Section J_Attachment M.1 Task Order PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

As of October 12, 2018

Contract Number:

Task Order Number:

Contractor Name:

Tracking Number:

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR)

a. Primary COR

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Task Order Title Defense Information Systems Agency (DISA) Department of Defense (DoD) Mobility Classified Capability (DMCC) Engineering and Support Services

3. Background Since 2013, the DoD Mobility Program, as directed by the DoD Commercial Mobile Device Implementation Plan, has led the development of an enterprise solution to support controlled unclassified and classified information mobility requirements that leverage carrier infrastructure and provide entry points for wireless capabilities to meet the DoD needs. The DoD Mobility Program encompasses multiple subcomponents that when integrated, provide mission partners with enterprise-level secure classified protected communication services, ensuring interoperability, increased security, access to information, and reliable service anywhere, at any time.

DMCC is provided as a service with ever evolving capabilities to coincide with future generations of mobile devices and using a series of deliveries. As of October 2018, there are approximately 2,700 DMCC customers for the classified program, to include both Secret and Top Secret classifications. This number is projected to increase to approximately 3,500 users in Fiscal Year 2019. The aim is to ensure successful delivery of increasingly secure, effective, useful, and operational capabilities to deliver enterprise level mobile capabilities in classified environments using integrated configurations with maximum commonality and efficiency, where feasible.

4. Objectives The objective of this task order is to provide program management, operational support, engineering, and sustainment services in support of the DMCC program and classified mobility services. The DMCC solution shall be capable of supporting Secret and Top Secret – Collateral classifications.

5. Scope The scope of this requirement is to utilize current and future Mobility capabilities to enhance DISA’s ability to provide classified mobile communication services to the entire DoD. DMCC consists of core mobility system components and devices, but also many other sub-system components and partner network interfaces. Hereafter, it is called, “DoD Enterprise Mobility system.” The following task order is not only to provide core mobility system integration and testing efforts, but also to support additional engineering activities to interface with other sub-systems and partner networks identified below, as well as future design integrations.

The Contractor shall provide the necessary support on each of the tasks areas listed below to achieve the overall DoD Enterprise Mobility system:

· Task 1 – Contract and Program Management Support

· Task 2 - Transition of Gateway and Operational Support Services

· Task 3 – Engineering Support

· Task 4 – Mobility Capability Integration

· Task 5 – Operational Support

· Task 6 – Logistics and Asset Management

6. Performance Requirements All task areas apply to the full performance period of this requirement. There may be multiple Contractors (i.e. from more than one contract vehicle and/or company) supporting DoD Mobility and other DoD activities that are tasked to work related activities. The Contractor shall work with these other Contractors, as required, to accomplish Government requirements, goals and objectives as efficiently and effectively as possible. This may include, but is not limited to, sharing or coordinating information resulting from the work required by this PWS or previous Government efforts, and/or working as a team to perform tasks in concert.

6.1 Contract and Program Management Support

6.1.1 Program Support

The Contractor will provide management oversight for the task order to ensure performance and schedule requirements are met or exceeded throughout the performance period. The Contractor will identify, prevent, and ensure non-recurrence of defective and inadequate service. The Contractor will recommend solutions to new requirements, unarticulated needs, or existing needs using more-effective products, processes, services, technologies, or business models that are readily available.

On Site Program Office Support. The Contractor shall provide on-site classified mobility Subject Matter Expert (SME) full time equivalent (FTE) support to the Government Mobility Program Office at Fort George G. Meade. On-site support will communicate and coordinate among all operations support personnel, engineering, Government personnel, etc. as required in the performance of the tasks detailed throughout the PWS. The Contractor shall attend meetings supporting DoD Mobility, annotate action items, meeting notes, meeting minutes, and report action item status within two business days after conclusion of meeting(s). Meeting Minutes will be due within three (3) business days and shall include notes from the meeting, action items with due dates, and assigned roles.

The Contractor shall provide a Staffing Plan detailing the management strategy used to successfully implement and sustain uninterrupted operations. This plan shall include a detailed roles and responsibilities matrix for the proposed staff members to ensure adequate coverage and proper workload distribution for those supporting field and/or lab operations.

The Contractor shall develop a project Work Breakdown Structure (WBS) to include a summary of project and task order levels, and submit it to the Government for approval. The WBS shall outline all resources, major and individual tasks assigned, and the level of effort for task completion. The WBS shall also address key milestone events, critical path activities, and delivery dates.

The Contractor shall develop an Integrated Master Schedule (IMS) and submit it to the Government for approval. The IMS will continue to be developed with the assigned Project Leads and Program Managers of the Mobility Program, managing and incorporating all feeder projects in subordinate IMS as well. The IMS shall include key milestones and activity information for the program and tasks identified by the Government. The Contractor shall coordinate with the Government on a daily basis to incorporate changes to the schedule and deliver the schedule to the Government on a monthly basis for approval.

The Contractor shall provide Level 2 Tier III engineering support in ongoing network performance metrics and system performance analysis. The on-site Mobility Program Office support will be in support of the continuous system performance as dictated in Section 6.2.3 Architecture Development. The Contractor shall be engaged and notify the Government of imminent risks that impact the system and/or service.

Deliverable(s): Meeting Minutes

6.1.2. Monthly Status Report (MSR) and Review

The MSR shall be used to track the quality and timeliness of the milestones, services, and deliverables as well as risks and task order/program financials. Within 30 days after task order award, the Contractor shall submit a draft MSR to the COR/ACOR to confirm format and contents meet the Government’s needs. The Contractor shall incorporate any Government comments and submit the final report format within five business days. The MSR shall include, but is not limited to: accomplishments for the quarter, plans for the next quarter, identifiable risks and recommendations for mediating the risks, expenditures, cumulative funding summary, and a listing of all personnel associated with the execution of the performance tasks. The MSR for all preceding months will be due by the fifteenth calendar day of the following month.

The Contractor shall conduct monthly in-progress MSR reviews that includes a summary of all specific tasks as requested by the Government. The Contractor will provide a review of progress against cost and schedule performance, programmatic and technical risks, and identify and resolve critical issues and actions as set up by the COR/ACOR. The Contractor shall conduct analysis of the risks involving cost, schedule, and performance parameters associated with the performance of this task order.

The Contractor shall identify high risk factors and develop mitigations to reduce risk. Upon Government approval, the Contractor will implement and monitor the selected mitigations. The Contractor shall work with the Mobility Program Office to de-conflict any schedule or deployment issues. In addition, the Contractor shall notify the COR via email once a high risk factor has been identified. The Contractor shall track these high risk factors via a risk matrix and develop mediations to reduce risk by identifying, addressing, and providing prioritization of risks (including how risks will be recorded and reported) as a part of the MSR. The Contractor should consider the full range of risks that could impact the project including, but not limited to resources, access, physical and cyber security, and unplanned events. Upon Government approval, the Contractor will implement and monitor the selected mediations. The Contractor shall work with the Government to mediate any schedule or deployment issues. Personnel listing should detail a “roles and responsibilities” matrix for all staff members and identify all dedicated full time and part time equivalents to ensure adequate coverage and proper workload distribution.

Deliverable(s): Monthly Status Report Monthly Status Meeting

6.1.3 Risk Management Plan

The Contractor shall provide a comprehensive risk management plan addressing the identification, assessment, and prioritization of risks including how risks will be recorded and reported. In addressing risk, the Contractor should consider the full range of risks that could impact the project including, but not limited to, resources, access, physical and cyber security, and unplanned events.

Deliverable(s): Risk Management Plan

6.1.4 Technical Writing and Knowledge Management

The Contractor shall develop, write, edit, and update documentation such as reports, manuals, briefs, whitepapers, catalogs, guides, and related technical and administrative publications.

Example documents include Concept of Operations, Service Operation Annex, and Technical Implementation Plans. The Contractor should have a clear understanding of DISA’s approval process and lead the DISA Operational Approval Processes as appropriate (ex. the Network Readiness Review Board (NRRB)). The Contractor shall maintain archived records and files of work revisions, and other essential documentation. The Contractor shall assist in maintaining release notes, functional deltas, installation guides, upgrade guides, migration guides, administration guides, user guides, training, and quality assurance plans and results as well as any other pertinent documentation relevant to Mobility. The Contractor shall provide a comprehensive Knowledge Management Guide that includes Mobility. The Contractor shall assist in developing the knowledge management capability to support various functions including task management, engineering action tracking, test management and status, configuration management, and general file storage. The Contractor shall maintain the knowledge management tool(s) in order to create and to structure portals necessary to display, disseminate, and keep current knowledge and information in the most efficient and useable format for the program and product management team, DISA leadership and DoD customer. The Contractor shall support Knowledge Management (KM) TTPs and SOPs, KM Implementation Plan, and DEPS site structure updates for current pages as well as design of new pages to include implementation and pages data population.

The Contractor shall create, edit, and improve any briefings. The Contractor will be responsible for tailoring briefings for targeted audiences and support graphic design requests.

The Contractor shall provide expertise in the technical knowledge of integration of information and knowledge portals for efficiency purposes and limit redundancy. Knowledge of integrating artifacts and tasks between FORGE.MIL and the DISA Enterprise Portal Service (DEPS) is an example.

Deliverable(s): Knowledge Management Guide

6.2 Transition of Gateway and Operational Support Services

6.2.1: Transition Planning and Execution of Operational Support Services and Equipment The Contractor shall support concurrent network operations services and receive all gateway operational support services from the incumbent Contractor. This shall include, but is not limited to, the following areas of responsibilities:

· Configuration

· Information Assurance (Configuration management support (current status and processes)

· IA support

· Mobile Device Management (MDM) support

· Implementation management support (to include history and current status)

· System performance analysis

· Virtual Private Network (VPN), Voice Over IP (VoIP) and gateway management (to include on-boarding and de-boarding devices)

· System and network engineering

· System deployment and integration support

· Incident handling and reporting

· System status reporting

· Asset Management responsibilities (to include transitioning active maintenance/support plans and licenses), transition all administration and user accounts

· Physical hardware

· System monitoring requirements (to include Continuous Monitoring (CONMON) support requirements) in order to facilitate a seamless transition and assure minimum service disruption of the current 2v4x7 on-site administration support, Service Desk Tier I and Tier II responsibilities and Program Office Tier III responsibilities

· License and certificate expiration tracking

The Contractor shall have complete information on the on-site operations and remote management support at the gateway locations, and full access and knowledge to all required systems to administer the Gateways to include the DISA Global Trouble Management System (GTMS) in order to effectively manage the Enterprise Mobility Management (EMM) suite. The Contractor shall ensure an official handoff of all privileged user accounts to the system and disable all accounts used by the predecessor Contractor. The Contractor will create a transition checklist of required information, documentation and system access. This checklist will be used to facilitate the transitions between the contractor and the incumbent contractors.

All operational support requirements to be transitioned include, but are not limited to the following:

· Coordination processes and requirements with DISA Global Operations Command (DGOC) and Watch Officer (WO)

· System maintenance and administration requirements

· Configuration Control Board (CCB) processes

· Network management support, trouble analysis procedures, network and system

· monitoring and administration/coordination

· Asset (hardware and software) maintenance and licensing tracking and support

· Circuit configuration advisement

· General administrative tasks as they pertain to personnel access and clearances for Government facilities The Contractor shall provide all mandatory Government Standard Operating Procedures (SOPs) and Concept of Operations (CONOPS), which include, but are not limited to: the Gateway Operations and Maintenance Manual, Authorized Service Interruption (ASI) SOP 100-55-08, the Global Information Grid Service Management – Operations (GSM-O) Operations and Maintenance (O&M) Convergence Network Operations C2 CONOPS, SOP for DISA GTMS Ticket Opening/Updating/Closing 13-GSM-SOP-OPS-0021-04, Version 04, as they apply to Network Operations Concepts and Network Management policy/procedures governed at the DISA and DoD Enterprise Level. Transition support shall also include all real time monitoring and management requirements of DISA Services for operational awareness and Cyber Defense.

The Contractor will support weekly meetings during the transition period to ensure a smooth transition of operational support services.

Deliverable(s): Transition checklist

6.2.2 Receipt and Execution of Engineering and Testing Services and Equipment The Contractor shall minimize service disruption and service degradation during and after a transition period from the incumbent Contractor. Transition shall include but not limited to relocating all Government owned property at Contractor facilities and information to include active support plans and licenses, and information as required to maintain service, and transition all administration accounts to a location designated by the Mobility PROGRAM OFFICE. The transition must maintain the current National Information Assurance Partnership (NIAP) and Commercial Solutions for Classified (CSfC) approved DMCC-S and DMCC-TS gateway solutions. Attributes of the Transition Plan include detailed transitioning activities of the requirements as described above and acceptance testing criteria.

6.2.3 Gateway Solution Delivery

The Contractor will provide one of the following Courses of Actions for the Gateway Solution:

1. If the solution is to provide a new NIAP and CSfC approved VPN, but keep the existing equipment, then the transition should be complete within 60 – 90 days after approval from Government is received to move forward.

2. If the solution is to provide a new end-to-end NIAP and CSfC approved solution to include an approved VPN and certain or all parts of the existing infrastructure that is operable with end user devices, then the transition should be complete within 90 - 120 days after approval from Government is received to move forward.

The solution deliverable will include a fully detailed Mobile Access Capability Package (MACP) version 2.0, vendor agnostic/open platform technical architecture and a detailed briefing highlighting the capabilities of the proposed solution, focusing on key areas including: technical performance, operational support, integration with existing capabilities and transition risks.

The proposed solution should meet all of the following requirements:

· All products used shall be active on the CSfC components list at time of proposal submission

· All proposed VPN components shall have the ability to integrate with the Native Samsung S7 VPN Client and/or Native Android VPN client

· All proposed solutions shall integrate with existing PKI infrastructure. No additional systems or products will be available for assistance in solution integration

· All solutions shall be built to MACP version 2.0 compliance

· All solutions shall have the ability to integrate without needing to alter or re-provision any End User Devices (EUDs)

· All solutions shall be able to report usage and performance metrics within 1 hour of requests

· All solutions must be able to operate in a low bandwidth cell coverage areas to include OCONUS and CONUS, for example 2G cell coverage

6.2.4 Transition

The contractor shall provide a transition plan which includes a detailed description of the contractor’s plan to execute the transition of all support services from the incumbent contractors as detailed below. At a minimum, the transition plan shall describe the technical approach, organizational resources, management controls, significant risks, and projected timelines to be employed to meet the cost, performance and schedule requirements throughout the PWS execution. The Transition Plan is the basis for the execution of all transition activities.

Upon the award of this task order, the contractor shall provide transition-in support to ensure the continuity of the current gateway operations and services and minimize service disruption and service degradation during and after transition period. During the transition period, the Contractor will assume Tier III operational support duties. Maintenance of the existing solution may be required for up to one year after task order award; however, the contractor shall strive to transition services in less than a year. The Mobility Program Office will support weekly meetings with the contractor and incumbent contractors to ensure a smooth transition.

Deliverable(s): Transition Plan

6.3 Engineering Support

6.3.1 Systems Engineering Support

The Contractor shall take over any new and existing engineering efforts. The Government will provide guidance on prioritizations of engineering efforts for the contractor to base staffing plans. The Contractor will be responsible for the entire engineering lifecycle from planning through Tier III Operations. Such efforts are listed, but not limited to:

a) Virtualization

b) Gateway solution transition

c) Continuity of Operations (COOP) for the Gateways

d) Classified data at rest (DAR) and non-DAR solution

e) Gateway upgrades in support of updated MACPs

f) Convergence of Gateways classifications

· Consolidated Black and Gray Enclaves

· Multiple Red Enclaves

· Additional gateways (Single/Converged) deployed

6.3.2 Systems Information Assurance (IA)

The DMCC Secret and Top solutions have been engineered to maintain and operate the procedures and tools (IA SW, HW and network) that provide the infrastructure with confidentiality, integrity, availability, authenticity, access control, survivability and non-repudiation of information. The infrastructures shall continue to be engineered so that security shall be provided to protect all information and data in accordance with Federal, DoD, Joint Chief of Staff, DISA Authorizing Official (AO), and Mobility Program Office security policies.

As such, the Contractor shall provide Tier III engineering and implementation support services in maintaining and/or meeting the following security requirements:

· Security Technical Implementation Guides (STIG) compliance

· Information Assurance Vulnerability Alert (IAVA) compliance

· Host Based System Security (HBSS) compliance and Information Assurance/Intrusion Detection (IA/ID)

· Physical security requirements for operating systems, as applicable

· Assured Compliance Assessment System (ACAS)

· MACP compliance

In coordination with the Government, the Contractor shall continue to maintain secure applications and configurations through applying applicable DoD STIGs, checklists, vendor security guidance, industry best practices, and applicable vendor product security patches. The Contractor shall ensure currently deployed applications are in compliance with DODI8500.2 Information Assurance Implementation (current version) and DODI 8551.1 Ports, Protocols, and Services management (current version). The Contractor shall assist in leveraging, to the maximum extent possible, automated tools to identify and remediate vulnerabilities or weaknesses in the currently deployed applications such as those described in Common Weakness Enumeration/System Administration, Networking, and Security Institute (CWE/SANS) TOP 25 Most Dangerous Software Errors (http://www.sans.org/top25-software-errors/) and Open Web Application Security Project (OWASP) Top Ten https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project, that could be exploited by unauthorized sources.

The Contractor shall participate in Government formal and informal design reviews to identify potential security weaknesses, deficiencies, and/or vulnerabilities in the design. As part of the change control process, the Contractor shall ensure participation by the Information System Security Engineer or a qualified cyber security SME to evaluate the security impact of each change. The Contractor shall maintain documentation of the results of these evaluations within the Systems Engineering Plan (SEP). The Contractor shall also ensure appropriate security requirements are included as part of the requirements traceability matrix and are evaluated as part of the security assessment.

The Contractor shall assess the implications and coordinate solutions for required security updates that affect the systems with operations personnel and monitor their successful implementation. The Contractor shall ensure the system engineering design is compliant with applicable IA and CSfC CP requirements, STIGs/Checklists, DISA Command Center (DCC) Command Task Orders (CTOs), ACAS results and NIAP Protection Profiles. The Contractor shall assist and support Government requirements to accomplish submittal of new and amended Certification and Accreditation packages for the DMCC-S and DMCC-TS infrastructures including system configuration of all components. The Contractor shall support bi-annual security self-assessment activities.

The Contractor shall provide engineering and or Tier 3 support to existing mechanisms as they apply to this effort to provide the capability to preserve, protect, detect, react, revise and recover from threats, intrusions and denial of services. These mechanisms are provided by DISA Enterprise Services. These procedures/mechanisms have been implemented to protect network, server, mobile devices, workstations, communication security (COMSEC) and physical facilities under Contractor control.

The Contractor shall analyze STIG, IAVA, and ACAS scans and provide appropriate supporting IA documentation for upload as artifacts in Enterprise Mission Assurance Support Service (eMASS). The Contractor shall provide weekly input so to elucidate the present security status of the systems to include, but not limited to, open IAVAs, STIGS and plans to mitigate vulnerabilities, which shall be done in a timely manner. If vulnerabilities cannot be mitigated within 60 days of release, the Contractor shall provide detailed Plan of Action for Mitigation documentation and seek approval from the Mobility Information Security System Manager (ISSM). The Contractor shall provide support for all efforts, duties and documents for requesting and maintaining Authority to Operate approvals associated with DMCC Secret and Top Secret capabilities.

The Contractor shall provide on-site classified secret and TS mobility IA SME(s) to support the Government Program Office at Fort George G. Meade. On-site support will coordinate among the Government, operations support personnel, Tier III Engineering, the Program Office, ISSM, Program Office IA team, and Contractor PM in providing required IA artifacts, reporting IA posture/status, assist in addressing present and upcoming IA vulnerabilities, and provide coordination support. IA administrative support will consist of, at a minimum, IA analysis, engineering, risk mitigation and other required efforts to maintain CSfC MACP IA compliance/registration.

In addition, the on-site IA SME shall support development of system documentation to facilitate the security assessment and authorization of the system according to DODI 8510.01 Risk Management Framework and the associated security controls as defined in DODI 8500.1, Cyber security Implementation (current version).

6.3.3 Systems Engineering Certification & Accreditation (C&A) The Prime Contractor must be on the NSA CSfC Integrator List. The Prime Contractor must maintain the CSfC certification for the life of the task order. Additionally, the Contractor must provide product offerings on the CSfC Components List.

The Contractor shall provide technical support to maintain C&A of the DoD/DISA Mobility classified Capabilities for Secret and Top Secret and maintain the CSfC security baselines. The IA accreditation boundary includes, but is not limited to the EMM, the mobility lab assets, Classified Secret and Top Secret production enclaves and Gateway infrastructure. The Contractor will be responsible for following all requirements and processes inside of the Risk Management Framework. This Framework will include access to multiple internal DISA Systems and applications. The Contractor will be responsible for handling all accreditation activities for all Mobility lab instances hosted within the DISA HQs.

The Contractor shall assist in being current and complaint with all DoD security requirements, to include but not limited to Security Recommendation Guides (SRGs), STIG, IA Vulnerability Management (IAVM), current CSfC Capability Packages (CP) requirements and any other applicable security policies applicable to the infrastructure components of the overall system solution.

The Contractor will provide support to all cyber security related meetings and tasking as required by the government. This will include but is not limited to cyber related reports, cyber related briefings, and any other task deemed required by the government. All deliverables will support DoD/DISA Mobility classified capabilities, to include TS security baselines.

Deliverable(s): DoD-approved C&A process artifacts and documentation Mobility Security Key Management Plan DoD Cyber Security Status “Stop-light Mobility” Cyber Threat Security Plan FISMA, IAVM, STIG compliance report/reporting

6.3.5 Architecture Development

The Contractor shall provide technical support and engineering services necessary to develop comprehensive DoD/DISA mobility classified architectures. To ensure continuous system performance, the Gateway shall continue to be engineered to maintain 99.5% availability, discounting incidents outside the Contractor’s direct control. The DoD/DISA mobility architecture is composed of many sub-functional systems and partner network interfaces. The Contractor shall assist in designing and developing Mobility enterprise system technical documentation (ex. System configuration reports, technical diagrams, Operational Views, System Views, and other diagrams) and architecture diagrams. The architecture diagrams shall include Operational Views, System Views, and other diagrams. The following are the current views being developed but not limited to adding and/or dropping other views:

Table X: Current DMCC Views

The Contractor shall provide DoD/DISA with architecture engineering services to develop the system architecture for the Mobility Program Office’s needs. The Contractor shall provide the Government with the architecture development support to include but not limited the following:

· DISA EMM Architecture

· Mobility Network Operations Architecture

· Mobility Continuous Monitoring (CONMON) Architecture

· Mobile Device Operating System (OS)

· Trouble Ticketing System

· Mobility Gateway Architecture

· Design (e.g. COOP, Robust, Load Balancing, Geo Routing)

· Services (e.g. Enterprise and device local)

· OS (e.g. mobile and gateway components

· Security (e.g. STIG, HBSS/ePO, ACAS, Cybersecurity Service Provider (CSSP), SSP, SSH)

· IAM (e.g. Enclave CAs, OCSP, CRL, CDR, Root CAs, Intermediate CAs, Cert Gen/Process, Radius, TACAS)

· Protocols (e.g. FTP, HTTPS, NTP, ICMP, IPSec, IKE, ICMP, SIP, TLS, SRTP, VLAN, Video)

· Networks (e.g. Cellular, Internet, NIPRNet, SIPRNet)

· Monitoring (e.g. IDS, CONMON, SMNP, SYSLOG, Auditing, DISA OSS, ESM/ID64, OPENNMS, Ansible)

· Components (e.g. NAS, VPN, FW, LSC, SBC, Switch, Router, EMM/MDM, MAS, MAM, ACS, DNS, NTP, Database, KGs, Load Balancers, Servers)

· PKE/PKI Authentication Framework Interface

· Enterprise Service Integration Interface

· DISA Mobility Lab Architecture Development and Integration

· Requirements development

The Contractor shall periodically assess capability gaps of the current DoD/DISA Mobility architecture and develop/provide architecture roadmaps/transition plans based on “as is” architecture and the “to be” DoD/DISA architecture. The Contractor shall provide the Government with software and hardware purchase lists to build “to be” architecture packages. The architecture package shall also include a proposed detailed architecture diagrams and system configurations with port and protocols being identified and data flows and security architecture to protect the solution. The recommendation will drive future mobility implementation decisions and architecture development requirements. The Contractor shall be capable of conducting such analysis to validate their architecture designs and make such artifacts readily available upon the Government request.

The DISA Mobility Program Office lab is used to demonstrate new mobility capabilities. Architecture development to perform new pilot capability integration to the existing lab system baseline is frequently needed. The Contractor shall provide technical insertion services to support such architecture modifications to integrate a Commerical items/GFE/Custom solution into the current DoD/DISA mobility lab baseline.

Simulation modeling, data traffic flow analysis, network bandwidth analysis, performance and bottleneck analysis, design trade off analysis, load balancing and scalability analysis are often used to validate architecture development artifacts. The Contractor shall be capable of conducting such analysis to validate their architecture designs and make such artifacts readily available upon the Government request.

Transport The Contractor shall engineer, analyze, and troubleshoot connections with Government and any third party commercial network providers hosting mobile device connections between the DMCC user, the DMCC Gateway, DoD Enterprise Services, and mobile carrier network capabilities respectively. One such connection is to the cellular carrier Multi-Protocol Label Switching (MPLS) network services hosting mobile devices, which serves as a gateway on the carrier side to their mobile networks; others being access to DoD "backend services," such as email and streaming video, etc. Efforts also include testing, troubleshooting, documentation, and notification of any unique circumstances that may affect connection performance. The scheme of these connections are documented and shall be maintained in the SEP.

The Contractor shall develop an Implementation Plan outlining all required SW, HW, associated licenses and any other requirements needed to implement engineered solutions to establish connections with commercial wireless carriers or Internet Service Providers (ISPs). In addition, the Contractor shall accompany Government personnel in support of site survey analysis for the installation of an additional gateway. The site survey is an installation planning effort to assess space, power, racking, and gateway management requirement deficiencies to the Government for resolution as it relates to installing required HW of the Implementation Plan.

Systems/Application The Contractor shall engineer solutions that integrate with existing DISA and external services, for example email and VoIP systems. The Contractor shall investigate technologies and commercial solutions to meet prospective DISA end user needs or which provide opportunity to enhance existing systems and service offerings. Investigations will include capture of DISA requirements, market studies for applicable technologies and vendors, and identification of key characteristics for evaluation. The Contractor shall design testbed configurations and implement selected solutions for evaluation in test lab/pre-production evaluation environments as required. The Contractor will develop and execute test plans in accordance with the test criteria & evaluation approach and provide reports to DISA for incorporation into production system specifications as requested.

Remote Access Capabilities The Contractor shall engineer remote access capabilities to each independent component of the gateways, both HW and SW, so to provide access for Tier III services. The remote access will be used for but not limited to routine maintenance on the system, troubleshooting new and existing issues and making any changes deemed required by the Government.

Deliverable(s): Implementation Plan(s) Test Plan(s) Remote Access Plan(s)

6.3.5.1 End-to-End Systems Architecture Assessment

The Contractor will support end-to-end Systems Architecture review and propose changes. The purpose is to develop a list of incremental changes to gain operational resiliency, increased cyber defense, and increased cyber situational awareness. The Contractor will continually propose improvements for Government consideration throughout the life of the contract.

6.3.5.2 Infrastructure Refresh

The Contractor will deliver then integrate an end-to-end solution to upgrade the current classified mobility service offering. The end-to-end solution will include but not be limited to a VPN Solution, MDM, inner encryption components (e.g. VPN and TLS) and fully configured and hardened end user devices. The delivered End User devices should be the current market version of the existing CSfC/NIAP certified devices provided in the operational environment. During the capability integration, the Contractor must ensure they avoid any service interruptions with the existing operational environment. The Mobility Program Office will work with the Contractor to approve and execute an infrastructure refresh.

6.3.6 System Engineering Plan

The SEP provides the foundation upon which everything else is built and supports the DISA Mobility Program Office program success. SEP ensures the effective development and delivery of Mobility capabilities through the implementation of a balanced approach with respect to cost, schedule, performance, and risk using integrated, disciplined, and consistent SEP activities and processes regardless of when a program/project enters the acquisition life cycle. SEP also enables the development of engineered resilient Mobility systems that are trusted, assured, and easily modified. The Mobility SEP identifies the most effective and efficient path to deliver a capability, from identifying user needs and concepts through delivery and sustainment. SEP event-driven technical reviews and audits assess Mobility program maturity and determine the status of the technical risks associated with cost, schedule, and performance goals. As the objective of the Mobility Program Office is to provide enterprise level service offerings across a spectrum of DoD users, it is important to manage the requirements and related processes to ensure customer expectations are met by the products delivered. Continued growth in the number of Mobility users is tied to gathering customer requirements, having a process that makes them a partner in the product development, and keeps them informed of the progress.

Requirements process plays a major role in the SEP as system requirements that describe the functions which the system as a whole should fulfill to satisfy the Mobility Program Office needs and required capabilities. Mobility Requirements process synchronizes with the DISA Mission Partner Engagement Office (MPEO) and the Requirements Analysis Office (RAO) and will be updated to harmonize with the newer ITIL and DESMF processes.

The Contractor shall support and perform, but not limited, to the following activities:

· Develop, maintain and execute the Mobility Program Office program’s SEP

· Develop Mobility Program Office program review briefings

· Develop Mobility Program Office program Architecture views as noted in Section 6.2.3 Architecture Development in accordance with DISA guidelines

· Provide Systems Engineering support for all systems engineering and integration tasks for the Fort Meade Labs

· Support major reviews, including Chief Mobility Engineer in weekly Engineering Review Boards (ERB), requirements review (ERB#1), preliminary design review (ERB#2), critical design review (ERB#3), system readiness reviews (ERB#4a/b), functional configuration audit and Mobility CCBs

· Interface or coordinate with NSA, JTIC, DISA and other DoD Components so to provide the necessary inputs

· Develop Test and Evaluation Strategy/Test and Evaluation Master Plan (TES/TEMP)

· Develop Life-Cycle Sustainment Plan (LCSP)

· Scale the Program Office Mobility SEP based on the scope and complexity of the program/system effort

· Work with the system integration teams to develop plans and timelines for the integration or install of the system(s)

The SEP will include a description of the Mobility Program Office program’s overall technical approach including processes, resources, metrics, applicable performance incentives, and the timing, conduct, and success criteria of technical review as well as Architecture Views and Summary Information for DMCC Secret and Top Secret Systems. The Contractor will provide an Interface Control Document (ICD) on one or more new Mobility capability requirements and associated capability gaps. The ICD also documents the intent to partially or wholly address identified Mobility capability gap(s) with a non-material solution, material solution or some combination of the two.

Deliverable(s): SEP (ERB#1-4a/b) Interface Control Document

6.3.7 Mobility Requirements Process

The Contractor shall determine how and when each new Mobility requirement should be verified, the tasks required to do so, as well as the necessary resources (i.e., test plan) to produce the verification matrix and supporting documentation to become part of the Mobility Program’s functional and allocated baselines. The Contractor shall support and perform the following activities:

· Develop, maintain, update, and execute the Mobility Program Office’s Requirements SOP

· Present the Mobility requirements baseline in accordance with the requirements management process from the Mobility SEP

· Establish and maintain a Requirements Traceability Matrix (RTM) that captures all requirements for DMCC-Secret, DMCC-Top Secret in the system performance specification, their decomposition/derivation and allocation history, and rationale for all entries and changes

· Develop an RTM which traces the functions of the capability back to the requirements also known as a DoDAF SV-5 or SvcV-5 view

· Review new Mobility requirements and assumptions to establish the overall decision context

· Documents the Mobility system’s internal and external interfaces and their requirement specifications

Deliverable(s): Requirements SOP

RTM

Interface requirements documentation Requirements Management Plan

6.3.8 Research Development Testing and Evaluation (RDT&E)

The RDT&E will aid the Mobility Program Office in continuing to enhance and improve capabilities across the classified portfolio. The Contractor shall be responsible for but not limited to executing five major tasking areas: Capability Research, identifying then evaluating emerging technologies, perform current capability assessments on deployed services, support two labs (located at DISA HQ), and provide support before, during and after major Government testing events.

6.3.9 Lab Support

To support multiple operational classified capabilities, the Mobility Program Office has begun the process of establishing two production represented lab environments. These two labs must be capable of hosting two unique test events for each capability at the same time while sharing physical hardware. Test events will include but not limited to system updating, patching, enhancements testing, troubleshooting, and operational changes. The shared hardware is designed to save the Government resources by eliminating required hardware and maintenance. The lab must be staffed and ready to provide quick turnaround on ad-hoc and planned test events, and must be able to expand or contract the lab based on the Mobility Program Office’s request.

Deliverable(s): Detailed and high level schedules Test preparation reports Test completion reports

6.3.10 Test Event Support

During the deployment of operational capabilities, the Contractor will support the DoD/DISA requirement to complete official testing events with Joint Interoperability Testing Command (JITC). The contractor shall assist in providing support to JITC before, during and after the test events. The Contractor will assist in creating timelines, test schedules, support during the test event in many different areas and then assist in the creation of the test report.

6.4 Mobility Capability Integration

6.4.1 Integration Services

The Contractor shall support existing integration efforts and is planning future integration efforts to improve capabilities. The Contractor shall take over any new and existing integration efforts.

Efforts listed are as follows, but not limited to:

· Additional Classified Gateways

· Pilot programs

· Additional devices

· Capability enhancements (e.g. Network, Service, Network Operations, etc.)

· Virtualization

· Continuity of Operations (COOP) for the Gateways

· Classified DAR and non-DAR solution

· External services

· Defense Red Switch Network (DRSN)

· Defense Enterprise Email (DEE)

· Voice over Secure IP (VoSIP)

· Identity management

· Cybersecurity services

· Interoperability with other classified systems

The Contractor will lead and assist with integration efforts and provide oversight and policy guidance to ensure compliance with standards for developing, implementing, and maintaining sound integrated and interoperable architectures. The Contractor shall ensure that security and information assurance is taken into consideration in all related architectures.

The Contractor shall assist with developing a mobility architecture and service framework to easily consume/support enterprise services. The framework will require identification of enterprise service interfacing requirements; identification of risks and challenges; development of a Service Level Agreement (SLA) process and SLA template to consume enterprise services for mobility customers; capability roadmap synchronization; and facilitation and resolution of interoperability, performance, and other issues related to interfaces, security, standards, and protocols critical to the end-to-end mobility operational systems.

The Contractor shall assist in the integration of the current mobility solution with DoD and DISA supported backend systems. This may include Enterprise portal, Enterprise Email, UC, and other Enterprise security solutions offered by DISA in addition to non-DISA capabilities. The Contractor shall assess and assist in the integration of data and event reporting requirements to external enterprise systems, including enterprise Network Operations tools. All integrations must have an implementation plan to include notional time frames for input into the IMS.

During the integration activities the Contractor may need to deploy SMEs to the DECC facilities where the equipment is being hosted. Many of the integration activities will require SMEs to be local at the DECCs to complete the integration.