Attachment_6_-_Enterprise_Architecture_Sample_Task_Order_20120619_2015.docx

SOURCE SELECTION INFORMATION - SEE FAR 2.101 & 3.104

DISA CIO - DISA IT Enterprise Support Services

HC1028-13-R-XXXX TASK ORDER 0001

31 January 2012

APPENDIX B –QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

APPENDIX C – QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Defense Information Systems Agency

Chief Information Officer DISA Information Technology Enterprise Support Services (DESS)

ENTERPRISE ARCHITECTURE SUPPORT

HC1047-12-D-XXXX

Task Order 0006 (Version 1.0) 19 June 2012

TABLE OF CONTENTS

Page i

Task Order Contracting Officer Representatives (TO CORs) Primary TO COR

Department of Defense Activity Address Code (DODAAC):

HC1047

DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD 20755

Alternate TO COR

Department of Defense Activity Address Code (DODAAC):

HC1047

DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD 20755

Task Order Title:

Defense Information Systems Agency’s (DISA’s) Information Technology (IT) Enterprise Architecture (EA) Support Services Background The Defense Information Systems Agency is a Combat Support Agency responsible for connecting U.S. Forces and their coalition partners to the DoD’s Global Information Technology (IT) Enterprise. DISA provides IT networks, computing infrastructure, and Enterprise services in direct support of US Warfighters to facilitate the seamless exchange of information on a global scale.

The mission of DISA’s Chief Information Officer (CIO) is to, “Lead and govern the delivery and operation of secure world-wide Enterprise IT services enabling the efficient and effective execution of DISA’s global combat support missions.” In order to accomplish this mission, the DISA CIO must:

· Provide an efficient and effective IT infrastructure and services to support the Agency’s warfighting mission.

· Achieve a Mission Assurance posture that ensures the security and continuity of the Agency’s internal IT Enterprise’s infrastructure and services against an ever evolving spectrum of threats.

· Maintain compliance with all DOD information governance policies and legislation.

· Govern a common architecture and service delivery framework to drive efficiencies in business system investments and portfolio and knowledge management capabilities.

The Office of the Chief Information Officer (OCIO) is responsible for promoting and facilitating the use of architecture products to support IT investment planning; IT requirements definition, planning, and programming; technology standardization; and other decision processes related to the management of IT.

The Office of the Technical Director, CI4, leads all DISA CIO Enterprise Architecture (EA) initiatives and supports the design and development of the Agency’s strategic Enterprise architecture in accordance with DoD EA directives. CIO CI4 EA establishes and supports Agency-wide architectural product compliance in accordance with DoD legislative and statutory compliance, and maintains the Enterprise architecture for the DISA CIO, including associated governance and policy for service and delivery of internal DISA systems and services. The effects of this Enterprise architecture are to promote interoperability, secure information sharing, collaboration, and economies of scale. The EA function of this division provides support to the CIO’s role as one of the Agency’s Senior Decision Authority (SDA) and Designated Approval Authority (DAA) which addresses acquisition oversight, portfolio management practices for all internal DISA systems, and information assurance (IA) for all systems that link to DISA’s IT Enterprise network.

CI4 investigates both new and emerging technologies; validating these technologies to DISA mission requirements and responsibilities of the CIO. CI4 develops process improvement standards and practices, provides senior technical direction on business decisions in the execution of specific Agency projects. CI4 provides senior IT leadership and serves as a consultant and advisor to DISA executive leaders and mission support staff ensuring technical results of the highest quality and effectiveness. CI4 guides the CIO in his internally-oriented position focused on technology needed for running the Agency and solving problems through acquiring and adapting existing technologies. This Task Order outlines requirements for the Contractor to provide Enterprise Architecture (EA) services necessary to support the DISA Chief Information Office. The DISA CIO is responsible for ensuring that all Department IT investments align to the Agency’s business missions in accordance with a controlled Enterprise Architecture that provides an effective, efficient and secure information infrastructure for the Agency. To accomplish this, DISA CIO as the chief architect, supports a set of forums (boards, working groups and integrated product teams) to support the research and development, staffing, approval and publication of Enterprise-level information technology and information management guidance, including but not limited to, architectures, standards, plans, processes and policies.

The CIO is responsible for championing the role of EA with stakeholders across DISA. The CIO is also responsible for communicating the benefits achieved through Enterprise Architecture to external stakeholders such as DoD CIO, Government Accountability Office (GAO) and Office of Management and Budget (OMB). This communication requires close coordination among all key Agency stakeholders supporting DISA’s mission, investment, technology development and IT Standards.

CIO must be able to support strategic alignments and effective IT investments. DISA CIO must respond to new capability requirements while at the same time face difficult budgetary decisions with respect to new requirements, resource redistribution, and spending cuts.

Enterprise Architecture Objectives The CIO and the Enterprise Architecture team must advise program project leaders on business case/solution development. The EA team contributes to the development of investment proposals and work to facilitate progress through DISA’s capital planning and strategic investment process by aligning projects and tracking projects to DISA’s Campaign Plan, Strategic Plan and GIG Convergence Master Plan (GCMP). The CIO EA team has a specific interest in ensuring that projects identified in these strategic plans are supported, and may also introduce new projects and or solutions. For other projects, CIO EA team must support project leaders in initiating and developing proposals to align the Project to the DISA EA. To support these objectives the CIO’s EA team must perform proposal and program assessments. In the initial phase capital planning, the emphasis of these EA assessments is on the business alignment, business case solution, strategic plan, and technical compliance.

One goal of the DISA CIO is to maintain an Enterprise Architecture (EA) as the primary authoritative resource for Program, Planning, Budget, and Execution (PPBE) in the development of DISA’s Investment Portfolio. The Office of the CIO (OCIO) must be positioned with these responsibilities and authorities to improve the operating efficiency of DISA. In addition to statutory responsibilities through the Clinger-Cohen Act and related laws, under the IT Reform Plan there are four main areas in which CIO shall have a lead role:

1. Governance: DISA CIO drives a coordinated investment review process through close coordination with DISA’s Strategic Planning and Investment (SPI) Office and Chief Financial Executive (CFE) Office for DISA’s IT investments, and has responsibility over the IT portfolio supporting the Agency.

2. Commodity IT: DISA CIO must focus on eliminating duplication and rationalize DISA's IT investments. DISA’s commodity services include services such as: IT infrastructure (data centers, networks, desktop computers and mobile devices); Enterprise IT systems (e-mail, collaboration tools, identity and access management, security, and web infrastructure); and business systems (finance, human resources, and other administrative functions.

3. Project Management: DISA CIO must drive improvements specific to overall management of large Federal IT projects by identifying, recruiting, and hiring top IT project management talent.

4. Information Security: As the DISA Designated Approval Authority (DAA), the CIO is the appointed management official tasked to authorize the operation of an information system within an established set of security parameters and with an acceptable risk level.

In support of this reform plan DISA CIO enforces the use of the EA precepts as outlined and directed by the Department of Defense (DoD) Information Enterprise Architecture (IEA) 2.0. The DoD IEA provides a common foundation to support the accelerated transformation to net-centric operations and establishes priorities to address critical barriers. The DoD IEA highlights the key principles, rules, constraints and best practices drawn from collective policy to which applicable DoD programs, regardless of Component or portfolio, must adhere in order to enable agile, collaborative net-centric operations. DoD IEA core principles and rules are organized around five key priorities where increased attention and investment will bring the most immediate progress towards realizing net-centric goals:

1. Data and Services Deployment (DSD)

2. Secured Availability (SA)

3. Computing Infrastructure Readiness (CIR)

4. Communications Readiness (CR)

5. NetOps Agility (NOA)

DoD IEA’s core principles and rules support decision-makers across all tiers and portfolios (including Investment Review Boards and Capability Portfolio Managers) in managing the overall DISA Information Technology (IT) portfolio while also ensuring strategic alignment of programs and architectures to DISA’s IT Enterprise vision. In addition, the following is example of some of the key DoD directives, policies, and instructions also applicable to DISA’s EA governance and support of DoD’s Information Enterprise environment:

· DoD Net-Centric Data Strategy (May 2003)

· Data Sharing in a Net-Centric DoD (DoDD 8320.02, December 2004)

· Guidance for Implementing Net-Centric Data Sharing (DoD 8320.02-G, April 2006)

· DoD Net-Centric Services Strategy (May 2007)

· DoD Information Sharing Strategy (May 2007)

· DoD Information Assurance Policies (DoDD 8500.01E, October 2002)

· DoD Computing Infrastructure Strategy (September 2007)

· DoD Telecommunications Policies (DoDD 4640.13 and DoDD 4650.1, November 2003 and June 2004, respectively)

· Chief Joint Staff Instruction (CJCSI) 6212.01E (2008)

· DoD NetOps Strategy (February 2008)

In reference to these instructions it is critical to the Government that Contractor EA Support be knowledgeable of these applicable DoD laws, policy, and governance (LPGs). As these LPGs determine many of the requirements of the DISA EA program to ensure alignment to the DoD Global Information Grid (GIG).

The DISA CIO’s EA Strategic Plan requires application of the necessary technology management activities to institutionalize mandated processes for ensuring the synchronized development, approval, publication, and compliance of Enterprise-wide Agency IT. The mandated guidance includes, but not limited to, standards and policies in fulfillment of the DoD CIO’s Title X, Title 40, Title 44, National Defense Authorization Act, Clinger-Cohen Act responsibilities, and DoD Directive 8210.xx (Enterprise Architecture (EA) in DoD).

Scope The scope of this Task Order includes DESS Task Area 1 - Project Management and Task Area 6 - DISA IT Enterprise Architecture. The specific technical scope of this Task Order is as follows.

EA Assessments Compliance EA assessments enable the DISA CIO to determine if the proposed project aligns with Agency strategic plans, goals, objectives, and meets requirements under the auspices of DoD IEA, Clinger Cohen Act (CCA), and Business Enterprise Architecture (BEA) and Agency IA requirements. The Business Enterprise Architecture (BEA) is the Enterprise Architecture for the DoD Business Mission Area (BMA) and reflects the DoD business transformation priorities; the Business Capabilities required to support those priorities; and the combinations of Enterprise Systems and Initiatives that enable those capabilities. BEA 9.0 aligns with DoD Architecture Framework (DoDAF) 2.2 name conventions and comprises a set of integrated products including the All Viewpoint (AV), Capability Viewpoint (CV), Operational Viewpoint (OV), System Viewpoint (SV), Services Viewpoint (SvcV), Standards Viewpoint (StdV), and Data & Information Viewpoint (DIV).

Enterprise Architecture Maturity Framework (EAMMF) Assessment To ensure the DISA builds a strong EA competency Agency-wide, DISA will use the GAO Enterprise Architecture Maturity Framework (EAMMF) Assessment as a benchmark to assess and build EA competency. EAMMF assessments of current DISA EA activities and planning plus the application of the EAMMF to DISA will assist in sharpening the focus of EA being applied and also broaden its application across the entire DISA Agency. At present, DISA’s EA lacks formal institutional acceptance across the Agency and is unable to foster change and efficiency as it might once more EA maturity is established. Founded on Carnegie-Mellon’s Software Engineering Institute’s Capability Maturity Model for Software, the GAO EAMMF methodology is organized into 7 levels. Each level represents an increased ability to control and manage the Enterprise Architecture (EA) for a component, service or Agency (C/S/A).

EA IT Portfolio Management Information Environment Driving a leading edge shared services environment will leverage DISA IT PfM resources to support a forward thinking approach to meet DoD’s anticipated IT service needs. Implementation of an IT Enterprise Portfolio Management Information Environment that provides the DISA CIO with analysis and visualization of the Agency IT portfolio. The Government has three key objectives for this work. One is to build greater leverage for the Agency as a provider of shared services. The second is to identify alignments in IT PfM that need to be made in support of DISA’s goals and objectives outlined in DISA’s Campaign Plan. This Information environment should provide the DISA CIO with required analysis that can support transition planning to execute alignment of IT resources, program health assessments, and consolidate duplicative investments and applications. Lastly, the third objective of this work is to provide DISA with information and analytics from its IT PfM that will support fluid authoritative cross Agency domain information sharing and infrastructure consolidation.

DISA EA Repository Implementation Provide the DISA CIO EA visibility across the Agency by implementing a repeatable assessment process through a single, secure, and unified information environment. Implementation of an Enterprise Architecture repository to enable a DISA IT Enterprise document library of artifacts. The repository must support all associated DODAF artifact formats as determined practical by the Government.

DISA EA Governance, Framework, and Management EA Governance, Framework and Management are to provide to support with DISA EA governance instructions, directives, policy, and a DISA EA Framework as directed by the Government. This supports EA communications within DISA and DoD and participation in DoD EA stakeholder activities.

DISA Security Risk Management Architecture The DISA Security Risk Management task will support the CIO’s role as Agency DAA. This work must strengthen risk identification, tracking, and mitigation across DISA's Enterprise information environment. The objective is to improve the Agency's risk posture by providing a comprehensive impact analysis based on validated vulnerabilities.

DESS IT Enterprise Architecture Documentation Enterprise architecture documentation is required to provide information to DISA CIO planners and designers involved in future DISA Enterprise improvements, Support investment planning, purchasing analysis, and decision support.

Specific Tasks Enterprise Architecture Assessment Compliance Program Health Assessments: As directed by the Government, the Contractor shall support EA Program Health assessments of systems, programs and services as needed by the CIO. The assessment shall assess capabilities, activities, processes, data, information exchanges, business rules, system functions, services, system data exchanges, technical standards, terms, and linkages to Laws, Regulations, and Policies (LRP).

PPB&E Assessments: As directed by the Government, the Contractor shall perform DISA CIO EA assessment reviews in support of the governing PPB&E process milestones for all DISA’s IT investments. In addition, the Contractor will work with Chief Financial Officers and Chief Acquisition Officers to ensure IT portfolio analysis is an integral part of the yearly budget process for DISA. These assessments will include assessment to DoD’s Business Enterprise Architecture (BEA). The BEA assessment goals and objectives of the reviews (see Table 1 below) are to ensure that the expected business outcomes of the project are aligned to concept and high-level project requirements.

Table 1 – EA Goals and Objectives

Compliance Review Sessions: As directed by the Government, the Contractor shall support Integrated Project Teams (IPTs) in compliance review sessions which are designed to improve line-of-sight between project teams and DISA’s senior executives.

Enterprise Architecture Maturity Framework (EAMMF) Assessment EAMMF Assessment: Contractor shall perform an annual assessment of DISA EA program, and provide results and recommendations to correct and/or develop necessary maturity in the following 7 areas identified in Table 2. This assessment must be done in support of a more effective Agency-wide EA program. The following DISA EA EAMMF deliverable Requirements Matrix outlines the specific deliverable outcome of the EAMMF Assessment for each of the 7 EAMMF assessment areas.

Table 2 - DISA EA EAMMF Deliverable Requirements Matrix

Establishing EA IT Portfolio Management Information Environment The Contractor shall leverage existing DISA Enterprise data resources to supporting IT PfM analysis and reporting capabilities for the Agency.

IT PfM Requirements Document: The Contractor shall develop a DISA Enterprise Architecture IT Portfolio Management (IT PfM) Requirements document based on DoD, DISA policy, laws and guidance.

IT PfM Baseline: The Contractor shall conduct review and analysis to baseline existing DISA IT PfM maturity and summarize these two activities in an IT PfM Finding and Recommendations white paper.

IT PfM Data & Services Strategy Model: The Contractor shall develop a data and services strategy model and approach to support DISA EA by leveraging existing multiple DoD EA resources (e.g. DoD IT Portfolio Registry (DITPR), DoD Architecture Repository System (DARS), Enterprise Mission Assurance Support System (EMASS), and GIG Technical Guidance (GTG) Federation of tools. Contractor will work closely with the owners of these systems/services for application to CIO use, consumption, and or support. Success criteria for this work will be that the data and services strategy leverage DISA IT PfM to be foundational to tracking and managing EA assessment and compliance for the CIO.

IT PfM Analysis & Reporting Capability: The Contractor shall implement a reporting system leveraging the aforementioned data resources as required to support EA IT transition planning for CIO by conducting technical analysis of DISA IT PfM. Reports shall identify and or propose logical sequential breakdown of detailed transition required to accomplish the goals of the DISA IT Enterprise IAW with the DISA Campaign Plan, GIG Convergence Master Plan (GCMP), and applicable data and service planning. Capability must support:

· Transition Planning – a function for the Government to assess level of effort and a predicted execution schedule.

· Transition Tracking – a function to visualize tracking interactive DISA IT Roadmap dashboard. The dashboard shall highlight key indicators (e.g. costs, schedule, and performance) for senior leaders.

· Risk Assessment – a functional reporting and analysis capability shall provide program and technical risk analysis and assessment of DISA’s IT portfolio.

· IT Rationalization – focuses on eliminating duplication and rationalizes DISA's IT investments such as: IT infrastructure (data centers, networks, desktop computers and mobile devices); Enterprise IT systems (e-mail, collaboration tools, identity and access management, security, and web infrastructure); and business systems (finance, human resources, and other administrative functions). The reporting functions of this tool shall support DISA’s overall mission in IT and infrastructure consolidation, and cross domain data sharing.

DISA EA Repository Implementation The Contractor shall design, implement and maintain the DISA Agency EA Repository. The EA Repository will become the central hub for storing architecture variants, viewpoints, views / models and architecture elements that comprise these objects. The EA Repository will integrate and display Enterprise information that supports the DISA Command Group, Senior Decision Authorities (SDA), Senior Management, and the Agency communities of interest (COI), and leverage Commercial-off-the-Shelf (COTS). This Repository shall be designed to scale to provide decision support for all levels of management throughout the Agency. Acceptance criteria for this DISA EA repository will be that it must prove ability to capture architecture, functional, operational, and service capabilities that exist within the DISA Enterprise to facilitate total accountability of Agency capabilities. It must demonstrate transparency to senior leadership and component managers that require Agency-wide visibility of their information technology and functional resources. The repository must capture architecture, functional, operational, and service capabilities that exist within the DISA Enterprise to facilitate total accountability of Agency capabilities. The EA repository must be made available to the Agency-wide DISA EA community.

EA Repository Strategic Plan: The Contractor shall initiate this work with an EA Repository Strategy brief to the DISA CIO for approval. This strategy shall include a comprehensive review of existing requirements documentation to baseline the percent complete of existing requirements. The Strategic Plan must provide and outline of recommended capabilities and at least 3 COTS architecture assessments with recommendations. One of the assessments must be IBM Rational System Architect v11.4. The Strategic Plan must also include a POA&M that covers all activities through implementation and testing. The design and implementation of the DISA EA Repository must include assessment of existing EA work and resources available to DISA internal and external (e.g. DARS). This work shall coordinate and leverage EA work outlined in DISA IT Enterprise Architecture Documentation task (Task 6.7). Essential to this work is that existing DoD/DISA resources be leveraged to maximum extent possible.

EA Repository Implementation Plan: The Contractor shall deliver a detailed Implementation Plan based on an approved Strategic Plan (Subtask 6.4.1). The Implementation Plan must address but not be limited to: resources required to accomplish the task, key personnel required/responsible for the task, training, technical assistance requirements, schedule led plan dependent IT requirements, and required data conversions.

EA Implementation: The Contractor shall implement an EA Repository based on the findings and recommendations of Subtasks 6.4.1 and 6.4.2. The Repository must meet the Government’s criteria for acceptance and testing as identified in the Implementation Plan.

EA Repository Management Plan: The Contractor shall provide an EA Repository Management Plan that addresses all life cycle requirements to include but not limited to Repository Hosting, EA Configuration Management (CM) processes, Standard Operating Procedures (SOP), and alignment to the needs of DISA and DoD’s EA community of practice.

DISA EA Governance, Framework, and Management The Contractor must demonstrate measurable effectiveness for the development and management of their proposed governance framework for DISA’s DISA’s IT investments in the IT portfolio supporting the Agency.

Develop and support DISA EA Governance: The Contractor shall develop and/or revise supporting DISA EA Governance instructions, directives, and or policy as directed by the Government. Support includes providing DoD EA thought leadership to support technical EA disciplines, DoD EA domain knowledge, and EA policy, laws, and governance (PLG), in addition to, participation with Government in both industry and Government EA plenary sessions and conferences.

EA Communication: The Contractor shall develop communications material for the DISA EA Community of Practice. The Contractor shall develop and publish DISA EA Educational Brochure, update DISA EA’s CoP Plan and EA Communications Plan. These materials shall leverage DISA MS SharePoint services data sharing and reduce repetitive distribution of new and or updated material.

Develop a DISA Security Risk Management Architecture (SRMA) The DISA Security Risk Management task must support the CIO’s role as the Agency DAA. The Contractor must demonstrate how they can improve the Agency's risk posture by providing a comprehensive impact analysis based on validated vulnerabilities in the following tasks:

Develop SRMA Framework: The Contractor shall develop a Security Risk Management Architecture (SRMA) framework that will support DISA’s Enterprise wide strategic security risk and technology architecture planning as it aligns to DISA policy, laws, and governance in support of EA compliance.

Develop SRMA Metrics: In support of program alignments to the SRMA, the Contractor will develop EA Information Assurance (IA) risk assessment metrics to be applied to appropriate recommended DODAF artifacts. These artifacts are to then be required to support IA assessment during acquisition milestone decisions while also being mandated in support of IA risk assessment.

DISA IT Enterprise Architecture Documentation The Contractor will conduct technical analysis to develop and maintain the DISA IT Enterprise DoD Architecture Framework (DODAF) views to support DISA IT EA documentation. (e.g., to include but not limited to OVs, TVs, SvcV, and SVs), and other network architecture documents as requested. The Contractor shall document DISA’s network and services architecture using DODAF. The Contractor shall develop and maintain a comprehensive set of DISA network architecture artifacts that can support network management, documentation, and testing. Documentation will adhere to the DoD Architecture Framework (DoDAF) 2.0 formats for all work products where applicable. Network drawings and plans will be provided in a timely fashion (e.g., documentation related to DISA Enterprise and Develop Net). The level of detail for the network diagram and security architecture goes down to the resource level (i.e. firewall, router, software package, etc.) and extends throughout DISA Enterprise to the Service Delivery Points of the DISA Enterprise locations and/or the last DISA Enterprise asset prior to the DISN. Network diagrams will be communicated using Microsoft Visio, but all data shall be entered into IBM Rational System Architect for management, analysis and transition planning. DISA CIO will work with the Contractor to publish the DISA Enterprise Architectures for viewing via SharePoint site.

The architecture management and analysis must facilitate long term EA goals including:

· Capturing long-term objectives and plans to adopt new and or expanded additional capabilities.

· Capturing the ‘requirements’ necessary to develop long-range network growth plans and adoption of concepts like Cloud Computing.

· Developing Continuity of Operations Plan (COOP).

· Leveraging documentation and lessons learned.

· Supporting simulation and what-if scenarios (e.g., how can we determine the number of users affected when a specific component, building floor, or site experiences an outage).

To support the development of these architecture artifacts, the Contractor will develop a Plan of Action and Milestones (POA&M) to illustrate the sequence of artifact development and their interdependencies. This will be the first deliverable for this work and will be used to manage the deliverable dates projected for these artifacts.

The following is an overview of the products and activities in which the Contractor developed DODAF artifacts must support:

· As-Is Network Architecture - The data gathered will be used to create a network architecture diagram illustrating the connectivity, both internally and externally, provided by the DISA Enterprise network. At the highest level, the Network Diagram will resemble a CONOPs, Operational Views, Systems Views, Technical Views, and more detailed decompositions will drill down to specific sites, buildings, floors of buildings, and possibly to the level of specific components, if the data is available (e.g., from up-to-date as-built and/or a network discovery exercise). All levels will be documented to resemble tailored DoDAF views (i.e., OV-1, OV-2, SV-2, etc.) The deliverables will include descriptions of the diagrams.

· To-Be Network Architecture - Through facilitation with DISA leadership, the operational purpose and strategy for the infrastructure will be established to provide clear direction for the continual evolution of DISA Enterprise and GIG compliant, Net-Centric DISA Network Architecture (e.g., “as-is” and future OV1/SV1).

· Network Security Architecture – The security architecture will provide details on the alignment of DISA Enterprise with Defense-In-Depth principles. The following will be considered: Hardware resources such as firewalls, Intrusion Detection System (IDS) and Common Access Card (CAC) readers, as well as software assets such as Single Sign-On (SSO) and Lightweight Directory Access Protocol (LDAP). Security standards that dictate the configuration of security assets will also be included.

· Technical Standards Profile - The architecture will include a profile of standards that will be applied to various segments of DISA’s network to ensure compliance with governing authorities. This will address the current and future standards (tailored StdV-1 /StdV-2).

· Configuration Management (CM) Plan – a formal change process necessary to keep the data quality of DISA’s architecture at the highest level possible. The CM Plan will spell out the processes for maintaining the infrastructure segment of the EA. This will include understanding new system introduction processes, break/fix, and release management.

· Transition Plan– A DISA Enterprise Transition Plan will be created to align current initiatives affecting DISA Enterprise to provide a single picture of how the infrastructure is changing and emerging technologies can be introduced. This information will feed analysis and recommendations for DISA’s target architecture.

The architecture shall be developed to support several key viewpoints and stakeholders with differing, but related needs as follows:

· Investment decision making – e.g., DISA Components can examine programmatic considerations for initiatives such as consolidations, proposed systems, and new IT in context with interoperability needs, integration or leveraging opportunities, and expected impact on mission effectiveness.

· Capability and interoperability analysis – e.g., DISA can analyze architectures in terms of their support to joint concepts, identification of capability needs, and determine the operational and support-related performance attributes of a system(s) that provide the capabilities required by the users.

· Component system development – e.g., DISA developing systems can use architectures to determine system concepts related to operational concepts and ensure interoperability.

· Operational planning – e.g., DISA Enterprise planners can examine how various mission participants, systems, and information work together, what problems may be encountered, and what quick fixes may be available.

· Compliance with DoD Business Enterprise Architecture (BEA) – DISA Enterprise Architecture will help to ensure compliance with the DoD BEA.

· Compliance with Global Information Grid (GIG) Enterprise Services (ES) – DISA will ensure compliance with the DoD GIG-ES. The goal of GIG-ES is to improve the speed and quality of DoD decision making by connecting information producers and consumers more effectively through information technology and Net-Centricity.

· Transition planning - DISA can use the architecture to make transition plans, establish schedules, and to retire legacy systems, reengineer and/or integrate systems and applications.

Developing the DESS DODAF 2.0 POA&M: The Contractor shall initiate this work by first providing a POA&M for the development of DESS DODAF artifacts. The POA&M must provide both sequence and interdependencies of artifacts with deliverable dates. The POA&M shall also make any recommendations to identify and additional support the requirements outlined in this overall 6.7 tasking.

Required DODAF 2.0 Artifacts: The Contractor shall develop the DODAF 2.0 Artifacts identified in the Deliverables Table located in Appendix A in accordance to the Government approved POA&M identified in Subtask 6.7.1.

The proper accurate completion of this EA artifact development and documentation must be capable of providing useful, accessible, navigable information that will:

1. Serve as a tool for DISA CIO planners and designers involved in future DISA Enterprise improvements.

2. Facilitate network trouble-shooting, e.g., determining effects of specific network or server component outages, and what-if planning.

3. Provide useful information to other functional or network systems (e.g., a network that plans to connect to DISA Enterprise) to promote development of standards.

4. Support investment planning, purchasing analysis, and decision support, with regards to upgrades and maintenance.

5. Support configuration management of changes that relate between the network and applications.

6. Understand the network topology to assess impacts of change on DISA programs; enabling program managers (and the Enterprise) to plan for future changes to DISA Enterprise.

7. Capture the Transition Plan based on ‘Enterprise’ requirements necessary to meet DISA’s strategic direction.

8. Serve as a tool for DISA CIO planners and designers involved in future DISA Enterprise improvements.

9. Facilitate network trouble-shooting, e.g., determining effects of specific network or server component outages, and what-if planning.

10. Provide useful information to other functional or network systems (e.g., a network that plans to connect to DISA Enterprise) to promote development of standards

11. Support investment planning, purchasing analysis, and decision support, with regards to upgrades and maintenance.

12. Support configuration management of changes that relate between the network and applications.

13. Provide understanding the network topology to assess impacts of change on DISA programs; enabling program managers (and the Enterprise) to plan for future changes to DISA Enterprise.

14. Capture the Transition Plan based on ‘Enterprise’ requirements necessary to meet DISA’s strategic direction.

Place of Performance Primary Place of Performance The Contractor shall perform work in Government provided office space located in the DISA Headquarters campus located on Fort Meade, MD.

Alternate Place of Performance Contractor employees may be required to work at home, another approved DISA activity within the local travel area or at the Contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR)/Task Order COR (TO COR) approval is required. Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources. The Contractor shall continue to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer may request an equitable adjustment.

8. Travel and Other Direct Costs Contractor travel is anticipated to support the requirements named in this Task Order. Travel shall be conducted IAW Section H.8 and H.9 of the DESS basic ID/IQ contract. Travel will be established as a Cost Reimbursable CLIN in the Task Order with an estimated amount of $5,000.00 per year. Travel for the 6-month extension of services in accordance with FAR 52.217-8 is estimated to be $2,500.00. The total travel estimated under this Task Order, inclusive of all options and extensions, is $27,500.00.

9. Period of Performance The period of performance for this Task Order is one-year with four (4) one-year option periods. The Task Order also includes the 6-month Extension of Services in accordance with FAR 52.217-8. The total period of period, inclusive of all options and extensions, is 66 months.

1. Delivery Schedule All deliverables associated with this Task Order are specified in the Deliverables Appendix (Appendix A).

Service Level Agreements and Performance Metrics All Service Level Agreements (SLAs) associated with this Task Order are specified in Appendix (Appendix B).

Security Requirements All tasks and subtasks to be performed under this contract are up to and including the SECRET level and positions are IT-II for systems access. All personnel performing services under this Task Order will be designated ADP Sensitivity Level II (ADP-II), and will have a favorably completed National Agency Check (NAC), or an Interim SECRET clearance prior to performance.

The Contractor will forward a Visit Authorization Letter (VAL) to the Task Order Contracting Officer Representative (TO/COR) listed at beginning of this Task Order all employees 5 working days prior to the beginning of the Task Order period of performance and as new Contractor employees are assigned to the Task Order.

The VAR/VAL Method One Per direction of DISA Security and the Chief of Security for Computing Services Operations, Visit Authorization Letters (VALs) or Visit Requests (VARs) for Contractor personnel that will be working for Computing Services either on- or off-site will be forwarded via Joint Personnel Adjudication System (JPAS) to the VAR Center using the following SMO Code: XXXXXX.

For those companies submitting the VALs via JPAS, they will also provide a copy of the VALs to the TO CORs of the contract for creation of records in the Contractor Verification System (CVS) so that Common Access Cards can be obtained for the Contractors that require them.

Method Two For those companies that do not have the capability to send VALs via JPAS, they can send the VALs via e-mail to the TO CORs. Due to Privacy Act concerns, the VALs will be e-mailed as a password protected “WinZip” attachment, followed up by a second e-mail containing the password for the first e-mail.

The VAR/VAL shall be on company letterhead or pre-fabricated form and contain the following information:

Task Order number with start and end dates Company point of contact (POC) and telephone number Government TO COR name and telephone number Complete legal name of employee(s) Social Security Number Security Clearance level, date granted, and Adjudication facility name, i.e. DISCO Type of personnel security investigation (PSI) pending or completed Date PSI completed

DISA Security Personnel can be contacted for security related questions as follows:

For Industrial Security related issues:

Primary: Ms. Jane A. Doe, phone: (301) 225-XXX Alternate: Mr. John A. Doe, phone: (301) 225-XXXX Defense Information Systems Agency ATTN: MPS61, Industrial Security DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD, 20755

For Personnel Security related issues to include interim IT access requests:

Primary: Ms Jane A. Doe, phone: (301) 225-XXXX Alternate: Mr. John A. Doe, phone: (301) 225-XXXX Defense Information Systems Agency ATTN: MPS62, Personnel Security DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD, 20755

Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the Government facility.

Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Personnel who fail to complete the required training by the stated deadlines for completion may have their access to the DISANet revoked and/or be removed from performance on the Task Order.

The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

DISA retains the right to request removal of Contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this Task Order, clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer (CO). When and if such removal occurs, the Contractor shall, within 15 working days, fill the vacancy (billable) with equally or more qualified personnel than the individual dismissed.

The Privacy Act of 1974 applies. The Contractor may be required to have access to highly sensitive and proprietary information for the performance of this Task Order. The Contractor will not divulge any information about data processing activities or functions, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor will observe and comply with the security provisions in effect at computer centers. Any required identification badges will be worn and displayed at all times. A Department of Defense Contract Security Classification Specification, Form DD 254, must be completed. A DISA Non-Discloser Agreement (NDA) must be completed by each employee prior to commencement of work.

Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI) GFE/Access DISA shall provide the Contractor access to the applicable Local Area Network(s), Personal Computer(s) necessary to accomplish the work tasked under this Task Order. The Contractor, in coordination with the COR/TO COR, shall be responsible for obtaining appropriate approvals for access. Non-DISA site access requirements shall be the sole responsibility of the Contractor.

GFI

A listing of GFI to be provided to the Contractor after Task Order award will be provided and maintained by the Task Monitor COR. As new GFI is made available to the Contractor, or current GFI is updated, the information will be added to the Task Order COR’s list. Other Pertinent Information or Special Considerations Identification of Potential Conflicts of Interest (COI).

The Contractor(s) providing support on this Task Order may be assisting in helping the DISA CIO to establish requirements for new DISA system and/or IT capabilities. Contractor(s) must identify any actual or potential organizational Conflict of Interest (COI) and its plan to avoiding, neutralizing or mitigating such conflicts IAW Sections H.4 and H.5 of the DESS basic ID/IQ contract and DARS 52.209-9000.

Identification of Non-Disclosure Requirements.

The Contractor may have access to sensitive or proprietary information during Task Order (TO) execution. All Contractor employees are required to sign non-disclosure agreements prior to the commencement of performance.

Inspection and Acceptance Criteria.

Task Order deliverable inspection and Acceptance Criteria procedures shall be detailed in the Quality Assurance Surveillance Plan (QASP).

Section 508 Accessibility Standards The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technica…