HE1254-17-R-9002_Amend_2.pdf

HE1254-17-R-9002

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is for the follow ing:

1. Extend the solicitation closing date from June 7, 2017 to June 12, 2017, 12:00 p.m. EST.

2. Post the answ ers to questions submitted by Offerors.

2. Make changes to the PWS; All changes have been highlighted in green.

3. Make changes to Addendum 52.212-1 Page limitations and Past Performance requirements. All changes have been highlighted in green.

4. Make changes to Addendum 52.212-2 Past Performance requirement. Highlighted in green

5. All other terms and conditions of this solicitation remain unchanged. (See Summary of Changes)

1. CONTRACT ID CODE PAGE OF PAGES

J 1 57

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 25-May-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HE1254-17-R-9002

X 9B. DATED (SEE ITEM 11)

12-May-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

25-May-2017

CODE

DOD EDUCATION ACTIVITY

ATTN: PROCUREMENT DIVISION

4800 MARK CENTER DRIVE

SUITE 05F09-02

ALEXANDRIA VA 22350-1400

HE1254 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 07-Jun-2017 12:00 PM to 12-Jun-2017 12:00 PM.

The following have been modified:

PERFORMANCE WORK STATEMENT

Department of Defense Office of Inspector General

IT Support

Department of Defense Education Activity 4800 Mark Center Drive

Alexandria, VA 22350

INFORMATION TECHNOLOGY SUPPORT SERVICE

1. General Information and Scope of Work.

1.1 Agency: The Department of Defense Office of Inspector General (DoD OIG) Office of the Chief Information Officer (OCIO), is responsible for installing, maintaining, operating and supporting all DoD OIG IT systems. The work of the OCIO enables the DoD OIG to accomplish its broad and continuing mission to support the warfighter and promote accountability, integrity, and efficiency in the Department of Defense.

The importance of the DoD OIG oversight work is signified by the enormity of the Department’s mission, the numerous assets that DoD utilizes to accomplish its mission, the magnitude of the DoD budget, and the over three million personnel who are part of the DoD family.

During the reporting period of April 1 through September 30, 2016, the DoD OIG issued a total of 65 audit, inspection, and evaluation reports that identified $52.4 million in questioned costs and $1 billion in funds put to better use. The DoD OIG also achieved $1.3 million in financial savings based on management-completed corrective actions elated to reports issued in this and previous reporting periods. Defense Criminal Investigative Service (DCIS) investigations, including those conducted jointly with other law enforcement organizations resulted in $445.3 million in civil judgments and settlements; $56 million in criminal fines, penalties, and restitution ordered;

and $42.1 million in administrative recoveries such as contractual agreements and military non-judicial punishment.

1.2 Background: The DoD OIG requires Information Technology support services covering a full range of technical, functional and managerial expertise to support the DoD OIG program initiatives. Current OIG transformational efforts focus on the improvements to business processes and organizational structures as part of the broader DOD effort to better support the war fighters, services and agencies, and Congressional mandates. A major focus of the transformation process involves leveraging Information Technology (IT) solutions to improve efficiency and establish an effective workforce.

1.3 Scope of work: The Contractor shall provide Program Management and Technical support by providing the required personnel in order to perform the tasks and produce the deliverables identified in this Performance Work Statement (PWS). See Appendix 1 for supported Networks and Systems, Appendix 2 for OIG staffing, IT resources, and office locations, Appendix 3 for historical work metrics to include help desk tickets, scheduled changes, and IT projects, and Section 3.12 for OIG IT service levels.

2. Requirement (Objectives) The objective of this effort is to obtain the full range of technical and functional expertise to support the DoD OIG Information Technology initiatives. The objectives of the PWS follow below, along with all the supporting tasks associated with each objective. Each objective is represented as a Contract Line Item Number (CLIN). Each Tier within an objective is represented as a Sub Contract Line Item Number (SCLIN):

2.1 Help Desk Support (Objective 1) (CLIN 1): The contractor shall provide phone and on-site support for OIG headquarters personnel and phone/remote desktop support for the OIG field offices. Support will cover a wide range of desktop hardware and software, common IT services, and OIG specific applications on the Unclassified (NIPRNet) and Classified (SIPRNet) networks. At a minimum the contractor will be required to perform the following tasks in support of the objective:

2.1.1 SCLIN 1 – Help Desk/Call Center Support (Tier 1):

Task 1 – Provide trouble call resolution in a knowledgeable, friendly and professional manner.

Task 2 – Meet OIG established service level metrics (Section 3.12) for call response, technical support, and customer service.

Task 3 – Input trouble calls into the OIG ticket tracking system. Ensure all relevant information is gathered and documented.

Task 4 – Resolve trouble calls; in person at the help desk, over phone, and/or through email.

Task 5 – Analyze and resolve trouble tickets utilizing tools such as remote desktop.

Task 6 – Escalate trouble tickets when required by service desk processes to either Tier II, Tier III, or appropriate team/individual.

Task 7 – Provide follow-up service to end-users to ensure that service provided by the Help Desk has addressed their needs in a timely and efficient manner.

Task 8 – Assign Trusted Agents (TA’s) responsible for issuing alternate tokens to Mark Center HQ personnel when required.

Task 9 – Fully document call resolution and ensure all notes are maintained in the ticket tracking system and Knowledge Base articles are published when applicable.

Task 10 – Maintain existing and when required create new SOPs in support of this objective for common Help Desk processes and activities.

2.1.2 SCLIN 2 – 24/7 Help Desk Support:

Task 1 – Perform all tasks identified in Objective 1 Help Desk Support, SCLIN 1 Help Desk/Call Center Support 24 hours a day, 7 days a week with the exception of holidays identified in Section 3.8.

Task 2 – Provide support for NIPRNet and SIPRNet during primary operation hours identified in Section 3.8 and NIPRNet only outside of those hours.

2.1.3 SCLIN 3 – Help Desk/Desk side Support (Tier 2):

Task 1 – Provide Tier 2 level IT support and trouble call resolution. This task includes all issues elevated from Tier 1 support.

Task 2 – Document incidents using the OIG ticket tracking system and create and publish knowledge base articles when applicable.

Task 3 – Meet OIG established service level metrics (Section 3.12) for call response, technical support, and customer service.

Task 4 – Resolve trouble calls using desk-side support, remote desktop, phone, and/or through email.

Task 5 – Respond to requests for network account modifications to include but not limited to account creation, configuration, deletions, and password/PIN resets.

Task 6 – an Image computer system, which includes but is not limited to desktop, laptop, tablet and thin client computers with OIG system images.

Task 7 – Perform computer re-imaging, assist users with data backup and restore, and installation of software applications.

Task 8 – Setup computer systems with external monitor(s), switch box, keyboard, mouse, printers or any other approved external peripheral.

Task 9 – Assist with the set-up of IT in training classrooms and conference rooms as required.

Task 10 – Perform the manual installation of approved software, software patches, and security updates to client systems when required.

Task 11 – Perform troubleshooting of incidents and issues on approved software applications, computer systems, printers, scanners, and other approved connected peripherals.

Task 12 – Monitor logs and automated systems for OIG IT system outages and incidents affecting multiple end users and initiate incident response procedures.

2.1.4 SCLIN 4 – Perform all tasks identified in Objective 1, SCLIN 3 for the TOP SECRET/SCI Joint Worldwide Intelligence Communications System (JWICS) network.

2.1.5 Performance Standards (PS) and Acceptable Quality Levels (AQL) (Objective 1)

The following applies to Objective 1:

PS1 – Meet OIG service level agreement metrics (Section 3.12) associated with this objective.

AQL1 – Service level agreement metrics shall not be missed more than 6 times during a 1-month period.

PS2 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order. Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL1– No Deviation

2.2 Operations (Objective 2): The contractor shall provide operational support of OIG IT systems listed in appendix 1. Support includes but is not limited to monitoring, incident response, maintenance, patching, and compliance on the Unclassified (NIPRNet) and Classified (SIPRNet) networks. The DoD OIG OCIO defines this type of support Operations Support (Tier 3). At a minimum the contractor will be required to perform the following tasks in support of the objective:

2.2.1 SCLIN 1 – Operations Support (Tier 3) :

Task 1 – Meet OIG established service level metrics (Section 3.12).

Task 2 – Provide configuration management support. Test, deploy, and maintain all OIG approved software. Apply STIGs, updates, and patches following established OIG processes and within designated timelines. IT systems identified with 90 day or older vulnerabilities will be rated as critical.

Task 3 – Follow all OIG change management and engineering review processes.

Task 4 – Ensure changes are completed according to the project and release manager schedule.

Task 5 – Document incidents using the OIG ticket tracking system.

Task 6 – Create and publish knowledge base articles when applicable.

Task 7 – Operate, maintain, and optimize all production IT systems to include but not limited to devices such as printers, scanners, copiers and fax devices.

Task 8 – Coordinate with engineering and/or developers for system redesigns and submit recommendations to the OIG Enterprise Architect (EA) and Project Management Office

(PMO).

Task 9 – Identify, troubleshoot, remediate, and document and perform and after action review (AAR) for all system outages.

Task 10 – Utilize desktop remote tools to analyze and resolve enterprise issues and outages.

Task 11 – Create, test, and prepare for deploying the standard OIG images for all OIG workstations.

Task 12 – Work as part of IT project teams and perform related tasks as assigned.

Task 13 – Monitor logs and automated systems for OIG IT system outages and incidents and initiate incident response procedures.

Task 14 – Coordinate equipment repair and services for all agency imaging (printing, scanning, copying, and fax devices), monitor the automated system that reports status, needs and usage trends on regular basis and take action as needed.

Task 15 – Monitors and analyzes usage of all OIG print devices and makes recommendations to maximize efficiency and decrease print costs.

Task 16 – Maintain existing and when required create new SOPs in support of this objective.

Task 17 – Support back-up and restoration services utilizing the OIG backup system(s). This support includes but is not limited to changing of tapes and maintaining the tape library.

Task 18 – Implement DoD security enhancements to include but not limited to Public key Infrastructure (PKI) to all assigned systems.

Task 19 – Assign System Administrator’s (SA’s) responsible for requesting, installing and maintaining DoD certificates on IT systems.

Task 20 – Implement DoD trained Registration Authorities (RA’s), Local Registration Authorities (LRA) and Key Recovery Agents (KRA’s) to manage the organizations PKI program which includes but is not limited to the approving, suspending, recovering and revoking of DoD certificates.

Task 21 – Coordinate with tier 1 and tier 2 for all system, development, and software changes impacting end user support and update help desk SOP’s as appropriate.

Task 22 – Utilize VMWare console or desktop remote admin tools to analyze and resolve workstation and server issues.

2.2.2 SCLIN 2 – Perform all tasks identified in Objective 2, SCIN 1 for the TOP SECRET/SCI (JWICS) network resources defined in Appendix 2.

2.2.3 Performance Standards and Acceptable Quality Levels (Objective 2)

The following applies to Objective 2:

PS1 – Meet OIG service level agreement metrics (Section 3.12) associated with this objective.

AQL1 – Service level agreement metrics shall not be missed more than 6 times during a 1-month period.

PS2– Mitigate/remediate all system vulnerabilities rated as critical findings as determined by the DoD standard vulnerability scanner within 7 calendar days of being discovered.

AQL2 – No deviation.

PS3 – Mitigate/remediate of all system vulnerabilities rated as High findings as determined by the DoD standard vulnerability scanner within 21 calendar days of being discovered.

AQL3 – No deviation.

PS4 – Mitigate/remediate all system vulnerabilities rated as Medium/Low as determined by the DoD standard vulnerability scanner within 90 days of being identified.

AQL4 – Acceptable deviation is to Mitigate/remediate 80% of all system vulnerabilities rated Medium/Low within 90 days of identification, with the remaining 20% mitigated/remediated within 180 days.

PS5 – After action review will be completed and submitted to the Government within five (5) working days after a service outage occurs and has been mitigated.

AQL5 – After action reviews will not be late more than one (1) time per task order.

PS6 – No scheduled maintenance or outages shall be planned during OIG business hours (as listed in section 3.8) without OCIO management authorization.

AQL6 – No deviation.

PS7 – System changes shall not be made without prior Government coordination and approval.

AQL7 – No deviation.

PS8 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL8– No Deviation.

2.3 Cyber Security (Objective 3): The contractor shall provide computer network defense and information assurance for the OIG networks to ensure confidentiality, integrity, and availability of OIG systems and data on the Unclassified (NIPRNet) and Classified (SIPRNet / JWICS) networks. At a minimum the contractor will be required to perform the following tasks in support of the objective:

2.3.1 SCLIN 1 – (Firewall and IDS/IPS) The contractor shall support, monitor, and provide analysis for all aspects of perimeter security to include but not limited to Firewall and Intrusion Detection

System (IDS)/Intrusion Prevention System (IPS). At a minimum in support of this task the contractor will perform the following:

Task 1 – Review and monitor firewall rules for networks at both OIG Headquarters and Alternate Data Center, identify issues and deficiencies, make corrections and advise management of possible incidents.

Task 2 – Monitor and maintain policies on OIG Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), including Wireless IDS.

Task 3 – Provide packet capture analysis as needed using various tools such as WireShark network protocol analyzer.

Task 4 – Provide response and support for customer requests for temporary firewall rules and firewall, IDS, and IPS-related issues.

Task 5 – Support, monitor, configure, and manage remote client VPN solutions.

Task 6 – Track and maintain lists of open ports via the DoD Ports, Protocols, and services management registry.

Task 7 – Support, maintain and patch all associated cyber security systems to include but not limited to Linux and Windows based operating systems managed by the DoD IG.

Task 8 – Review and configure system security posture IAW DISA STIG requirements and industry security best practices for system hardening.

Task 9 – Maintain existing and when required create new SOPs in support of this objective.

SOPs shall be in compliance with DoD 8530.01M and current CND evaluators scoring matrix (currently ESM v9).

2.3.2 SCLIN 2 – (Email Gateway and AV) The Contractor shall support, maintain, patch, and update gateway e-mail security systems, antivirus software, and gateway e-mail encryption systems. In the performance of this task, the Contractor shall:

Task 1 – Review and monitor gateway e-mail security systems for networks at both OIG Headquarters and Alternate Data Center, identify issues and deficiencies, make corrections and advise management and federal leads of possible incidents, inappropriate use, and malicious domains.

Task 2 – Monitor threat intelligence feeds for latest email borne threats.

Task 3 – Identify email based threats and malicious emails, and be able to write custom signatures to identify/alert/block email threats.

Task 4 – Update Antivirus software supporting NIPRNet and SIPRNet security systems.

Task 5 – Provide response and support for customer requests to release valid e-mails and other e-mail security issues.

Task 6 – Support, maintain and patch all associated cyber security systems to include but not limited to Linux and Windows based operating systems managed by the DoD IG.

Task 7 – Review and configure system security posture IAW DISA STIG requirements and industry security best practices for system hardening.

Task 8 – Maintain existing and when required create new SOPs in support of this objective.

2.3.3 SCLIN 3 – (HBSS (host AV) The Contractor shall support, maintain, patch, and update antivirus and host-based security servers and client software. In performance of this task, the Contractor shall:

Task 1 – Provide system administration, review and monitor host based security system server and host systems for networks at both OIG Headquarters and Alternate Data Center, identify issues and deficiencies, make corrections and advise management and federal leads of possible incidents and malicious activity.

Task 2 – Provide response and support for host based security system software and virus incidents, address customer issues, and take corrective action to clean viruses and malicious software from affected systems.

Task 3 – Provide host based security system support to system administrators during troubleshooting efforts.

Task 4 – Ensure compliance with DoD requirements as they pertain to host based security system.

Task 5 – Maintain existing and when required create new SOPs in support of this objective.

2.3.4 SCLIN 4 – (Web Proxy) The Contractor shall administer, support, maintain, patch, and update web proxy and associated systems. The Contractor shall:

Task 1 – Review and monitor web content servers and systems, identify issues and deficiencies, collect and review information on malicious sites and update block lists, make corrections and advise management and federal leads of possible incidents, malicious activity, and inappropriate use.

Task 2 – Provide packet capture analysis as needed using various tools such as WireShark network protocol analyzer.

Task 3 – Provide response and support to address customer issues related to blocked web sites.

Task 4 – Coordinate with OIG and CNDSP firewall personnel to setup IP blocks for malicious activity that warrants further action.

Task 5 – Support, maintain and patch all associated cyber security systems to include but not limited to Linux and Windows based operating systems managed by the DoD IG.

Task 6 – Review and configure system security posture IAW DISA STIG requirements and industry security best practices for system hardening.

Task 7 – Maintain existing and when required create new SOPs in support of this objective.

2.3.5 SCLIN 5 – (Network Defense) The Contractor shall utilize all available monitoring systems to provide computer network defense. In support of this task the contractor shall:

Task 1 – Support and monitor IDS, IPS, and associated monitoring software.

Task 2 – Participate in security assessments.

Task 3 – Respond to possible security incidents, identify false positives where applicable, open incident tickets, perform incident analysis, and close tickets upon completion.

Task 4 – Coordinate with the Firewall team for IP and other network blocks based on incidents and findings.

Task 5 – Provide packet capture analysis as needed using various tools such as WireShark network protocol analyzer.

Task 6 – Generate monthly security trend analysis reports based on data gathered from various Computer Security Systems.

Task 7 – Maintain existing and when required create new SOPs in support of this objective.

SOPs shall be in compliance with DoD 8530.01M and current CND evaluators scoring matrix (currently ESM v9).

Task 8 – Ensure all security incidents are identified and handled within established CND SLAs and follows the DoD IG Incident Handling Plan and CNDSP Incident Handling Plan procedures.

2.3.6 SCLIN 6 – (Information Assurance (IA) support) The Contractor shall provide Information

Assurance (IA) support. In performance of this task the Contractor shall:

Task 1 – Complete and report for Federal Information Security Management Act (FISMA) compliance.

Task 2 – Maintain OIG entries in the DOD IT Portfolio Repository (DITPR). 3.21.3 Document, prepare and submit DOD Risk Management Framework (RMF) packages.

Task 3 – Provide Information Assurance (IA) training and other security briefings, and track employee completion.

Task 4 – Review and assist with drafting IA policies and guidance.

Task 5 – Review change request information and participate in Change Management meeting giving recommendations based on DoD policy and security best practices.

Task 6 – Monitor and responds to guidance, directives, and issuances from the USCYBERCOM, and tracks and reports on compliance with Communication Tasking Orders (CTOs), Task Order (TASKORD), Operational Orders (OPORD), Information Assurance Vulnerability Alerts (IAVAs) and other security requirements using the Continuous Monitoring and Risk Scoring (CMRS) System.

Task 7 – Perform scans and analysis of servers, workstations, routers, switches, and all other devices connected to OIG networks for compliance with federal, DOD, and USCYBERCOM requirements.

Task 8 – Provide vulnerability reports to OIG and CNDSP as required to include current vulnerability reports and historical trending.

Task 9 – Track and monitor IA Workforce Improvement Program (IAWIP) compliance.

Task 10 – Maintain existing and when required create new SOPs in support of this objective.

Task 11 – Maintain existing and when required support the creation and submission of IA accreditation documentation to include but not limited to Risk Management Framework (RMF) packages and Approval to Connect (ATC) packages.

2.3.7 Performance Standards and Acceptable Quality Levels (Objective 3)

The following applies to Objective 3:

PS1 – Meet OIG service level agreement metrics (Section 3.12) associated with this objective.

AQL1 – Service level agreement metrics shall not be missed more than three (3) times during a one month period.

PS2 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days

AQL2– No Deviation.

2.4 Project Management (Objective 4): The contractor shall provide project management support for the various IT projects worked by the OIG. The contractor shall work projects as the primary or alternate project manager and will ensure project goals and constraints are met, and deliverables are complete. The contractor will work projects within the established OIG project processes and will provide input on project process improvement. At a minimum the contractor will be required to perform the following tasks in support of the objective:

Task 1 – Plans, directs, and coordinates activities of IT projects to ensure that established milestones are accomplished on time, within prescribed funding parameters, and in accordance with client business objectives.

Task 2 – Conducts analytical studies and reports project metrics and status to include but not limited to using, earned value calculations, cost benefit analysis, performance charts and quantitative risk assessments.

Task 3 – Provides all necessary documents and plans to include but not limited to project proposals, project charters, scheduling plans, quality control plans, communication management plans, and project closing documents.

Task 4 – Develops and maintains effective stakeholder relationships, working with stakeholders to understand and manage projects.

2.4.1 Performance Standards and Acceptable Quality Levels (Objective 4)

The following applies to Objective 4:

PS1 – Meet established project milestones 95% of the time.

AQL1 – Acceptable deviation is meeting established project milestones at minimum 90% of the time. However, this deviation shall not occur more than twice per quarter for each task order.

PS2 – Maintain all project documentation to OIG standards.

AQL2 – Maintain project documentation to OIG standards 95% of the time.

PS3 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL3 – No Deviation.

2.5 Technical Writing (Objective 5): The Contractor shall manage and produce technical documentation and guidelines based on Federal and DOD policies, and industry best practices. At a minimum the contractor will be required to perform the following tasks in support of the objective:

Task 1 – Produce concise and effective documentation. including but not limited to OIG business correspondence, online content, proposals, instruction manuals, design specifications, how-to guides, service catalogs, service level agreements, and “run books” that document the processes and procedures for providing IT services to the OIG.

Task 2 – Coordinate, consolidate and route responses to business documents such as strategic plans, action plans, policies, and procedures routed to OCIO management for evaluation, resolution, and final approval.

Task 3 – Edit OCIO documents and guidelines considering style, grammar, purpose, and audience in accordance with DoD Plain Language standards as defined in http://www.dtic.mil/whs/directives/plainlanguage.html.

Task 4 – Provide recommendations to OCIO management to improve the readability and usability of documents by shaping the content, tone, design, and presentation.

Task 5 – Document current work processes and procedures by writing and compiling technically accurate content utilizing various methods, including but not limited to visual diagrams.

2.5.1 Performance Standards and Acceptable Quality Levels (Objective 5)

The following applies to Objective 5:

PS1 – Meet guidelines for producing clear and technically accurate communication documentation agreed upon by both parties.

AQL1 – Meet all deadlines for documents at minimum 95% of the time. The occurrence of meeting only 95% of all deadlines shall not be more frequent than four per month for task orders 1, 2, 4, and 5.

PS2 – Ensure all business documents are routed for comment or approval in a timely manner.

AQL2 – Meet all deadlines for routing documents at a minimum 95% of the time. The contractor performance shall not fall below 95% or miss 5% of the established deadlines associated with each correspondence assignment for task 2.

PS3 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days http://www.dtic.mil/whs/directives/plainlanguage.html

AQL3 – No Deviation.

2.6 Business Case and Requirement Analysis (Objective 6): The contractor shall gather, document, and validate the OIG IT requirements. Working with the OIG component, the contractor shall document functional and non-functional requirements and business case. At a minimum the contractor will be

Task 1 – Conduct IT requirements collection for projects and processes.

Task 2 – Collect and document functional and non-functional requirements from OIG stakeholders and coordinates project development with the PMO.

Task 3 – Maintain process documentation, manage, and recommend improvements to the requirement collection process. Ensure process integration with the IT and OIG project processes.

Task 4 – Work with OIG components to document and validate business case for IT requirements.

Task 5 – Conduct cost benefit analysis for agency IT requirements.

Task 6 – Work with the OCIO Enterprise Architect and PMO to ensure requirement packages are complete. Present packages to the applicable working group/board.

Task 7 – Coordinate and communicate with the OCIO and OIG PMO offices to ensure visibility on current and upcoming IT requirements and requirement/business case analyst work products.

2.6.1 Performance Standards and Acceptable Quality Levels (Objective 6)

The following applies to Objective 6:

PS1 – Contact OIG requirement requestor and initialize the requirement process within three

(3) business days of request.

AQL1 – A deviation from the standard is allowed to exceed three (3) days, but not more than seven (7) days. This deviation shall not occur more than three (3) times per task order.

PS2 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL2 – No Deviation.

2.7 Records and Information Management (Objective 7): The contractor shall provide onsite professional support to help organize, maintain, use, retrieve and control electronic records and information created within an unclassified (NIPRNet) and classified (SIPRNet) environment as a result of OIG business activities, and transactions. All tasks shall be performed using federal best practices, following established guidelines, and complying with federal, DoD, and OIG policy, At a minimum the contractor will be required to perform the following tasks in support of the objective:

2.7.1 SCLIN 1 – (Library Science and Information Support) The Contractor shall provide library science, records management support, and information management support, including organizing and searching for information on the DoD OIG unclassified (NIPRNet) and classified (SIPRNet and JWICS) networks. Library Science activities performed by the contractor shall include, but are not limited to the following:

Task 1 - Contractor shall provide support for the classification, indexing, categorizing, controlled vocabulary, and development of taxonomies for legacy and current electronic information and its metadata to maintain the integrity of the organization’s electronic archive and ensure related records are linked, retrievable, and meet all compliance requirements.

Task 2 - The Contractor shall identify, document, and provide input to RIM management to improve the quality of the program relating to organizing and continuously identifying information as records, retrieving, preserving, and disposing records in accordance with Federal laws, regulations, and DoD policies.

Task 3 - The Contractor shall provide support for specific requests for information by searching, locating, retrieving, and delivering records and information by following established procedures and security protocols that protect the integrity and confidentiality of information.

Task 4 - Provide support for documenting and preserving metadata that explains how electronic records were created, used, and managed.

Task 5 - Assist in the appraisal and analysis of information for retention and records scheduling purposes.

Task 6 - Perform assigned tasks supporting the implementation and maintenance of the agency’s the Electronic Archives and Records Management System (EARMS).

Task 7 - Provide support for organizing, normalizing, and cleanup of duplicates and redundant obsolete and trivial files found within shared-drives and Microsoft SharePoint sites.

Task 8 - Provide the OIG with recommendations to support reduction of paper records and promote practical solutions for generating electronic records vice paper records.

2.7.2 SCLIN 2 – (Program Management Support) The Contractor shall provide assistance for program oversight, support for managing OIG records and information electronically, and support for managing various tasks relating to administering an electronic archive and records management system used to manage OIG information.

Task 1 - The Contractor shall provide program management support to include but not limited to administrative support, status reporting, team facilitation, performance tracking, and administrative oversight of work activities.

Task 2 - The contractor shall attend meetings as required to support office and operation functions and provide deliverables to include but not limited to work plans, products and documentation supporting the RIM Division.

Task 3 – The Contractor shall monitor risk and project activities and track status of the EARMS deployment, maintenance, and execution.

Task 4 – The Contractor shall assist with executing and maintaining a communications strategy targeting senior leadership and internal organizations.

Task 5 - Maintain existing and when required create new SOPs in support of this objective.

2.7.4 Performance Standards and Acceptable Quality Levels (Objective 7)

The following applies to Objective 7:

PS1 – Meet established project milestones 95% of the time.

AQL1 – Meet agreed upon deadlines for Records and Information Management 90% of the time. This deviation can occur no more than eight (8) times per each task order.

PS2 – Maintain all program documentation to OIG standards

AQL2 – Meet established deadlines for program management support 90% of the time. This deviation can occur no more than three (3) times per month for each task order.

PS3 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL3 – No Deviation.

2.8 IT Training Support (Objective 8): The contractor shall provide IT training support to technical and non-technical staff on the use and management of IT systems and processes. Provide recommendations for areas of training and introduce new training methods based on industry standards and best practices.

Historical training metrics are available in Appendix 3. At a minimum the contractor will be required to perform the following tasks in support of the objective:

Task 1 – Provide technical instruction in formal classroom and offsite workshop settings to both technical and non-technical personnel.

Task 2 – Fully utilize available technology to include but not limited to VTC, virtual, and instructional videos to provide IT training.

Task 3 – Use all available data (e.g. tickets, projects, incidents) to proactively develop a training curriculum.

Task 4 – Research and prepare IT training courses and curriculum based on OIG software, systems, processes, procedures, and mission need.

Task 5 – Assist the OCIO PMO with the creation, development, and implementation of training plans in support of IT projects.

Task 6 – Research and prepare instructional materials to include IT hardware required to support IT training courses and curriculum.

Task 7 – Conduct post training surveys for each course and provide results within five (5) working days after completion of the training to the COR.

Task 8 – Course requirements shall include, but are not limited to:

• OIG IT processes and procedures

• SharePoint

• IT ticket and tracking systems

• End-user training for Microsoft Windows (multiple versions)

• Microsoft Office suite

• OIG custom business applications

• Records Information Management

2.8.1 Performance Standards and Acceptable Quality Levels (Objective 8)

The following applies to Objective 8:

PS1 – Meet agreed upon deadlines for course development.

AQL1 – The acceptable deviation is to miss deadlines is no more than twice (2) per task order.

PS2 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL2 – No Deviation.

2.9 Systems Engineering (Objective 9): The contractor shall provide expertise in the design, implementation, configuration, and optimization of OIG IT systems on the Unclassified (NIPRNet) and Classified (SIPRNet) networks. The contractor shall have the ability to apply technical knowledge of networks, operating systems, applications, and utilities to the OIG environment. Evaluate and determine computing resource requirements for ongoing and future OIG projects. Support will include but is not limited to the systems listed in Appendix-1. At a minimum the contractor will be required to perform the following tasks in support of the objective:

2.9.1 SCLIN 1 – (Systems Engineer)

Task 1 – Engineer, design, install, configure, and optimize IT systems.

Task 2 – Provide system and engineering support for documented and approved projects and tasks.

Task 3 – Ensure all engineered solutions are in compliance with DISA STIGs, DoD and OIG policies and standards.

Task 4 – Ensure engineered solutions are designed to maintain highest availability and service dependability.

Task 5 – Maintain existing and, as required, develop new documentation that will include but is not limited to SOPs and System Architecture Guides and Diagrams adhering to organizational templates, policies, and standards.

Task 6 – Perform root cause analysis of critical outage and incidents, engineer permanent solutions, and coordinate implementation.

Task 7 – Support the OIG PMO and EA during requirement analysis to develop technical solution options.

Task 8 – Provide OIG management proposed configurations, optimizations, and system improvement plans.

Task 9 – Work with the OIG PMO to establish and meet project milestones and deliverables.

Ensure all solutions meet documented customer requirements and are within project scope.

Task 10 – Follow all OIG Change Management and Engineering Review processes. Ensure changes are completed according to the project and/or release manager schedule.

Task 11 – Work as part of a project team to engineer and develop migration plans for existing services ensuring minimal service interruption.

Task 12 – Engineer and design hardware solutions as required to ensure capacity and availability of OIG services.

Task 13 – Engineer, install, configure, optimize, support and design solutions that incorporate DoD security requirements such as Public Key Infrastructure (PKI) and Host Based Security System (HBSS).

Task 14 – Perform duties as a Project Lead. Develop task lists, assist the OCIO PMO with project documentation, maintain project status in the OIG automated project tracking system, and ensure milestones are identified and met.

Task 15 - Meet OIG established service level metrics (Section 3.12).

2.9.2 SCLIN 2 – (Virtualization Platforms) Perform all tasks identified in Objective 9, SCLIN 1 for virtualization platforms. Support will include but is not limited to the virtualization systems listed in Appendix 1. At a minimum the contractor will be required to perform the following tasks in

Task 1 – V-Motion, Storage V-Motion and Network/Storage IO Control.

Task 2 – Port groups, VLAN networking and NIC teaming on VMware.

Task 3 – VMware Site Recovery Manager (SRM) for maintaining business continuity and performing disaster recovery (DR) activity.

Task 4 – Creation, Management and Configuration of Virtual Machines, Clone and Templates.

Task 5 – Snapshot manager and restoring of snapshots.

Task 6 – Installation, Configuration and Administration of VMware.

2.9.3 SCLIN 3 – (JWICS) Perform all tasks identified in Objective 9, SCLIN 2 for the TOP SECRET/SCI (JWICS) network.

2.9.4 SCLIN 4 – (Email Systems) Perform all tasks identified in Objective 9, SCLIN 1 for electronic mail (email). Supported systems include but are not limited to Microsoft Exchange and Skype for Business.

2.9.5 SCLIN 5 – (JWICS) Perform all tasks identified in Objective 9, SCLIN 4 for the TOP

2.9.6 SCLIN 6 – (Directory Services) Perform all tasks identified in Objective 9, SCLIN 1 for directory services. Supported systems include but are not limited to Microsoft Active Directory. At a minimum the contractor will be required to perform the following tasks in support of the objective:

Task 1 – Develop organizational units in Active Directory (AD) and managed user security with group policies.

Task 2 – Create Group Policy Objects (GPOs).

2.9.7 SCLIN 7 – (JWICS) Perform all tasks identified in Objective 9, SCLIN 6 for the TOP

2.9.8 SCLIN 8 – (Windows Server OS) Perform all tasks identified in Objective 9, SCLIN 1 for Windows Server operating systems.

2.9.9 SCLIN 9 – (JWICS) Perform all tasks identified in Objective 9, SCLIN 8 for the TOP

2.9.10 SCLIN 10 – (SharePoint & Project Server) Perform all tasks in Objective 9, SCLIN 1 for

Microsoft SharePoint and Project Server.

2.9.11 SCLIN 11 – (Microsoft Dynamics CRM) Perform all tasks in Objective 9, SCLIN 1 for Microsoft

Dynamics CRM.

2.9.12 SCLIN 12 – (VOIP) Perform all tasks in Objective 9, SCLIN 1 for Voice over IP (VOIP).

2.9.13 SCLIN 13 – (Networking devices) Perform all tasks in Objective 9, SCLIN 1 for Networking that includes but not limited to networking devices listed Appendix 1.

2.9.14 SCLIN 14 – (VTC) Perform all tasks in Objective 9, SCLIN 1 for Video Teleconferencing (VTC).

2.9.15 SCLIN 15 – (Mobility Solutions) Perform all tasks in Objective 9, SCLIN 1 for Mobility

Solutions.

2.9.16 SCLIN 16 – (SAS) Perform all tasks in Objective 9, SCLIN 1 for SAS.

2.9.17 Performance Standards and Acceptable Quality Levels (Objective 9)

The following applies to Objective 9:

PS1 – Meet established project milestones 95% of the time.

AQL1 – Acceptable deviation is meeting established project milestones at minimum 90% of the time. However, this deviation shall not occur more than six (6) times per task order.

PS2 – Maintain project documentation to DoD Plain Language standards as defined at http://www.dtic.mil/whs/directives/plainlanguage.html.

AQL2 – Not meeting standards shall occur no more than eight (8) times for each task order.

PS3 – Mitigate/remediate 100% of all system vulnerabilities rated as Critical findings as determined by the DoD standard vulnerability scanner within 7 calendar days of being discovered.

AQL3 – No deviation.

PS4 – Mitigate/remediate 100% of all system vulnerabilities rated as High findings as determined by the DoD standard vulnerability scanner within 21 calendar days of being discovered.

AQL4 – No deviation.

PS5 – Mitigate/remediate 100% of all system vulnerabilities rated as Medium/Low as determined by the DoD standard vulnerability scanner within 90 days of being identified.

AQL5 – Acceptable deviation is to Mitigate/remediate 80% of all system vulnerabilities rated Medium/Low within 90 days of being identified, with the remaining 20% mitigated/remediated within 180 days of being identified.

PS6 – Meet OIG service level agreement metrics (Section 3.12) associated with this objective.

AQL6 – Service level agreement metrics shall not be missed more than 6 times during a 1-month period.

PS7 – Ensure all engineered solutions are in compliance with DISA STIGS.

AQL7 – No deviation.

PS8 – Each position is a CLIN/SCLIN. All positions (CLIN/SCLIN) under this objective shall be staffed no later than 10 calendar days from the effective date of each task order.

Funded positions (CLINS/SCLINS) shall not remain vacant for longer than 10 calendar days due to such things as turnover or any other factor which may occur after a task order is issued.

AQL8 – No Deviation.

2.10 Software Development (Objective 10): The contractor shall provide a full range of application development support, through all phases of the software development lifecycle. The contractor shall provide software development, programming, configuration, and customization support for customer technical issues and requests. Design, code, and test new applications. Enhance existing systems by analyzing business objectives, preparing an action plan, and identifying areas for modification and improvement. Maintain existing software systems by identifying and correcting software defects. All software and code created under this task is the sole property of the DoD OIG. Supported languages include but are not limited to ASP.NET, SQL, HTML, CSS, JavaScript, and C#. At minimum the contractor will be required to perform the following tasks in support of the objective:

2.10.1 SCLIN 1 – (Software Development)

Task 1 – Support will involve the utilization of established development tools, guidelines and conventions including but not limited to ASP.NET, SQL Server, HTML, CSS, JavaScript, and C #.NET.

Task 2 – Modify, develop, write and implement software programming applications and components.

Task 3 – Coordinate with user interface designers to develop site architecture.

Task 4 – Create client side applications and web sites that meet customer requirements.

2.10.2 SCLIN 2 – (Dynamics CRM Development) Perform all tasks in SCLIN 1 of Objective 10 for

Microsoft Dynamics CRM support. At a minimum the contractor will be required to perform the following tasks in support of the objective:

Task 1 – Provide Microsoft Dynamics CRM support for but not limited to the following versions of Microsoft Dynamics CRM, version 4.0, 2011 and 2015.

Task 2 – Install and support services for Microsoft Dynamics software.

Task 3 – Implement software and hardware components for Microsoft Dynamics CRM.

Task 4 – Conduct customization and migration of Dynamics CRM applications and latest system upgrades.

Task 5 – Develop and enhance user interfaces and custom web applications through the use of JavaScript, C# and other…