HC1028-13-R-0046-0002.docx

HC1028-13-R-0046

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been modified:

QUESTIONS / ANSWERS

INDUSTRY QUESTIONS AND GOVERNMENT ANSWERS (Q&A’s)

Amendment 1

1. RFP - Would the government consider increasing the page limit for the technical/management volume to 25 pages? Given the number of performance requirements and the scope of the solution, we believe that offerors would be able to provide more complete responses with the increase.

Answer: The government will increase the page limit on the technical/management volume to 20 pages.

2. RFP, Section A.1.4 –Would the government reconsider the requirement to resolve assumptions only through questions and answers? Since questions are shared among all vendors, there is sometimes a reluctance to ask questions that might reveal a strategy or other advantage.

Answer: No – the government will not reconsider.

3. PWS, Section 6., capability 2 – Does the government require a separate centralized database for each of the SIPR and NIPR discovered components or will all data be stored in a single database? If so, will cross domain transfers be covered by the government or does the proposal need to accommodate it?

Answer: Yes - the government requires a separate centralized database for each of the SIPR and NIPR discover components. No – cross domain transfers are not required for the solution scope in this solicitation.

4. PWS, Section 6., capability 19 – Would the government please clarify and provide more detail of what “monitor” means for the solution? Is the government looking for an active monitoring solution to detect changes to baseline service models?

Answer: Monitor indicates a requirement to discover any change during an initial discovery, a regularly occurring scheduled discovery or an adhoc discovery as determined by an authorized user.

5. PWS, Section 6.1 and 6.4 – Will each of the 900 users listed require training or only those specified in section 6.4? Can you provide a breakout of the number of users that will be required to administer and the number that will just be users (viewers) of the data?

Answer: Only the users listed in section 6.4 will require training by the vendor. An estimated 102 users will have varying levels of administration duties.

6. PWS, Section 6.3 – Please clarify whether the sixteen services defined represent 16 specific business applications, or, is DISA looking for just the discovery of the components listed?

Answer: Section 6.3 represents 16 specific business applications; DISA requires the solution to meet each requirement designed to discover these specific business applications accurately and in their entirety.

7. PWS - Do the ITSM modules (IM, PM and CM) need to interact with discovered data in the BAM repository?

Answer: The requirement includes integration with DISA’s instances of ITSM. The intent is for BAM data to interact with ITSM to create relationships between existing ITSM OE records, communication device records and storage device records based on matching key data.

8. PWS - Have the mappings and relationships between business applications and business services already been identified?

Answer: POCs for these applications have varying level of information regarding the relationship maps for these business services.

9. PWS, Section 6.3 - What does “non-consecutive days of on-site installation support” imply? Does that mean that contractor personnel cannot be performing installation activities on consecutive days?

Answer: The offeror is not required to be on site for the entire installation period. The environments are transitioned to site technical staff for security reviews at multiple points during the installation and configuration processes. The security reviews can take several days. The contractor does not need to be on site on the days where this review is being completed.

10. PWS - What type of MAC level and COOP (failover) environment is the government asking for? MAC Level II? RTO/RPO=24 hours? Or will the ADDM application reside on current ITSM infrastructure for which there is already MAC and COOP levels defined?

Answer: The MAC level for this system is MAC III. The solution will reside on infrastructure as designed during the engineering phase of the project.

Amendment 2

11. Referring to the QASP document provided with the RFP, Section 4. Scope of Performance refers twice to DISA services being found in section 5.1. There is no section 5.1 in any of the RFP documentation provided. Please clarify.

Answer: Both instances of “5.1” in section 4. Scope of Performance should be “6.3”. This is a typographical error in the QASP.

12. Section L.3.1.i BAM Solution Testing and attachment J-2 Functional Test Plan appear to be inconsistent. Attachment J-2, Section 2.6 states the physical location for testing will be Mechanicsburg, PA. The physical location of the environments will be Mechanicsburg, PA for mainframe and Montgomery, AL for mid-tier. Section L.3.1.i (A) of the RFP states that Offerors’ solution will be shipped to testing locations at 5450 Carlisle Pike, Mechanicsburg PA 17055, and 8705 Industrial Blvd Oklahoma City, OK 73145 facility. Please clarify.

Answer: This is a typographical error. The components required to test the mainframe solution will be shipped by the contractor to 5450 Carlisle Pike, Mechanicsburg PA 17055. The components required to test the mid-tier solution will be shipped by the contractor to 401 E Moore Drive, MAFB/Gunter Annex, AL 36114.

13. Per “12.2 Security Clearances. Technical Implementation personnel working for the contractor require IT-1 Secret clearances on day one of service delivery.” Will INTERIM SECRET Clearances be accepted?

Answer: Yes. The government will accept an Interim Secret Clearance.

14. What is the page limitation for Volume 1 (Executive Summary)? Within the RFP, it makes reference to it being 2 page and 5 page limit.

Answer: The page limitation for Volume I, titled Executive Summary, will be limited to 2 pages.

15. The Past Performance Section in the RFP states that only 3 references may be provided. However, the attachment provided for Past Performance provides space for 4 references. Would DISA please clarify if the references provided should be a quantity of 3 or 4?

Answer: The offeror shall each provide no more than three (3) past performance references using the Past Performance Form Attachments J-3.

16. For the two requirements listed below, what will the system be attempting to import?

The solution provides the capability to import data from.xml.

The solution provides the capability to import data from.xlsx or .csv

Answer: The solution will import business application relationship information and/or identifying information related to assets (for example: application name, sub-application name, LPAR name, OE name) when required.

17. For the second 2 requirements, will there be a system wide agent? Can you expand on the last requirement?

The solution discovers at level 3 for Solaris zones.

The solution discovers, monitors and displays relationships to and from z/OS LPARs, z/VM LPARs or z Linux virtual machines on the mainframe.

Answer: The solution proposed is required to support complex business application discovery in Solaris Zones and the multiple environments residing on the mainframe that are described in this requirement. The solution will support automatic discovery, where business applications cross varying operating environments to include both mid-tier and mainframe.

18. Item 16,17, and 18: The discovery function supports pseudo (ability to run commands as root without actually being root user)

a. Question: Does DISA mean sudo?

Answer: The Government means sudo.

SECTION A - SOLICITATION/CONTRACT FORM

SECTION A - RFP INFORMATION

A.1.1. Defense Information Technology Contracting Organization (DITCO) is issuing a Request for Proposal (RFP) /solicitation for a Commercial Off-The-Shelf (COTS) Business Application Mapping (BAM) Solution, in support of Defense Information Systems Agency (DISA).

A.1.2. The RFP HC1028-13-R-0046 responses are due no later than Friday, November 22, 2013, 3:00PM, CST. See section L for further delivery instructions. Questions pertaining to this RFP shall be submitted electronically to christopher.p.jordan13.civ@mail.mil not later than Wednesday, November 4, 2013, 3:00PM, CST. The Government cannot guarantee a response to any questions received after this date/time.

A.1.3. DITCO/PL8321 is requesting proposals from qualified contractors who can provide a BAM solution. The agency will award a Firm-Fixed-Price contract using the best value criteria in section M. The government reserves the right to make award to one contractor, or to make no award in respond to this solicitation.

A.1.4. In response to this RFP, no terms, conditions or assumptions will be entertained. All issues will be resolved with questions and answers. Submission of terms, conditions or assumptions included in your proposal may be cause for your proposal to be determined non-responsive to this RFP and may be excluded.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

as of October 9, 2013

1. Contracting Officer Representative (COR):

a. Primary COR:

Department of Defense Activity Address Code (DODAAC):

H98249

Greenwood Village, CO 80155-4598

b. Alternate COR:

Chambersburg, PA 17201

2. Contract Title: Business Application Mapping Solution

3. Background: Defense Information Systems Agency’s (DISA) in support of the warfighter requires detailed knowledge of our computing network infrastructure to ensure DISA meets service level agreements for application availability requirements. The Business Application Mapping solution will provide visualization of all the interactions or dependencies each business service has with our underlying application infrastructure, regardless of environment, to include communication devices that regularly and automatically updates the visualizations as changes to the service or infrastructure occur. DISA’s significant virtual environment hinders our current ability to obtain accurate information detailing the cascade of affects one device failure may cause.

The solution will allow DISA to automatically and electronically discover and map all application footprints in the infrastructure and automatically modify the discovered service map when new assets are installed on the datacenter floor, application configurations are modified, or existing assets are technology refreshed. The solution will maintain a near-real time service map that may also be used during disaster recovery scenarios. This solution will allow DISA to understand the complex relationships between applications, server, network connections and network devices as well as storage resources, which are particularly challenging in the DISA data center environment due to continual virtual machine migrations and scaled out storage solutions. Application mapping and transaction profiling are critical in quickly determining the root cause of bottlenecks in distributed environments like service-oriented architecture (SOA) and Cloud. As DISA moves more and more towards a cloud infrastructure, a business application mapping solution is imperative to DISA’s success in supporting mission requirements.

DISA’s incident, problem, change and configuration management tool is BMC Software’s Information Technology Service Management (ITSM) solution. Relationship data from the business application mapping solution provided by the offeror is intended to be consumable by DISA’s ITSM solution. The application mapping solution would serve to provide a near real-time visualization of the underlying application infrastructure for all business services across the DISA enterprise.

“Business services” in DISA, relates to customer-owned or internal business applications. The Department of Defense (DoD) Enterprise Email solution is an example of a DISA business service. The business application mapping solution provided must support multiple views of a business service to include a comprehensive view of all interactions and dependencies of a business service and sub-applications where applicable. The solution must support parent-child relationships among service components.

4. Objectives: The requirement is to establish a business application-mapping tool that provides the capability to discover and provide visualization of business service interactions and dependencies for both stand-alone hardware operating environments (hosts) and virtual operating environments (VOE) (hosts) in both mid-tier and mainframe environments. The environments the solution must discover to build business application maps includes Windows and Linux (and VMware Windows and Linux VOEs), Solaris (and Logical Domains (LDOMs), containers and zones), Hewlett Packard Unix (HP-UX) (and Integrity Virtual Machines (IVMs)), IBM Advanced Interactive eXecutive (AIX) (and Logical Partitions (LPARs)), IBM System z operating system (z/OS) (and LPARs, Virtual Machines (VMs), and Linux VMs) as well as communications and storage dependencies. The solution will provide the capability for DISA to visualize interactions and dependencies of components, in the tool and in an extract, for all business services on both the Non-Classified Internet Protocol Router Network (NIPRNet) production environment, the Secure Internet Protocol Router Network (SIPRNet) production environment and on DISA’s out of band network. This visualization will allow DISA to ensure outages or service issues are addressed quickly and effectively.

5. Scope: The scope of this requirement is to provide a Commercial Off-The-Shelf (COTS) solution meeting all Government technical requirements listed in section 6, along with, software licenses, implementation services, on-site technical support, system documentation, training and software/solution maintenance. The contractor shall provide implementation support to include engineering, system architecture, security posture, configuration, implementation, training and integration development for the solution. The contractor will deploy their solution within DISA and produce accurate service maps and views for the pre-defined set of DISA services described in section 6.3. The integration efforts include integration with the DISA Enterprise ITSM solution.

6. Performance Requirements: The contractor shall provide a solution that includes all of the following capabilities.

6.1 Task 1 – Provide Software Licenses and Maintenance Support

The contractor shall provide Business Application Mapping/Dependency software licensing or appliance licensing, and software maintenance support. Licensing shall cover DISA’s entire environment to include applications residing in NIPR, SIPR and pre-production enclaves.

DISA’s environment is identified below.

DISA Environment

9850 - Operating Environments (OE's) includes all OEs (both virtual OEs and the 5650 physical hardware devices in the next line below)

5650 – Mid-Tier Physical Hardware Devices

2818-A01

2287 - Business Applications (These are complex business applications, not software products) Business Applications fall into three categories at DISA. ESTIMATED totals of each type are listed below:

0. 45 - Internal Business Applications

0. 13 - Services Applications

0. 2200 - Customer Applications

900 Users (Estimated)

17 locations/sites may require the solution

6.1.1 Subtask 1 – Software keys – The contractor shall provide software keys, whether routine or emergency, after initial request.

6.1.2 Subtask 2 – New Software versions, fixes, upgrades, options. The contractor shall provide new software versions, releases, fixes, upgrades, and options immediately upon availability. Any replacement computer software product (the “replacement software”) which becomes available to contractor customers and provides similar, equal or greater substantially equivalent features, functionality and pricing as the unsupported computer program.

6.1.3 Subtask 3 – Notice of End of Life/End of Service. The contractor shall provide 12 months notice of any product reaching end of life or end of service. In the event that the contractor ceases providing support for any part of the solution, then the contractor shall provide an alternative or replacement product at no additional charge.

If DISA is unable to migrate to another product by the contractor identified End-of-Life/End-of-Service (EOS) date, then the contractor shall agree to temporarily extend support, at no additional cost, for EOS products to allow DISA additional time to upgrade to the supported version or replacement product.

On a case by case basis the contractor may, at no additional cost, extend support for EOS product(s) by 1 year (if extended support is available for the EOS product) to allow DISA additional time to upgrade to the supported version.

6.2 Task 2 – Provide Technical Support.

Technical support for the proposed solution is required. Required availability and response time varies depending on the severity level of the reported problem.

6.2.1 Subtask 1 – Escalation of Errors. The contractor shall escalate errors based on severity.

6.2.2 Subtask 2 – Software Errors – Severity Level 1. 24 hours a day x 7 days a week x 365 days a year (24x7x365), 1 hour response, 12 hours resolution following error; for current and previous release of software product. This level can be defined as the service not being operational, the production system has crashed, data integrity is at risk or production back-up and recovery operations have failed.

6.2.3 Subtask 3 – Software Errors – Severity Level 2. 8 hours a day x 5 days a week (8x5) (Monday – Friday), 2 business hours response, 24 hours resolution following error, for current and previous release of software product. This level means the application, system or service is seriously affected or implementation has stopped and no acceptable workaround is available.

6.2.4 Subtask 4 – Software Errors – Severity Level 3. 8x5 (Monday – Friday), 4 business hours response time, 2 business days resolution following error. This severity level means the application, system or service is moderately impacted, on data has been lost, and the system is still functioning. The issue may be temporarily resolved using an available workaround.

6.2.5 Subtask 5 – Software Errors – Severity Level 4. 8x5 (Monday- Friday), 1 business day response time, 5 business days resolution following error. This level includes non-critical issues, general questions, enhancement requests or documentation issues.

Managed Software Errors - Support Requirements Table

MANAGED SOFTWARE ERRORS -

SUPPORT REQUIREMENTS:

1. 24 Hours x 7 Days x 365 Days a Year Contractor Support

1. 1 hour Voice Response (contractor returns call to the Government within 1 hour)

1. Support Direct to DISA Managed / Maintained Facility

1. Resolution within 12 hours

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 2 business hours Voice Response Support Direct to DISA Managed / Maintained Facility

1. Resolution within 24 hours

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 4 business hours Voice Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

1. Resolution within 2 Business Days

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 1 business day Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

1. Resolution within 5 Business Days

X

6.3 Task 3 – Implementation of Business Application Mapping/Dependency Mapping Solution.

Implementation Services - Business Application/Services Mapping. The implementation efforts performed by the contractor will include mapping the DISA Business Services detailed in the list below labeled “List of DISA Business Services to be mapped”.

The contractor shall provide implementation services which includes on-site installation of the business application/dependency mapping solution, configuration, integration, implementation, testing, training and STIG remediation for the solution provided in pre-production, as well as the NIPR and SIPR environments. The scope of this effort includes professional services to install, integrate, configure and deploy the provided solution in pre-production, production, NIPR and SIPR environments. Professional services are required to create and implement business application mapping/dependency mapping maps and reports for the pre-defined set of ESD applications listed in this section 6.3.

DISA requires non-consecutive days of on-site installation support for the pre-production environment in Montgomery, AL, and Mechanicsburg, PA, for mainframe installation, the NIPRNet production environment, and the SIPRNet production environment to support applications residing at all DISA sites. The contractor is not required to be on site for this entire period. The environments are transitioned to site technical staff for security reviews at multiple points in the installation and configuration process. The site staff reviews can take several days. The contractor does not need to be on site for these days.

List of DISA Business Services to be mapped

Service #1 2 geographic locations. NIPR and SIPR resources.

Contiguous United States (CONUS) DISA Defense Enterprise Computing Centers (DECC)s: Columbus OH and San Antonio TX 67 Linux Red Hat ES 6 operating environments 128 Windows v2003 operating environments 24 Windows v2008 operating environments

Service #2 16 geographic locations. NIPR and SIPR resources.

CONUS DISA DECCs: Oklahoma City OK, Columbus OH, Ogden UT, Montgomery AL, Huntsville AL, St. Louis MO, Mechanicsburg PA, and San Antonio TX Outside the contiguous United States (OCONUS) DECCs: Pacific (Pearl Harbor HI), Europe (Wiesbaden GE) Non-DISA DoD sites: Raven Rock Mountain Complex (PA), Yokota AB JA, Camp Walker KO, Ft. Knox KS, Ft Wainwright AK, SWA (Bahrain) Alex-HRC-Belv, Camp Arifjan (Kuwait) 1478 Windows v2008 operating environments

Service #3 2 geographic locations. NIPR resources.

CONUS DISA DECCs: Montgomery AL and Oklahoma City OK 15 Windows v2003 operating environments 10 Solaris v10 operating environments 9 Database instances in Oracle RAC, on Linux v 6.2

Service #4 1 geographic location. NIPR resources.

CONUS DISA DECCs: Ogden UT 7 Solaris v10 LDOMs 22 Windows v2003 operating environments

Service #5 9 geographic locations. NIPR resources.

CONUS DISA DECCs: St. Louis MO, Oklahoma City OK, Columbus OH, San Antonio TX , Mechanicsburg PA, Ogden UT, Montgomery AL OCONUS DECCs: Pacific (Pearl Harbor HI), Europe (EUR) 68 Red Hat Linux ES6 operating environments

Service #6 2 geographic locations. NIPR and SIPR resources.

CONUS DISA DECCs: Oklahoma City OK, Chambersburg PA 11 Windows v2003 operating environments

Service #7 9 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Columbus OH, San Antonio TX, Mechanicsburg PA, Ogden UT, Montgomery AL OCONUS DECCs: Pacific (Pearl Harbor HI), Europe (EUR) Non-DISA DoD sites: SWA (Bahrain) Alex-HRC-Belv 46 Red Hat Linux ES 6 operating environments 8 Solaris 10 operating environments (SPARK/LDOMs and zones) 6 Windows v2003, 2 Windows v2008 operating environments 3 HP-UX v11.23 operating environments 2 Database instances on Oracle RAC

Service #8 2 geographic locations. NIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Mechanicsburg PA 3 Linux Red Hat v5 operating environments Two of these virtual machines are on the same server host.

Service #9 2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Mechanicsburg PA 48 Windows v2008 operating environments

Service #10 2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: San Antonio TX, Mechanicsburg PA, Ogden UT 35 Windows v2008 virtual operating environments 6 Windows v2008 stand alone operating environments 19 Suse Linux v11virtual operating environments

Service #11 1 geographic location. NIPR and SIPR CONUS DISA DECCs: Montgomery AL 3 RedHat Linux operating systems

Service #12 1 geographic location. NIPR and SIPR CONUS DISA DECCs: Oklahoma City OK 3 RedHat Linux operating systems

Service #13 2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Montgomery AL 14 Red Hat Linux ES6 operating systems

Service #14 2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Montgomery AL 19 Red Hat Linux ES6 operating systems 2 database instances on Oracle RAC

Service # 15 4 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Columbus OH, San Antonio TX, Mechanicsburg PA 19 Windows v2008 operating systems

Service #16 1 geographic location. NIPR CONUS DISA DECCs: Mechanicsburg PA z/OS IBM Mainframe, Model 2818-H03 (210 MIPS)

Deliverables:

Weekly Status Report

6.3.1 Subtask 1 – Stage 1 – Project Setup and Initiation. Prior to the Contractor arriving at the Government site, a series of joint conference calls will be held in order to prepare both contractor and the Government for the beginning of the implementation. Preparation will be accomplished through a Project Kickoff meeting.

1. Prerequisite planning

1. Creation and approval of project management plan

1. Scheduling of start dates and physical logistics

1. Introduction of project team

1. Validate prerequisites are completed: hardware, software, security clearance, passwords, etc.

1. Project Management for Implementation

1. Manage deliverables

1. Develop engineering solution

1. Maintain project plan

1. Attend status meeting

Deliverables:

1. Joint Project Management Plan

1. Project Schedule

0. Implementation activities

0. Resources

0. Information Assurance activities

1. Deployment Schedule

0. Deployment activities

0. Deployment resources and responsibilities

0. Deployment schedule

0. Back-out plan for contingency purposes

6.3.2 Subtask 2 – Stage 2 – Solution Requirements Definition. During Stage 2, the contractor shall review the business and IT requirements for the DISA deployment. The contractor and Government will review the current-state technical architecture and existing product architecture documents or other materials related to the implementation effort to identify unique configurations or environmental considerations that may impact the implementation. The contractor reviews and documents requirements for the pre-production, NIPRNet and SIPRNet and provides a Solution Requirements Specification Document (SRS) deliverable.

Deliverables:

Solution Requirements Specification (SRS)

6.3.3 Subtask 3 – Stage 3 –Solution Architecture and Design. During this stage, the contractor shall work with the Government to establish and document the engineering solution architecture and design, as well as the high level solution test and integration plans.

The project team will conduct an initial workshop to define and document the design and configuration decisions needed to support the requirements defined in the PWS.

1. Identify architecture approach based on best practices

1. Identify data flow

1. Identify integration solution architecture

1. Identify data sharing requirements for interface

1. Review requirements for initial service views

The team will produce the engineering solution design document that contains:

1. Solution Architecture Model - Defines solution components, component interface specifications

1. Physical Architecture Model – Provides a network diagram, system specifications and configurations

1. Validation Approach - Provides a high level description of how the solution’s functional and non-functional requirements will be validated

1. Solution Phasing - Describes the sequence of phases to roll out the solution and the high level integration plan

As an output of this stage, the contractor shall provide a configuration design document deliverable describing the configurations that have been applied by the contractor to the solution in the pre-production, SIPRnet and NIPRnet environments. This document shall contain all of the following:

1. Configuration specifics, including code changes, settings, etc.

1. Discovery methods for initial services

1. Integration configuration details

1. Reporting configuration details

Deliverables:

6.3.4 Subtask 4 – Stage 4 Solution Install, Configuration and Security Technical Implementation Guides (STIG). During stage 4, the contractor shall work with the Government to install and configure the solution in a pre-production/test environment, from Montgomery, AL. DISA requires non-consecutive days of on-site installation support from the Offeror for the pre-production installation from Montgomery, AL. The contractor shall work with the Government to ensure all STIG requirements and application reviews are successfully conducted. The contractor shall address any outstanding security items. Any outstanding items shall have a plan of action and milestones (POA&M) document or the contractor will bring the solution requirements.

Deliverables:

6.3.5 Subtask 5 – Stage 5 – Production deployment, STIG and integration. During stage 5, the contractor shall work with the Government to install and configure the solution in the production environment for both NIPRNet and SIPRNet at the DISA site locations identified in the engineering solution. During this stage, the contractor shall discover and map each of the 16 DISA applications, listed in section 6.3 and their supporting infrastructure accurately and in their entirety.

During this stage, the contractor shall ensure the application/services information in the business application mapping solution and the configuration item relationship information is consumable by DISA’s Enterprise ITSM solution and is acceptable by the government.

The contractor shall work with the Government to ensure all STIG findings are mitigated, POA&Ms are written as required and application reviews are successfully conducted. DISA requires non-consecutive days of installation support for a NIPRNet production environment, and a SIPRNet production environment within the government sites. Any outstanding items shall be mitigated by the contractor or shall have a POA&M document submitted to the Information Assurance team to ensure compliance with the certification and accreditation process. The contractor shall conduct a technical wrap-up session to provide final project documentation (the “Solution Documents”) to the Government and review proposed next steps/phases.

Deliverables:

1. Updated solution documents including:

0. Engineering Solution Design

0. Configuration Design Document

0. Customized User and Administration Manual

1. Automatic discovery of and complete Application/Service maps for services in section 6.3

6.3.6 Subtask 6 – Stage 6 Quality Assurance and Test. During this Stage, for each environment, the project team consisting of government personnel and contractor personnel, operators and end users shall perform quality assurance and verify operational integrity.

The government with contractor personnel support shall validate the production environments and utilize test plans to ensure mandatory requirements are met as well as execute use cases supplied by the government based on defined functional and technical requirements. The government will only accept a fully functional solution that meets the performance requirements in section 6 of the PWS.

Deliverables:

Test Results Report

6.3.7 Subtask 7 – Stage 7 – Configuration Documentation and Backup. During this stage, the contractor shall complete and supply the government with the system documentation and backup strategy. The team will review the backup strategy for the solution and finalize recovery options.

Deliverable:

Backup Strategy Document

6.3.8 Subtask 8 – Stage 8 – Knowledge Transfer. During the implementation effort, Government personnel will receive knowledge transfer including documentation from the contractor describing DISA-specific installation and configuration items. Prior to this stage, Government administrator personnel will have attended the contractor recommended training defined in Task 4 in order to facilitate knowledge transfer and understand the acquired products. The contractor and the government shall agree on when the training is scheduled. The contractor’s tasks for this stage shall include:

1. Review deployment architecture

1. Demonstrate access management functionality

1. Walkthrough discovery processes

1. Walkthrough configuration processes

1. Walkthrough delivered technical documentation

Deliverables:

Checklist of Tasks Completed

6.3.9 Subtask 9 – Stage 9 – Implementation handoff and closure. During this Stage, the contractor project manager shall conduct an implementation closure meeting or conference call to validate that the solution conforms to requirements identified in the PWS.

Technical Closure Requirements:

Finalize project documentation Conduct final solution review session

Deliverables:

Implementation Closure Meeting and implementation sign-off

6.4 Task 4 – Training.

The contractor shall provide onsite training for business application mapping/dependency mapping software. Contractor shall provide the training for personnel based on role and position for the solution. Training courses shall be specifically designed and developed for DISA’s configuration and implementation. Training is to include user and administrator training, and also include a reporting course.

The contractor shall provide training sessions to be held at CONUS DISA government sites as follows:

1. Two (2) instructor led training to cover Administration of the solution for 6 students at a government site

1. Four (4) instructor led training to cover Users of the solution for up to 20 students at a government site

1. Two (2) instructor led training to cover Reporting with the solution for 5 students at a government site

1. All classroom and lab guides used during the training courses will be provided to the government and the contractor will support DCO sessions, for training, when requested by the government.

Deliverables:

7. Performance Standards:

Deliverables –

1. Joint Project Management Plan

100% inspection

Deliverable – Solution Requirements Specification

100% inspection

Deliverables –

1. Engineering Solution Design

1. Configuration Design Document

1. Integration Plan

1. Draft Test Plan

100% inspection

Deliverables –

1. Security Application Review

1. Installation Guide

1. Customized User and Administrator Guide

100% inspection

Deliverable –

· Updated Solution Document

· Complete application service maps listed in 6.3

100% inspection

Deliverables –

1. Test Results Report

100% inspection

Deliverable – Backup Strategy Documentation

100% inspection

Deliverables –

1. Checklist of completed tasks

100% inspection

Deliverable – Implementation Closure Meeting and project sign-off

100% inspection

Deliverables –

1. Training Plan

1. Training Curriculum

1. Training Manuals/Documents

100% inspection

8. Incentives:

None.

9. Place of Performance: Work on this contract shall be performed at DISA Government sites in Montgomery, AL, Mechanicsburg and Oklahoma City, OK. Training may take place at designated CONUS DISA sites.

Alternate Place of Performance - Contingency Only. Contractor employees may be required to work at home, another approved activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. COR approval is required.

Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment.

10. Period of Performance (PoP): The PoP for this contract will be one base year from the date of award, and 4 one-year option periods.

As directed by the COR, the contractor shall continue performance in emergency or mission-essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Delivery Schedule: Deliverables shall be prepared using the Microsoft Office products where applicable, e.g., Word, Excel, PowerPoint, Visio.

Title

Date

6.3.2