Attachment_1_PWS-.docx

Attachment 1

Performance Work Statement for:

Defense Automated Management Information System (DAMIS)

PART 1

GENERAL INFORMATION

1.1 Description of Services/Introduction: The contractor shall provide all personnel and supervision necessary to operate and maintain the Defense Automated Management Information System (DAMIS) as defined in this Performance Work Statement (PWS) except for those items specified as Government-furnished property and services.

1.2 Background: The Department of Defense Office of Inspector General (DoD OIG) was established by Congress to conduct and supervise audits, evaluations, inspections, and investigations relating to the programs and operations of the Department of Defense (DoD).

DoD OIG has a requirement to operate and maintain DAMIS; a legacy software system that provides the DoD OIG a technology-based management information system for planning, managing, and reporting on audits, evaluations, and inspections to its internal and external customers. Specifically, DAMIS is a web-based application that was engineered for the DoD OIG to facilitate project management and other activities associated with project management. It is a planning and tracking tool that provides an automated capability to capture and distribute information about the projects the DoD OIG has planned, in-progress or completed.

DAMIS Service View (SV) is a stand-alone application designed to document and display auditors and other staff members’ information about their activities. It is a repository of planned, ongoing, and completed audits, consults, evaluations, inspections, and quality control undertakings and assistance activities; and to manage time and attendance data, training and development data, and case management data from ongoing and completed projects.

DAMIS SV is composed of 10 major modules:

· Fact Sheet – The primary planning tool and initiating document for audit projects.

· Projects –Plans and tracks personnel assignments, project status, project milestones, and project costs.

· Product – Tracks findings, recommendations, and monetary benefits associated with the recommendations.

· Reports – A tool for the required management reporting capability.

· Staff –Adds, modifies, and removes users from the system.

· Training –Tracks staff training and compliance with Continuing Professional Education (CPE) requirements required by Generally Accepted Government Auditing Standards (GAGAS).

· Timesheet – Tracks the staff work hours by project and other indirect activities.

· Admin – Allows privileged users to manage various parts of the DAMIS system.

· Government Accountability Office (GAO) – Tracks GAO audits of DoD activities and programs.

· Audit Follow-up (AFU) – Tracks the status of findings, recommendations, and monetary benefits associated with the recommendations for DoD OIG reports as well as GAO reports on DoD topics. However, AFU does not track monetary benefits for GAO projects.

1.3 Objective: The objective of this PWS is to obtain contractor support to operate and maintain DAMIS at the Government facilities.

1.4 Scope: The contractor will be responsible for DAMIS operations and maintenance to include system troubleshooting; performing code adjustments; software release development, testing, implementation, and integration; database management; and DAMIS back-ups and data recovery.

CLIN0001 DAMIS System Administration, Operations and Maintenance

The contractor must be able to provide sufficient technical expertise as necessary to effectively and efficiently perform as required to support DAMIS.

1.5 Period of Performance: The anticipated period of performance will be for one four -month base period from the Date of Award (DOA) and four 12-month option periods. The Period of Performance reads as follows:

1.6 General Information

1.6.1 Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rates.

1.6.2 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor will develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s Quality Control Program is the means by which the contractor assures that the work performed complies with the requirements of the contract. The contractor shall provide its Quality Control Program in its technical submission. The Quality Control Program must address the quality control planning, execution, and tracking to be utilized to assure compliance with contract performance standards.

1.6.3 Recognized Federal Holidays: The contractor shall not be required to perform on the following Federal holidays:

1.6.4 Hours of Operation/Place of Performance: The contractor is responsible for conducting business, between the hours of 5:30 AM and 9:00 PM EST, Monday thru Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Additionally, the contractor must ensure that technical contractor support personnel are available to assist the DoD OIG Information Systems Directorate in performing regular maintenance on the DAMIS systems and servers. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor will keep in mind that the stability and continuity of the workforce are essential.

1.6.4.1 Place of Performance: The work to be performed under this contract will be performed at the contractor site and Government facilities at 4800 Mark Center Drive Alexandria, VA 22350-1500.

1.6.5 Type of Contract: The Government anticipates award of a Firm-Fixed Price (FFP) contract.

1.6.6 Security Requirements:

1.6.6.1 Access to Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), and Privacy Act information is required in performance of this PWS. DAMIS contains CUI, PII, and Privacy Act information. The contractor will implement security requirements as defined below and set forth in Part 5, Applicable Publications to this PWS.

1.6.6.2 Physical Security: The contractor will be responsible for safeguarding all Government-furnished property, information, and materials provided for contractor use. At the close of each work day; Government-furnished property, materials, and facilities will be secured.

In case of a security incident, the contractor will notify the Government, including the Contracting Officer (KO), Contracting Officer Representative (COR), and DoD OIG Office of Security (OSEC) Point of Contact (POC) in writing within 24 hours of discovering a security incident. At a minimum, the contractor will provide the following details to the Government:

· Nature of the incident,

· Cause of the incident,

· Time and date of the incident,

· Operational/technical impact,

· Response actions taken,

· Point(s) of contact present or knowledgeable about the incident, and

· Incident status.

1.6.6.3 Non-Disclosure Agreements: The contractor will ensure that all contractor personnel working on this contract comply with the DoD Privacy Program and the Non-Disclosure Agreement. The DoD Privacy Program (32 CFR 310, Part 310/DoDD 5400.11) provision restricts contractor employees from disclosing personal information from a system of records they operate on behalf of a DoD component, outside of DoD. All contractor personnel assigned to this project must complete and submit a Non-Disclosure Agreement to the COR within ten (10) calendar days after arrival. A copy of the Non-Disclosure Agreement can be found in Technical Exhibit 1. Non-Disclosure Agreement.

1.6.6.4 Security Clearances: The contractor is responsible for ensuring that all contractor personnel working on this effort are U.S. citizens. Additionally, the contractor will possess a SECRET facility clearance. The contractor will also ensure that all contractor personnel working on this contract possess a minimum of a “SECRET” level clearance. All contractors working on this contract must obtain a favorably adjudicated National Agency Check with Local Agency and Credit Check (NACLC) background investigation prior to performing work on this contract. The DoD OIG does not process contractor background investigations. The DoD OIG OSEC will verify in the Joint Personnel Adjudication System (JPAS) that each contractor’s background investigation and security clearance meets the security requirements defined in this contract prior to performing work on this contract.

1.6.6.4.1 The contractor will complete and submit a “Visit Authorization Letter (VAL)” through JPAS to the DoD OIG OSEC POC within a minimum of 7 calendar days of the DOA. The OSEC POC will be identified after the contract is awarded. The OIG Security Management Office (SMO) code will be provided directly to the contractor’s security office. The contractor will complete and submit a new VAL to the DoD OIG OSEC through JPAS when additional contractor support personnel are added to this contract.

1.6.6.4.2 The Government considers the requirement for a SECRET security clearance a definitive responsibility matter. Quoters must submit proof of these credentials. This proof will be made available to the Government with the contractor’s technical submission by the deadline for receipt of technical submissions. Failure to submit that information will be deemed a material nonconformity and result in the disqualification or rejection of the quoter’s quote.

1.6.6.5 All COR/Program Managers/contractors will notify the DoD OIG OSEC and Network Security prior to departure from this program or at the conclusion of the contract (whichever occurs first). All contractors will complete DoD OIG Form 5220.22-1 Contractor Employee Checkout Certification prior to departure from this program or at the conclusion of the contract (whichever occurs first). All contractors will attend a Security Debrief with the DoD OIG OSEC prior to departure from this program or at the conclusion of the contract (whichever occurs first). All Government-furnished notebook computers issued to contractor employees are Government property and will be returned either prior to departure from the program or at the conclusion of the contract (whichever occurs first) to the COR. All Common Access Cards issued to the contractor employees are Government property and will be returned either prior to departure from the program or at the conclusion of the contract (whichever occurs first) to the COR.

1.6.6.6 All contractor personnel assigned to this contract will be required to renew their Common Access Card (CAC) within one year of issuance. Contractors whose CAC is lost or stolen must present documentation to the DoD OIG OSEC with their immediate supervisor’s signature acknowledging the loss and the CAC sponsor’s signature confirming that the CAC is missing and describing the circumstances under which the loss occurred. The DoD OIG OSEC will generate a memorandum required by the Pentagon Badge Office in order to issue a new CAC.

1.6.6.7 The contractor’s staff must not share CACs, Personal Identification Numbers or passwords with any other contractor or Government personnel. The COR will report any violation or suspected violation of misuse of the CAC, PIN or passwords to the KO. Violators will be temporarily suspended or permanently removed from the project.

1.6.7 Mandatory Training

1.6.7.1 All contractors working on this contract will be required to complete mandatory trainings for the DoD OIG and provide proof of completion to the COR and DoD OIG Industrial Security Program Manager. This list of mandatory training is subject to change as the DoD OIG identifies additional training in areas that are relevant to the performance of this contract. All required training will be provided by the Government. All contractors assigned to this contract will attend a Security In-brief during in-processing with the DoD OIG OSEC POC.

· All contractors working on this contract will complete Level I Antiterrorism Awareness Training and provide proof of completion to the COR and DoD OIG Industrial Security Program Manager via email within ten (10) calendar days after receipt of their CAC and Government-furnished notebook computers. The web link to the Level I Antiterrorism Awareness Training is: (https://jkodirect.jten.mil).

· DoD Directive 5400.11-R, “Department of Defense Privacy Program,” May 14, 2007, requires all DoD civilian, military, and contractor personnel to complete Identifying and Safeguarding PII Training. All contractors working on this contract will complete Identifying and Safeguarding PII Training and provide the certificate of completion to the COR and DoD OIG Industrial Security Program Manager via email within ten (10) calendar days after receipt of their CAC and Government-furnished notebook computers. The web link to the Identifying and Safeguarding PII Training is: (http://iatraining.disa.mil/eta/piiv2/launchPage.htm).

· All contractors working on this contract will complete OIG Security Awareness training. OIG Security Awareness training is located on the DoD OIG Intranet. Click on “MANDATORY TRAINING” and scroll down the list of mandatory training to reach the course titled “Security Awareness”. Upon completion, all contractors working on this contract are required to certify completion and provide a copy of their certificate of completion to the COR and DoD OIG Industrial Security Program Manager via email within ten (10) calendar days after receipt of their CAC and Government-furnished notebook computers.

· All contractors working on this contract will complete refresher Level I Antiterrorism Awareness Training, Identify and Safeguarding PII Training, and OIG Security Awareness Training annually by the deadline established by the Government and provide proof of completion to the COR and DoD OIG Industrial Security Program Manager via email.

· All contractors working on this contract will complete Cyber Awareness Challenge Training and provide a copy of their certificate of completion to the COR within ten (10) calendar days after arrival. The web link to the Cyber Awareness training is: (http://iatraining.disa.mil/eta/cyberchallenge/launchpage.htm).

· Government-furnished notebook computers cannot be issued to the contractor until Cyber Awareness Challenge training has been completed and proof of completion has been provided to the DoD OIG Information Systems Directorate.

· All contractors working on this contract will complete refresher Cyber Awareness Challenge training annually by the deadline established by the Government and provide proof of completion to the COR. Access to the DoD OIG local area network will be terminated if refresher Cyber Awareness Challenge training is not completed by the deadline established by the Government.

· All contractors working on this contract will complete Counterintelligence Awareness and Reporting (CIAR) training in the format offered by the Air Force Office of Special Investigations (AFOSI) and provide proof of completion to the COR by the deadline established by the Government. Additionally, all contractors working on this contract will complete refresher CIAR training by the deadline established by the Government.

· All contractors working on this contract will complete Social Networking training and provide a copy of their certificate of completion to the COR within ten (10) calendar days after receipt of their CAC and Government-furnished notebook computers. The web link to the Social Networking training is: (http://iaseapp.disa.mil/eta/sns_v1/sn/launchPage.htm) The Social Networking training is NOT an annual requirement. All contractors working on this contract will only need to complete Social Networking training once.

· All contractors performing on this contract will complete Preventing Workplace Violence Training. Preventing Workplace Violence Training is located on the DoD OIG Intranet. Click on “MANDATORY TRAINING” and scroll down the list of mandatory training to reach the course titled “Preventing Workplace Violence”. Upon completion, all contractors working on this contract are required to certify completion and provide a copy of their certificate of completion to the COR within ten (10) calendar days after receipt of their CAC and Government-furnished notebook computers.

· All contractors working on this contract will complete refresher Preventing Workplace Violence Training annually by the deadline established by the Government and provide proof of completion to the COR.

1.6.8 Contracting Officer Representative (COR):

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

· Assure that the Contractor performs the technical requirements of the contract;

· Perform inspections necessary in connection with contract performance;

· Maintain written and oral communications with the Contractor concerning technical aspects of the contract;

· Issue written interpretations of technical requirements, including Government drawings, designs, and specifications;

· Monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies;

· Coordinate availability of Government-furnished property; and

· Provide site entry of Contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the PWS or the contract. Original of all correspondence and deliverables related to this requirement will be submitted electronically to the designated COR.

1.6.9 Key Personnel:

The following personnel are considered key personnel by the Government: program manager, alternate program manager, and one primary and alternate Information Assurance Technical (IAT) Level-II certified person or higher. The contractor shall provide the Government with the name of the program manager and the alternate program manager who will act for the program manager when the manager is absent. The program manager or alternate program manager will have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The program manager or alternate program manager will be available between 9:00 AM to 5:00 PM EST, Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative reasons, or similar Government-directed facility closings.

1.6.10 Program Management Roles:

· The program manager will work closely with the Government to coordinate all tasks and deliverables.

· The program manager will ensure that a monthly analysis of DAMIS is performed to identify potential problems and will include the findings and recommendations in the Monthly Status Reports.

· The program manager will prepare Monthly Status Reports. The Monthly Status Report (MSR) will be submitted to the COR no later than the 10th workday of each month. The MSR will provide a description of activities, both completed during the past month and planned for the next month, issues and problems encountered, recommended solutions, and client actions. The MSR will correspond with contractor invoices and provide the Government with the contract award amount status and cumulative level of effort expended.

1.6.11 Special Qualifications:

The Information Assurance Technical (IAT) Level-II or higher certified personnel will meet the qualifications described below:

The contractor will provide one primary and alternate IAT Level-II or higher certified person with the expertise in system and database architecture, database administration, and system and web development. These individuals will be responsible for DAMIS software release design, development, debugging, testing, deployment, integration, and operation and maintenance. Additionally, these individuals will be responsible for the design, development, and maintenance of database procedures required to ensure the completeness, accuracy, availability, and integrity of the DAMIS data. These individuals will be responsible for implementation and maintenance of the DAMIS data models and database designs, data access, and table maintenance.

The contractor will ensure that all contractor support personnel performing IAT Level -I, -II, or -III duties on this project meet the Information Technology (IT) certification requirements specified in DoD Manual 8570.1, “Information Assurance Workforce Improvement Program,” prior to working on this contract. Contractor personnel performing information assurance functions must obtain and maintain a certification corresponding to the highest level function(s) required by their position prior to working on this contract. The contractor will submit the names of the IAT Level-II or higher certified personnel to the COR within 7 calendar days of the DOA and verification documentation to demonstrate that all contractor personnel performing information assurance duties on this project possess the appropriate IAT certification.

1.6.12 Identification of Contractor Employees:

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All contractor personnel assigned to this project will be required to obtain and use a CAC during the performance of this service.

1.6.13 Post Award Conference/Periodic Progress Meetings:

The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The post award conference will occur within 15 calendar days of the DOA. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the KO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action will be taken to resolve outstanding issues. These meetings will be at no additional cost to the Government.

PART 2

DEFINITIONS & ACRONYMS

2.1. DEFINITIONS:

2.2 Contractor - A supplier or vendor having a contract to provide specific supplies or service to the Government. The Contractor that is awarded the contract will be referred to as the prime contractor.

2.3 Contracting Officer (KO). - A person with authority to enter into, administer, and terminate contracts, and to make related determinations and findings on behalf of the Government. The Contracting Officer is the only individual who can legally bind the Government.

2.4 Contracting Officer Representative (COR) -An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment will be in writing and will state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. The Contracting Officer Representative DOES NOT have authority to change the terms and conditions of the contract. The COR cannot legally bind the Government.

2.5 Defective Service - A service output that does not meet the quality or standards of performance associated with the Performance Work Statement.

2.6 Deliverable - Intangible/Tangible items or services that can be delivered.

2.7 Key Personnel – Key Personnel are required meet the certifications as outlined in section 1.6.9 and DoD Manual 8570.01. The Government reserves the right to validate said certifications at any point during the life of the contract.

2.8 Physical Security - Actions that prevent the loss or damage of Government property.

2.9 Quality Assurance - The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.10 Quality Assurance Surveillance Plan (QASP) - An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.11 Quality Control - All necessary measures taken by the Contractor to assure that the quality of an end product or service will meet contract requirements.

2.12 Work Day - The period of time in a day during which work is performed. The number of hours per day which the contractor performs in accordance with the contract.

2.13 Work Week – Hours or days worked during a week.

Acronyms

2.14 Acronyms:

PART 3

GOVERNMENT-FURNISHED ITEMS AND SERVICES

3.1 General: The Government will provide the facilities, equipment, materials, and services listed below:

3.1.1 Facilities: The Government will provide the necessary workspace for contractor staff, based on availability, to provide the support outlined in this PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

3.1.2 Utilities: All utilities in the Government facilities will be available for the contractor’s use during performance of the duties outlined in this PWS. The contractor will instruct employees to use conservation practices. The contractor will be responsible for operating under conditions that preclude the waste of utilities.

3.1.3 Equipment: The Government will provide the contractors, including those located at remote sites, with Government-owned notebook computers to use to perform assigned contractor duties. All contractor personnel assigned to this project will operate Government-furnished notebook computers in accordance with the terms of the Information System Privileged Access Agreement; DoD OIG Non-Classified Internet Protocol Router Network (NIPRNET) Personal User Network Security Agreement; and DoD OIG publications, directives, and instructions set forth in Part 5, Applicable Publications.

3.1.3.1 Before access is granted to DAMIS information, information systems or network resources; all contractors performing on this contract will be required to sign and provide a copy of their Information System Privileged Access Agreement and DoD OIG NIPRNET Personal User Network Security Agreement to the COR within ten (10) calendar days after arrival.

3.1.3.2 The Government provides the contractors, including those located in remote locations, access to the following Government-furnished equipment:

· Network - connectivity within the DoD OIG protected enclave

· Hardware - Access to servers to facilitate DAMIS operations and maintenance

3.1.3.3 All Government-furnished items will be returned to the Government upon completion or termination of this contract.

3.2 Web-Hosting Package:

3.2.1 The Government will provide the hardware and software required to support DAMIS primary and failover operations to include:

· Redhat Enterprise Linux Operating System

· Microsoft Windows Server Operating System

· Microsoft Internet Information Services

· Crionics jPDF Server, Merger, Template

· Oracle Database Software

· Apache Tomcat

· Java JRE

· Antivirus Software

3.2.2 The Government will provide the following developer software on Government-furnished notebook computers to enable the contractor to support DAMIS operations and maintenance:

· Apache Subversion Software

· Apache Tomcat for Windows Software

· Remote Access Software

· Internet Explorer web browser

· Oracle SQL Developer Software

· Oracle Client Software

· Crionics jPDF Suite Professional + Developer

· Embarcadero JBuilder

· Antivirus Software

3.2.3 The Government will manage all software licenses and updates for all software provided by the Government and loaded on Government-furnished equipment.

3.2.4 DAMIS supports up to 50,000 hits a day worldwide and supports approximately 1,600 users.

3.3 Government Services:

3.3.1 The Government will establish and maintain the registration on the NIPRNET.

3.3.2 The Government will provide contractors access to DAMIS 24 hours a day, 7 days a week unless stated otherwise.

3.3.3 The Government will provide an alternate (failover) site to permit redundancy and partial restoration of mission or business essential functions supporting DAMIS operations following a disaster or emergency situation.

3.3.4 The Government will ensure that full daily backups of DAMIS system data are performed. Additionally, the Government will ensure that back-ups of the DAMIS applications are performed following deployment of any new DAMIS software release. Storage of application back-ups and backup data and media will be performed offsite in a secured facility operated by the Government. The Government will ensure that backup media is retrieved from the offsite location and made available to the contractor upon request.

3.3.5 The Government will develop and implement a Continuity of Operations Plan (COOP) for all OIG IT systems and network resources (including DAMIS). Additionally, the Government will perform periodic testing of the COOP.

3.3.6 The Government will provide support to verify, check, and repair or replace hardware and software. The Government will provide the contractor advance notice of changes to the software, hardware or network equipment. The Government will submit written notice of changes to the contractor at least 48 hours before making changes to the DAMIS software, hardware or network equipment, which may affect services availability.

3.3.7 The Government currently uses Numara FootPrints to report, monitor, and track DAMIS Software Change Requests (SCRs) and Software Trouble Reports (STRs). The SCRs will be presented to the DoD OIG Configuration Control Board (CCB) for approval or disapproval prior to completion by the contractor. The STRs will be presented to the DAMIS Project Manager during the periodic status meetings for review and discussion and to obtain additional clarification, if needed.

3.3.8 The Government will maintain copies of the DAMIS user manuals in the DoD OIG SharePoint Documentation Library.

3.3.9 The Government will maintain DAMIS in a secure, temperature-controlled DoD facility.

3.3.10 The Government will maintain sufficient Uninterruptible Power Supplies (UPS) to maintain connectivity in the event of power failures. Such capability will be sufficient to run the DAMIS applications. That includes servers, routers, firewalls, switches and other connectivity equipment for not less than 15 minutes.

3.4 Information Assurance:

3.4.1 The Government will perform analysis of DAMIS, as necessary, in accordance with Information Assurance Vulnerability Management (IAVM) requirements and report on corresponding operations, maintenance issues, and corrective actions required. Changes to DAMIS as a result of IAVM Alerts, Bulletins, or Technical Advisories should be made within the timeframe specified in the Alert, Bulletin, or Technical Advisory. The Government will create a Plan of Action & Milestone (POA&M) in the DoD Vulnerability Management System (VMS) if an IAVM alert, bulletin, or technical advisory cannot be completed within the timeframe specified in the notice. The Government will coordinate with the contractor prior to the installation or application of patches, upgrades, temporary workarounds, and new Automated Information Systems (AIS).

3.4.2 The Government will perform vulnerability assessments of DAMIS. Network vulnerability scanning will be performed using DoD-mandated scanning tools and software. The Government will provide Blue and Red Team Assessments of DAMIS to identify and protect DoD data, information, information systems, and networks against vulnerabilities and limitations.

3.4.3 The Government will align DAMIS with a Computer Network Defense Service Provider (CNDSP) for Computer Network Defense (CND) Services, acquiring and maintaining a CNDSP verification letter, and submitting POA&Ms as required to the CND Certification Authority (CA) and CND Architect.

3.4.4 The Government will support the CNDSP in network security monitoring and analysis; attack sensing and warning; and incident reporting, and response for DAMIS.

3.4.5 The Government will perform audit trail monitoring and analysis of the event logs belonging to the DAMIS systems on a regular basis for indications of inappropriate or unusual activity.

3.4.6 The Government will provide virus protection for DAMIS. The Government will perform routine virus scans and update virus definitions on a daily basis or whenever new virus definitions are released.

3.4.7 The Government will ensure that DAMIS remains compliant with all Federal Government, DoD rules, regulations, directives, instructions, orders, and policies pertaining to Information Assurance (IA), Information Technology (IT), IT Security, and protection of Federal and DoD data and information systems. These include, but are not limited to, requirements from the following organizations: DoD, Strategic Command (STRATCOM), and U.S. Cyber Command (USCYBERCOM), Joint Chief of Staff, and Defense Information Systems Agency (DISA).

3.4.8 The Government will ensure that DAMIS complies with all required rules, regulations, directives, instructions, orders, and policies that include, but are not limited to: Joint Chief of Staff Fragmentary Orders (FRAGO), Communications Tasking Orders (CTO), Warning Orders (WARNORD), Operational Directive Messages (ODM), Information Operation Conditions (INFOCON) levels and associated security level changes, IA Workforce regulations, DoD Directive O-8530.1 (Computer Network Defense), the National Institute of Standards and Technology (NIST) policies, and the Federal Information Security Management Act (FISMA).

3.4.9 The Government will track and monitor DAMIS compliance with USCYBERCOM directives and orders using the DoD VMS.

3.4.10 The Government will perform random configuration audits to ensure that all code written for DAMIS conforms to Federal and DoD IA standards from the DOA. The contractor will provide a complete copy in machine-readable form of the source code, source code compilers, and complete instructions for compiling and linking every part of the source code into executable code to the Government within 15 calendar days of a software release for purposes of enabling verification of the DAMIS source code conformance to Federal and DoD IA standards. The Government will immediately notify the contractor of any deficiencies identified during random audits. The contractor will correct deficiencies within 30 calendar days of receipt of written notice from the Government. If the deficiencies cannot be corrected within 30 calendar days, then the contractor will immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within 10 calendar days of receipt of written notice from the Government.

3.4.11 The Government will conduct periodic reviews, testing, and assessment of the security controls in place for DAMIS in accordance with DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT).” Additionally, the Government will complete the Security Authorization Package (security plan, security assessment report, and POA&M) required to obtain a full Authorization to Operate (ATO).

PART 4

SPECIFIC TASKS

4.1. Basic Services: The contractor will provide services for the design, development, deployment, testing, and maintenance and operation of DAMIS.

4.2 System Administration, Operation, And Maintenance Service:

4.2.1 System Availability Requirement

The contractor will ensure that the DAMIS system is available to Government employees during core operating hours.

The purpose of this requirement is to establish a fault-tolerant standard for DAMIS operation during core operating hours.

The availability requirement is 96.8 percent or 15.5x5 (15.5 hours per day, 5:30 AM – 9:00 PM EST, Monday – Friday). Unplanned downtime hours per day are 0.5 hours or 30 minutes.

Since downtime will only constitute unplanned shutdown of DAMIS during core operating hours, availability will be defined as:

DAMIS Availability =

((Operating hours) – (Total downtime due to unplanned shutdown)) x 100 (Operating hours) where,

· Operating hours per year: 4,030 hours

· Unplanned downtime hours per year: 130 hours

· DAMIS Availability: 96.8 percent

4.2.2 The contractor will provide the Government advance notice of changes to the DAMIS system. The contractor will submit written requests to the Government at least 7 calendar days before making changes to the DAMIS system, which may affect service and advise the Government of the changes made to the system. Changes to the DAMIS system must be evaluated and approved by the DoD OIG CCB prior to completion.

4.2.3 The contractor will perform testing of all patches, upgrades, workarounds, and new AIS in the test environment prior to deployment in the production environment.

4.2.4 The contractor will make minor updates to DAMIS Data as directed by the Government.

4.2.5 The contractor will establish and maintain a server administration and technical troubleshooting guide to document the procedures that must be followed to operate and maintain DAMIS and resolve common recurring problems in DAMIS. The server administration and technical troubleshooting guide will be delivered to the COR within 60 calendar days from the DOA. The contractor will review and update the DAMIS server administration and technical troubleshooting guide on a quarterly basis to ensure that the written procedures are complete, accurate, and up-to-date. The contractor will provide an updated server administration and technical guide within 30 calendar days of completing a review, but no later than 10 days after the end of the quarter.

4.2.6 The contractor will establish and maintain a list of all table names, structures, and relationships for DAMIS. The contractor will review and update the table lists, structures, and relationships after all upgrades, updates, changes, and enhancements to DAMIS. The updated list of table names, structures, and relationships for DAMIS will be delivered to the COR within 30 calendar days of a quarterly software update.

4.2.7 The contractor will assist the Government in developing technical recovery procedures for the applications, servers, and databases; and establishing recovery priorities based on the appropriate hosting environment. The technical recovery procedures and recovery priorities will be delivered to the COR within 60 calendar days from the DOA. The COR will review and approve the recovery procedures and recovery priorities within 15 calendar days after submission by the contractor or provide comments showing additional information required. The contractor will then address all COR comments and provide additional requested information to the COR within 7 calendar days from receipt. The review and correction timeframe for the deliverable will not exceed 30 calendar days from the date of the initial receipt by the COR.

4.2.8 The contractor will perform testing of the DAMIS data back-up files on a quarterly basis to ensure that the data can be restored from the back-ups files in the DAMIS testing environment. Additionally, the contractor will assist the Government in performing testing of the DAMIS application back-up files on an annual basis to ensure that the applications can be restored at the alternate (failover) site from the application back-up files.

4.2.9 The contractor will support security assessments and audits of DAMIS. Specifically, the contractor will ensure that all necessary information and documentation required to support the Government in developing the Security Plan is provided to the Government to maintain the Approval to Connect (ATC) and Authorization to Operate (ATO) for DAMIS in accordance with the DoD Instruction 8510.01, Risk Management Framework (RMF) For DoD Information Technology (IT).

4.3 Section 508 Compliance Requirements: All Electronic and Information Technology (EIT) procured through this requirement must meet the following applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.section508.gov.

Full details demonstrating compliance with Section 508 requirements will be included as an attachment to any award made hereunder. The following standards have been determined to be applicable to this contract and are summarized below. The full text of these Section 508 requirements is viewable at http://www.section508.gov.

Software Applications and Operating Systems

Most of the specifications for software pertain to usability for people with vision impairments. For example, one provision requires alternative keyboard navigation, which is essential for people with vision impairments who cannot rely on pointing devices, such as a mouse. Other provisions address animated displays, color and contrast settings, flash rate, and electronic forms, among others.

Web-based Intranet and Internet Information and Applications

The criteria for web-based technology and information are based on access guidelines developed by the Web Accessibility Initiative of the World Wide Web Consortium. Many of these provisions ensure access for people with vision impairments who rely on various assistive products to access computer-based information, such as screen readers, which translate what's on a computer screen into automated audible output, and refreshable Braille displays. Certain conventions, such as verbal tags or identification of graphics and format devices, like frames, are necessary so that these devices can "read" them for the user in a sensible way. The standards do not prohibit the use of Web site graphics or animation. Instead, the standards aim to ensure that such information is also available in an accessible format. Generally, this means use of text labels or descriptors for graphics and certain format elements. (HTML code already provides an "Alt Text" tag for graphics that can serve as a verbal descriptor for graphics). This section also addresses the usability of multimedia presentations, image maps, style sheets, scripting languages, applets and plug-ins, and electronic forms.

The standards apply to Federal Web sites but not to private sector web sites (unless a site is provided under contract to a Federal agency, in which case only that web site or portion covered by the contract would have to comply). Accessible sites offer significant advantages that go beyond access. For example, those with "text-only" options provide a faster downloading alternative and can facilitate transmission of web-based data to cell phones and personal digital assistants.

It is not the intent of the Government to re-design DAMIS to be 100% compliant with Section 508 requirements. The current level of Section 508 compliance of DAMIS is sufficient to the Government.

4.4 Change Management Plan and Software Updates:

4.4.1 Change Management Plan:

4.4.1.1 The contractor will ensure that the DAMIS Change Management Plan remains complete, accurate, and up-to-date. The Change Management Plan should include the procedures for requesting changes, reviewing and approving all proposed changes, maintaining and managing the Source Code Library, and the testing process for the requested changes to include a Regression Test Plan Process. The regression test plan must incorporate a provision for hardware, software, and/or network updates. The change management plan will be delivered to the COR within 30 calendar days from the DOA. The COR will review and approve the change management plan within 15 calendar days after submission by the contractor, or provide comments showing additional information required. The contractor will then address all COR comments and provide additional requested information required. The contractor will then address all COR comments and provide additional requested information to the COR within 7 calendar days from receipt. The review and correction timeframe for deliverable will not exceed 30 calendar days from the date of the initial receipt by the COR.

4.4.1.2 The contractor will review and update the change management plan on a quarterly basis to ensure that the written procedures are complete, accurate, and up-to-date. The contractor will provide an updated change management plan within 30 calendar days of completing a review, but no later than 10 days after the end of the quarter.

4.4.2 Software Updates:

4.4.2.1 The contractor will perform software updates based on the routine approved software change requests derived from the Government, contractor or DoD OIG CCB meetings. No software change requests will be made without the approval of the DoD OIG CCB. The contractor will deploy software updates on a quarterly basis unless an emergency software change request requires a software release to be released sooner. The contractor will issue software releases on a quarterly basis to address software trouble reports reported by the Government. The contractor will issue a software release sooner if a high priority software trouble report requires a software release to be released sooner. The DAMIS Program Manager and COR will determine when an emergency software release must be released outside of the quarterly release schedule. All code developed as part of this contract is the property of the United States Government.

4.4.2.2 The source code for DAMIS is the property of the United States Government, and must be provided to the DoD OIG Information Systems Directorate within 15 calendar days of a software release. The contractor will provide a complete copy in machine-readable form of the source code, source code compilers, design documentation, and complete instructions for compiling and linking every part of the source code into executable code for the purposes of enabling verification of the completeness of the source code. Such instructions will include precise identification of all compilers, library packages, and linkers used to generate executable code.

4.5. Testing, Inspection, and Acceptance:

4.5.1 Regression Testing/User Acceptance Testing:

After development is completed, the contractor will load the updated software onto the development instance. The contractor will perform a system-wide regression test before the release of approved changes and updates to the Government to perform user acceptance testing. The contractor will correct any software errors that occur during regression testing. The contractor will notify the COR within 48 hours of determining that a software release will be delayed.

4.5.2 The contractor will develop a test plan for the Government.