DOP_PWS_Services_01_Nov_2012.docx

STRATEGICWATCH AND GNISE DEVELOPMENT AND SOFTWARE ENGINEERING SUPPORT

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

as of November 1, 2012

1. Contracting Officer Representative (COR)

a. Primary COR

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract Title. Defense Operations Platform Support (DOP)

3. Background. This requirement is follow-on to contract vehicle HC1047-10-P-4161, Assured Sharing Framework (ASF) with IBM to articulate to a next step as the Defense Operations Platform. The initial requirement was tied to the National Senior Leadership Decision Support System (NSLDSS) effort which fulfilled the Command and Control and Content Sharing interest area for the Chief Technology Office (CTO). This requirement will expound upon the work done on the previous contract vehicle and continue in the creation of the Service Oriented Architecture (SOA) middleware solution.

4. Objectives. The purpose of the requirement is to provide the CTO with the ability to integrate third party capabilities which once integrated into the DOP harness will be present as an Attribute Based Access Control (ABAC) enabled service. The requirement will prove out the DOP on-boarding process for third party applications and will offer a functionality demonstration of a third party application fielded within the DOP harness. The requirement will generate the documentation and research needed to create a working service catalogue offering for the Defense Information Systems Agency (DISA), and automate the support for the hosted composable ABAC-enabled web-services.

5. Scope. The goals of the DOP Security Harness

· Is to enable an organization to evaluate the functionality of newly created or 3rd party mission applications with actual mission data – prior to having to incur the time and expense of accrediting the application.

· Give an enterprise the confidence that their security posture will not be adversely affected by the operations of the mission applications under evaluation.

The Defense Operations Platform (DOP) provides enclave within the customer's enterprise that can then host one or more of these mission applications. Each one of these mission applications is in turn isolated from other hosted tenants. DOP SHSA provides the necessary supervised network routing to enable the hosted mission applications to continue to provide their capabilities to the enterprise. In addition to the network infrastructure, DOP SH provides a series “services” that can be used by the mission applications to enable them to operate within the security harness in a manner that is consistent with the enterprises security policies. The scope of this requirement will include contract management, guidance for third party applications behind DOP, cost model analysis, validation of government acceptance on-boarding process, training support, professional services, quality assurance, third-party application demonstration and workflow integration analysis.

6. Performance Requirements.

6.1. Task 6.1 – Contract Management.

6.1.1. Subtask 6.1.1. - Contract Management Plan. The Contractor will prepare a Contract Management Plan (CMP) describing the technical approach, organizational resources including contract budget, key personnel (labor category breakouts), and management controls to be employed to satisfy, at minimum, the baseline functional requirements and meet the cost, performance and schedule requirements throughout contract execution. A Work Breakdown Structure (WBS) and project schedule will be provided with the CMP as separate documents. The CMP cost and schedule data will serve as the guide against which the government will monitor contract progress. The contractor will submit changes to the CMP as necessary, if conditions change during the life of this contract.

DELIVERABLES

Contract Management Plan

6.1.2. Subtask 6.1.2 - Monthly Status Report (MSR). The Contractor will provide a MSR using WBS, schedules, and budget/cost charts to describe the costs, technical progress, quality assurance, configuration management, risks, and security management as applied to execute the requirements of this contract. The Contractor will provide appendices to the monthly MSR as appropriate or as directed by the terms of this contract, such as: new capabilities, trip reports, and special reports. At a minimum, the MSR will include:

· The project task schedule showing any proposed changes, the reasons for changes, and the potential impact on the contract;

· Progress of work accomplished for that reporting period, including descriptions of activities for each task/subtask and deliverables;

· Planned and accomplished travel, with trip reports attached;

· Planned activities for the next reporting period including technical data to be submitted;

· Outstanding issues from prior monthly reports and the status of each issue (provided monthly until issues are resolved or COR has deleted);

· Identification of problems or issues occurring during the reporting period and recommendations for resolutions, with attention to issues involving risk management activities;

DELIVERABLES

Monthly Status Report (MSR)

6.1.3. Subtask 6.1.3 - In-Progress Reviews (IPR). The contractor must meet monthly with the DISA Program Manager (PM), COR, and other DISA staff to report status and progress and to identify and resolve issues. The contractor is expected to provide briefing slides, as well as printed briefings and other explanatory hand-outs in sufficient quantities to support anticipated attendance. These IPRs may be held at government or contractor facilities, at the discretion of the government. One copy of the monthly IPR printed briefings and associated explanatory material will be submitted as a deliverable on the date the IPR is held. The contractors will track issue and/or action items identified at the IPR and will report status to the COR monthly in the MSR until the COR declares the action item resolved.

Deliverables

In-Progress Reviews (IPR)

6.2. Task 6.2 – Application Guidance for DOP

6.2.1 Subtask 6.2.1 – Guidance for Third Party Applications Behind DOP The contractor must provide guidance in the form of documentation and test cases for integration of third party applications behind DOP. The contractor must provide documentation that denotes an integration difficulty scale. The integration difficulty scale must expound upon technical guidance of third party applications on a sliding scale that ranges between easy integration, medium integration, and hard integration. The integration scale should use as its rating criteria ease of integration, cost of integration, engineering support spent to integrate, and cost benefit of integration. The documentation and integration scale should tie to the Cost Model Analysis under Subtask 6.3.1 Cost Model Analysis.

Deliverables

Technical Integration Scale of Third Party Applications in DOP (documentation) Guidance for Third Party Applications in DOP (documentation)

6.3. Task 6.3 – Cost Model Process for Applications Fielded Behind DOP

6.3.1 Subtask 6.3.1 – Cost Model Analysis. The contractor must provide technical inputs to support for a cost model analysis for CTO. The cost model analysis must present cost guidance associated with the integration of applications ranging from easy to hard. The analysis must outline all costs associated with the on boarding process, as well as, an incremental breakdown of the costs. The contractor must detail operation and maintenance costs associated with application integration based on degree of difficulty. The contractor must prepare the cost analysis model in conjunction with the Guidance for Third Party Applications in DOP. The contractor must determine the cost benefit to the government in utilizing DOP for fielding third party applications.

Deliverables

Cost Model Analysis (documentation) White Paper

6.4. Task 6.4 – Validation for Government Acceptance of the On-Boarding Process.

6.4.1. Subtask 6.4.1 – Government Acceptance of DOP On-Boarding Process. The contractor must provide technical guidance to the government application manager to determine difficulty of third party application integration based on the technical integration scale as delivered under Task 6.2.1. The contractor must set up testing standards for the government application manager to determine degree of difficulty for the on-boarding process. The contractor must deliver testing standards with guidance on how to utilize the testing standards in the form of documentation to the government.

Deliverables

DOP – On boarding testing standards (Documentation)

6.4.2 Task 6.4.2 Tools

Rational Tester – The contractor will provide the tester to ensure that the performance of the equipment meet standards.

6.5. Task 6.5 –Training

6.5.1. Subtask 6.5.1 – Training Support. The contractor must provide user web-based and in person training, including downloadable multi-media training materials, handouts, and other documentation for approximately five students. The training sessions will exist for up to twenty users. These training sessions will teach users how to use the commercial DOP. The contractor must provide integration support of third party application training. The contractor must provide integration protocol support for plug in and add on. The training locations would be at DISA Ft. Meade facilities. The contractor must submit a course outline and synopsis, along with proposed training materials to the COR for approval at least 30 days before the first class and will brief the COR on the procedures and policies to be employed in the training sessions. The contractor must solicit feedback from each student at the completion of the class. The contractor must maintain a roster of students attending and will submit to the Task Monitor both the roster of attendees and completed student survey forms at the end of each class in a course completion report within ten (10) days of the end of the class.

DELIVERABLES

Course Outline and Synopsis Training Materials Course Completion Report User Guide

6.6. Task 6.6 – Professional Services.

6.6.1. Subtask 6.6.1 –Technical Engineering and Configuration. The contractor must provide mid-level engineering and configuration services to configure the commercial DOP software and hardware. The contractor must also supply engineering and configuration services to assist DISA in maintaining DOP and the underlying components. The contractor will provide a full installation and configuration guide of DOP and all underlying components within 60 days of contract start-up, update as required by the COR. The contractor will provide an update user’s guide and system administrator’s guide within 60 days of contract start-up, as needed or as specified by the COR. The user guide will document all user tasks and capabilities within DOP. The contractor must provide a configuration guide within 90 days of contract start, as needed or as specified by the COR. The contractor will address problem as specified by the COR.

Deliverables

Integrated Software Deliveries with Configuration/Engineering Support Full Installation and Configuration Guide Update User Guide and System Administrator’s Guide

6.6.2. Subtask 6.6.2 – Quality Assurance. The contractor must provide the CTO with documentation and test cases that demonstrate 100% functionality of applications within the DOP framework. The contractor must provide documentation for applications that perform at less than 100% functionality within the DOP framework. The documentation will discuss the functionality that was unable to be achieved within DOP and the contractor must explain why the application did not meet the 100% functionality requirement including lessons learned to provide future 100% functionality.

Deliverables

Application Functionality Documentation

Subtask 6.6.3 – Third Party Application Validation Demonstration for the CTO. The contractor must provide integration of third party capabilities into DOP. The contractor must provide a proof of technology demonstration that shows a successful integration of third party capabilities at the DISA Ft. Meade Lab Facilities. The contractor must deliver an updated design/integration plan denoting specific lessons learned during the integration of the third party capabilities. The contractor must deliver an updated third party configuration guide for “on-boarding” the capability into the DOP harness with the control console, to include the minimum standards and associated APIs. The contractor will deliver an Integration Analysis Tool to determine remaining integration steps needed for the third party service, the integrated DOP harness and third party application(s), and an enhanced DOP harness calibration tool. The contractor must deliver DOP user documentation, and DOP system administrator guide, as well as a final report summarizing all integration activities and actions, including associated performance impacts to the third party service, and a projection for enhanced DOP capability.

Deliverables

Update Third Party Design/Integration Plan Update Third Party Configuration “On-Boarding” Guide Third Party Integration Analysis Tool Demonstration of successful integration Calibration DOP Tools Update DOP User Guide Update DOP System Administrator Guide Third Party Capability Integration - Final Report at the end of performance

6.7. Task 8 – Workflow Integration Analysis (OPTIONAL). The contractor must develop a workflow study that demonstrates a pipeline to production approach amongst the DISA service catalogue offerings (RACE/FORGE.MIL). The contractor must document the pipeline to production approach chronicling the milestones and technical integration processes. The contractor must project costs to determine a DISA service catalogue offering.

DELIVERABLES

Workflow Integration Analysis

6.8. Task 9 – Travel

6.8.1. Subtask 6.9.1– Travel. Travel is anticipated in and around the National Capital Region (greater Washington, DC, including northern Virginia and Maryland locations). Travel must be preapproved by the COR in email prior to travel. The contractor must submit trip reports electronically within five (5) days of trip completion and will include a copy of trip reports in the MSRs. Trip reports must include a discussion of any issues at other locations which could potentially impact the effectiveness of the DOP integration or use. It must also list the objective of the travel and what was accomplished during the travel. The contractor must, to the maximum extent practicable, minimize overall travel costs by taking advantage of discounted airfare rates available through advance purchase. Charges associated with itinerary changes and cancellations under non-refundable airline tickets are reimbursable, as long as the changes are caused by the work requirement. Travel performed for personal convenience or daily travel to and from work at the contractor’s facility or local Government facility (DISA Ft. Meade) must not be reimbursed. Costs associated with contractor travel must be in accordance with FAR Part 31.205-46, Travel Costs.

6.9. Work Flow Integration

6.10. Performance Standards.

7. Place of Performance. The majority of the work will be performed at the DISA Ft. George G Meade facility. Travel to other CONUS locations possible as required.

Alternate Place of Performance - Contingency Only. Contractor employees may be required to work at home, another approved activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to contractor personnel must be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR) approval is required. Contractor must prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor must use best efforts to provide the same level of support as stated in the PWS.

8. Period of Performance.

The period of performance will be 365 calendar days after contract award with two one-year options to be exercised at the discretion of the Government.

9. Delivery.

9.1. Delivery Schedule.

(2 copies) Updates as needed

(2 copies) Monthly by the 10th day of the month

(4 copies) As directed by the COR

(4copies) As directed by the COR

(4 copies) As directed by the COR

(4 copies) As directed by the COR

(4 copies) As directed by the COR

(4 copies) As directed by the COR

Updated Third Party Configuration “On-Boarding” Guide Third Party Integration Analysis Tool Demonstration of successful integration

Calibration DOP tool DOP User Guide DOP System Administrator Guide Third Party Capability Integration - Final Report

(2 copies) As directed by the COR

(2 copies) Monthly, in MSR

9.2. Deliverables Submission Process. Acceptance covers the process and criteria by which deliverables, milestones, phases of the project and the project as a whole, are to be accepted. The three major components of the acceptance process are:

· Deliverables. Any product, service or document produced as part of a project that is of sufficient significance to require customer acceptance. A number of deliverables will be produced throughout a project and can be used to demonstrate project progress.

· Acceptance criteria. A defined set of principles or standards by which something can be judged. These should be expressed quantitatively (where possible) to allow objective measurement and are defined in the list of project deliverables in the PWS.

· Acceptance procedures. The process to be followed to gain formal acceptance that a deliverable meets the agreed criteria.

9.3. Deliverable Submission. The contractor must present a number of deliverables to the COR for review and approval. The deliverables presented electronically to the COR on or before the dates listed for each deliverable. The contractor must provide a deliverable acceptance form (format to be determined) for completion by the DISA representative and must record the acceptance request in a deliverable acceptance log. The information recorded includes:

· Deliverable name

· Date request presented to client

· Client representative to whom the request was delivered.

9.4. Deliverable Acceptance. The deliverable acceptance must include a review period of thirty (30) days or less (or as otherwise indicated through mutual agreement with the DISA representative) from the submission date. Within this period the COR must review the deliverable and either accept or reject it by returning the deliverable acceptance form to the contractor. If more time is needed to review a specific deliverable, the COR must notify the contractor. Extensions must be negotiated between contractor and the COR and confirmed in writing (either physical or through electronic email).

In order for the project to continue on schedule, deliverables not formally accepted or rejected within the agreed 30- day review period must be considered approved. When a deliverable acceptance form is returned to the contractor, details must be recorded in the acceptance log. Final deliverables, such as entire systems, may not realistically be reviewed in a thirty-day period. The contractor and COR should agree on the review period length for major deliverables prior to their completion and submission. Accepted deliverables must become baselines for later work.

9.5. Acceptance.

If the deliverable meets the acceptance criteria (including any approved variations), the COR must sign and date the “Accepted By” section of the deliverable acceptance form and return it to the Contractor within the review period. While an electronic notification must be acceptable to indicate that the deliverable has been accepted, the contractor to ensure accurate record keeping must receive an original or digital signature. Electronic Notification must be Upon COR acceptance; the contractor must consider the deliverable complete. "Electronic notification” means the notification of a party or other person that a document is served by sending an electronic message to the electronic service address at or through which the party or other person has authorized electronic service, specifying the exact name of the document served and providing a hyperlink at which the served document can be viewed and downloaded.

9.6. Rejection. The contractor must strive to obtain constant feedback during a project so that deliverable acceptance is a formality. However, if a deliverable fails to meet the acceptance criteria (including any approved variations), the COR must complete the "Rejected By" section of the deliverable acceptance form and return it to the contractor within, or before the review period. A reason for rejection must be provided.

The contractor must act expediently to correct all in-scope problems and must negotiate with the COR on any out-of-scope issues.

Since the extent of a problem cannot be anticipated in this response, no set time must be established for deliverable correction. The contractor must submit a schedule for making changes to the deliverable within three (3) working days of receiving a rejected deliverable acceptance form.

9.7. Partial Acceptance. In some cases, the COR may issue partial acceptance of a deliverable. This may occur when the majority of a large deliverable, one consisting of multiple functions, meets the acceptance criteria (and approved variations) but a minority of the deliverable does not.

The contractor must assess the request for partial acceptance to determine its feasibility, since changes to the rejected portion may have an impact (unknown to the COR) on the accepted portion. The contractor must have the ability to consider the entire deliverable rejected if necessary. When the schedule for correcting the deliverable is presented to the client, the contractor must also advise whether the deliverable has been deemed rejected or partially accepted.

9.8. Tracking and Reporting. The acceptance status of all deliverables must be tracked in the acceptance log and reported in the project’s monthly status report. Acceptance of deliverables throughout the project reduces overall project risk.

The contractor must maintain a list of all deliverables in the acceptance log. This includes deliverables identified in the PWS. The contractor must update the acceptance log when the status of a deliverable changes.

As part of the normal project reporting process, the contractor must identify deliverables that:

· Are not on schedule (typically these will already be identified through analysis of the project schedule)

· Have been submitted to the client and are nearing the end of the review period or have exceeded the review period

· Have been rejected by the client but have not been corrected.

The contractor must report these exceptions as issues in the monthly status report. Deliverable acceptance must be reported as an accomplishment for the specified period.

Reporting deliverable acceptance on the status report must ensure that CTO/TO2 and contractor personnel outside of the acceptance process are aware of the status of deliverables.

The contractor must maintain all deliverable acceptance forms for the life of the project in submission date sequence.

10. Security. The work to be formed and products to be delivered under this contract must be accomplished in accordance with the Contract Security Classification Specification, DD Form 254, pertaining to this contract. The contract must conscientiously follow the security guidance provided in the DD form 254, the Classification Guide, and other guidance that may be established in writing by the Contracting Officer’s Representative (COR).

10.1. Security Clearance. This section must be considered a supplement to Block 13 of the Government provided DD 254. Contract Classification and Specification. The work to be performed under this contract is up to the Top Secret level and may require Sensitive Compartmented Information (SCI) access eligibility. All personnel entering Government facilities require security clearance at least at the SECRET level. All individuals will be U.S. citizens. The Contractor must follow the standards established in DOD 5200.2-R, DOD Personnel Security Program. All unclassified portions of such data and information must be defined as sensitive information and be protected under Public Law 100-225.

Security Clearance and Information Technology (IT) Level. The contractor must provide at least one engineer or developer with a final Top Secret security clearance and final IT-I with Sensitive Compartmented Information (SCI) access eligibility. The contractor’s project manager and the remaining contractor personnel require a full Secret security clearance and IT-II. All personnel supporting the tier II/tier III task support will have IT-I. There are two levels of personnel security requirements under this contract:

Investigation Requirements. All personnel requiring SCI, Top Secret or IT-I eligibility under this contract must undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation. The SSBI will be maintained current within 5-years and requests for Special Background Periodic Review (SBPR) will be initiated 6-months prior to the 5-year anniversary date of the previous SSBI or SBPR.

Clearances. Contract employees that are not immediately eligible for at least interim IT-1 systems access will be permitted to begin work with interim IT-II systems access at the discretion of the Government, pending eligibility for IT-1. Before being permitted to begin work under this arrangement, the individual contractor employee must be submitted by the company for an SSBI (investigation) that is reflected in the DoD JPAS database and granted interim IT-II systems access approval by DISA Personnel Security. The employee will not be granted any privileged access until interim or final IT-I systems access is granted by DISA Personnel Security. The contract company must submit the request for SSBI as soon as a job offer is tendered to an employee. Advance NAC results will be requested by the contract company to facilitate expeditious consideration for interim IT-I systems access by DISA Security. Advance NAC results or a previous DoD investigation are required for interim IT-I consideration. If the employee is not able to obtain an interim IT-I clearance within 100 days they will not be eligible for continued employment with the agency.

Adjudication for IT Access. Adjudication of investigations for granting of interim or final IT-I access will be accomplished through DISA Security. An exception to this is that individual contractor employees with an SSBI or SBPR (within a 5-year scope) that is favorably adjudicated for a Top Secret security clearance by any of the Department of Defense adjudication facilities (DISCO, DIA, ACCF, AFCAF, NAVCAF, WHSCAF) will be automatically accepted for final IT-I access.

Obtaining Clearance. The contractor is responsible for obtaining personnel security clearance. The contractor will assure that individuals assigned to this contract have completed the required actions to obtain prerequisite security clearance. The contractor will forward a Visit Authorization Letter (VAL) on all their employees to:

DISA Security Division ATTN: Programs and Oversight Branch, MP61 P.O. Box 549 Ft. Meade, MD 20755-0549

Removal of Contractor Personnel. Should the contractor decide to replace key personnel assigned to this effort whose actions conflict with the interest of the Government, regardless of prior clearance or adjudication status, the Contractor must within five days, assign other qualified personnel to fill those positions.

Regulation Compliance. Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the government facility. Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Failure to comply with security requirements can be cause for termination of employment. The Contractor must not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor must observe and comply with the security provisions in effect at the DoD facility. Identification must be worn and displayed at all times. DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

FOUO material. Contractor personnel will generate or handle documents that contain FOUO information at Government facilities. Contractor must have access to, generate, and handle classified material only at Government facilities. The contractor must comply with the provisions of the DOD Industrial Security Manual for handling classified material and producing deliverables. The contractor must comply with DISA Instruction 630-230-19. The contractor must ensure that employees assigned to this task understand and comply with the Privacy Act, Title 5 of U.S. Code, Section 552a and DoD Regulation 5400.7, DoD Freedom of Information Act Program. These directives set policy and procedures for the disclosure of records to the public and for making, handling, transmitting, and safeguarding For Official Use Only (FOUO) material. In addition, they set guidelines for collecting, safeguarding, maintaining, using, accessing, amending, and disseminating personal data kept in systems of records.

11. Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI). GFE will be furnished to the contractor as required. Government provided facilities will be available if needed (Lab space with common use SIPR and NIPR access). GFI will be provided by way of Forge.mil housed documents, trackers, code, and file releases.

12. Other Pertinent Information or Special Considerations.

12.1. Identification of Non-Disclosure Requirements. All contractor personnel must sign a Non-Disclosure Agreement (NDA) to protect all Government information to which they have access both during and after contract performance is complete. Copies of the NDAs will be provided to the COR.

12.2. Visit Authorization Letters. The Contractor will send a Visit Authorization Letter (VAL) to the COR for all employees prior to the beginning of each contract period of performance and as new contractor employees are assigned to the contract:

The VAL must be on company letterhead or pre-fabricated form and contain the following information:

Contract number with start and end dates Company point of contact (POC) and telephone number Government COR name and telephone number Complete legal name of employee(s) Social Security Number Security Clearance level, date granted, and Adjudication facility name, i.e. DISCO Type of personnel security investigation (PSI) -pending or completed Date PSI completed

13. 508 Accessibility Standards. Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are not applicable to this acquisition.

Page 1 of 20 Pages

Page 11 of 11 Pages