HC108424R0005 AMD 0010.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

A) Provide AMD 0010 Question and Answ ers - HC108424R0005 PDF to provide further clarif ication to questions proposed.

B) Provide an updated PWS and Attachment 1, CLIN Pricing Worksheet, to provide further clarification.

C) Updated FAR 52.212-1, Instructions to Offerors – Commercial Products and Commercial Services, and FAR 52.212-2, Evaluation – Commercial Items.

The Government has answ ered all questions received.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 29

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 29-Oct-2024

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HC108424R0005

X 9B. DATED (SEE ITEM 11)

18-Jan-2024

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

29-Oct-2024

CODE

DISA/DITCO-SCOTT-PS84

2300 EAST DRIVE

SCOTT AFB IL 62225

HC1084 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HC108424R0005

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

(PWS)

PRICING OPTIMIZATION TOOL

DEFENSE COMMISSARY AGENCY

(DeCA)

Award/Mod Effective Version Date

Contract Number: To be determined Order Number: Not Applicable Contractor Name To be determined Tracking Number: 842368173 Prior Task Orders: Not Applicable

Contracting Officer’s Representative (COR):

Primary COR.

Primary COR. See Points of Contact in Contract Administration Data

Task Order Title: Retail Price and Promotion Optimization solution.

Background: DeCA operates 235 commissaries worldwide for the Department of Defense (DoD) with a legislative responsibility to provide commissary patrons with baseline savings as compared to commercial grocery prices. DeCA’s mission is to provide members of the military services and their families with an effective and efficient network of commissaries worldwide for the resale of groceries and household products at the lowest practical price and highest quality.

Objectives: The goals and expectations of this contract are to implement a retail price and promotion optimization capability using a SOC2 Type 2 environment. The objectives are to provide a retail optimization tool that shall produce data compatible with DeCA’s Enterprise Business Systems (EBS) product assortment catalog to allow personnel to analyze dashboard product details that shall help effectively determine price points for products and help DeCA understand customer needs, behaviors, and product features that add value to DeCA’s patrons.

Scope: The Contractor shall conduct agile method development activities with DeCA functional personnel, DeCA subject matter experts and other DeCA representatives. The Contractor shall design, document, and implement a retail price and promotion optimization solution meeting DeCA’s requirements. The Contractor shall provide post-deployment services and continuous improvement for the lifecycle sustainment of their solution.

Performance Requirements:

6.1 Task 1 – Deliver Optimization Tool Solution. The Contractor shall deliver and configure a retail price and promotion optimization solution that shall produces data compatible with NCR’s EBS Power HQ full item product assortment catalog. EBS Power HQ is a central repository for product assortment across the entire EBS Increment 1, 2, and 3 solutions. EBS Power HQ consolidates vendor, item, and store information providing DeCA with item information store allocation, vendor item base and net cost, and retail shelf price data management capabilities. To provide flexibility in service offerings, DeCA requires modular or tiered pricing for a pricing optimization tool as a stand-alone capability and have the option to include promotions module at a later date.

6.1.1 The contractor shall successfully work and coordinate all implementation activities needed with our Enterprise Business System (EBS), currently NCR provides EBS;

to execute the Power HQ loader requirement.

6.1.2 The retail price and promotion optimization solution data shall include all relevant Power HQ data attributes such as (but not limited to): Item UPC, Case GTIN, Brand Code, Vendor Number, Vendor Name, Item Description, RSL Code, Base Unit Cost, Future Cost, Future Cost Date, Current Retail, Future Retail, Future Retail Date, and Cost Adjustments based on Adjustment Type.

6.1.2.1 The solution is expected to provide predictive analysis and forecasting of the expected impact of the pricing decisions. The system shall include the consideration of variables and formula that support accurate forecasting of the final retails.

6.1.2.2 The solution shall include historical retails, historical sales volume, historical financial transactions to support the formulaic expression of forecasted impact.

6.1.3 Future Costs will be a part of the dataset and will be used to set a new retail based on the new costs to be effective on the date of the future cost. The system can provide a separate future cost portal that solely captures future costs and recommended retails, which would allow an analyst to solely review and approve applicable future costs. The goal is to capture and set retails for upcoming cost changes. Contractor can present their version of a solution for consideration.

6.1.4 The solution shall consume, employ, and allow for regular updates to the DeCA defined:

6.1.4.1 Product assortment merchandising hierarchy (major department, sub-department, major category, subcategory and segment) and the category manager and merchandising specialist assigned.

6.1.4.2 Regional cost zones, price zones and store zones. For DeCA the Stock keeping unit (SKU) counts ranges from ~10-17K items per store. SKU count within a store is dependent on the size of the store. The are 3 tiers of store sizes with regional differences due to the agency operating in 12 countries. Lower 48 is considered to be Continental United States (CONUS) . Alaska/Hawaii are their own regions, everything else is Outside Continental United States (OCONUS) Regions.

6.1.5 The solution shall consume, employ, and allow for weekly updates to the DeCA defined product assortment retail price families.

6.1.6 The solution shall consume, employ, and allow for updates to the DeCA defined special program indicators such as, but not limited to, Known Value Items (KVI), Everyday Low Price, Your Everyday Savings, and user defined product groupings.

6.1.6.1 KVI’s shall be determined by DeCA Leadership and the pricing strategies will vary and be applied by rule-based pricing groups.

6.1.7 The solution shall consume and employ DeCA sales EBS transaction logs and sales movement data aggregated by store by day.

6.1.8 The solution shall allow dashboards for senior level presentation.

6.1.8.1 The expected result / format of DeCA data presented to the end user shall include a row / column presentation of pertinent details of the item at the highest level to allow for an informed assessment of the recommended retails and the opportunity to adjust the retails prior to export. This data shall include cost, margin, potential margin, lift impact, margin impact, relevant comp data. Upon completion, the data shall be expanded to apply to relevant cost zones and price family items.

6.1.8.2 Planned and expected number of end-users expected to access the Price Optimization solution is not to exceed 25 end-users.

6.1.8.3 The tool shall capture the variables that impacted the decision making of the optimization process to include current cost, future cost, current retail, current margin, recommended retail, recommended margin, export retail, export margin, price family id, price family parent/child status, current sales volume, forecasted sales volume, current margin, forecasted margin, elasticity (if applicable), Job # or rules applied, and regional ID.

6.1.9 Contractor shall maintain the capability to remain data agnostic ensuring ability to evolve with agency system and data maturity needs. In other words, ability to interface the system shall produce data compatible with agency system replacements as legacy system solution life cycles end.

6.1.10 The retail price and promotion optimization solution shall be customizable without added technical support. Parameters are easily accessible to create necessary dashboards. A customizable solution without added technical supports shall allow the agency to dictate the performance of the optimization without added change requirements, using a low-code / no-code interface.

6.1.10.1 This shall include but not limited to the creation, modification, and removal of product groupings, regional identifiers, savings goals, margin goals, targeted margins, price family adjustments, inclusion/exclusion in optimization, fields of view in reporting, fields available for import, fields available for export, and user management. The admin console of the solution shall allow for the modification of optimization without the requirement of contract modifications.

6.1.10.2 The solution shall be easy to understand – intuitive for the user to create pricing and promotions inquiries.

6.1.10.3 For the visibility and Reporting Requirements, the primary level of the visibility for reporting requirements shall include executive managers, Power Analysts, and Retail Analysts. All levels shall possess the ability to access scenarios, view competition data, view forecasting of current status and forecast of scenarios. The only Manager, Power Analyst and Retail Analyst levels shall possess the ability to change retails for export. The contractor shall be responsible for managing the capabilities and assignments of the roles as directed from DeCA personnel.

6.1.11 Retail price and promotion optimization tool is readily available and not in development mode.

6.1.12 Rule based price scenarios with manual override. Rule based pricing allows for parameters to be set and modified within the system to include a hierarchical approach to savings goals, margin goals, growth goals, etc. The rules shall have the ability to be applied hierarchically to product groupings, regions, size, etc.

6.1.13 Ability to utilize product grouping and category specific parameters.

6.1.14 Multi-level review and approval processes.

6.1.15 Data compatibility with EBS and/or import and export capabilities with other future systems.

6.1.16 Scalable across product categories, regions and countries. The optimization shall allow for the use of a multi-variant approach down the subcategory level.

6.1.17 Data Structure and Optimization Parameters tool is expected to have rules-based pricing built into the platform. DeCA regions are identified by numerical cost zones which can also be identified by global region. Regional competition data can also be aligned by numerical cost zone. Rules Based Pricing shall be able to denote that applicable margin / savings performance be applied hierarchically depending on the zone / region. Cost / price zones have a numerical identifier. There are 39 cost / price zones that cover 235 stores in 12 countries. Competitor rules have first priority. Rules shall have a hierarchical order of priority as determined by the DeCA depending on the nature of the product, product grouping, region, etc. The program rules shall be adaptive and applied in order of priority.

The system shall contain a rounding rule component. EDLP rules are based on agreed upon retails with a promotional component outside of the routine process.

The agency will determine the EDLP approach based on the customizable Rules Based Pricing approach that shall be a core component of the selected system.

Product Grouping and Price Family Dynamics: Price families will be determined by DeCA Personnel and shall require price family import capability. Parent/child relationships and independently priced items have assigned designations PFAM#:

XXXX, Parent: 1, Child: 0, Stand-alone: 2. Regional Pricing variations to be determined. For Price moves, the system shall programmatically optimize the retails without violation. For example, if the margin floor is prioritized over competition retail, the margin floor will lead the decision path. The system shall not automatically apply retails as the Pricing Analyst will review all recommended changes prior to release.

6.1.18 For Multi-Level Approval Workflows, the Analyst, Power Analyst, and Manager shall possess the ability to modify and approve retail based on the standardized rules of pricing optimization. The approval hierarchy would enable the Analyst level to also build independent scenarios that include or allow for modification of existing rules and product groups (solely as it relates to the scenarios). Upon approval of regular retail and/or scenario retails, Power Analyst or Manager shall have the authority to approve the change for finalization.

6.1.18.1 The tool shall allow for the modification of groups, in case the agency decides to optimize a category by cost zone instead of region, and allow the accomplishment by modifying the product group and optimizing based on the factors related to that scenario/optimization schema.

6.1.18.2 Pricing workflow shall include a bi-monthly review and an adjustment of regular non-commodity retails.

6.1.19 For the Elasticity and Competitor Data Utilization, the Commissary benefit is designed to deliver grocery products at a mandated savings rate. Competitor data is ranked by the mode retail within proximity of DeCA stores.

6.1.19.1 The elasticity of the pricing optimization process allows for the agency to deliver the benefit in a manner that maximizes savings whilst generating varying margin goals. Margin and Savings goals shall eventually be category specific and the rules-based approach to allow for variations in goals. Presentation of item elasticity is sufficient in the optimization tool if forecasting models account for impact based on recommended or exported retails.

6.1.20 DeCA seeks a software solution and the requisite expertise to best implement the tool, apply best past practices, and optimize the DeCA retails in a manner that supports the savings/margin/performance goals of DeCA within a viable and properly forecasted system.

6.2 Task 2 - Program Analyst Support. The Contractor shall provide a subject matter expert and assist in the use of all Contractor provided data, services, and applications.

6.2.1 The analyst shall be available upon request to answer questions and provide customer support during regular business hours, where core hours fall from Monday through Friday from 6:30am – 5:00pm EST.

6.2.2 The Contractor shall provide the overall program management and administrative support to the management of the PWS requirements, and the management of the deployment support services PWS requirements.

6.2.3 Project Management Plan (PMP). The Contractor shall provide a PMP for the agile development of implementation project that details the project vision and goals; project scope; schedule, critical path, milestones, timeline; resource allocation; risk management; change management; quality management;

communication management; and continuous improvement. The plan shall also identify required DeCA resources.

6.2.4 Configuration Management Plan (CMP). The Contractor shall provide a CMP that includes detailed procedures and guidelines for managing the configuration, extensions, and documentation for the solution throughout the implementation project and the post-deployment support services.

For escalation criteria and priority level response times, the Contractor shall provide a Service Level Agreement (SLA) for Government approval.

Deliverables – PWS Task 6. 3

Deliverable Title Electronic

Format Due Date Distribution /

Copies Frequency and Remarks PWS 6.2.3 PMP Contractor

Format 20 Business days after award

One (1) each to COR and Information Technology Group Program Management Directorate (Office symbol: ITP).

Ongoing.

Remarks:

The PMP is a living document during the implementation project.

DeCA requires three (3) business days to review and approve plan changes.

PWS 6.2.4 CMP Contractor Format

20 Business days after award

One (1) each to COR and ITP.

Ongoing.

Remarks:

The CMP is a living document during the implementation project and during the post-deployment support services.

DeCA requires three (3) business days to review and approve plan changes.

PWS 6.2.4 SLA Contractor Format

30 calendar days After contract Award

One (1) each to COR and Information Technology Group Program Management Directorate (Office symbol: ITP).

Remarks:

DeCA requires five (5) business days to review and approve final SLA draft.

6.3 Task 3 – SOC2 Type 2 Compliant - DeCA is increasing the use of commercial cloud services to maintain its technological advantage, better secure applications, and reduce costs. The commercial cloud services sought by the DeCA include, but are not limited to, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) Cloud Service Offerings (CSOs), cloud computing, information technology services, and professional support services. It is the intent of DeCA that the scope of this PWS is sufficiently broad and flexible to satisfy requirements that may change over the period of performance and be fully comprehensive so as to embrace the full complement of services that relate to commercial cloud services.

6.3.1 This requirement shall reside and operate within services by Cloud Service Providers (CSPs) that are SOC2 Type 2 compliant with an emphasis on aligning with DFARS Clause 252.204-7012 regulation and NIST 800-171 Special Publication 500-291.

6.3.1.1 This will also be encompassing IaaS, PaaS, SaaS, and other commercially available CSOs as aligned with either the IaaS, PaaS, or SaaS service delivery model in accordance with the Cloud Computing Security Requirements Guide, at moderate Impact Level, as defined in the NIST Special Publication 800-145.

6.3.2 The Contractor shall acquire, install, configure, and provide software and software updates for all products associated with this contract. The cloud solution shall be available to DeCA and DoD via the internet on a pay-as-you-go basis. The Government will retain ownership of all consumers created/loaded data and applications hosted on Contractor’s infrastructure.

6.3.3 The Contractor shall ensure it operates in accordance with (IAW) DoD’s prevailing Cloud Computing Security Requirements Guide (currently dated 14 January 2022) to include continuously providing applicable data to DeCA’s certified DoD Cybersecurity Service Provider per DoD Instruction DoDI 8530.01.

6.3.4 The Contractor shall report all cybersecurity issues directly to the Information Systems Security Manager ISSM) or Strategic Information Security Officer (SISO).

6.3.5 The Contractor shall assist DeCA in the generation of all documentation to maintain accreditation under the DoD Risk Management Framework (RMF) IAW DOD 8500 series and processes.

6.3.6 The Contractor shall provide a DoD approved/SOC2 Type 2 compliant multi-factor authentication solution that is commensurate with the level of protection required for a moderate level environment. The vendor must show evidence that they can achieve a SOC2 Type 2 prior to contract award. These requirements apply to the entire solution (i.e., SaaS, IaaS, etc.). This means the SaaS and IaaS must meet these requirements (not just the IaaS).

DeCA requires engineering support to analyze Cloud requirements and to develop and implement recommended solutions.

6.3.7 Contractor shall provide the required level of logging and log review. For example, SOC 2 compliance requires the retention of log events for a minimum period of 365 days. The log group retention period is an essential control for maintaining audit trails and preserving log data for a sufficient duration. Contractor alignment shall include the following:

Be able to demonstrate their ability to identify and manage risks associated with data security and privacy (e.g., Effective access control mechanisms, such as strong authentication, role-based access, and least privilege principles).

Be able to demonstrate their ability to secure an independent auditor to evaluate the effectiveness of controls over a specified period, and ensure assessments confirm adherence to the prescribed security measures.

Be able to maintain comprehensive documentation of security practices and controls, and effectively address issues related to access controls, perform incident response, and data protection (e.g., reporting findings and demonstrating compliance).

6.4 Task 4 – Training – Training of end users is required as part of this proposed service, Contractor shall provide both comprehensive training and administer the introduction and onboarding for all testers, new and existing DeCA users.

6.4.1 The Contractor shall train Government personnel on their retail price and promotion optimization solution by providing an instructor-led training virtually or on-premises training at DeCA HQ Ft. Gregg-Adams.

6.4.2 Contractor shall provide an ongoing training requirement quarterly and per release / per annum with a minimum of 6 sessions of training with a variety of dates and times for all end users. The total class size estimated 25, not more than 50 per training session.

6.4.3 The Contractor shall provide training for all new end users as needed throughout the performance period of the contract.

6.4.4 The Contractor shall provide end user training for all updates to the platform and new capabilities introduced throughout the performance period of the contract. Training shall be 10 business days prior to any release to the production environment based on the Release Schedule.

6.4.5 The Contractor shall assist end users in the use of end-user-configurable services and settings for all provided products and services, as well as guide them in the appropriate use of the provided products and services.

6.4.6 Training Materials. The Contractor shall provide configuration managed training products and resources for both synchronous and asynchronous training.

6.4.6.1 Training materials include user manuals, job aids, cheat sheets/process guides, system embedded tips, interactive online lessons, and “train the trainer” lesson guides.

Synchronous training is defined as instructor led. Asynchronous training is defined as non-instructor led, but learner self-paced.

6.4.6.2 The Contractor shall provide the training material in electronic format and recording of the training session upon completion.

6.4.6.3 The Contractor shall provide video format training sessions.

Deliverable - PWS Task 6.4

Deliverable Title Electronic

Format Due Date Distribution /

Copies Frequency and Remarks

PWS 6.4.6.2

Training Materials

Contractor Format

Initial materials 15 business days prior to DeCA Testers and Pre-Deployment end user training.

One (1) each to COR and

ITP

Updated for each User Interface (UI) (screen) change during development.

Remarks:

DeCA requires five (5) business days to review and approve final training materials.

6.5 Task 5 – Testing - The Contractor shall be responsible for all necessary testing of the solution to ensure successful integration with DeCA’s existing EBS environment to include any associated data compatibilities.

6.5.1 Prior to testing, the Contractor shall provide end-to-end training on their retail price and promotion optimization solution to DeCA personnel test team.

6.5.2 The Contractor shall provide system test scenarios and step-by-step test cases. All user queries shall have their respective user test cases. The Contractor shall validate and verify all configurations and connectivity extension functions of retail price and promotion optimization solution as a result of this testing.

6.5.3 The Contractor shall perform system and development testing in DeCA’s Developmental Test & Evaluation (DT&E) environment - DEV/DT&E1; DeCA personnel will perform testing in the DT&E2 environment.

6.5.4 Contractor shall perform end-to-end testing in support of any change including cybersecurity related updates, system modifications, and cloud migration.

6.5.5 The Contractor shall maintain the-current application baseline to match the DeCA production environment, throughout the life of the contract.

6.5.6 The Contractor shall follow the below performance milestones:

Milestone 1 Kick-Off Meeting and Deliver Project Schedule.

Milestone 2 Deliver 100% Functionality to DTE2 (DeCA DTL). The Contractor shall deliver a testing solution that shall successfully integrate with DeCA’s existing EBS Power HQ environment. The Contractor shall also provide a Plan of Action and Milestone timeline for any discrepancies that need to be resolved.

Milestone 3 Deliver 100% Functionality to Production Store. The Contractor shall deliver a solution that shall be 100% successful in integrating with DeCA’s existing EBS Power HQ environment. The Contractor shall also provide a Plan of Action and Milestone timeline for any discrepancies that need to be resolved.

6.5.7 The Contractor shall conduct end-to-end testing in all DT&E environments. The Contractor shall maintain all test cases and test results to include configurations and extensions.

6.5.8 The Contractor shall provide all test tools and training on test tools to DeCA’s testers and users.

6.5.9 The Contractor shall maintain the final release package in DT&E2 after testing in DT&E 1 and 2.

6.5.10 The Contractor shall release solution into the production environment after user testing is approved and complete.

6.5.11 The Contractor shall submit a Test Plan that includes schedules, decision gates, roles and responsibilities and an installation/test checklist to be used as a part of Government testing and acceptance.

6.5.12 Developmental Test & Evaluation is the type of testing which verifies that the system under test meets all technical requirements. Vendor verifies their solution in DT&E1 and when it is complete they pass it to DeCA (DT&E2) with test cases. In DT&E2 - DeCA verifies that the vendor's solution is satisfactory and that all technical specifications and contract requirements have been met. The Contractor shall have a development/testing environment (DT&E1) in which the contractor shall test the solution or changes to the solution prior to providing this to the Government. The Contractor shall provide test cases to the Government and shall assist the Government in validating the solution and verifying the solution is satisfactory prior to the government implementing the solution within the Governments Production environment.

6.5.13 Critical Design Review (CDR) - The Contractor shall deliver a detailed design of the proposed solution and conduct a critical design review.

6.5.14 Test Readiness Review (TRR) – The Government and the Contractor shall conduct a joint Test Readiness Review, based on the Contractor’s test plan, and submitted test conditions, with the DeCA Technical Review Board (TRB). Based on the results of the TRB and a review by the DeCA Program Manager (PM), authorization may be granted for Initial Test & Evaluation

(IT&E).

6.5.15 IT&E – The Contractor staff shall work with DeCA personnel in the IT&E of the system software and hardware components. The IT&E testing shall include load testing and response time testing.

The Contractor shall perform any remediation necessary to correct system performance functions.

The Contractor shall provide equipment/facilities necessary to conduct initial integration testing of the software.

6.5.16 Security Test and Evaluation - DeCA intends to use Government and other Contractor personnel to perform DoD RMF cybersecurity scans and reviews both prior to IT&E and during IT&E. The Contractor shall provide personnel, as needed, to assist in security documentation, testing, and remediation.

6.5.17 Production Readiness Review (PRR) - The Government and the Contractor shall conduct a joint Production Readiness Review, with the DeCA TRB. This review is based on the Test Report and the Test Readiness Review Scenarios, and the overall readiness of the system to be deployed.

Based on the results of the TRB and a review by the DeCA PM, authorization may be granted for installation of the solution.

6.5.18 Operational Test and Evaluation Testing - Installation and Operational Test & Evaluation (OT&E) testing shall be conducted in the same period.

PWS

Task#

Deliverable Title Electronic Format

Due Date Distribution / Copies

PWS

6.5.11

Test Plan - Contractor shall describe how the system shall be tested in the DeCA test lab and in an operational pilot environment to verify that the solution meets the functional requirements. The Test Plan shall include specific test scripts to be used during testing.

Microsoft Office

45 days after contract acceptance

One (1) each to DeCA PM, Test lead, EBS Pricing Chief.

PWS

6.5.12

CDR- Deliver a detailed design of the proposed solution and participate in a CDR with the information produced in 6.5.7, with the DeCA TRB IAW the DoD 5000.02.

Microsoft Office

45 days after contract acceptance

One (1) each to DeCA PM, Test lead, Pricing Chief.

PWS

6.5.13

TRR - Provide a summary of the testing planned for IT&E, High Availability Testing, and outline the approach to achieve Cybersecurity RMF Certification. Participate in a TRR & TRB with DeCA personnel.

Microsoft Office

TRR

material shall be.

submitted

NLT

30 days prior to beginning of testing.

One (1) each to DeCA PM, Test lead, & Pricing Chief

PWS

6.5.14

IT&E - Perform the IT&E of the system software and hardware components. Perform any remediation necessary to correct any hardware, software, or system performance issues encountered.

Microsoft Office

Completed within 75 calendar days after contract acceptance

One (1) each to DeCA PM, Test lead, Pricing Chief.

PWS

6.5.16

Test Report – Deliver detailed reports upon completion of each testing phase that includes, at a minimum, the number of employees included in testing, locations, results of each phase of testing, scenarios tested, results of each scenario, issues logged, and mitigation and/or resolution of test issues. The Contractor shall participate in test acceptance reviews, prior to the Production Readiness Review.

Microsoft Office

14 calendar days following completion of Product Testing

One (1) each to DeCA PM, Test lead, Pricing Chief.

PWS

6.5.16

PRR - Provide a summary of the test results and Information Assurance certification outcome to ensure successful completion of the OT&E, RMF testing, and the achievement of RMF Cybersecurity Certification and Authority to Operate (ATO) from the DeCA designated approving authority. Participate in a TRR, in support of DeCA personnel with the DeCA TRB.

Microsoft Office

30 calendar days prior to Product Installation

One (1) each to DeCA PM, Test lead, EBS Chief and Pricing Chief Point-of-Contact

PWS

6.5.17

OT&E – Contractor shall perform OT&E to test software in a test environment that is designed for actual users in realistic operational conditions. This shall determine if the software is operationally effective

Microsoft Office

30 calendar days prior to Product Installation

One (1) each to DeCA PM, Test lead, EBS Chief and Pricing Chief

6.6 Task 6 –Lifecycle Sustainment - The Contractor shall perform maintenance and lifecycle sustainment activities that include designing, coding, testing, and implementing the retail price and promotion optimization solution requirements. This shall encompass all aspects of operating the production, development, test environment and any updates to different Enterprise resource planning interfacing.

6.6.1 The Contractor shall recommend changes through the change management process to improve the operational efficiency of their solution.

6.6.2 The Contractor shall perform configuration management of the software per the CMP.

6.6.3 The Contractor shall refresh data in the test environments at least quarterly to have current data available for use in testing.

6.6.4 The Contractor shall make changes to configuration of their solution when directed by the

Government Program Manager.

6.6.5 The Contractor shall coordinate and make plans with the Government, and request

Government approval before executing any scheduled system downtime in the production environment whether initiated by the Contractor or requested by the Government.

6.6.6 The Contractor shall keep abreast on new and emerging technologies for retail price and promotion optimization solution. Contractor shall maintain training and knowledge of program changes that can potentially be applied to the current instance of their solution. The Contractor shall investigate and perform upgrades to allow their program to perform its function more effectively with new technology and/or versions of software.

Task 7 - Cyber Security Compliance - The Contractor shall provide cybersecurity compliance parameters on cloud-based solutions.

Provide the knowledge, skills, abilities, staff support, and other related resources necessary to conduct the following RMF related services:

• Execute RMF Requirements and Related Services

• Implement Security Controls

• Remediation, Documentation, and Tracking of Deficiencies

• Provide or create evidence/artifacts to prove security control implementation annually

• Achieving and maintaining authorization of the system

• Continuous Monitoring of Security Controls Implemented

6.7.2 The Contractor shall provide information and assistance requisite to maintain a DeCA Cybersecurity ATO for all hardware and software components under the DoD RMF, or current DoD risk management process.

6.7.3 The Contractor shall implement applicable NIST 800-53 security controls, to include additional controls required for applicable overlays IAW the NIST 800-60 system categorization.

6.7.4 The Contractor shall create, document, and maintain current all supporting artifacts required to satisfy NIST 800-53 security control test procedures. The Contractor shall create, upload and maintain supporting artifacts, security control test results (including evidence), and Plan of Action and Milestones (POA&Ms) in E-MASS for all RMF activities in support of initial and annual security reviews and to support continuous monitoring activities. Ensure all information system cybersecurity-related documentation is current, remains current, and is available in (E-MASS) and accessible to properly authorized individuals.

6.7.5 The Contractor shall implement all NIST 800-53 applicable security controls (e.g., access controls, anti-virus, vulnerability management, configuration management, audit log management, STIGs, etc.), DeCA security requirements (e.g., DeCA 35-31.01 series), and additional DoD security requirements (JFHQ-DoDIN mandated items, etc.) are implemented within the timelines defined by DoD official notices (e.g., task orders, DoD vulnerability alerts, etc.) and/or DeCAM 35-31.01.

6.7.6 The Contractor shall create POA&Ms for all system vulnerabilities and deficiencies, facilitating remediation activities, and tracking the status of remediation efforts. All deficiencies must be documented in a POA&M and approved by the DeCA Authorizing Official per DeCAM 35-31.01.

6.7.7 The Contractor shall provide knowledge, skills, and abilities assessments to all staff members for this functional area IAW NIST SP 800-181 and the DoD 8140 series prior to assigning staff members to DeCA cybersecurity roles and responsibilities. The Contractor shall ensure privileged users complete the necessary technical and cybersecurity training, education and certification to carry out their cybersecurity duties as required by DoDM 8140.03/DoDI

8140.02. The Contractor shall maintain 100% compliance with DoD cybersecurity workforce requirements. Contractor personnel who do not meet cybersecurity workforce qualifications shall be denied access to DeCA systems for the purpose of performing cybersecurity functions/tasks. Therefore, Contractor personnel shall be unable to perform work and unable to charge against this task order until they have the required DoD cybersecurity workforce qualifications. Upon request by the Government, the Contractor shall provide documentation supporting the cybersecurity workforce certification and training status of personnel performing cybersecurity workforce functions.

6.7.8 Contractor shall develop, update, maintain, and deliver Process Flow Diagrams & Work Instructions for any processes or procedures specific to the Agency that is a deviation from documented federal guidance and instructions. Process Flow Diagrams and Work Instructions must be updated minimally on an annual basis or based on lessons learned.

6.7.9 Security incidents shall be handled and reported IAW DeCAM 35-31 and DeCA Incident Response Procedures.

6.7.10 In coordination with the ISSM, initiate protective or corrective measures when a cybersecurity incident or vulnerability is discovered.

6.7.11 Contractor shall ensure cybersecurity inspections, tests, and reviews (conducted by internal or external entities) are coordinated and supported properly (e.g., DeCA cybersecurity assessments, financial audits, cybersecurity inspections conducted by DoD, Payment Card Industry audits, etc.).

6.7.12 Verify that system audit logs are configured, managed, and reviewed (with anomalies/incidents reported) IAW DeCAM 35-31.01.

6.7.13 Ensure compliance with the DoD vulnerability management program by identifying components affected by vulnerabilities within the Assured Compliance Assessment Solution (ACAS) on a weekly basis, facilitating remediation efforts in order to comply with remediation timelines in DeCAM 35-31.01, monitoring the remediation status within ACAS, and reporting status on affected assets weekly, at a minimum. Ensure reports for whether or not assets are affected, total number of assets affected, and patch status are provided to the DeCA Cybersecurity Branch before the deadlines established by the US Cyber Command.

6.7.14 Implement all applicable system and software security hardening guides defined by DeCAM 35-31.01. Conduct compliance assessments to verify the security hardening baseline remains implemented, implement new hardening guides, and remediate deficiencies per DeCAM 35- 31.01.

6.7.15 The system shall comply with DoD requirements for the installation and configuration of DoD’s end point security point products (to include anti-virus) per DeCAM35-31.01. DeCA shall provide the end point software.

6.7.16 The Contractor shall implement an authentication approach consistent with DoDI 8520.03 based on the technology and data sensitivity. When the system uses DeCA's Active Directory, or credentials contained therein, to authenticate users, the system shall interoperate with DeCA's smart card logon solution and use of DoD Personal Identity Verification certificates on the Common Access Card (CAC).

6.7.17 All remote access to DeCA network resources shall use Virtual Private Network technology, CAC, and no Government Furnished Equipment shall be furnished IAW DeCAM 35-12.01.

6.7.18 The Contractor shall support DoD's plan to issue Public Key Infrastructure (PKI) credentials with stronger algorithms, DoD information technology infrastructure (e.g., servers, browsers, and email applications) must be capable of supporting stronger algorithms. All Public Key enabled commercial-off-the-shelf software and Public Key enabled Open-Source software integrations performed or purchased either as new procurements or as part of scheduled and budgeted DoD Component technology refreshes and upgrades must support at least RSA- 3072 (4096 is preferred) and SHA-384. Systems that will sunset before December 2027 are exempt from this requirement. In addition, all DoD information systems that have been upgraded or are upgrading to support RSA-3072 (or RSA-4096) and SHA-384 must continue to maintain backward compatibility with DoD's current RSA-2048/SHA-256 PKI credentials.

6.7.19 Personnel with access to DoD systems shall meet the background investigation requirements of DoD 5200.2-R and will receive a favorable investigation commensurate with their level of access to Government information. The DeCA System Sensitivity Designations for each DeCA system role is available upon request. Designations for new system roles will be documented per DeCAM 35-31.01.

6.7.20 The Contractor shall ensure program management reporting or status updates include cybersecurity requirements, such as status of RMF activity (e.g., activities in support of achieving / maintaining an ATO, Continuous Monitoring, annual reviews, security control updates, POA&M remediation activities, ACAS remediation activity, in support of DoD RMF, and vulnerability management remediation activity, etc.), to ensure the Contractor stays on track in meeting these requirements.

6.7.21 Provide Performance Metrics to the Government. Service Performance and Operational Metrics must minimally capture quantifiable measurements to gauge overall performance, track efficiency, effectiveness, quality, timeliness, governance, and compliance with all supporting tasks of this high-level functional area. Delivery expectations are monthly, quarterly (3), and annually (final quarter of reporting year). Reporting’s are based on fiscal year reporting.

7 Performance Standards:

Performance Standard Acceptable Quality Level (AQL) Methods of Calculation PWS 6.1 Task #1 – Deliver a solution that shall consume, employ and allow updates to DeCA’s full item assortment catalog and all relevant data and attributes

Target:

Production deployment baseline is 95% of all survey respondents are Satisfied, More Than Satisfied, or Very Satisfied

Minimum Acceptable:

> 85% of all survey respondents are Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery of Services

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least 5 Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate.

PWS 6.2 Task #2 – Program Analyst Support

Target:

Baseline is 95% Service Level Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery of Services.

Minimum Acceptable:

> 85% of all survey respondents are Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery of Services.

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least 5 Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate

PWS 6.3 Task #3 SOC2 Type 2 Cloud Compliant solution.

Target:

Baseline is a 95% Service Level Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management retail price and promotion optimization solution.

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least 5 Government personnel must

Minimum Acceptable:

> 85% of Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all IT Services complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate

PWS 6.4 Task #4 - Training of end users are required - as part of this proposed service, Contractor shall provide both comprehensive training and administer the introduction and onboarding for all new and existing DeCA users.

Target:

Training performance baseline is a 95% Service Level Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery of proposed Services.

Minimum Acceptable:

> 85% of Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all IT Services

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least 5 Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate

PWS 6.5 Task #5 Testing - Contractor shall be responsible for all necessary testing of their solution to ensure successful compatibility with DeCA’s existing EBS environment Implementation of:

1) Test Plan

2) Critical Design

Review

3) Test Readiness

Review

4) IT&E

5) Security Test and

Evaluation

6) Production

Readiness Review

7) Operational Test and Evaluation Testing

Target:

Testing baseline are a 95% Service Level Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all Services.

Minimum Acceptable:

> 85% of Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all IT Services

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least 5 Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate

PWS 6.6 Task #6 Lifecycle Sustainment

Target:

Sustainment baseline are a 95% Service Level Satisfied, More Than Satisfied, or Very Satisfied with

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of

Contractor delivery management of all Services.

Minimum Acceptable:

> 85% of Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all IT Services completed surveys returned.

At least 5 Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate

PWS 6.7 Task #7 Cyber Security Compliance

Target:

Cyber security baseline is 95% Service Level Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all Services.

Minimum Acceptable:

> 85% of Satisfied, More Than Satisfied, or Very Satisfied with Contractor delivery management of all IT Services

Calculation:

The number of 5 users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least 5 Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a 5% error rate

8. Incentives. This requirement is a firm-fixed price contract. The Contractor shall be evaluated in CPARS based on meeting performance standards.

9. Place of Performance. Work shall be performed by remote and on-site to DeCA Headquarters, Gregg-Adams, VA.

10. Period of Performance: The period of performance is estimated to be 48 months: one base period of performance of 12 months from date of award, and three 12-month option periods for maintenance. Contractors must price each item separately. The period of performance reads as follows:

Base Period— Date of award through 12 months Option Period 1— One year following base period.

Option Period 2— One year following option period 1.

Option Period 3— One year following option period 2.

As directed by the Program Manager, the Contractor shall continue performance in emergency or mission essential conditions. Additionally, the Contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Security Requirements: The Contractor shall coordinate site visits with site POCs at least 48 hours prior to requiring any site access.