HC1047-14-R-4003-0002.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

1. Provide responses to the questions asked as a result of Amendment 0001 to the RFP.

2. Add FAR 52.230-7

3. Update task 6.5 and 6.6 of the PWS.

4. Update Section L, 6.1.1 to provide information for f irms that are interested in providing a proposal and might not have an approved accounting system for aw ard of a cost type contract. This information provides the guidance.

5. Provide SF 1408, PREAWARD SURVEY OF PROSPECTIVE CONTRACTOR ACCOUNTING SYSTEM as an attachment.

All terms and conditions remain unchanged and in full force and effect.

1. CONTRACT ID CODE PAGE OF PAGES

S 1 36

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 12-Feb-2014

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HC1047-14-R-4003

X 9B. DATED (SEE ITEM 11)

22-Jan-2014

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

12-Feb-2014

CODE

DEFENSE INFORMATION SYSTEMS AGENCY

6910 COOPER AVENUE

FT. MEADE MD 20755-7088

HC1047 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HC1047-14-R-4003

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been added by full text:

52.230-7 PROPOSAL DISCLOSURE--COST ACCOUNTING PRACTICE CHANGES (APR 2005)

The offeror shall check ``yes'' below if the contract award will result in a required or unilateral change in cost accounting practice, including unilateral changes requested to be desirable changes.

( ) Yes ( ) No

If the offeror checked ``Yes'' above, the offeror shall--

(1) Prepare the price proposal in response to the solicitation using the changed practice for the period of performance for which the practice will be used; and

(2) Submit a description of the changed cost accounting practice to the Contracting Officer and the Cognizant

Federal Agency Official as pricing support for the proposal.

(End of provision)

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

PWS - 23OCT2013

Forge.mil Omnibus Support

Performance Work Statement (PWS)

21 January 2014

Updated 6 February 2014

Contract Number: TBD

Task Order Number: N/A

1. Contractor Officer Representative (CORs).

1.1. Primary COR.

Name

Organization

DODAAC

Address

Phone Number

Fax Number

E-Mail Address

1.2. Alternate COR.

Name

Organization

DODAAC

Address

Phone Number

Fax Number

2. Task Order Title. Forge.mil Omnibus Support

3. Background.

The Defense Information System Agency (DISA) Forge.mil Program Management Office

(PMO) requires Software Development Life Cycle (SDLC) support. SDLC includes, but is not limited to planning, implementing, testing, documenting, deploying, and maintaining the software applications that comprise the Forge.mil service. This effort will require project management expertise as well as technical expertise in the areas of application lifecycle management systems (ALM), software engineering, DoD security architectures, security-related technologies, risk migration strategies, integration assessments into emerging IT technologies, business operations, and community management support. Detailed information concerning the requirements and task is contained in subsequent sections.

Forge.mil is a family of enterprise services using cloud computing capabilities to provide hardware and software-as-a-service infrastructure to accelerate design, development, test, deployment, and sharing of applications, program source code, and other software development artifacts (such as IA and test documentation), and to improve the reliability of software, systems, and services implemented on the Global Information Grid (GIG). Forge.mil services comprise four distinct production systems available to the Department of Defense (DoD) community, and one currently being deployed into production:

Current Systems:

www.Forge.mil: This site is the only Forge.mil site with no access restrictions. Anyone with access to NIPRNet or the internet can view www.Forge.mil. Its purpose is to educate the viewing public about the Forge.mil program and service offerings, and to provide a link for users to register for Forge.mil. Unauthorized users attempting to access the other Forge.mil services are redirected to this site.

Forge.mil Community: Social networking-like collaboration site for software developers and other DoD IT capability providers. Supports self-organizing behavior to facilitate communications and collaboration across projects. Supports technical and functional groupings and provides a rich content management capability.

SoftwareForge: A collection of tools providing a full-featured application lifecycle management system support distributed collaborative development within projects and reuse of open source and DoD community source software across the enterprise. Its intent is to promote early and continuous collaboration among developers, material providers, testers, operators, and other users throughout the software/application development life-cycle.

ProjectForge: ProjectForge provides the same capabilities as SoftwareForge, but for programs and/or projects that are not doing DoD community source development and/or need to restrict access to specific project members. While SoftwareForge comes free to all DoD affiliated users, Project Forge is a fee for service capability.

milCloud: The newest addition to the Forge.mil family of services, milCloud provides for the automated provisioning of virtual environments within a variety of cloud environments, automated system build and deployment with a limited number of integrated test tools, and automated deployment of simulator test systems. milCloud itself is a system/service independent of other Forge.mil services and will be available to Forge.mil and Forge.mil users, as well as non-Forge.mil users. Based on the CONS3RT software, milCloud interfaces with the VMWare systems in DISA Defense Enterprise Computing Centers (DECCs) and acts as the orchestration software residing above the VCloud Director, providing an ability to build “recipes” of systems that can then be executed iteratively to instantiate an entire set of systems into development, test, pre-production, and production environments.

In production, Forge.mil is deployed on approximately 10 virtual machines on the unclassified network for the www.Forge.mil, Software.Forge.mil, Project.Forge.mil, and

Community.Forge.mil applications and databases; and 5 virtual machines on the classified network for the www.Forge.mil, Software.Forge.mil, and Project.Forge.mil applications and databases; All applications run on top of Red Hat Enterprise Linux. The NIPR environment has deployed environment 10 Red Hat Enterprise Linux systems consisted of 3 PostgreSQL database servers, 1 MySQL database server, 1 Apache web server, 1 Drupal/Apache app server, 2

JBoss/Tomcat/Apache app servers, and 2 Tomcat/Apache subversion servers.

There are also automated deployments to the following environments: dev, dev-test, staging

(DISA RACE), Hanscom milCloud on DREN, and production NIPR. These occur as needed for development and testing as they would in any development project.

The SIPR environment has 5 systems deployed: 2 PostgreSQL database servers, 1 Apache web server, 1 JBoss/Tomcat/Apache app server, 1 Tomcat/Apache subversion server. All management and administration of the Forge.mil server and communications hardware and operating systems is a 24 X 7 X 365 service performed by DISA as part of hosting the systems in

DISA DECCs.

In pre-production (currently DISA’s RACE environment) a full complement of Forge.mil application stacks are deployed.

When milCloud is deployed to production, it will be hosted on approximately 11 more virtual machines on the unclassified network; it runs on top of Red Hat Enterprise Linux having a single

Windows 2008 server; and management its hardware and operating systems is a 24 X 7 X 365 service performed by DISA as part of hosting the systems in DISA DECCs.

The installation and/or maintenance updates for Forge.mil application stack in the production operational environments (unclassified and classified) occurs monthly or more frequently and is performed as an Authorized Service Interruption (ASI) in the off-hours, normally from Friday after Close Of Business (COB) until complete. Normal Forge.mil management and operations are an 8 X 5 function, however as previously stated, when outages occur designated on-call personnel may be required to work during off-hour periods to perform emergency maintenance for RTS conditions.

The Forge.mil engineering team is using automation tools such as Puppet for provisioning, configuring, and integrating the Forge.mil application stack, over the number of test environments needed to perform all required tests (e.g. integration, functional, acceptance, performance, security, load, regression) on the Forge.mil application stack prior to deployment to the operational systems. The number of environments required shall be determined jointly by the

Forge.mil PMO and the contractor. The test environments shall be maintained at the same level of rigor as the pre-production and production operating environments.

When milCloud is deployed to production, in the same manner as stated above, for the test environments needed to support milCloud. As milCloud utilizes cloud resources on the “back-end” the contractor must be able to support integration with such capabilities. For purposes of this requirement assume the cloud will be VMWARE based.

The engineering development team will jointly work with the Forge.mil PMO and milCloud development team to include the use of common open-source or COTS test tools used for web-service validation, functional, performance, code analysis, and other purposes.

The operational support and engineering team will jointly serve as the Tier 2 and Tier 3 Service

Desk function on an 8 X 5 basis, with a designated on-call administrator during off-hours. On-call administrators may be required to perform emergency maintenance for Return to Service

(RTS) conditions during off-hour periods. DISA will provide the 24 X 7 X 365 Tier 1 Service

Desk function, there for Tier 1 service desk functions are not part of this effort.

The Forge.mil program has always operated using the Agile Software Engineering methodology at a 2 week/iteration pace. Forge.mil follows agile project management and other agile concepts and incorporates them into processes and procedures. The Forge.mil team has multiple “scrum masters” and continues to incorporate Agile concepts, processes, and procedures into our program. The contractor shall be familiar with Agile Software Engineering and adopt Agile concepts, processes, and procedures in all contract areas.

4. Objectives. The overall objective of this requirement is to develop, integrate, test, sustain, and maintain the entire Forge.mil ecosystem and infrastructure, and to provide business and community management support under one consolidated effort. Work accomplished under this effort will provide Forge.mil with the ability to continue to provide services in full life-cycle activities such as integration, certification, operational support (e.g., user assistance, performance reporting, and maintenance), system upgrades, and day-to-day operations. The effort to develop, integrate, test, sustain, and maintain the entire Forge.mil ecosystem and infrastructure includes applying security patches, maintenance, provisioning, testing, and operations management (e.g., trouble ticketing, performance reporting, and service desk support). This also includes exploration and evaluation of new emergent technologies, assessment, procurement, Certification

& Accreditation (C&A) support, and system administration and support necessary to support operations, sustainment, and improvements to the Forge.mil family of services. The work needed under this requirement is to provide support services and assistance to the Forge.mil application engineering effort and the Program Management Office (PMO). The Forge.mil environments and components include, but are not limited to the development, test & integration, pre-production, and production environments of the DISA Rapid Access Computing Environments

(RACE) at Defense Enterprise Computing Center (DECC) Oklahoma and DECC Montgomery, the milCloud environments at DECCs Oklahoma and Montgomery, and the production environments at DECC Montgomery and DECC St. Louis. DECC St. Louis is a shared COOP location for Forge.mil.

The overall scope also includes full engineering life-cycle support in the areas of information assurance, community management for users and prospective users of the Forge.mil family of services, Forge.mil business office support, software development, integration, testing, certification, operational support (e.g., user assistance, performance reporting, and maintenance), system upgrades, and day-to-day operations of all environments related to Forge.mil. The life-cycle management support includes applying security patches, maintenance, provisioning, testing, and operational management (e.g., trouble ticketing, performance reporting, and service desk support).

5. Scope.

The work needed under this requirement is to provide support services and assistance to the

Forge.mil application engineering effort and the Program Management Office (PMO). The

Forge.mil environments and components include, but are not limited to; the test, integration, pre-production, and production environments of the DISA Headquarters (HQ) Lab at Ft. Meade, MD; the DISA Rapid Access Computing Environment (RACE) Test & Evaluation (T&E) environments at Defense Enterprise Computing Center (DECC) Oklahoma and the production/operational forge.mil environments at DECC Montgomery, DECC Oklahoma City

(OKC), as well as the shared COOP environments at DECC St. Louis and other DISA DECCs as necessary.

The overall scope also includes full engineering life-cycle support in the areas of information assurance, community management for users and prospective users of the Forge.mil suite of services, Forge.mil business office support, software development, integration, testing, certification, operational support (e.g., user assistance, performance reporting, and maintenance), system upgrades, and day-to-day operations of all environments related to Forge.mil. The life-cycle management support includes applying security patches, maintenance, provisioning, testing, and operational management (e.g., trouble ticketing, performance reporting, and service desk support).

6. Performance Requirements

6.1 Task 1 - Project Management & Documentation Support

The contractor shall provide project management & documentation support for the Forge.mil operating environments in support of the Forge PMO. The contractor shall perform the following activities:

Creating engineering documents as required;

Keeping all engineering documents up to date;

Ensuring the engineering team follows the Agile methodology;

Providing support to end-users by monitoring, performing triage, and responding to trouble tickets or other means of reporting;

Maintaining statistics of number of users using Forge.mil that will provide management information for user growth and will support out year budget projections;

Managing all incident reports (internal and external) to closure;

Defining and implement customer communication plans to ensure status is appropriately updated;

Define, implementing, and monitoring that means to measure customer satisfaction;

Participating in the planning and delivery of community webinars;

Creating and maintaining user stories that involve the purpose of monitoring a task in

Forge.mil;

Maintaining configuration control and management of the operating environments in accordance with the policies laid out in the DISA Small Project Documents;

Providing Subject Matter Experts (SME) on Forge.mil engineering, IA, Integration and

Testing, and Operations matters from both technical and functional perspectives, and supporting stakeholders;

Preparing, as requested, customer outreach briefs, plans, Forge.mil software demos, and other documentation supporting the Forge.mil’s mission;

Providing Monthly Status Reports (MSR) to Forge.mil management that includes accomplishment, progress, plans for next month, issues/concerns, and financial status

(current work plan, work breakdown structure, burn rate);

Ensuring all teams formed in this requirement provide guidance/recommendations to the

PMO, CMT and CCB that can adversely impact schedule or performance;

Leading the Forge.mil daily standup (DSU) calls (currently held at 9:00 AM eastern but subject to change), as well as being an active participant;

Leading the bi-weekly iteration Planning and User Acceptance Test (UAT) meetings

(using both Defense Connect Online and conference calling) normally held on alternating

Fridays following the DSU as well as being an active participant;

Leading the bi-weekly iteration kickoff meetings normally held on alternating Mondays following the DSU as well as being an active participant; and

Performing monthly program reviews describing the contract activities performed, providing an updated schedule of activities, and briefing the MSR.

Coordinating and leading the quarterly Release Planning meetings held either in a physical location or virtually via DCO and conference call, as well as being an active participant and documenting the meeting.

Provide support and assist with reducing program costs of design, development, test, deployment, and certification through automation, centralization, and virtualization of hardware and services;

Deliverables: Kick Off Meeting

Project Management Plans

Prepare and maintain a master Plan of Actions and Milestones

(POA&M) for TestForge.mil test and operations and activities.

In Process Reviews (IPR)

Briefs, plans, demos, and other documentation supporting the

Forge.mil project office.

Monthly Status Report (MSR)

Daily Stand-up

QPR/IPR Iteration Plan Slide

Iteration Planning Meeting notes

Configuration Control Board Meeting notes

6.2 Task 2 - Certification & Accreditation Support

The contractor shall provide certification and accreditation by means of IA support over the

Forge.mil environments in support of the Forge PMO. The activities in this task involve access to sensitive information. A Top Secret security clearance is required when performance starts.

The contractor shall perform the following activities:

Assure the security posture of the Forge.mil family of services;

Maintain and track status of Information Assurance Vulnerability Assessment (IAVA) or other open findings in Operating System (OS) and application level of components;

prepare and submit Plan Of Action & Milestone (POA&Ms) as required and manage open findings to closure;

Work with Forge stakeholders to apply and maintain the necessary IA posture of

Forge.mil environments as specified by DoD policy, security checklists, Security

Readiness Reviews (SRRs), and Security Technical Implementation Guides (STIGS);

Ensure current and new Forge components meet the DoD IA criteria and requirements for performance and dependability;

Support Forge.mil services in maintaining a security risk assessment throughout the performance of this requirement;

Support the DoD Certification and Accreditation process as described in DIACAP or any replacement process (such as the risk management framework) and be responsible for reporting, tracking, and correcting services based on US CYBERCOMMAND

Communication Tasking Orders (CTOs) and IAVA advisories using DoD standard tools, including the Vulnerability Management System (VMS) and other relevant IA information systems are up-to-date;

Support the DoD Certification and Accreditation process as described in DIACAP or any replacement process (such as the risk management framework) and be responsible for ensuring required IA artifacts are present in eMASS and any other data stores associated with IA; Support the maintenance and revision of documentation needed for the C&A process;

Provide knowledge and expertise in the following areas: Service-Oriented Architecture

(SOA) and net-centric design; software design and development; database management;

network design and management; web application architectures; hardware configuration and installation; systems integration; testing; DoD DIACAP or any replacement process

(such as the risk management framework) certification; and technology integration; and

Provide support to enable cross-component collaboration and integration using an open computing model to support system development and certification and accreditation;

Deliverables: IA & CA Tracking Report

IAVA Review Report

VMS Tracking & eMASS update

Generate and maintain C&A documentation

6.3 Task 3 – Software integration, test and validation support

The contractor shall support the Forge’s engineering team in providing software integration, test and validation support of the Forge.mil environments in addition to supporting Forge PMO and team members. The activities in this task involve access to DISA DECC hosted systems. A Top

Secret security clearance and IT-I (privileged level systems access) are required when performance starts. The contractor shall perform the following activities:

Provide support to the program’s software development, integration and test, production deployment, operations, and certification processes throughout the Software

Development Life Cycle (SDLC);

Provide support and assistance with the continued development and fielding of all automation that provides provisioning, test, and deployment of the Forge.mil services;

Work with all other Forge.mil groups to successfully develop, build, test, and deploy the

Forge.mil services into the various production environments on a daily, weekly, or monthly basis (currently Forge.mil deploys to production on a monthly basis, and the

Forge.mil teams are modifying deployment processes to increase the frequency of production deployments);

Provide an independent verification and validation view-point on the Forge application system’s functionality, performance, and security, and the Forge continuous integration and delivery platform’s functionality and integrity of function;

Define, implement, and maintain test plans and procedures for testing and validating critical systems components;

Define test and implementation test-cases for inclusion during integration and pre-deployment test cycles necessary to validate existing automated test processes;

Maximize utilization of software engineering test cases by auditing the development process and independently confirming their applicability for reuse;

Monitor test artifacts produced within the Forge continuous integration environment, recommending improvements and/or identifying gaps in test cases;

Provide troubleshooting support to the engineering teams specific to the testing of components in the Forge.mil environments;

Work with Forge stakeholders to resolve site specific issues concerning installation, configuration, network connectivity, and Information Assurance items related to the operating environments;

Test the viability of various applications and pilot them in test environments in support of future Forge.mil components and capabilities;

Work with Forge stakeholders to enhance and increase the capabilities in the Forge development and test environments to support a more robust virtualized and automated architecture;

Execute performance tests, functional tests, and security scans prior to major deployment to the production environment(s);

Implement, in concert with Forge.mil Engineering, automation necessary to (i) continuously monitor and report on the state of the application pre-production and production environments; (ii) deploy OS and/or application level updates ‘on demand;’

(iii) establish system baseline at a known revision level, (iv) work harmoniously with the

Forge continuous integration environment;

Establish and maintain the Forge.mil product lines’ Configuration Management (CM)

Control Items (CI) and baselines;

Provide support in the automation of Forge.mil components across project partners to promote the utilization of continuous integration and deployment;

Ensure a seamless integration between collaborative development components and other components or systems that may be provided by partner organizations of DISA in the

Forge software; and

Install, manage, and operate the Forge.mil application stack residing on the development, test, pre-production and production operating environments.

Forge.mil utilizes an Agile Development methodology. Historically iterations span a 2 week period of time with small increments of new functionality (to include bug-fixes, IA updates, etc.) with a once per month update and deployment to production. Documentation for the iteration will be maintained in the Forge application’s wikis and trackers by the responsible parties for the function (development, test, release, etc.).

Deliverables: User Artifacts, Technical Reports, use cases, source codes, software scripts, and user support documentations, IA support documentations, environment

System Architecture

Iteration Test Plan

Iteration Test Report

Site specific issues/incident After Action Report

Monthly Drop Readiness Assessment

Reports to IAM

6.4 Task 4 – Operations Support

The contractor shall provide operations support to ensure the quality and dependability of the

Forge.mil infrastructure in support of the Forge PMO. The activities in this task involve access to

DISA DECC data systems. A Top Secret security clearance and IT-I (privileged level systems access) are required when performance starts. The contractor shall perform the following activities:

All operations and maintenance of current pre-production (development, test, and preproduction staging environments such as RACE) and production systems in unclassified and classified environments;

Implement and maintain the configuration management system;

Apply application level updates to any affected system (monthly maintenance);

Monitor production systems – remediate run-time issues, assure security posture of production system;

Define, maintain, and implement operational processes germane to the application system and relevant environments;

Provide support to assist those programs and projects relying on Forge.mil services to integrate Forge.mil into their native IT processes and existing tools;

Provide operational support to Commercial Of The Shelf (COTS) vendors in support of isolating or determining reported problems;

Provide guidance/recommendations to the Forge.mil PMO, Community Management

Team (CMT) and Configuration Control Board (CCB) on readiness to deploy changes to production that can impact schedule or performance;

Serve as both as a CCB member and CCB Secretariat roles; and

Perform as a Forge stakeholder with engineering design, development, and integration for the Forge.mil environments.

Provide all applications administration and management support for the operations of the production Forge.mil services hosted on NIPRNet including http://www.Forge.mil, https://community.Forge.mil, https://software.Forge.mil, and https://project.Forge.mil, milCloud services, as well as other Forge.mil services developed for deployment and hosting on NIPRNet as they become available; and

Provide all applications administration and management support for the operations of

Forge.mil services hosted on SIPRNet including software.forge.smil.mil and other

Forge.mil services developed for deployment and hosted on SIPRNet as they become available, as well as milCloud services and other Forge.mil services developed for deployment and hosting on NIPRNet as they become available.

Deliverables: POA&M Technology products enhancement

Support the development, implementation, and maintenance of integrated product

Documented Forge.mil production system configuration baseline hardware and software

6.5 Task 5 – Software Development for the Collaboration and Community product line

The contractor shall support the engineering task to develop and deliver the Forge.mil family of services, the systems that enable the Forge.mil Collaborative Development Environment. This task provides an open, Service Oriented Architecture (SOA) based collaboration platform based on CollabNet software to support the Forge.mil community and the development of open source and community source software within the DoD. The Forge.mil family of services is operated in

DoD computing centers and must meet all DoD IA requirements. The activities in this task involve access to DECC hosted systems. The contractor shall perform the following activities:

Providing additional capabilities to the Collaborative Development Environment’s core platform. This additional capability shall include SubVersion, CollabNet Team Forge

Enterprise, and Cubit services as enabled by the existing CollabNet software;

Design and develop new features and enhance existing features of Forge.mil Family of

Services, with a particular focus on features requiring expertise in security;

Evaluate the current Forge.mil code and develop technical solutions to help mitigate any security vulnerabilities.

Providing software development, engineering solutions and support for Community

Forge using open source and community source software;

Providing software development, engineering solutions and support for the Forge.mil public interface website (www.Forge.mil) using open source and community source;

Providing development, engineering solutions and support for the Forge.mil Single Sign-on (SSO) authentication and authorization for all Forge.mil environments using the open source and COTS solutions;

Providing additional engineering support in response to this increase capability and new feature enhancement requests. The contractor shall help to define road map, design, and implement new enhancement features and capacity to support the project new demand and growth in both quality and quantity;

Delivering the Forge.mil Collaborative Development Environment to support distributed development of open source and community source software within the DoD network environment (i.e., NIPRNet and SIPRNet);

Providing open interfaces and product extensions to enable integration with other commercial and government tools that support the software development process. The

Forge.mil Developer Network will make use of CollabNet’s open and pluggable SOA

Based integration framework to connect these federated user tool environments into the

DECC hosted CollabNet infrastructure; and

As part of the planning and ramp up of the Forge.mil Developer Network, the contractor shall work with the community to identify and build integrations to commonly used software development lifecycle tools and environments into the DECC hosted infrastructure.

Provide guidance to the government and be aware of any IA issues as a result of ST&E and scanning that could impact related DIACAP packages; as necessary, assist the IAMs execute the DIP and implement IA controls on Forge.mil, compile the results and any

POA&M’s into the DIACAP Scorecard, and review the DIACAP package.

Communicate security risks and mitigations to the government IAMs, FSO, and DAAs during reviews and validation of DIACAP deliverables and artifacts related to the IA security posture.

Support the government with design and integration of Forge.mil services and customer outreach.

The contractor shall be required to maintain and provide upgrades to the existing Forge.mil ecosystem. This includes providing open interfaces and product extensions to enable integration with other commercial and government tools that support the software development process.

Deliverables: Assess engineering solution for IA security posture

Documented Quarterly release plan

Documented iteration release plan

COTS required list with expected costs

COTS required products for deployment

6.6 Task 6 – Community Management Support

The contractor shall support the creation and growth of a collaborative community of stakeholders who both benefit from and contribute to the Forge.mil Collaborative Development

Environment. Working in tandem with DISA, the contractor shall ensure that activities such as governance, public relations and outreach, community recruitment, training and support, and ongoing process development will take place in an institutionalized fashion and contribute to the successful adoption of, satisfaction with, and overall growth of Forge.mil:

Support services necessary to on-ramp new customers and partners in the Forge.mil collaborative environment, ensure stakeholder alignment, establish success metrics, and develop a community governance approach to maintaining and evolving the Forge.mil community;

Develop a site content strategy and go-to-market strategy that aligns with the DISA and

Forge.mil stakeholder objectives and support the Forge.mil family of services;

Ensure the brand integration of all Forge.mil services;

Host Webinars and other presentation sessions as needed to inform the community about new capabilities in the Forge.mil family of services;

Provide user training and partner training to ensure successful recruitment and retention of community membership, and facilitate real-time feedback to help evolve and maintain the Forge.mil capability;

Take part in the weekly Community Management Team meeting;

Provide support to maintain the integrity and operational availability of the Forge.mil operating environments in support of the Forge.mil program office and the end users; and

Work with current and prospective users of the Forge.mil family of services to improve

DoD community adoption, user satisfaction, and overall utilization.

Provide requirements and concept development, and COTS analysis and selection.

Provide a Community Support Plan that is a tailored plan for communicating to Forge stakeholders about Forge.mil. Plan includes, but is not limited to governance, public relations outreach, community recruitment, training and support, ongoing process development, key messages, and communications to Forge.mil stakeholders.

Deliverables:

Community Support plan

Training & Webinar briefing slides

6.7 Task 7 – Business Operation Support

The contractor shall provide support to Forge.mil project coordinators in the planning, operations, and outreach activities necessary to the program. Specific tasks include:

Maintaining and executing the community support processes;

Maintaining and supporting the execution of the Forge.mil communications plan;

o Write technical articles topics such as open source software development, Forge.mil capabilities and features, o Ensure the technical accuracy of Forge.mil’s web presence on the Forge.mil web sites as well as community outreach sites such as Wikipedia, Intellipedia, and DoDTechipedia, o Prepare and make presentations on behalf of the Forge program to cloud computing initiatives and other technical focus areas as identified, and

Supporting the user community for the Forge.mil family of services;

o Inform new projects on the Forge.mil capabilities, o Help on-board new projects into Forge.mil’s CollabNet SourceForge

Enterprise (CSFE) tool and Subversion repository, o Perform as a site administrator of Forge.mil’s CSFE tool and support

Forge.mil Tier 1 and Tier 2 support processes, o Develop memoranda and support agreements to institutionalize partnerships and clarify relationships and expectations, o Make maximum use of online resources (e.g. wikis, portals, hosted collaboration tools) to increase the rate of knowledge sharing within communities and strengthen DISA technical partnerships, and o Ensure Forge.mil community growth and evolution through education and outreach.

The contractor shall provide support at various conferences where Forge.mil is required to provide booths and demonstrations to the conference attendees. The contractor shall provide conference items as part of the conference, which shall be governed, and guidance provided by

COR or Alt COR. The contractor shall support Forge.mil conference requirements by providing additional space at customer conferences, rental or purchase of electrical equipment, storage units, media furniture, and marketing accessories. As required by the COR.

All purchases of products or support shall require advanced written approval by the COR or ALT

COR prior to the contractor purchasing the products or support.

Deliverables:

Business support plan

7. Performance Standards.

Performance Standard Acceptable Quality Level

(AQL)

Method of Surveillance

Task 6.1 – Briefing material will be delivered on time and in accordance with (IAW)

Government

COR/AltCOR guidance

Performance occurs with no required re-performance or re-work at least 95% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Routine inspection of deliverable products and services.

Task 6.1 – Provide meeting administrative support Meeting agendas, support packages, guidance packages, trip reports, records of technical discussions, and other products are (1) correctly formatted, complete, and effectively address all subject areas, and (2) delivered IAW approved Program Plan schedule.

Performance Standards are met 95% of the time Routine inspection of the materials

Routine inspection of deliverable products and services.

Task 6.2- Identify and provide recommendations to address issues.

Performance occurs with no required re-performance or re-work at least 95% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Routine inspection of deliverable products and services.

Task 6.2 – Provide certification and accreditation by means of IA for critical management, technical, resource, and security

Performance Standards are met for DIACAP or any replacement process (such as the risk management framework) Process 100% of the time.

Routine inspection of the materials issues.

Task 6.3- Providing support to the Forge.mil environment’s software development, integration and test, production deployment, operations, and certification processes throughout the Software

Development Life

Cycle (SDLC).

Performance occurs with no required re-performance or re-work at least 95% of the time. Problems that occur are minor and are resolved in a satisfactory manner

Routine inspection of deliverable products and services.

Task 6.4 - Provide operations support to ensure the quality and dependability of the

Forge.mil infrastructure and provide uninterrupted System

Access during maintenance activities and upgrades.

100% of scheduled maintenance activities, upgrades, etc. which involve loss of system access must be coordinated with the government at least 7 calendar days before scheduled downtime and must take place only during non-critical periods. The contractor will not be penalized for circumstances outside of his control that lead to downtime or loss of connectivity.

Routine inspection of the materials.

Task 6.6 - Support the creation and growth of a collaborative community of stakeholders for the

Forge.mil Collaborative

Development

Environment

Performance occurs with support services necessary to on-ramp new customers and partners in the Forge.mil collaborative environment, ensure stakeholder alignment, establish success metrics, and develop a community governance approach to maintaining and evolving the

Forge.mil community at least

95% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Routine inspection of deliverable products and services.

Task 6.7 - Provide support to Forge.mil project coordinators in

Performance Standards are met 100% of the time.

Routine inspection of the materials the planning, operations, and outreach activities.

8. INCENTIVES. Both positive and negative performance will be documented in past performance reports/databases, as appropriate. Meeting or exceeding the Acceptable Quality

Level is considered positive performance. Failure to meet the AQL is considered negative performance.

9. PLACE OF PERFORMANCE.

Work for Tasks 2, 4, and 7 will be performed at DISA headquarters (Fort Meade, MD). Work for Tasks 1, 3, 5, and 6 shall be at the Contractor's facility or designated alternate location. The contractor shall be required to travel to support Forge.mil within CONUS. The government estimates a total of 10 trips with 4 people for 5 days for planning purposes. For estimating purposes, it is anticipated that travel may be necessary from place of performance to DISA HQ, DISA DECCs Montgomery and Oklahoma. The SCIF portion of Task 3 to be performed at

DISA Headquarters (Fort Meade, MD) with the remainder of Task 3 performed at the

Contractor's facility or designated alternate location.

All travel shall be pre-approved by the COR/ALT COR in writing. Specific travel requirements shall be coordinated with the COR/ALT COR and shall be in accordance with the Federal

Acquisition Regulation (FAR) Subpart 31.205-46 requirements and limitations. Reimbursement for travel expenses shall be made in accordance with the Federal Travel Regulations.

Alternate Place of Performance - Contingency Only. Contractor employees may be required to work telework, work at another approved activity within the local travel area, or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. COR/ALT COR approval is required. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources.

10. PERIOD OF PERFORMANCE.

The period of performance is for one year from contract award with four (4) one year option periods.

11. Delivery Schedule.

SOW

Task#

Deliverable Title Format Due Date Distribution Frequency and

Remarks

6.1 Kick Off Meeting N/A 10 calendar days

after award

*Standard

Distribution

10 days after award

6.1 Project

Management Plans

Government format

30 calendar days after contract award

*Standard

Distribution

Quarterly

6.1 Prepare and

maintain a master

Government format

10 days after each major

*Standard

Distribution

Estimated

Quarterly -

Plan of Actions and

Milestones

(POA&M) for

TestForge.mil test and operations and activities.

release of

Forge.mil

Minimum of 4

– Master

POA&M and

3 revisions

6.1 In Process Reviews

(IPR)

Government format

Every 90 days after first quarterly IPR

*Standard

Distribution

Quarterly

6.1 Briefs, plans, demos, and other

documentation supporting the

Forge.mil project office.

Government format

10 days before due date

*Standard

Distribution

Estimate a minimum of 15 and a maximum of

6.1 Monthly Status

Report (MSR)

Government format

30 calendar days *Standard

Distribution

Monthly on the th day of the month.

6.1 Daily Stand-up Government

format

Each business day

Deputy PM, Business

Office

Daily

6.1 QPR/IPR Iteration

Plan Slide

Government format

Each

Wednesday after contract award

*Standard

Distribution

Weekly

6.1 Iteration Planning

Meeting notes

Government format

Bi-weekly after contract award

*Standard

Distribution

Bi-weekly

6.1 Configuration

Control Board

Meeting notes

Government format

Bi-weekly after contract award

*Standard

Distribution

Bi-weekly

6.1 Release Planning

Meeting notes

Government format

Quarterly after contract award

*Standard

Distribution

Quarterly

6.2 IA & CA Tracking

Report

Government format

2 Days before

Iteration Kick-off

*Standard

Distribution

Bi-weekly

6.2 IAVA Review

Report

Government format

Day of release *Standard

Distribution

Weekly

6.2 VMS Tracking &

eMASS update

Government format

Day of release *Standard

Distribution

Weekly

6.2 Generate and

maintain C&A documentation

Government format

As needed *Standard

Distribution

Monthly

6.3 User Artifacts, Technical Reports, use cases, source

codes, software scripts, user support documentations, IA support documentations, environment

System

Architecture

Government format

10 days after award for Kick-off, Bi-Weekly iteration planning, and

User Acceptance

Test

*Standard

10 days after award for

Kick-off and bi-weekly thereafter

6.3 Iteration Test Plan Government

2 Days after

Iteration Kick-off

*Standard

Distribution

Bi-Weekly

6.3 Iteration Test

Report

Government format

Day of User

Acceptance Test

*Standard

Distribution

Bi-Weekly

6.3 Site specific

issues/incident

After Action

Report

Government format

2 days after incident

*Standard

Distribution

Based on incidents – historically minimum of 20 and maximum of 60 *

6.3 Monthly Drop

Readiness

Assessment

Government format

2 days before monthly drop

*Standard

Distribution

Monthly

6.3 Reports to IAM Government

format

Before and After incident releases

*Standard

Distribution

*Based on the number of Site

Specific

Issue/Incident

After Action

Reports

6.4 POA&M

Technology products enhancement

Government format

90 days after award.

Quarterly thereafter

*Standard

Distribution

Quarterly

6.4 Support the

development, implementation, and maintenance of integrated product

Government format

Bi-weekly after contract award

Bi-weekly

6.4

Documented

Forge.mil production system

60 calendar days after contract award

*Standard

Distribution

Initial: 60 calendar days award configuration baseline hardware and software

Updated two days after changes occur

Final: updates two days after changes occur

6.5 Assess engineering

solution for IA security posture

Government format

Day of security incident release

Weekly

6.5

Quarterly release plan

Government format

Initial - 90 days after contract award

*Standard

Distribution

Initial – 90 days after award

Updates

Quarterly

6.5 iteration release plan

Bi-weekly after contract award

*Standard

Distribution

Bi-weekly after contract award

6.5 COTS required list

with expected costs

Contractor determined

Initial - 90 days

Initial – 90 days after award

Updates -

Monthly

6.5 COTS required

products for deployment

Contractor determined format

Initial - 90 days

Initial – 90 days after award

Updates -

Monthly

6.6 Community

Support plan

Government format

Initial - 15 days

Initial – 15 days after award

Updates -

Monthly

6.6 Training &

Webinar briefing slides

Government format

10 days prior training/webinar date

*Standard

Distribution

Minimum of

12, maximum of 24

6.7 Business support

plan

Government format

Initial – 15 days

Initial – 15 days after award

Updates

Monthly– 30 days after requested

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting

Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR ,Alternate COR and Deputy PM.

12. Security Requirements: This section shall be considered a supplement to block 13 of the

Government provided DD 254, Contract Classification Specification. The following security requirements shall apply to this effort.

12.1 Facility Security Clearance. The work to be performed under this contract is up to the

Top Secret level and may require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore the company shall have a final Top Secret Facility Clearance

(FCL) from the Defense Security Service (DSS) Facility Clearance Branch (FCB).

12.2 Security Clearance and Information Technology (IT) Level. All personnel performing on this contract will be U.S. citizens. There are two levels of personnel security requirements under this contract covering 8 types of tasks:

12.2.1 The following positions require a Top Secret security clearance and IT-I (privileged level systems access) eligibility when performance starts. The incumbents will require Sensitive

Compartmented Information (SCI) access eligibility adjudicated by the Defense Intelligence

Agency (DIA) to perform their duties. SCI Processing for SCI eligibility will be coordinated with the supporting…