12__PWS_Task_Order_0001.docx

PERFORMANCE WORK STATEMENT (PWS)

As of 06 June 2019 Defense Collaboration Services (DCS) Solicitation Number HC1047-19-R-4005 Task Order 0001

1. Task Order - Defense Collaboration Services (DCS) Sustainment Support – Task Order 0001.

2. Contracting Officer’s Representative (COR) See section H1 of contract “Points of Contact”

3. Background. Defense Information Systems Agency provides Defense Collaboration Services (DCS) as an unified real time enterprise collaboration capability that delivers secure web conferencing and instant messaging services on Secret Internet Protocol Router Network (SIPRNet), Sensitive but Unclassified Internet Protocol Network (NIPRNet), and internet (via NIPRNet). This critical enterprise service regularly serves 150K monthly web conference users and 20K concurrent daily chat users on NIPRnet. With DCS, DISA promotes and fosters a Joint information collaborative environment with a high quality and cost effective services to improve workflow productivity. DCS capabilities are built on open source solution and provides:

· Collaboration Portal: Social media and collaboration features, links and training info, and real time communications via XMPP chat messages.

· Web Conferencing: Browser-based web conference sessions that provide users with the capability to host presentations, record sessions, share desktops, white-board with all session participants, call into a session from their phone, view closed captioning, chat among session participants, and participant voting in session polls.

· Instant Messaging (Desktop and Mobile Apps): Persistent chat rooms, Multi-User Chat (XEP-0045, XEP-0369), one-to-one chat, presence, chat history search, chat user search, chatbots, and administration functions.

· File Transfer: Secure transfer of files for Department of Defense (DoD) enterprise users.

· Voice Conferencing: Voice conference bridge capability that is accessible to all DoD enterprise users.

4. Objectives: The objective of this contract is to provide DCS engineering and sustainment support to improve and maintain the service. DCS support contract includes managing and maintaining the applications, servers and supporting infrastructure on both the DISA NIPRNet and SIPRNet. The contract personnel should have requisite knowledge of DoD enterprise architectures, networks, frameworks, systems, process, and data requirements. Additionally, the technical contractual personnel should have expert knowledge of Web services, Open source components and trends, DoD integration and networks, DoD engineering and sustainment procedures and processes to deliver a real time enterprise collaborative service to a large customer base.

This includes continuously assessing the DCS security posture leading to and maintaining a current security authorization that meets the criteria of the DoD Risk Management Framework (RMF). This PWS delineates Contractor support in assuring the DCS information system, technology and components are secured according to the applicable security requirements, directives, and regulations and meet all applicable DoD and Non-DoD Information Assurance (IA) security requirements in accordance with (IAW) the DoDD 8140, DoD 8510 (RMF), and DoD 8570.01-M. Because of the complexity of DCS engineering and sustainment functions, Capability Maturity Model Integration (CMMI) Services (CMMI-SVC) Level 3 (or better) and Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) are required. With rapidly evolving technologies, budget uncertainty, constant customer requirements, and fierce competition, DISA needs to manage these areas closely and continuously seek new, innovative, and effective ways to optimize and improve the DCS service. To better serve DOD and its Mission Partner customers, DCS program office has to continue DevOps methodologies to manage infrastructure deployments, technology refreshes, and customer requirements.

5. Scope. Task Order 0001 is for the sustainment for DCS service. Task Order 0001 consists of the following tasks from the base Indefinite Delivery/Indefinite Quantity (ID/IQ): 1- program management, 3 - Tier 3 support, 4 - training and subject matter expert support, 6.2- sustainment engineering, 7 - sustainment tool development and integration, and 9 - information assurance support. This task requires the day to day management of the schedule and performance of the all supported tasks from the vendor perspective. This tasks calls for formation of a tier III that will perform high level troubleshooting, fault isolation, and incident mitigation for all parts of the service; as well as the engineering support to facilitate incident mitigation. This tasks requires the vendor provide training in the form of documentation, live, and recorded training for the service in its entirety. The vendor will also be required to develop, deploy, and sustain event management, logging, and reporting tools. This task calls for information assurance personnel who can deliver reports and provide service in line with the risk management framework.

6.0 Work to Be Performed – The following subsections align to the base ID/IQ section 6. Each subsection provides specific details for the performance of task order 0001. Only the task areas that are required for each specific task orders will be defined in this section. If a task area of the ID/IQ is not part of this task order, it will be noted as “Reserved.”

6.1 Task 1 - Task Order (TO) Management

This task provides project management support to manage DCS service.

Contractor shall:

1. Provide a weekly status report for the tasks and subtasks by monitoring for quality assurance, progress/status reporting and program reviews applied to the task order. The report shall include:

· Task name, description, accountable team members, and projected start and end dates.

· Task issues and action items and description of issue/action

· Upcoming Activities

1. The contractor shall update the Task Order Management Plan to include the management of this task and describing the technical approach, organizational resources and management controls to be employed to meet performance and schedule requirements of this task.

1. Deliver an Integrated Master Schedule (IMS) to define the work projections throughout Task Order (TO) execution updated monthly.

1. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

Deliverables:

1. Tasks for projects detailing the task name, accomplishments description, and the responsible team members assigned to complete the task and projected start and end dates.

2. Issues and action items detailing task name, description of issue/action

3. Upcoming Activities

Final 30 business days after contract award updated annually.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Reserved

6.3 Task 3 - DCS Tier 3 Support

To provide Tier 3 support for the DCS application for the next 12 months. Interface with the supporting Tiers (2 and 4) in an effort to assess the infrastructure and resolve the respective incident or problem tickets. The annual historical average of incident tickets is 380 incident tickets with a monthly closure of on average of 20 tickets per month. To support this task:

a. The contractor shall attain and maintain an IT level II qualification DoD 8570.01-M to perform this task.

b. The contractor shall utilize DISA Global Ticket Management System (GTMS) on the SIPRNet, and IT Service Management (ITSM) on the NIPRNet, in order to:

· Access and review all Tier 3 Incident Tickets and Problem Tickets assigned to their group daily.

· Within one working day, accept, analyze, and annotate on the GTMS or ITSM Tier ticket a status update.

· Identify the root cause of incident and resolve within five working days.

· Unresolved incidents will be added to Forge for tier four support within five working days.

· Ensure all incident tickets in the Tier 3 queue have updates every three working days.

· Ensure 100% of the monthly incident tickets for Tier 3 are opened, reviewed, and annotated within the defined ITSM/GTMS metrics for incident priority.

· Ensure 100% of the active incident tickets for Tier 3 are updated weekly.

· Ensure 90% of the monthly incident tickets for Tier 3 are either closed, escalated to Tier 4, or de-escalated to Tier 2 quarterly.

c. The contractor shall summarize and track/update DCS issues escalated in GTMS in Forge.mil on a weekly basis.

d. The contractor shall use Software Forge in order to submit Software Forge artifacts and update them as required.

e. The contractor shall troubleshoot all issues escalated to Tier 3 and discuss with designated service manager before escalating to Tier 4.

f. The contractor shall apply Capability Maturity Model Integration (CMMI) Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of the operation of DCS services where applicable.

g. The contractor shall insert all summarized issues escalated to Tier 3 in Forge and where necessary, use Forge to escalate tickets to Tier 4.

h. The contractor shall provide the Government a Weekly Tier 3 Ticket Report that identifies the:

0. Total Incident Tickets and their current status in the Tier 3 Queue

0. Total Problem Management Tickets in the Tier 3 Queue and the number of associate incident Tickets

0. Total Number of Incidents Tickets Opened

0. Total Incident Tickets that are older than 10 working days old

0. Total Number of Incidents Tickets Updated

0. Total Number of Incidents Tickets Escalated to Forge

0. Total Number of Incidents Tickets deescalated to Tier 2

0. Total Number of Incidents Tickets Closed Deliverable(s):

· Total Incident Tickets in the Tier 3 Queue

· Total Problem Management Tickets in the Tier 3 Queue and the number of associate incident Tickets.

· Total Number of Incidents Tickets Opened

· Total Incident Tickets that are older than 10 working days old

· Total Number of Incidents Tickets Updated

· Total Number of Incidents Tickets Escalated to Tier 4

· Total Number of Incidents Tickets deescalated to Tier 2 Total Number of Incidents Tickets Closed

Incidents, technical issues, and updates via Software Forge

Software Forge Format

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.4 Task 4 - DCS Training

This task is to provide live and recorded training to the DCS community for the next 12 months. Training is conducted primarily on NIPRNet using DCS. The training sessions average 40 participants for DCS Basic Training, 25 for DCS Advanced, and 60 for Swift and Transverse Chat Client training.

The contractor shall:

Develop, present, and update the DCS live training and the DCS recorded video presentations. To perform this subtask the contractor shall:

1. Conduct Basic DCS conferencing training twice a week utilizing current DCS material.

1. Conduct Advanced DCS conferencing training twice a week utilizing DCS Deskshare.

1. Conduct Swift Chat Client training once a week utilizing DCS Deskshare and the Swift Chat Client

1. Develop, update quarterly, and maintain currency of all DCS Training Presentations.

1. Develop, update quarterly, and maintain training scripts to develop DCS Training Videos.

Record and make available DCS Basic, Advances, and Chat Client training videos in the Government-designated Visual Information facilities updated quarterly.

Deliverables(s):

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.5 Reserved

6.6 Task 6 - DCS Integration and Operational Support

6.6.2 Subtask 4.2. DCS Operational Support

This subtask is to provide dedicated operational support (Tier 4) for DCS and ensure that the DCS application(s) and Virtual Operating Environments (VOEs) are managed, configured, sustained, and monitored during the lifecycle of the DCS program to ensure service availability & optimal performance for DCS. DCS VOE’s include Staging, Pre-Production, and Production VDCs on NIPRNet and SIPRNet. The average escalations of incident tickets from Tier 3 to Tier 4 are 10 per month.

The contractor shall:

a. Provide operational support (Tier 4) for the current and pending DCS capabilities to provide a high quality customer service on the following:

· Infrastructure and optimizations

· Mil 2.0 or AWS transition

· Shared services optimizations - F5, OCSP, EASF, and DNS

· Infrastructure/Client/server optimizations - NGINX, RED5, REDIS, MySQL, Free Switch, TOMCAT, SWIFT, Openfire, containerization to include Kubernetes and Openshift, multi-site cross site interactions

· Tech Refreshes

· Ensure full capability performance of HTML5 on DCS

· Core updates to the portal, WC, and chat components to include software and enhancements

· Open source component upgrades to include Web conference and Chat Component upgrades, Web conference and Chat Component Upgrades – As required (24 times a year), Open Source technology SW (12 per year), Software Updates – approximately 5 per month (60 per year), Feature Enhancements approximately 2 per month (24 per year),

· Enhancements that benefit the customer user experience

· Unified capabilities (voice, video, chat)

· Voice integration for web conference

· Five Eyes (FVEY) Classified Environment chat

· Mobility (web conference, XMPP chat Native App)

· Enterprise chat federation and protocol converter (SylkServer, Nextplane)

· Disconnected Intermittent Low Bandwidth

· Regional DCS.

b. Provide dedicated Tier 4 support to Tier 3 and Tier 2 daily to troubleshoot DCS issues documented in Forge on NIPRNet and SIPRNet.

c. Manage, configure, and monitor the DCS Virtual Operating Environments (VOEs) associated with the DCS Staging, Pre-Production, and Production VDCs on NIPRNet and SIPRNet.

d. Manage, configure, and monitor the DISA Milcloud Virtual Data Center (VDC) configured for DCS on the NIPRNet and SIPRNet.

e. Coordinate with DCS Tier 2 to apply the necessary Cybersecurity controls, Enterprise Systems Management (ESM) tools, and Security Technical Implementation Guidance (STIG) controls.

f. Hand-off the validated Pre-Production application to the production deployment via the TRB process.

g. Ensure every change to an application component has a document location for immediate roll-back.

h. For each quarterly developmental upgrade or update, receive, deploy, and test the deliverable code from the development stage into the Milcloud staging enclave. Upon successful testing, move the code to the Milcloud pre-production VDCs for Cybersecurity hardening. Provide test and hardening results to the PM prior to production delivery.

i. Document and provide meeting minutes of the weekly Technical Review Board (TRB) to the TRB facilitator.

j. Provide a monthly Change Management tracking and status report (that documents any changes to any of the deployed application components and the status of the roll-back capability.

k. Update Software Forge artifacts and submit software code and deliverables via designated software development management platform (e.g. Software Forge)

l. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

m. Provide a monthly Status, Health and Configuration report on following:

0. DCS Milcloud hosting environment.

0. F5 Load balancer

0. Openfire Chat Servers

0. DECC Firewall and Routers

0. Primary and Secondary Mirroring

0. Primary and Secondary Roll-Back Capability

0. HAZCON Status

0. Approved RFCs in the queue, and processed

0. Recording and processing Servers

0. NAS thresholds

0. MilCloud Storage Thresholds

0. IAVA Compliance

Deliverable(s):

Final 15 business days after each testing event.

Forge format

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.7 Task 7 - DCS Service Analysis and Situational Awareness Capability This task is to evaluate, develop, and deliver Service Analysis and Situational Awareness tools that can be used by operational support elements to assess the visibility, health and stability of the DCS application environment and the support infrastructure and to provide near real-time Situational Awareness of their DCS Conference, Chat Session, or infrastructure stability. The contractor shall develop, modify and deliver net ops tools for new DCS capabilities in terms of infrastructure, tech refreshes, and customer enhancements:

There are two tasks: Integration and Sustainment:.

6.7.1 Subtask 7.1 DCS Service Analysis integration

The focus of this subtask is to develop and maintain the DCS Service Analysis capabilities. The development environment is the responsibility of the contractor. DCS uses the following tools and applications to manage the development portion of the Service Analysis and Situational Awareness Development effort:

0. Nagios XI

0. Elasticsearch, Logstash, & Kibana (ELK Stack)

0. Simple Network Management Protocol (SNMP)

0. Rsyslog

To support the integration of Service Analysis and Situational Awareness tools, the following elements are considered to be key components.

0. Internet Protocol (IP) networks (IPV4 and IPV6)

0. Firewalls, Routers, and Switches

0. Virtual Infrastructures (VMWare)

0. Network Attached Storage

0. Storage Area Networks

0. Active Directory / Domain Controllers

0. Virtual Private Networks

0. F5 Load Balancers

The contractor shall:

a. Develop level-of effort (LOE) assessments on development efforts to support each of the developmental tasks.

b. Develop and deliver net ops tools for current and existing DCS capabilities:

· Infrastructure and optimizations

· Mil 2.0 or AWS transition

· Shared services optimizations - F5, OCSP, EASF, and DNS

· Infrastructure/Client/server optimizations - NGINX, RED5, REDIS, MySQL, Free Switch, TOMCAT, SWIFT, Openfire, containerization to include Kubernetes and Openshift, multi-site cross site interactions

· Tech Refreshes

· Fully HTML5 capable DCS

· Core updates to the portal, WC, and chat components to include software and enhancements

· Open source component upgrades to include Web conference and Chat Component upgrades, Web conference and Chat Component Upgrades – As required (24 times a year), Open Source technology SW (12 per year), Software Updates – approximately 5 per month (60 per year), Feature Enhancements approximately 2 per month (24 per year),

· Customer Enhancements

· Unified capabilities (voice, video, chat)

· Voice integration for web conference

· Five Eyes (FVEY) Classified Environment chat

· Mobility (web conference, XMPP chat Native App)

· Enterprise chat federation and protocol converter (SylkServer, Nextplane)

· Disconnected Intermittent Low Bandwidth

· Regional DCS.

c. Update Software Forge artifacts and submit software code and deliverables via designated software development management platform (e.g. Software Forge)

d. Develop and/or integrate the DCS Service Analysis tools with changes in infrastructure, tech refresh, customer requirements, and other modifications. Update DCS Service Analysis tools on an semi-annual basis and modify tools to ensure that tools monitor the current DCS architecture on an as needed basis.

e. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

f. Develop required documentation to support the developmental tasks to include:

0. Update the Systems Interface Description (SV1) and Operational View (OV-1) architecture quarterly to define how each solution will interface with the existing infrastructure on monthly basis.

0. For each quarterly software release, develop Test plans and deliver results designed to validate and support the tool deployment to include technical testing, and regression testing when appropriate.

0. Conduct a Limited User Testing (LUT) with each quarterly SW upgrade and provide the results of each LUT to the Government to validate wider testing and implementation.

Deliverable(s)

Final 30 business days after each upgrade requirement decision

Final 30 business days after each upgrade requirement decision

Final 20 business days after each deliverable

Final 20 business days after each LUT event

Formal Software Development Processes documentation

Baseline Requirements Management processes

DOORS New Requirements Documentation

Updated DCS Platform Architectural Documentation

Test Plans and Results

Updates via Software Forge

Software Forge Format

Static Code Analysis Reports

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.7.2 Subtask 7.2 DCS Service Analysis - Sustainment

The focus of this subtask is DCS service analysis sustainment. DCS uses the following tools and applications to manage the development portion of the Service Analysis and Situational Awareness Development effort:

0. Nagios XI

0. Elasticsearch, Logstash, & Kibana (ELK Stack)

0. Simple Network Management Protocol (SNMP)

0. Rsyslog

The contractor shall:

1. Monitor DCS servers and associated IaaS components on the NIPRNet and SIPRNet using the Nagios and ELK tools.

1. Maintain & configure DCS Service Situational Awareness/NetOps tools per direction of DCS NetOps Development.

1. Maintain close communication with DCS Tier 2, Tier 3, and Tier 4, and DCS NetOps Development.

1. Provide direct support to DCS Tier 2 and Tier 3, the DISA NetOPs and the DISA Command Center (DCC).

1. Utilize government provided monitoring tools to maintain the visibility, health, and security of all DCS servers, infrastructure components, and application stability.

1. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

1. Participate in DISA Operations Meetings weekly to provide status and health of DCS to DISA NetOPs.

1. Provide a weekly Performance Analysis Report that addresses the following:

1. Health and stability of the network routers and firewalls supporting the DCS infrastructure

1. Health and stability of the F5 Application Load Balancers supporting the DCS infrastructure

1. Health and stability of the Milcloud Virtual Data Centers (VDCs) supporting the DCS infrastructure

1. Health and stability of the Staging, Pre-Production, and Production VDCs supporting the DCS infrastructure

1. Health and stability of all of the Virtual Operating Environments (VOEs) is each of the Milcloud VDC

1. Validation of the mirroring of the primary DCS site to the failover site

1. Readiness of secondary DCS site to fail over if needed

Deliverable(s):

DCS Status, Health, and Configuration Report (updated Monthly)

1. Health and stability of the network routers and firewalls supporting the DCS infrastructure

1. Health and stability of the F5 Application Load Balancers supporting the DCS infrastructure

1. Health and stability of the Milcloud Virtual Data Centers (VDCs) supporting the DCS infrastructure

1. Health and stability of the Staging, Pre-Production, and Production VDCs supporting the DCS infrastructure

1. Health and stability of all of the Virtual Operating Environments (VOEs) is each of the Milcloud VDC

1. Validation of the mirroring of the primary DCS site to the failover site

1. Readiness of secondary DCS site to fail over if needed

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.8 Reserved

6.9 Task 9 – Cybersecurity Support

This task is to provide support to the DCS Program to ensure all Cybersecurity requirements are met and required security controls are selected and implemented to maintain compliance with the DoD RMF. This is a support task and any deliverables are government generated artifacts that require input and completion on the part of the contractor. Paramount to this task is having the necessary Cybersecurity expertise to advise and support the Government Information System Security Manager (ISSM) with required RMF tasks.

The contractor shall:

a. Ensure all contractors supporting this task are DoDD 8140-IAM Level 2 Certified Professionals.

b. Research and validate compliance with applicable DoD/DISA Cybersecurity requirements, directives, regulations, and US Laws.

c. Be required to function on both the classified and unclassified networks.

d. Support the utilization of the automated validation capabilities of the Enterprise Mission Assurance Support Service (eMASS) for preparation of the RMF Package.

e. Develop and maintain the RMF package quarterly which includes:

· Maintaining the DCS system artifacts.

· Assigning security controls based on the DCS system categorization as required by DoDI 8500.01 and DoDI 8510.01, CNSS 1253 and NIST SP 800-60, Volume II.

1. Ensuring the DCS system is properly registered in eMASS

1. Initiating and maintaining the RMF System Security Plan (SSP).

f. Implement and validate assigned security controls which include:

· Execution of the SSP.

· Conducting RMF validation activities.

· Compile the status of the validation results in the RMF Scorecard.

g. Develop and maintain the supporting Assessment and Authorization (A&A) which include:

· Risk Assessments

· Contingency Plan

· Plan of Actions and Milestones (POA&M)

· Other artifacts associated with implementing security controls, etc. as required for the RMF.

h. Draft a POA&M for any authorization decision that requires corrective action.

i. Develop and maintain the System Security Plan (SSP) annually that provides a systematic approach and techniques for protecting the application environment from being used by unauthorized users, guards against worms and viruses as well as any other incident/event/process that can jeopardize the underlying system’s security.

j. Provide security engineering to the Government and support assessment and authorization (A&A activities related to the DCS System).

k. Update any Cybersecurity databases as required or directed by DoD/DISA policies.

l. Submit and update IA related artifacts in softwareforge.

m. Manage and maintain the DCS Assessment and Authorization (A&A) process monthly required to sustain DoD/DISA compliance standards IAW the DoD RMF and in compliance with DoD 8500 series publications.

n. Manage the DCS IAVM (Information Assurance Vulnerability Alert (IAVAs)/ Information Assurance Vulnerability Bulletin (IAVBs)) management process as determined by the Government.

o. Support the preparation and documentation of Cybersecurity assessments of the DCS system and assets for all security and/or certification visits in the Command Cyber Readiness Inspection (CCRI) Federal Information Security Modernization Act (FISMA) discrepancies. Assessment tasks include:

· Auditing and reporting of the DCS system

· Documentation

· Security control compliance

· DoD 8570.1-M compliance requirements

· IAVM which include IAVAs/IAVBs), and STIG/SRG compliance.

p. Coordinate and provide Cybersecurity input on matters related to

· STIG compliance

· IAVA Testing and compliance

· Assured Compliance Assessment Solution (ACAS) and Fortify Scans, and Penetration Test results

Deliverable(s):

Final 90 business days after contract award, updated quarterly

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.10 Reserved

6.11 Reserved

6.12 Reserved

6.13 Reserved

6.14 Reserved

6.15 Reserved

6.16 Reserved

7. Performance Standards.

6.1 Task 1 - Task Order (TO) Management

6.2 Task 2 - DCS Engineering Support

6.3 Task 3 - DCS Tier 3 Support

6.3 Task 3b - DCS Tier 3 GTMS/ITSM Processing

Access and review all Tier 3 Incident Tickets and Problem Tickets daily 95% of the time.

Weekly inspection of deliverable products and services.

6.3 Task 3b - DCS Tier 3 GTMS/ITSM Processing

Within one working day, annotate on the GTMS Tier ticket a status update 95% of the time.

Weekly inspection of deliverable products and services.

6.3 Task 3b - DCS Tier 3 GTMS/ITSM Processing

6.4 Task 4 - DCS Training and Service Desk Support

6.5 Task 5 - Enterprise Collaboration Open Services Support (Optional)

6.6 Task 6 - DCS Developmental and Operational Support (Optional)

6.6.1 Subtask 6.1. DCS Developmental Support

Ensure any Plan of Action and Mitigation (POA&M) are resolved within on or before the date of the Government approved POA&M 85% of the time.

Each deliverable will be reviewed.

6.6.1 Subtask 6.1. DCS Developmental Support

Apply full SDLC processes to the development effort 85% of the time.

Each deliverable will be reviewed.

6.6.1 Subtask 6.1. DCS Developmental Support

Apply Capability Maturity Model Integration (CMMI) Level 3 processing to the development effort.

Each deliverable will be reviewed.

6.6 Task 6 - DCS Developmental and Operational Support

Ensure modifications to support Information Assurance Vulnerability Management (IAVM) are corrected on or before the designated suspense date 90% of the time.

Each deliverable will be reviewed.

Performance occurs with no required re-performance or re-work at least 80% of the time. Problems that occur are minor and are resolved in a satisfactory manner Each deliverable will be reviewed.

8. Incentives. The Government will positively and/or negatively review the contractor's performance based on the success or failure in meeting Quality Assurance Surveillance Plan objectives. The contractor is incentivized to earn favorable Government reviews to support continuation of DISA work and to support contract awards with other Government agencies seeking DISA's input on the contractor's past performance and the Contract Performance Assessment Reporting System (CPARS). Failure to meet the acceptable quality levels may result in an unsatisfactory past performance report by the Government.

9. Place of Performance and Hours of Operation. Contract performance shall be a combination of Contractor-provided facilities performing unclassified work and all classified work being performed at DISA facilities at DISA HQ, 6910 Cooper Ave, Ft. Meade, MD 20755-7088. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of this PWS.

0. Local Travel. Travel will be considered local travel within 50 miles of the individual’s main place of performance/duty station and will not be reimbursed. Local travel within the National Capital Region (NCR), to other than DISA HQ, is very limited. The government shall not reimburse for local travel between the contractor facility (or facilities) and the DISA facility at Ft. Meade, MD.

0. Temporary duty (known as TDY) Travel. Any Government-approved long-distance travel or TDY travel will be a cost-reimbursable direct cost to the resultant contract, and will require pre-approval by the COR. All TDY must be approved in writing by the COR prior to its execution.

0. Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer, contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the KO or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

0. Contractor personnel shall provide coverage for all associated contract services for eight hours a day, between 0630 to 1700 ET Monday – Friday (except holidays). Exceptions to this requirement may be granted via written request from the contract program manager to the Contracting Officer (KO) and/or Contracting Officer Representative (COR). Until written authorization is received from the KO and/or COR, no changes to the work schedule is permitted.

The only exception is Tier 1 support which will require 24X7 support.

0. The contractor will be required to participate and travel to designated locations for coordination, on-site conferences.

0. The contractor is responsible to obtain and pay for any regulatory approvals. This includes initial fee and annual fees for technical assistance agreements, personnel certifications, and any other contractor certifications.

0. If authorized in the Task Order, travel will be reimbursed at actual cost in accordance with the limitations set forth in FAR Subpart 31.205-46, Travel Costs. Profit shall not be applied to travel costs. To the extent authorized by the Task Order, Contractors may apply indirect costs to travel in accordance with the Contractor’s usual accounting practices consistent with FAR 31.2. The OCO must identify a not-to-exceed travel ceiling under a separate CLIN on the Task Order.

10. Period of Performance /ordering period. This single award IDIQ is for a five year ordering period. Orders may be issued against the IDIQ up until the last day of the ordering period. As directed by the Contracting Officer, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254. Contract Security Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User Responsibilities – Basic User

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change 02 May 2016

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore the company must have a final Secret Facility Clearance from the Defense Security Service Facility Clearance Branch.

11.2 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance and interim or final IT-level eligibility delineated in the table below when performance starts.

Secret Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to SIPR Required

Secret Final

IT– I

Tasks and deliverables require access to live systems within the environment

Secret Final

IT– I

Incident investigation will require access to live systems within the environment

Secret Final

IT–II

Some of the standards being worked on in this task are classified Secrete. Access to SIPR Required.

Secret Final

IT– I

Integration of services will require access to live systems within the environment

Task 6.6.1

Final Secret Final

IT– I

Patching of systems will require access to the live environment

Secret Final

IT– I

Requires the contractor to access DCS systems on NIPRNet and SIPRNet for the purposes of managing and configuring DCS systems, managing and configuring DCS cloud environments, and understanding and assisting lower tiers in application of cybersecurity controls.

Secret Final

IT– I

Access to reporting environment is require to complete tasks

Secret Final

IT– I

Access to reporting environment is require to complete tasks

Secret Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to SIPR Required

Secret Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to SIPR Required

Secret Final

IT– I

Infrastructure issues will require access to the live environment

Secret Final

IT– I

Tech refresh activities will require access to the live environment

Secret Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to SIPR Required

Secret Final

IT– I

Implementation of services will require access to the live environment

Secret Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to SIPR Required

Secret Final

IT – I

Tiered support will require access to the live environment.

11.3 Investigation Requirements. All personnel requiring IT-I access under this contract/order shall undergo a favorably adjudicated Tier 5 (T5) investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. The T5 will be maintained current within 6-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or Phased Periodic Reinvestigation (PPR)) will be initiated prior to the 6-year anniversary date of the previous Tier 5.

11.3.1 Investigation Requirements. All personnel requiring Secret or IT-II access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

11.3.2 IT-I access. Contractor personnel that do not meet the investigative requirements for Privileged IT1 access may be granted interim access by the DISA Personnel Security Office (MP62) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated.