Enterprise_Task_Management_-_PWS_revised.pdf

Attachment 1

Performance Work Statement (PWS)

Task Management System

Strategic, Plans, and Initiatives (SPI) Defense Human Resources Activity (DHRA)

4800 Mark Center Dr Alexandria, VA 22350-4000

Table of Contents

1.0 INTRODUCTION

2.0 BACKGROUND

3.0 SCOPE

4.0 REQUIREMENTS

4.1 Cloud Computing Services

4.2 Application

4.3 System Environments and User Capacity

4.4 Disaster Recovery and Continuity of Operations

4.5 System Administration and Maintenance

4.6 Training and Technical Support

4.7 Adoption Services

4.8 Other Requirements

5.0 DELIVERABLES

6.0 CONTRACTOR PERSONNEL

6.1 General

6.2 Contractor Manpower Reporting

6.3 Contractor Travel

6.4 Common Access Card (CAC)

6.5 Access to Facilities

6.6 Training Requirements

7.0 SECURITY

8.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)

9.0 PERIOD AND PLACE OF PERFORMANCE

10.0 QUALITY CONTROL

11.0 QUALITY ASSURANCE

12.0 CONFLICTS OF INTEREST

13.0 APPLICABLE DOCUMENTS

14.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

1.0 INTRODUCTION

1.1 The Defense Human Resources Activity (DHRA) seeks to procure and rapidly deploy a commercial-off-the-shelf (COTS) task management system utilizing the Software as a Service (SaaS) model via a DoD-approved network architecture.

1.2 DHRA is comprised of a Headquarters and eleven Components, spanning the United States, with high-level responsibilities across a diverse mission set. DHRA:

1.2.1 provides centralized and comprehensive personnel data management and analysis for the entire Department of Defense (DoD);

1.2.2 manages DoD enterprise-wide mission programs ranging from travel management, language and culture, to civilian human resource advisory services;

1.2.3 ensures Service members and their families receive the care and support they are entitled through multiple and highly visible risk reduction and direct support programs; and,

1.2.4 operates out of six primary locations: Alexandria, Virginia; Monterey, California; Pensacola, Florida; Patrick Air Force Base, Florida; Fort Knox, Kentucky; and, San Antonio, Texas.

2.0 BACKGROUND

2.1 DHRA’s portfolio responsibilities necessitate a multitude of complex tasks ranging from mission-specific initiatives to funding the Enterprise to establishing DoD-wide policy. Currently, tasks are managed by individual organizations, inhibiting leadership’s ability to see and prioritize task accomplishment. In short, DHRA requires an Enterprise-level system to assign, track, and manage its many tasks.

2.2 The Office of the Secretary of Defense (OSD) uses its own system, called the Correspondence and Task Management System (CATMS), to manage tasks between DoD components. Any future DHRA task management system must include bi-directional communication with CATMS.

2.2.1 The Deputy Secretary of Defense (DSECDEF) signed Directive-type Memorandum (DTM) 15-001, “Implementation of the Correspondence and Task Management System (CATMS)” on 3 FEB 2015, incorporating Change 3, effective February 7, 2018.

2.2.2 The DTM established DoD policy that CATMS is the enterprise correspondence system for all DOD components and will be used for all official correspondence in accordance with the procedures DOD 5110.04-M, Volume 1, “DOD Manual for Written Material: Correspondence Management,” 26 OCT 201 O and DOD 5110.04-M, Volume 2, DOD Manual for Written Material:

Examples and Reference Material,” 26 OCT 2010.

3.0 SCOPE

3.1 The purpose of this acquisition is to acquire a task management system for DHRA Headquarters and its 11 Components.

3.2 The outcomes include:

3.2.1 Procure and deploy a COTS, SaaS task management system that is hosted on a DoD-approved architecture and capable of bi-directional communication with CATMS at award.

3.2.2 DHRA leadership and staff have embraced the system and use it effectively.

3.2.3 The task management system is embedded in DHRA’s business processes.

3.2.4 The task management system provides metrics to identify workflow bottlenecks, conduct workload comparisons, and create efficiencies and accountability for staff processes.

4.0 REQUIREMENTS

4.1 The task management system shall be provided using cloud computing services and meet the following requirements:

4.1.1 Cloud computing services shall comply with 48 CFR § 252.239-7010.

4.1.2 Cloud computing services shall meet all requirements established in the DoD Cloud Computing Security Requirements Guide (SRG).

4.1.3 Cloud computing services shall meet all FedRAMP reporting requirements, including the System Security Plan. This plan shall, at a minimum, include the following attachments:

4.1.3.1 Information Security Policies and Procedures

4.1.3.2 User Guide

4.1.3.3 Electronic Authentication (E-Authentication) Plan

4.1.3.4 Privacy Impact Assessment (PIA)

4.1.3.5 Rules of Behavior (RoB)

4.1.3.6 Information System Contingency Plan (ISCP)

4.1.3.7 Configuration Management Plan (CMP)

4.1.3.8 Incident Response Plan (IRP)

4.1.3.9 Control Implementation Summary (CIS) Workbook

4.1.3.10 Federal Information Processing Standard (FIPS) 199 Categorization

4.1.3.11 Separation of Duties Matrix

4.1.3.12 Laws and Regulations

4.1.3.13 Integrated Inventory Workbook

4.2 The task management system shall meet the following application requirements:

4.2.1. General

4.2.1.1 Commercial-off-the-shelf (COTS) software focused, specifically, on task management. Per DFARS 239.7602-1(b), the COTS solution must already have provisional authorization to operate from the Defense Information Systems Agency.

4.2.1.2 Utilizes Software as a Service (SaaS) model.

4.2.1.3 Operates on a DoD-approved network architecture with appropriate Authorization to Operate (ATO).

4.2.1.4 Provides automated, bi-directional communications with OSD’s CATMS software and administrator-level access to modify field mapping.

4.2.1.5 Integrates with DoD/DISA Enterprise Identity & Access Management (IdAM) service.

4.2.1.6 Security and access model uses/supports Microsoft Active Directory and DoD Public Key Encryption/Common Access Card (PKE/CAC) infrastructure for user authentication and data protection. The system must provide the ability to audit user system access in near real time.

4.2.1.7 Utilizes a consistent, modern user interface with intuitive user experience.

4.2.1.8 Supports Microsoft Office 2010 and above, including support for future releases.

4.2.1.8.1 Allows task creation directly from Microsoft Outlook, including the ability to handle document attachments.

4.2.1.8.2 Allows export of task data to Microsoft Excel with active links to the original task.

4.2.1.8.3 Facilitates leadership approval via direct email to the task management system or via a task summary screen with adjudication button(s).

4.2.1.9 Uses Microsoft SharePoint as the default document management and storage solution. Supports co-authoring and versioning.

4.2.1.10 Compatible with Internet Explorer 11 on Windows 10.

4.2.1.11 Provides the ability to update user forms and fields to meet changing mission needs.

4.2.1.12 Provides an integrated routing capability with review and approval functions designed to accommodate senior leader coordination.

4.2.2 Data Entry. The system shall have the capability to add, update, delete, view, and lock records that are put into the database through a web-based portal or user site.

4.2.3 Tasking. The system shall provide a tasking schema for task correspondence and action items across the chain of command in a hierarchical fashion from the DHRA Director to the individual action officers (AO). The system shall have no limits on the depth of sub-tasking and provide real-time status updates across the entire task assignment tree.

4.2.4 Searches. The system shall have a search capability capable of executing search inquiries by task, user, key word, document, or any other fields established as part of the task record within the database.

4.2.5 Notification. The system shall provide users with the capability to issue and receive notifications within the system and via email. Utilizes DoD/DISA Enterprise E-mail Service (DEE) Global Address List (GAL) for the purpose of assigning tasks and emailing notifications.

4.2.6 Reporting. The system shall provide the capability to conduct standard, customized, or ad hoc query searches and reports which are exportable to Microsoft and Adobe applications. The system shall produce a variety of reports and query printouts, which assist in the efficient management, and control of correspondence, documents, and taskers. Task management system reports and dashboards shall provide 100% accurate decision-support information. If a deficiency is noted, it shall be corrected within three business days.

4.2.7 Dashboards. The system must provide real time charts and tables that facilitate management, oversight, and leadership review of key tasking metrics. At a minimum, dashboards shall be capable of showing the distribution of task loading by DHRA organization, the status of tasks (e.g., complete, overdue, due within a user-selected period such as 30 days), and on-time completion rate for DHRA organizations. Dashboards must be user configurable and support Microsoft PowerBI.

4.2.8 Help Functions. The system shall provide an online help tutorial about the functions and features comprising the system. The online help shall provide quick, accurate, and easy to understand information concerning how to use the system from the user’s perspective. The online help system should be customizable to allow for DHRA-specific guidance.

4.2.9 Document or Task Approval. The system should have a flexible approval engine, allowing updates even while approvals are underway. The workflow shall include a simplified senior leader-friendly interface for approval, including via email. It shall incorporate digital signature functionality, either inherently or through the ApproveIt Desktop or other DISA-approved application for standard document formats, including but not limited to .docx and .pdf standards.

4.2.10 Personnel Actions. The system shall provide the ability to staff awards, decorations, disciplinary actions, evaluations, or any other personnel actions in a secure, private environment. Protects personally identifiable information (PII) either through user- or role-based access; or, demonstrated ability to mark and segregate or quarantine tasks and attachments as private or close-hold.

4.2.11 Records Management Integration. The system shall allow for completed taskers to be archived in an existing records management system.

4.3 System Environments and User Capacity

4.3.1 Provide a live, stable production environment that is accessible from any DHRA operating location and, initially, supports 750 DHRA users, but is scalable to support as many as 5,250 users with no system degradation, if later required by DHRA.

4.3.2 Provide a staging environment that facilitates DHRA review, evaluation, and performance testing of patches, upgrades, and other proposed changes to the production environment.

4.4 Disaster Recovery and Continuity of Operations

4.4.1 General

4.4.1.1 The task management system shall be available 24/7, except during coordinated maintenance periods. The task management system shall have a 99.5% uptime during core business hours of Monday through Friday from 7:00 a.m. to 8:00 p.m. U.S. Eastern Standard Time. When down, the system shall be back online within three hours during core business hours. Maintenance periods shall be scheduled outside business hours of Monday through Friday from 7:00 a.m. to 8:00 p.m. U.S. Eastern Standard Time.

4.4.1.2 Whenever there is an interruption in service affecting the end user during business hours, the Contractor shall notify the Contracting Officer and Contracting Officer’s Representative of any outages within one hour of identifying the outage. Otherwise, notification is required the morning of the next business day. All reports will be in a format prescribed by the Contracting Officer or Contracting Officer’s Representative following consultation the Offeror awarded the contract.

4.4.1.3 During an outage, the Contractor shall provide hourly updates, unless otherwise agreed to by the DHRA Chief of Staff, Contracting Officer, or Contracting Officer’s Representative, regarding troubleshooting and restoration progress along with an estimated timeframe for recovery of the service.

4.4.1.4 The Contractor shall provide a monthly system uptime and performance report, including a list of trouble tickets along with their solution and resolution time.

4.4.2 Disaster Recovery

4.4.2.1 The Contractor shall implement system redundancy and backup protocols to ensure disaster recovery capability within 24 hours of any system outage to include system upgrades or scheduled system maintenance outages.

4.4.2.2 The Contractor shall conduct, at a minimum, semi-annual risk management assessments and report the results to the Government on a schedule agreed to by the Contracting Officer and Contracting Officer’s Representative.

4.4.3 Asset Availability. The Contractor shall be responsible for maintaining and ensuring continued compatibility and interoperability with the Government’s systems, infrastructure, and processes for the term of the contract. In the event of an unavoidable compatibility or interoperability issue as determined by the Contracting Officer, Contracting Officer’s Representative, or the Contractor, the determining party shall be responsible for providing notification within three business days to all three parties. The Contractor shall be responsible for working with the Government to identify appropriate remedies and, if applicable, working with the Government to facilitate a smooth and seamless transition to an alternative solution and/or provider.

4.5 System Administration and Maintenance

4.5.1 The Contractor is responsible for the upkeep, configuration, and reliable operation of the task management system.

4.5.2 Database Management.

4.5.2.1 The system shall have status, completion, and file reference information maintained.

4.5.2.2 Information input into the system and database shall be input by different users whose access is controlled by a User Profile.

4.5.2.3 The system has the capability to pull from the database DHRA-defined reports and query printouts, which assist in the efficient management, and control of correspondence, documents, and actions.

4.5.2.4 Provides a tracking system comprised of one centralized database containing data from all organizations participating in the system.

4.5.2.5 Provide and manage a database which houses data pertaining to correspondence control, staff action and physical records data.

4.5.2.6 Provides the capability to structure the database in such a manner as to reflect the various levels of the DHRA leadership structure from the highest level, to the organization, division, branch, and to the lowest level, the action officer.

4.5.2.7 Provides and manages the database to ensure that data integrity is maintained and enforced at each level, as items are tasked up and down the chain of command without causing unnecessary duplication of data.

4.5.2.8 Provides and manages the database to ensure that reference integrity is retained when changes are made to data stored in the database.

4.5.2.9 Be the administrator of the database function at the database software, instance, and database level.

4.5.2.10 Provides an enterprise-wide accessible document repository for correspondence attachments for archiving and content management purposes.

4.5.2.11 Database Records.

4.5.2.11.1 The Contractor shall provide the Contracting Officer all Government data and Government-related data in the format specified by the Contracting Officer or designated representative.

4.5.2.11.2 The Contracting Officer may at any time issue a hold notification in writing to the Contractor. At such time, the Contractor may not dispose of any Government data or Government-related data described in the hold notification until such time as the Contractor is notified in writing by the Contracting Officer, including preservation of all such data in accordance with agency instructions.

4.5.2.11.3 When the Government is using a Contractor’s software, the Contractor shall provide the agency with access and the ability to search, retrieve, and produce Government data in a standard commercial formats.

4.5.3 Maintenance. The Contractor shall be responsible for all patching and vulnerability management (PVM) of software and other system components supporting services provided under this agreement so as to proactively prevent the exploitation of IT vulnerabilities that may exist within the Contractor’s operating environment. Such patching and vulnerability management shall meet the requirements and recommendations of NIST SP 800-40 with special emphasis on ensuring that the vendor’s PVM systems and programs apply standardized configurations with automated continuous monitoring of the same to assess and mitigate risks associated with known and unknown IT vulnerabilities in the Contractor’s operating environment.

4.5.4 Provide the necessary personnel, supplies, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide task management system software licenses and software assurance (i.e., maintenance) and perform the planning, installation, configuration, deployment, accreditation, training, adoption support, and sustainment of the task management system as defined in this PWS.

4.6 Training and Technical Support

4.6.1 Training

4.6.1.1 The Contractor shall develop training curricula for instructors, system administrators, and users (senior and action officer levels), including user guides for each class of user, to support instructor-led, hands-on class room environment training as well as one-on-one sessions conducted desk-side. All relevant training material will be provided to the Government within 20 work days of contract award. Training products shall incorporate Government-provided business rules. The Contractor shall assign or transfer all copyright to the Government for training products.

4.6.1.2 The Contractor will conduct all training sessions at the Mark Center until 400 staff members and, approximately, 30 senior leaders have been trained. Contractor should plan on approximately 28 group and 30 individual sessions to be completed by March 1, 2019.

Following this initial training, the Government shall conduct the training with support from an on-site subject matter expert provided by the Contractor. The Contractor shall provide training support on-site in each of DHRA’s primary operating locations for approximately one week at each location. Additional training support may include remote, on-site, phone, and email support.

4.6.1.3 At the end of training users must, at minimum, be able to: 1) create a task; 2) task an action; 3) accept an action; 4) respond to an action; 5) close an action; 6) search for an action; and 7) run reports. Additionally, senior leaders and their staff must be trained on how to coordinate senior leader approval. All trainees below the senior leader level will take a post-training quiz at the end of their training session and knowledge deficits will be remedied on the spot.

4.6.2 Technical Support

4.6.2.1 The Contractor shall provide Tier Three support, including an outline of services provided. The task management system support outline should identify POC’s, hours of operation, and ticket response times.

4.6.2.2 Task management system helpdesk support shall be Monday – Friday between the hours of 7:00 a.m. to 8:00 p.m. U.S. Eastern Standard Time, except Federal holidays or when the Government facility is closed due to national emergencies, administrative closings, or similar Government directed facility closing.

4.7 Adoption Services

4.7.1 Provide adoption services and support throughout the implementation the task management system.

4.7.2 Support development and update of a Change Management Plan, including the following key areas:

4.7.2.1 assess change readiness;

4.7.2.2 define desired change outcomes and culture state;

4.7.2.3 build case for change and detail transition initiatives;

4.7.2.4 defines change structure and governance;

4.7.2.5 identify and assess change impacts; and,

4.7.2.6 identify and assess stakeholder groups.

4.7.3 Support development of a Communications Plan, including development of key messages and best practices.

4.7.4 Assist in the reengineering of business process to incorporate the task management system.

4.7.5 Support development of a DHRA Task Management Operating Instruction.

4.7.6 Assist in the development and implementation of task management metrics and reports.

4.8 Other Requirements

4.8.1 License Adjustments. Contractor will provide a mechanism for the Government to adjust licensing requirements throughout the period of performance.

4.8.2 Transition Services Plan. Provide a plan for transition out services to ensure minimum disruption to vital Government business. This plan shall address how the Contractor will work with the successor contractor and Government personnel to ensure that there will be no service degradation during and after a transition period of 30 days.

4.8.3 Post-Award Conference. This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management, and security issues.

The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements and to identify and resolve any potential issues.

The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable. The Contractor shall provide a written summary of the Post Award Conference.

4.8.4 Government Program Office Support. The contractor is required to provide ongoing support to the Government to inform senior leadership and others about the status of the program, its functionality, or other information. In support of this effort the contractor will develop briefings, documents, and other presentations, as needed.

4.8.5 Project Management Plan. Contractor will deliver and maintain a Project Management Plan (PMP) that documents the approach for the management of tasks, resources, schedule, issues, and risks associated with the project. The PMP communicates, confirms the scope of the project, references the Performance Work Statement (PWS) for specification of tasks and the project schedule, and describes the organization of the Project Team.

5.0 DELIVERABLES

Deliverable PWS Ref. Delivery Date

System Security Plan 4.1.3 Within 10 work days

System Uptime and Performance Report 4.4.1.4 Monthly

Semi-annual Risk Management Assessment Report.

4.4.2.2 Within 10 work days of completion

Training Curricula and User Guides 4.6.1.1 No later than 20 work days after contract award

Task Management System Support Outline.

4.6.2.1 No later than 20 work days after contract award.

Transition Services Plan. 4.8.2 Within 30 days of Government decision to transition.

Post-Award Conference Summary 4.8.3 No later than 5 work days after contract award

Deliverable PWS Ref. Delivery Date

Project Management Plan 4.8.5 No later than 5 work days after contract award

Contractor Manpower Reporting 6.2 No later than 31 October each year

Quality Control Plan (QCP) 10.1-10.2 Pre-award

Corrective Action Response 11.2 No later than 5 work days after contract award

6.0 CONTRACTOR PERSONNEL

6.1 General

6.1.1 The Contractor shall be responsible for the performance, control, and direction of their personnel to ensure PWS requirements are met. These personnel shall possess the requisite skills to provide the primary functional, business, and technical skills necessary for successful, efficient, and effective implementation of the task management system at DHRA.

6.1.2 The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for recognized holidays. When hiring personnel, the Contractor shall maintain the stability and continuity of the workforce.

6.1.3 The Contactor will require all employees, including those of sub-Contractors, who will have access to government data, the architecture that supports government data, or any physical or logical devices/code to pass the appropriate background investigation required by the Government in compliance with HSPD -12. At a minimum, all Contractor employees with access to the government data, the architecture that supports government data, or any physical or logical devices/code will pass a National Agency Check with Inquiries (NACI) investigation and be a US person as defined in Executive Order 12333. The Contractor shall retain operational configuration and control of data repository systems used to process and store government data to include any or remote work. The Contractor shall not subcontract the operational configuration and control of any government data.

6.1.4 The Contractor shall provide a point of contact who shall meet with COR and Program Officer or other assigned Government representative on a regular basis throughout the period of the contract. Meetings will be conducted monthly or at the direction of the COR.

6.2 Contractor Manpower Reporting

6.2.1 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for DHRA via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/.

6.2.2 Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Office of the Under Secretary of Defense (Personnel and Readiness). Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil

6.3 Contractor Travel

6.3.1 The Government anticipates one five-day training session at each of DHRA’s four primary operating sites. These training sessions should be conducted within the first 90 days of contract award.

6.3.2 Contractor costs for Government authorized travel are included in this contract. All travel shall be in accordance with FAR 31.205-46 and applicable travel regulations (Joint, Federal or Standardized). Contractor payment claims shall include applicable documentation to support actual costs incurred (e.g. airfare and hotel/lodging receipts) as well as any receipts valued at or above $75.00. Failure to provide appropriate documentation may result in loss of reimbursement of travel expenses.

6.4 Common Access Card (CAC)

6.4.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) and:

6.4.2 Be responsible for obtaining CAC or PIV ready status prior to reporting for work. At a minimum, all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing.

6.4.3 Be citizens of the United States.

6.4.4 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

6.4.5 The Government will issue the Contractor employee a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD- approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more.

6.4.6 If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the Requiring Activity’s Information Systems Security Group (ISSG) and remove such person from work under this contract.

6.4.7 Under no circumstances will Contractors loan or give their badge to other personnel or to visitors to use to access buildings belonging to the DHRA. Contractors shall immediately report lost or stolen access control badges to the COR and to appropriate security personnel.

6.5 Access to Facilities

6.5.1 The Government will authorize appropriate badge access to Contractor employees identified on Contractor’s personnel roster, wearing identification badges, and complying with any other facility access requirements.

6.5.2 The COR will maintain facilities access control approvals.

http://www.ecmra.mil/

6.6 Training Requirements

6.6.1 Operational Security. New Contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All Contractor employees must complete annual OPSEC awareness training.

6.6.2 Information Assurance Awareness. All Contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All Contractor employees working IA/IT functions must comply with DoD requirements in DoDD 8570.01 and DoD 8570.01-M within 6 months of employment.

6.6.3 Information Assurance Certification. Per DoD 8570.01-M and DFARS 252.239.7001, the Contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

6.6.4 Privacy Act. All contract personnel assigned to this contract shall have access to information that may be subject to the Privacy Act of 1974. The Contractor is responsible for ensuring all assigned contract personnel are briefed on Privacy Act requirements.

7.0 SECURITY

7.1 The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall comply with:

7.1.1 DoD Instruction (DoDI) 8500.1, Cybersecurity

7.1.2 Records Maintained on Individuals (5 U.S.C. 552a)

7.1.3 DoD Directive 5400.11, DoD Privacy Program

7.1.4 DoD 6025.18, DoD Health Information Privacy Regulation

7.1.5 DoD 5200.2, Personnel Security Program

7.1.6 HSPD-12, Homeland Security Presidential Directive

7.2 All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01 "Risk Management Framework (RMF) for DoD Information Technology (DIT)”. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

7.3 DoD-Controlled IS and PIT Systems operated by a Contractor or other entity on behalf of the DOD; to include contractor owned IS and PIT systems that are dedicated to DoD processing, must be authorized as DoD IS or PIT systems. The Requiring Activity’s Authorizing Official (AO) must render an authorization decision for this type of a DoD system prior to DoD use of the capability.

7.4 IT services provided by a commercial or other non-federal government entity under this requirement must ensure the security protections of the IS delivering the service is appropriate to the confidentiality, integrity, and availability needs of the Requiring Activity’s information and mission in order to be approved for acceptable use. The Government will assess the adequacy of security proposed by potential service providers, and accept the proposed approach, negotiate changes to the approach to meet DoD needs, or reject the offer. The accepted security approach will be documented and included as attachments to the resulting contract.

7.5 Any commercial cloud computing services used for this requirement must comply current with DoD cloud computing policy and procedural guidance as published.

8.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)

8.1 The Government does not anticipate providing GFP, GFE, or GFI.

8.2 Should circumstances change, the Government will handle modification on a case-by-case basis.

8.3 All data entered into the task management system is and remains Government property. The Contractor may not disclose or destroy any data without the Contracting Officer’s approval.

9.0 PERIOD AND PLACE OF PERFORMANCE

9.1 Period of Performance. The period of performance shall be the date of contract award through one year and will include four one-year option periods, if exercised.

9.2 Place of Performance. The Contractor will not maintain permanent office space at any DHRA location, but will be required to provide on-site training and support on a case-by-case basis as directed by the Contracting Officer’s Representative (COR).

9.3 Recognized Holidays. DHRA observes the below listed Federal Holidays. When a holiday occurs on a Saturday, employees are normally granted the previous Friday as the holiday observance.

When a holiday occurs on a Sunday, employees are normally granted the following Monday as the holiday.

9.3.1 New Year’s Day - January 1

9.3.2 Martin Luther King Day - 3rd Monday in January

9.3.3 President's Day - 3rd Monday in February

9.3.4 Memorial Day - Last Monday in May

9.3.5 Independence Day - July 4

9.3.6 Labor Day - First Monday in September

9.3.7 Columbus Day - 2nd Monday in October

9.3.8 Veterans Day - November 11

9.3.9 Thanksgiving Day - 4th Thursday in November

9.3.10 Christmas Day - December 25

10.0 QUALITY CONTROL

10.1 The Contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS.

10.2 The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

11.0 QUALITY ASSURANCE

11.1 The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

11.2 Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

12.0 CONFLICTS OF INTEREST

12.1 The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR, including signing a Non-Disclosure Agreement (NDA) as required by FAR Subpart 9.504. If the performance requires the Contractor (to include subcontractors) to supply technical support related to systems or projects with which the Contractor is already directly concerned, either by prime or subcontract, the Contractor shall immediately inform the Contracting Officer.

12.2 Contractor understands that through the performance of this Contract, it may have access to acquisition sensitive data that may result in the Contracting Officer determining that the Contractor is precluded from future awards.

12.3 The PWS may be withdrawn if a conflict is found. The Contractor shall not undertake performance of any PWS requirements which requires it to supply technical support regarding such systems until the notice is given, and written consent to proceed is issued by the Contracting Officer.

13.0 APPLICABLE DOCUMENTS

Document Web link

Committee on National Security Systems (CNSS) Instruction No. 1253 http://www.dss.mil/documents/CNSSI_No1253.pd f

Contractor Performance Assessment Reporting System (CPARS) https://www.cpars.gov/

CJCSM 6510.01B, Cyber Incident Handling Program, Jul 10, 2012, current as of Dec 18 2014 http://www.jcs.mil/Portals/36/Documents/Library /Manuals/m651001.pdf?ver=2016-02-05-175710-

Defense Federal Acquisition Regulation Supplement https://www.acq.osd.mil/dpap/dars/dfarspgi/curr ent/index.html

Directive-type Memorandum (DTM) 15-001, “Implementation of the Correspondence and Task Management System (CATMS)” on 3 FEB 2015, incorporating Change 2, Jan 13, 2017 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dtm/DTM15001.pdf

DoD Cloud Computing Security Requirements Guide (SRG) https://www.wbdg.org/files/pdfs/dod_cloudcomp uting.pdf

DoD 5110.04-M, Volume 1, DOD Manual for Written Material: Correspondence Management, Oct 26, 2010 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodm/511004m_v1.pdf?ver=2017- 06-20-125409-483

DoD 5110.04-M, Volume 2, DOD Manual for Written Material: Examples and Reference Material, Oct 26, 2010 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodm/511004m_v2.pdf?ver=2017- 06-20-125406-170

DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), Feb 24, 2012 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodm/520001_vol4.pdf

DoDM 5200.02, Procedures for the DoD Personnel Security Program (PSP), Apr 3, 2017 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodm/520002_dodm_2017.pdf

DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), Nov 5, 2012, incorporating Change 2, Jul 27, 2017 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodi/520044p.pdf

DoDD 5400.11, DoD Privacy Program, Oct 29, 2014 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodd/540011p.pdf

DoD 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs, Dec 2, 2009 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodi/602518p.pdf

DoDI 8500.1, Cybersecurity, Mar 14, 2014 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodi/850001_2014.pdf

DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (DIT), Mar 12, 2014, incorporating Change 2, Jul 28, 2017 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodi/851001_2014.pdf

DoD 8570.01-M, Information Assurance Workforce Improvement Program, Dec 19, 2005, incorporating Change 4, Nov 10, 2015 http://www.esd.whs.mil/Portals/54/Documents/D D/issuances/dodm/857001m.pdf

Executive Order 13556, Controlled Unclassified Information, Nov 4, 2010 https://obamawhitehouse.archives.gov/the-press-office/2010/11/04/executive-order-13556-controlled-unclassified-information

Executive Order 12333, United States Intelligence Activities, Dec 4, 1981 https://www.archives.gov/federal-register/codification/executive-order/12333.html

Federal Acquisition Regulations https://www.acquisition.gov/browsefar

FedRAMP Continuous Monitoring Strategy Guide https://s3.amazonaws.com/sitesusa/wp-content/uploads/var/www/html/sites/www/app/ wordpress/wp-content/blogs.dir/482/files/2016/06/FedRAMP_Co ntinuous_Monitoring_Strategy_Guide_v3.0.pdf

FIPS 140-2, Federal Information Processing Standard 140-2: Security Requirements for Cryptographic Modules, May 25, 2001 https://csrc.nist.gov/publications/detail/fips/140/ 2/final

FIPS 180, Federal Information Processing Standard 180: Secure Hash Standard (SHS), Aug 2015 https://csrc.nist.gov/publications/detail/fips/180/ 4/final

FIPS 198-1, Federal Information Processing Standard 198-1: The Keyed-Hash Message Authentication Code (HMAC), Jul 2008 https://csrc.nist.gov/publications/detail/fips/198/ 1/final

FIPS 199, Federal Information Processing Standard 199: Standards for Security Categorization of Federal Information and Information Systems, Feb https://csrc.nist.gov/publications/detail/fips/199/f inal

FIPS 200, Federal Information Processing Standard 200: Minimum Security Requirements for Federal Information and Information Systems, Mar 2006 https://csrc.nist.gov/publications/detail/fips/200/f inal

FIPS 201, Federal Information Processing Standard 201: Personal Identity Verification (PIV) of Federal Employees and Contractors, Aug 2013 https://csrc.nist.gov/publications/detail/fips/201/ 2/final

HSPD-12, Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors, Aug 27, https://www.dhs.gov/homeland-security-presidential-directive-12

National Archives and Record Administration

(NARA)

https://www.archives.gov/about/regulations/regu lations.html

NIST SP 800-40 Rev 3, Guide to Enterprise Patch Management Technologies, Nov 2005 https://csrc.nist.gov/publications/detail/sp/800- 40/rev-3/final

NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, Jan 22, 2015 https://csrc.nist.gov/publications/detail/sp/800- 53/rev-4/final

NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans, Dec 18, 2014 https://csrc.nist.gov/publications/detail/sp/800- 53a/rev-4/final

NIST SP 800-59, Guideline for Identifying an Information System as a National Security System, Aug 20, 2003 https://www.nist.gov/publications/guidelines-identifying-information-system-national-security-system

NIST SP 800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories, Aug 2008 https://csrc.nist.gov/publications/detail/sp/800- 60/vol-1-rev-1/final

NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, Jun 10, https://www.nist.gov/publications/guide-applying-risk-management-framework-federal-information-systems-security-life-0

Representation of Use of Cloud Computing (252.239-7009) https://www.acq.osd.mil/dpap/dars/dfars/html/c urrent/252239.htm#252.239-7009

14.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

14.1 Purpose. The PRS lists performance objectives for the required services the Government will surveil. The absence of any contract requirement from the PRS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract.

14.2 Remedies. In all cases, failure to comply with established standards may result in:

14.2.1 reduction of payment equal to the applicable labor rate times the number of hours of services that were not provided; and/or,

14.2.2 negative Contractor Performance Assessment Reporting System (CPARS) report.

Performance Objective

PWS

Paragraph

Performance Standard/Acceptable Quality Levvel

PRS #1: Task management system data is authoritative and trustworthy

4.2.6, 4.2.7

Task management system reports and dashboards provide 100% accurate decision-support information. If a deficiency is noted, it shall be corrected within three business days.

PRS #2: Provide live task management system

4.4.1.1

The task management system shall have a 99.5% uptime during core business hours of Monday through Friday from 7:00 a.m. to 8:00 p.m. U.S.

Eastern Standard Time. When down, the system shall be back online within three hours during core business hours.

PRS #3: Provide timely and accurate incident reports

4.4.1.2

Whenever there is an interruption in service affecting the end user during business hours, the Contractor shall notify the Government of any outages within one hour of identifying the outage. Otherwise, notification is required the morning of the next business day. All reports will be in a format prescribed by the Contracting

Officer or Contracting Officer’s Representative following consultation the Offeror awarded the contract.

PRS #4: Maintain interoperability with Government systems

4.4.3

The Contractor shall be responsible for maintaining and ensuring continued compatibility and interoperability with the Government’s systems, infrastructure, and processes for the term of the contract. In the event of an unavoidable compatibility or interoperability issue as determined by the Contracting Officer, Contracting Officer’s Representative, or the Contractor, the determining party shall be responsible for providing notification within three business days to all three parties. The Contractor shall be responsible for working with the Government to identify appropriate remedies and, if applicable, working with the Government to facilitate a smooth and seamless transition to an alternative solution and/or provider.

PRS #5: Provide training

4.6.1

All relevant training and testing material will be provided to the Government within 20 work days of contract award.

The Contractor will conduct all training sessions at the Mark Center until 400 staff members and, approximately, 30 senior leaders have been trained. It will provide a subject matter expert (SME) to support training until 1,350 DHRA staff have been trained.

The Contractor completes approximately 28 group and 30 individual sessions by March 1, 2019.

All (100%) of trainees below the senior leader level will take a post-training quiz at the end of their training session and knowledge deficits will be remedied on the spot.

PRS #6: Provide technical support

4.6.2

Contractor provides Tier Three support for the duration of this contract during weekedays between the hours of 7:00 a.m. to 8:00 p.m. U.S.

Eastern Standard Time, except Federal holidays or when the Government facility is closed due to national emergencies, administrative closings, or similar Government directed facility closing 100% of the time.

PRS #7: Provide adoption services

4.7 Provide adoption services and support throughout the implementation of the task management system 100% of the time.

PRS #8: Develop and submit all required deliverables

5.0

100% of deliverable requirements are met and received on time – AND – critical information is accurate. Identified errors are corrected within 5 business days of notification by the COR.

PRS #9: Provide secure task management system

7.0

Task management system meets all required government security and privacy protocols.

100% compliance with DoD security standards is required.