12__PWS_Task_Order_0001.pdf

PERFORMANCE WORK STATEMENT (PWS)

As of 14 May 14, 2019

Defense Collaboration Services (DCS)

Solicitation Number HC1047-19-R-4005

Task Order 0001

1. Task Order - Defense Collaboration Services (DCS) Sustainment Support – Task Order 0001.

2. Contracting Officer’s Representative (COR)

See section H1 of contract “Points of Contact”

3. Background. Defense Information Systems Agency provides Defense Collaboration Services (DCS) as an unified real time enterprise collaboration capability that delivers secure web conferencing and instant messaging services on Secret Internet Protocol Router Network (SIPRNet), Sensitive but

Unclassified Internet Protocol Network (NIPRNet), and internet (via NIPRNet). This critical enterprise service regularly serves 150K monthly web conference users and 20K concurrent daily chat users on

NIPRnet. With DCS, DISA promotes and fosters a Joint information collaborative environment with a high quality and cost effective services to improve workflow productivity. DCS capabilities are built on open source solution and provides:

o Collaboration Portal: Social media and collaboration features, links and training info, and real time communications via XMPP chat messages.

o Web Conferencing: Browser-based web conference sessions that provide users with the capability to host presentations, record sessions, share desktops, white-board with all session participants, call into a session from their phone, view closed captioning, chat among session participants, and participant voting in session polls.

o Instant Messaging (Desktop and Mobile Apps): Persistent chat rooms, Multi-User Chat

(XEP-0045, XEP-0369), one-to-one chat, presence, chat history search, chat user search, chatbots, and administration functions.

o File Transfer: Secure transfer of files for DoD enterprise users.

o Voice Conferencing: Voice conference bridge capability that is accessible to all DoD enterprise users.

4. Objectives: The objective of this contract is to provide DCS engineering and sustainment support to improve and maintain the service. DCS support contract includes managing and maintaining the applications, servers and supporting infrastructure on both the DISA NIPRNet and SIPRNet. The contract personnel should have requisite knowledge of DoD enterprise architectures, networks, frameworks, systems, process, and data requirements. Additionally, the technical contractual personnel should have expert knowledge of Web services, Open source components and trends, DoD integration and networks, DoD engineering and sustainment procedures and processes to deliver a real time enterprise collaborative service to a large customer base.

This includes continuously assessing the DCS security posture leading to and maintaining a current security authorization that meets the criteria of the DoD Risk Management Framework (RMF). This

PWS delineates Contractor support in assuring the DCS information system, technology and components are secured according to the applicable security requirements, directives, and regulations and meet all applicable DoD and Non-DoD Information Assurance (IA) security requirements in accordance with

(IAW) the DoDD 8140, DoD 8510 (RMF), and DoD 8570.01-M. Because of the complexity of DCS engineering and sustainment functions, Capability Maturity Model Integration (CMMI) Services (CMMI-

SVC) Level 3 (or better) and Capability Maturity Model Integration (CMMI) Development (CMMI-

DEV) Level 3 (or better) are required. With rapidly evolving technologies, budget uncertainty, constant customer requirements, and fierce competition, DISA needs to manage these areas closely and continuously seek new, innovative, and effective ways to optimize and improve the DCS service. To better serve DOD and its Mission Partner customers, DCS program office has to continue DevOps methodologies to manage infrastructure deployments, technology refreshes, and customer requirements.

5. Scope. Task Order 0001 is for the sustainment for DCS service. Task Order 0001 consists of the following tasks from the base ID/IQ: 1- program management, 3 - Tier 3 support, 4 - training and subject matter expert support, 6.2- sustainment engineering, 7 - sustainment tool development and integration, and 9 - information assurance support. . This task requires the day to day management of the schedule and performance of the all supported tasks from the vendor perspective. This tasks calls for formation of a tier III that will perform high level troubleshooting, fault isolation, and incident mitigation for all parts of the service; as well as the engineering support to facilitate incident mitigation. This tasks requires the vendor provide training in the form of documentation, live, and recorded training for the service in its entirety. The vendor will also be required to develop, deploy, and sustain event management, logging, and reporting tools. This task calls for information assurance personnel who can deliver reports and provide service in line with the risk management framework.

6.0 Work to Be Performed – The following subsections align to the base ID/IQ section 6. Each subsection provides specific details for the performance of task order 0001. Only the task areas that are required for each specific task orders will be defined in this section. If a task area of the ID/IQ is not part of this task order, it will be noted as “Reserved.”

6.1 Task 1 - Task Order (TO) Management

This task provides project management support to manage DCS service.

Contractor shall:

a. Provide a weekly status report for the tasks and subtasks by monitoring for quality assurance, progress/status reporting and program reviews applied to the task order. The report shall include:

Task name, description, accountable team members, and projected start and end dates.

Task issues and action items and description of issue/action

Upcoming Activities

b. The contractor shall update the Task Order Management Plan to include the management of this task and describing the technical approach, organizational resources and management controls to be employed to meet performance and schedule requirements of this task.

c. Deliver an Integrated Master Schedule (IMS) to define the work projections throughout Task Order

(TO) execution updated monthly.

d. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

Deliverables:

PWS

Task#

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due Date

6.1 Weekly Status

Report

The report shall include

Assigned projects of each staff member and

MS Project or as specified by government

Standard

Distribution*

Every Friday

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due Date the sections described as follows:

1. Tasks for projects detailing the task name, accomplishments description, and the responsible team members assigned to complete the task and projected start and end dates.

2. Issues and action items detailing task name, description of issue/action

3. Upcoming Activities

6.1 Task Order

Management

Plan

Prepare a Task Order

Management Plan describing the technical approach, organizational resources and management controls to be employed to meet performance and schedule requirements.

Contractor-

Determined

Format

Standard

Distribution*

Draft 15 days after contract award.

Final 30 days after contract award updated annually.

6.1 Integrated

Master

Schedule (IMS)

Prepare an Integrated

Master Schedule (IMS) to define the work projections throughout

Task Order (TO) execution

MS Project Standard

Weekly: COB Friday

6.2 Reserved

6.3 Task 3 - DCS Tier 3 Support

To provide Tier 3 support for the DCS application for the next 12 months. Interface with the supporting Tiers (2 and 4) in an effort to assess the infrastructure and resolve the respective incident or problem tickets. The annual historical average of incident tickets is 380 incident tickets with a monthly closure of on average of 20 tickets per month. To support this task:

a. The contractor shall attain and maintain an IT level II qualification DoD 8570.01-M to perform this task.

b. The contractor shall utilize DISA Global Ticket Management System (GTMS) on the SIPRNet, and IT

Service Management (ITSM) on the NIPRNet, in order to:

Access and review all Tier 3 Incident Tickets and Problem Tickets assigned to their group daily.

Within one working day, accept, analyze, and annotate on the GTMS or ITSM Tier ticket a status update.

Identify the root cause of incident and resolve within five working days.

Unresolved incidents will be added to Forge for tier four support within five working days.

Ensure all incident tickets in the Tier 3 queue have updates every three working days.

Ensure 100% of the monthly incident tickets for Tier 3 are opened, reviewed, and annotated within the defined ITSM/GTMS metrics for incident priority.

Ensure 100% of the active incident tickets for Tier 3 are updated weekly.

Ensure 90% of the monthly incident tickets for Tier 3 are either closed, escalated to Tier 4, or de-escalated to Tier 2 quarterly.

c. The contractor shall summarize and track/update DCS issues escalated in GTMS in Forge.mil on a weekly basis.

d. The contractor shall use Software Forge in order to submit Software Forge artifacts and update them as required.

e. The contractor shall troubleshoot all issues escalated to Tier 3 and discuss with designated service manager before escalating to Tier 4.

f. The contractor shall apply Capability Maturity Model Integration (CMMI) Services (CMMI-SVC) Level 3

(or better) to engineering efforts in support of the operation of DCS services where applicable.

g. The contractor shall insert all summarized issues escalated to Tier 3 in Forge and where necessary, use

Forge to escalate tickets to Tier 4.

h. The contractor shall provide the Government a Weekly Tier 3 Ticket Report that identifies the:

Total Incident Tickets and their current status in the Tier 3 Queue

Total Problem Management Tickets in the Tier 3 Queue and the number of associate incident

Tickets

Total Number of Incidents Tickets Opened

Total Incident Tickets that are older than 10 working days old

Total Number of Incidents Tickets Updated

Total Number of Incidents Tickets Escalated to Forge

Total Number of Incidents Tickets deescalated to Tier 2

Total Number of Incidents Tickets Closed

Deliverable(s):

PWS

Task#

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due

Date

6.3 Weekly Tier 3

Ticket Report

Provide the

Government a Weekly

Tier 3 Ticket Report that identifies the:

Total Incident

Tickets in the Tier

3 Queue

Total Problem

Management

Tickets in the Tier

3 Queue and the number of associate incident

Tickets.

Total Number of

Incidents Tickets

Opened

Total Incident

Tickets that are older than 10 working days old

Total Number of

Incidents Tickets

Updated

Total Number of

Incidents Tickets

Escalated to Tier 4

Contractor-

Determined

Format

Standard

Weekly

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due

Date

Total Number of

Incidents Tickets deescalated to Tier

Total Number of

Incidents Tickets

Closed

6.3 Weekly

Service

Operational

Report

Detailed summary of new and ongoing troubleshooting status report (customer, issue, resolution)

Contractor-

Determined

Format

Standard

Distribution*

Weekly

6.3 Software

Forge Updates

Incidents, technical issues, and updates via Software Forge

Software

Forge Format

Standard

6.4 Task 4 - DCS Training

This task is to provide live and recorded training to the DCS community for the next 12 months. Training is conducted primarily on NIPRNet using DCS. The training sessions average 40 participants for DCS Basic Training, 25 for DCS Advanced, and 60 for Swift and Transverse Chat Client training.

The contractor shall:

Develop, present, and update the DCS live training and the DCS recorded video presentations. To perform this subtask the contractor shall:

a. Conduct Basic DCS conferencing training twice a week utilizing current DCS material.

b. Conduct Advanced DCS conferencing training twice a week utilizing DCS Deskshare.

c. Conduct Swift Chat Client training once a week utilizing DCS Deskshare and the Swift Chat Client

d. Develop, update quarterly, and maintain currency of all DCS Training Presentations.

e. Develop, update quarterly, and maintain training scripts to develop DCS Training Videos.

Record and make available DCS Basic, Advances, and Chat Client training videos in the Government-designated Visual Information facilities updated quarterly.

Deliverables(s):

Task#

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due Date

6.4 Training

presentations in

MS PowerPoint

(Basic and

Advanced

Training) for all

DCS

capabilities.

Develop, update, and maintain currency of all

DCS Training

Presentations.

MS

PowerPoint

Standard

Distribution* updated at least quarterly; but not more than quarterly

6.4 Presentation

scripts for

Audio/Video recordings of

Basic, Advanced, and

Develop, update, and maintain training scripts to develop DCS Training

Videos

MS Word Standard

Distribution* updated at least quarterly; but no more than monthly

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due Date

Chat Client

Training

6.4 DCS Training

Videos

Record DCS Basic, Advances, and Chat

Client training videos in the Government-designated Visual

Information facilities updated quarterly.

MP4 or MOV formats

Standard

Distribution* updated at least bi annually; but not more than quarterly

6.4 DCS

Information

Portal updated monthly

Provide content management of the information on the DEPS

DCS Information Portal on the NIPRNet and

SIPRNet.

Contractor-

Determined

Format

Standard

Distribution*

Weekly

6.4 DCS FAQ, Did

you know articles, Best

Practices, Lessons

Learned, quick start guides

Provide a review and update FAQ, Did you know articles, Best

Practices, Lessons

Learned, quick start guides

Contractor-

Determined

Format

Standard

Distribution* updated at least monthly

; but not more than weekly

6.5 Reserved

6.6 Task 6 - DCS Integration and Operational Support

6.6.2 Subtask 4.2. DCS Operational Support

This subtask is to provide dedicated operational support (Tier 4) for DCS and ensure that the DCS application(s) and

Virtual Operating Environments (VOEs) are managed, configured, sustained, and monitored during the lifecycle of the DCS program to ensure service availability & optimal performance for DCS. DCS VOE’s include Staging, Pre-

Production, and Production VDCs on NIPRNet and SIPRNet. The average escalations of incident tickets from Tier 3 to Tier 4 are 10 per month.

a. Provide operational support (Tier 4) for the current and pending DCS capabilities to provide a high quality customer service on the following:

Infrastructure and optimizations

Mil 2.0 or AWS transition

Shared services optimizations - F5, OCSP, EASF, and DNS

Infrastructure/Client/server optimizations - NGINX, RED5, REDIS, MySQL, Free Switch, TOMCAT, SWIFT, Openfire, containerization to include Kubernetes and Openshift, multi-site cross site interactions

Tech Refreshes

Ensure full capability performance of HTML5 on DCS

Core updates to the portal, WC, and chat components to include software and enhancements

Open source component upgrades to include Web conference and Chat Component upgrades, Web conference and Chat Component Upgrades – As required (24 times a year), Open Source technology SW (12 per year), Software Updates – approximately 5 per month (60 per year), Feature Enhancements approximately 2 per month (24 per year), Enhancements that benefit the customer user experience

Unified capabilities (voice, video, chat)

Voice integration for web conference

Five Eyes (FVEY) Classified Environment chat

Mobility (web conference, XMPP chat Native App)

Enterprise chat federation and protocol converter (SylkServer, Nextplane)

Disconnected Intermittent Low Bandwidth

Regional DCS.

b. Provide dedicated Tier 4 support to Tier 3 and Tier 2 daily to troubleshoot DCS issues documented in

Forge on NIPRNet and SIPRNet.

c. Manage, configure, and monitor the DCS Virtual Operating Environments (VOEs) associated with the DCS

Staging, Pre-Production, and Production VDCs on NIPRNet and SIPRNet.

d. Manage, configure, and monitor the DISA Milcloud Virtual Data Center (VDC) configured for DCS on the

NIPRNet and SIPRNet.

e. Coordinate with DCS Tier 2 to apply the necessary Cybersecurity controls, Enterprise Systems

Management (ESM) tools, and Security Technical Implementation Guidance (STIG) controls.

f. Hand-off the validated Pre-Production application to the production deployment via the TRB process.

g. Ensure every change to an application component has a document location for immediate roll-back.

h. For each quarterly developmental upgrade or update, receive, deploy, and test the deliverable code from the development stage into the Milcloud staging enclave. Upon successful testing, move the code to the

Milcloud pre-production VDCs for Cybersecurity hardening. Provide test and hardening results to the PM prior to production delivery.

i. Document and provide meeting minutes of the weekly Technical Review Board (TRB) to the TRB facilitator.

j. Provide a monthly Change Management tracking and status report (that documents any changes to any of the deployed application components and the status of the roll-back capability.

k. Update Software Forge artifacts and submit software code and deliverables via designated software development management platform (e.g. Software Forge)

l. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and

CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

m. Provide a monthly Status, Health and Configuration report on following:

DCS Milcloud hosting environment.

F5 Load balancer

Openfire Chat Servers

DECC Firewall and Routers

Primary and Secondary Mirroring

Primary and Secondary Roll-Back Capability

HAZCON Status

Approved RFCs in the queue, and processed

Recording and processing Servers

NAS thresholds

MilCloud Storage Thresholds

IAVA Compliance

Deliverable(s):

Deliverable

Title

Minimum Requirements Format Distribution/

Copies

Submission Due Date

6.6.2 Pre-Deployment

Testing Results

For each developmental upgrade or update, receive, deploy, and test the deliverable code from the development stage into the Milcloud

Staging and pre-production VDCs for

DCS. Provide test results to the PM prior to production delivery.

Contractor-

Determined

Format

Standard

Distribution*

Draft 5 Days after each testing event.

Final 15 Days after each testing event.

6.6.2 Weekly Change

Management

Tracking and

Status report

Provide a weekly Change

Management tracking and status report that documents any changes to any of the deployed application components and the status of the roll-back capability.

Contractor-

Determined

Format

Standard

Distribution*

Weekly

6.6.2 Software Forge

Updates

Updates to Software

Forge Artifacts, Task, and repositories

Software

Forge format

N/A Weekly

6.7 Task 7 - DCS Service Analysis and Situational Awareness Capability

This task is to evaluate, develop, and deliver Service Analysis and Situational Awareness tools that can be used by operational support elements to assess the visibility, health and stability of the DCS application environment and the support infrastructure and to provide near real-time Situational Awareness of their DCS Conference, Chat Session, or infrastructure stability. The contractor shall develop, modify and deliver net ops tools for new DCS capabilities in terms of infrastructure, tech refreshes, and customer enhancements:

There are two tasks: Integration and Sustainment:.

6.7.1 Subtask 7.1 DCS Service Analysis integration

The focus of this subtask is to develop and maintain the DCS Service Analysis capabilities. The development environment is the responsibility of the contractor. DCS uses the following tools and applications to manage the development portion of the Service Analysis and Situational Awareness Development effort:

Nagios XI

Elasticsearch, Logstash, & Kibana (ELK Stack)

Simple Network Management Protocol (SNMP)

Rsyslog

To support the integration of Service Analysis and Situational Awareness tools, the following elements are considered to be key components.

Internet Protocol (IP) networks (IPV4 and IPV6)

Firewalls, Routers, and Switches

Virtual Infrastructures (VMWare)

Network Attached Storage

Storage Area Networks

Active Directory / Domain Controllers

Virtual Private Networks

F5 Load Balancers

a. Develop level-of effort (LOE) assessments on development efforts to support each of the developmental tasks.

b. Develop and deliver net ops tools for current and existing DCS capabilities:

Infrastructure and optimizations

Mil 2.0 or AWS transition Shared services optimizations - F5, OCSP, EASF, and DNS

Infrastructure/Client/server optimizations - NGINX, RED5, REDIS, MySQL, Free Switch, TOMCAT, SWIFT, Openfire, containerization to include Kubernetes and Openshift, multi-site cross site interactions

Tech Refreshes

Fully HTML5 capable DCS

Core updates to the portal, WC, and chat components to include software and enhancements

Open source component upgrades to include Web conference and Chat Component upgrades, Web conference and Chat Component Upgrades – As required (24 times a year), Open Source technology SW (12 per year), Software Updates – approximately 5 per month (60 per year), Feature Enhancements approximately 2 per month (24 per year), Customer Enhancements

Unified capabilities (voice, video, chat)

Voice integration for web conference

Five Eyes (FVEY) Classified Environment chat

Mobility (web conference, XMPP chat Native App)

Enterprise chat federation and protocol converter (SylkServer, Nextplane)

Disconnected Intermittent Low Bandwidth

Regional DCS.

c. Update Software Forge artifacts and submit software code and deliverables via designated software development management platform (e.g. Software Forge)

d. Develop and/or integrate the DCS Service Analysis tools with changes in infrastructure, tech refresh, customer requirements, and other modifications. Update DCS Service Analysis tools on an semi-annual basis and modify tools to ensure that tools monitor the current DCS architecture on an as needed basis.

e. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and

CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

f. Develop required documentation to support the developmental tasks to include:

Update the Systems Interface Description (SV1) and Operational View (OV-1) architecture quarterly to define how each solution will interface with the existing infrastructure on monthly basis.

For each quarterly software release, develop Test plans and deliver results designed to validate and support the tool deployment to include technical testing, and regression testing when appropriate.

Conduct a Limited User Testing (LUT) with each quarterly SW upgrade and provide the results of each LUT to the Government to validate wider testing and implementation.

Deliverable(s)

Deliverable

Title

Minimum Requirements Format Distribution/

Copies

Submission Due Date

6.7.1 Developmental

Tasks Level of

Effort (LOE)

Develop a level-of effort

(LOE) assessments on development efforts to support each of the developmental tasks.

Contractor-

Determined

Format

Standard

Distribution*

Draft 15 days after each requirement decision

Final 30 days after each upgrade requirement decision

6.7.1 System OV-1

and SV 1

Operational View (OV-1) and System View (SV-1) of DCS System

Architecture

MS Visio and

PDF

Standard

Distribution*

Draft 15 days prior to each architecture change and final 30 days after each architecture change

6.7.1 Test Plans and

results

For each deliverable develop Test plans and deliver results designed to validate and support the tool deployment to include technical testing, and regression testing when appropriate.

Contractor-

Determined

Format

Standard

Distribution*

Draft 10 Days after each deliverable

Final 20 Days after each deliverable

6.7.1 LUT and Results Conduct Limited User

Testing (LUT) and provide the results of each LUT to the

Government to validate wider testing and implementation.

Contractor-

Determined

Format

Standard

Distribution*

Draft 10 Days after each

LUT event

Final 20 Days after each

LUT event

6.7.1 Formal Software

Development

Processes

Formal Software

Development Processes documentation

Format

Standard

Distribution*

Annually

6.7.1 Baseline

Requirements

Management processes

Baseline Requirements

Management processes

Format

Standard

Distribution*

Annually

6.7.1 DOORS New

Requirements

Documentation

DOORS New

Requirements

Format

Standard

Distribution*

As requested

6.7.1 Updated DCS

Platform

Architectural

Updated DCS Platform

Architectural

MS Visio, MS

Word, and PDF as directed.

Standard

Distribution*

Monthly

6.7.1 DCS Integrated

Software modules [24 upgrades and 60 updates per year]

DCS Integrated Software modules (e.g. rpms, Ansible Playbooks) [24 upgrades and 60

Rpms, Ansible

Playbooks

Software Forge and as otherwise directed.

Twice Monthly

6.7.2 Subtask 7.2 DCS Service Analysis - Sustainment

The focus of this subtask is DCS service analysis sustainment. DCS uses the following tools and applications to manage the development portion of the Service Analysis and Situational Awareness Development effort:

Nagios XI

Elasticsearch, Logstash, & Kibana (ELK Stack)

Simple Network Management Protocol (SNMP)

Rsyslog

a. Monitor DCS servers and associated IaaS components on the NIPRNet and SIPRNet using the Nagios and

ELK tools.

b. Maintain & configure DCS Service Situational Awareness/NetOps tools per direction of DCS NetOps

Development.

c. Maintain close communication with DCS Tier 2, Tier 3, and Tier 4, and DCS NetOps Development.

d. Provide direct support to DCS Tier 2 and Tier 3, the DISA NetOPs and the DISA Command Center (DCC).

e. Utilize government provided monitoring tools to maintain the visibility, health, and security of all DCS servers, infrastructure components, and application stability.

f. Apply Capability Maturity Model Integration (CMMI) Development (CMMI-DEV) Level 3 (or better) and

CMMI Services (CMMI-SVC) Level 3 (or better) to engineering efforts in support of development and operation of DCS services where applicable.

g. Participate in DISA Operations Meetings weekly to provide status and health of DCS to DISA NetOPs.

h. Provide a weekly Performance Analysis Report that addresses the following:

Health and stability of the network routers and firewalls supporting the DCS infrastructure

Health and stability of the F5 Application Load Balancers supporting the DCS infrastructure

Health and stability of the Milcloud Virtual Data Centers (VDCs) supporting the DCS infrastructure

Health and stability of the Staging, Pre-Production, and Production VDCs supporting the DCS infrastructure

Health and stability of all of the Virtual Operating Environments (VOEs) is each of the Milcloud VDC

Validation of the mirroring of the primary DCS site to the failover site

Readiness of secondary DCS site to fail over if needed

6.7.1 Test Plans and

Results

Test Plans and Results

Format

Standard

Distribution*

With each software deliverable

6.7.1 Request For

Change (RFCs)

Request For Change

(RFCs) to be reviewed by the DCS Technical

Review Board (TRB)

Meeting

As Directed Standard

Distribution*

Weekly

6.7.1 Updates via

Software Forge

Updates via Software

Forge

Software

Forge Format

Standard

Distribution*

Weekly

6.7.1 Static Code

Analysis

Reports

Static Code Analysis

Reports

Format

Standard

Distribution*

With each deliverable as directed.

Deliverable

Title

Minimum Requirements Format Distribution/

Copies

Submission Due Date

6.7.2 Metrics Report DCS Metrics Report on

System Metrics as determined by DCS PMO

As directed Standard

Distribution*

Weekly, Monthly, and as requested

6.7.2 DCS Status, Health, and

Configuration

Report (updated

Monthly)

DCS Status, Health, and

Configuration Report

(updated Monthly)

Format

Standard

Distribution*

Weekly and monthly

6.7.2 Weekly

Performance

Analysis Reports for DCS on

NIPRNet and

SIPRNet

Provide a weekly

Performance Analysis

Report that addresses the following:

Health and stability of the network routers and firewalls supporting the DCS infrastructure

Health and stability of the F5 Application

Load Balancers supporting the DCS infrastructure

Health and stability of the Milcloud Virtual

Data Centers (VDCs) supporting the DCS infrastructure

Health and stability of the Staging, Pre-

Production, and

Production VDCs supporting the DCS infrastructure

Health and stability of all of the Virtual

Operating

Environments (VOEs) is each of the Milcloud

VDC

Validation of the mirroring of the primary DCS site to the failover site

Readiness of secondary DCS site to fail over if needed

Format

Standard

6.8 Reserved

6.9 Task 9 – Cybersecurity Support

This task is to provide support to the DCS Program to ensure all Cybersecurity requirements are met and required security controls are selected and implemented to maintain compliance with the DoD RMF. This is a support task and any deliverables are government generated artifacts that require input and completion on the part of the contractor. Paramount to this task is having the necessary Cybersecurity expertise to advise and support the

Government Information System Security Manager (ISSM) with required RMF tasks.

The contractor shall:

a. Ensure all contractors supporting this task are DoDD 8140-IAM Level 2 Certified Professionals.

b. Research and validate compliance with applicable DoD/DISA Cybersecurity requirements, directives, regulations, and US Laws.

c. Be required to function on both the classified and unclassified networks.

d. Support the utilization of the automated validation capabilities of the Enterprise Mission Assurance Support

Service (eMASS) for preparation of the RMF Package.

e. Develop and maintain the RMF package quarterly which includes:

Maintaining the DCS system artifacts.

Assigning security controls based on the DCS system categorization as required by DoDI 8500.01 and

DoDI 8510.01, CNSS 1253 and NIST SP 800-60, Volume II.

Ensuring the DCS system is properly registered in eMASS

Initiating and maintaining the RMF System Security Plan (SSP).

f. Implement and validate assigned security controls which include:

Execution of the SSP.

Conducting RMF validation activities.

Compile the status of the validation results in the RMF Scorecard.

g. Develop and maintain the supporting Assessment and Authorization (A&A) which include:

Risk Assessments

Contingency Plan

Plan of Actions and Milestones (POA&M)

Other artifacts associated with implementing security controls, etc. as required for the RMF.

h. Draft a POA&M for any authorization decision that requires corrective action.

i. Develop and maintain the System Security Plan (SSP) annually that provides a systematic approach and techniques for protecting the application environment from being used by unauthorized users, guards against worms and viruses as well as any other incident/event/process that can jeopardize the underlying system’s security.

j. Provide security engineering to the Government and support assessment and authorization (A&A activities related to the DCS System).

k. Update any Cybersecurity databases as required or directed by DoD/DISA policies.

l. Submit and update IA related artifacts in softwareforge.

m. Manage and maintain the DCS Assessment and Authorization (A&A) process monthly required to sustain

DoD/DISA compliance standards IAW the DoD RMF and in compliance with DoD 8500 series publications.

n. Manage the DCS IAVM (Information Assurance Vulnerability Alert (IAVAs)/ Information Assurance

Vulnerability Bulletin (IAVBs)) management process as determined by the Government.

o. Support the preparation and documentation of Cybersecurity assessments of the DCS system and assets for all security and/or certification visits in the Command Cyber Readiness Inspection (CCRI) Federal

Information Security Modernization Act (FISMA) discrepancies. Assessment tasks include:

Auditing and reporting of the DCS system

Documentation

Security control compliance

DoD 8570.1-M compliance requirements

IAVM which include IAVAs/IAVBs), and STIG/SRG compliance.

p. Coordinate and provide Cybersecurity input on matters related to

STIG compliance

IAVA Testing and compliance

Assured Compliance Assessment Solution (ACAS) and Fortify Scans, and Penetration Test results

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due Date

6.9 DCS RMF

Package

Quarterly

Updates

Develop and maintain the RMF package quarterly which includes:

• Maintaining the DCS system artifacts.

• Assigning security controls based on the

DCS system categorization as required by DoDI

8500.01 and DoDI

8510.01, CNSS 1253

and NIST SP 800-60, Volume II.

• Ensuring the DCS system is properly registered in eMass

• Initiating and maintaining the RMF

System Security Plan

(SSP).

Contractor-

Determined

Format

Standard

Distribution*

Draft 60 days after contract award

Final 90 days after contract award, updated quarterly

6.9 DCS System

Security Plan

Annual Updates

Develop and maintain the System Security

Plan (SSP) annually that provides a systematic approach and techniques for protecting the application environment from being used by unauthorized users, guards against worms and viruses as well as any other incident/event/proces s that can jeopardize the underlying system’s security.

Contractor-

Determined

Format

Standard

Distribution*

11 months from award, updated annually

Deliverable

Title

Minimum

Requirements

Format Distribution/

Copies

Submission Due Date

6.9 A&A Process

Monthly

Updates

Manage and maintain the DCS Assessment and Authorization

(A&A) process monthly required to sustain

DoD/DISA compliance standards IAW the DoD

RMF and in compliance with DoD 8500 series publications.

Contractor-

Determined

Format

Standard

Distribution*

30 days from contract award, updated

Monthly

6.9 Weekly IAVM

report

Weekly IAVM report Contractor-

Determined

Format

Standard

Distribution* weekly

6.9 DCS change

requests

DCS change requests for new capabilities

Contractor-

Determined

Format

Standard

As requested

6.10 Reserved

6.11 Reserved

6.12 Reserved

6.13 Reserved

6.14 Reserved

6.15 Reserved

6.16 Reserved

7. Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Method of Surveillance

6.1 Task 1 - Task Order

(TO) Management

Materials contain required information and are delivered on time at least 95% of the time.

Revisions that occur are minor and are resolved.

Each document will be reviewed.

6.2 Task 2 - DCS

Engineering Support

Performance occurs with no required re-performance or re-work at least 85% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Each deliverable will be reviewed.

6.3 Task 3 - DCS Tier

3 Support at least 95% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Weekly inspection of deliverable products and services.

6.3 Task 3b - DCS Tier

3 GTMS/ITSM

Processing

Access and review all Tier 3

Incident Tickets and Problem

Tickets daily 95% of the time.

Weekly inspection of services.

6.3 Task 3b - DCS Tier

Within one working day, annotate on the GTMS Tier ticket a status update 95% of the time.

Weekly inspection of services.

6.3 Task 3b - DCS Tier

Ensure all incident tickets in the tier 3 queue have updates every 30 days 95% of the time.

Weekly inspection of deliverable products and services.

6.3 Task 3b - DCS Tier

3 GTMS/ITSM

Processing

Ensure 95% of the monthly incident tickets for Tier 3 are opened and reviewed.

Weekly inspection of deliverable products and services.

4.3 Task 3b - DCS Tier

3 GTMS/ITSM

Processing

Ensure 95% of the monthly incident tickets for Tier 3 are updated

Weekly inspection of deliverable products and services.

6.3 Task 3b - DCS Tier

3 GTMS/ITSM

Processing

Ensure 95% of the monthly incident tickets for Tier 3 are either closed, escalated to Tier 4, or de-escalated to Tier 2

Weekly inspection of deliverable products and services.

6.4 Task 4 - DCS

Training and Service

Desk Support at least 80% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Weekly inspection of deliverable products and services.

6.5 Task 5 - Enterprise

Collaboration Open

Services Support

(Optional) at least 85% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Each deliverable will be reviewed.

6.6 Task 6 - DCS

Developmental and

Operational Support

(Optional) at least 85% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Each deliverable will be reviewed.

6.6.1 Subtask 6.1. DCS

Developmental Support

Ensure any Plan of Action and

Mitigation (POA&M) are resolved within on or before the date of the

Government approved POA&M

85% of the time.

Each deliverable will be reviewed.

Apply full SDLC processes to the development effort 85% of the time.

Apply Capability Maturity Model

Integration (CMMI) Level 3 processing to the development effort.

8. Incentives. The Government will positively and/or negatively review the contractor's performance based on the success or failure in meeting Quality Assurance Surveillance Plan objectives. The contractor is incentivized to earn favorable Government reviews to support continuation of DISA work and to support contract awards with other

Government agencies seeking DISA's input on the contractor's past performance and the Contract Performance

Assessment Reporting System (CPARS). Failure to meet the acceptable quality levels may result in an unsatisfactory past performance report by the Government.

9. Place of Performance and Hours of Operation. Contract performance shall be a combination of Contractor-provided facilities performing unclassified work and all classified work being performed at DISA facilities at DISA

HQ, 6910 Cooper Ave, Ft. Meade, MD 20755-7088. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of this PWS.

a. Local Travel. Local travel within the National Capital Region (NCR), to other than DISA HQ, is very limited. Local Travel will not be reimbursed. The government does not intend to reimburse for local travel between the contractor facility and the DISA facility at Ft. Meade, MD.

b. Temporary duty (known as TDY) Travel. Any Government-approved long-distance travel or

TDY travel will be a cost-reimbursable direct cost to the resultant contract, and will require pre-approval by the COR. All TDY must be approved by the COR prior to its execution.

c. Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer, contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are

6.6 Task 6 - DCS

Developmental and

Operational Support

Ensure modifications to support

Information Assurance

Vulnerability Management (IAVM) are corrected on or before the designated suspense date 90% of the time.

4.7 Task 7- DCS

Service Analysis and

Situational Awareness

Capability

Materials contain required information and are delivered on time at least 90% of the time.

Revisions that occur are minor and are resolved in a satisfactory manner.

Each deliverable will be reviewed.

6.9 Task 9 –

CyberSecurity Support

(Optional)

Materials contain required information and are delivered on time at least 95% of the time.

Revisions that occur are minor and are resolved in a satisfactory manner.

Performance occurs with no required re-performance or re-work at least 80% of the time. Problems that occur are minor and are resolved in a satisfactory manner impacted, reduced, compromised, etc., the KO or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

d. Work Hours. Core business hours, Monday through Friday. Only exception is Tier 1 support which will require 24X7 support.

e. The contractor will be required to participate and travel to designated locations for coordination, on-site conferences.

f. The contractor is responsible to obtain and pay for any regulatory approvals. This includes initial fee and annual fees for technical assistance agreements, personnel certifications, and any other contractor certifications.

g. If authorized in the Task Order, travel will be reimbursed at actual cost in accordance with the limitations set forth in FAR Subpart 31.205-46, Travel Costs. Profit shall not be applied to travel costs. To the extent authorized by the Task Order, Contractors may apply indirect costs to travel in accordance with the Contractor’s usual accounting practices consistent with FAR 31.2. The

OCO must identify a not-to-exceed travel ceiling under a separate CLIN on the Task Order.

10. Period of Performance /ordering period. This single award IDIQ is for a five year ordering period. Orders may be issued against the IDIQ up until the last day of the ordering period. As directed by the Contracting Officer, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254.

Contract Security Classification Specification. The following security requirements shall apply to this effort.

References:a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User

Responsibilities – Basic User

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change

02 May 2016

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore the company must have a final Secret Facility Clearance from the Defense Security Service Facility Clearance Branch.

11.2 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a

DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance and interim or final IT-level eligibility delineated in the table below when performance starts.

PWS Task

/ Subtask

Clearance

Level

IT Level

Access

Level of

Classified

Access

Justification for Access to

Classified

Task 6.1 Final

Secret

Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to

SIPR Required

Task 6.2 Final

Final

IT– I

Tasks and deliverables require access to live systems within the environment

Task 6.3 Final

Secret

Final

IT– I

Incident investigation will require access to live systems within the environment

Task 6.4 Final

Secret

Final

IT–II

Some of the standards being worked on in this task are classified Secrete. Access to

SIPR Required.

Task 6.5 Final

Secret

Final

IT– I

Integration of services will require access to live systems within the environment

Task 6.6.1

Final

Final

IT– I

Patching of systems will require access to the live environment

Task 6.6.2 Final

Secret

Final

IT– I

Requires the contractor to access DCS systems on

NIPRNet and SIPRNet for the purposes of managing and configuring DCS systems, managing and configuring DCS cloud environments, and understanding and assisting lower tiers in application of cybersecurity controls.

Task 6.7.1 Final

Final

IT– I

Access to reporting environment is require to complete tasks

Task 6.7.2 Final

Secret

Final

IT– I

Access to reporting environment is require to complete tasks

Task 6.8 Final

Secret

Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to

SIPR Required

Task 6.9 Final

Secret

Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to

SIPR Required

Task 6.10 Final

Secret

Final

IT– I

Infrastructure issues will require access to the live environment

Task 6.11 Final

Secret

Final

IT– I

Tech refresh activities will require access to the live environment

Task 6.12 Final

Secret

Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to

SIPR Required

Task 6.13 Final

Final

IT– I

Implementation of services will require access to the live environment

Task 6.14 Final

Secret

Final

IT– II

Some of the standards being worked on in this task are classified Secret. Access to

SIPR Required

Task 6.15 Final

Secret

Final

IT – I

Tiered support will require access to the live environment.

11.3 Investigation Requirements. All personnel requiring IT-I access under this contract/order shall undergo a favorably adjudicated Tier 5 (T5) investigation (formerly known as a Single Scope Background Investigation

(SSBI)) as a minimum requirement. The T5 will be maintained current within 6-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or Phased

Periodic Reinvestigation (PPR)) will be initiated prior to the 6-year anniversary date of the previous Tier 5.

11.3.1 Investigation Requirements. All personnel requiring Secret or IT-II access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local

Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The

Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3

Investigation.

11.3.2 IT-I access. Contractor personnel that do not meet the investigative requirements for Privileged IT1 access may be granted interim access by the DISA Personnel Security Office (MP62) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated. The Personnel Security Specialist

(PERSEC) assigned to the organization in which the contractor will be working will initiate a T5 e-QIP (Electronic

Questionnaire for Investigation Processing) of which fingerprints will be required. If the contractor has an adjudicated NACLC/ANACI/T3 investigation, upon completion of the T5 review and SAC (fingerprint) results from the FBI (Federal Bureau of Investigation), if there is no disqualifying information, the individual may be granted

Interim eligibility/IT1 access. Contract personnel found ineligible for Interim IT1 will not be allowed to support a

DISA contract requiring IT1 access nor will MP62 go forward with the T5 Investigation. If, while still on a DISA contract that requires IT1, the contractor is due for his/her PR (Periodic Reinvestigation), DISA will initiate, review and submit the T5R investigation.

11.4 Adjudication for IT-I access. Favorable Adjudication of any previous T5, T5R, SSBI, SBPR or PPR by the

DoD Central Adjudication Facility or other federal adjudications facilities within a six year period will be automatically accepted for final IT-I access.

11.4.1 Other requirements. Prior to granting interim IT-I authorization, the supporting security manager will forward a written request for interim IT-I authorization to DISA PSO for approval. The request for SSBI e-QIP, FBI name and fingerprint check must be submitted by DISA PSO to the OPM.

11.5 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the Joint Personnel

Adjudication System (JPAS) to SMO DKABAA10. JPAS visits for contracts/orders are identified as “Other” or

“TAD/TDY” and will include the Contract/Order Number and ADP/IT-Access level of the contract/order in the

Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in Section 1.0.

If JPAS is not available, the VAL must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit

• Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency, and IT access level)

• Name of COR/Alt COR

• Dates or period the VAL is to be valid

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-1235 or via mail at:

Defense Information Systems Agency Defense Information Systems Agency

ATTN: MP61, Industrial Security ATTN: MP62, Personnel Security

Command Building Command Building

6910 Cooper Ave. 6910 Cooper Ave.

Fort Meade, MD 20755-7088 Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Security Manager Contact Information:

Name: Paula Gallman

Phone Number: 301-225-5128/DSN 312-375

E-mail: disa.meade.bd.mbx.sd-security-managers@mail.mil

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with local security requirements including entry and exit control for personnel and property at the government facility.

11.6.2 Contractor employees shall be required to comply with all…