Attachment_14_Supplmental_Information_Packet_Final.pdf

Source Selection Sensitive Information – See FAR 2.101 and FAR 3.104

DEFENSE THREAT REDUCTION AGENCY

8725 John J. Kingman Road, MSC 6201

Ft. Belvoir, VA 22060-6201

SUPPLEMENTAL INFORMATION PACKET

Defense Threat Reduction Agency

Agency-Wide Information Technology Services and Support

HDTRA1-18-R-0002

February 2018

TABLE OF CONTENTS

Consolidated RFI HDTRA1-IT-18REQ

Response Questions and Answers

Statement of Objectives for DTRA Agency-

Wide Information Technology Support

Services Base Contract

Industry Day Attendees Page 23

Strategic Plan 2017-2020 Page 26

Questions and Answers Regarding

September 1st RFI Addenda

Basic Contract Statement of Objectives for the DTRA Agency-Wide Information

Technology Services and Support Contract

Cloud Strategy Page 54

Agency-Wide Information Technology

Support Services (ITSS) Industry Day

Slides

Agency-Wide Information Technology

Support Services (ITSS) Industry Day

Slides

Consolidated RFI HDTRA1-IT-18REQ Response Questions and Answers

The Government has reviewed the RFI responses and appreciate the inputs and suggestions provided in the responses. Your feedback to the RFI is contributing to the continued evolution of the acquisition strategy for this anticipated acquisition effort. Also included in the RFI responses were questions submitted for government review and consideration. After reviewing these questions, the acquisition planning team recognized that the questions fall generally into three categories. The first category are unique and specific questions that warrant a specific and unique response. The second category of questions were similar and/or duplicate questions that either cannot be answered at this time, or are to be answered more appropriately during the planned Industry Day, included in documents that will become part of a technical library, or will be defined in the solicitation when it is released. The third category of questions are seeking specific details that will be more appropriately addressed within the individual task orders that will be issued against the planned overarching IDIQ(s) (based on the current, tentative acquisition strategy). To ensure consistent responses are provided to similar questions, the government has elected to group the questions within these three categories and provide specific or general responses as appropriate.

Section 1: The following questions were determined to be in the first category and are included in this section with specific and individual responses:

1. Is the work expected to be completed on-site in government facilities or will some tasks allow for remote support?

RESPONSE: The government anticipates a combination of on and off-site work based on the nature of the work to be defined at the task order level. Specific instructions will be included in the formal solicitation to allow consistent pricing.

2. Is the work expected to be completed on-site in government facilities or will some tasks allow for remote support?

RESPONSE: The government anticipates a combination of on and off-site work based on the nature of the work to be defined at the task order level. Specific instructions will be included in the formal solicitation to.

3. Is it mandated that the solution must be On-Premises, In the Cloud, or Both?

RESPONSE: DTRA has a Cloud Strategy that will continue to mature, and be implemented during the performance period of this anticipated acquisition effort.

During the performance period, the ITSS will support both on-premises and cloud, and the incremental migrations that will occur as selected services and capabilities transition to appropriate and available cloud based solutions.

4. Because the current incumbent has been performing on ITSS for 10 years, clarify how

Corporate Experience in addition to Past Performance will be evaluated as part of ITSS solicitation. Low-risk solution providers with the capability to deliver against the full scope of ITSS across the 10 year POP should be evaluated in a manner that does not favor incumbents past performance.

RESPONSE: The government continues to discuss and seek inputs regarding the ideal balance between IT technical expertise and qualifications, and the ability to translate IT expertise into the domain (the specific DTRA mission areas). The government’s plan is to conduct full and open competition.

5. The list of functional and task areas appear to cover all functions and tasks that need to be addressed in the emerging RFP. Vendor recommends that DTRA clearly outlines its expectations for these service areas as part of a Draft RFP. This should be quickly followed by open engagement between DTRA and industry, through the Q&A process, one-on-one sessions and tours of the facilities. Industry feedback can then be incorporated into the final RFP, which may impact the alignment of some tasks-tofunctional areas, as suggested. If DTRA follows that process, a final RFP can be issued that should ensure DTRA receives a number of highly competitive and fully technically qualified proposals from which to select its CIO IT performer of choice.

RESPONSE: The government is planning to hold “one-on-one” sessions as part of the Industry Day in July. The Industry Day announcement will include an opportunity to register for “One-on-One” discussion sessions where your suggestions and inputs will be most appreciated. The government further intends to release draft copies of the planning Statement of Objectives (SOO) in advance of the Industry Day to gain additional industry feedback.

6. Would the government consider allowing a physical walk through (site survey) of the DTRA data center(s) RESPONSE: The government will consider this request and provide additional information at a later date.

7. SOO Para 4.2: Please communicate the maturity level of the Information Technology Service Management (ITSM) and Information Technology Information Library (ITIL) frameworks being utilized at DTRA.

RESPONSE: DTRA has not been evaluated for ITIL maturity.

8. Explain the automation capabilities of the service desk. For example, is interactive chat with end users available; Can end-users create and submit service request online; What type of ticketing system is used; What IT system monitoring capabilities are used by the service desk?

RESPONSE: Yes, end users can communicate with the service desk via interactive chat sessions. Yes, end users can create and submit service requests online. The current ticketing and tracking system is Remedy. IT System monitoring is a function of the network operations center.

9. SOO Para 4.23: Provide amount of formal training sessions expected to occur over a 1 year period along with time duration of each session.

RESPONSE: The training requirement is specific to support the transition and deployment of new services/capabilities and to improve user efficiency and productivity. The precise amount of training will vary based on the pace of introduction of new services and capabilities.

10. Overall SOO: To accurately size the workload in the various task areas, an understanding of how many contractor FTEs currently fulfilling those task is required. Furthermore, an opinion from the government on whether the staffing levels were sufficient would be appreciated.

RESPONSE: The government intends to include level of effort metrics reflecting workload of the current scope in the Technical Library.

11. Will the government issue or share the historical level of effort prior to solicitation release?

RESPONSE: The government intends to include level of effort metrics reflecting workload of the current scope in the Technical Library.

12. Will the government please provide staffing requirements? Will the government provide the key personnel qualifications prior to solicitation release?

RESPONSE: Government anticipates releasing a performance based contract(s) and, as such, intends to leave to the proposing service provider the opportunity to determine the staffing levels, qualifications, and skill mix required to deliver the best technical solution at competitive rates. Government will provide historical data to assist vendors in their proposal.

13. Given the eight key functional areas and the almost 20 task orders considered, does DTRA think the timeline will hold?

RESPONSE: Yes, the government is on pace to release a solicitation in early calendar year 2018 to support award(s) by late summer. There is an Industry Day planned in

July and a draft RFP release in November with another Industry Day scheduled to follow the Draft RFP release. Content of the solicitation will be dependent on the ultimate acquisition strategy.

14. Is DTRA considering using an Assisted Acquisition (i.e., GSA, FEDSIM, NITAAC, etc.)? RESPONSE: The government has not yet ruled out the possibility of leveraging available GWAC/MAC/FSS as a procurement method.

15. Contractor suggests DTRA require offerors to possess processes appraised at SEI CMMI Level 3 and ISO 9001 and 20000 to ensure the Agency receives consistent service quality over the life of this mission critical requirement.

RESPONSE: The government has not yet determined what quality certifications, if any, will be established as minimum requirements for this acquisition. Your recommendation will be considered as this part of the strategy if finalized.

16. Due to the unique mission of DTRA and the preeminent importance of its mission, Contractor suggests using a Best Value Trade Off evaluation for this procurement.

RESPONSE: Thank you for your specific recommendation. The government is continuing to evolve the evaluation and selection strategies, and the best value tradeoff remains as a viable approach.

17. Given DTRA's focus on expertise and experimentation, has the Agency considered creating a Blanket Purchase Agreement (BPA) in the areas requiring more acquisition flexibility?

RESPONSE: The government is continuing to evolve the specific acquisition strategy for this acquisition. Using either a BPA or an IDIQ for portions of this requirement continues to be among the approaches under consideration.

18. We recommend that the government consider leveraging GSA’s Alliant Small Business

GWAC for Solutions Development and other DTRA requirements that require the innovation and agility that mature, highly capable small businesses bring to bear.

RESPONSE: The government has reviewed the GSA Alliant and Alliant SB GWACs, along with other GWACs/MACs and FFSs for potential use in support of this effort.

19. To ensure sufficient competition, we recommend that the government broaden the Past Performance relevancy factor such that all DOD past performance provided the scope is similar to DTRA's be evaluated favorably in terms of a source selection performance confidence rating.

RESPONSE: No determination as to the breadth and depth of past performance has been determined. We welcome industry feedback on the subject.

20. Since the government indicates the scope of the SOO is broader than just the Leidos contract cited in the RFI, will the government publish the names of the other incumbent contractors and the periods of performance for those contracts?

RESPONSE: Once the full scope of the requirement has been determined, appropriate information will be provided to industry.

21. Does the government foresee any Organizational Conflicts of Interest if the requirement is or is not broken up into several procurements/contracts?

RESPONSE: The government will include specific provisions in the Draft solicitation to address any potential OCI concerns.

22. The first goal listed in the RFI is to “evolve IT in support of CWMD mission performance”. Does this evolution in mission performance include any CWMD Global Synchronizer requirements, and/or any potential future JIDO IT requirements?

RESPONSE: Yes, the DTRA CIO’s requirement is to support the full range of current and evolving DTRA mission requirements.

23. If/when DTRA migrates to the cloud; is there a preference between on premise or off premise?

RESPONSE: The government anticipates a mixture of both on and off premise support.

24. Is CWMD situational awareness information gathering, sharing, analysis, collaboration, and visualization capabilities (Constellation) included the overall IT solution? If so, does DTRA desire to maintain Constellation, or are they seeking a more modern and agile system?

RESPONSE: Constellation is no longer a program supported by DTRA.

25. Where is the existing point on the maturity cycle of the existing infrastructure environment?

RESPONSE: The requested information is not available.

26. Is DTRA currently leveraging virtualization?

RESPONSE: Yes.

27. Does DTRA currently have a centralized enterprise IT environment? If so, is there a contract to managed J6 enterprise IT services to DTRA?

RESPONSE: Yes, the current contract for ITSS is HDTRA1-08-D-0016 supports the DTRA IT Enterprise.

28. What is the current contract arrangement(s) for DTRA IT environment?

RESPONSE: HDTRA1-08-D-0016 is a Single-Award IDIQ

29. Is this a new contract, or a consolidation of several other contracts?

RESPONSE: This acquisition is a follow on to HDTRA1-08-D-0016 with new requirements brought in to encompass the full range of agency IT requirements.

30. Who is/are the current incumbent(s) and the corresponding contract #?

RESPONSE: The incumbent for the HDTRA1-08-D-0016 is Leidos.

31. Is the incumbent(s) eligible to bid as a prime contractor?

RESPONSE: Yes, if they elect to submit a proposal.

32. What is the current staffing support level to the current state of DTRA IT environment?

RESPONSE: The government intends to include level of effort metrics reflecting workload of the current scope in the Technical Library.

33. What is the location for performance of this work?

RESPONSE: The primary work location will be at DTRA Headquarters on Fort Belvoir, VA, however, there are additional operational and support locations with IT requirements that are supported either remotely or on-site. Details will be provided in the final RFP.

34. What level of security clearance is required?

RESPONSE: Service providers supporting this acquisition will require a TS facility clearance. Additionally, all personnel supporting this requirement will require a minimum of a Secret Security clearance.

35. What current, ongoing efforts (contracts, etc.) that are not currently part of the existing ITSS contract (with Lockheed/Leidos as the incumbent) are being contemplated to be included as part of the proposed ITSS contract?

RESPONSE: Once the requirements are finalized, and strategy is approved, the information will be provided to potential vendors. The government intends to provide draft SOOs for industry review and comment prior to the Industry Day.

36. The SOO that was provided as part of the RFI solicitation is dated November15, 2013. Is there a more recent SOO available?

RESPONSE: The SOO included in the RFI was from the current ITSS contract. The government intends to release a revised draft SOO prior to the July Industry Day. In addition, the Government will solicit industry feedback on a draft RFP scheduled to be released in November.

37. Can we expect any feedback or follow -up from the DTRA regarding our RFI response?

RESPONSE: Feedback and follow up will be provided at schedule Industry Day.

Section 2: The follow collection of questions are similar in nature and are collectively answered with the following overarching response.

RESPONSE: The Government intends to address the following questions at the level of detail necessary to allow potential offerors to adequately develop appropriate solutions in their proposal responses to the anticipated solicitation. However, as requirements are not finalized, the responses will be provided in forums and venues planned later in the acquisition planning process. The Government will host an Industry Day in July which will include opportunities for “One-on-One” sessions with the acquisition planning team. The general Industry Day presentations are intended to provide details regarding DTRA’s IT Enterprise and the DTRA operational environment. In the November timeframe the government anticipates releasing a draft RFP(s) for industry review and feedback and is considering a second Industry Day/PreSolicitation Conference. Finally, no later than the release of the final RFP(s), the government intends to populate and make available to interested potential offerors, a Technical Library / Reading Room that will include agency specific IT technical, strategy, and organizational documentations relative to the planned acquisition.

Questions:

1. What recent or current strategic transformation efforts are in flight for DTRA’s IT

Enterprise?

2. How would you describe the maturity of the governance mechanism, at operational and strategic levels?

3. What is the overall operational scale (environments, facilities, number of systems, operating systems, hardware, software, etc)?

4. What is DTRA’s need for having a dynamic dashboard functionality on mobile devices?

5. Clarify Acquisition Strategy, scope and task order boundaries. Industry can offer the best and most innovative solutions and limit potential for increased coordination costs if the government provides task order boundaries with well-defined interfaces and areas of responsibility.

6. Clarify Technical Evaluation and Sub-factor elements. By emphasizing evaluation criteria that is clear on expertise and innovation that are critical to ITSS’ mission success, DTRA can best evaluate offerors that meet future requirements.

7. Allow industry access to a reading room for current technology and processes to ensure a common baseline for evaluation.

8. The first industry day that is scheduled for June 2017 should clarify to industry the timeline for the acquisition, IGCE, and what techniques and methods (i.e., performance incentives for innovation; improved operations) the government intends to use in evaluation of offerors. We would welcome the opportunity to discuss any of these topics with DTRA in more detail. We are also prepared to submit additional, more detailed, white papers on topics of interest to DTRA.

9. Please provide the following details in the RFP: Network Diagram, servers (virtual hosts and physical), Storage NAS and SAN, Security Zoning (hi / low), Primary and Out of Band Networks, LAN / WAN, Switches, VPN Gateways, Security Firewalls, Internal /

External Load Balancers, Application / Web accelerators.

10. For each server: Server Name, Virtual or physical instance, If virtualized what hypervisor is used, CPU and number of Cores, Memory size in GB, Operating System and version, Active Directory(Yes or No), Storage Capacity in GB.

11. Current storage requirements for all DTRA data.

12. Please provide a reading room for the above requested data available to offerors.

13. Estimated projected growth for storage, compute and network demands.

14. Expected frequency for doing full Backups and incremental backups?

15. Please provide any KPI’s and SLA’s currently used.

16. Recommendation: To encourage competition and aid industry in their ability to develop solutions that benefit DTRA, please encourage open and regular dialog with all interested industry participants in advance of the RFP release.

17. SOO Para 4.4: Typically, when competing for service desk opportunities, metrics are an important factor in determining staffing. Suggest the government provide the following service desk metrics covering a 12-month span as close to the RFQ date as possible:

Trouble Tickets Processed; Change Requests; Service Request; Phone Calls; Emails Handled; Manual Password Resets.

18. Explain the operational relationship between the service desk, DTRA Operations Center and Network Operations Security Center (NOSC).

19. SOO Para 4.5: Provide number of operating environments (OE) and applications running on the DTRA network. Please segregate between Infrastructure (i.e. Network) and user applications. This will factor into level of support provided by System Administrators, Developers, Network Support Technicians, Database Administrators etc.

20. SOO Para 4.6: Since this is dedicated support...please provide similar information requested above under SOO Para 4.5

21. SOO Para 4.12: Describe the Asset Management system currently being utilized.

22. We suggest that DTRA provide a list of the top 5 problems/issues that currently impact users. Problem Statements, which clarify the issues, should be provided in the solicitation.

23. In order to receive the most applicable and relevant responses from industry, will the government please characterize its interest in, commitment to, or current utilization of Agile? For example:

a. Does DTRA have Agile implementation at any level?

b. Will this contract be required to help implement Agile at the enterprise level?

c. What is DTRA’s vision for defining the Agile value streams and/or establishing the main Agile roles?

24. Has DTRA defined activities across the Portfolio, Program and Team levels?

25. When does DTRA anticipate making a decision regarding the final acquisition strategy for this requirement (i.e., single award, multiple award, SBSA portions, etc.)?

26. We recommend that the government consider separating the requirement for

Telecommunications & Network Operations (to include Help Desk and Systems Administration) and the Solutions & Applications Development into separate contracts.

27. We recommend that the government consider including detailed Service Level Agreements that measure the contractor’s performance executing modern application and solution development methods such as Agile Scrum.

28. The RFI mentions “governance” several times. In the overall context of the RFI, what does governance mean? Specifically, is governance an internal DTRA IT “policy”, or does DTRA want the contractor to develop and provide a governance to describe the overall contract management approach?

29. Will DTRA provide a copy of the existing internal IT governance document?

30. How does DTRA see merging the IT requirements of this procurement with the recently awarded JIDO Mission and Enterprise IT Task Orders?

31. Does DTRA seek to maintain Enterprise and Mission IT under one single contract, or do they seek to split it across two contracts?

32. Does DTRA have a current roadmap to be made available?

33. Does DTRA currently have a Cloud strategy, i.e. public/private/hybrid cloud solutions?

34. Has DTRA done an assessment whether the agency is cloud ready? If so, what are the current efforts to addressing that assessment?

35. What phase of a Knowledge Management Program is DTRA considered to be in?

36. Where is DTRA in the progress of fully complying, or aligning to FITARA?

37. DTRA has clearly articulated the goals of the CIO, including evolving IT in support of

WMD mission performance, enhancing knowledge sharing and communications across the WMD workforce, enabling and maintaining robust and efficient communications and computing capabilities and establishing governance to effectively track and utilize their information resources. To get the best possible solution from contractors in achieving these goals, the government should consider expanding on what is working well today and where things could be improved. The CIO’s Strategic Plan with associated timelines would be beneficial for contractors in prioritizing how they assist in achieving those goals. Bottom line, nobody wants to talk about the incumbent contractor and any weaknesses, if any, out of concern for a protest or some other legal precedent. However, if the government truly wants to get to the next level in IT service delivery, they may have to make changes from the status quo.

38. What are the type of Weapons of Mass Destruction (WMD) that the systems are designed to counter against? Do they include Biological warfare etc.as well?

39. What is the size of the systems in terms of number of applications, number of users, Database volumes?

40. Do users access all systems using PIV Cards and are all applications PIV enabled withSingle Sign on?

41. What Cloud Providers are being used by DTRA currently?

42. If Cloud is already in use, how many applications have been migrated to the Cloud?

Section 3: The follow collection of questions are similar in nature and are collectively answered with the following overarching response.

RESPONSE: The Government intends to address the following questions at the level of detail necessary to allow potential offerors to adequately develop appropriate solutions in their proposal responses to the anticipated solicitation. However, these questions address specific topics which cannot be properly addressed at the base (IDIQ) level, but will instead be appropriately addressed with the issuance of individual task orders. Once requirements are finalized, and information is gathered, industry will be presented the information necessary to aid in proposals.

Questions:

1. “Data” are mentioned several times in the DTRA Strategic Plan. Is there an agency Data Strategy? What is the current guiding mechanism for portfolio alignment?

2. What is the overall operational scale (environments, facilities, number of systems, operating systems, hardware, software, etc?

3. Does DTRA require GFE to perform all tasks or do they differentiate based on task?

4. What is the timing requirement necessary for analytic results, near-real-time, real-time, or other?

5. What is DTRA’s need for having a dynamic dashboard functionality on mobile devices?

6. Can DTRA provide an idea of the types of data being gathered and analyzed, (i.e.

Structured, Unstructured, video, audio, geospatial, social, text, etc)?

7. Is there a requirement for the data and analysis to be not just historical reviews of what has happened, but what is currently happening (present), and what is likely to happen, where, when and by whom (future)?

8. Will DTRA take all analytical services in-house, or would they prefer to outsource with a preferred vendor, or both?

9. What methods/standards are in place to evaluate/validate Open Source solutions before selecting them for use?

10. Are there any specific and unique IT requirements related to the SOCOM Support Cell?

11. Understanding DTRA’s role as a Combat Support Agency and Defense Agency, are there any specific external customer requirements for IT that will need to be addressed during this period of performance?

12. Given the historical connectivity and access issues experienced by many of DTRA’s geographically dispersed locations, such as Liaison Offices (LNO) and Regional Coordination Engagement Offices (RCEO); are there any specific IT needs or requirements or upgrades that DTRA would like included in the new IT infrastructure?

13. Does DTRA want to maintain the existing Enterprise Information System (EIS), or is there a vision for a modernized task management and tracking system?

14. What are the specific Operations Center requirements or upgrades that should be addressed?

15. Will DTRA provide their Cloud Strategy to Industry for input and feedback?

Statement of Objectives for

DTRA Agency-Wide Information Technology Support Services

Base Contract

1. Purpose: The purpose of this Statement of Objectives (SOO) is to define the scope of work to be performed and the expected performance outcomes to be achieved by the contractor(s), in support of the Defense Threat Reduction Agency J6 Information Operations Directorate and

Chief Information Officer’s (CIO) mission to provide robust IT services and capabilities to meet current mission requirements and transform how the agency uses knowledge, technologies, and capabilities to meet the critical mission of safeguarding the United States and its allies from global weapons of mass destruction and improvised threats more effectively now and in the future. The goal of this SOO is to establish a one-stop source for the full range of DTRA Agency-Wide IT support requirements.

2. Introduction

2.1. Vision Statement: By 2020, Defense Threat Reduction Agency (DTRA) is the government’s premier counter weapons of mass destruction (CWMD) and improvised threats workforce and solutions provider. In support of this Agency vision, the DTRA CIO vision is to lead an Agency-wide information technology transformation, enabling our workforce to be the premier DoD provider of CWMD expertise and solutions.

2.2. Mission Statement: The DTRA mission is to safeguard the United States and its allies from global weapons of mass destruction and improvised threats by integrating, synchronizing and by providing expertise, technologies and capabilities. Established in 1998, DTRA provides the Department of Defense’s core intellectual, technical, and operational support expertise for countering threats posed by weapons of mass destruction (chemical, biological, radiological, and nuclear) and highyield explosives. As a defense agency, DTRA has a mission that includes nonproliferation, counterproliferation, consequence management, countering WMD planning support, and support to a safe, secure and effective U.S. nuclear deterrent. In support of this DTRA mission, the CIO’s mission is to project the Agency’s knowledge and capability in order to counter the threat of WMDs.

2.3. Background: The J6 is responsible for providing Agency-wide information management services, supporting in excess of 5,000 world-wide Agency customers utilizing Unclassified, Secret, and Top Secret/Special Compartmented Information (TS/SCI) Networks (for a more detailed description of the current networks see Attachment 1). DTRA personnel supporting the Agency’s mission require common IT support services in areas such as, but not limited to, help desk support, systems administration, networks and application administration and design, engineering, and architecture support. Although the support requirements are common in nature, the DTRA mission needs are vastly different. Various short and long-term efforts must be undertaken to continually modernize, integrate and secure these systems. Continuous IT support must meet the needs of the Agency and other internally and externally supported customers to include first responders, Combatant Commands (COCOMS) and other U.S. Government entities.

The CIO intent is to provide seamless and integrated communications among all supported elements, for the purposes of office automation, data collaboration and knowledge management, support of exercises, experimentation and operational support across three principle security domains: Sensitive but Unclassified (SBU), Secret and Top Secret/SCI. The DTRA mission dictates a diverse set of customers and unique mission requirements. As the organization evolves, the demands on information technology (IT) and associated cybersecurity controls increase accordingly.

2 DTRA Agency-wide ITSS Base Contract SOO (DRAFT 07/17/2017) The CIO supports DTRA’s mission by serving as a mission partner, transforming how the agency uses knowledge, technologies, and capabilities to achieve the following strategic goals as defined in the DTRA J6, CIO Information Operations Strategic Plan:

2.3.1. Goal 1: Evolve information technology in support of CWMD mission

2.3.2. Goal 2: Enhance knowledge sharing and communications across the CWMD community

2.3.3. Goal 3: Enable and maintain robust and effective communications and computing capabilities, and,

2.3.4. Goal 4: Establish governance to effectively track and utilize information resources.

2.4. Scope Statement: The scope of this SOO is to provide the full range of IT Support Services, to include IT Enterprise Performance Management, IT Service Strategy, IT Service Design, IT Service Transition and Integration, and IT Service Operations and Cybersecurity. In the performance of this SOO, the contractor(s) shall provide support services necessary to meet the

J6 strategic goals consistent with DoD policies and industry best practices. The scope of this SOO is divided into three sections based on performance outcomes aligned with IT Operations Support Services (core infrastructure and cybersecurity), IT Service Design (solutioning), and IT Mission Support services (including IT enterprise performance management and service strategy support).

3. Applicable Documents - TBD

4. Objectives

4.1. DTRA IT Service Operations Support Objectives: Within the “as is” and evolving DTRA IT Enterprise, the contractor shall deliver reliable, secure and effective IT capabilities and services such as those listed in the IT Services (Attachment 2) and common IT industry definitions for IT

Service Operations and Delivery. Such capabilities and services shall be delivered consistent with the performance standards included in this SOO and any resulting task order performance standards. These IT capabilities and services shall be delivered consistent with industry best practices and DoD security compliance standards. As selected IT capabilities, applications, and data repositories transition from DTRA owned/operated data centers and systems to cloud services, the contractor shall ensure the transition is transparent for all end users. A critical element of this work will involve physical movement of systems to the cloud along with appropriate conversion of workforce to support the evolving IT enterprise.

In support of this overarching Services Operations Support Objective, and in support of Goal 1 of the Information Operations Strategic Plan (Evolve IT in support of the CWMD mission performance), and Goal 3 (Enable and maintain robust and efficient communications and computing capabilities), the contractor shall appropriately plan for and execute support and service solutions to satisfy the following Service Operations Objectives;

4.1.1. Service Operations Support Specific Objective 1; Network Operations and Maintenance:

In support of Goal 3 of the Information Operations Strategic Plan (Enable and maintain robust and efficient communications and computing capabilities), the contractor shall plan, develop, implement, operate, maintain and monitor a network operations and maintenance program to provide robust, reliable, efficient, and secure IT networks access and availability across all security levels. This objective includes the full scope of IT systems administration, application delivery (i.e. Sharepoint), and content management.

3 DTRA Agency-wide ITSS Base Contract SOO (DRAFT 07/17/2017) The contractor shall also analyze and recommend hardware upgrades and replacements, and, with the government contracting officer’s approval, implement the replacement actions consistent with the following constraints:

- Procure hardware and software and/or systems required to accomplish the tasks specifically defined in the contract to maintain current operations (i.e. bench stock items and/or mission critical items that are in-service, fail/failing).

- Enable a critical function. The enablement of a critical function is an item that supports provision of service to the existing infrastructure or poses a critical risk to

Agency mission such as enhanced security, storage capacity (i.e. disk space), etc.

- Supports a time sensitive mission requirement.

- Support demonstration support and testing.

- Assure Proof-of-Concept development.

The measure of success will be based on network and system availability, network security, security patch deployment and installations, and reliable system back-ups.

Performance metrics for Objective 4.1.1 are included in the QASP at Attachment 3.

4.1.2. Operations Support Services Specific Objective 2; Service Desk Support: The DTRA workforce relies heavily on availability of the communications and computing systems, and on access to the associated data repositories to allow information technology to support the CWMD mission performance. In support of Goal 3 of the Information Operations Strategic Plan (Enable and maintain robust and efficient communications and computing capabilities), the contractor shall plan, implement, monitor, and continuously evolve an

Agency-wide IT Service Desk function to ensure interruptions in individual or collective users’ availability of systems or data are resolved promptly and reliably. Service Desk Support includes support for in-processing new team members, user equipment exchanges, and out-processing support for departing team members. The measure of success for this objective will be based on call response time, first contact resolution rates, and user service restoration times. Performance metrics for Objective 4.1.2 are included in the QASP at Attachment 3.

4.1.3.Operations Support Services Specific Objective 3; Cybersecurity and Computer Network Defense: In support of the J6 CIO Information Operations Strategic Plan Sub-Goal 3.2 (Protect and defend our critical information systems, technology, and resources), the contractor shall support the CIO’s requirement to provide secure and compliant IT systems by protecting, defending, and monitoring information critical to both mission and business functions within the Agency. In direct support of this objective the contractor shall provide the full range of IT security and technical expertise necessary to plan, operate, maintain and enhance the Network Operations and Security Center (NOSC) for the Agency on a 24x7x365 basis, in accordance with requirements for a Defense Agency NOSC and appropriate DoD Directives, as a Tier 2 Cybersecurity Service Provider (CSSP). Included in this objective, the contractor shall maintain real-time situational awareness of the DTRA IT infrastructure and supported environments; shall provide information related to IT threats; shall identify and reduce IT vulnerabilities within the DTRA networks/systems;

shall lead restorative actions to ensure all networks remain up and operational; and shall monitor the health and security posture of DTRA’s IT infrastructures to ensure they remain within acceptable limits for performance and information security. In addition to the

NOSC, the contractor shall support the J6 Senior Information Security Officer (SISO) by coordinating Agency information assurance tasks, controls and activities per Agency and 4 DTRA Agency-wide ITSS Base Contract SOO (DRAFT 07/17/2017) DoD policies. The contractor shall also support the full range of cybersecurity to include Assessments and

Authorizations, Cross Domain Solutions, and Supply Chain Risk Management (SCRM). The measure of success for this objective will be based on Cyber Command Readiness Inspection (CCRI) scoring, and on vulnerability solution and implementation. Performance metrics for Objective 4.1.3 are will be included in individual task orders.

4.1.4. Service Operations Support Specific Objective 4; Asset Management: In support of Goal 1 of the Information Operations Strategic Plan; “evolve information technology in support of the WMD mission performance”, the contractor shall implement best industry practices to improve the overall quality of IT software and hardware through the asset life-cycle. This objective also includes software asset management (SAM). SAM is the practice of integrating people, processes, and technology to allow software licenses and usage to be systematically tracked, evaluated, and managed. The goal of SAM is to reduce IT expenditures, human resource overhead and risks inherent in owning and managing software assets. The contractor shall also, inventory, track, analyze and recommend hardware upgrades and replacements. The measure of success for this objective will be based on the consistency with which IT assets (software or hardware components) are upgraded, patched, or replaced before they exceed their usefulness and serviceability and impact mission availability or effectiveness. Performance metrics for Objective 4.1.4 will be included in the individual task orders.

4.1.5.Service Operations Support Specific Objective 5; Technical Management: In support of Goal 3 of the Information Operations Strategic Plan (Enable and maintain robust and efficient communications and computing capabilities), the contractor shall provide technical expertise and support for the management of the IT infrastructure. This process plays an important role in the technical aspects of designing, testing, operating and improving IT services, as well as in developing the skills required to operate the IT infrastructure. The measure of success for this objective will be based on the consistency with which network provides consistent, reliable, secure and effective delivery of the services available in the Service Catalog (Attachment 2). Performance metrics for Objective 4.1.5 will be included in the individual task orders.

4.1.6.Service Operations Specific Objective 6: IT Transition and Integration Services; In support of Goal 3 (Enable and maintain robust and effective communications and computing capabilities), and Goal 4 (Establish governance to effectively track and utilize our information resources), the contractor shall plan for and support the logical and seamless transition and integration of approved system, software, security and cloud solutions onto the DTRA IT enterprise and into productive usage with the target end user group(s). This objective includes a technical function where performance and security tests are either validated or accomplished, and a change management function that prepares the environment for the deployment of a new service and, thus, accelerates its adoption and usage. The measure of success in this objective will be based on evidence of compliant performance and security testing, the transparency of the introduction of new services, and the rate of adoption of the new services. Performance metrics for Objective 4.1.6 are included in the QASP at Attachment 3 and within the individual task orders.

5 DTRA Agency-wide ITSS Base Contract SOO (DRAFT 07/17/2017)

4.1.7.Operations Support Services Specific Objective 7; Contingency Operations and Disaster Response: In support of Goal 3 (Enable and maintain robust and efficient communications and computing capabilities), the contractor shall plan, maintain, enhance and execute (as directed) Continuity of Operations Planning and Disaster Recovery (COOP/DR) plans and capabilities; shall provide formalized roles, designation of a dedicated recovery team, backup procedures, and facilities; and shall ensure that proactive measures are taken to avoid or lessen the impact of a disruption as necessary to maintain DTRA operations. The COOP/DR shall be both a plan and a specific capability available for implementation as directed or required to support continuous mission support. The measure of success from this objective will be based on the percentage of time backups are performed within the defined backup window. Performance metrics for Objective 4.1.7 will be included in the individual task orders.

4.2. DTRA IT Service Design Objectives: The DTRA mission success relies on efficient and fully integrated IT services and capabilities. The contractor shall provide the full range of IT support services necessary to create and maintain IT systems, services and capabilities necessary to ensure the DTRA mission partners have ready access to the IT solutions needed to meet DTRA mission priorities. The overarching outcome of this objective aligns with the Strategy

Outcome defined in the Information Operations Strategic Plan to “transform how the Agency utilizes information to accomplish the CWMD mission”, and Goal 1, “evolve information technology in support of CWMD mission performance”. Supporting goals 1.1 and 1.2 further emphasize the need to “understand the unique needs of the counter-WMD mission space”, and

“advance information sharing, synthesis and collaboration technologies to keep pace with the needs of the CWMD mission.” The DTRA IT Service Design Objective is to satisfy the requirements of individual call orders issued against the base contract in support of the DTRA mission and the strategic goals stated above. Specific requirements will be appropriately reviewed and approved via the DTRA J6 governance process prior to issuing a Service Design task order. In support of this overarching DTRA IT Service Design Objective, and in support of DTRA J6, CIO Information Operations Strategic Plan Goals 1 through 4, the contractor shall appropriately plan for and execute support and service solutions to satisfy the following Specific

Objectives;

4.2.1.IT Service Design Objective 1: Overall IT Service Design: In support of Goal 1 (evolve information technology in support of CWMD Mission performance), and consistent with the IT industry common descriptions of IT Service Design, the contractor shall provide the full range of expertise and experience required to encompass all elements relevant to technology service delivery in design and development of systems, software, security or cloud solutions to approved IT service requests. In addition to and in direct support of the various solution design, development, test, and implementation planning, the contractor shall also provide appropriate IT project management to assist with the planning and performance monitoring of the solution creation process. Specific requirements for this objective may originate from within any DTRA directorate, or DTRA mission partner. The measure of success in this objective will be based on adherence to projected solution delivery timelines, and the quality of the delivered solution as measured by defects identified during transition, deployment and post-deployment. Performance metrics for Objective 4.2.1 will be included within the individual task orders.

6 DTRA Agency-wide ITSS Base Contract SOO (DRAFT 07/17/2017) 4.2.2.IT Service Design Objective 2: IT Service Design for J2/5 - Intelligence, Plans and Security: In direct support of the J2/5 mission to “anticipate and shape global CWMD information and operations ensure One Team success”, and consistent with the IT industry common descriptions of IT Service Design, the contractor shall provide the full range of expertise and experience required to encompass all elements relevant to technology service delivery in design and development of systems, software, security or cloud solutions to approved

IT service requests. In addition to and in direct support of the various solution design, development, test, and implementation planning, the contractor shall also provide appropriate IT project management to assist with the planning and performance monitoring of the solution creation process. The measure of success in this objective will be based on adherence to projected solution delivery timelines, and the quality of the delivered solution as measured by defects identified during transition, deployment and post-deployment. Performance metrics for Objective 4.2.2 will be included within the individual task orders.

4.2.3.IT Service Design Objective 3: IT Service Design for J3/7 – Operations, Readiness and

Exercises: The J3/7 mission is to “support U.S. national security by preventing the acquisition, proliferation, and use of WMD; implementing arms control treaties;

responding to crises: building partner capacity; maintaining situation awareness; and preparing DTRA personnel to deploy and conduct CWMD operations worldwide.” In direct support of the J3/7 mission, and consistent with the IT industry common descriptions of IT Service Design, the contractor shall provide the full range of expertise and experience required to encompass all elements relevant to technology service delivery in design and development of systems, software, security or cloud solutions to approved IT service requests. In addition to and in direct support of the various solution design, development, test, and implementation planning, the contractor shall also provide appropriate IT project management to assist with the planning and performance monitoring of the solution creation process. The measure of success in this objective will be based on adherence to projected solution delivery timelines, and the quality of the delivered solution as measured by defects identified during transition, deployment and post-deployment.

Performance metrics for Objective 4.2.3 will be included within the individual task orders.

4.2.4.IT Service Design Objective 4: IT Service Design for J9 – Research and Development: The J9 mission is to “provide research, development, test and evaluation (RDT&E) investments that focus on maintain the U.S. military’s CWMD technological superiority, supporting current readiness, and mitigating the risks of technical surprise for the CWMD mission.” In direct support of the J9 mission, and consistent with the IT industry common descriptions of IT Service Design, the contractor shall provide the full range of expertise and experience required to encompass all elements relevant to technology service delivery in design and development of systems, software, security or cloud solutions to approved IT service requests. In addition to and in direct support of the various solution design, development, test, and implementation planning, the contractor shall also provide appropriate IT project management to assist with the planning and performance monitoring of the solution creation process. The measure of success in this objective will be based on adherence to projected solution delivery timelines, and the quality of the delivered solution as measured by defects identified during transition, deployment and post-deployment.

Performance metrics for Objective 4.2.4 will be included within the individual task orders.

7 DTRA Agency-wide ITSS Base Contract SOO (DRAFT 07/17/2017)

4.2.5. IT Service Design Objective 5: IT Service Design for J10 – Nuclear Enterprise Support:

The J10 mission is to “ensure a safe, secure, reliable, an effective nuclear enterprise, and provide continued support to countering WMD threats.” In direct support of the J10 mission, and consistent with the IT industry common descriptions of IT Service Design, the contractor shall provide the full range of expertise and experience required to encompass all elements relevant to technology service delivery in design and development of systems, software, security or cloud solutions to approved IT service requests.