Attachment 5 - IT Service Management Sample Task Order FINAL 20120403 0800.docx

Defense Information Systems Agency Chief Information Officer

DISA Information Technology Enterprise Support Services (DESS)

HC1047-12-D-XXXX

Task Order 0005 (Version 1.0) 22 March 2012

Table of Contents

Page ii

Task Order Contracting Officer Representative’s (TO COR’s) Primary TO COR

Department of Defense Activity Address Code (DODAAC):

HC1047

DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD 20755

Alternate Task Order COR.

Department of Defense Activity Address Code (DODAAC):

HC1047

DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD 20755

Task Order Title:

Defense Information Systems Agency’s (DISA’s), Information Technology (IT) Service Management Office (ITSMO) Support.

Background The Defense Information Systems Agency is a Combat Support Agency responsible for connecting US Forces and their coalition partners to the DoD’s Global Information Technology (IT) Enterprise. DISA provides IT networks, computing infrastructure, and enterprise services in direct support of US Warfighters to facilitate the seamless exchange of information on a global scale.

The mission of DISA’s Chief Information Officer (CIO) is to, “Lead and govern the delivery and operation of secure world-wide enterprise IT services enabling the efficient and effective execution of DISA’s global combat support missions.” In order to accomplish this mission, the DISA CIO must:

· Provide an efficient and effective IT infrastructure and services to support the Agency’s warfighting mission.

· Achieve a Mission Assurance posture that ensures the security and continuity of the Agency’s internal IT Enterprise’s infrastructure and services against an ever evolving spectrum of threats.

· Maintain compliance with all DOD information governance policies and legislation.

· Govern a common architecture and service delivery framework to drive efficiencies in business system investments and portfolio and knowledge management capabilities.

The CIO’s Information Technology Service Management Office (ITSMO) is charged with the establishment of standards for service management across the DISA IT Enterprise. DISA’s ITSMO supports unclassified, secret, top secret and SCI Service Management Standards and consultants and advises the department and agency on proper implementation and adoption practices across DISA’s 39 worldwide locations and occasionally mission partner locations. High visibility customers include the Pentagon and the White House Communication Agency. DISA’s IT Enterprise includes all hardware, software, middleware, cable plant infrastructure, technical settings, tools, devices and configurations, including all supporting infrastructure and related ancillary and functional components, that are required to provide the IT services identified in this Performance Work Statement (PWS) across three classification levels (e.g., unclassified, secret, top secret and SCI). These components, referred to herein as “DISA IT Enterprise Components" include, but are not limited to, all servers, desktop terminals, laptops, cables, routers, switches, firewalls, intrusion detection systems and voice capabilities (e.g., telephones) and supporting infrastructure. The responsibilities of the DISA ITSMO includes consulting, standards setting, continual service improvement and service analysis across the entire service management spectrum to the DISA IT Enterprise components.

The DISA Information Technology Service Management Office (ITSMO) was established to support the DISA Campaign Plan. Commonly accepted and widely used frameworks or architectures for IT processes will be used as guidance to reform and improve the way DISA makes decisions and performs work. By adopting best practices for Service Management implementations where it makes sense for DISA, regulatory risk are reduced, audit compliance improves, and costs savings result from improved process efficiencies and automation. Customer satisfaction increases due to concise expectation setting and service performance reporting. Staff morale increases due to clear understanding of roles, reduced duplication of effort, and of streamlined, repeatable work processes.

The DISA CIO’s Information Technology Service Management Office (ITSMO) Division performs the following functions:

· Service Strategy and ITSM Policy The Strategy and Policy organizational unit is responsible for defining, maintaining and optimizing the process reformation strategy to meet the missions of DISA IT Enterprise customers. The unit governs and facilitates the development and management of process policies and standards to ensure compliance with the Defense Enterprise Service Management Framework (DESMF) guidelines and to ensure uniformity between the process policies and standards. The Strategy and Policy team develops and maintains the integrity of the DESMF and its relationship to enterprise architecture standards across DISA directorates. This unit is responsible for ensuring continual alignment of service management strategies and standards within DoD and DISA goals and objectives. This unit also evaluates emerging methods and technologies and assesses the potential impact or benefit for the Department and DISA.

· Service Operations The Service Operations Domain Specialist team is responsible for aiding in the adoption of all Service Operations Domain guidelines and standards as outlined in the DESMF. Aiding the Process Owners, Process Managers, Domain Owners and corresponding Domain Owner Representatives in adopting the standards, assessing their process, procedures and work instructions for Service Improvement Opportunities, when necessary aiding in the design of the aforementioned processes, procedures and work instructions. The Service Operation domain is comprised of Incident, Event and Problem Management. Also included are Request Fulfillment, Monitoring and Reporting and the functions known as Service Desk, IT Operations Management, Applications Management and Technical Management all of the above are currently defined by ITIL V.3 2011 but will change over time as the DESMF matures. Note: the ITSMO does not operate any of these functions or processes but aids in their design, operation and improvement through analysis, consulting and design assistance.

· Service Transition The Service Transition Domain Specialist team is responsible for aiding in the adoption of all Service Transition Domain guidelines and standards as outlined in the DESMF. Aiding the Process Owners, Process Managers, Domain Owners and corresponding Domain Owner Representatives in adopting the standards, assessing their process, procedures and work instructions for Service Improvement Opportunities, when necessary aiding in the design of the aforementioned processes, procedures and work instructions. The Service Transition domain is comprised of Change, Configuration, Release, Deploy, Evaluation and Test and Validation Management and Transition, Planning and Support all of the above are currently defined by ITIL V.3 2011 but will change over time as the DESMF matures. Note: the ITSMO does not operate any of these functions or processes but aids in their design, operation and improvement through analysis, consulting and design assistance.

· Service Design The Service Design Domain Specialist team is responsible for aiding in the adoption of all Service Design Domain guidelines and standards as outlined in the DESMF. Aiding the Process Owners, Process Managers, Domain Owners and corresponding Domain Owner Representatives in adopting the standards, assessing their process, procedures and work instructions for Service Improvement Opportunities, when necessary aiding in the design of the aforementioned processes, procedures and work instructions. The Service Design domain is comprised of Service Level, Service Catalog, Capacity, IT Security, Continuity, Availability and Design Coordination Management and Support all of the above are currently defined by ITIL V.3 2011 but will change over time as the DESMF matures. Note: the ITSMO does not operate any of these functions or processes but aids in their design, operation and improvement through analysis, consulting and design assistance.

· Service Strategy The Service Strategy Domain Specialist team is responsible for aiding in the adoption of all Service Strategy Domain guidelines and standards as outlined in the DESMF. Aiding the Process Owners, Process Managers, Domain Owners and corresponding Domain Owner Representatives in adopting the standards, assessing their process, procedures and work instructions for Service Improvement Opportunities, when necessary aiding in the design of the aforementioned processes, procedures and work instructions. The Service Strategy domain is comprised of Service Portfolio, Service Demand, Financial Management, as well as Service Strategy Generation and Governance. All of the above are currently defined by ITIL V.3 2011 but will change over time as the DESMF matures. Note: the ITSMO does not operate any of these functions or processes but aids in their design, operation and improvement through analysis, consulting and design assistance.

· Maturity and Audit Assessments The Maturity and Audit Assessment team is responsible for the monitoring of process operational compliance to IT policies and standards established by the DESMF. The unit is responsible to perform audit readiness assessments of the ISO/IEC 20000 standard for IT Service Management today and compliant with DESMF adapted standards later. This unit establishes and manages a Risk Management program for agency-wide IT process compliance. It provides readiness reports to DISA leadership and assists in audits conducted by other internal and external auditors. The unit facilitates audit remediation efforts and process improvement requirements.

· Quality Management and Continual Service Improvement The Quality Management unit is responsible for the development and management of DISA Quality Management Plans (QMS). A QMS is required by the ISO2000 standard and defines quality and performance standards, requirements, and expectations for all IT processes and programs. The office facilitates the process teams with adherence to the QMS with a goal to install a culture on ongoing continual service improvement. It assists process teams in the definition of quality process metrics and development of the data capture plans. It establishes and operates the agency Business Intelligence Competency Center (BICC) and develops analysis tools and monitors and reports quality-related performance metrics to DISA Leadership. The unit provides support and expertise to process teams in continual improvement methodologies using Lean Six Sigma as the methodology for more complex improvement initiatives. The team mentors staff in its application, facilitates process improvement prioritization workshops, assists in the assessment of process improvement ROI calculations and trains the Agency’s Green and Black Belt Candidates.

· Strategic Communications The Strategic Communications unit is responsible for development and management of the DISA CIO’s ITSM Communications Plan. This includes the crafting of messages and management of communications with other DISA directorates and field offices. They use a variety of settings, formal and informal, as communication venues. Will review content of proposed messages, ensures timely responses to queries, and serves as the web content manager for the ITSMO. This unit also manages and oversees the Defense ITSM Community of Practice Collaboration capabilities.

Objectives The objective of this Task Order is to support the DISA CIO’s Information Technology Service Management Office (ITSMO) with Program Management, Implementation Engineering and IT Service Management services, which provide for analysis, recommendations and implementation of the "best practices" and most "cost effective" methodologies for the ITSMO as it engages processes that are indentified in section 5 and 6.2 of this Task Order.

The technical work under this task will require highly skilled and trained personnel with practical deployment experience and expert knowledge of ITIL, Leans Six Sigma, ISO 20000, PMP and COBIT in large enterprise environments. The contractor staff should also provide expertise in the general area of IT Service Management (ITSM).

Scope The scope of this Task Order includes DESS PWS Task Area 1 - Project Management and Task Area 2 - Information Technology Service Management. The scope of this Task Order is to provide DISA CIO with consulting, analytical services, planning and management services for the IT Service Management Office (ITSMO) Division. This includes activities such as: policy analysis and development; project plan development; establishing and consulting and aiding in process convergence for all DISA services; conducting the registration of all DISA customer and network projects; supporting customer interface activities such as surveys, incident management, and conferences/meetings; developing and implementing policies and processes; providing administrative support to the Division; conducting analyses and technical evaluations. The contractor shall be responsible for supporting the following ITSM areas and the nature of the work conducted under this task will consist of the following:

IT Governance Governance is a formal management discipline, defining an organization's roles, organizational units and processes, assigning decision rights and determining which policies to follow in making those decisions.

Service Catalog Management Management of the central database and menu information about deliverables, prices, contact points, ordering and request Processes. The service catalog serves as the single automated entry point for all DISA services.

Service Level Management The process responsible for negotiating Service Level Agreements (SLA) and ensuring that the SLA’s are met. The SLA describes the IT Service, documents Service Level Targets, and specifies the responsibilities of the provider and the customer. These agreements are made for each service provided.

Financial Management The function and processes responsible for managing DISA’s budgeting, accounting and charging requirements.

Knowledge Management The process responsible for gathering, analyzing, storing, and sharing knowledge/information within DISA. The purpose of Knowledge Management is to ensure that the right information is delivered to the appropriate place or competent person at the right time to enable informed decision. The goal of Knowledge Management is to enable organizations to improve the quality of management decision making by ensuring that reliable and secure information and data is available throughout the service lifecycle.

Change Management The process responsible for controlling the lifecycle of all changes. The primary objective of Change Management is to enable beneficial changes to be made, with minimum disruption to IT Services. Change management is the guardian of production and must tie into the Authorized Service Interruption (ASI) process and the release processes.

Service Asset and Configuration Management The process responsible for maintaining information about Configuration Items (CI’s) required to deliver an IT Service, including their relationships. This information is managed throughout the lifecycle of the CI. This process will also include the tracking of all capital items and assets used internally to support DISA processes and people.

Transition Planning and Support This process is a subset of the overall project/program management process at DISA. It is responsible for planning all Service Transition processes and coordinating the resources that they require.

Release and Deployment Management A release is defined as the collection of hardware, software, documentation, processes or other components required to implement one or more approved changes to IT Services. The contents of each release are managed, tested, and deployed as a single entity. The activity is responsible for movement of new or changed hardware, software, documentation, and processes to the production environment.

Service Request Fulfillment The process responsible for managing the service requests made from the service catalog which has pre-approval from the change management process. This includes the verification of supporting funding, ASI, and implementation of the new service.

IT Information Security Management The process that ensures the Confidentiality, Integrity and Availability of DISA’s assets, information, data and IT Services. Information security management forms part of DISA’s approach to security management and includes handling of paper, building access, phone calls etc., for the entire organization. Within the DISA CIO, it is closely related to Information Assurance and Incident Management.

Incident Management Incidents fall into two primary categories at DISA: security related and service related. This process is responsible for managing the lifecycle of all incidents. The primary objective of Incident Management is to return the IT Service to users as quickly as possible, and to and to quickly respond to threats to DISA’s assets.

Problem Management Problem management is concerned with the root cause analysis of the incidents recorded in incident management, both service and security related. Whereas restoration of service is the key to incident management, problem management is concerned with finding the underlying cause of the interruption and determining how to ensure the incident does not recur.

Service Portfolio Management This process is a superset of service catalog management. It is not only concerned with current services, but services that have been discontinued and services that the DISA CIO has decided to add to the catalog of current services.

Demand Management Demand Management supports the DISA IT Enterprise’s uptime service requirements by defining and executing the necessary activities to understand and influence customer demand for services and the provision of capacity to meet these demands.

Capacity Management The process responsible for ensuring that the DISA maintains sufficient infrastructure to deliver agreed Service Level Targets in a cost effective and timely manner.

Availability Management Availability Management is responsible for ensuring that all IT Infrastructure, processes, tools, roles etc., are appropriate for the agreed Service Level Targets for availability.

IT Service Continuity Management The process responsible for managing risks that could seriously impact IT Services. It is a subset of DISA’s overall business continuity plan and directly support the continuity of operations plan.

Event Management The process for determining how to react to significant changes to the state of any IT asset, or the attempted security breach to any IT asset.

Service Desk This is the generic term for all of DISA’s call centers and various help lines. The goal of centralizing the processes for the service desks is to better support DISA IT Enterprise’s mission and to provide them with a single point of contact for all resolutions.

Service Validation and Testing This process Service Validation and Testing ensures that the new or changed IT Service matches its design specification and will meet the needs of the mission partners.

Evaluation Management The process responsible for assessing a new or changes to IT Services to ensure that risks have been managed and to help determine whether to proceed with the change. Evaluation is also used to mean comparing an actual outcome with the intended outcome, or comparing one alternative with another. This process works hand-in-hand with the service validation and testing process to ensure that all requirements have been met and the customer is satisfied with the outcome.

Supplier Relationship Management The process responsible for ensuring that all contracts with suppliers support the needs of the business, and that all suppliers meet their contractual commitments, and follow both DoD and DISA rules of acquisition.

Access Management Where security management defines the overall structure to protect data, asset management responsible for allowing users to make use of IT Services, data, or other assets, using the security policy and structure.

IT Project Management IT Project Management is the discipline of planning, organizing, securing and managing resources to bring about the successful completion of specific engineering project goals and objectives.

Specific Tasks Task Order Management The Contractor shall provide a single project manager (PM) that is responsible for the daily oversight and management of all contracting personnel assigned to this Task Order.

To best serve the needs of the Government and the Contractor, the Contractor shall provide one Task Order Manager full time at the Government facility to perform the roles and responsibilities of the Task Order Manager as specified in this section. The Task Order Manager shall also serve as the PM and assist in the preparation and maintenance of the various administrative and management tasks associated with the execution of tasks specified in this PWS.

The Contractor shall provide a Monthly Status Report monitoring the quality assurance, progress/status reporting, and program reviews applied to the TO. Within the monthly status report, the Contractor shall provide the following minimal information: summary of work performed and status of deliverables that are coming up. The Contractor shall support the maintenance of the ITSM internal program review (IPR) for all activities under their purview. Initial update to the IPR will be due within 10 days after contract award. Weekly updates to the schedule will be required to be provided to the Government’s designated POC no later than NOON one business day prior to the weekly Project Review meeting for the duration of the contract. The Contractor PM will ensure that all tasks with Contractor resources identified will be updated and/or verified to be accurate on a weekly basis. The Contractor PM must ensure all tasks on the schedule are fully resourced, and any resource deficiencies clearly noted and brought to the attention of the Government TO COR. The Contractor shall use the standard project management application (currently MS Project) that is made available by DISA. The master schedule shall address any changes mutually agreed at the initial and subsequent project planning and review meetings with all ITSMO Government and Contractor leads.

The Contractor shall host an initial TO Technical Interchange Meeting (TIM) within 15 days after TO award for the purpose of reviewing and clarifying the requirements of this PWS, establishing dates for the master schedule, and reviewing the TO Project Management Plan which should address how the contractor intends to accomplish all of the stated tasks and subtasks of this PWS, while ensuring quality is maintained.

The Contractor shall implement technical management controls and quality assurance processes to ensure all contract related work products and services provided to the Government are of an acceptable quality level.

The Contractor shall ensure staffing levels are maintained at an appropriate level to ensure no operational impact with staff turnover. If contractor staff shall depart during the performance period of the Task Order, the Contractor will ensure the vacated position and its corresponding duties are fully covered until a suitable long-term replacement is identified. If the vacated position is not filled within 15 days of receiving notice that the position will be vacated, the Contractor will provide the Government with a written Staffing Plan of action for filling the position and addressing the staffing deficiency.

Program Management (Implementation and Sustainment) Support

The Contractor staff provided under this contract will be responsible for supplying Subject Matter Experts to support, interact and assist with the requirements team to reconcile issues associated with process owners requirements; negotiate delivery schedules with Government program managers; design, develop and deploy processes and governance; and support all other aspects of Information Technology (IT) Service Management Office (ITSMO). The Contractor will be responsible for supporting the ITSMO by providing assistance with program management development, process engineering, IT service management services, analysis, recommendations and implementation of the "best practices" and most "cost effective" methodologies of the processes identified within Section 6.2.

Service Strategy and ITSM Policy The Contractor will assist with the development of the Strategy and Policy required for defining, maintaining and optimizing the process reformation strategy to meet the missions of the DISA IT Enterprise. The Contractor will provide guidance from industries “Best and or Good Practices” that governs and facilitates the development and management of process policies to ensure compliance with ITSMO guidelines and to ensure uniformity between the process policies. The Contractor shall ensure that the strategy and policy develops and maintains the integrity of the IT process framework and its relationship to enterprise architecture standards across DISA Directorates. The Contractor will also be responsible for ensuring continual alignment of service improvement strategies with DISA’s goals and objectives. This unit also evaluates emerging methods and technologies and assesses the potential impact or benefit for DISA.

Compliance and Inspection The Contractor will assist in the development of the Compliance & Inspection which will be responsible for the monitoring of process operational compliance to IT policies and standards established by the ITSMO. The Contractor will also be responsible for running audit assessments to ensure requirements of ISO/IEC 2000 standards for IT Service Management have been met. They will also establish and manages a Risk Management program for agency-wide IT processes. The Contractor shall also provide compliance reports to DISA leadership and assists in audits conducted by other internal and external auditors and will facilitates audit remediation efforts and process improvement requirements.

Quality Management The contract shall assist with the development and management of a DISA IT Enterprise Quality Management Plan (QMP). The contractor shall also work with the process teams to ensure that the team adherence to the QMP with a goal to install a culture on ongoing continual improvement. They will also assist with the process teams in the definition of quality process metrics and development of the data capture plans and provide support and expertise to process teams in continual improvement methodologies using Lean Six Sigma as the methodology for more complex improvement initiatives. The Contractor shall also mentor staff in its application, facilitates process improvement prioritization workshops, and assists in the assessment of process improvement ROI calculations and provide LSS training to Green and Black Belt Candidates. The Contractor shall provide skilled staff in the implementation of a Business Intelligence Competency Center (BICC) with corresponding business analysis capabilities.

Process and Domain Development The Contractor shall provide technical and analytical services to the Process and Domain Development initiatives across the DSIA IT Enterprise organizations as they oversee and facilitate the execution of process improvement initiatives. The Contractor will be responsible for the technical integration and optimization of ITSM processes that cut across multiple functional areas or business divisions. The Contractor shall ensure enterprise-wide technology solutions are developed for process workflow support and will provide ITSMO process subject matter experts as necessary to process design teams to develop a comprehensive future state vision, including the tools set integration requirements, and a proposal for deployment of the future state vision.

Strategic Communications The Contractor will be responsible for the development and management of the ITSMO Communications Plan. This includes the crafting of messages and management of communications with other DISA directorates and outside organizations / customers. The Contractor will also review content of proposed messages, ensures timely responses to queries, and serves as the web content manager for the ITSMO. The Contractor will also provide skilled social engineers to enable the Defense ITSM Community of Practice Collaboration Capability.

Continual Process Improvement Support The Contractor shall support the Request Fulfillment process owners by providing technical expertise and managers to the Information Technology Service Management Team to be responsible for fully implementing Request Fulfillment (RF), Release and Deploy (RD), and related processes as-needed to improve/correct service fulfillment.

This includes developing a strategic and tactical constructs of process management models to guide growth and improvement in management of RF/RD process portfolio, identification of project-level process improvement benefit models and decision support tools that provide parameters for assessing options against in-progress improvement efforts.

Contractor shall lead engineering efforts in designing the development and maturation of RF/RD process management, process improvement management frameworks, planning, measurement, analysis, and improvement of DISA IT Enterprise service process improvement efforts.

Through collaboration with other DISA IT Enterprise process owners and managers, the Contractor shall provide management oversight to the implementation of RF/RD business and functional process requirements and develop performance criteria for process interfaces and touch points. Through communication with all DISA IT Enterprise managers, the contractor shall ensure all process owners and process managers are implementing the RF/RD procedures and implementation plans. The support provided shall operationalize RF/RD Strategic Team recommendations into daily practice in the execution of RF responsibilities.

The Contractor shall employ tools such as Lean Six Sigma, Information Technology Infrastructure Library, and Project Management principles as appropriate in instituting improved RF/RD processes to support DISA customers and to improve the efficiencies, effectiveness and reliability of DISA IT Enterprise Services.

The Contractor shall work through the ITSMO to develop a strategy, high-level plan including tracking, reporting and tactical decision (trade-off) points necessary to support restructuring of DISA Policy, Procedures, and Work Instructions to align DISA Circulars and Instructions to preferred DISA methodologies and/or frameworks such as ITIL and other industry best practices.

The Contractor shall provide the expertise required to recommending design and implement best practices in the delivery of DISA IT Enterprise IT services to all customers and support the documentation initiatives to clearly define the interface of tools to process and support promulgation of these initiatives throughout the IT Enterprise community.

Place of Performance Primary Place of Performance The place of performance for this Task Order is the DISA Headquarters campus located on Fort Meade, MD. The Contractor shall perform work in Government provided office space located in the DISA Headquarters campus. Occasional travel may be required to the DISA installations located bellow.

NCR region:

· Communications Management Control – Sterling, VA

· DoD Network Information Center (NIC) – Vienna, VA

· Indian Head, MD

· North Fairfax– Arlington, VA

· Pentagon– Arlington, VA

· US Army Information Technology Agency (ITA), Fort Detrick, MD

· Industry Partner Secure Facilities

CONUS

· Alternate National Military Command Center

· Annapolis, MD

· Chambersburg, PA

· Columbus, OH

· Elmendorf, AK

· Fairview Heights, IL

· Fort Detrick, MD

· Fort Huachuca , AZ

· Greenmount Facility, IL

· MacDill AFB, FL

· Mechanicsburg, PA

· Miami, FL

· Norfolk, VA

· Peterson AFB, CO

· Scott AFB, IL (two facilities)

OCONUS

· Europe/Middle East

· Bahrain

· Brussels, BE

· Stuttgart, GE

· Camp Smith, HI

· Elmendorf, AK

· Enhanced Mobile Satellite Services, HI

· Ford Island, HI

· Guam FO

· Korea FO

· Okinawa FO

· Wheeler AFB, HI

· Yokota FO

Alternate Place of Performance Contractor employees may be required to work at home, another approved DISA activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR) approval is required. The contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. The Contractor shall continue to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer may request an equitable adjustment.

Travel Requirements Contractor travel is anticipated to support the requirements named in this Task Order. Travel shall be conducted IAW Section H.8 and H.9 of the DESS basic ID/IQ contract. Travel will be established as a Cost Reimbursable CLIN in the Task Order with an estimated amount of $5,000.00 per year ($25,000.00 over the five-year life cycle of the Task Order).

Period of Performance The period of performance for this Task Order is one-year with four (4) one-year option periods.

Task Order Deliverables All deliverables associated with this Task Order are specified in the Deliverables Appendix (Appendix A).

Task Order Service Level Agreements and Performance Metrics All Service Level Agreements (SLAs) associated with this Task Order are specified in Appendix (Appendix B).

Security Requirements All proposed staff shall have at least a TOP SECRET level security clearance to gain access to customer restricted workspaces by the time of Task Order award. The majority of the on-site work areas are UNCLASSIFIED. However, the Contractor shall support activities associated with delivery and maintenance of any classified instance as needed. This work will be performed in a classified computing environment provided by the Government and will require SIPRNET access and the handling and storage of classified information.

The Contractor will forward a Visit Authorization Letter (VAL) to the Task Order Contracting Officer Representative (TO/COR) listed at beginning of this Task Order all employees one week prior to the beginning of the Task Order period of performance and as new Contractor employees are assigned to the Task Order.

The VAR/VAL Method One Per direction of DISA Security, Visit Authorization Letters (VALs) or Visit Requests (VARs) for contract personnel that will be working for the DISA CIO, either on- or off-site, will be forwarded via Joint Personnel Adjudication System (JPAS) to the VAR Center using the following SMO Code: XXXXXX.

For those companies submitting the VALs via JPAS, they will also provide a copy of the VALs to the TO CORs of the contract for creation of records in the Contractor Verification System (CVS) so that Common Access Cards can be obtained for the contractors that require them.

Method Two For those companies that do not have the capability to send VALs via JPAS, they can send the VALs via e-mail to the TO CORs. Due to Privacy Act concerns, the VALs will be e-mailed as a password protected “WinZip” attachment, followed up by a second e-mail containing the password for the first e-mail.

The VAR/VAL shall be on company letterhead or pre-fabricated form and contain the following information:

· Task Order number with start and end dates

· Company point of contact (POC) and telephone number

· Government TO COR name and telephone number

· Complete legal name of employee(s)

· Social Security Number

· Security Clearance level, date granted, and

· Adjudication facility name, i.e. DISCO

· Type of personnel security investigation (PSI) pending or completed

· Date PSI completed DISA Security Personnel can be contacted for security related questions as follows:

For Industrial Security related issues:

Primary: Ms. Jane A. Doe, phone: (301) 225-XXX Alternate: Mr. John A. Doe, phone: (301) 225-XXXX Defense Information Systems Agency ATTN: MPS61, Industrial Security DISA HQ Complex (Command Bldg) 6910 Cooper Ave For Meade, MD, 20755

For Personnel Security related issues to include interim IT access requests:

Primary: Ms Jane A. Doe, phone: (301) 225-XXXX Alternate: Mr. John A. Doe, phone: (301) 225-XXXX Defense Information Systems Agency ATTN: MPS62, Personnel Security DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD, 20755

Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the government facility.

Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Personnel who fail to complete the required training by the stated deadlines for completion may have their access to the DISA IT Enterprise access revoked and/or be removed from performance on the Task Order.

The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this Task Order, clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer (CO). When and if such removal occurs, the contractor shall, within 15 working days, fill the vacancy with equally or more qualified personnel than the individual dismissed.

The Privacy Act of 1974 applies. The contractor may be required to have access to highly sensitive and proprietary information for the performance of this Task Order. The contractor will not divulge any information about data processing activities or functions, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The contractor will observe and comply with the security provisions in effect at computer centers. Any required identification badges will be worn and displayed at all times. A Department of Defense Contract Security Classification Specification, Form DD 254, must be completed. A DISA Non-Discloser Agreement (NDA) must be completed by each employee prior to commencement of work. .

Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI) Contractor Access DISA will provide the Contractor access to the applicable Local Area Network(s), Personal Computer(s) necessary to accomplish the work tasked under this task order. The Contractor, in coordination with the Customer, will be responsible for obtaining appropriate approvals for access. Non-DISA site access requirements will be the sole responsibility of the Contractor.

GFI Listing A listing of GFI to be provided to the contractor after Task Order award will be provided and maintained by the TO COR. As new GFI is made available to the contractor, or current GFI is updated, the information will be added to the Task Order COR’s list.

Other Pertinent Information or Special Considerations Identification of Potential Conflicts of Interest (COI).

The contractor(s) providing support on this Task Order may be assisting in helping the DISA CIO to establish requirements for new DISA system and/or IT capabilities. Contractor(s) must identify any actual or potential organizational Conflict of Interest (COI) and its plan to avoiding, neutralizing or mitigating such conflicts IAW Sections H.4 and H.5 of the DESS basic ID/IQ contract and DARS 52.209-9000.

Identification of Non-Disclosure Requirements.

The contractor may have access to sensitive or proprietary information during the Task Order (TO) execution. All contractor employees are required to sign a non-disclosure agreements prior to the commencement of performance.

Inspection and Acceptance Criteria.

Task Order deliverable inspection and Acceptance Criteria procedures shall be detailed in the Quality Assurance Surveillance Plan (QASP).

Section 508 Accessibility Standards The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards |_| 1194.21 - Software Applications and Operating Systems |_| 1194.22 - Web Based Intranet and Internet Information and Applications |_| 1194.23 - Telecommunications Products |_| 1194.24 - Video and Multimedia Products |_| 1194.25 - Self-Contained, Closed Products |_| 1194.26 - Desktop and Portable Computers |_| 1194.41 - Information, Documentation and Support The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria

|_| 1194.31 - Functional Performance Criteria

NOTE: All Deliverables required for performance of this Task Order shall be provided to the COR and TO/COR.

APPENDIX A – LIST OF DELIVERABLES/DELIVERABLES TABLE

Page A-3

Title: DESS ITSM Task Order SLA's

KPI #

Weight

(System Name)