HC1047-14-R-4003_RFP.pdf

DISA/PL61

P.O. BOX 549

FORT MEADE MD 20755

UNDER DPAS (15 CFR 700)

11. DELIVERY FOR FOB

RFQ

SEE SCHEDULE

14. METHOD OF SOLICITATION

IFB RFP

CODE

SEE ADDENDUM

BLOCK IS MARKED

DESTINATION UNLESS

12. DISCOUNT TERMS

(No Collect Calls)

$25.5

13b. RATING

13a. THIS CONTRACT IS A RATED ORDER

X

CODE

HC1047-14-R-4003 22-Jan-2014

b. TELEPHONE NUMBER

301-225-4060

8. OFFER DUE DATE/LOCAL TIME

11:00 AM 24 Feb 2014

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV 3/2005)

Prescribed by GSA

FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER) 31c. DATE SIGNED

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

22. UNIT 23. UNIT PRICE 24. AMOUNT21. QUANTITY

CODE 10. THIS ACQUISITION IS

UNRESTRICTED

FAX:

NAICS:

TEL:

CODE 18a. PAYMENT WILL BE MADE BYOFFEROR

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TEL.

HC1047

SIZE STD:

9. ISSUED BY

FACILITY

CODE

17a.CONTRACTOR/

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

15. DELIVER TO CODE HC1047 16. ADMINISTERED BY

DISA/NE_B5

HUNG TRUONG

6910 COOPER AVE

FT. MEADE MD 20755

TEL: (301) 225-9409 FAX:

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

JONELLE WALTERS

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES

SEE SCHEDULE

541511

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS

SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

SB

HUBZONE SB

SET ASIDE: 100 % FOR

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

TEL: EMAIL:

COPIES

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

.OFFER DATED YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

8(A)

SVC-DISABLED VET-OWNED SB

EMERGING SB

X

X

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

SEE SCHEDULE

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES 21. QUANTITY 22. UNIT 24. AMOUNT

PAGE 2 OF

23. UNIT PRICE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV 3/2005) BACK

Prescribed by GSA

FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

HC1047-14-R-4003

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 Months Project Mgmt & Documentation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 1 and all subtask.

FOB: Destination

NET AMT

0002 Months Certification & Accreditation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 2 and all subtask.

0003 Cost Software Integration

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 3 and all subtask.

ESTIMATED COST

FIXED FEE

TOTAL EST COST + FEE

0004 Months Operations Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 4 and all subtask.

0005 Cost Software Development

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 5 and all subtask.

0006 Months Community Management Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 6 and all subtask.

0007 Months Business Ops Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 7.

0008 Cost Travel

COST

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Tasks

1001 Months OPTION Project Mgmt & Documentation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

1002 Months OPTION Certification & Accreditation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

1003 Cost OPTION Software Integration

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

1004 Months OPTION Operations Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

1005 Cost OPTION Software Development

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

1006 Months OPTION Community Management Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

1007 Cost OPTION Business Ops Support

COST

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Task 7

1008 Cost OPTION Travel

COST

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support PWS Tasks

2001 Months OPTION Project Mgmt & Documentation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2002 Months OPTION Certification & Accreditation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2003 Cost OPTION Software Integration

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2004 Months OPTION Operations Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2005 Cost OPTION Software Development

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2006 Months OPTION Community Management Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2007 Months OPTION Business Ops Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

2008 Cost OPTION Travel

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3001 Months OPTION Project Mgmt & Documentation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3002 Months OPTION Certification & Accreditation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3003 Cost OPTION Software Integration

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3004 Months OPTION Operations Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3005 Cost OPTION Software Development

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3006 Months OPTION Community Management Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3007 Months OPTION Business Ops Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

3008 Cost OPTION Travel

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4001 Months OPTION Project Mgmt & Documentation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4002 Months OPTION Certification & Accreditation Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4003 Cost OPTION Software Integration

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4004 Months OPTION Operations Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4005 Cost OPTION Software Development

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4006 Months OPTION Community Management Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4007 Months OPTION Business Ops Support

FFP

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

4008 Cost OPTION Travel

CPFF

IAW PWS dated 21 Jan 14, provide the necessary personnel needed to support

Forge.mil Omnibus Support Performance Work Statement (PWS)

21 January 2014

Contract Number: TBD

Task Order Number: N/A

1. Contractor Officer Representative (CORs).

1.1. Primary COR.

Name

Organization

DODAAC

Address

Phone Number

Fax Number

E-Mail Address

1.2. Alternate COR.

Name

Organization

DODAAC

Address

Phone Number

Fax Number

2. Task Order Title. Forge.mil Omnibus Support

3. Background.

The Defense Information System Agency (DISA) Forge.mil Program Management Office (PMO) requires Software Development Life Cycle (SDLC) support. SDLC includes, but is not limited to planning, implementing, testing, documenting, deploying, and maintaining the software applications that comprise the Forge.mil service. This effort will require project management expertise as well as technical expertise in the areas of application lifecycle management systems (ALM), software engineering, DoD security architectures, security-related technologies, risk migration strategies, integration assessments into emerging IT technologies, business operations, and community management support. Detailed information concerning the requirements and task is contained in subsequent sections.

Forge.mil is a family of enterprise services using cloud computing capabilities to provide hardware and software-as-a-service infrastructure to accelerate design, development, test, deployment, and sharing of applications, program source code, and other software development artifacts (such as IA and test documentation), and to improve the reliability of software, systems, and services implemented on the Global Information Grid (GIG). Forge.mil services comprise four distinct production systems available to the Department of Defense (DoD) community, and one currently being deployed into production:

Current Systems:

• www.Forge.mil: This site is the only Forge.mil site with no access restrictions. Anyone with access to NIPRNet or the internet can view www.Forge.mil. Its purpose is to educate the viewing public about the Forge.mil program and service offerings, and to provide a link for users to register for Forge.mil. Unauthorized users attempting to access the other Forge.mil services are redirected to this site.

• Forge.mil Community: Social networking-like collaboration site for software developers and other DoD IT capability providers. Supports self-organizing behavior to facilitate communications and collaboration across projects. Supports technical and functional groupings and provides a rich content management capability.

• SoftwareForge: A collection of tools providing a full-featured application lifecycle management system support distributed, collaborative development within projects and reuse of open source and DoD community source software across the enterprise. Its intent is to promote early and continuous collaboration among developers, material providers, testers, operators, and other users throughout the software/application development life-cycle.

• ProjectForge: ProjectForge provides the same capabilities as SoftwareForge, but for programs and/or projects that are not doing DoD community source development and/or need to restrict access to specific project members. While SoftwareForge comes free to all DoD affiliated users, Project Forge is a fee for service capability.

• milCloud: The newest addition to the Forge.mil family of services, milCloud provides for the automated provisioning of virtual environments within a variety of cloud environments, automated system build and deployment with a limited number of integrated test tools, and automated deployment of simulator test systems. milCloud itself is a system/service independent of other Forge.mil services and will be available to Forge.mil and Forge.mil users, as well as non-Forge.mil users. Based on the CONS3RT software, milCloud interfaces with the VMWare systems in DISA Defense Enterprise Computing Centers (DECCs) and acts as the orchestration software residing above the VCloud Director, providing an ability to build “recipes” of systems that can then be executed iteratively to instantiate an entire set of systems into development, test, pre-production, and production environments.

In production, Forge.mil is deployed on approximately 10 virtual machines on the unclassified network for the www.Forge.mil, Software.Forge.mil, Project.Forge.mil, and Community.Forge.mil applications and databases; and 5 virtual machines on the classified network for the www.Forge.mil, Software.Forge.mil, and Project.Forge.mil applications and databases; All applications run on top of Red Hat Enterprise Linux. All management and administration of the Forge.mil server and communications hardware and operating systems is a 24 X 7 X 365 service performed by DISA as part of hosting the systems in DISA DECCs.

In pre-production (currently DISA’s RACE environment) a full complement of Forge.mil application stacks are deployed.

When milCloud is deployed to production, it will be hosted on approximately 11 more virtual machines on the unclassified network; it runs on top of Red Hat Enterprise Linux having a single Windows 2008 server; and management its hardware and operating systems is a 24 X 7 X 365 service performed by DISA as part of hosting the systems in DISA DECCs.

The installation and/or maintenance updates for Forge.mil application stack in the production operational environments (unclassified and classified) occurs monthly or more frequently and is performed as an

Authorized Service Interruption (ASI) in the off-hours, normally from Friday after Close Of Business (COB) until complete. Normal Forge.mil management and operations are an 8 X 5 function, however as previously stated, when outages occur designated on-call personnel may be required to work during off-hour periods to perform emergency maintenance for RTS conditions.

The Forge.mil engineering team is using automation tools such as Puppet for provisioning, configuring, and integrating the Forge.mil application stack, over the number of test environments needed to perform all required tests (e.g. integration, functional, acceptance, performance, security, load, regression) on the Forge.mil application stack prior to deployment to the operational systems. The number of environments required shall be determined jointly by the Forge.mil PMO and the contractor. The test environments shall be maintained at the same level of rigor as the pre-production and production operating environments.

When milCloud is deployed to production, in the same manner as stated above, for the test environments needed to support milCloud. As milCloud utilizes cloud resources on the “back-end” the contractor must be able to support integration with such capabilities. For purposes of this requirement assume the cloud will be VMWARE based.

The engineering development team will jointly work with the Forge.mil PMO and milCloud development team to include the use of common open-source or COTS test tools used for web-service validation, functional, performance, code analysis, and other purposes.

The operational support and engineering team will jointly serve as the Tier 2 and Tier 3 Service Desk function on an 8 X 5 basis, with a designated on-call administrator during off-hours. On-call administrators may be required to perform emergency maintenance for Return To Service (RTS) conditions during off-hour periods. DISA will provide the 24 X 7 X 365 Tier 1 Service Desk function, there for Tier 1 service desk functions are not part of this effort.

The Forge.mil program has always operated using the Agile Software Engineering methodology at a 2 week/iteration pace. Forge.mil follows agile project management and other agile concepts and incorporates them into processes and procedures. The Forge.mil team has multiple “scrum masters” and continues to incorporate Agile concepts, processes, and procedures into our program. The contractor shall be familiar with Agile Software Engineering and adopt Agile concepts, processes, and procedures in all contract areas.

4. Objectives. The overall objective of this requirement is to develop, integrate, test, sustain, and maintain the entire Forge.mil ecosystem and infrastructure, and to provide business and community management support under one consolidated effort. Work accomplished under this effort will provide Forge.mil with the ability to continue to provide services in full life-cycle activities such as integration, certification, operational support (e.g., user assistance, performance reporting, and maintenance), system upgrades, and day-to-day operations. The effort to develop, integrate, test, sustain, and maintain the entire Forge.mil ecosystem and infrastructure includes applying security patches, maintenance, provisioning, testing, and operations management (e.g., trouble ticketing, performance reporting, and service desk support). This also includes exploration and evaluation of new emergent technologies, assessment, procurement, Certification & Accreditation (C&A) support, and system administration and support necessary to support operations, sustainment, and improvements to the Forge.mil family of services. The work needed under this requirement is to provide support services and assistance to the Forge.mil application engineering effort and the Program Management Office (PMO). The Forge.mil environments and components include, but are not limited to the development, test & integration, pre-production, and production environments of the DISA Rapid Access Computing Environments (RACE) at Defense Enterprise Computing Center (DECC) Oklahoma and DECC Montgomery, the milCloud environments at DECCs Oklahoma and Montgomery, and the production environments at DECC Montgomery and DECC St. Louis. DECC St. Louis is a shared COOP location for Forge.mil.

The overall scope also includes full engineering life-cycle support in the areas of information assurance, community management for users and prospective users of the Forge.mil family of services, Forge.mil business office support, software development, integration, testing, certification, operational support (e.g., user assistance, performance reporting, and maintenance), system upgrades, and day-to-day operations of all environments related to Forge.mil. The life-cycle management support includes applying security patches, maintenance, provisioning, testing, and operational management (e.g., trouble ticketing, performance reporting, and service desk support).

5. Scope.

The work needed under this requirement is to provide support services and assistance to the Forge.mil application engineering effort and the Program Management Office (PMO). The Forge.mil environments and components include, but are not limited to; the test, integration, pre-production, and production environments of the DISA Headquarters (HQ) Lab at Ft. Meade, MD; the DISA Rapid Access Computing Environment (RACE) Test & Evaluation (T&E) environments at Defense Enterprise Computing Center (DECC) Oklahoma and the production/operational forge.mil environments at DECC Montgomery, DECC Oklahoma City (OKC), as well as the shared COOP environments at DECC St.

Louis and other DISA DECCs as necessary.

The overall scope also includes full engineering life-cycle support in the areas of information assurance, community management for users and prospective users of the Forge.mil suite of services, Forge.mil business office support, software development, integration, testing, certification, operational support (e.g., user assistance, performance reporting, and maintenance), system upgrades, and day-to-day operations of all environments related to Forge.mil. The life-cycle management support includes applying security patches, maintenance, provisioning, testing, and operational management (e.g., trouble ticketing, performance reporting, and service desk support).

6. Performance Requirements

6.1 Task 1 - Project Management & Documentation Support

The contractor shall provide project management & documentation support for the Forge.mil operating environments in support of the Forge PMO. The contractor shall perform the following activities:

• Creating engineering documents as required;

• Keeping all engineering documents up to date;

• Ensuring the engineering team follows the Agile methodology;

• Providing support to end-users by monitoring, performing triage, and responding to trouble tickets or other means of reporting;

• Maintaining statistics of number of users using Forge.mil that will provide management information for user growth and will support out year budget projections;

• Managing all incident reports (internal and external) to closure;

• Defining and implement customer communication plans to ensure status is appropriately updated;

• Define, implementing, and monitoring that means to measure customer satisfaction;

• Participating in the planning and delivery of community webinars;

• Creating and maintaining user stories that involve the purpose of monitoring a task in Forge.mil;

• Maintaining configuration control and management of the operating environments in accordance with the policies laid out in the DISA Small Project Documents;

• Providing Subject Matter Experts (SME) on Forge.mil engineering, IA, Integration and Testing, and Operations matters from both technical and functional perspectives, and supporting stakeholders;

• Preparing, as requested, customer outreach briefs, plans, Forge.mil software demos, and other documentation supporting the Forge.mil’s mission;

• Providing Monthly Status Reports (MSR) to Forge.mil management that includes accomplishment, progress, plans for next month, issues/concerns, and financial status (current work plan, work breakdown structure, burn rate);

• Ensuring all teams formed in this requirement provide guidance/recommendations to the PMO, CMT and CCB that can adversely impact schedule or performance;

• Leading the Forge.mil daily standup (DSU) calls (currently held at 9:00 AM eastern but subject to change), as well as being an active participant;

• Leading the bi-weekly iteration Planning and User Acceptance Test (UAT) meetings (using both Defense Connect Online and conference calling) normally held on alternating Fridays following the DSU as well as being an active participant;

• Leading the bi-weekly iteration kickoff meetings normally held on alternating Mondays following the DSU as well as being an active participant; and

• Performing monthly program reviews describing the contract activities performed, providing an updated schedule of activities, and briefing the MSR.

• Coordinating and leading the quarterly Release Planning meetings held either in a physical location or virtually via DCO and conference call, as well as being an active participant and documenting the meeting.

• Provide support and assist with reducing program costs of design, development, test, deployment, and certification through automation, centralization, and virtualization of hardware and services;

Deliverables: Kick Off Meeting

Project Management Plans

Prepare and maintain a master Plan of Actions and Milestones (POA&M) for TestForge.mil test and operations and activities.

In Process Reviews (IPR)

Briefs, plans, demos, and other documentation supporting the Forge.mil project office.

Monthly Status Report (MSR)

Daily Stand-up

QPR/IPR Iteration Plan Slide

Iteration Planning Meeting notes

Configuration Control Board Meeting notes

6.2 Task 2 - Certification & Accreditation Support

The contractor shall provide certification and accreditation by means of IA support over the Forge.mil environments in support of the Forge PMO. The activities in this task involve access to sensitive information. A Top Secret security clearance is required when performance starts. The contractor shall perform the following activities:

• Assure the security posture of the Forge.mil family of services;

• Maintain and track status of Information Assurance Vulnerability Assessment (IAVA) or other open findings in Operating System (OS) and application level of components; prepare and submit Plan Of Action & Milestone (POA&Ms) as required and manage open findings to closure;

• Work with Forge stakeholders to apply and maintain the necessary IA posture of Forge.mil environments as specified by DoD policy, security checklists, Security Readiness Reviews (SRRs), and Security Technical Implementation Guides (STIGS);

• Ensure current and new Forge components meet the DoD IA criteria and requirements for performance and dependability;

• Support Forge.mil services in maintaining a security risk assessment throughout the performance of this requirement;

• Support the DoD Certification and Accreditation process as described in DIACAP or any replacement process (such as the risk management framework) and be responsible for reporting, tracking, and correcting services based on US CYBERCOMMAND Communication Tasking Orders (CTOs) and IAVA advisories using DoD standard tools, including the Vulnerability Management System (VMS) and other relevant IA information systems are up-to-date;

• Support the DoD Certification and Accreditation process as described in DIACAP or any replacement process (such as the risk management framework) and be responsible for ensuring required IA artifacts are present in eMASS and any other data stores associated with IA; Support the maintenance and revision of documentation needed for the C&A process;

• Provide knowledge and expertise in the following areas: Service-Oriented Architecture (SOA) and net-centric design; software design and development; database management; network design and management; web application architectures; hardware configuration and installation; systems integration; testing; DoD DIACAP or any replacement process (such as the risk management framework) certification; and technology integration; and

• Provide support to enable cross-component collaboration and integration using an open computing model to support system development and certification and accreditation;

Deliverables: IA & CA Tracking Report

IAVA Review Report

VMS Tracking & eMASS update

Generate and maintain C&A documentation

6.3 Task 3 – Software integration, test and validation support

The contractor shall support the Forge’s engineering team in providing software integration, test and validation support of the Forge.mil environments in addition to supporting Forge PMO and team members. The activities in this task involve access to DISA DECC hosted systems. A Top Secret security clearance and IT-I (privileged level systems access) are required when performance starts. The contractor shall perform the following activities:

• Provide support to the program’s software development, integration and test, production deployment, operations, and certification processes throughout the Software Development Life Cycle (SDLC);

• Provide support and assistance with the continued development and fielding of all automation that provides provisioning, test, and deployment of the Forge.mil services;

• Work with all other Forge.mil groups to successfully develop, build, test, and deploy the Forge.mil services into the various production environments on a daily, weekly, or monthly basis (currently Forge.mil deploys to production on a monthly basis, and the Forge.mil teams are modifying deployment processes to increase the frequency of production deployments);

• Provide an independent verification and validation view-point on the Forge application system’s functionality, performance, and security, and the Forge continuous integration and delivery platform’s functionality and integrity of function;

• Define, implement, and maintain test plans and procedures for testing and validating critical systems components;

• Define test and implementation test-cases for inclusion during integration and pre-deployment test cycles necessary to validate existing automated test processes;

• Maximize utilization of software engineering test cases by auditing the development process and independently confirming their applicability for reuse;

• Monitor test artifacts produced within the Forge continuous integration environment, recommending improvements and/or identifying gaps in test cases;

• Provide troubleshooting support to the engineering teams specific to the testing of components in the Forge.mil environments;

• Work with Forge stakeholders to resolve site specific issues concerning installation, configuration, network connectivity, and Information Assurance items related to the operating environments;

• Test the viability of various applications and pilot them in test environments in support of future Forge.mil components and capabilities;

• Work with Forge stakeholders to enhance and increase the capabilities in the Forge development and test environments to support a more robust virtualized and automated architecture;

• Execute performance tests, functional tests, and security scans prior to major deployment to the production environment(s);

• Implement, in concert with Forge.mil Engineering, automation necessary to (i) continuously monitor and report on the state of the application pre-production and production environments;

(ii) deploy OS and/or application level updates ‘on demand;’ (iii) establish system baseline at a known revision level, (iv) work harmoniously with the Forge continuous integration environment;

• Establish and maintain the Forge.mil product lines’ Configuration Management (CM) Control Items (CI) and baselines;

• Provide support in the automation of Forge.mil components across project partners to promote the utilization of continuous integration and deployment;

• Ensure a seamless integration between collaborative development components and other components or systems that may be provided by partner organizations of DISA in the Forge software; and

• Install, manage, and operate the Forge.mil application stack residing on the development, test, pre-production and production operating environments.

Deliverables: User Artifacts, Technical Reports, use cases, source codes, software scripts, and user support documentations, IA support documentations, environment System Architecture

Iteration Test Plan

Iteration Test Report

Site specific issues/incident After Action Report

Monthly Drop Readiness Assessment

Reports to IAM

6.4 Task 4 – Operations Support

The contractor shall provide operations support to ensure the quality and dependability of the Forge.mil infrastructure in support of the Forge PMO. The activities in this task involve access to DISA DECC data systems. A Top Secret security clearance and IT-I (privileged level systems access) are required when performance starts. The contractor shall perform the following activities:

All operations and maintenance of current pre-production (development, test, and preproduction staging environments such as RACE) and production systems in unclassified and classified environments;

• Implement and maintain the configuration management system;

• Apply application level updates to any affected system (monthly maintenance);

• Monitor production systems – remediate run-time issues, assure security posture of production system;

• Define, maintain, and implement operational processes germane to the application system and relevant environments;

• Provide support to assist those programs and projects relying on Forge.mil services to integrate Forge.mil into their native IT processes and existing tools;

• Provide operational support to Commercial Of The Shelf (COTS) vendors in support of isolating or determining reported problems;

• Provide guidance/recommendations to the Forge.mil PMO, Community Management Team (CMT) and Configuration Control Board (CCB) on readiness to deploy changes to production that can impact schedule or performance;

• Serve as both as a CCB member and CCB Secretariat roles; and

• Perform as a Forge stakeholder with engineering design, development, and integration for the Forge.mil environments.

• Provide all applications administration and management support for the operations of the production Forge.mil services hosted on NIPRNet including http://www.Forge.mil, https://community.Forge.mil, https://software.Forge.mil, and https://project.Forge.mil, milCloud services, as well as other Forge.mil services developed for deployment and hosting on NIPRNet as they become available; and

• Provide all applications administration and management support for the operations of Forge.mil services hosted on SIPRNet including software.forge.smil.mil and other Forge.mil services developed for deployment and hosted on SIPRNet as they become available, as well as milCloud services and other Forge.mil services developed for deployment and hosting on NIPRNet as they become available.

Deliverables: POA&M Technology products enhancement

Support the development, implementation, and maintenance of integrated product

6.5 Task 5 – Software Development for the Collaboration and Community product line

The contractor shall support the engineering task to develop and deliver the Forge.mil family of services, the systems that enable the Forge.mil Collaborative Development Environment. This task provides an open, Service Oriented Architecture (SOA) based collaboration platform based on CollabNet software to support the Forge.mil community and the development of open source and community source software within the DoD. The Forge.mil family of services is operated in DoD computing centers and must meet all DoD IA requirements. The activities in this task involve access to DECC hosted systems. The contractor shall perform the following activities:

• Providing additional capabilities to the Collaborative Development Environment’s core platform.

This additional capability shall include SubVersion, CollabNet Team Forge Enterprise, and Cubit services as enabled by the existing CollabNet software;

• Design and develop new features and enhance existing features of Forge.mil Family of Services, with a particular focus on features requiring expertise in security;

• Evaluate the current Forge.mil code and develop technical solutions to help mitigate any security vulnerabilities.

• Providing software development, engineering solutions and support for Community Forge using open source and community source software;

• Providing software development, engineering solutions and support for the Forge.mil public interface website (www.Forge.mil) using open source and community source;

• Providing development, engineering solutions and support for the Forge.mil Single Sign-on (SSO) authentication and authorization for all Forge.mil environments using the open source and COTS solutions;

• Providing additional engineering support in response to this increase capability and new feature enhancement requests. The contractor shall help to define road map, design, and implement new enhancement features and capacity to support the project new demand and growth in both quality and quantity;

• Delivering the Forge.mil Collaborative Development Environment to support distributed development of open source and community source software within the DoD network environment (i.e., NIPRNet and SIPRNet);

• Providing open interfaces and product extensions to enable integration with other commercial and government tools that support the software development process. The Forge.mil Developer Network will make use of CollabNet’s open and pluggable SOA Based integration framework to connect these federated user tool environments into the DECC hosted CollabNet infrastructure;

and

• As part of the planning and ramp up of the Forge.mil Developer Network, the contractor shall work with the community to identify and build integrations to commonly used software development lifecycle tools and environments into the DECC hosted infrastructure.

Deliverables: Assess engineering solution for IA security posture

6.6 Task 6 – Community Management Support

The contractor shall support the creation and growth of a collaborative community of stakeholders who both benefit from and contribute to the Forge.mil Collaborative Development Environment. Working in tandem with DISA, the contractor shall ensure that activities such as governance, public relations and outreach, community recruitment, training and support, and ongoing process development will take place in an institutionalized fashion and contribute to the successful adoption of, satisfaction with, and overall growth of Forge.mil:

• Support services necessary to on-ramp new customers and partners in the Forge.mil collaborative environment, ensure stakeholder alignment, establish success metrics, and develop a community governance approach to maintaining and evolving the Forge.mil community;

• Develop a site content strategy and go-to-market strategy that aligns with the DISA and Forge.mil stakeholder objectives and support the Forge.mil family of services;

• Ensure the brand integration of all Forge.mil services;

• Host Webinars and other presentation sessions as needed to inform the community about new capabilities in the Forge.mil family of services;

• Provide user training and partner training to ensure successful recruitment and retention of community membership, and facilitate real-time feedback to help evolve and maintain the Forge.mil capability;

• Take part in the weekly Community Management Team meeting;

• Provide support to maintain the integrity and operational availability of the Forge.mil operating environments in support of the Forge.mil program office and the end users; and

• Work with current and prospective users of the Forge.mil family of services to improve DoD community adoption, user satisfaction, and overall utilization.

Deliverables: COTS required list with expected costs

COTS required products for deployment

Community Support plan

Training & Webinar briefing slides

6.7 Task 7 – Business Operation Support

The contractor shall provide support to Forge.mil project coordinators in the planning, operations, and outreach activities necessary to the program. Specific tasks include:

• Maintaining and executing the community support processes;

• Maintaining and supporting the execution of the Forge.mil communications plan;

o Write technical articles topics such as open source software development, Forge.mil capabilities and features, o Ensure the technical accuracy of Forge.mil’s web presence on the Forge.mil web sites as well as community outreach sites such as Wikipedia, Intellipedia, and DoDTechipedia, o Prepare and make presentations on behalf of the Forge program to cloud computing initiatives and other technical focus areas as identified, and

• Supporting the user community for the Forge.mil family of services;

o Inform new projects on the Forge.mil capabilities, o Help on-board new projects into Forge.mil’s CollabNet SourceForge Enterprise (CSFE) tool and Subversion repository, o Perform as a site administrator of Forge.mil’s CSFE tool and support Forge.mil Tier 1 and Tier 2 support processes, o Develop memoranda and support agreements to institutionalize partnerships and clarify relationships and expectations, o Make maximum use of online resources (e.g. wikis, portals, hosted collaboration tools) to increase the rate of knowledge sharing within communities and strengthen DISA technical partnerships, and o Ensure Forge.mil community growth and evolution through education and outreach.

The contractor shall be required to maintain and provide upgrades to the existing Forge.mil ecosystem.

This includes providing open interfaces and product extensions to enable integration with other commercial and government tools that support the software development process. Acceptable purchases for the categories listed in this section are as follows:

The contractor shall provide product maintenance and technical refreshes for existing software and hardware products.

The contractor shall provide support at various conferences where Forge.mil is required to provide booths and demonstrations to the conference attendees. The contractor shall provide conference items as part of the conference, which shall be governed, and guidance provided by COR or Alt COR. The contractor shall support Forge.mil conference requirements by providing additional space at customer conferences, rental or purchase of electrical equipment, storage units, media furniture, and marketing accessories. As required by the COR.

All purchases of products or support shall require advanced written approval by the COR or ALT COR prior to the contractor purchasing the products or support.

Deliverables: Forge.mil Product End Items. This includes successful and operational upgrade features compatible with the current Forge platform that is in DISA DECCs environments

System build documentation

Documented plan for upgrades, bug fixes and plan successfully delivered

Business support plan

7. Performance Standards.

Performance Standard Acceptable Quality Level

(AQL)

Method of Surveillance

Task 6.1 – Briefing Performance occurs with no Routine inspection of deliverable material will be delivered on time and in accordance with (IAW) Government COR/AltCOR guidance required re-performance or re-work at least 95% of the time.

Problems that occur are minor and are resolved in a satisfactory manner.

products and services.

Task 6.1 – Provide meeting administrative support Meeting agendas, support packages, guidance packages, trip reports, records of technical discussions, and other products are (1) correctly formatted, complete, and effectively address all subject areas, and (2) delivered IAW approved Program Plan schedule.

Performance Standards are met 95% of the time Routine inspection of the materials

Routine inspection of deliverable products and services.

Task 6.2- Identify and provide recommendations to address issues.

Performance occurs with no required re-performance or re-work at least 95% of the time.

Problems that occur are minor and are resolved in a satisfactory manner.

Routine inspection of deliverable products and services.

Task 6.2 – Provide certification and accreditation by means of IA for critical management, technical, resource, and security issues.

Performance Standards are met for DIACAP or any replacement process (such as the risk management framework) Process 100% of the time.

Routine inspection of the materials

Task 6.3- Providing support to the Forge.mil environment’s software development, integration and test, production deployment, operations, and certification processes throughout the Software Development Life Cycle

Performance occurs with no required re-performance or re-work at least 95% of the time.

Problems that occur are minor and are resolved in a satisfactory manner

Routine inspection of deliverable products and services.

(SDLC).

Task 6.4 - Provide operations support to ensure the quality and dependability of the Forge.mil infrastructure and provide uninterrupted System Access during maintenance activities and upgrades.

100% of scheduled maintenance activities, upgrades, etc. which involve loss of system access must be coordinated with the government at least 7 calendar days before scheduled downtime and must take place only during non-critical periods. The contractor will not be penalized for circumstances outside of his control that lead to downtime or loss of connectivity.

Routine inspection of the materials.

Task 6.6 - Support the creation and growth of a collaborative community of stakeholders for the Forge.mil Collaborative Development Environment

Performance occurs with support services necessary to on-ramp new customers and partners in the Forge.mil collaborative environment, ensure stakeholder alignment, establish success metrics, and develop a community governance approach to maintaining and evolving the Forge.mil community at least 95% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Routine inspection of deliverable products and services.

Task 6.7 - Provide support to Forge.mil project coordinators in the planning, operations, and outreach activities.

Performance Standards are met 100% of the time.

Routine inspection of the materials

8. INCENTIVES. Both positive and negative performance will be documented in past performance reports/databases, as appropriate. Meeting or exceeding the Acceptable Quality Level is considered positive performance. Failure to meet the AQL is considered negative performance.

9. PLACE OF PERFORMANCE.

Work will be performed at DISA headquarters (Fort Meade, MD). The contractor shall be required to travel to support Forge.mil within CONUS. The government estimates a total of 10 trips with 4 people for 5 days for planning purposes. For estimating purposes, it is anticipated that travel may be necessary from DISA HQ for the following purposes: Forge stakeholders meetings, Conference attendance, meetings with DISA DECC personnel, and meetings with vendors at their facilities.

All travel shall be approved by the COR/ALT COR in writing. Specific travel requirements shall be coordinated with the COR/ALT COR and shall be in accordance with the Federal Acquisition Regulation (FAR) Subpart 31.205-46 requirements and limitations. Reimbursement for travel expenses shall be made in accordance with the Federal Travel Regulations.

Alternate Place of Performance - Contingency Only. Contractor employees may be required to work at home, another approved activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. COR/ALT COR approval is required.

Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources.

10. PERIOD OF PERFORMANCE.

The period of performance is for one year from contract award with four (4) one year option periods.

11. Delivery Schedule.

SOW

Task#

Deliverable Title Format Due Date Distribution Frequency and Remarks

6.1 Kick Off Meeting N/A 10 calendar days

after award

*Standard Distribution

10 days after award

6.1 Project

Management Plans

Government format

30 calendar days after contract award

*Standard Distribution

Quarterly

6.1 Prepare and

maintain a master Plan of Actions and Milestones (POA&M) for TestForge.mil test and operations and activities.

Government format

10 days after each major release of Forge.mil

*Standard Distribution

Estimated Quarterly - Minimum of 4

– Master POA&M and 3 revisions

6.1 In Process Reviews

(IPR)

Government format

Every 90 days after first quarterly IPR

*Standard Distribution

Quarterly

6.1 Briefs, plans, demos, and other documentation supporting the Forge.mil project

Government format

10 days before due date

*Standard Distribution

Estimate a minimum of 15 and a maximum of office.

6.1 Monthly Status

Report (MSR)

Government format

30 calendar days *Standard Distribution

Monthly on the 5th day of the month.

6.1 Daily Stand-up Government

format

Each business day

Deputy PM, Business Office

Daily

6.1 QPR/IPR Iteration

Plan Slide

Government format

Each Wednesday after contract award

*Standard Distribution

Weekly

6.1 Iteration Planning

Meeting notes

Government format

Bi-weekly after contract award

*Standard Distribution

Bi-weekly

6.1 Configuration

Control Board Meeting notes

Government format

Bi-weekly after contract award

*Standard Distribution

Bi-weekly

6.1 Release Planning

Meeting notes

Government format

Quarterly after contract award

*Standard Distribution

Quarterly

6.2 IA & CA Tracking

Report

Government format

2 Days before Iteration Kick-off

*Standard Distribution

Bi-weekly

6.2 IAVA Review

Report

Government format

Day of release *Standard Distribution

Weekly

6.2 VMS Tracking &

eMASS update

Government format

Day of release *Standard Distribution

Weekly

6.2 Generate and

maintain C&A documentation

Government format

As needed *Standard Distribution

Monthly

6.3 User Artifacts, Technical Reports, use cases, source codes, software scripts, user support documentations, IA support documentations, environment System Architecture

Government format

10 days after award for Kick-off, Bi-Weekly iteration planning, and User Acceptance Test

*Standard Distribution

10 days after award for Kick-off and bi-weekly thereafter

6.3 Iteration Test Plan Government

2 Days after Iteration Kick-off

*Standard Distribution

Bi-Weekly

6.3 Iteration Test Government Day of User *Standard Bi-Weekly

Report format Acceptance Test Distribution

6.3 Site specific

issues/incident After Action Report

Government format

2 days after incident

*Standard Distribution

Based on incidents – historically minimum of 20 and maximum of 60 *

6.3 Monthly Drop

Readiness Assessment

Government format

2 days before monthly drop

*Standard Distribution

Monthly

6.3 Reports to IAM Government

format

Before and After incident releases

*Standard Distribution

*Based on the number of Site Specific Issue/Incident After Action Reports

6.4 POA&M

Technology products enhancement

Government format

90 days after award.

Quarterly thereafter

*Standard Distribution

Quarterly

6.4 Support the

development, implementation, and maintenance of integrated product

Government format

Bi-weekly after contract award

Bi-weekly

6.5 Assess engineering

solution for IA security posture

Government format

Day of security incident release

Weekly

6.6 COTS required list

with expected costs

Contractor determined

Initial - 90 days after contract award

Initial – 90 days after award Updates - Monthly

6.6 COTS required

products for deployment

Contractor determined format

Initial - 90 days

Initial – 90 days after award Updates…