HC1028-13-R-0046.doc

Section A - Solicitation/Contract Form

SECTION A - RFP INFORMATION

A.1.1. Defense Information Technology Contracting Organization (DITCO) is issuing a Request for Proposal (RFP) /solicitation for a Commercial Off-The-Shelf (COTS) Business Application Mapping (BAM) Solution, in support of Defense Information Systems Agency (DISA).

A.1.2. The RFP HC1028-13-R-0046 responses are due no later than Tuesday, November 11, 2013, 3:00PM, CST. See section L for further delivery instructions. Questions pertaining to this RFP shall be submitted electronically to christopher.p.jordan13.civ@mail.mil not later than Wednesday, November 4, 2013, 3:00PM, CST. The Government cannot guarantee a response to any questions received after this date/time.

A.1.3. DITCO/PL8321 is requesting proposals from qualified contractors who can provide a BAM solution. The agency will award a Firm-Fixed-Price contract using the best value criteria in section M. The government reserves the right to make award to one contractor, or to make no award in respond to this solicitation.

A.1.4. In response to this RFP, no terms, conditions or assumptions will be entertained. All issues will be resolved with questions and answers. Submission of terms, conditions or assumptions included in your proposal may be cause for your proposal to be determined non-responsive to this RFP and may be excluded.

Section B - Supplies or Services and Prices

Software Licenses and Assurance

FFP

Business Application Mapping Solution (Software/Licenses/Assurance)

The contractor shall provide BAM Solution in accordance with (IAW) the Performance Work Statement (PWS).

The contractor shall invoice upon delivery and acceptance. CLINS ARE SUBJECT TO CHANGE UPON AWARD TO COORDINATE WITH THE PROPOSAL.

FOB: Destination

NET AMT

Implementation

Business Application Mapping Implementation

The contractor shall provide BAM implementation IAW the PWS.

The contractor shall invoice upon task completion and acceptance. See Section B for Payment Structure.

CLINS ARE SUBJECT TO CHANGE UPON AWARD TO COORDINATE WITH THE PROPOSAL.

NET AMT

Training

Business Application Mapping Training The contractor shall provide BAM training IAW the PWS.

The contractor shall Invoice upon training completion.

NET AMT

Lot

Travel

COST

Business Application Mapping - Travel.

The contractor shall provide Travel IAW the PWS.

Travel shall be authorized, in writing, by the Government prior to performance. Travel shall be paid in accordance with Joint Travel Regulations (JTR) and FAR Part 31.205-46.

All travel invoices shall be provided to the Government for review/certification prior to submission for payment. After acceptance the contractor shall invoice monthly.

ESTIMATED COST

Optional Growth

Optional Business Application Mapping - for Government Growth The contractor shall provide for Government Growth IAW the PWS. CLINS ARE SUBJECT TO CHANGE UPON AWARD TO COORDINATE WITH THE PROPOSAL.

NET AMT

FFP

Business Application Mapping Sustainment

The contractor shall provide BAM Sustainment IAW the PWS. CLINS ARE SUBJECT TO CHANGE UPON AWARD TO COORDINATE WITH THE PROPOSAL.

NET AMT

FFP

Business Application Mapping Sustainment

The contractor shall provide BAM Sustainment IAW the PWS. CLINS ARE SUBJECT TO CHANGE UPON AWARD TO COORDINATE WITH THE PROPOSAL.

NET AMT

FFP

Business Application Mapping Sustainment The contractor shall provide BAM Sustainment IAW the PWS.

NET AMT

FFP

Business Application Mapping Sustainment The contractor shall provide BAM Sustainment IAW the PWS.

NET AMT

SECTION B

B.1.1. The Government requests the offerors propose a Contract Line Item Number (CLIN) / Sub-Contract Line Item Number (SLIN) structure as identified in the solicitation. Contractors shall provide all cost breakouts to support their proposed cost.

B.1.2. Payment Structure - All implementation deliverables will need to be tied to Performance Work Statement (PWS) deliverables, significant milestones. The contractor shall propose a firm fixed price payment plan commensurate with the value of the deliverables and/or significant milestones in the PWS for this requirement. A firm fixed price payment plan with the total dollar amount divided into twelve (12) equal payments will not be accepted.

The contractor will be authorized to invoice monthly for all approved travel costs incurred and approved by the Contracting Officer Representative (COR).

Example:

20% Tasks 1 - 3

Tasks 4 - 6

Tasks 7 - 8

40% Task 9

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

as of October 9, 2013

1. Contracting Officer Representative (COR):

a. Primary COR:

Department of Defense Activity Address Code (DODAAC):

H98249

Greenwood Village, CO 80155-4598

b. Alternate COR:

Chambersburg, PA 17201

2. Contract Title: Business Application Mapping Solution

3. Background: Defense Information Systems Agency’s (DISA) in support of the warfighter requires detailed knowledge of our computing network infrastructure to ensure DISA meets service level agreements for application availability requirements. The Business Application Mapping solution will provide visualization of all the interactions or dependencies each business service has with our underlying application infrastructure, regardless of environment, to include communication devices that regularly and automatically updates the visualizations as changes to the service or infrastructure occur. DISA’s significant virtual environment hinders our current ability to obtain accurate information detailing the cascade of affects one device failure may cause.

The solution will allow DISA to automatically and electronically discover and map all application footprints in the infrastructure and automatically modify the discovered service map when new assets are installed on the datacenter floor, application configurations are modified, or existing assets are technology refreshed. The solution will maintain a near-real time service map that may also be used during disaster recovery scenarios. This solution will allow DISA to understand the complex relationships between applications, server, network connections and network devices as well as storage resources, which are particularly challenging in the DISA data center environment due to continual virtual machine migrations and scaled out storage solutions. Application mapping and transaction profiling are critical in quickly determining the root cause of bottlenecks in distributed environments like service-oriented architecture (SOA) and Cloud. As DISA moves more and more towards a cloud infrastructure, a business application mapping solution is imperative to DISA’s success in supporting mission requirements.

DISA’s incident, problem, change and configuration management tool is BMC Software’s Information Technology Service Management (ITSM) solution. Relationship data from the business application mapping solution provided by the offeror is intended to be consumable by DISA’s ITSM solution. The application mapping solution would serve to provide a near real-time visualization of the underlying application infrastructure for all business services across the DISA enterprise.

“Business services” in DISA, relates to customer-owned or internal business applications. The Department of Defense (DoD) Enterprise Email solution is an example of a DISA business service. The business application mapping solution provided must support multiple views of a business service to include a comprehensive view of all interactions and dependencies of a business service and sub-applications where applicable. The solution must support parent-child relationships among service components.

4. Objectives: The requirement is to establish a business application-mapping tool that provides the capability to discover and provide visualization of business service interactions and dependencies for both stand-alone hardware operating environments (hosts) and virtual operating environments (VOE) (hosts) in both mid-tier and mainframe environments. The environments the solution must discover to build business application maps includes Windows and Linux (and VMware Windows and Linux VOEs), Solaris (and Logical Domains (LDOMs), containers and zones), Hewlett Packard Unix (HP-UX) (and Integrity Virtual Machines (IVMs)), IBM Advanced Interactive eXecutive (AIX) (and Logical Partitions (LPARs)), IBM System z operating system (z/OS) (and LPARs, Virtual Machines (VMs), and Linux VMs) as well as communications and storage dependencies. The solution will provide the capability for DISA to visualize interactions and dependencies of components, in the tool and in an extract, for all business services on both the Non-Classified Internet Protocol Router Network (NIPRNet) production environment, the Secure Internet Protocol Router Network (SIPRNet) production environment and on DISA’s out of band network. This visualization will allow DISA to ensure outages or service issues are addressed quickly and effectively.

5. Scope: The scope of this requirement is to provide a Commercial Off-The-Shelf (COTS) solution meeting all Government technical requirements listed in section 6, along with, software licenses, implementation services, on-site technical support, system documentation, training and software/solution maintenance. The contractor shall provide implementation support to include engineering, system architecture, security posture, configuration, implementation, training and integration development for the solution. The contractor will deploy their solution within DISA and produce accurate service maps and views for the pre-defined set of DISA services described in section 6.3. The integration efforts include integration with the DISA Enterprise ITSM solution.

6. Performance Requirements: The contractor shall provide a solution that includes all of the following capabilities.

6.1 Task 1 – Provide Software Licenses and Maintenance Support

The contractor shall provide Business Application Mapping/Dependency software licensing or appliance licensing, and software maintenance support. Licensing shall cover DISA’s entire environment to include applications residing in NIPR, SIPR and pre-production enclaves.

DISA’s environment is identified below.

DISA Environment

9850 - Operating Environments (OE's) includes all OEs (both virtual OEs and the 5650 physical hardware devices in the next line below)

5650 – Mid-Tier Physical Hardware Devices

Mainframe Hosts currently deployed –

2818-P02

2098-L02

2098-N05

2098-A02

2098-V04

2098-M03

2818-P03

2818-S04

2098-J04

2098-T05

2818-O03

2098-V02

2098-T04

2818-A01

2818-A01

2818-H03

2098-V03

2818-A01

2098-K04

2818-U04

2098-E10

2818-A01

2287 - Business Applications (These are complex business applications, not software products)

Business Applications fall into three categories at DISA. ESTIMATED totals of each type are listed below:

1. 45 - Internal Business Applications

2. 13 - Services Applications

3. 2200 - Customer Applications

900 Users (Estimated)

17 locations/sites may require the solution

6.1.1 Subtask 1 – Software keys – The contractor shall provide software keys, whether routine or emergency, after initial request.

6.1.2 Subtask 2 – New Software versions, fixes, upgrades, options. The contractor shall provide new software versions, releases, fixes, upgrades, and options immediately upon availability. Any replacement computer software product (the “replacement software”) which becomes available to contractor customers and provides similar, equal or greater substantially equivalent features, functionality and pricing as the unsupported computer program.

6.1.3 Subtask 3 – Notice of End of Life/End of Service. The contractor shall provide 12 months notice of any product reaching end of life or end of service. In the event that the contractor ceases providing support for any part of the solution, then the contractor shall provide an alternative or replacement product at no additional charge.

If DISA is unable to migrate to another product by the contractor identified End-of-Life/End-of-Service (EOS) date, then the contractor shall agree to temporarily extend support, at no additional cost, for EOS products to allow DISA additional time to upgrade to the supported version or replacement product.

On a case by case basis the contractor may, at no additional cost, extend support for EOS product(s) by 1 year (if extended support is available for the EOS product) to allow DISA additional time to upgrade to the supported version.

6.2 Task 2 – Provide Technical Support.

Technical support for the proposed solution is required. Required availability and response time varies depending on the severity level of the reported problem.

6.2.1 Subtask 1 – Escalation of Errors. The contractor shall escalate errors based on severity.

6.2.2 Subtask 2 – Software Errors – Severity Level 1. 24 hours a day x 7 days a week x 365 days a year (24x7x365), 1 hour response, 12 hours resolution following error; for current and previous release of software product. This level can be defined as the service not being operational, the production system has crashed, data integrity is at risk or production back-up and recovery operations have failed.

6.2.3 Subtask 3 – Software Errors – Severity Level 2. 8 hours a day x 5 days a week (8x5) (Monday – Friday), 2 business hours response, 24 hours resolution following error, for current and previous release of software product. This level means the application, system or service is seriously affected or implementation has stopped and no acceptable workaround is available.

6.2.4 Subtask 4 – Software Errors – Severity Level 3. 8x5 (Monday – Friday), 4 business hours response time, 2 business days resolution following error. This severity level means the application, system or service is moderately impacted, on data has been lost, and the system is still functioning. The issue may be temporarily resolved using an available workaround.

6.2.5 Subtask 5 – Software Errors – Severity Level 4. 8x5 (Monday- Friday), 1 business day response time, 5 business days resolution following error. This level includes non-critical issues, general questions, enhancement requests or documentation issues.

Managed Software Errors - Support Requirements Table

MANAGED SOFTWARE ERRORS -

SUPPORT REQUIREMENTS:

· 24 Hours x 7 Days x 365 Days a Year Contractor Support

· 1 hour Voice Response (contractor returns call to the Government within 1 hour)

· Support Direct to DISA Managed / Maintained Facility

· Resolution within 12 hours X

· 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

· 2 business hours Voice Response Support Direct to DISA Managed / Maintained Facility

· Resolution within 24 hours

X

· 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

· 4 business hours Voice Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

· Resolution within 2 Business Days

X

· 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

· 1 business day Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

· Resolution within 5 Business Days

X

6.3 Task 3 – Implementation of Business Application Mapping/Dependency Mapping Solution.

Implementation Services - Business Application/Services Mapping. The implementation efforts performed by the contractor will include mapping the DISA Business Services detailed in the list below labeled “List of DISA Business Services to be mapped”.

The contractor shall provide implementation services which includes on-site installation of the business application/dependency mapping solution, configuration, integration, implementation, testing, training and STIG remediation for the solution provided in pre-production, as well as the NIPR and SIPR environments. The scope of this effort includes professional services to install, integrate, configure and deploy the provided solution in pre-production, production, NIPR and SIPR environments. Professional services are required to create and implement business application mapping/dependency mapping maps and reports for the pre-defined set of ESD applications listed in this section 6.3.

DISA requires non-consecutive days of on-site installation support for the pre-production environment in Montgomery, AL, and Mechanicsburg, PA, for mainframe installation, the NIPRNet production environment, and the SIPRNet production environment to support applications residing at all DISA sites. The contractor is not required to be on site for this entire period. The environments are transitioned to site technical staff for security reviews at multiple points in the installation and configuration process. The site staff reviews can take several days. The contractor does not need to be on site for these days.

List of DISA Business Services to be mapped

Service #1

2 geographic locations. NIPR and SIPR resources.

Contiguous United States (CONUS) DISA Defense Enterprise Computing Centers (DECC)s: Columbus OH and San Antonio TX

67 Linux Red Hat ES 6 operating environments

128 Windows v2003 operating environments

24 Windows v2008 operating environments

Service #2

16 geographic locations. NIPR and SIPR resources.

CONUS DISA DECCs: Oklahoma City OK, Columbus OH, Ogden UT, Montgomery AL, Huntsville AL, St. Louis MO, Mechanicsburg PA, and San Antonio TX

Outside the contiguous United States (OCONUS) DECCs: Pacific (Pearl Harbor HI), Europe (Wiesbaden GE)

Non-DISA DoD sites: Raven Rock Mountain Complex (PA), Yokota AB JA, Camp Walker KO, Ft. Knox KS, Ft Wainwright AK, SWA (Bahrain) Alex-HRC-Belv, Camp Arifjan (Kuwait)

1478 Windows v2008 operating environments

Service #3

2 geographic locations. NIPR resources.

CONUS DISA DECCs: Montgomery AL and Oklahoma City OK

15 Windows v2003 operating environments

10 Solaris v10 operating environments

9 Database instances in Oracle RAC, on Linux v 6.2

Service #4

1 geographic location. NIPR resources.

CONUS DISA DECCs: Ogden UT

7 Solaris v10 LDOMs

22 Windows v2003 operating environments

Service #5

9 geographic locations. NIPR resources.

CONUS DISA DECCs: St. Louis MO, Oklahoma City OK, Columbus OH, San Antonio TX , Mechanicsburg PA, Ogden UT, Montgomery AL

OCONUS DECCs: Pacific (Pearl Harbor HI), Europe (EUR)

68 Red Hat Linux ES6 operating environments

Service #6

2 geographic locations. NIPR and SIPR resources.

CONUS DISA DECCs: Oklahoma City OK, Chambersburg PA

11 Windows v2003 operating environments

Service #7

9 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Columbus OH, San Antonio TX, Mechanicsburg PA, Ogden UT, Montgomery AL

OCONUS DECCs: Pacific (Pearl Harbor HI), Europe (EUR)

Non-DISA DoD sites: SWA (Bahrain) Alex-HRC-Belv

46 Red Hat Linux ES 6 operating environments

8 Solaris 10 operating environments (SPARK/LDOMs and zones)

6 Windows v2003, 2 Windows v2008 operating environments

3 HP-UX v11.23 operating environments

2 Database instances on Oracle RAC

Service #8

2 geographic locations. NIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Mechanicsburg PA

3 Linux Red Hat v5 operating environments

Two of these virtual machines are on the same server host.

Service #9

2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Mechanicsburg PA

48 Windows v2008 operating environments

Service #10

2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: San Antonio TX, Mechanicsburg PA, Ogden UT

35 Windows v2008 virtual operating environments

6 Windows v2008 stand alone operating environments

19 Suse Linux v11virtual operating environments

Service #11

1 geographic location. NIPR and SIPR

CONUS DISA DECCs: Montgomery AL

3 RedHat Linux operating systems

Service #12

1 geographic location. NIPR and SIPR

CONUS DISA DECCs: Oklahoma City OK

3 RedHat Linux operating systems

Service #13

2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Montgomery AL

14 Red Hat Linux ES6 operating systems

Service #14

2 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Montgomery AL

19 Red Hat Linux ES6 operating systems

2 database instances on Oracle RAC

Service # 15

4 geographic locations. NIPR, SIPR and Pre-prod resources.

CONUS DISA DECCs: Oklahoma City OK, Columbus OH, San Antonio TX, Mechanicsburg PA

19 Windows v2008 operating systems

Service #16

1 geographic location. NIPR

CONUS DISA DECCs: Mechanicsburg PA z/OS IBM Mainframe, Model 2818-H03 (210 MIPS)

Deliverables:

Weekly Status Report

6.3.1 Subtask 1 – Stage 1 – Project Setup and Initiation. Prior to the Contractor arriving at the Government site, a series of joint conference calls will be held in order to prepare both contractor and the Government for the beginning of the implementation. Preparation will be accomplished through a Project Kickoff meeting.

· Prerequisite planning

· Creation and approval of project management plan

· Scheduling of start dates and physical logistics

· Introduction of project team

· Validate prerequisites are completed: hardware, software, security clearance, passwords, etc.

· Project Management for Implementation

· Manage deliverables

· Develop engineering solution

· Maintain project plan

· Attend status meeting

· Joint Project Management Plan

· Project Schedule

· Implementation activities

· Resources

· Information Assurance activities

· Deployment Schedule

· Deployment activities

· Deployment resources and responsibilities

· Deployment schedule

· Back-out plan for contingency purposes

6.3.2 Subtask 2 – Stage 2 – Solution Requirements Definition. During Stage 2, the contractor shall review the business and IT requirements for the DISA deployment. The contractor and Government will review the current-state technical architecture and existing product architecture documents or other materials related to the implementation effort to identify unique configurations or environmental considerations that may impact the implementation. The contractor reviews and documents requirements for the pre-production, NIPRNet and SIPRNet and provides a Solution Requirements Specification Document (SRS) deliverable.

Solution Requirements Specification (SRS)

6.3.3 Subtask 3 – Stage 3 –Solution Architecture and Design. During this stage, the contractor shall work with the Government to establish and document the engineering solution architecture and design, as well as the high level solution test and integration plans.

The project team will conduct an initial workshop to define and document the design and configuration decisions needed to support the requirements defined in the PWS.

· Identify architecture approach based on best practices

· Identify data flow

· Identify integration solution architecture

· Identify data sharing requirements for interface

· Review requirements for initial service views

The team will produce the engineering solution design document that contains:

· Solution Architecture Model - Defines solution components, component interface specifications

· Physical Architecture Model – Provides a network diagram, system specifications and configurations

· Validation Approach - Provides a high level description of how the solution’s functional and non-functional requirements will be validated

· Solution Phasing - Describes the sequence of phases to roll out the solution and the high level integration plan

As an output of this stage, the contractor shall provide a configuration design document deliverable describing the configurations that have been applied by the contractor to the solution in the pre-production, SIPRnet and NIPRnet environments. This document shall contain all of the following:

· Configuration specifics, including code changes, settings, etc.

· Discovery methods for initial services

· Integration configuration details

· Reporting configuration details

· Deliverables:

Engineering Solution Design

Configuration Design Document

Draft Integration Plan

Draft Test Plan (based on validation approach)

6.3.4 Subtask 4 – Stage 4 Solution Install, Configuration and Security Technical Implementation Guides (STIG). During stage 4, the contractor shall work with the Government to install and configure the solution in a pre-production/test environment, from Montgomery, AL. DISA requires non-consecutive days of on-site installation support from the Offeror for the pre-production installation from Montgomery, AL. The contractor shall work with the Government to ensure all STIG requirements and application reviews are successfully conducted. The contractor shall address any outstanding security items. Any outstanding items shall have a plan of action and milestones (POA&M) document or the contractor will bring the solution requirements.

Deliverables:

Installation Guide

Customized User and Administrator Manual

Security Application Reviews

6.3.5 Subtask 5 – Stage 5 – Production deployment, STIG and integration. During stage 5, the contractor shall work with the Government to install and configure the solution in the production environment for both NIPRNet and SIPRNet at the DISA site locations identified in the engineering solution. During this stage, the contractor shall discover and map each of the 16 DISA applications, listed in section 6.3 and their supporting infrastructure accurately and in their entirety.

During this stage, the contractor shall ensure the application/services information in the business application mapping solution and the configuration item relationship information is consumable by DISA’s Enterprise ITSM solution and is acceptable by the government.

The contractor shall work with the Government to ensure all STIG findings are mitigated, POA&Ms are written as required and application reviews are successfully conducted. DISA requires non-consecutive days of installation support for a NIPRNet production environment, and a SIPRNet production environment within the government sites. Any outstanding items shall be mitigated by the contractor or shall have a POA&M document submitted to the Information Assurance team to ensure compliance with the certification and accreditation process. The contractor shall conduct a technical wrap-up session to provide final project documentation (the “Solution Documents”) to the Government and review proposed next steps/phases.

· Updated solution documents including:

· Engineering Solution Design

· Configuration Design Document

· Customized User and Administration Manual

· Automatic discovery of and complete Application/Service maps for services in section 6.3

· 6.3.6 Subtask 6 – Stage 6 Quality Assurance and Test. During this Stage, for each environment, the project team consisting of government personnel and contractor personnel, operators and end users shall perform quality assurance and verify operational integrity.

· The government with contractor personnel support shall validate the production environments and utilize test plans to ensure mandatory requirements are met as well as execute use cases supplied by the government based on defined functional and technical requirements. The government will only accept a fully functional solution that meets the performance requirements in section 6 of the PWS.

Test Results Report

· 6.3.7 Subtask 7 – Stage 7 – Configuration Documentation and Backup. During this stage, the contractor shall complete and supply the government with the system documentation and backup strategy. The team will review the backup strategy for the solution and finalize recovery options.

· Deliverable:

Backup Strategy Document

· 6.3.8 Subtask 8 – Stage 8 – Knowledge Transfer. During the implementation effort, Government personnel will receive knowledge transfer including documentation from the contractor describing DISA-specific installation and configuration items. Prior to this stage, Government administrator personnel will have attended the contractor recommended training defined in Task 4 in order to facilitate knowledge transfer and understand the acquired products. The contractor and the government shall agree on when the training is scheduled. The contractor’s tasks for this stage shall include:

· Review deployment architecture

· Demonstrate access management functionality

· Walkthrough discovery processes

· Walkthrough configuration processes

· Walkthrough delivered technical documentation

Checklist of Tasks Completed

· 6.3.9 Subtask 9 – Stage 9 – Implementation handoff and closure. During this Stage, the contractor project manager shall conduct an implementation closure meeting or conference call to validate that the solution conforms to requirements identified in the PWS.

· Technical Closure Requirements:

· Finalize project documentation

· Conduct final solution review session

Implementation Closure Meeting and implementation sign-off

· 6.4 Task 4 – Training.

· The contractor shall provide onsite training for business application mapping/dependency mapping software. Contractor shall provide the training for personnel based on role and position for the solution. Training courses shall be specifically designed and developed for DISA’s configuration and implementation. Training is to include user and administrator training, and also include a reporting course.

The contractor shall provide training sessions to be held at CONUS DISA government sites as follows:

· Two (2) instructor led training to cover Administration of the solution for 6 students at a government site

· Four (4) instructor led training to cover Users of the solution for up to 20 students at a government site

· Two (2) instructor led training to cover Reporting with the solution for 5 students at a government site

· All classroom and lab guides used during the training courses will be provided to the government and the contractor will support DCO sessions, for training, when requested by the government.

Training Plan

Training Curriculum

Training Manuals/Documents

7. Performance Standards:

Deliverables –

· Joint Project Management Plan

100% inspection

Deliverable – Solution Requirements Specification

100% inspection

Deliverables –

· Engineering Solution Design

· Configuration Design Document

· Integration Plan

· Draft Test Plan

100% inspection

Deliverables –

· Security Application Review

· Installation Guide

· Customized User and Administrator Guide

100% inspection

Deliverable –

· Updated Solution Document

· Complete application service maps listed in 6.3

100% inspection

Deliverables –

· Test Results Report

100% inspection

Deliverable – Backup Strategy Documentation

100% inspection

Deliverables –

· Checklist of completed tasks

100% inspection

Deliverable – Implementation Closure Meeting and project sign-off

100% inspection

Deliverables –

· Training Plan

· Training Curriculum

· Training Manuals/Documents

100% inspection

8. Incentives:

None.

9. Place of Performance: Work on this contract shall be performed at DISA Government sites in Montgomery, AL, Mechanicsburg and Oklahoma City, OK. Training may take place at designated CONUS DISA sites.

Alternate Place of Performance - Contingency Only. Contractor employees may be required to work at home, another approved activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. COR approval is required.

Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment.

10. Period of Performance (PoP): The PoP for this contract will be one base year from the date of award, and 4 one-year option periods.

As directed by the COR, the contractor shall continue performance in emergency or mission-essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Delivery Schedule: Deliverables shall be prepared using the Microsoft Office products where applicable, e.g., Word, Excel, PowerPoint, Visio.

Title

Date

6.3.2

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR or TM.

12. Security: Work on this will support classified projects and systems.

12.1 The Contractor shall comply with all appropriate provisions of the security regulations. Specific security requirements are identified in Attachment J-1, DD Form 254 for the basic contract.

12.2 Security Clearances. Technical Implementation personnel working for the contractor require IT-1 Secret clearances on day one of service delivery. Personnel are required to complete mandatory security training prior to receiving a Common Access Card and a laptop. All development and configuration work must be completed using GFE equipment over DISA’s internal networks. The work is unclassified in the pre-production environment and on NIPRNet, but the work is classified SECRET on SIPRNet. The Technical Point of Contact (TPOC) will coordinate or be copied on all Visit Authorization Requests from Offeror. Security clearances are required by personnel providing implementation services from the Offeror.

Contractor personnel shall comply with local security requirements for entry and exit control for personnel and property at the government facility.

Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Failure to comply with security requirements can be cause for revocation of access privileges and removal from the contract.

At a MINIMUM, provisions for security include those as listed in the sections that follow:

· Supports Common Access Card (CAC) authentication

· Supports Internet Protocol Version 6

· Software Security - Access http://iase.disa.mil/stigs/index.html to utilize the most current version(s) of the security guides, memos, and references including but not limited to below:

· Access Control STIG – Version 2, Release 3

· Application Security and Development STIG Version 3, Release 4

· Application Security Development STIG Release Memo – Version 3

· Application Services STIG – Version 1, Release 1

· Database Security Requirements Guide (SRG) – Version 1, Release 1

· Applicable OS STIG(s)

· Applicable Web STIG

· Information Assurance - Access http://www.dtic.mil/whs/directives/corres/dir.html to utilize the most current version of the DoD Information Assurance references listed below:

· DoD Directive 8500.1, "Information Assurance (IA)”

· DoD Instruction 8500.2, "Information Assurance (IA) Implementation”

12.3 Visit Authorization Letters (VAL). The contractor's security Point of Contract (POC) will forward requests for facility visits directly to the DISA Visit Access Request (VAR) Center via the Joint Personnel Adjudication System (JPAS) using Security Management Office (SMO) Code: to be determined upon award.

The contractor will forward a VAL to the COR identified in paragraph 1.0 of this PWS for all employees, both prior to the beginning of each contracting/task order PoP, and as new contractor employees are assigned to the contract.

The VAL should be sent using one of two approved methods. The preferred method is to e-mail the VAL. Because it contains sensitive information covered by the Privacy Act, the VAL document should compressed into the "zip" file archiving format using 256-bit AES encryption (password-protected) and transmitted via one e-mail and then followed-up by a separate e-mail with the password to unlock the compressed file. The alternative method is to transmit the VAL via facsimile to the number listed. Prior coordination with the COR should be made by phone to validate the method of transmission is agreed upon and properly secure.

The VAL will be on company letterhead or pre-fabricated form and contain the following information:

· Contract number with start and…