Attachment_2_TO_1_PWS_-_IT_Service_Provisioning_and_Operations.docx

DTRA Agency-Wide Information Technology Support Services Core IT Services Contract –

HDTRA1-18-R-0002

Performance Work Statement (PWS) for Task Order 1; IT Service Provisioning and Operations

1. Introduction: This PWS provides IT service provisioning and operations to ensure DTRA and its partners have reliable, secure, and efficient IT capabilities and services necessary to perform the critical DTRA mission.

1.1. Mission: The DTRA mission is to safeguard the United States and its allies from global weapons of mass destruction and improvised threats by integrating, synchronizing and providing expertise, technologies and capabilities. The DTRA Information Integration and Technology Services Directorate (I2TS)/Chief Information Officer’s (CIO) mission is to provide the IT services and capabilities necessary for DTRA’s business and mission functions and support transforming how the agency uses knowledge, technologies, and capabilities to meet the DTRA mission.

1.2. Background: The I2TS/CIO is responsible for providing Agency-wide information management services, supporting in excess of 5,000 world-wide Agency customers utilizing Unclassified, Secret, and Top Secret/Special Compartmented Information (TS/SCI) Networks. DTRA personnel supporting the Agency’s mission require common IT services in areas such as, but not limited to, help desk support, systems administration, networks and application administration and design, engineering, and architecture development and implementation. Although the functional requirements are similar across the DTRA mission, the activities involved vary widely by specific mission area. Various short and long-term efforts must be undertaken to continually modernize, integrate and secure functions and systems. Continuous IT support must meet the needs of the Agency and other internally (including JIDO) and externally supported customers to include first responders, Combatant Commands (COCOMS) and other U.S. Government entities. The intent is to provide seamless and integrated communications among all supported elements, for the purposes of office automation, data collaboration and knowledge management, support of exercises, experimentation and operational support across three principle security domains: Sensitive but Unclassified (SBU), Secret and Top Secret/SCI. The DTRA mission supports a diverse set of customers and unique mission requirements. As the organization evolves, the demands on information technology (IT) and associated cybersecurity controls will increase accordingly.

1.3. Scope: The DTRA-wide IT service provision, and operations scope includes the full range of support actions and resources necessary to deliver reliable, secure and effective IT capabilities and services. These operations and support services will be provided within the “as is” and evolving DTRA IT Enterprise, and consistent with industry best practices and the performance standards contained within this PWS. To support the evolving DTRA IT Enterprise new services and capabilities will be added to the IT Enterprise and other services will be retired. The scope of this task order will also support the seamless transition of these new capabilities from the solutions cycle through the transition and integration phase, and into the operations infrastructure.

2. Applicable Documents: The contractor shall comply with all documents listed below as “Mandatory”. Documents listed as “Non-Mandatory” are provided as information only and for use at the contractor’s discretion.

2.1. Mandatory Documents:

2.1.1. DoD Directive 5200.01; Information Security Program,

2.1.2. DTRA Directive 5200.1R DTRA Information Security Program,

2.1.3. DOD Manual 5220.22; National Industrial Security Program (NISPOM)

2.1.4. DoD Instruction 8510.01; Risk Management Framework (RMF) for DoD Information Technology (IT)

2.1.5. DoD Instruction 8500.2 Information Assurance Implementation Document

2.2. Non-Mandatory Documents:

2.2.1. DTRA Strategic Plan

2.2.2. DTRA J6, CIO Information Operations Strategic Plan 2017 - 2020

2.2.3. DTRA Cloud Strategy

3. Performance Requirements: This section of the PWS defines the performance requirements and the performance results the government intends to measure the contractor’s performance against. These performance requirements address the full scope of this task order and support the higher-level objective stated in paragraph 1.3 above. They provide the full range of support actions and resources necessary to support the seamless transition of new capabilities into the enterprise and deliver reliable, secure and effective IT capabilities and services as defined in the DTRA IT Services Catalog and as needed to meet the critical DTRA mission.

3.1. Performance Requirement #1, Task Order Management. The contractor shall provide the necessary resources to effectively oversee the performance of all requirements defined in this task order. Within this responsibility, the contractor shall develop and implement a quality control and management oversight plan to effectively manage the staff and the performance per the performance standards established herein. The contractor shall develop and deliver a monthly status report (MSR) per CDRL A001. Performance measures for this requirement are defined in the Performance Requirements Summary (PRS) in Section 11 below and include timeliness of staff on-boarding, timeliness of deliverables, and consistently meeting performance measures in other performance measures within this task order.

3.2. Performance Requirement #2, IT Operations, and Systems Administration (SA). The contractor shall provide the full range of support services required to manage the day-to-day operations and systems administration of the DTRA IT computing environment, ensuring reliable, secure, and efficient availability of the current and evolving DTRA IT services and capabilities. Working with the government team, as principle members of the SA Group, the contractor shall maintain the DTRA IT infrastructure, to include all servers and storage devices such as the DTRA Storage Area Networks (SAN) across multiple separate networks. The SA Group will maintain the security of all DTRA IT Infrastructure systems and perform Information Assurance (IA) to maintain Risk Management Framework (RMF) tasks, documentation and system accreditation required to maintain system Authority to Operate (ATO). The DTRA IT infrastructure includes all routers, circuits, firewalls, interconnecting cabling, network security equipment, network monitoring equipment, and end user IT equipment. In order to mitigate security risks, the contractor shall coordinate closely with the government and support team responsible for Cybersecurity Support Services (Task Order 2) ensure security upgrades, patches, configurations, and logging are introduced and implemented with appropriate priority commensurate with the level of exposure to potential cybersecurity threats. The DTRA IT Infrastructure supports approximately 5000 users using distributed operations between the National Capital Region (NCR) and DTRA Albuquerque, NM and supporting facilities on Fort Belvoir, VA, as well as sites in Albuquerque, NM, Eglin AFB, FL, and a variety of CONUS and OCONUS locations. In support of the DTRA IT Systems Administration Group the contractor shall support multiple computer networks at various levels of security classification. The contractor shall plan, manage, back up, troubleshoot, fix/repair, install OEM and security patches and upgrades, and monitor the health of the DTRA IT Server and Storage infrastructures to ensure continuous, secure, and efficient access to the full range of DTRA partners. The contractor will provide database administration for SQL, ORACLE databases. The contractor will provide application support to various DTRA offices as designated in Service Level Agreements (SLA) with those offices. The contractor shall support the Network Operations and Security Center (NOSC) for the Agency on a 24x7x365 basis, in accordance with requirements for a Defense Agency NOSC and appropriate DoD Directives. Included in this objective the contractor shall maintain real-time situational awareness of the DTRA IT infrastructure and supported environments; shall lead restorative actions to ensure all networks remain up and operational. Additionally, as part of the Systems Administration function, the contactor shall continuously monitor infrastructure equipment and components to support appropriate technical refresh plans. Performance measures for this requirement are defined in the PRS below and focus on network availability, efficiency, and security.

3.3. Performance Requirement #3, Service Desk Support. The contractor shall operate an IT Service Desk to provide end-users IT remediation and support to allow DTRA I2TS partners to effectively leverage the full capabilities of the available IT services and capabilities in direct support of the DTRA mission. The Service Desk shall serve as the primary point of contact for delivery of IT services for the Agency by receiving and responding to support requests for hardware/software and systems access. Additionally, the contractor shall provide assistance for all systems/applications under the control of the I2TS. The contractor shall support the full range of DTRA IT Service Desk functions and responsibilities to include, but not limited to;

· Capture and reporting of IT Service Desk support metrics,

· Installation, configuration, maintenance and troubleshooting for all users of the DTRA systems,

· Maintain a web-based capability for DTRA users to enter, track and escalate Service Desk tickets, as well as self-service actions (currently using Remedy),

· Remote access configuration and support for DTRA users and external customers as required (supporting telework, off-site travel, and mission or contingency operations)

· Install, configure, maintain and troubleshoot computer peripherals,

· Provide tracking for all deployed IT assets from procurement to disposal to allow real-time accounting of IT assets to both government and contractor personnel,

· Provide end-user software and application support,

· Coordinate security and situational awareness concerns with DTRA NOSC

· Provide technical assistance and customer support in the operations and maintenance of wireless voice and data services.

The contractor shall plan, implement and maintain a customer survey/feedback function to gather feedback directly from the service desk customer regarding their level of satisfaction with the service provided. Survey responses will be voluntary for customers. The survey content will be submitted for review and approval by the government prior to implementing. (CDRL A002) Service Desk call answering after normal business hours (0600 – 1800) are currently covered by the NOSC. Support services are limited outside the normal business hours unless advance arrangements are made to support scheduled after hours activities.

Performance measures for this requirement are defined in the PRS below and focus on effectiveness, responsiveness, and overall customer satisfaction.

3.4. Performance Requirement #4, Applications and Asset Management. The contractor shall plan, implement and maintain an effective application and asset management program that integrates people, processes, and technology to allow software licenses and usage to be systematically and accurately tracked, evaluated, and managed. Effective management of the IT Infrastructure applications and assess reduce IT expenditures, human resource overhead and risks inherent in owning and managing software assets. This effort will develop and maintain lifecycle management plans for hardware and software managed by the I2TS. Included in this asset management requirement the contractor shall plan for and implement an efficient hardware Return Merchandise Authorization (RMA) program to quickly return and track failed equipment items for appropriate replacement. Performance measures for this requirement are defined in the PRS below and focus on consistency and accuracy of applications and asset management reporting.

3.5. Performance Requirement #5, Technical Management. The contractor shall provide the full range of IT technical expertise and technical management support services to ensure DTRA IT infrastructure meets performance requirements stated in paragraphs 3.2 – 3.4 above and the larger enterprise level objectives as stated in paragraph 1.3. The technical management requirement shall provide for technical analysis of network operations, independent evaluation and integration support for new capabilities and applications to be deployed onto the IT networks, and the ability to escalate user or system generated trouble tickets that cannot be resolved in a timely manner by the Service Desk staff. (CDRL A003) This requirement is complimentary to and supportive of other requirements in this PWS and will not be subject to separate performance measurement in the PRS.

3.6. Performance Requirement #6, Cloud Management Support. The contractor shall support the integration and management of cloud services and capabilities that become part of the DTRA IT Enterprise. As cloud solutions are approved, these solutions must be fully integrated in the DTRA IT Enterprise and included in the management and oversight functions of the overall Service Operations umbrella. The contractor shall support the seamless integration and continuing support of the cloud-based capabilities without interruption of service capabilities delivered to the DTRA IT customers. The integration planning and transition support efforts are included in task order 3, but their success will require the coordinated support effort of the operations team in this PWS. Performance measures for this requirement are defined in the PRS below and focus on the systems administration and operations support responsiveness in support of cloud-based systems.

3.7. Performance Requirement #7, Incidental Hardware/Software Procurement. The contractor shall analyze and recommend hardware upgrades and replacements, and with the government contracting officer’s approval, implement the replacement actions consistent with the following constraints:

- Procure hardware and software and/or systems required to accomplish the tasks specifically defined in the contract to maintain current operations (i.e. bench stock items and/or mission critical items that are in-service, fail/failing).

- Enable a critical function. The enablement of a critical function is an item that supports provision of service to the existing infrastructure or poses a critical risk to Agency mission such as enhanced security, storage capacity (i.e. disk space), etc.

- Support time sensitive mission requirements.

The performance measures for this incidental procurement requirement will not be measured separately but will instead be evaluated as part of PWS paragraph 3.2.

3.8. Performance Requirement #8, Task Order Transition In. The contractor shall plan for and execute a transition-in strategy to provide for the on-boarding of appropriately qualified staff with the required DoD security clearances and certificates, needed to support a smooth and seamless transition from the incumbent support team to “full performance” within 60 calendar days of task order award. Transition-in includes all staffing activities, as well as the necessary knowledge capture and transfer to ensure “work-in-progress” is smoothly transitioned, and mission support is not interrupted. Performance measures for the first 60 days will be recorded and reported for monitoring purposes but will not be used as performance indicators until the completion of the 3rd month of performance. The exception to this suspension of performance measures will be measures associated with this transition-in requirement. The performance measure for this requirement is defined in the PRS below and focuses on the on-boarding of support staff per the transition-in plan included in the contractor proposal.

3.9. Performance Requirement #9, Task Order Transition Out. The contractor shall plan for and support the smooth and seamless transition-out at the end of the performance period. The contractor shall develop and deliver a transition-out plan (CDRL A004) defining their knowledge transfer plan with specific emphasis on transiting work-in-progress. The contractor shall coordinate with the incoming workforce (government or contactor) as necessary to enable a seamless transition with minimum interruption of mission support. The contractor shall remain accountable for performance consistent with the PRS below until the end of the contract period of performance.

4. Deliverables: In support of the requirements in this PWS, the contractor shall develop and deliver a variety of reports, analyses, recommendations, and plans. The specific requirement for content, format, and delivery timing for each deliverable is defined in the Contract Data Requirements Lists (CDRL; DD Form 1423) which will be specifically associated with the PWS paragraph for the corresponding work scope. Unless specifically stated otherwise in the CDRL, all deliverables shall be submitted electronically in either a MS Office compatible or PDF format. The specific format for each deliverable shall be at the contractor’s discretion unless otherwise specified in the CDRL. The following table summarizes the contract deliverables associated with this PWS.

4.1. Deliverables Summary Table

5. Period of Performance. The period of performance will be one-year base, with up to four one-year options, if exercised.

5.1. Base: Task order award + 12 Months

5.2. Option 1: To be specified at award

5.3. Option 2: To be specified at award

5.4. Option 3: To be specified at award

5.5. Option 4: To be specified at award

6. Support Hours The contractor shall provide support during the core Government hours 52 weeks a year. The standard schedule must encompass the DTRA core hours of 9 AM to 3 PM (0900 – 1500). Additionally, the contractor may be required to support outside of standard hours based on loss of service and mission impact or Agency need. The IT Operations and Systems Administration (paragraph 3.2) and IT Service Desk (paragraph 3.3) are 24x7x365 requirements. Standard work hours shall be Monday through Friday during normal duty hours except for the following Federal Holidays:

7. Place of Performance/Travel

7.1. Place of Performance: Currently the majority of these tasks are performed at the Defense Threat Reduction Center, 8725 John J. Kingman Road, Fort Belvoir, VA 22060-6201, however; DTRA maintains a global mission, and contractor personnel may be required to work at locations other than the NCR. As mentioned in Paragraph 3.2 above, DTRA relies on distributed operations between the NCR and DTRA Albuquerque, NM. As DTRA becomes more virtualized, and physical space within the DTRA facilities become a premium commodity, support and operations from locations other than DTRA may be necessary to reduce the physical contractor onsite footprint. For situational reasons, contractor personnel may work at an alternate location/worksite using Government Furnished Equipment (GFE) with COR approval.

7.2. Travel may be required based on Agency requirements to any DTRA facility world-wide. The Contractor shall provide a detailed estimate of any desired travel in advance to the COR in writing via memorandum or email. All travel costs shall not exceed on a daily basis the maximum per diem rates in effect at the time of travel as set forth in the Federal Travel Regulation. All travel shall be approved by the COR in writing via memorandum or e-mail prior to the contractor incurring any travel expenses and prior to any departure.

8. Security: (Reference DD Form 254 DoD Contract Security Classification Specifications) The contractor employees working on this program must be U. S. citizens and will require a minimum of a DoD SECRET clearance in order to provide the required support. Selected individuals may require Top Secret or higher clearances (SCI Access). Rationale: All employees performing services on this contract have the potential to access classified systems up to TS-SCI (JWICS) as a normal requirement in the performance of their duties.

The contractor shall comply with the Department of Defense Security Agreement (DD Form 441) including the NISPOM and any revision to that manual, notice of which has been furnished to the contractor. Item 13b: The contractor's employees performing work under this contract shall be U.S. citizens and been granted appropriate security clearance, based on the need for access to specific classified information. That is SECRET clearance based on favorably adjudicated National Agency Check with Law and Credit Check (NACLC) or a TOP SECRET clearance based on Single Scope Background Investigations favorably adjudicated by the Defense Security Service, Defense Industrial Security Clearance Office.

All contractors in privileged user positions must have a completed single scope background investigation (SSBI) in accordance with DOD I 8500.2 prior to filling the position. Privileged users are defined as but not limited to, persons in the following roles or positions: Information Assurance Managers/Officers, supervisors of IT positions, systems administrators, maintainers of IA-enabled products.

9. Government Furnished Property, Equipment or Material (GFP/GFE/GFM) The Government will provide office space, desks, computers, use of telephone, copier, fax, paper, and other administrative materials for on-site personnel assigned to this task order.

9.1. Government Furnished Material for Contractor Use

DTRA may provide Government equipment to the contractor for use offsite. The contractor shall comply with the contract clauses for accountability of Government Property in the possession of contractors.

The Master Government Property List (MGPL) shall be updated at the time any new equipment is issued to the contractor by the government (CDRL A006). The MGPL shall include all equipment/property provided to the contract, including equipment transferred between projects, broken and obsolete equipment, and items purchased outside the United States. The MGPL shall be delivered electronically in a spreadsheet using Microsoft Office Excel. Abbreviations are not allowed. Ninety (90) days prior to contract expiration, the Contractor shall submit a final MGPL suitable for close-out purposes containing use/disposition recommendations.

9.2. Contractor Purchased Government Material

If the contractor is required to purchase any Government Furnished Material, all purchases of hardware and software shall be in accordance with the procedures of Federal Acquisition Regulations (FAR) Part 45 and Defense Federal Acquisition Regulations (DFAR) and shall be approved to purchase, by the Contracting Officer’s Representative (COR), and shall be considered Government Property. As such, all care, maintenance, and consideration apply, and the same as it would for GFE hardware or software (CDRL A006). The contractor shall be liable for Government Property in their possession pursuant to FAR 52.245-1, as applicable.

10. Section 508 All Contract Data Requirements List (CDRL) deliverables, in Section 4 above, should meet applicable accessibility requirements and should not adversely affect accessibility features of existing EIT technologies. Information, documentation, and support requirements from 36 CFR part 1194 Subpart D have been determined to apply to this acquisition. Solicitation respondents must describe how the information, documentation, and support proposed for Contract Services deliverables will meet at least those information, documentation, and support requirements identified as applicable in the attached Government Product/Service Accessibility Template (GPAT).

Task Order 1; IT Service Provisioning and Operations

11. Performance Requirements Summary (PRS)

Average Staff Availability Metric (Non-Key Personnel) = (Total hours accumulated within period for Non-Key Personnel) / (# of key personnel positions X available workhours in period) Metric begins after transition period AQL for Key Personnel > 95%

AQL for Non-Key Personnel > 90%

Data will be collected from MRS and will be as of the cut-off date of the MSR for each period.

NOTE: on-time deliverable assumes the item is accepted as compliant by the government reviewer. A rejected deliverable will be withdrawn from the delivered count and the metric will be recalculated.

For each network the metric is calculated as follows: Possible Availability = (# of devices) * (seconds in month) Actual Availability = (Possible Availability) - (sum of all outages in seconds for servers as measured in Remedy by taking Asset Outage records and subtracting the Actual Start Time from the Actual End Time) Availability = Actual Availability/Possible Availability

Average time to incorporate = (date installation and checkout is complete – date of receipt of patch/update) / # of patches/updates completed in the period.

Metrics will be separate for patches/updates received as “urgent” and all others.

There will be two AQLs for this performance requirement;

AQL for Urgent patches/updates < 2 days

AQL for other than Urgent patches/updates < 7 days The contract shall maintain a log of the receipt date/time for all patches and updates. The contractor shall calculate this metric each month and include in the MSR.

First Contract Resolution Rate = # of user service restoration incidents (received during performance period) resolved during the initial contact / Total # of user service restoration incidents within the performance period.

Monthly AQL for First Contact Resolution Rate shall be equal to or greater than 75%.

Beginning with the sixth month of performance, a second metric will be added to represent the most recent cumulative 6-month rate. The rolling 6-month cumulative rate AQL shall be greater than 80% The contractor shall collect data to support this metric from their QA program and include the calculated metric in the MSR.

Thus, the contractor shall meet the stated performance standard 90% of the time, as measured on for any given performance period (one month).

The contractor shall collect data to support this metric from their QA program and include the calculated metric in the MSR.

# of abandoned calls / total # of calls (in a given period) Performance Standard is 13% or less as measured monthly The AQL for this metric is 100%.

Any month this metric exceeds the standard will be considered unacceptable and corrective action plan will be required.

The contractor shall collect data to support this metric from their QA program and include the calculated metric in the MSR.

Respond time = the time it takes to move a ticket from “assigned” to “in-progress” Respond time for Stop work shall be 1hour Respond time for Executive/Premier/VIP shall be 15 minutes or less Resolve time = time from creation to resolution or Mean Time To Restore for normal work status shall be 36 hours Resolve time = time from creation to resolution or Mean Time To Restore for a work stoppage shall be 8 hours Resolve time = time from creation to resolution or Mean Time To Restore Executive/Premier/VIP shall be 4 hours The percentage of compliant resolution metric = sum of all incidents completed within established time standards / total number of incidents tracked.

Accuracy rate = (# of records inspected - # of errors identified) / (# of records inspected).

Note: an error could be an unverifiable entry, or the failure to have recorded an entry at time of inspection.

The AQL for this measure will be

Accurate rate > 96%

Sample size and frequency of inspection will be at COR discretion This metric will be based on government random inspection of asset management records.

1st Month AQL > 85% 2nd Month AQL > 95% 3rd Month AQL > 98%

The contractor shall collect data to support this metric from their QA program and include the calculated metric in the MSR