 1 PPQ Cover Letter 1 21-DEC-2017 Attachment 2 PPQ 7 21-DEC-2017

The following have been modified:

INSTRUCTIONS TO OFFERORS

ADDENDUM TO FAR 52.212-1 – INSTRUCTIONS TO OFFERORS – COMMERCIAL ITEMS. (JAN

2017)

The following is hereby changed from the basic provision:

Paragraph (c) is changed to read:

(c) Period for acceptance of offers. The offeror agrees to hold the prices in its offer firm for 120 calendar days from the date specified for receipt of offers.

The following are hereby deleted from the basic provision:

(d) Product samples.

(h) Multiple Awards.

The following instructions are hereby added to the basic provision:

(b)(4) Factor 1 – Technical Offerors shall submit one original, three hardcopies, and one electronic copy (on CD) of this volume (VOLUME 2) which shall include, and address Subfactors 1 through 4 below. The total page count for this volume shall not exceed 60 single-sided pages, excluding the subcontracting plan and inclusive of any table of contents, appendices, attachments etc. The Government will only review up to the 60th page of this volume, therefore, any pages beyond will not be evaluated. Margins shall not be less than ½ inch. Font may be Times New Roman or Arial with not less than eleven pitch.

The offeror’s technical proposal shall demonstrate its understanding of the requirements outlined in the PWS by addressing the following technical subfactors:

Subfactor 1. Technical Approach & Methodology. The offeror shall provide its Project Management Plan.

The plan must include its proposed labor solution for fulfilling the requirements of the PWS, to include the qualifications, professional certifications, number of personnel and a cross matrix identifying how the solution will meet the requirements of the PWS. Additionally, the offeror shall demonstrate its approach and methodology by providing details about how the offeror has applied the entellitrak software and its configuration, roll out interfaces, the Agile methodology, system development lifecycle process and documentation.

Subfactor 2. Cybersecurity. The offeror shall demonstrate its understanding of cybersecurity by providing details about how the offeror has applied cybersecurity policies and Risk Management Framework (RMF) to information systems as described in National Institute of Standards and Technology (NIST) SP 800-37 as well as the proper Assessment and Accreditation (A&A) procedures defined in the NIST SP 800-115 and how they would apply them to DMDC.

Subfactor 3. Test Plan. The offeror shall provide a test plan that describes its approach for testing strategies and procedures to ensure system releases will be successful.

Subfactor 4. Subcontracting Plan. Large Business offerors shall provide a subcontracting plan in accordance with FAR 52.219-9, Alt II (DEVIATION 2016-O0009)(AUG 2016).

(b)(6) Factor 3 – Price Offerors shall submit one original and one electronic copy (on CD) of this volume (VOLUME 1) which shall include and address the following:

- Any exceptions to the terms and conditions shall be clearly stated, accompanied by clear and complete rationale.

This information shall be presented on page 1 of Volume 1. NOTE: Exceptions to the Government’s terms and conditions may render a proposal unawardable.

- Price Schedule. Insert proposed prices, (unit prices, and extended amounts) for each Contract Line Item Number (CLIN), including all option period CLINs.

-The completed Standard Form 1449- blocks 12, 17 and 30 of the RFP, signed original documents. NOTE: An official authorized to contractually bind the offer must sign Block 30a.

-Any Solicitation Amendments

-Representations and Certifications. Complete all required FAR and DFARS representations and certifications.

-A description of each proposed labor category to include the minimum education and experience related to each.

-A breakdown of pricing for the labor mix including the labor categories, and fully unburdened labor rates (hourly or annual salary) for the Base and all Option periods.

Additionally, provide proposed Total Compensation Plan in accordance with FAR 52.222-46.

The contracting officer has determined there is a high probability of adequate price competition in this acquisition.

Upon examination of the initial offers, the contracting officer will review this determination and if, in the contracting officer’s opinion, adequate price competition exists, no additional cost information will be requested.

However, if at any time during this competition the contracting officer determines that adequate price competition no longer exists, offerors may be required to submit information, other than cost or pricing data, to the extent necessary for the contracting officer to determine the reasonableness and affordability of the price.

(b)(10) Factor 2 – Past Performance Each offeror shall submit a past performance volume (VOLUME 3) as part of their proposal. Offerors are cautioned that the Government will use data provided by each offeror in this volume and data obtained from other sources in the development of performance confidence assessments. This volume shall be limited to no more than two (2) pages per contract listed. Only past performance information for recent and relevant contracts are desired. Submit original and three copies of Past Performance Information.

Offerors may submit up to 5 recent and relevant Past Performance references. For this solicitation, Recent is defined as current projects or those completed within the last three years of the issue date of this RFP.

See the definitions of relevance in table 1, to be used for this RFP.

PAST PERFORMANCE RELEVANCY RATINGS (Table 1) Rating Definition Very Relevant Effort includes support services and includes entellitrak or a similar COTS platform that is configured for the DoD HR IT case management systems Relevant Effort includes support services and includes entellitrak or a similar COTS platform that is configured for Federal Government HR IT case management systems Somewhat Relevant Effort includes support services and includes entellitrak or a similar COTS platform that is configured for any HR IT case management systems Not Relevant Effort did not include support services for entellitrak or a similar COTS platform and HR IT case management systems

For each reference being submitted , the offeror shall complete Section 1 and Section 2 of the Past Performance Questionnaire (Attachment 2) and include in this volume of proposal.

Offerors shall also complete Sections 1 and 2 of the Past Performance Questionnaire (Attachment 2) and submit to its references, along with the Past Performance Questionnaire Cover Letter (Attachment 1),which requests the references to submit the completed questionnaires directly to the Contracting Officer. Once the Past Performance Questionnaires are completed by the offeror’s POCs, the information contained in the Questionnaires shall be considered source selection sensitive and not released to you, the offeror.

Questionnaires shall be sent directly to the Government.

In the event that commercial contracts or contracts the offeror performed as a subcontractor are presented as past/present sources of performance information, a client authorization form shall be issued to those commercial POCs authorizing/instructing them to complete a Past Performance Questionnaire. The offeror shall send the client authorization form with the Past Performance Questionnaire to each POC on commercial contracts. Offerors shall include a separate copy of client authorization form(s) for each commercial contract included in the offeror’s proposal for the Government’s use in case additional questionnaires or contact is needed after proposal submission.

The form must authorize the POC to speak with the Government regarding past performance.

The Government will utilize the references submitted and may use other sources, such as the Past Performance Information Retrieval System (PPIRS). Subcontractors Past Performance will be considered.

Should the Offeror possess no relevant past performance, a written statement shall be provided by the Offeror so indicating. In this case, the Offeror will not be evaluated favorably or unfavorably on past performance.

The following is hereby added to the basic provision:

(m) Delivery Details. Offers may be submitted by mail or hand carried. Late proposals will be handled in accordance with paragraph (f) of this provision. Submit proposals to the address below:

DHRA PK

Attn: Frank Whorton, Contract Specialist 4800 Mark Center Drive, Suite 03E25 Alexandria, VA 22350-4000

NOTE: If hand delivering a proposal, contact the Contract Specialist, Frank Whorton via e-mail at:

frank.a.whorton.civ@mail.mil, at least five business days prior to the due date for delivery instructions.

(n) Questions. Offerors may e-mail written questions to the Contract Specialist Frank Whorton at:

frank.a.whorton.civ@mail.mil and the Contracting Officer, Melissa Tamayo at: melissa.s.tamayo.civ@mail.mil. No information concerning this RFP will be provided in response to telephone calls. Questions will be received up to 11:00 a.m. Eastern Time on 1/10/2018. Questions received after this time and date may not be answered.

PERFORMANCE WORK STATEMENT

mailto:frank.a.whorton.civ@mail.mil mailto:civ@mail.mil mailto:melissa.s.tamayo.civ@mail.mil

Performance Work Statement (PWS) Investigations and Resolutions Case Management System (IRCMS), Case Management Tracking

System (CMTS), and Defense Injury and Unemployment Compensation System (DIUCS) Program Support Services, Technical Services, and System Sustainment

1.0 INTRODUCTION

The Defense Manpower Data Center (DMDC) Enterprise Human Resources Information Systems (EHRIS) Directorate requires program support services, technical services, and system sustainment for Department of Defense (DoD) enterprise human resources (HR) case management systems.

2.0 BACKGROUND

Starting in 2009, DMDC procured three implementations of the commercial off-the-shelf (COTS) solution, entellitrakTM, with a one-time license user fee that has been purchased, and has configured each solution to meet Department of Defense (DoD) required capabilities. These capabilities are identified into three different DoD enterprise HR case management systems:

Investigations and Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS), and Defense Injury and Unemployment Compensation System (DIUCS).

DMDC requires the sustainment support to continue providing HR capabilities through case management systems to the DoD Civilian workforce, ultimately supporting the warfighter.

3.0 SCOPE

The Contractor shall provide the personnel, management and materials necessary to successfully provide management and IT services support as detailed in sections 4.1, 4.2, 4.3, 4.4, 4.5 and 4.6.

4.0 REQUIREMENTS The Contractor shall:

Support and sustain DMDC case management systems to include IRCMS, CMTS, and DIUCS built on the COTS solution, entellitrakTM. Support for IRCMS and CMTS will begin in the base year, whereas support for the DIUCS will begin August 18, 2018, following the end of the current DIUCS contract.

4.1 System Sustainment activities

4.1.1 Provide software technical support and interface functionality to the configured solution to include Bug fixes and Change requests and enhancements, see Attachment C. The contractor isn’t responsible for bug fixes, change requests, and enhancements to the Core COTS solutions.

4.1.2 Perform all software maintenance, including installation, testing, add or amend business rules/processes, and deploy software upgrades and patches to the Core COTS solution.

4.1.3 Provide communication to the project managers on system outages to include:

• 72 hours prior to scheduled outages; and

• Within 1 hour of identified emergency issues.

4.1.4 Utilize Agile Methodology to conduct sustainment operations. The Government Program Manager and contractor will agree to the review, deliverable cycle, due dates, and document via email to the COR.

4.1.4.1 Support product backlog reviews and refinement of requirements by providing level of effort for system changes (sprint cycle varies per system).

4.1.4.2 Facilitate the cycle review to include briefing materials. Briefing materials include description of the user stories, the acceptance criteria, and a demonstration or explanation on how the story was completed. The user story will then either be deemed accepted or failed by the Government Functional and Technical POC.

4.1.4.3 Prepare User Acceptance Testing (UAT) documentation to include testing procedures and acceptance criteria.

4.1.4.4 Prepare and execute the deployment of all system releases monthly and create release notes. Submit the release notes to the Project Manager for review 2 business days prior to release and a finalized version within 1 business day following a release, if anything changed during the release process.

4.1.5 Provide technical assistance in troubleshooting and resolving problems or symptoms with the systems, as well as answering questions regarding documented properties, methods, events, function calls, parameters, and specific functionality of software components. Technical support shall be available, via telephone and/or online support, Monday-Friday, 7AM – 6PM ET. The contractor shall acknowledge receipt of all inquiries within 1 business day.

4.1.6 Ensure case management systems are maintained to operate in compliance with DMDC infrastructure standards. Currently the case management systems are hosted at the Denver Data Center (DDC) and it is anticipated that during the performance of this contract they will be moving to a DISA Enterprise Computer Center.

4.1.7 Attend Change Control Board meetings to provide technical level of effort on system change requests.

4.2 System Documentation

4.2.1 Update case management system user guides in the form of a web linked document and/or appropriate “Help” screens embedded in the solution’s functionality. Guidance shall provide end users with instructional information necessary to navigate the various functional components of the software. Updates shall be accomplished within seven calendar days of significant system changes.

4.2.2 Provide support for system development lifecycle documentation and maintain system architecture artifacts to include:

• Privacy Impact Assessment

• Systems of Record Notification

• Paperwork Reduction Act

• Business Enterprise Architecture Compliance

• Memorandums of Understanding/Agreement

• Security Agreements

• Section 508 Compliance

• Clinger Cohen Act

• Other applicable documents, see Section 13.0

4.3 Disaster Recovery

4.3.1 Support DMDC Disaster Recovery Exercises to ensure that adequate procedures, capabilities, and safeguards exist for the timely recovery of the DMDC EHRIS case management systems at the Disaster Recovery site.

4.3.2 In the event of a failover, support the Disaster Recover activities to ensure that the case management systems are restored to full operation at the Disaster Recovery site.

4.4 System Security

4.4.1 Assist in establishing and updating Risk Management Framework (RMF) Authorization to Operate (ATO) to comply with DOD directives per Section 13.0.

4.4.1.1 Support the RMF continuous monitoring to identify, analyze and remediate vulnerabilities.

4.4.1.2 Establish Plan of Action and Milestones (POA&Ms) and Security Technical Implementation Guide (STIG) Deviations. POA&M shall be completed within 5 business days following each system scan and remediation action or STIG Deviation.

4.4.2 Support DMDC Cyber Hardening Policy to comply with DMDC Policy and DOD Directives per Section 13.0.

4.4.3 Generate system certificate requests and install certificates.

4.5 Monthly Status Reports

Provide Monthly Status Reports to the Contracting Officer’s Representative (COR). Reports should contain the current status of each task as well as indicate the work accomplished on the task the previous month. In cases where a task is not complete or has been broken down into subtasks, the target completion date for both the task and each subtask should also be included.

4.6 Post-Award Conference

The Contractor shall attend a Post-Award Conference with the COR and the CO. The purpose of the Post-Award Conference is to review contract requirements, obtain required Government- Furnished Information (GFI) documentation, discuss visitor policies and security access issues, project schedule, Key and non-Key personnel, and other topics relevant to contract performance.

The Contractor shall provide concurrence with the date, time and location for the meeting via email notification to the CO at least three (3) business days prior to the scheduled meeting.

4.7 Transition Period

4.7.1 Transition-Out. At least 6 months prior to contract expiration, provide a plan for transition out to ensure minimum disruption to vital Government business.

4.7.2 The Contractor shall negotiate in good faith, a plan with a successor to determine the extent of phase-in, phase-out services required.

4.7.3 The Contractor shall furnish phase-in training and exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

4.7.4 This plan shall address how the Contractor will work with the follow-on contractor and Government personnel to ensure that there will be no service degradation during and after the transition period transition-out period (21-day period prior to date of contract expiration).

4.7.5 The plan shall include a training program and a date for transferring responsibilities for each division of work described in the plan, and shall be subject to the Contracting Officer’s approval.

4.7.6 The Contractor shall provide sufficient experienced personnel to ensure that the services are maintained at the required level of proficiency.

4.7.7 The Contractor shall disclose necessary personnel records and allow the successor to conduct on-site interviews with its employees, and if selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date.

5.0 DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last work day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the Government Program Manager. Unless otherwise stated, day means business day.

Deliverable PWS Ref. Delivery Date Briefing Materials 4.1.4.2 At least 2 days prior to sprint review UAT documentation 4.1.4.3 No more than one day following sprint review Release Notes 4.1.4.4 Draft due 2 business days for review and final due 1 day following release

Deliverable PWS Ref. Delivery Date Update user guides 4.2.1 One week following any significant system enhancement POA&M documentation 4.4.1.2 Within 5 business days following each system scan and remediation action

Monthly Status Report 4.5 First business day of each month

Quality Control Plan 10.0 No later than 30 days after award

6.0 CONTRACTOR MANPOWER REPORTING

Contractor Inventory. In accordance with Section 8108 of Public Law 112-10 of the Department of Defense and Full-Year Continuing Appropriations Action, 2011.

6.1 The contractor shall report all labor hours required for performance of services provided under this task order via the secure Contractor Manpower Reporting Application (CMRA) data collection site. The contractor is required to completely fill in all required data fields at http://www.ecmra.mil. Reporting inputs shall be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September.

While inputs may be reported anytime during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor may direct questions to the CMRA help desk. The prime contractor is responsible to ensure all subcontractor data is reported.

6.2 User Manual. Data for the DHRA services requirements must be input at the “All Other Defense Components” CMRA link. However, user manuals for Government personnel and contractors are available at the U.S. Army CMRA link at http://www.ecmra.mil.

6.3 Subcontractor Input in CMRA. Prime contractors are responsible to ensure all subcontractor data is reported. Subcontractors will not be able to enter any data into CMRA, but will enter their information into a Bulk Loader spread sheet available from the CMRA helpdesk. Subcontractor shall fill in columns A-C then return it to the CMRA helpdesk after it's completed and a technician team will enter the information into CMRA.

7.0 CONTRACTOR TRAVEL

Travel is not anticipated during the performance of this contract. Should travel become required, a contract modification will be accomplished to incorporate funding for travel. Should travel be required, the Contractor shall be required to travel to attend meetings in support of tasks listed above to fulfill PWS requirements. All trips will be in accordance with regulatory requirements and actual travel shall be coordinated and pre-approved by the Government COR in writing.

Additionally, should travel be added at a later date, the Government will only reimburse allowable costs in accordance with FAR Clause 31.205-46 and the current Joint Travel Regulation. The Contractor shall bill and will be reimbursed at the Contractor's actual cost and per diem, no profit or fee shall be added. The Contractor shall be required to provide travel http://www.ecmra.mil/ receipts to the COR as attachments in WAWF for all allowable costs. Travel projections are subject to change based on Government requirements.

8.0 SECURITY. The Contractor shall:

8.1 Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of Government data.

8.1.1 Comply with:

• DoD Instruction (DoDI) 8500.1, Cybersecurity

• The Privacy Act (5 U.S.C. 552a)

• DoD 5400.11-R, and DoD Directive 5400.11, DoD Privacy Program

• DoD 6025.18-R, DoD Health Information Privacy Regulation

• DoD 5200.02, Procedures for the DoD Personnel Security Program; and

• HSPD-12, Homeland Security Presidential Directive.

8.1.2 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) for DMDC and:

8.1.2.1Be responsible for obtaining CAC or PIV ready status prior to reporting for work. At a minimum, all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing.

8.1.2.2 Be citizens of the United States.

8.1.2.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

8.2 If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the DMDC Information Systems Security Group (DISSG) and remove such person from work under this contract.

8.3 Immediately report the discovery of any Privacy breach first to the DMDC CIO/ Privacy Office and secondly to the COR.

8.4 Meet and maintain DoD cybersecurity requirements and certifications for all cybersecurity positions (full time and embedded). Provide documentation supporting the cybersecurity certification status of personnel performing cybersecurity functions, upon request. Contractor Personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions. All personnel are required to obtain and maintain the appropriate certifications applicable to their system responsibilities in accordance with Attachment B.

8.5 Abide by the DMDC Information Systems Acceptable Use Policy (AUP) and Acknowledgement of Basic User Responsibilities and Agreement. If contractor has elevated access to DMDC systems and networks, abide by the DMDC Privileged-Level Access Agreement and Acceptable Use Policy. All personnel are required to obtain and maintain the appropriate certifications applicable to their system responsibilities in accordance with Attachment B.

8.6 Complete all DoD Computer User Training as required by DoD and/or DHRA.

8.7 Perform offsite work with Personally Identifiable Information (PII) only on systems and platform information technology (PIT) systems that meet RMF (formerly Defense Information Assurance Certification and Accreditation Process (DIACAP)) for DoD Information Technology (IT) requirements. Systems previously certified under DIACAP must be current but cannot exceed an ATO date later than October 2016. Such information systems and PIT systems will be updated on an on-going basis to continue to meet applicable RMF requirements. Systems must have and maintain an ATO or, if acceptable to the Government under DIACAP, an Interim Authority to Operate (IATO) not to exceed the October 2016 time frame.

8.8 Contractor systems and information networks that receive, transmit, store, or process nonpublic Government data must be accredited according to DoDI 8510.01 "Risk Management Framework for DoD IT” (formally DIACAP) and comply with annual Federal Information Security Management Act (FISMA) security control testing. All systems subject to RMF must present evidence of authorization in the security plan, Security Assessment Report (SAR) POA&M and authorization decision document or show that the system has successfully gone through the RMF process in order to integrate information security and risk management activities into the system’s life cycle. The RMF decision must be current and cannot exceed a 3 year timeframe. Evidence of FISMA compliance must be presented in the form of a POA&M.

The Contractor will be responsible for the cost of RMF processes and FISMA testing required for any Contractor owned and operated network, facility and/or application processing DoD information.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION

(GFP/GFE/GFI)

9.1 The Government will provide each contractor employee with a laptop equipped with virtual private network capability for the work to be performed, or if the work is sensitive in nature and performed in a location other than a DMDC office. The laptop will contain all software required to perform the work assigned. When in DMDC office space, contractor personnel will have access to the Internet, other office software, telephones, fax machines, scanners, and printers necessary to conduct their required work.

9.2 The contractor personnel will be provided the authority to access all information required to perform duties. The Government point-of-contact will provide coordination and assistance to the contractor personnel in accessing required information and meetings.

9.3 The Government will provide the specific information, functional and program documentation, requirements, manuals, texts, access to relevant Government organizations and individuals, and briefs and other associated materials necessary to perform required work.

10.0 QUALITY CONTROL

The Contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract. The quality control plan shall be submitted to the Contracting Officer for review and approval no later than 30 days after contract award.

11.0 ADMINISTRATION CONSIDERATIONS:

11.1 Place of performance: The Contractor shall be located off-site, not at a Government facility, to perform and accomplish tasks identified in this contract.

11.2 Telework: The Contractor shall determine the frequency their personnel are allowed to telework.

11.3 Base Shutdown/Inclement Weather: The Contractor will follow guidance of the installation containing their place of performance to determine reporting schedules whether due to a base closure or inclement weather. The website for guidance regarding status of performance in the National Capitol Region (NCR) is http://www.opm.gov/status/. In all cases, if Government personnel are not available in the building/location of work to oversee Contractor activities, Contractor personnel shall leave/vacate the premises.

11.4 Contractor Identification. Each contractor employee shall, while on duty, wear in plain view on the upper portion of his outer garment a metal or plastic identification badge to be furnished by the contractor, containing the company name, employee name, and the section where the employee works. Contractor employees shall clearly identify themselves as "Contractors" at all times, in all communications and representations, including in the workplace, at meetings, in conversations, telecommunications, mail, electronic mail (e-mail), and faxes, whether with Government personnel, other contractor personnel, or with the public. Contractors with access to the base Local Area Network (LAN) or with an official Government e-mail address shall include their company name in the signature block and the designation "CTR" in the global address. The Contractor shall notify the Government if the "CTR" designation is not included in the global address.

12.0 HUMAN RESOURCE MANAGEMENT. The contractor shall:

12.1 Personnel Qualifications. Provide qualified personnel that meet or exceed the stated Knowledge, Skills, and Abilities (KSA) and education qualification requirements in the offeror’s proposal which was considered as an evaluation factor relevant to the award decision and incorporated into the resulting award.

12.2 Personnel Maintenance. Maintain minimal personnel turnover throughout the life of the contract. Ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal. Once a contractor knows that an employee is leaving and will no longer support a task, the contractor shall provide written documentation to the CO and COR within three (3) business days of the employee advising the contractor of his/her intent to leave. This written notification shall include the date and time the position will be vacant, the reason the employee will no longer work on the task, anticipated replacement date, and what management corrective action will be taken to ensure task mission completion. Position vacancies or absences shall not exceed 14 calendar days unless approved in writing or otherwise approved in advance by the CO.

13.0 APPLICABLE DOCUMENTS

http://www.opm.gov/status/

Document Web link DoD 5200.01, Vol. 4, February 24, 2012, DoD Information Security Program: Controlled Unclassified Information (CUI) http://www.dtic.mil/whs/directives/corres/pdf/520 001_vol4.pdf

DoDI 5200.44, November 5, 2012, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN) http://www.dtic.mil/whs/directives/corres/pdf/520 044p.pdf

DoDI 8000.01, February 10, 2009, Management of the Department of Defense Information Enterprise http://www.dtic.mil/whs/directives/corres/pdf/800 001p.pdf

DoDI 8500.01, March 14, 2014, Cyber Security http://www.dtic.mil/whs/directives/corres/pdf/850 001_2014.pdf

DoDI 8510.01, March 12, 2014, Risk Management Framework (RMF) for DoD Information Technology (IT) http://www.dtic.mil/whs/directives/corres/pdf/851 001_2014.pdf

DoDI 8520.02, May 23, 2011, Public Key Infrastructure (PKI) and Public Key (PK) Enabling http://www.dtic.mil/whs/directives/corres/pdf/852 002p.pdf

DoDI 8520.03, May 13, 2011, Identify Authentication for Information Systems http://www.dtic.mil/whs/directives/corres/pdf/852 003p.pdf

DoD O-8530.01-M, December 17, 2002, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program http://www.dtic.mil/whs/directives/corres/pdf/O85 3001M_placeholder.pdf

DoDI O-8530.2, March 9, 2001, Support to Computer Network Defense (CND) http://www.dtic.mil/whs/directives/corres/pdf/O85 302p_placeholder.pdf

DoDI 8550.01, September 11, 2012, DoD Internet Services and Internet-Based Capabilities http://www.dtic.mil/whs/directives/corres/pdf/855 001p.pdf

DoDI 8551.01, May 28, 2014, Ports, Protocols and Services (PPSM) http://www.dtic.mil/whs/directives/corres/pdf/855 101p.pdf

DoDD 8570.01, August 15, 2004, Information Assurance (IA) Training, Certification, and Workforce Management http://www.dtic.mil/whs/directives/corres/pdf/857 001p.pdf

DoD 8570.01-M, December 19, 2005, Information Assurance Workforce Improvement Program http://www.dtic.mil/whs/directives/corres/pdf/857 001m.pdf

DoDI 8580.1, July 9, 2004, Information Assurance (IA) in the Defense Acquisition System http://www.dtic.mil/whs/directives/corres/pdf/858 001p.pdf

DoDI 8582.01, June 6, 2012, Security of Unclassified DoD Information on Non-DoD Information Systems http://www.dtic.mil/whs/directives/corres/pdf/858 201p.pdf

DoD 5200.02, April 3, 2017, Procedures for the DoD Personnel Security Program http://www.dtic.mil/whs/directives/corres/pdf/520 002_dodm_2017.pdf

DoDD 5400.07, January 2, 2008, DoD http://www.dtic.mil/whs/directives/corres/pdf/540 http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf http://www.dtic.mil/whs/directives/corres/pdf/520044p.pdf http://www.dtic.mil/whs/directives/corres/pdf/520044p.pdf http://www.dtic.mil/whs/directives/corres/pdf/800001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/800001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf http://www.dtic.mil/whs/directives/corres/pdf/852002p.pdf http://www.dtic.mil/whs/directives/corres/pdf/852002p.pdf http://www.dtic.mil/whs/directives/corres/pdf/852003p.pdf http://www.dtic.mil/whs/directives/corres/pdf/852003p.pdf http://www.dtic.mil/whs/directives/corres/pdf/O853001M_placeholder.pdf http://www.dtic.mil/whs/directives/corres/pdf/O853001M_placeholder.pdf http://www.dtic.mil/whs/directives/corres/pdf/O85302p_placeholder.pdf http://www.dtic.mil/whs/directives/corres/pdf/O85302p_placeholder.pdf http://www.dtic.mil/whs/directives/corres/pdf/855001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/855001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/855101p.pdf http://www.dtic.mil/whs/directives/corres/pdf/855101p.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf http://www.dtic.mil/whs/directives/corres/pdf/858001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/858001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/858201p.pdf http://www.dtic.mil/whs/directives/corres/pdf/858201p.pdf http://www.dtic.mil/whs/directives/corres/pdf/520002_dodm_2017.pdf http://www.dtic.mil/whs/directives/corres/pdf/520002_dodm_2017.pdf http://www.dtic.mil/whs/directives/corres/pdf/540007p.pdf

Freedom of Information Act 007p.pdf DoD 5400.7-R, September 4, 1998, DoD Freedom of Information Act Program http://www.dtic.mil/whs/directives/corres/pdf/540 007r.pdf

DoDD 5400.11, May 14, 2007, DoD Privacy Program http://www.dtic.mil/whs/directives/corres/pdf/540 011p.pdf

DoDI 5400.16, February 12, 2009, DoD Privacy Impact Assessment (PIA) Guidance http://www.dtic.mil/whs/directives/corres/pdf/540 016p.pdf

CJCSI 6510.01E, August 15, 2007, Information Assurance (IA) and Computer Network Defense (CND) http://www.dtic.mil/cjcs_directives/cdata/unlimit/ 6510_01.pdf

NIST Special Publication (SP) 800-37, February 2012, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems http://csrc.nist.gov/publications/PubsSPs.html

NIST Special Publication (SP) 800-53, April 30, 2013, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations http://csrc.nist.gov/publications/PubsSPs.html

DoD 6025.18-R, January 2033, DoD Health Information Privacy Regulation http://www.dtic.mil/whs/directives/corres/pdf/602 518r.pdf

DMDC Policy on Application Cyber Hardening

N/A

DoDI 5000.02 Operation of the Defense Acquisition System http://www.dtic.mil/whs/directives/corres/pdf/500 002_dodi_2015.pdf

DoDI 5000.75, Business Systems Requirements and Acquisition http://www.dtic.mil/whs/directives/corres/pdf/500 075_dodi_2017.pdf

Attachment A

Performance Requirements Summary

Performance Objective PWS Paragraph Performance Standard/Acceptable Quality Level Planned System Outages 4.1.3 No more than one instance per month where the contractor failed to notify the PM of system outage within 72 hours for planned system outage

Emergency System Outages

4.1.3 Zero instances where the contractor failed to

notify the PM within 1 hour of their knowledge of a system outage.

Briefing Materials for sprint reviews

4.1.4.2 No more than two instances in a year that the

contractor failed to submit a full briefing package at least 2 business days prior to the sprint review.

http://www.dtic.mil/whs/directives/corres/pdf/540007p.pdf http://www.dtic.mil/whs/directives/corres/pdf/540007r.pdf http://www.dtic.mil/whs/directives/corres/pdf/540007r.pdf http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf http://www.dtic.mil/whs/directives/corres/pdf/540016p.pdf http://www.dtic.mil/whs/directives/corres/pdf/540016p.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/6510_01.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/6510_01.pdf http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html http://www.dtic.mil/whs/directives/corres/pdf/602518r.pdf http://www.dtic.mil/whs/directives/corres/pdf/602518r.pdf http://www.dtic.mil/whs/directives/corres/pdf/500002_dodi_2015.pdf http://www.dtic.mil/whs/directives/corres/pdf/500002_dodi_2015.pdf http://www.dtic.mil/whs/directives/corres/pdf/500075_dodi_2017.pdf http://www.dtic.mil/whs/directives/corres/pdf/500075_dodi_2017.pdf

User Acceptance Testing documentation

4.1.4.3 No more than two a quarter where the Contractor

failed to provide User Acceptance Testing documentation within 1 day. 100% zero instances where contractor failed to submit User Acceptance Testing documentation.

Release Notes 4.1.4.4 No more than 2 instances annually where the contractor failed to provide the release notes to the PM 2 business days prior to release for review and 1 day following release

Unlimited Business-Day Telephone and/or Online Support

4.1.5 No more than once a month the contractor failed

to respond with at least acknowledgement of receipt within 1 business day

Update User Guides 4.2.1 No more than one instance annually that contractor failed to update user guides within one week of significant system changes

POA&M

Documentation

4.4.1.2 No more than two instances a quarter (Sep – Nov, Dec – Feb, Mar – May, Jun – Aug) where the contractor failed to provide POA&M documentation completed within 5 business days following each system scan and remediation action; and Zero instances where the contractor failed to submit a POA&M or STIG Deviation.

Attachment B

DoD Approved 8570.01-M Certification Requirements

This attachment identifies categories and specialties within the IA workforce. Categories are IA Technical (IAT) and IA Management (IAM). IA duties may be performed as primary or additional/embedded duties. All personnel directly supporting these systems as described in the PWS will have either Level I or Level II IA duties.

Within 6 months of assignment of duties, all IAT personnel must achieve the appropriate IA certification. All IA workforce personnel must maintain their certifications as required by their certification providers to retain their position. All personnel must agree to release their IA baseline certification qualification(s) to the Department of Defense through the Defense Workforce Certification Application (DWCA).

An individual needs to obtain and maintain only one (1) of the approved IA baseline certifications listed below for his or her IA category or specialty and level to meet the minimum requirement. For example, an individual in an IAT Level II position could obtain any one of the four certifications listed in the IAT Level II cell.

Higher level IAT and IAM certifications satisfy lower level requirements. Certifications listed in Level II or III cells can be used to qualify for Level I. However, Level I certifications cannot be used for Level II or III unless the certification is also listed in the Level II or III cell.

In addition to the IA baseline certification requirement for their level, IATs with privileged access must obtain appropriate Computing Environment (CE) certifications for the operating system(s) and/or security related tools/devices they support.

IA Workforce Level High-Level Responsibilities Baseline Certifications

IAT Level I IAT Level I personnel make the CE less vulnerable by correcting flaws and implementing IAT controls in the hardware or software installed within their operational systems.

A+CE

CCNA-Security Network + CE

SSCP

IAT Level II IAT Level II personnel provide network environment

(NE) and advanced level CE support. They pay special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured. These positions focus on threats and vulnerabilities and improve the security of systems.

CCNA-Security

GICSP

GSEC

Security+ CE

SSCP

IAT Level III Not applicable for this contract CASP CE

CISA

CISSP (or Associate)

GCED

GCIH

IAM Level I IAM Level I personnel are responsible for the implementation and operation of a DoD IS or system DoD Component within their CE. Personnel ensure that IA related information system (IS) are functional and secure within the CE

CAP

GSLC

Security+ CE

IAM Level II IAM Level II personnel are responsible for the IA program of an IS within the NE. Personnel in these positions perform a variety of security related tasks, including the development and implementation of system information security standards and procedures. They ensure that IS are functional and secure within the NE

CAP

CASP CE

CISM

CISSP (or Associate)

GSLC

Attachment C

Work load Estimates CMTS, IRCMS and DIUCS Type of System Update Frequency Base Year Frequency Option Year 1

Bug Defect 10/month/all systems 15/month/all systems

Change Request/Enhancement 15/month/all systems 22/month/all systems

SECTION 508 ACCESSIBILITY STANDARDS

The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable to this acquisition.

Technical Standard

Type of system updates Definition

Bug Defect Updates to address system functionality and corrective action taken if something is incorrectly displayed. Defined in detail as “Corrective Maintenance” - modifications to correct defects in the system, which prevent the system from operating or functioning as intended. Such defects may stem from errors in the requirements, design, or production baselines.

COTS component updates and patches Applying updates to all COTS components to include entellitrak software, SQL & Oracle Databases, Apache, Java, middleware

Change Request/Enhancement To improve (enhance) or augment functionality. Defined in detail as “Adaptive Maintenance” - modifications to keep the system usable in a changed or changing environment. This includes modifications to accommodate sustained interoperability with external systems, such as when external systems implement changes to data structures that impact exchanged data. This also includes modifications to existing business rules, data structures, processing logic, and output products (e.g. reports) that do not introduce new functionality, but update existing functionality to conform to changes in the related business environment (e.g. Laws, Regulations, and Policies).

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

1194.25 - Self-Contained, Closed Products

1194.26 - Desktop and Portable Computers

1194.41 - Information, Documentation and Support Functional Performance Criteria

1194.31 - Functional Performance Criteria

(End of Summary of Changes)