HC1028-14-R-0032_conformed_as_of_Amendment_0002.doc

HC1028-14-R-0032

Section SF 1449 - CONTINUATION SHEET

Program Management

FFP

Provide Program Management support in accordance with (IAW) Performance Work Statement (PWS) Task 1, paragraph 6.1.

FOB: Destination

NET AMT

Software/Hardware Configuration

Provide Software/Hardware Configuration accordance with (IAW) Performance Work Statement (PWS) Task 2, paragraph 6.2.

NET AMT

Testing

Provide Testing accordance with (IAW) Performance Work Statement (PWS) Task 3, paragraph 6.3.

NET AMT

Training

Provide Training in accordance with (IAW) Performance Work Statement (PWS) Task 4, paragraph 6.4.

NET AMT

Deployment

Deploy DECA TAS hardware/software IAW PWS Task 5, paragraph 6.5.

NET AMT

Lot

Travel

COST

Travel in accordance with (IAW) Performance Work Statement (PWS).

ESTIMATED COST

FFP

Provide Program Management support in accordance with (IAW) Performance Work Statement (PWS) Task 1, paragraph 6.1.

NET AMT

FFP

Provide Operations and Sustainment support in accordance with (IAW) Performance Work Statement (PWS) Task 6, paragraph 6.6.

NET AMT

Lot

COST

NET AMT

FFP

Provide Program Management support in accordance with (IAW) Performance Work Statement (PWS) Task 1, paragraph 6.1.

NET AMT

FFP

Provide Operations and Sustainment support in accordance with (IAW) Performance Work Statement (PWS) Task 6, paragraph 6.6.

NET AMT

Lot

COST

NET AMT

FFP

Provide Program Management support in accordance with (IAW) Performance Work Statement (PWS) Task 1, paragraph 6.1.

NET AMT

FFP

Provide Operations and Sustainment support in accordance with (IAW) Performance Work Statement (PWS) Task 6, paragraph 6.6.

NET AMT

Lot

COST

NET AMT

FFP

Provide Program Management support in accordance with (IAW) Performance Work Statement (PWS) Task 1, paragraph 6.1.

NET AMT

FFP

Provide Operations and Sustainment support in accordance with (IAW) Performance Work Statement (PWS) Task 6, paragraph 6.6.

NET AMT

Lot

COST

NET AMT

PERFORMANCE WORK STATEMENT

PWS

Defense Commissary Agency (DeCA) Time and Attendance System (TAS)

Performance Work Statement (PWS) as of June 18, 2014

Contract Number:

Task Order Number:

1. Contracting Officer Representative (COR).

a. Primary COR.

Department of Defense Activity Address Code (DODAAC):

HQCAAA

b. Alternate COR.

2. Task Order Title. DeCA TAS

The TAS PWS will enable DeCA to acquire a commercial off-the-shelf (COTS) TAS that provides DeCA an automated timekeeping and schedule exception tracking capability. This will allow DeCA to achieve efficiencies in time entry and improvement in operations through more timely and accurate data collection and reporting. This solution will support approximately 16,000 DeCA employees worldwide that are paid via the Defense Civilian Pay System (DCPS), a Defense Finance and Accounting Service (DFAS) system that processes payroll. DeCA requires enterprise licensed software hosted by DeCA and has determined that software as a service (SaaS) hosted by a time and attendance service provider is not acceptable, as the TAS software must be in compliance with the DIACAP DoD Instruction 8510.01 and 8500.2 security controls. Additionally, the TAS software shall run on a government owned server.

3. Background. DeCA’s mission is to deliver a premier quality-of-life benefit to the Armed Services community by satisfying customer demand for high-quality grocery and household products and providing exceptional savings. One of DeCA’s strategic goals is to provide the military community with a great shopping experience by providing the best possible service at the lowest price.

DeCA currently operates 24x7 commissaries, twelve central distribution centers (CDCs), area offices, headquarters, and off-site locations (e.g., employees conducting sales at National Guard and Reserve sites for a limited number of days) worldwide. Of that total, 182 stores are located within the United States including Alaska and Hawaii, and 77 stores are located in 13 countries and two territories outside of the United States.

Sixty percent of DeCA employees paid via DCPS have either intermittent or part-time work schedules, which results in frequent schedule changes and related exception data. Currently, DeCA uses a manual process to record time and attendance (T&A) data and to support payroll actions for approximately 16,000 employees worldwide at stores, CDCs, area offices, and headquarters. The paper-based processes are inefficient and create a significant amount of errors and rework to correct employee pay and also result in negative audit findings. The current process and the future process are described in the reference materials available at https://www.commissaries.com/tas/.

DeCA employees’ participation in the timekeeping process differs by the level of the organization in which they work. TAS must support the entry of timekeeping data at each of the following organizational levels:

· Above store level. Headquarters, area offices, and other managerial employees typically work a 40-hour week with few schedule changes. These employees have easy access to personal computers (PCs) in their work areas.

· Store level. These employee schedules may change frequently to meet operational needs. Only a few PCs exist in the store environment with limited or no access for the majority of store employees (10 – 200). An automated method to capture sign-in, sign-out, and other payroll information is required to prevent a lengthy queue and delay at the start of the work day. Other payroll information required is described in the Automated Exception Request Forms document, located in the reference materials at https://www.commissaries.com/tas/.

At all organizational levels, TAS shall be in compliance with Homeland Security Presidential Directive 12 (HSPD-12), which is also located at https://www.commissaries.com/tas/. Based on HSPD-12, DeCA requires two system access methods using two-factor authentication. First, the employee may enter their T&A data using a government-issued computer that accepts a DoD issued common access card (CAC) with related personal identification number (PIN). Second, the employee may enter their T&A data using a contractor provided T&A terminal that includes a CAC reader capable of reading the employee CAC chip and accepting the employee PIN.

DeCA TAS user roles include the following:

· Employee. Employees submit their own T&A data, request exceptions (e.g., annual leave, sick time, overtime), certify their own timecards, and have access to their own reports and timekeeping data.

· Timekeeper. Timekeepers have access to timekeeping records for all employees within their assigned facility or organizational structure. Timekeepers can approve timekeeping transactions and have the authority to create employee and organizational reports using their facility or organizational structure’s timekeeping records.

· Supervisor. Supervisors have access to timekeeping records for all employees under their supervision and within their assigned facility or organizational structure. They will manage work schedules, approve timekeeping transactions, certify timekeeping entries for their assigned employees, and create reports using timekeeping records for their assigned employees.

· Customer service representative (CSR). CSRs have access to timekeeping records for all employees within their assigned facility or organizational structure. CSRs oversee TAS operations, identify error conditions, process corrections, and interact with DCPS. CSRs have the authority to create employee and organizational reports.

· System administrator. System Administrators have unlimited access to timekeeping records for the purposes of system administration, help desk functions, and general support to users.

4. Objectives: The contractor shall provide a COTS TAS with any needed modifications to meet DeCA requirements including the enterprise software, remote input devices with CAC interface (aka timekeeping units), software installation, hardware deployment and installation, training, and hardware and software maintenance.

The contractor shall provide the ability to capture T&A information, validate and correct data, and complete certifications per DCPS requirements in a manner that enables DeCA to realize its expected business outcomes. The system shall support DeCA employees worldwide who are paid via DCPS. TAS shall provide a solution that enables employees at all levels to interact with TAS for time capture, reporting payroll exceptions, and submitting T&A data with or without access to a PC. The system will have a bi-directional interface with DCPS and one-directional interfaces with two DeCA systems – the DeCA Electronic Records Management and Archive System (DERMAS) and the Enterprise Data Warehouse (EDW).

DeCA’s objectives of TAS, through both functional and technical improvements, are as follows:

· Increase operational effectiveness.

· Standardize T&A processes for the various organizational levels.

· Streamline processes that track sign-in and sign-out times for employees.

· Establish an audit trail for updates and certification of T&A data.

· Reduce administrative tasks for timekeepers, supervisors, and CSRs.

· Reduce costs associated with printing and storing paper-based records and reports.

· Reduce payroll processing errors.

· Improve decision making.

· Provide data and reports to facilitate more timely decisions (e.g., how many employees received Sunday premium pay during a fiscal year, or how many times was overtime used at a particular store).

· Enhance reporting capability.

· Provide information for making scheduling decisions (automated scheduling will not be a part of this effort).

· Increase employee satisfaction.

· Increase privacy and security related to employee timesheets and related timekeeping data.

· Increase payroll accuracy.

· Reduce time spent storing, tracking, and searching for paper timesheets or leave request forms.

· Increase the sense of fairness that timekeeping practices are applied consistently through business rules.

DeCA has identified several business outcomes in terms of specific program timelines, thresholds, and objectives to be achieved within the defined scope. It presents the anticipated benefits in terms of measurable and time-bound program objectives through operational metrics. The contractor shall support DeCA’s achievement of these measures through implementation of TAS.

5. Scope. The scope of the DeCA TAS program is to acquire a COTS TAS that allows all DeCA employees to enter their payroll information electronically and securely using modern IT equipment. TAS scope includes the sending and receiving of T&A and other information to DeCA and DoD systems, training users and support personnel, and maintaining the associated hardware and software products at all DeCA locations worldwide.

6. Performance Requirements. The contractor shall provide an innovative solution in support of DeCA’s achievement through implementation of TAS. The contractors shall describe how they will support, manage, and complete each of the tasks; how they will provide the required deliverable products; and how they will achieve the stated requirements as follows:

A. Capture Time & Attendance Data:

TAS shall enable all employees paid through DCPS to enter their T&A daily using either a government-issued computer or a timekeeping unit, both with two-factor CAC authentication. This includes the ability to request, review, approve, and disapprove exception requests through the system and will automate the current manual timesheets and forms used by DeCA. To support capture of daily data, TAS must interface with DCPS to obtain information on new employees and changes in employee status (e.g., full-time worker, part-time work, or intermittent work) or work schedules.

B. Validate and Correct T&A Data:

TAS shall use business rules and validation checks compliant with the Department of Defense (DoD) Financial Management Regulation (FMR) to identify erroneous T&A entries. TAS shall enable employees, timekeepers, supervisors, and CSRs to make corrections in TAS during the pay period as required and for CSRs to make changes to T&A data for up to one year after hours were worked.

C. Perform Pay Period Processes:

TAS shall require employees to certify their timesheets using electronic signatures. After an employee has certified their timesheet, TAS shall allow the respective supervisor to approve and certify the timesheet data for inclusion in the Source Data Automation (SDA) file that is transmitted to DCPS.

D. Interface with Government Systems:

TAS must interface with three systems. First, TAS will interface with DCPS and transmit SDA files several times each pay period in accordance with DCPS SDA transmission schedules. TAS shall create the SDA file and check for errors prior to submission to DCPS. TAS shall also receive master employee record (MER) data from DCPS to establish and maintain employee data. Specifications for the file interfaces with DCPS are located at https://www.commissaries.com/tas/. Second, TAS will forward portable document file (PDF) formats of each employee’s timesheet to DERMAS, which is DeCA’s certified record management system. Third, TAS will send an extensible markup language (XML) file to the DeCA EDW to support reporting requirements located at https://www.commissaries.com/tas/.

6.1 Task 1 – Program Management

The contract shall provide program management and oversight support throughout the contract period to keep DeCA management informed of progress and issues related to TAS implementation and operations. The contractor shall propose the program management approach within the Program Management Plan that best fits DeCA’s objectives, environment, and also supports industry best practices. DeCA is to receive high-quality products that support implementation of the system, are defect free, and are delivered in accordance with the proposed schedule.

Deliverables:

Program Management Plan

Monthly Status Report

6.2 Task 2. Software and Hardware Configuration

The contractor shall deliver a COTS software solution and related TAS sign-in/sign-out device hardware (timekeeping units) to DeCA headquarters in Fort Lee, VA. This includes all software licenses and contractor timekeeping units needed to ensure efficient and effective operations. DeCA will provide any required servers. The contractor’s proposed software shall function when loaded on the servers provided by DeCA.

DeCA operates a virtual server environment and prefers that the TAS solution operate uses this virtual server environment; however, pending DeCA approval, based on demonstrated benefits of such, DeCA may support physical/hybrid if the Contractor’s solution requires it. The contractor shall detail the requirements for all proposed hardware components, physical/ virtual.. The DeCA Infrastructure Requirements and Technical Requirements sections, at Appendix A, lists the information DeCA needs to configure servers to support TAS. DeCA will supply servers, physical and/or virtual requirements, under DeCA information technology (IT) contracts. Contractors do not need to propose servers.

DeCA operates a desktop standard security technical implementation guide (STIG) configuration of Windows 7 and IE 8 or above. The printing environment is IP-based at the store level and print server based above store. The contractor’s proposed software must be able to function in this environment.

The configured TAS software solution and related hardware shall meet functional and technical requirements defined in the subtasks listed below.

Configuration Management Plan

Configuration and Installation of Software and Hardware

6.2.1 Subtask 1. Software Configuration

6.2.1.1 The Contractor shall configure software to define its value, parameters, and other options and settings to ensure the COTS software adheres to DeCA’s TAS business rules available at www.commissaries.com/tas. The contractor shall analyze DeCA’s requirements and business rules to configure the COTS application and establish a baseline that documents identification of areas configured including internal and external interfaces.

6.2.1.2 The software configuration must meet DeCA’s functional, technical, and interface requirements for store-level and above-store-level operation. It must also support the DeCA Information Security Office with the DoD Information Assurance Certification and Accreditation Process (DIACAP), i.e., certification and accreditation (C&A), of the proposed system in accordance with DeCA policy and the Federal Information Management Security Act (FISMA) 2002. Process flows for as-is and to-be TAS processes are located at https://www.commissaries.com/tas/

6.2.1.3 The contractor shall provide a system that:

· Captures T&A information at all organizational levels through keyed entry using a government-issued computer that accepts a DoD issued CAC and PIN or using a time entry device with a CAC reader capable of reading the employee CAC chip and accepting the employee PIN. T&A information capture includes entering, updating, and correcting employee work schedules, status changes, and daily T&A data.

· Creates employee profiles with CAC ID based on employee data transmitted from DCPS.

· Creates and maintains work schedule information and support comparison of actual hours to planned hours.

· Determines the last workday and the pay period cutoff based on an employee’s schedule and the government’s pay periods.

· Provides alerts for missing or invalid data.

· Incorporates business rules that support reconciliation of data to remove errors, make corrections, and ensure accuracy.

· Support automated requests for exceptions to scheduled working hours (annual leave, sick leave, overtime, compensatory time, etc.).

· Provides workflow activities and notifications in a manner that allows automated processing of electronic requests.

· Allow certification of T&A data by individual employees and supervisors using digital signatures or, at minimum, electronic signatures provided through a DoD CAC reader device interface. Notifies appropriate individuals of approvals, rejections, and needed corrections using a government-issued computer as well as a contractor furnished data-capturing device with display messaging functionality.

· Allocates time entry to projects, tasks, and accounts.

· Provides the capability for an employee to view and print work schedule documents to a DeCA network printer. Provides reporting and query capabilities.

· Displays T&A data in a way that simulates DeCA Form 70-4 (see reference material DeCA Directive 70-9, Financial Management for Payroll)

· Incorporates business rules to validate accuracy of T&A data.

· Interfaces to DCPS to receive employee data including the daily Master Employee Record (MER) files and biweekly MER/Leave Extract.

· Creates multiple SDA files that include current pay records and prior pay period correction records.

· Transmits SDA files to DCPS per DCPS required schedule.

· Provides validation, certification, and error correction of T&A data for up to one (1) year after the date on which time was worked.

· Interfaces to the DERMAS to support record keeping using PDF.

· Interfaces to the DeCA EDW to support business intelligence queries (XML).

6.2.2 Subtask 2. Hardware Configuration.

6.2.2.1 The Contractor shall provide all hardware devices, excluding servers, required for implementing and deploying TAS software, including proposed timekeeping units and other necessary hardware. The contractor’s proposal shall identify, in their proposal, the specific hardware proposed and provide the related specifications for DeCA’s review.

6.2.2.2 The contractor shall configure, deliver, and install any proposed hardware products to capture sign-in and sign-out data. Equipment will be required for the test lab as well as for each location with employees that will use TAS. The TAS website (https://www.commissaries.com/tas/) includes a listing of all DeCA commissaries. In addition, DeCA operates 12 CDCs worldwide, a Central Meat Processing Plant in Germany, and five area offices (West Area, Pacific Area, East Area, Central Area, and Europe Area).

6.3 Task 3. Testing

6.3.1. Subtask 1. The contractor shall provide for participation in and successful completion of the following levels of testing:

· Lab tests in DeCA’s test environment located at DeCA headquarters in Fort Lee, VA, to ensure TAS meets all requirements, integrates within the DeCA IT environment, and interfaces properly with EDW, DERMAS and DCPS. Testing will verify that the Contractor’s solution meets DeCA requirements including enabling access to TAS using the CAC and PIN process and ensuring the interfaces to DCPS, DERMAS, and EDW function properly. Testing also includes attaining certification as described in DoD Instruction 8510.01, “DoD Information Assurance Certification and Accreditation Process.”

· Pilot tests at DeCA headquarters and a sample of stores to ensure the system meets requirements. Pilot tests will test the ability to produce accurate employee T&A data in a Form 70-4 format and transmit SDA files.

· During the maintenance and sustainment phase (after fielded) all software upgrades, patches, and debugging will be tested in the DeCA test lab prior to being release into production.

The DeCA TAS Program Management Office (PMO) has selected, from its three SDA files, the following areas for inclusion in initial pilot testing:

· ZKA database: Headquarters and one Continental United States (CONUS) zone.

· ZFR database: Guam.

· ZFA database: geographic zones in Korea, Japan, and Europe.

6.3.2 Subtask 2. The contractor shall participate in test readiness reviews to ensure that the system is ready for testing through each step in the implementation process. DeCA will work with the contractor to ensure government test resources are available and that the scope of the tests is clearly defined. Technical review activities that the contractor shall participate in include a critical design review, test readiness review, and production readiness review.

Information Security, Certification and Acceptance Support

Interface Specification Plan

System Test Plan

Critical Design Review Report

Test Readiness Review Report

Production Readiness Review Report

6.4 Task 4 – Training

6.4.1 Subtask 1. DeCA will use a train-the-trainer approach for TAS. Training will be based on contractor developed materials on all aspects of TAS. DeCA will identify staff members to receive training prior to system deployment. The contractor shall provide their approach to training these groups.

6.4.2 Subtask 2. The contractor shall provide electronic versions of the system documentation for all proposed hardware and software products, provide a training course for new DeCA employees hired after TAS implementation, and describe how users should be trained on changes to TAS if the contractor performs updates to its software.

6.4.3 Subtask 3. DeCA intends to conduct training at the following locations:

· Tier 1 help desk training of six (6) people at DeCA headquarters in Fort Lee, VA.

· Train-the-trainer program that includes all functional levels including users, supervisors, CSRs, and management for:

· 45 people at DeCA Headquarters

· 30 people in Sacramento, California

· 30 people in Kapaun, Germany.

Deliverables:

Training Plan

Training Classes – Admin Users and End Users

Training Materials – Admin Users and End Users

Concept of Operations/User Manual

System Documentation

6.5 Task 5 - Deployment

6.5.1 Subtask 1. The contractor shall provide for resources to perform site surveys, site preparation, and equipment installation. Telephone survey(s) are acceptable. The contractor shall configure the timekeeping units for each DeCA location and shall provide and install the media cable. The Government’s required number of units at each location is identified at the following website https://www.commissaries.com/tas/. The contractor is responsible for shipping the units to each location prior to installation, or can provide the units at the time of installation. Shipping must include the necessary customs paperwork for shipment to locations outside of the United States.

6.5.2 Subtask 2. The contractor shall describe its approach to:

· Selection of installation technology – DeCA prefers Power over Ethernet (PoE), but will consider other approaches [provide time data collection device specifications]; reference the Cable Infrastructure Support link at www.commissaries.com/tas/.

· Description of its processes and procedures to configure and ship the timekeeping units to all DeCA locations, including verification that the units arrive at the store.

· Description of its processes and procedures to deploy to all locations in accordance with DeCA’s deployment schedule.

Configuration Designs

Technical Implementation Plan

Deployment Schedule

6.6 Task 6 - Operations and Sustainment

6.6.1 Subtask 1. The contractor shall provide operations and sustainment support to maintain TAS software and contractor T&A hardware units for all TAS locations.

6.6.2 Subtask 2. The contractor shall provide help desk support to include:

· Tier 2 support is required 24x7x365 to resolve unique issues that the DeCA Enterprise Service Desk Tier 1 support cannot resolve, including functional and technical representative assistance in solving basic functional problems and for investigating elevated issues by confirming the validity of the problem and seeking known solutions related to these more complex issues.

· Tier 3 support during regular DeCA Headquarters business hours (8a.m. to 5p.m. Eastern Time zone, Monday through Friday) for more complex and unique problems that the contractor’s Tier 2 support cannot solve.

· Incident tracking, where DeCA shall be provided a ticket by the contractor, by which DeCA will track the incidents in-house.

6.6.3 Subtask 3. The contractor shall provide ongoing operations support including:

· Support for installation of required software patches designed to fix problems or update the system or its supporting data including support for modifications to TAS that may be required because of DoD or operating system patches (e.g., IA vulnerability assessments by DoD or Microsoft patches)

· Recommendation of hardware and software baseline upgrades (including related costs)

· Product information and prices for the annual software license and related maintenance support to include pricing for billable support for on-site visits as needed throughout the contract lifecycle.

· Depot maintenance for provided TAS components including identification of original maintenance warranties and maintenance support after warranty expiration. The contractor shall ship replacement hardware (timekeeping units) within two business days. DeCA will inform the contractor when a unit fails and will use a spare unit to replace the failed unit. DeCA will return the failed unit to the contractor upon receipt of a replacement unit.

· Consumable products used in TAS operations to include pricing for replacement hardware throughout the contract lifecycle (pricing should consist of a burdened rate that includes shipping and installation as well as non-burdened rate for equipment only).

Software Change Specifications

Process Change Specifications

System Support Plan

Incident Analysis Report

Software Patch Support

Hardware and Software Upgrade Support

Software License

Hardware Maintenance

Consumable Products

7. Performance Standards.

Table 1 – TAS Performance Standards

8. Incentives. This requirement is a firm-fixed price contract. Contractor will be evaluated in CPARS based on meeting performance standards.

9. Place of Performance. Work will be performed at DeCA Headquarters, Fort Lee, VA; DeCA locations worldwide (CONUS and Outside Continental United States (OCONUS)), and off-site contractor facilities. Software modifications will be performed primarily off-site at the contractor’s facilities. The worldwide locations at which the contractor will perform work have restrictions on travel including security restrictions. For example, the contractor personnel may need Visas or military installation clearance to access some DeCA locations. Systems implementation tasks such as data loads, testing, system maintenance, and training will be completed mainly at Fort Lee, VA, but may occur off-site as directed by the COR. Actual travel will be directed by the COR in writing.

Travel to support the PWS will be authorized, in writing, by the COR prior to performance. Travel is paid in accordance with the Federal Acquisition Regulation (FAR) Part 31.205-46 and is a cost-reimbursable contract line item. The contractor must submit a travel itinerary and estimated costs for approval by the COR. DeCA will not reimburse local travel and related expenses to the contractor for daily travel to or from the contractor's facilities within 50 miles. All travel must be approved by the COR in advance, in writing, prior to performance.

Alternate Place of Performance - Contingency Only. Contractor employees may be required to work at home, another approved activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR) approval is required. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the SOW/PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment.

10. Period of Performance. The period of performance is estimated to be 60 months: one base period of performance of 12 months from date of award, and four 12-month option periods for maintenance. Contractors must price each item separately. The period of performance reads as follows:

· Base Period— Date of award through 12 months

· Option Period 1— One year following base period

· Option Period 2— One year following option period 1

· Option Period 3— One year following option period 2

· Option Period 4— One year following option period 3

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Delivery Schedule.

Delivery of computer programs, specifications, technical reports, progress/status reports, and any other data shall be in accordance with the following table, or as specified in individual Task Directives. All deliverables under this contract become the property of the Government.

Copies Frequency and Remarks

Distribution* Final due 90 calendar days after contract award (ACA)

Distribution* 5th business day of following month

Distribution* Final due 90 calendar days ACA

Distribution* 450 calendar days ACA

Distribution* 365 calendar days ACA

Distribution* 150 calendar days ACA

Distribution* 240 calendar days ACA

Distribution* 300 calendar days ACA

Distribution* 60 calendar days priior to Product Readiness Review

Distribution* 365 calendar days ACA

Distribution* Final due 90 calendar days ACA

Distribution* 300 calendar days ACA

Distribution* 300 calendar days ACA

Distribution* 365 calendar days ACA

Distribution* 180 calendar days ACA

Distribution* 300 calendar days ACA

Distribution* 150 calendar days ACA

Distribution* Final due 90 calendar days ACA

Distribution* 180 calendar days ACA

Distribution* 270 calendar days ACA

Distribution* Every 120 calendar days Post Go Live

Distribution* Throughout Lifecycle

Distribution* Throughout Lifecycle

Distribution* Throughout Lifecycle

Distribution* Throughout Lifecycle

Distribution* Throughout Lifecycle

*Standard Distribution: One copy of each report will be submitted to the client representative. The contractor shall deliver each report in a mutually agreed to format. Deliverables are to be transmitted with a cover letter, on the prime contractor’s letterhead, describing the contents.

12. Security.

For installations located outside of the United States (U.S.), Puerto Rico, or a U.S. possession or trust territory, the contractor and his or her employees shall be considered to be visitors. Note 252.239-9207 APPROVAL AND PERMITS (JUN 1996) states “the contractor shall, when required, obtain all approvals, permits, and licenses, including but not limited to those required by the facility and installation Commanders, site owners, U.S. Government agencies and foreign Government agencies.”

The work in this PWS will be sensitive but unclassified. The contractor will be accessing information that contains personal data such as social security numbers and other personally identifiable information (PII). The contractor shall comply with all applicable DoD security regulations (including those to protect information that is designated PII) and procedures during the performance of this contract. The contractor shall not disclose and must safeguard procurement sensitive information, computer systems and data, Privacy Act data, and Government work products that are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through the public literature.

Information assurance and security requirements include the following:

· Certification & Accreditation (C&A)

· Compliance with the DIACAP DoD Instruction 8510.01 and 8500.2 security controls for an unclassified system with a Mission Assurance Category of III

· Generation of all required documentation to support the initial DIACAP “Interim Approval to Operate” and “Approval to Operate”

· Compliance with all Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs)

· Use of Public Key Infrastructure (PKI) for authentication and use of DoD PKI certificate services and DeCA’s active directory capability to authenticate Common Access Card (CAC) users

· Security procedures to allow system access only to authorized users

· Restriction of users’ access to only authorized functions and data

· Audit logs that track system changes by user

· Digitally signed Category I mobile code using DoD-approved PKI code-signing

· Limited access to web servers by Secure Socket Layer (SSL) connections over secure Hypertext Transfer Protocol Secure (HTTPS)

· Compliance with Information Assurance Vulnerability Alerts (IAVAs) within the time frame required

Contractor personnel shall abide by DoD and DeCA security policies and procedures as part of their daily interface with DeCA. The contractor shall not divulge any information about files, data, processing activities or functions, user IDs, passwords, or other knowledge that may be gained to anyone who is not authorized access to such information. The contractor will ensure all employees with access to such information sign a nondisclosure agreement furnished by DeCA immediately following contract award. The contractor shall adhere to Information Assurance (IA) policies and procedures as defined in DoD and DeCA directives, instructions, and regulations.

The contractor shall ensure compliance of Department of Defense Contract Security Classification Specification, DD Form 254, as included with this PWS.

13. Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI). The Government will provide the contractor with all of the relevant documentation required to accomplish development of specific requirements and objectives described in this PWS. GFI will include T&A data to be used in testing and initially loading the TAS database, technical information for hardware and software setup, T&A requirements related documents (e.g., DeCA Directive 70-9, DoD Financial Management Regulation). The Government will provide the server environment to support the COTS TAS implementation and operations as it complies with the DeCA infrastructure requirements listed under Appendix A. All GFE hardware will remain in DeCA facilities under DeCA control.

The Government will make available workspace, utilities, electrical power hook-ups, and access to TAS-related systems and data for contractor personnel. The COR will assist the contractor with accessing required TAS-related systems and data as needed. The Government will provide hosting facilities for TAS including a test and production environment.

The Government will provide technical support for TAS servers and network needs. The Government will provide functional and technical testers for TAS test activities (Reference Appendix A of the PWS for DeCA Infrastructure, Software, and Technical Requirements).

14. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. Potential Growth/Surge Support. Dependent on DAI mandates and available funding, the Government may request an increase in the level of effort through contract mod which may be issued at any time during the contract year.

b. Identification of Potential Conflicts of Interest (COI). No conflicts of interest, as defined by FAR Part 9.5, have been identified for the government. The contractor shall disclose all potential COIs that may arise resulting from this effort. The contractor shall submit a separate Organizational Conflict of Interest (OCI) mitigation plan, which delineates whether or not an OCI exists. If the contractor believes that none is present the OCI plan shall set forth in sufficient detail to support its position. If an OCI exists, a mitigation plan shall also be submitted and the contractor shall explain in detail how the OCI will be mitigated and/or avoided. Throughout the life of the contract, OCIs shall be reported to the Contracting Officer as soon as they are known. The Contractor shall ensure that all OCIs and concerns are resolved promptly.

c. Identification of Non-Disclosure Requirements. TAS will include PII to support data matching between TAS and interfacing DoD systems. The Contractor, in the performance of this contract, may receive or have access to "non-public information" and is required to have employee’s holding positions on this contract sign a Non-Disclosure Statement (NDS) upon award of this contract or immediately upon being assigned to perform work. The attached NDS at the end of the PWS (Enclosure 1) shall be filled out by the employee or Contractor and submitted to the COR.

d. Packaging, Packing and Shipping Instructions. All deliverables (software, documentation, hardware) should be presented or mailed to the designated DeCA location.

e. Inspection and Acceptance Criteria. Identified in Section 11. Delivery Schedule.

f. Property Accountability. DeCA obtains "unlimited rights" to all noncommercial software, software source code, software documentation, enhancements, research, reports, studies, data, documents, drawings, technical data, and similar noncommercial data developed exclusively at Government expense and delivered to the Government under this PWS. "Unlimited rights" means rights to use, publish, display, modify, reproduce, release, transfer, perform, display, or disclose in whole or in part, in any manner and for any purpose whatsoever, and to have or authorize others to do so. The contractor shall not use, willingly allow, or cause to have such materials used for any purpose other than the performance of contractor's obligations under this contract without the prior written consent of DeCA; however, that contractor shall be allowed to use unclassified materials for writing samples in pursuit of other work.

15. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

FORMCHECKBOX

1194.21 - Software Applications and Operating Systems

FORMCHECKBOX

1194.22 - Web Based Intranet and Internet Information and Applications

FORMCHECKBOX

1194.23 - Telecommunications Products

FORMCHECKBOX

1194.24 - Video and Multimedia Products

FORMCHECKBOX

1194.25 - Self-Contained, Closed Products

FORMCHECKBOX

1194.26 - Desktop and Portable Computers

FORMCHECKBOX

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Contractors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance.