Section_J_Attachment_M.1_Task_Order_0001_Performance_Work_Statement_Amend_0004.pdf

Page 1 of 43 Pages

PERFORMANCE WORK STATEMENT (PWS)

As of January 18, 2019

Contract Number:

Task Order Number:

Contractor Name:

Tracking Number:

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR)

a. Primary COR

Name: TBD Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name: Melissa Redd Organization: BDL2

DODAAC: HC1047

Address: 6910 Cooper Ave. Fort Meade, MD 20755 Phone Number: 301-225-9424 Fax Number:

E-Mail Address: melissa.j.redd.civ@mail.mil

2. Task Order Title Defense Information Systems Agency (DISA) Department of Defense (DoD) Mobility Classified Capability (DMCC) Engineering and Support Services

3. Background Since 2013, the DoD Mobility Program, as directed by the DoD Commercial Mobile Device Implementation Plan, has led the development of an enterprise solution to support controlled unclassified and classified information mobility requirements that leverage carrier infrastructure and provide entry points for wireless capabilities to meet the DoD needs. The DoD Mobility Program encompasses multiple subcomponents that when integrated, provide mission partners with enterprise-level secure classified protected communication services, ensuring

Page 2 of 43 Pages interoperability, increased security, access to information, and reliable service anywhere, at any time.

DMCC is provided as a service with ever evolving capabilities to coincide with future generations of mobile devices and using a series of deliveries. As of October 2018, there are approximately 2,700 DMCC customers for the classified program, to include both Secret and Top Secret classifications. This number is projected to increase to approximately 3,500 users in Fiscal Year 2019. The aim is to ensure successful delivery of increasingly secure, effective, useful, and operational capabilities to deliver enterprise level mobile capabilities in classified environments using integrated configurations with maximum commonality and efficiency, where feasible.

4. Objectives The objective of this task order is to provide program management, operational support, engineering, and sustainment services in support of the DMCC program and classified mobility services. The DMCC solution shall be capable of supporting Secret and Top Secret – Collateral classifications.

5. Scope The scope of this requirement is to utilize current and future Mobility capabilities to enhance DISA’s ability to provide classified mobile communication services to the entire DoD. DMCC consists of core mobility system components and devices, but also many other sub-system components and partner network interfaces. Hereafter, it is called, “DoD Enterprise Mobility system.” The following task order is not only to provide core mobility system integration and testing efforts, but also to support additional engineering activities to interface with other sub-systems and partner networks identified below, as well as future design integrations.

The Contractor shall provide the necessary support on each of the tasks areas listed below to achieve the overall DoD Enterprise Mobility system:

• Task 1 – Contract and Program Management Support

• Task 2 - Transition of Gateway and Operational Support Services

• Task 3 – Engineering Support

• Task 4 – Mobility Capability Integration

• Task 5 – Operational Support

• Task 6 – Logistics and Asset Management

6. Performance Requirements All task areas apply to the full performance period of this requirement. There may be multiple Contractors (i.e. from more than one contract vehicle and/or company) supporting DoD Mobility and other DoD activities that are tasked to work related activities. The Contractor shall work with these other Contractors, as required, to accomplish Government requirements, goals and objectives as efficiently and effectively as possible. This may include, but is not limited to, sharing or coordinating information resulting from the work required by this PWS or previous Government efforts, and/or working as a team to perform tasks in concert.

Page 3 of 43 Pages

6.1 Contract and Program Management Support

6.1.1 Program Support

The Contractor will provide management oversight for the task order to ensure performance and schedule requirements are met or exceeded throughout the performance period. The Contractor will identify, prevent, and ensure non-recurrence of defective and inadequate service. The Contractor will recommend solutions to new requirements, unarticulated needs, or existing needs using more-effective products, processes, services, technologies, or business models that are readily available.

On-site Program Office Support. The Contractor shall provide on-site classified mobility Subject Matter Expert (SME) full time equivalent (FTE) support to the Government Mobility Program Office at Fort George G. Meade. On-site support will communicate and coordinate among all operations support personnel, engineering, Government personnel, etc. as required in the performance of the tasks detailed throughout the PWS.

Option: The Contractor shall attend meetings supporting DoD Mobility, annotate action items, meeting notes, meeting minutes, and report action item status within two business days after conclusion of meeting(s). Meeting minutes will be due within three (3) business days and shall include notes from the meeting, action items with due dates, and assigned roles.

The Contractor shall provide a staffing plan detailing the management strategy used to successfully implement and sustain uninterrupted operations. This plan shall include a detailed roles and responsibilities matrix for the proposed staff members to ensure adequate coverage and proper workload distribution for those supporting field and/or lab operations.

The Contractor shall further develop the PMO’s existing Integrated Master Schedule (IMS) and submit it to the Government for approval. The IMS will continue to be developed with the assigned Project Leads and Program Managers of the Mobility Program, managing and incorporating all feeder projects in subordinate IMS as well. The IMS shall include key milestones and activity information for the program and tasks identified by the Government. The Contractor shall coordinate with the Government on a daily basis to incorporate changes to the schedule and deliver the schedule to the Government on a monthly basis for approval.

The Contractor shall develop, implement and maintain a quality control plan. This plan shall include inspection, validation, evaluation, corrective action and procedures necessary to effect quality control of all performance and products provided under the contract. The plan shall allow inspection and evaluation by the Government, and shall be applicable to all subcontractors and members of the contractor's team, as appropriate.

Deliverable(s): Meeting Minutes - Option Staffing Plan

IMS

Quality Control Plan

6.1.2. Monthly Status Report (MSR) and Review

Page 4 of 43 Pages

The MSR shall be used to track the quality and timeliness of the milestones, services, and deliverables as well as risks and task order/program financials. Within 30 days after task order award, the Contractor shall submit a draft MSR to the COR/ACOR to confirm format and contents meet the Government’s needs. The Contractor shall incorporate any Government comments and submit the final report format within five business days. The MSR shall include, but is not limited to accomplishments for the quarter, plans for the next quarter, identifiable risks and recommendations for mediating the risks, expenditures, cumulative funding summary, and a listing of all personnel associated with the execution of the performance tasks. The MSR for all proceeding months will be due by the fifteenth calendar day of the following month.

The Contractor shall conduct monthly in-progress MSR reviews that includes a summary of all specific tasks as requested by the Government. The Contractor will provide a review of progress against cost and schedule performance, programmatic and technical risks, and identify and resolve critical issues and actions as set up by the COR/ACOR. The Contractor shall conduct analysis of the risks involving cost, schedule, and performance parameters associated with the performance of this task order.

The Contractor shall identify high risk factors and develop mitigations to reduce risk. Upon Government approval, the Contractor will implement and monitor the selected mitigations. The Contractor shall work with the Mobility Program Office to de-conflict any schedule or deployment issues. In addition, the Contractor shall notify the COR via email once a high risk factor has been identified. The Contractor shall track these high risk factors via a risk matrix and develop mediations to reduce risk by identifying, addressing, and providing prioritization of risks (including how risks will be recorded and reported) as a part of the MSR. The Contractor should consider the full range of risks that could impact the project including, but not limited to resources, access, physical and cyber security, and unplanned events. Upon Government approval, the Contractor will implement and monitor the selected mediations. The Contractor shall work with the Government to mediate any schedule or deployment issues. Personnel listing should detail a “roles and responsibilities” matrix for all staff members and identify all dedicated full time and part time equivalents to ensure adequate coverage and proper workload distribution.

Deliverable(s): MSR Monthly Status Meeting

6.1.3 Risk Management Plan

The Contractor shall provide a comprehensive risk management plan addressing the identification, assessment, and prioritization of risks including how risks will be recorded and reported. In addressing risk, the Contractor should consider the full range of risks that could impact the project including, but not limited to, resources, access, physical and cyber security, and unplanned events.

Deliverable(s): Risk Management Plan

6.1.4 Technical Writing and Knowledge Management (KM)

The Contractor shall develop, write, edit, and update documentation such as reports, manuals, briefs, whitepapers, catalogs, guides, and related technical and administrative publications.

Page 5 of 43 Pages

Example documents include Concept of Operations, Service Operation Annex, and Technical Implementation Plans. The Contractor should have a clear understanding of DISA’s approval process and lead the DISA Operational Approval Processes as appropriate (ex. the Network Readiness Review Board (NRRB)). The Contractor shall maintain archived records and files of work revisions, and other essential documentation. The Contractor shall assist in maintaining release notes, functional deltas, installation guides, upgrade guides, migration guides, administration guides, user guides, training, and quality assurance plans and results as well as any other pertinent documentation relevant to Mobility. The Contractor shall provide a comprehensive Knowledge Management Guide that includes Mobility. The Contractor shall assist in developing the knowledge management capability to support various functions including task management, engineering action tracking, test management and status, configuration management, and general file storage. The Contractor shall maintain the knowledge management tool(s) (e.g. DISA Enterprise Portal Service (DEPS)) in order to create and to structure portals necessary to display, disseminate, and keep current knowledge and information in the most efficient and useable format for the program and product management team, DISA leadership and DoD customer. The Contractor shall support Knowledge Management (KM), Tactics, Techniques and Procedures (TTPs) and Standard Operating Procedures (SOPs), KM Implementation Plan, and DEPS site structure updates for current pages as well as design of new pages to include implementation and pages data population.

The Contractor shall create, edit, and improve any briefings. The Contractor will be responsible for tailoring briefings for targeted audiences and support graphic design requests.

The Contractor shall provide expertise in the technical knowledge of integration of information and knowledge portals for efficiency purposes and limit redundancy. Knowledge of integrating artifacts and tasks between FORGE.MIL and DEPS is an example.

Deliverable(s): KM Guide

6.2 Transition of Gateway and Operational Support Services

6.2.1: Transition Planning and Execution of Operational Support Services and Equipment The Contractor shall support concurrent network operations services and receive all gateway operational support services from the incumbent Contractor. This shall include, but is not limited to, the following areas of responsibilities:

• Configuration

• Information Assurance (IA) (Configuration management support (current status and processes)

• IA support

• Mobile Device Management (MDM) support

• Implementation management support (to include history and current status)

• System performance analysis

• Virtual Private Network (VPN), Voice Over Internet Protocol (VoIP) and gateway management (to include on-boarding and de-boarding devices)

• System and network engineering

Page 6 of 43 Pages

• System deployment and integration support

• Incident detection, handling and reporting

• System status reporting

• Asset management responsibilities (to include transitioning active maintenance/support plans and licenses), transition all administration and user accounts

• Physical hardware

• System monitoring requirements (to include Continuous Monitoring (CONMON) support requirements) in order to facilitate a seamless transition and assure minimum service disruption of the current 24x7 on-site administration support, Service Desk Tier I and Tier II responsibilities and Program Office Tier III responsibilities

• License and certificate expiration tracking

The Contractor shall have complete information on the on-site operations and remote management support at the gateway locations, and shall have full access and knowledge to all required systems to administer the gateways. This includes the DISA Global Trouble Management System (GTMS) for effectively managing the Enterprise Mobility Management (EMM) suite. The Contractor shall ensure an official handoff of all privileged user accounts to the system and disable all accounts used by the predecessor Contractor. The Contractor will create a transition checklist of required information, documentation and system access. This checklist will be used to facilitate the transitions between the contractor and the incumbent contractors.

All operational support requirements to be transitioned include, but are not limited to the following:

• Coordination processes and requirements with DISA Global Operations Command and Watch Officer

• System maintenance and administration requirements

• Configuration Control Board (CCB) processes

• Network management support, trouble analysis procedures, network and system monitoring and administration/coordination

• Asset (hardware and software) maintenance and licensing tracking and support

• Circuit configuration advisement

• General administrative tasks as they pertain to personnel access and clearances for

Government facilities

The Contractor shall provide all mandatory Government SOPs and Concept of Operations (CONOPS), which include, but are not limited to the following:

• Gateway Operations and Maintenance Manual

• Authorized Service Interruption (ASI) SOP 100-55-08

• Global Information Grid Service Management – Operations (GSM-O)

• Operations and Maintenance (O&M) Convergence Network Operations C2 CONOPS

• SOP for DISA GTMS Ticket Opening/Updating/Closing 13-GSM-SOP-OPS-0021-04, Version 04, as they apply to Network Operations Concepts and Network Management policy/procedures governed at the DISA and DoD Enterprise Level

Page 7 of 43 Pages

• Transition support shall also include all real time monitoring and management requirements of DISA Services for operational awareness and Cyber Defense.

The Contractor will support weekly meetings during the transition period to ensure a smooth transition of operational support services.

Deliverable(s): Transition checklist

6.2.2 Receipt and Execution of Engineering and Testing Services and Equipment The Contractor shall minimize service disruption and service degradation during and after a transition period from the incumbent Contractor. Transition shall include but not limited to relocating all Government owned property at Contractor facilities and information to include active support plans and licenses, information as required to maintain service and transition all administration accounts to a location designated by the Mobility Program Office. The transition must maintain the current National Information Assurance Partnership (NIAP) and Commercial Solutions for Classified (CSfC) approved or in NIAP evaluation and listed on the CSfC Components List for DMCC-S and DMCC-TS gateway equipment solutions. Attributes of the transition plan include detailed transitioning activities of the requirements that are described in Section 6.2.4 Transition.

6.2.3 Future Gateway Solution Delivery

The Contractor will provide one of the following Courses of Actions for the gateway solution:

(Current CSfC Gateways are configured as MACP version 1.1 and will need equipment upgrade MACP version 2.0 for both options)

1. Partial Gateway Upgrade: If the solution is to provide a new NIAP approved/in evaluation CSfC Components with a replacement VPN and only currently CSfC Components no longer listed, but keep the remaining CSfC listed and non-CSfC categories listed equipment (e.g routers, switches, management tools, etc), then the transition should be complete within 90 – 120 days after approval from Government is received to move forward; wherein, all Government processes and approvals have been met (e.g. SRF, ERB etc.)

2. Full Gateway Upgrade: If the solution is to provide a new end-to-end NIAP approved/in evaluation CSfC Components listed solution which includes a VPN replacement and certain or all parts of the existing infrastructure replaced that is operable with end user devices, then the transition should be complete within 120 - 150 days after approval from Government is received to move forward; wherein, all Government processes and approvals have been met (e.g. SRF, ERB etc.)

The solution deliverable will include a fully detailed Mobile Access Capability Package (MACP) version 2.0, vendor agnostic (non-proprietary) technical architecture and a detailed briefing highlighting the capabilities of the proposed solution, focusing on key areas including technical performance, operational support, integration with existing capabilities and transition risks.

The proposed solution should meet all of the following requirements:

Page 8 of 43 Pages

• Where applicable in the design, in reference to the CSfC Component List categories, all products utilized shall be active on the CSfC Components List at time of proposal submission

• All proposed CSfC Outer VPN components must have the ability to integrate with the Native Samsung S7 VPN Client and/or Native Android VPN client and with the Windows 10 Native VPN Client. All proposed solutions shall integrate with existing PKI infrastructure. No additional systems or products will be available for assistance in solution integration

• All solutions shall be built to MACP version 2.0 compliance

• All solutions shall utilize UC/APL equipment, where available, as outlined in 6.3.4

Architecture Development.

• All solutions shall have the ability to integrate without needing to alter or re-provision any End User Devices (EUDs)

• All solutions shall be able to report usage and performance metrics within 1 hour of requests

• Gateway solutions must support all current DMCC-TS and DMCC-S EUDs in a low bandwidth (e.g. 2G) cellular coverage areas to include OCONUS and CONUS

• Windows 10 tablet operations support is conditional for high bandwidth usage requirements (e.g. patching, high definition streaming video, etc.).

• Growth plan for supporting a future 10,000 user capability

• Troubleshooting, to include demonstrating Subject Matter Expert (SME) knowledge for all included systems within the organic team and vendor reach back (as required). The use of system debugs and other tools (software, hardware, feature sets) to determine expected and unexpected behaviors

Deliverable(s) : Architecture Diagrams Technical Briefing

6.2.4 Transition

The contractor shall provide a transition plan, which includes a detailed description of the Contractor’s plan to execute the transition of all support services from the incumbent Contractors as detailed below. At a minimum, the transition plan shall provide the following:

• Technical approach

• Transition items: 1) goals; 2) assumptions; 3)significant risk and; 4) other critical factors

(e.g. pre-transition requirements)

• GFE transition/property accountability

• Transition task

• Management controls

• Transition performance measurement: 1) goals; 2) acceptance criteria; 3) metrics; 4) evaluation process; 5) frequency

• IMS with major Government review milestones and critical path

• Organizational resources

Page 9 of 43 Pages

• Key transition personnel, staffing and clearances plan for key personal

• Deliverables schedule that will need to be employed to meet the cost, performance and schedule requirements throughout the execution of the transition period.

The transition plan is the basis for the execution of all transition activities. It must specifically also include the necessary transition steps and the subsequent Contractor task summary required for implementing Section 6.5.1 Tier III Support items of the following:

• Establishment of SME knowledge within the organic team as it relates in supporting the DMCC gateway

• Identification and establishment of repeatable high level Tier III support processes

• Utilization of vendor reach back (as required) to enhance the knowledgebase and product support analysis in support of Tier III responsibilities.

Upon the award of this task order, the Contractor shall provide transition-in support to ensure the continuity of the current gateway operations technical assistance and services minimize service disruption and service degradation during and after transition period. During the transition period, the Contractor will assume Tier III operational support duties within 90 days of contract award and the complete transition within 120 days of contract award. Tier III technical assistance of the existing solution may be required for up to one year after task order award;

however, the Contractor shall strive to transition services in less than a year. The Mobility Program Office will support weekly meetings with the Contractor and incumbent Contractors to ensure a smooth transition.

Deliverable(s): Transition Plan

6.3 Engineering Support

6.3.1 Systems Engineering Support

The Contractor shall take over any new and existing incumbent Contractor engineering efforts.

The Government will provide guidance on prioritizations of engineering efforts for the Contractor to base staffing plans. The Contractor will be responsible for the entire engineering lifecycle from planning through Tier III Operations. Such efforts are listed, but not limited to the following:

a) Virtualization

b) Gateway solution transition

c) Continuity of Operations (COOP) for the gateways

d) Classified data at rest (DAR) and non-DAR solution

e) Gateway upgrades in support of updated MACPs

f) Convergence of gateways classifications

- Consolidated black and gray enclaves

- Multiple red enclaves

- Additional gateways (single/converged) deployed

Page 10 of 43 Pages

6.3.2 Systems IA

The DMCC S and TS solutions have been engineered to maintain and operate the procedures and tools (IA software, hardware and network) that provide the infrastructure with confidentiality, integrity, availability, authenticity, access control, survivability and non-repudiation of information. The infrastructures shall continue to be engineered so that security shall be provided to protect all information and data in accordance with Federal, DoD, Joint Chief of Staff, DISA Authorizing Official (AO), and Mobility Program Office security policies.

As such, the Contractor shall provide Tier III engineering and implementation support services in maintaining and/or meeting the following security requirements:

• Security Technical Implementation Guides (STIG) compliance

• IA Vulnerability Alert (IAVA) compliance

• Host Based System Security (HBSS) compliance and IA/Intrusion Detection (IA/ID)

• Physical security requirements for operating systems, as applicable

• Assured Compliance Assessment System (ACAS)

• MACP compliance

• DISA AO

In coordination with the Government, the Contractor shall continue to maintain secure applications and configurations through applying applicable DoD STIGs, checklists, vendor security guidance, industry best practices, and applicable vendor product security patches. The Contractor shall ensure currently deployed and new applications comply with DODI8500.2 IA Implementation (current version) and DODI 8551.1 Ports, Protocols, and Services Management (current version). The Contractor shall assist in leveraging, to the maximum extent possible, automated tools to identify and remediate vulnerabilities or weaknesses in the currently deployed applications. Examples are the Common Weakness Enumeration/System Administration, Networking, and Security Institute (CWE/SANS) TOP 25 Most Dangerous Software Errors (http://www.sans.org/top25-software-errors/) and Open Web Application Security Project (OWASP) Top Ten https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project, that could be exploited by unauthorized sources.

The Contractor shall participate in Government formal and informal design reviews to identify potential security weaknesses, deficiencies, and/or vulnerabilities in the design. As part of the change control process, the Contractor shall ensure participation by the Information System Security Engineer or a qualified cyber security SME to evaluate the security impact of each change. The Contractor shall maintain documentation of the results of these evaluations within the Systems Engineering Plan (SEP). The Contractor shall also ensure appropriate security requirements are included as part of the requirements traceability matrix and are evaluated as part of the security assessment.

The Contractor shall assess the implications and coordinate solutions for required security updates that affect the systems with operations personnel and monitor their successful implementation. The Contractor shall ensure the system engineering design is compliant with applicable IA and CSfC Capability Package (CP) requirements, STIGs/Checklists, DISA http://www.sans.org/top25-software-errors/

Page 11 of 43 Pages

Command Center Command Task Orders, ACAS results, DISA AO requirements and NIAP Protection Profiles.

The Contractor shall assist and support Government requirements to accomplish submittal of new and amended Certification and Accreditation packages for the DMCC-S and DMCC-TS infrastructures including system configuration of all components. The Contractor shall support bi-annual security self-assessment activities. The Contractor will need to have access to JWICS to support the IA requirements.

The Contractor shall provide engineering and or Tier III support to existing mechanisms as they apply to this effort to provide the capability to preserve, protect, detect, react, revise and recover from threats, intrusions and denial of services. DISA Enterprise Services provide these mechanisms. These procedures/mechanisms have been implemented to protect network, server, mobile devices, workstations, communication security (COMSEC) and physical facilities under Contractor control.

The Contractor shall analyze STIG, IAVA, and ACAS scans and provide appropriate supporting IA documentation for upload as artifacts in Enterprise Mission Assurance Support Service. The Contractor shall provide weekly input to elucidate the present security status of the systems to include, but not limited to, open IAVAs, STIGS and plans to mitigate vulnerabilities, which shall be done in a timely manner. If vulnerabilities cannot be mitigated within 60 days of release, the Contractor shall provide detailed Plan of Action for Mitigation documentation and seek approval from the Mobility Information Security System Manager (ISSM). The Contractor shall provide support for all efforts, duties and documents for requesting and maintaining Authority to Operate approvals associated with DMCC S and TS capabilities.

The Contractor will be responsible for the development, integration and Tier III support of Cyber Defense systems that are focused on identifying, thwarting and reporting any Cyber Attack or incident. This applies to the Risk Management Framework (RMF) Cyber Remediation, wherein the Contractor will actively analyze and remediate within the applicable DoD/DISA timeframes and in accordance with US CYBERCOM Information Assurance Vulnerability Management Notices, Directives, and Orders. In the event of an incident, the contractor shall respond and address incidents in accordance with MAC system Level 2 requirements (or higher, if required) within the ITSM database. Lastly, identify a trend analysis tracking mechanism for projecting operational impact of identified vulnerabilities.

The Contractor shall provide on-site classified S and TS mobility IA SME(s) to support the Government Program Office at Fort George G. Meade. On-site support will coordinate among the Government, operations support personnel, Tier III Engineering, the Program Office, ISSM, Program Office IA team, and Contractor PM in providing required IA artifacts, reporting IA posture/status, assist in addressing present and upcoming IA vulnerabilities, and provide coordination support. IA administrative support will consist of, at a minimum, IA analysis, engineering, risk mitigation and other required efforts to maintain CSfC MACP IA compliance/registration.

Page 12 of 43 Pages

In addition, the on-site IA SME shall support development of system documentation to facilitate the security assessment and authorization of the system according to DODI 8510.01 RMF and the associated security controls as defined in DODI 8500.1, Cyber Security Implementation (current version).

6.3.3 Systems Engineering Certification & Accreditation (C&A) The Prime Contractor must be on the NSA CSfC Integrator List. The Prime Contractor must maintain the CSfC certification for the life of the task order. Additionally, the Contractor must provide product offerings on the CSfC Components List. The Contractor does not have to be the manufacturer of the equipment listed on the CSfC Components List.

The Contractor will be responsible for assisting in the compiling, evaluating, submission and maintenance of all DMCC related IA accreditations to include RMF and CSfC Capability Packages/Registration such as MACP, DAR and Multi-Site Connectivity. The Contractor shall provide technical support to maintain Certification & Accreditation (C&A) of the DMCC for S and TS and maintain the CSfC security baselines. The IA accreditation boundary includes, but is not limited to the EMM, the mobility lab assets, Classified S and TS production enclaves and gateway infrastructure. The Contractor will be responsible for following all requirements and processes inside of the RMF. This framework will include access to multiple internal DISA Systems and applications. The Contractor will be responsible for handling all accreditation activities for all Mobility lab instances hosted within the DISA HQs.

The Contractor shall assist in being current and compliant with all DoD security requirements, to include but not limited to Security Recommendation Guides, STIG, IAVM, current CSfC CP requirements and any other applicable security policies applicable to the infrastructure components of the overall system solution. The Contractor will provide support to all cyber security related meetings and tasking as required by the Government. This will include but is not limited to cyber related reports, cyber related briefings, and any other task deemed required by the Government. All deliverables will support DoD/DISA Mobility classified capabilities, to include TS security baselines.

Deliverable(s): DoD-approved C&A process artifacts and documentation

DoD Cyber Security Status “Stop-light Mobility” Cyber Threat Security Plan FISMA, IAVM, STIG compliance report/reporting

6.3.4 Architecture Development

The Contractor shall provide technical support and engineering services necessary to develop comprehensive DoD/DISA mobility classified architectures. To ensure continuous system performance, the gateway shall continue to be engineered to maintain 99.5% availability, discounting incidents outside the Contractor’s direct control. The DoD/DISA mobility architecture is composed of many sub-functional systems and partner network interfaces. The Contractor shall assist in designing and developing Mobility enterprise system technical documentation (ex. system configuration reports, technical diagrams, operational views, system views, and other diagrams) and architecture diagrams. The following are the current required

Page 13 of 43 Pages

DoD Architecture Framework (DoDAF) views within DMCC, but not limited to adding and/or dropping other views to the list:

Table 1: Current DMCC Views AV-1 Overview and Summary

Information Scope, purpose, intended users, environment depicted, analytical findings (if applicable)

AV-2 Integrated Dictionary Definitions of all terms used in all products.

CV-1 Vision Addresses the enterprise concerns associated with the overall vision for transformational endeavors and thus defines the strategic context for a group of capabilities.

CV-2 Capability Taxonomy The model presents a hierarchy of capabilities that may be presented in context of a timeline.

CV-6 Capability to Operational Activities Mapping

Describes the mapping between the capabilities required and the activities that enable those capabilities.

CV-7 Capability to Services Mapping Describes the mapping between the capabilities required and the services that enable those capabilities.

OV-1 High Level Operational Concept Graphic

High-level graphical and textual description of operational concept (high-level organizations, missions, geographic configuration, connectivity, etc.).

OV-2 Operational Node Connectivity Description

Operational nodes, activities performed at each node, and con-nectivity and information flow between nodes.

OV-4 Organizational Relationships Chart

Command, control, coordination, and other relationships among organizations.

OV-5a Operational Activity Decomposi-tion Tree

Activities, relationships among activities, inputs and outputs

SV-1 Systems/Services Interface De-scription

Depicts systems nodes and the systems resident at these nodes to support organizations/human roles represented by opera-tional nodes of the OV-2. SV-1 also identifies the interfaces between systems and systems nodes.

SV-2 Systems/Services Communica-tions Description

Depicts pertinent information about communications systems, communications links, and communications networks. SV-2 documents the kinds of communications media that support the systems and implements their interfaces as described in SV-1. Thus, SV-2 shows the communications details of SV-1 interfaces that automate aspects represented in OV-2.

SV-3 Systems-Systems, Services-Sys-tems, Services-Services Matrices

Provides detail on the interface characteristics described in SV-1 for the architecture, arranged in matrix form.

SV-4a/ SV-4b

Systems/Services Functionality Description

The SV-4a documents system functional hierarchies and sys-tem functions, and the system data flows between them. Alt-hough there is a correlation between OV-5 or business-process hierarchies and the system functional hierarchy of SV-4a, it need not be a one-to-one mapping, hence, the need for the Op-erational Activity to Systems Function Traceability Matrix (SV-5a), which provides that mapping

SV-5b Operational Activity to Systems Traceability Matrix

Addresses the linkage between described in SV-1 Systems Functionality Description and Operational Activities specified in OV-5a Operational Activity Decomposition Tree or OV-5b

SV-8 Systems/Services Evolution De-scription

Captures evolution plans that describe how the system, or the architecture in which the system is embedded, will evolve over a lengthy period. Generally, the timeline milestones are

Page 14 of 43 Pages critical for a successful understanding of the evolution time-line

SvcV-1 Services Context Description Addresses the composition and interaction of Services pub-lished to/subscribed by performers in the OV-2

StdV-1 Standards Profile Defines the technical, operational, and business standards, guidance, and policy applicable to the architecture being de-scribed.

The Contractor shall provide DoD/DISA with architecture engineering services to develop the system architecture for the Mobility Program Office’s needs. The Contractor shall provide the Government with the architecture development support to include but not limited the following:

• DISA EMM Architecture

• Mobility Network Operations Architecture

• Mobility Continuous Monitoring (CONMON) Architecture

• Mobile Device Operating System (OS)

• Trouble Ticketing System

• Mobility Gateway Architecture o Design (e.g. COOP, Robust, Load Balancing, Geo Routing) o Services (e.g. Enterprise and device local) o OS (e.g. mobile and gateway components o Security (e.g. STIG, HBSS/ePO, ACAS, Cyber Security Service Provider (CSSP), SSP, SSH) o IAM (e.g. Enclave CAs, OCSP, CRL, CDR, Root CAs, Intermediate CAs, Cert

Gen/Process, Radius, TACAS) o Protocols (e.g. FTP, HTTPS, NTP, ICMP, IPSec, IKE, ICMP, SIP, TLS, SRTP, VLAN, Video) o Networks (e.g. Cellular, Internet, NIPRNet, SIPRNet) o Monitoring (e.g. IDS, CONMON, SMNP, SYSLOG, Auditing, DISA OSS, ESM/ID64, OPENNMS, Ansible) o Components (e.g. NAS, VPN, FW, LSC, SBC, Switch, Router, EMM/MDM, MAS, MAM, ACS, DNS, NTP, Database, KGs, Load Balancers, Servers)

• PKE/PKI Authentication Framework Interface

• Enterprise Service Integration Interface

• DISA Mobility Lab Architecture Development and Integration

• Requirements development

The Contractor shall periodically assess capability gaps of the current DoD/DISA Mobility architecture and develop/provide architecture roadmaps/transition plans based on “as is” architecture and the “to be” DoD/DISA architecture. The Contractor shall provide the Government with software and hardware purchase lists to build “to be” architecture packages.

The list of components will be based on the following in priority order: 1) Service Request Form (SRF) availability; 2) DoD/General Services Administration Blanket Purchase Agreements/Contracts; 3) Other Government/Mobility PMO approved sources; 4) Commercial.

Of that list, for Non-CSfC items, the solution will incorporate components from the Unified Capabilities - Approved Products List (UC-APL) where applicable, or as directed by the COR or

Page 15 of 43 Pages

Program Manager. The architecture package shall also include a proposed detailed architecture diagrams and system configurations with port and protocols being identified and data flows and security architecture to protect the solution. The recommendation will drive future mobility implementation decisions and architecture development requirements. The Contractor shall be capable of conducting such analysis to validate their architecture designs and make such artifacts readily available upon the Government request.

The DISA Mobility Program Office lab is used to demonstrate new mobility capabilities.

Architecture development to perform new pilot capability integration to the existing lab system baseline is frequently needed. The Contractor shall provide technical insertion services to support such architecture modifications to integrate a commercial items/GFE/custom solution into the current DoD/DISA mobility lab baseline.

Simulation modeling, data traffic flow analysis, network bandwidth analysis, performance and bottleneck analysis, design trade off analysis, load balancing and scalability analysis are often used to validate architecture development artifacts. The Contractor shall be capable of conducting such analysis to validate their architecture designs and make such artifacts readily available upon the Government request.

Transport The Contractor shall engineer, analyze, and troubleshoot connections with the Government and any third party commercial network providers hosting mobile device connections between the DMCC user, the DMCC Gateway, DoD Enterprise Services, and mobile carrier network capabilities, respectively. One such connection is to the cellular carrier Multi-Protocol Label Switching network services hosting mobile devices, which serves as a gateway on the carrier side to their mobile networks with others being access to DoD "backend services," such as email and streaming video, etc. Efforts also include testing, troubleshooting, documentation, and notification of any unique circumstances that may affect connection performance. The scheme of these connections are documented and shall be maintained in the SEP.

The Contractor shall develop an implementation plan outlining all required software, hardware, associated licenses and any other requirements needed to implement engineered solutions to establish connections with commercial wireless carriers or Internet Service Providers (ISPs). In addition, the Contractor shall accompany Government personnel in support of site survey analysis for the installation of an additional gateway. The site survey is an installation planning effort to assess space, power, racking, and gateway management requirement deficiencies to the Government for resolution, as it relates to installing required hardware of the implementation plan.

Systems/Application The Contractor shall engineer solutions that integrate with existing DISA and external services, for example email and VoIP systems. The Contractor shall investigate technologies and commercial solutions to meet prospective DISA end user needs or which provide opportunity to enhance existing systems and service offerings. Investigations will include capture of DISA requirements, market studies for applicable technologies and vendors, and identification of key characteristics for evaluation. The Contractor shall design testbed configurations and implement

Page 16 of 43 Pages selected solutions for evaluation in test lab/pre-production evaluation environments as required.

The Contractor will develop and execute test plans in accordance with the test criteria and evaluation approach and provide reports to DISA for incorporation into production system specifications as requested.

Remote Access Capabilities The Contractor shall engineer remote access capabilities to each independent component of the gateways, both hardware and software, so to provide access for the DMCC Mobility Gateway operations NetOps contractor for DMCC-S and DMCC-TS. The remote access will be used for but not limited to routine maintenance on the system, troubleshooting new and existing issues and making any changes deemed required by the Government. Where deemed necessary, remote access will be engineered to provide Tier III access in support of Network and Operational Technical Assistance.

Deliverable(s): Implementation Plan(s)

Test Plan(s) Remote Access Plan(s) DoDAF View(s)

6.3.4.1 End-to-End Systems Architecture Assessment

The Contractor will support end-to-end Systems Architecture review and propose changes. The purpose is to develop a list of incremental changes to gain operational resiliency, increased cyber defense, and increased cyber situational awareness. The Contractor will continually propose improvements for Government consideration throughout the life of the contract.

6.3.4.2 Infrastructure Refresh

The Contractor will design, deliver, and then integrate an end-to-end solution to upgrade the current classified mobility service offering. The end-to-end solution will include but not be limited to a VPN Solution, MDM, inner encryption components (e.g. VPN and TLS) and current and future DMCC devices. The end user devices should be the current market version of the existing CSfC/NIAP certified devices provided in the operational environment. During the capability integration, the Contractor must ensure they avoid any service interruptions with the existing operational environment. The Mobility Program Office will work with the Contractor to approve and execute an infrastructure refresh using the hardware/software list as noted in Section

6.3.4 Architecture Development.

6.3.5 System Engineering Plan

The SEP provides the foundation upon which everything else is built and supports the DISA Mobility Program Office program success. SEP ensures the effective development and delivery of Mobility capabilities through the implementation of a balanced approach with respect to cost, schedule, performance, and risk using integrated, disciplined, and consistent SEP activities and processes regardless of when a program/project enters the acquisition life cycle. SEP also enables the development of engineered resilient Mobility systems that are trusted, assured, and easily modified. The Mobility SEP identifies the most effective and efficient path to deliver a capability, from identifying user needs and concepts through delivery and sustainment. SEP event-driven technical reviews and audits assess Mobility program maturity and determine the

Page 17 of 43 Pages status of the technical risks associated with cost, schedule, and performance goals. As the objective of the Mobility Program Office is to provide enterprise level service offerings across a spectrum of DoD users, it is important to manage the requirements and related processes to ensure customer expectations are met by the products delivered. Continued growth in the number of Mobility users is tied to gathering customer requirements, having a process that makes them a partner in the product development, and keeps them informed of the progress.

Requirements process plays a major role in the SEP as system requirements that describe the functions, which the system as a whole should fulfill to satisfy the Mobility Program Office needs and required capabilities. The Mobility Requirements process synchronizes with the DISA Mission Partner Engagement Office and the Requirements Analysis Office and will be updated to harmonize with the newer Information Technology Infrastructure Library (ITIL) and DESMF processes.

The Contractor shall support and perform, but not limited, to the following activities:

• Develop, maintain and execute the Mobility Program Office program’s SEP

• Develop Mobility Program Office program review briefings

• Develop Mobility Program Office program Architecture views as noted in Section 6.2.3

Architecture Development in accordance with DISA guidelines

• Provide Systems Engineering support for all systems engineering and integration tasks for the Fort Meade Labs

• Support major reviews, including Chief Mobility Engineer in

ERB, requirements review (ERB#1), preliminary design review (ERB#2), critical design review (ERB#3), system readiness reviews (ERB#4a/b), functional configuration audit and Mobility CCBs

• Interface or coordinate with NSA, JTIC, DISA and other DoD Components so to provide the necessary inputs

• Develop Test and Evaluation Strategy/Test and Evaluation Master Plan

• Develop Life-Cycle Sustainment Plan (LCSP)

• Scale the Program Office Mobility SEP based on the scope and complexity of the program/system effort

• Work with the system integration teams to develop plans and timelines for the integration or install of the system(s)

The SEP will include a description of the Mobility Program Office program’s overall technical approach including processes, resources, metrics, applicable performance incentives, and the timing, conduct, and success criteria of technical review as well as architecture views and summary information for DMCC S and TS Systems. The Contractor will provide an Interface Control Document (ICD) on one or more new Mobility capability requirements and associated capability gaps. The ICD also documents the intent to partially or wholly address identified Mobility capability gap(s) with a non-material solution, material solution or some combination of the two.

Deliverable(s): SEP (ERB#1-4a/b)

ICD

Page 18 of 43 Pages

6.3.6 Mobility Requirements Process

The Contractor shall determine how and when each new Mobility requirement should be verified, the tasks required to do so, as well as the necessary resources (i.e., test plan) to produce the verification matrix and supporting documentation to become part of the Mobility Program’s functional and allocated baselines. The Contractor shall support and perform the following activities:

• Develop, maintain, update, and execute the Mobility Program Office’s Requirements

SOP

• Present the Mobility requirements baseline in accordance with the requirements management process from the Mobility SEP

• Establish and maintain a Requirements Traceability Matrix (RTM) that captures all requirements for DMCC-S, DMCC-TS in the system performance specification, their decomposition/derivation and allocation history, and rationale for all entries and changes

• Develop an RTM which traces the functions of the capability back to the requirements also known as a DoDAF SV-5 or SvcV-5 view

• Review new Mobility requirements and assumptions to establish the overall decision context

• Documents the Mobility system’s internal and external interfaces and their requirement specifications

Deliverable(s): Requirements SOP

RTM

Interface requirements documentation Requirements Management Plan

6.3.7 Research Development Testing and Evaluation (RDT&E)

The RDT&E…