H98210-17-R-0030.docx
DOCX document 169 KB Posted
- Solicitation number
- H9821017R0030
- Issued by
-
Defense Human Resources Activity
About this file
SF1449
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Amendment_02.pdf | ||
| Attachment_3_Questions_and_Government_Responses.pdf | ||
| Attachment_2_PPQ_dtd_12_Jan_18.pdf | ||
| Attachment_1.pdf | ||
| Attachment_2.pdf | ||
| Amendment_01.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
H9821017R0030
Section SF 1449 - CONTINUATION SHEET
NOTICE TO OFFEROR(S)
NOTICE TO OFFEROR(S)/SUPPLIER(S):
Funds are not presently available for this effort. No award will be made under this solicitation until funds are available. The Government reserves the right to cancel this solicitation, either before or after the clsoing date. In the event the Government cancels this solicitation, the Government has no obligation to remiburse an offeror for any costs.
| ITEM NO |
| SUPPLIES/SERVICES |
| QUANTITY |
| UNIT |
| UNIT PRICE |
| AMOUNT |
| 12 |
| Months |
IRCMS/CMTS Support Management & Service
FFP
Investigations & Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS) Management and Service (FFP) in accordance with the Performance Work Statement (PWS) FOB: Destination
NET AMT
| ITEM NO |
| SUPPLIES/SERVICES |
| QUANTITY |
| UNIT |
| UNIT PRICE |
| AMOUNT |
| 1 |
| Each |
DIUCS Support Management & Service
FFP
Defense Injury & Unemployment Compensation System (DIUCS) Support Management & Service (FFP) in accordance with the Performance Work Statement (PWS)
NET AMT
| ITEM NO |
| SUPPLIES/SERVICES |
| QUANTITY |
| UNIT |
| UNIT PRICE |
| AMOUNT |
| 12 |
| Months |
| OPTION |
| IRCMS/CMTS/DIUCS Support Mngmt Services |
FFP
Investigations & Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS) and Defense Injury & Unemployment Compensation System (DIUCS) Support Management & Service (FFP) in accordance with the Performance Work Statement (PWS)
Option Year 1
NET AMT
| ITEM NO |
| SUPPLIES/SERVICES |
| QUANTITY |
| UNIT |
| UNIT PRICE |
| AMOUNT |
| 12 |
| Months |
| OPTION |
| IRCMS/CMTS/DIUCS Support Mngmt Services |
FFP
Investigations & Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS) and Defense Injury & Unemployment Compensation System (DIUCS) Support Management & Service (FFP) in accordance with the Performance Work Statement (PWS)
Option Year 2
NET AMT
| ITEM NO |
| SUPPLIES/SERVICES |
| QUANTITY |
| UNIT |
| UNIT PRICE |
| AMOUNT |
| 12 |
| Months |
| OPTION |
| IRCMS/CMTS/DIUCS Support Mngmt Services |
FFP
Investigations & Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS) and Defense Injury & Unemployment Compensation System (DIUCS) Support Management & Service (FFP) in accordance with the Performance Work Statement (PWS)
Option Year 3
NET AMT
| ITEM NO |
| SUPPLIES/SERVICES |
| QUANTITY |
| UNIT |
| UNIT PRICE |
| AMOUNT |
| 12 |
| Months |
| OPTION |
| IRCMS/CMTS/DIUCS Support Mngmt Services |
FFP
Investigations & Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS) and Defense Injury & Unemployment Compensation System (DIUCS) Support Management & Service (FFP) in accordance with the Performance Work Statement (PWS)
Option Year 4
NET AMT
INSPECTION AND ACCEPTANCE TERMS
Supplies/services will be inspected/accepted at:
| CLIN |
| INSPECT AT |
| INSPECT BY |
| ACCEPT AT |
| ACCEPT BY |
| 0001 |
| Destination |
| Government |
| Destination |
| Government |
| 0002 |
| Destination |
| Government |
| Destination |
| Government |
| 1001 |
| Destination |
| Government |
| Destination |
| Government |
| 2001 |
| Destination |
| Government |
| Destination |
| Government |
| 3001 |
| Destination |
| Government |
| Destination |
| Government |
| 4001 |
| Destination |
| Government |
| Destination |
| Government |
PERFORMANCE WORK STATEMENT
Performance Work Statement (PWS) Investigations and Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS), and Defense Injury and Unemployment Compensation System (DIUCS) Program Support Services, Technical Services, and System Sustainment
1.0 INTRODUCTION
The Defense Manpower Data Center (DMDC) Enterprise Human Resources Information Systems (EHRIS) Directorate requires program support services, technical services, and system sustainment for Department of Defense (DoD) enterprise human resources (HR) case management systems.
2.0 BACKGROUND
Starting in 2009, DMDC procured three implementations of the commercial off-the-shelf (COTS) solution, entellitrakTM, with a one-time license user fee that has been purchased, and has configured each solution to meet Department of Defense (DoD) required capabilities. These capabilities are identified into three different DoD enterprise HR case management systems: Investigations and Resolutions Case Management System (IRCMS), Case Management Tracking System (CMTS), and Defense Injury and Unemployment Compensation System (DIUCS). DMDC requires the sustainment support to continue providing HR capabilities through case management systems to the DoD Civilian workforce, ultimately supporting the warfighter.
3.0 SCOPE
The Contractor shall provide the personnel, management and materials necessary to successfully provide management and IT services support as detailed in sections 4.1, 4.2, 4.3, 4.4, 4.5 and 4.6.
4.0 REQUIREMENTS The Contractor shall:
Support and sustain DMDC case management systems to include IRCMS, CMTS, and DIUCS built on the COTS solution, entellitrakTM. Support for IRCMS and CMTS will begin in the base year, whereas support for the DIUCS will begin August 18, 2018, following the end of the current DIUCS contract.
4.1 System Sustainment activities
4.1.1 Provide software technical support and interface functionality to the configured solution to include Bug fixes and Change requests and enhancements, see Attachment C. The contractor isn’t responsible for bug fixes, change requests, and enhancements to the Core COTS solutions.
4.1.2 Perform all software maintenance, including installation, testing, add or amend business rules/processes, and deploy software upgrades and patches to the Core COTS solution.
4.1.3 Provide communication to the project managers on system outages to include:
· 72 hours prior to scheduled outages; and
· Within 1 hour of identified emergency issues.
4.1.4 Utilize Agile Methodology to conduct sustainment operations. The Government Program Manager and contractor will agree to the review, deliverable cycle, due dates, and document via email to the COR.
4.1.4.1 Support product backlog reviews and refinement of requirements by providing level of effort for system changes (sprint cycle varies per system).
4.1.4.2 Facilitate the cycle review to include briefing materials. Briefing materials include description of the user stories, the acceptance criteria, and a demonstration or explanation on how the story was completed. The user story will then either be deemed accepted or failed by the Government Functional and Technical POC.
4.1.4.3 Prepare User Acceptance Testing (UAT) documentation to include testing procedures and acceptance criteria.
4.1.4.4 Prepare and execute the deployment of all system releases monthly and create release notes. Submit the release notes to the Project Manager for review 2 business days prior to release and a finalized version within 1 business day following a release, if anything changed during the release process.
4.1.5 Provide technical assistance in troubleshooting and resolving problems or symptoms with the systems, as well as answering questions regarding documented properties, methods, events, function calls, parameters, and specific functionality of software components. Technical support shall be available, via telephone and/or online support, Monday-Friday, 7AM – 6PM ET. The contractor shall acknowledge receipt of all inquiries within 1 business day.
4.1.6 Ensure case management systems are maintained to operate in compliance with DMDC infrastructure standards. Currently the case management systems are hosted at the Denver Data Center (DDC) and it is anticipated that during the performance of this contract they will be moving to a DISA Enterprise Computer Center.
4.1.7 Attend Change Control Board meetings to provide technical level of effort on system change requests.
4.2 System Documentation
4.2.1 Update case management system user guides in the form of a web linked document and/or appropriate “Help” screens embedded in the solution’s functionality. Guidance shall provide end users with instructional information necessary to navigate the various functional components of the software. Updates shall be accomplished within seven calendar days of significant system changes.
4.2.2 Provide support for system development lifecycle documentation and maintain system architecture artifacts to include:
· Privacy Impact Assessment
· Systems of Record Notification
· Paperwork Reduction Act
· Business Enterprise Architecture Compliance
· Memorandums of Understanding/Agreement
· Security Agreements
· Section 508 Compliance
· Clinger Cohen Act
· Other applicable documents, see Section 13.0
4.3 Disaster Recovery
4.3.1 Support DMDC Disaster Recovery Exercises to ensure that adequate procedures, capabilities, and safeguards exist for the timely recovery of the DMDC EHRIS case management systems at the Disaster Recovery site.
4.3.2 In the event of a failover, support the Disaster Recover activities to ensure that the case management systems are restored to full operation at the Disaster Recovery site.
4.4 System Security
4.4.1 Assist in establishing and updating Risk Management Framework (RMF) Authorization to Operate (ATO) to comply with DOD directives per Section 13.0.
4.4.1.1 Support the RMF continuous monitoring to identify, analyze and remediate vulnerabilities.
4.4.1.2 Establish Plan of Action and Milestones (POA&Ms) and Security Technical Implementation Guide (STIG) Deviations. POA&M shall be completed within 5 business days following each system scan and remediation action or STIG Deviation.
4.4.2 Support DMDC Cyber Hardening Policy to comply with DMDC Policy and DOD Directives per Section 13.0.
4.4.3 Generate system certificate requests and install certificates.
4.5 Monthly Status Reports
Provide Monthly Status Reports to the Contracting Officer’s Representative (COR). Reports should contain the current status of each task as well as indicate the work accomplished on the task the previous month. In cases where a task is not complete or has been broken down into subtasks, the target completion date for both the task and each subtask should also be included.
4.6 Post-Award Conference
The Contractor shall attend a Post-Award Conference with the COR and the CO. The purpose of the Post-Award Conference is to review contract requirements, obtain required Government-Furnished Information (GFI) documentation, discuss visitor policies and security access issues, project schedule, Key and non-Key personnel, and other topics relevant to contract performance. The Contractor shall provide concurrence with the date, time and location for the meeting via email notification to the CO at least three (3) business days prior to the scheduled meeting.
5.0 DELIVERABLES
The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last work day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the Government Program Manager. Unless otherwise stated, day means business day.
| Deliverable |
| PWS Ref. |
| Delivery Date |
| Briefing Materials |
| 4.1.4.2 |
| At least 2 days prior to sprint review |
| UAT documentation |
| 4.1.4.3 |
| No more than one day following sprint review |
| Release Notes |
| 4.1.4.4 |
| Draft due 2 business days for review and final due 1 day following release |
| Update user guides |
| 4.2.1 |
| One week following any significant system enhancement |
| POA&M documentation |
| 4.4.1.2 |
| Within 5 business days following each system scan and remediation action |
| Monthly Status Report |
| 4.5 |
| First business day of each month |
| Quality Control Plan |
| 10.0 |
| No later than 30 days after award |
6.0 CONTRACTOR MANPOWER REPORTING
Contractor Inventory. In accordance with Section 8108 of Public Law 112-10 of the Department of Defense and Full-Year Continuing Appropriations Action, 2011.
6.1 The contractor shall report all labor hours required for performance of services provided under this task order via the secure Contractor Manpower Reporting Application (CMRA) data collection site. The contractor is required to completely fill in all required data fields at http://www.ecmra.mil. Reporting inputs shall be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported anytime during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor may direct questions to the CMRA help desk. The prime contractor is responsible to ensure all subcontractor data is reported.
6.2 User Manual. Data for the DHRA services requirements must be input at the “All Other Defense Components” CMRA link. However, user manuals for Government personnel and contractors are available at the U.S. Army CMRA link at http://www.ecmra.mil.
6.3 Subcontractor Input in CMRA. Prime contractors are responsible to ensure all subcontractor data is reported. Subcontractors will not be able to enter any data into CMRA, but will enter their information into a Bulk Loader spread sheet available from the CMRA helpdesk. Subcontractor shall fill in columns A-C then return it to the CMRA helpdesk after it's completed and a technician team will enter the information into CMRA.
7.0 CONTRACTOR TRAVEL
Travel is not anticipated during the performance of this contract. Should travel become required, a contract modification will be accomplished to incorporate funding for travel. Should travel be required, the Contractor shall be required to travel to attend meetings in support of tasks listed above to fulfill PWS requirements. All trips will be in accordance with regulatory requirements and actual travel shall be coordinated and pre-approved by the Government COR in writing. Additionally, should travel be added at a later date, the Government will only reimburse allowable costs in accordance with FAR Clause 31.205-46 and the current Joint Travel Regulation. The Contractor shall bill and will be reimbursed at the Contractor's actual cost and per diem, no profit or fee shall be added. The Contractor shall be required to provide travel receipts to the COR as attachments in WAWF for all allowable costs. Travel projections are subject to change based on Government requirements.
8.0 SECURITY. The Contractor shall:
8.1 Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of Government data.
8.1.1 Comply with:
· DoD Instruction (DoDI) 8500.1, Cybersecurity
· The Privacy Act (5 U.S.C. 552a)
· DoD 5400.11-R, and DoD Directive 5400.11, DoD Privacy Program
· DoD 6025.18-R, DoD Health Information Privacy Regulation
· DoD 5200.02, Procedures for the DoD Personnel Security Program; and
· HSPD-12, Homeland Security Presidential Directive.
8.1.2 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) for DMDC and:
8.1.2.1Be responsible for obtaining CAC or PIV ready status prior to reporting for work. At a minimum, all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing.
8.1.2.2 Be citizens of the United States.
8.1.2.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.
8.2 If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the DMDC Information Systems Security Group (DISSG) and remove such person from work under this contract.
8.3 Immediately report the discovery of any Privacy breach first to the DMDC CIO/ Privacy Office and secondly to the COR.
8.4 Meet and maintain DoD cybersecurity requirements and certifications for all cybersecurity positions (full time and embedded). Provide documentation supporting the cybersecurity certification status of personnel performing cybersecurity functions, upon request. Contractor Personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions. All personnel are required to obtain and maintain the appropriate certifications applicable to their system responsibilities in accordance with Attachment B.
8.5 Abide by the DMDC Information Systems Acceptable Use Policy (AUP) and Acknowledgement of Basic User Responsibilities and Agreement. If contractor has elevated access to DMDC systems and networks, abide by the DMDC Privileged-Level Access Agreement and Acceptable Use Policy. All personnel are required to obtain and maintain the appropriate certifications applicable to their system responsibilities in accordance with Attachment B.
8.6 Complete all DoD Computer User Training as required by DoD and/or DHRA.
8.7 Perform offsite work with Personally Identifiable Information (PII) only on systems and platform information technology (PIT) systems that meet RMF (formerly Defense Information Assurance Certification and Accreditation Process (DIACAP)) for DoD Information Technology (IT) requirements. Systems previously certified under DIACAP must be current but cannot exceed an ATO date later than October 2016. Such information systems and PIT systems will be updated on an on-going basis to continue to meet applicable RMF requirements. Systems must have and maintain an ATO or, if acceptable to the Government under DIACAP, an Interim Authority to Operate (IATO) not to exceed the October 2016 time frame.
8.8 Contractor systems and information networks that receive, transmit, store, or process nonpublic Government data must be accredited according to DoDI 8510.01 "Risk Management Framework for DoD IT” (formally DIACAP) and comply with annual Federal Information Security Management Act (FISMA) security control testing. All systems subject to RMF must present evidence of authorization in the security plan, Security Assessment Report (SAR) POA&M and authorization decision document or show that the system has successfully gone through the RMF process in order to integrate information security and risk management activities into the system’s life cycle. The RMF decision must be current and cannot exceed a 3 year timeframe. Evidence of FISMA compliance must be presented in the form of a POA&M. The Contractor will be responsible for the cost of RMF processes and FISMA testing required for any Contractor owned and operated network, facility and/or application processing DoD information.
9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)
9.1 The Government will provide each contractor employee with a laptop equipped with virtual private network capability for the work to be performed, or if the work is sensitive in nature and performed in a location other than a DMDC office. The laptop will contain all software required to perform the work assigned. When in DMDC office space, contractor personnel will have access to the Internet, other office software, telephones, fax machines, scanners, and printers necessary to conduct their required work.
9.2 The contractor personnel will be provided the authority to access all information required to perform duties. The Government point-of-contact will provide coordination and assistance to the contractor personnel in accessing required information and meetings.
9.3 The Government will provide the specific information, functional and program documentation, requirements, manuals, texts, access to relevant Government organizations and individuals, and briefs and other associated materials necessary to perform required work.
10.0 QUALITY CONTROL
The Contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract. The quality control plan shall be submitted to the Contracting Officer for review and approval no later than 30 days after contract award.
11.0 ADMINISTRATION CONSIDERATIONS:
11.1 Place of performance: The Contractor shall be located off-site, not at a Government facility, to perform and accomplish tasks identified in this contract.
11.2 Telework: The Contractor shall determine the frequency their personnel are allowed to telework.
11.3 Base Shutdown/Inclement Weather: The Contractor will follow guidance of the installation containing their place of performance to determine reporting schedules whether due to a base closure or inclement weather. The website for guidance regarding status of performance in the National Capitol Region (NCR) is http://www.opm.gov/status/. In all cases, if Government personnel are not available in the building/location of work to oversee Contractor activities, Contractor personnel shall leave/vacate the premises.
11.4 Contractor Identification. Each contractor employee shall, while on duty, wear in plain view on the upper portion of his outer garment a metal or plastic identification badge to be furnished by the contractor, containing the company name, employee name, and the section where the employee works. Contractor employees shall clearly identify themselves as "Contractors" at all times, in all communications and representations, including in the workplace, at meetings, in conversations, telecommunications, mail, electronic mail (e-mail), and faxes, whether with Government personnel, other contractor personnel, or with the public. Contractors with access to the base Local Area Network (LAN) or with an official Government e-mail address shall include their company name in the signature block and the designation "CTR" in the global address. The Contractor shall notify the Government if the "CTR" designation is not included in the global address.
12.0 HUMAN RESOURCE MANAGEMENT. The contractor shall:
12.1 Personnel Qualifications. Provide qualified personnel that meet or exceed the stated Knowledge, Skills, and Abilities (KSA) and education qualification requirements in the offeror’s proposal which was considered as an evaluation factor relevant to the award decision and incorporated into the resulting award.
12.2 Personnel Maintenance. Maintain minimal personnel turnover throughout the life of the contract. Ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal. Once a contractor knows that an employee is leaving and will no longer support a task, the contractor shall provide written documentation to the CO and COR within three (3) business days of the employee advising the contractor of his/her intent to leave. This written notification shall include the date and time the position will be vacant, the reason the employee will no longer work on the task, anticipated replacement date, and what management corrective action will be taken to ensure task mission completion. Position vacancies or absences shall not exceed 14 calendar days unless approved in writing or otherwise approved in advance by the CO.
| 13.0 | APPLICABLE DOCUMENTS |
| Document | |
| Web link |
| DoD 5200.01, Vol. 4, February 24, 2012, DoD Information Security Program: Controlled Unclassified Information (CUI) |
| http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf |
| DoDI 5200.44, November 5, 2012, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN) |
| http://www.dtic.mil/whs/directives/corres/pdf/520044p.pdf |
| DoDI 8000.01, February 10, 2009, Management of the Department of Defense Information Enterprise |
| http://www.dtic.mil/whs/directives/corres/pdf/800001p.pdf |
| DoDI 8500.01, March 14, 2014, Cyber Security |
| http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf |
| DoDI 8510.01, March 12, 2014, Risk Management Framework (RMF) for DoD Information Technology (IT) |
| http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf |
| DoDI 8520.02, May 23, 2011, Public Key Infrastructure (PKI) and Public Key (PK) Enabling |
| http://www.dtic.mil/whs/directives/corres/pdf/852002p.pdf |
| DoDI 8520.03, May 13, 2011, Identify Authentication for Information Systems |
| http://www.dtic.mil/whs/directives/corres/pdf/852003p.pdf |
| DoD O-8530.01-M, December 17, 2002, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program |
| http://www.dtic.mil/whs/directives/corres/pdf/O853001M_placeholder.pdf |
| DoDI O-8530.2, March 9, 2001, Support to Computer Network Defense (CND) |
| http://www.dtic.mil/whs/directives/corres/pdf/O85302p_placeholder.pdf |
| DoDI 8550.01, September 11, 2012, DoD Internet Services and Internet-Based Capabilities |
| http://www.dtic.mil/whs/directives/corres/pdf/855001p.pdf |
| DoDI 8551.01, May 28, 2014, Ports, Protocols and Services (PPSM) |
| http://www.dtic.mil/whs/directives/corres/pdf/855101p.pdf |
| DoDD 8570.01, August 15, 2004, Information Assurance (IA) Training, Certification, and Workforce Management |
| http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf |
| DoD 8570.01-M, December 19, 2005, Information Assurance Workforce Improvement Program |
| http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf |
| DoDI 8580.1, July 9, 2004, Information Assurance (IA) in the Defense Acquisition System |
| http://www.dtic.mil/whs/directives/corres/pdf/858001p.pdf |
| DoDI 8582.01, June 6, 2012, Security of Unclassified DoD Information on Non-DoD Information Systems |
| http://www.dtic.mil/whs/directives/corres/pdf/858201p.pdf |
| DoD 5200.02, April 3, 2017, Procedures for the DoD Personnel Security Program |
| http://www.dtic.mil/whs/directives/corres/pdf/520002_dodm_2017.pdf |
| DoDD 5400.07, January 2, 2008, DoD Freedom of Information Act |
| http://www.dtic.mil/whs/directives/corres/pdf/540007p.pdf |
| DoD 5400.7-R, September 4, 1998, DoD Freedom of Information Act Program |
| http://www.dtic.mil/whs/directives/corres/pdf/540007r.pdf |
| DoDD 5400.11, May 14, 2007, DoD Privacy Program |
| http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf |
| DoDI 5400.16, February 12, 2009, DoD Privacy Impact Assessment (PIA) Guidance |
| http://www.dtic.mil/whs/directives/corres/pdf/540016p.pdf |
| CJCSI 6510.01E, August 15, 2007, Information Assurance (IA) and Computer Network Defense (CND) |
| http://www.dtic.mil/cjcs_directives/cdata/unlimit/6510_01.pdf |
NIST Special Publication (SP) 800-37, February 2012, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems http://csrc.nist.gov/publications/PubsSPs.html
NIST Special Publication (SP) 800-53, April 30, 2013, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations http://csrc.nist.gov/publications/PubsSPs.html
| DoD 6025.18-R, January 2033, DoD Health Information Privacy Regulation |
| http://www.dtic.mil/whs/directives/corres/pdf/602518r.pdf |
| DMDC Policy on Application Cyber Hardening |
| N/A |
| DoDI 5000.02 Operation of the Defense Acquisition System |
| http://www.dtic.mil/whs/directives/corres/pdf/500002_dodi_2015.pdf |
| DoDI 5000.75, Business Systems Requirements and Acquisition |
| http://www.dtic.mil/whs/directives/corres/pdf/500075_dodi_2017.pdf |
Attachment A
Performance Requirements Summary
| Performance Objective |
| PWS Paragraph |
| Performance Standard/Acceptable Quality Level |
| Planned System Outages |
| 4.1.3 |
| No more than one instance per month where the contractor failed to notify the PM of system outage within 72 hours for planned system outage |
| Emergency System Outages |
| 4.1.3 |
| Zero instances where the contractor failed to notify the PM within 1 hour of their knowledge of a system outage. |
| Briefing Materials for sprint reviews |
| 4.1.4.2 |
| No more than two instances in a year that the contractor failed to submit a full briefing package at least 2 business days prior to the sprint review. |
| User Acceptance Testing documentation |
| 4.1.4.3 |
| No more than two a quarter where the Contractor failed to provide User Acceptance Testing documentation within 1 day. 100% zero instances where contractor failed to submit User Acceptance Testing documentation. |
| Release Notes |
| 4.1.4.4 |
| No more than 2 instances annually where the contractor failed to provide the release notes to the PM 2 business days prior to release for review and 1 day following release |
| Unlimited Business-Day Telephone and/or Online Support |
| 4.1.5 |
| No more than once a month the contractor failed to respond with at least acknowledgement of receipt within 1 business day |
| Update User Guides |
| 4.2.1 |
| No more than one instance annually that contractor failed to update user guides within one week of significant system changes |
| POA&M Documentation |
| 4.4.1.2 |
| No more than two instances a quarter (Sep – Nov, Dec – Feb, Mar – May, Jun – Aug) where the contractor failed to provide POA&M documentation completed within 5 business days following each system scan and remediation action; and |
Zero instances where the contractor failed to submit a POA&M or STIG Deviation.
Attachment B
DoD Approved 8570.01-M Certification Requirements
This attachment identifies categories and specialties within the IA workforce. Categories are IA Technical (IAT) and IA Management (IAM). IA duties may be performed as primary or additional/embedded duties. All personnel directly supporting these systems as described in the PWS will have either Level I or Level II IA duties.
Within 6 months of assignment of duties, all IAT personnel must achieve the appropriate IA certification. All IA workforce personnel must maintain their certifications as required by their certification providers to retain their position. All personnel must agree to release their IA baseline certification qualification(s) to the Department of Defense through the Defense Workforce Certification Application (DWCA).
An individual needs to obtain and maintain only one (1) of the approved IA baseline certifications listed below for his or her IA category or specialty and level to meet the minimum requirement. For example, an individual in an IAT Level II position could obtain any one of the four certifications listed in the IAT Level II cell.
Higher level IAT and IAM certifications satisfy lower level requirements. Certifications listed in Level II or III cells can be used to qualify for Level I. However, Level I certifications cannot be used for Level II or III unless the certification is also listed in the Level II or III cell.
In addition to the IA baseline certification requirement for their level, IATs with privileged access must obtain appropriate Computing Environment (CE) certifications for the operating system(s) and/or security related tools/devices they support.
| IA Workforce Level |
| High-Level Responsibilities |
| Baseline Certifications |
| IAT Level I |
| IAT Level I personnel make the CE less vulnerable by correcting flaws and implementing IAT controls in the hardware or software installed within their operational systems. |
| A+CE |
CCNA-Security Network + CE
SSCP
| IAT Level II |
| IAT Level II personnel provide network environment (NE) and advanced level CE support. They pay special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured. These positions focus on threats and vulnerabilities and improve the security of systems. |
| CCNA-Security |
GICSP
GSEC
Security+ CE
SSCP
| IAT Level III |
| Not applicable for this contract |
| CASP CE |
CISA
CISSP (or Associate)
GCED
GCIH
| IAM Level I |
| IAM Level I personnel are responsible for the implementation and operation of a DoD IS or system DoD Component within their CE. Personnel ensure that IA related information system (IS) are functional and secure within the CE |
| CAP |
GSLC
Security+ CE
| IAM Level II |
| IAM Level II personnel are responsible for the IA program of an IS within the NE. Personnel in these positions perform a variety of security related tasks, including the development and implementation of system information security standards and procedures. They ensure that IS are functional and secure within the NE |
| CAP |
CASP CE
CISM
CISSP (or Associate)
GSLC
| Type of system updates |
| Definition |
| Bug Defect |
| Updates to address system functionality and corrective action taken if something is incorrectly displayed. Defined in detail as “Corrective Maintenance” - modifications to correct defects in the system, which prevent the system from operating or functioning as intended. Such defects may stem from errors in the requirements, design, or production baselines. |
| COTS component updates and patches |
| Applying updates to all COTS components to include entellitrak software, SQL & Oracle Databases, Apache, Java, middleware |
| Change Request/Enhancement |
| To improve (enhance) or augment functionality. Defined in detail as “Adaptive Maintenance” - modifications to keep the system usable in a changed or changing environment. This includes modifications to accommodate sustained interoperability with external systems, such as when external systems implement changes to data structures that impact exchanged data. This also includes modifications to existing business rules, data structures, processing logic, and output products (e.g. reports) that do not introduce new functionality, but update existing functionality to conform to changes in the related business environment (e.g. Laws, Regulations, and Policies). |
Attachment C
Work load Estimates CMTS, IRCMS and DIUCS
| Type of System Update |
| Frequency Base Year |
| Frequency Option Year 1 |
| Bug Defect |
| 10/month/all systems |
| 15/month/all systems |
| Change Request/Enhancement |
| 15/month/all systems |
| 22/month/all systems |
SECTION 508 ACCESSIBILITY STANDARDS
The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable to this acquisition.
Technical Standard |X| 1194.21 - Software Applications and Operating Systems |X| 1194.22 - Web Based Intranet and Internet Information and Applications |_| 1194.23 - Telecommunications Products |_| 1194.24 - Video and Multimedia Products |_| 1194.25 - Self-Contained, Closed Products |X| 1194.26 - Desktop and Portable Computers |X| 1194.41 - Information, Documentation and Support Functional Performance Criteria |X| 1194.31 - Functional Performance Criteria
DELIVERY INFORMATION
| CLIN |
| DELIVERY DATE |
| QUANTITY |
| SHIP TO ADDRESS |
| DODAAC / CAGE |
| 0001 |
| POP 30-MAR-2018 TO |
29-MAR-2019
| N/A |
| DEFENSE MANPOWER DATA CENTER (DMDC) |
EARL BEYER
4800 MARK CENTER DR, STE 04E25
ALEXANDRIA VA 22350-1300
210-308-1945
H98201
| 0002 |
| POP 18-AUG-2018 TO |
29-MAR-2019
| N/A |
| (SAME AS PREVIOUS LOCATION) |
H98201
| 1001 |
| POP 30-MAR-2019 TO |
29-MAR-2020
| N/A |
| (SAME AS PREVIOUS LOCATION) |
H98201
| 2001 |
| POP 30-MAR-2020 TO |
29-MAR-2021
| N/A |
| (SAME AS PREVIOUS LOCATION) |
H98201
| 3001 |
| POP 30-MAR-2021 TO |
29-MAR-2022
| N/A |
| (SAME AS PREVIOUS LOCATION) |
H98201
| 4001 |
| POP 30-MAR-2022 TO |
29-MAR-2023
| N/A |
| (SAME AS PREVIOUS LOCATION) |
H98201
CLAUSES INCORPORATED BY REFERENCE
| 52.202-1 |
| Definitions |
| NOV 2013 |
| 52.203-3 |
| Gratuities |
| APR 1984 |
| 52.203-18 |
| Prohibition on Contracting With Entities That Require Certain Internal Confidentiality Agreements or Statements--Representation |
| JAN 2017 |
| 52.204-4 |
| Printed or Copied Double-Sided on Postconsumer Fiber Content Paper |
| MAY 2011 |
| 52.204-7 |
| System for Award Management |
| OCT 2016 |
| 52.204-9 |
| Personal Identity Verification of Contractor Personnel |
| JAN 2011 |
| 52.204-13 |
| System for Award Management Maintenance |
| OCT 2016 |
| 52.204-16 |
| Commercial and Government Entity Code Reporting |
| JUL 2016 |
| 52.204-18 |
| Commercial and Government Entity Code Maintenance |
| JUL 2016 |
| 52.204-19 |
| Incorporation by Reference of Representations and Certifications. |
| DEC 2014 |
| 52.204-21 |
| Basic Safeguarding of Covered Contractor Information Systems |
| JUN 2016 |
| 52.212-1 |
| Instructions to Offerors--Commercial Items |
| JAN 2017 |
| 52.212-4 |
| Contract Terms and Conditions--Commercial Items |
| JAN 2017 |
| 52.222-22 |
| Previous Contracts And Compliance Reports |
| FEB 1999 |
| 52.222-46 |
| Evaluation Of Compensation For Professional Employees |
| FEB 1993 |
| 52.222-58 |
| Subcontractor Responsibility Matters Regarding Compliance with Labor Laws (Executive Order 13673) |
| DEC 2016 |
| 52.224-1 |
| Privacy Act Notification |
| APR 1984 |
| 52.224-2 |
| Privacy Act |
| APR 1984 |
| 52.225-25 |
| Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions Relating to Iran-- Representation and Certifications. |
| OCT 2015 |
| 52.232-40 |
| Providing Accelerated Payments to Small Business Subcontractors |
| DEC 2013 |
| 52.237-3 |
| Continuity Of Services |
| JAN 1991 |
| 52.252-5 |
| Authorized Deviations In Provisions |
| APR 1984 |
| 252.203-7000 |
| Requirements Relating to Compensation of Former DoD Officials |
| SEP 2011 |
| 252.203-7003 |
| Agency Office of the Inspector General |
| DEC 2012 |
| 252.203-7005 |
| Representation Relating to Compensation of Former DoD Officials |
| NOV 2011 |
| 252.204-7008 |
| Compliance With Safeguarding Covered Defense Information Controls |
| OCT 2016 |
| 252.204-7009 |
| Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information |
| OCT 2016 |
| 252.204-7012 |
| Safeguarding Covered Defense Information and Cyber Incident Reporting |
| OCT 2016 |
| 252.205-7000 |
| Provision Of Information To Cooperative Agreement Holders |
| DEC 1991 |
| 252.215-7008 |
| Only One Offer |
| OCT 2013 |
| 252.219-7003 |
| Small Business Subcontracting Plan (DOD Contracts)--Basic |
| MAR 2016 |
| 252.222-7007 |
| Representation Regarding Combating Trafficking in Persons |
| JAN 2015 |
| 252.225-7012 |
| Preference For Certain Domestic Commodities |
| DEC 2016 |
| 252.225-7050 |
| Disclosure of Ownership or Control by the Government of a Country that is a State Sponsor of Terrorism |
| OCT 2015 |
| 252.227-7013 |
| Rights in Technical Data--Noncommercial Items |
| FEB 2014 |
| 252.227-7015 |
| Technical Data--Commercial Items |
| FEB 2014 |
| 252.227-7016 |
| Rights in Bid or Proposal Information |
| JAN 2011 |
| 252.227-7025 |
| Limitations on the Use or Disclosure of Government-Furnished Information Marked with Restrictive Legends |
| MAY 2013 |
| 252.227-7030 |
| Technical Data--Withholding Of Payment |
| MAR 2000 |
| 252.227-7037 |
| Validation of Restrictive Markings on Technical Data |
| SEP 2016 |
| 252.232-7003 |
| Electronic Submission of Payment Requests and Receiving Reports |
| JUN 2012 |
| 252.232-7010 |
| Levies on Contract Payments |
| DEC 2006 |
| 252.239-7001 |
| Information Assurance Contractor Training and Certification |
| JAN 2008 |
| 252.239-7010 |
| Cloud Computing Services |
| OCT 2016 |
| 252.243-7002 |
| Requests for Equitable Adjustment |
| DEC 2012 |
| 252.244-7000 |
| Subcontracts for Commercial Items |
| JUN 2013 |
| 252.247-7022 |
| Representation Of Extent Of Transportation Of Supplies By Sea |
| AUG 1992 |
| 252.247-7023 |
| Transportation of Supplies by Sea |
| APR 2014 |
CLAUSES INCORPORATED BY FULL TEXT
52.204-17 OWNERSHIP OR CONTROL OF OFFEROR (JUL 2016)
(a) Definitions. As used in this provision--
Commercial and Government Entity (CAGE) code means—
(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity; or
(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.
Highest-level owner means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.
Immediate owner means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.
(b) The Offeror represents that it [ ___ ] has or [ ___ ] does not have an immediate owner. If the Offeror has more than one immediate owner (such as a joint venture), then the Offeror shall respond to paragraph (c) and if applicable, paragraph (d) of this provision for each participant in the joint venture.
(c) If the Offeror indicates ``has'' in paragraph (b) of this provision, enter the following information:
Immediate owner CAGE code:
Immediate owner legal name: ___
(Do not use a ``doing business as'' name)
Is the immediate owner owned or controlled by another entity?:
[ ___ ] Yes or [ ___ ] No.
(d) If the Offeror indicates ``yes'' in paragraph (c) of this provision, indicating that the immediate owner is owned or controlled by another entity, then enter the following information:
Highest-level owner CAGE code:
Highest-level owner legal name:
(Do not use a ``doing business as'' name)
(End of provision)
52.204-20 Predecessor of Offeror (JUL 2016)
Commercial and Government Entity (CAGE) code means--
(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity; or
(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.
Predecessor means an entity that is replaced by a successor and includes any predecessors of the predecessor.
Successor means an entity that has replaced a predecessor by acquiring the assets and carrying out the affairs of the predecessor under a new name (often through acquisition or merger). The term “successor” does not include new offices/divisions of the same company or a company that only changes its name. The extent of the responsibility of the successor for the liabilities of the predecessor may vary, depending on State law and specific circumstances.
(b) The Offeror represents that it [____] is or [____] is not a successor to a predecessor that held a Federal contract or grant within the last three years.
(c) If the Offeror has indicated “is” in paragraph (b) of this provision, enter the following information for all predecessors that held a Federal contract or grant within the last three years (if more than one predecessor, list in reverse chronological order):
Predecessor CAGE code: ____ (or mark “Unknown”).
Predecessor legal name: ____.
(Do not use a “doing business as” name).
52.209-2 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS--REPRESENTATION (NOV 2015)
(a) Definitions. Inverted domestic corporation and subsidiary have the meaning given in the clause of this contract entitled Prohibition on Contracting with Inverted Domestic Corporations (52.209-10).
(b) Government agencies are not permitted to use appropriated (or otherwise made available) funds for contracts with either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation, unless the exception at 9.108-2(b) applies or the requirement is waived in accordance with the procedures at 9.108-4.
(c) Representation. The Offeror represents that--
(1) It [ ___ ] is, [ ___ ] is not an inverted domestic corporation; and
(2) It [ ___ ] is, [ ___ ] is not a subsidiary of an inverted domestic corporation.
52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (JULY 2013)
Administrative proceeding means a non-judicial process that is adjudicatory in nature in order to make a determination of fault or liability (e.g., Securities and Exchange Commission Administrative Proceedings, Civilian Board of Contract Appeals Proceedings, and Armed Services Board of Contract Appeals Proceedings). This includes administrative proceedings at the Federal and State level but only in connection with performance of a Federal contract or grant. It does not include agency actions such as contract audits, site visits, corrective plans, or inspection of deliverables.
Federal contracts and grants with total value greater than $10,000,000 means--
(1) The total value of all current, active contracts and grants, including all priced options; and
(2) The total value of all current, active orders including all priced options under indefinite-delivery, indefinite-quantity, 8(a), or requirements contracts (including task and delivery and multiple-award Schedules).
Principal means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a division or business segment; and similar positions).
(b) The offeror ( ) has ( ) does not have current active Federal contracts and grants with total value greater than $10,000,000.
(c) If the offeror checked “has” in paragraph (b) of this provision, the offeror represents, by submission of this offer, that the information it has entered in the Federal Awardee Performance and Integrity Information System (FAPIIS) is current, accurate, and complete as of the date of submission of this offer with regard to the following information:
(1) Whether the offeror, and/or any of its principals, has or has not, within the last five years, in connection with the award to or performance by the offeror of a Federal contract or grant, been the subject of a proceeding, at the Federal or State level that resulted in any of the following dispositions:
(i) In a criminal proceeding, a conviction.
(ii) In a civil proceeding, a finding of fault and liability that results in the payment of a monetary fine, penalty, reimbursement, restitution, or damages of $5,000 or more.
(iii) In an administrative proceeding, a finding of fault and liability that results in--
(A) The payment of a monetary fine or penalty of $5,000 or more; or
(B) The payment of a reimbursement, restitution, or damages in excess of $100,000.
(iv) In a criminal, civil, or administrative proceeding, a disposition of the matter by consent or compromise with an acknowledgment of fault by the Contractor if the proceeding could have led to any of the outcomes specified in paragraphs (c)(1)(i), (c)(1)(ii), or (c)(1)(iii) of this provision.
(2) If the offeror has been involved in the last five years in any of the occurrences listed in (c)(1) of this provision, whether the offeror has provided the requested information with regard to each occurrence.
(d) The offeror shall post the information in paragraphs (c)(1)(i) through (c)(1)(iv) of this provision in FAPIIS as required through maintaining an active registration in the System for Award Management database via https://www.acquisition.gov (see 52.204-7).
52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A
FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)
(a) As required by sections 744 and 745 of Division E of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235), and similar provisions, if contained in subsequent appropriations acts, the Government will not enter into a contract with any corporation that--
(1) Has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless an agency has considered suspension or debarment of the corporation and made a determination that suspension or debarment is not necessary to protect the interests of the Government; or
(2) Was convicted of a felony criminal violation under any Federal law within the preceding 24 months, where the awarding agency is aware of the conviction, unless an agency has considered suspension or debarment of the corporation and made a determination that this action is not necessary to protect the interests of the Government.
(b) The Offeror represents that--
(1) It is [ ] is not [ ] a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability; and
(2) It is [ ] is not [ ] a corporation that was convicted of a felony criminal violation under a Federal law within the preceding 24 months.
52.212-2 EVALUATION--COMMERCIAL ITEMS (OCT 2014)
(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:
Technical, Past Performance and Price
Technical and Past performance evaluation factors, when combined, are signifcantly more important than price.
(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).
(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.
52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (JAN 2017) ALTERNATE I (OCT 2014)
The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site located at https://www.sam.gov/portal . If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision.
(a) Definitions. As used in this provision--
“Administrative merits determination” means certain notices or findings of labor law violations issued by an enforcement agency following an investigation.
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it.