J-03 FS3i_Common_Services-TO-PWS-v16_01022026.docx

UNCLASSIFIED

UNCLASSIFIED

PERFORMANCE WORK STATEMENT (DRAFT)

For

Foundation Sustainment Support, Software and Integration (FS3i)

Software COTS Procurement and Common Services Task Order

12/11/2025

Table of Contents

1 (U) Purpose

(U) The Foundation Sustainment Support, Software and Integration (FS3i) Task-Order # 1 (TO-1) is outlining the requirements for a consolidated approach to provide common IT services in support of the Mapping, Charting Geodesy (MC&G) mission, through the creation of TO-1under the FS3i base contract. The Contractor under this TO will work in coordination with the FS3i Government PMO to liaise across the MC&G mission areas to provide IT services such as Program Management, Cloud management, Cybersecurity Management, Enterprise Architecture compliance management, Configuration Management to support other task orders executed under this contract.

(U) The goal of the Common IT Services is to complement other task orders on the FS3i program and support the seamless integration of activities across multiple Foundation GEOINT (FG) domains and Dissemination activities. Furthermore, the program manager, a key personnel member, under this TO-1 will be overseeing the FS3i Program and responsible for reporting and communication to the Government Program Management Office (GPMO).

2 (U) Scope

(U) The TO-1 is intended to improve interoperability and efficiency between Source Foundation (SF) domains, Source Dissemination (ST) capabilities and NGA enterprise services, the Contractor personnel supporting the Common IT services will lead and facilitate communication, collaboration and prevent disruption of activities and services in support of the broader MC&G mission, and at the same time, maintains NGA enterprise compliance requirements.

(U) This contract requires the Contractor to provide a Contractor led governance structure to harmonize and coordinate activities, processes, and procedures across all task-orders under FS3i. As an example, Cloud Management Services in TO-1 is responsible for providing overall Cloud management processes that are executed across all FS3i task-orders. This may include but is not limited to:

· Plans and processes to implement an efficient cloud enterprise, such as using the Amazon Web Services (AWS) Well Architected Framework,

· Cloud rightsizing and capacity management plan and processes,

· Instrumenting Cloud with alerts, and alarms,

· Overseeing execution of plans and processes and identifying opportunities for improvement.

(U) In addition, the Contractor will meet the requirements for sustainment of the Foundation GEOINT Enterprise Systems listed in Section 6 below.

(U) The Contractor will have the capability to deliver the services in the Base Indefinite Delivery, Indefinite Quantity (IDIQ) Performance Work Statement (PWS) as shown in figure 1.1 below. This includes WBS 1.0 Software Development, WBS 2.0 Integration, WBS 3.0 Software Maintenance, WBS 4.0 Operations Support, WBS 5.0 Foundation GEOINT IT Procurement, and WBS 6.0 Foundation GEOINT Enterprise Software in accordance with this TO. Figure 1.1 below shows services that are included in this TO.

Figure 1.1: (U) Common Services FS3i Work Breakdown Structure

(U) This TO-1 contains the requirements for the following systems, processes, and capabilities:

1. FS3i Contract Program Management Services,

2. FS3i Help Desk Services,

3. FS3i Cloud Management Services,

4. FS3i Cyber Security Lead,

5. FS3i Configuration Management Services,

6. FS3i Solution Architecture Services,

7. COTS HW/SW Procurement Requirements,

8. Foundation GEOINT Enterprise Systems (FGES).

2.1 (U) Current Environment and Constraints

(U) The Contractor will comply to and adhere with all Base IDIQ PWS Section 4 “Current Environment and Constraints”.

(U) The Contractor will adhere with the NGA standards, processes, and procedures including but not limited to:

· The IPF Capability Delivery SOP

· SAM’s current or future requirements, policies, and procedures – NGAI 8410.2 – Software Asset Management,

· IPF Software Solution Stack Standard

· All NGA produced compliance documents listed below under “Applicable Documents” heading.

· Foundation GEOINT in compliance with the NGA Software Way,

· NGA Technology Strategy, and the NGA Acquisition Design Elements (ADEs),

· The Contractor will use the NGA CORE services and capabilities to the greatest degree feasible, given considerations for cost, schedule, and performance.

(U) The Contractor will coordinate, leverage, integrate with and adhere to existing NGA Enterprise IT Services such as Service Plus, Jira, Confluence, Microsoft SharePoint and Teams, as well as the SAM Software Requirements & Workflow (SRW) tool.

3 (U) FS3i Contract Program Management Services

(U) The Government intent is for the Contractor to provide Program Management Services for the overall FS3i Contract and coordinate the execution of all FS3i Task Orders.

(U) Program Management Services will oversee the successful delivery of the requirements under FS3i contract and facilitates:

· Program coordination and resource sharing,

· Compliance with regulations and Program Governance,

· Delivery of capabilities under FS3i contract that meets the Government cost and quality requirements,

· More efficient delivery of capabilities under FS3i contract, by identifying and managing interdependencies between projects,

· Institutionalizing the culture of continuous improvement in delivery of services.

(U) The Contractor will provide Program Management Services to ensure the successful delivery of all the capabilities included in the current and future FS3i task-orders.

(U) Program Management Services will meet all the requirements outlined in table 3.1 for current and future task-orders under FS3i contract.

(U) The Contractor will provide Program Management Services for Common Services Task Order.

(U) The Contractor will adhere to all requirements identified in this PWS. Modifications to this PWS and associated addendums must be approved by the GPMO and the Contracting Office (OCS).

(U) This Table is Unclassified in its entirety.

The Contractor will provide Program Management for the overall FS3i contract, and for this Common Services Task Order specifically.

The Contractor will arrange and host a task order kick-off meeting within 15 business days of award.

The Contractor kicks off meeting presentation will include the following content: (CDRL A025)

· Review contract and program administration, deliverables, risks, and transition schedule.

· Additional topics proposed by the Government and Contractor.

The Contractor will present to the GMPO and Key Stakeholders updates that are not limited to just cost, scope, and schedule in the performance of the FS3i contract. If risks were to occur, the Contractor will present mitigation strategies within five (5) business days.

The Contractor provides a monthly Task Order Program Management Review (PMR) (CDRL A023) for the Government and Government designated personnel.

In addition to the requirements stated in (CDRL A023) the Contractor will provide the following information during the PMR.

1. State of Cloud right sizing and cost savings

2. State of Cloud storage usage, storage clean up and cost savings.

3. Number of critical INCs and their resolution times

4. Open critical INCs, their risk assessments, and estimated resolution times.

5. The state of software expiration date if they are less than 6 months, the state of software license End-of-Support (EOS) if it occurs in less than 9 months, and the state of software license End-Of-Life (EOL) if it occurs less than 9 months.

The Contractor will hold TEMs, facilitate capturing requirements, and be responsive in delivering proposals in support of the most efficient RFP process.

The Contractor will host reviews and update the required CDRLs NLT 30 days after award for the following:

· Program Management Plan (CDRL A001)

· Contract Funds Status Report (CDRL A002)

· Risk Management Plan (CDRL A014)

· Quality Control Plan (CDRL A015)

· Program Management Review (CDRL A023)

· Risk / Issue / Opportunity Register (CDRL A036)

· Stakeholder Communication Plan (CDRL A047)

The Contractor will adhere to all Program Management requirements in accordance with FS3i Base IDIQ PWS section 7.2.

Key personnel will be leveraged from TO-1 for all task orders under FS3i contract.

Government requires the Contractor provide three Key personnel for FS3i contract with the following skills:

· FS3i Program Manager,

· Operations Manager,

· Cyber Security Lead.

Appendix D contains job descriptions and job qualifications for the key personnel.

The Contractor will manage all Contractor Acquired Property under this contract in accordance with the FS3i Base IDIQ PWS section 7.4.

The Contractor will complete such evidence and documents as required to comply with NGA equipment and property management directives and policies in accordance with the FS3i Base IDIQ PWS section 7.4.

The Contractor will provide an FS3i security plan (CDRL A005)

Table 3.1: (U) Program Management requirements. This Table is Unclassified in its entirety.

4 (U) FS3i Contract Common Requirements

(U) The requirements in table 4.1 below are allocated to the entire FS3i Contract. These capabilities will be provided as Common Services to the entirety of all Task Orders under the FS3i contract. These services are:

4.1 (U) FS3i Help Desk Services

(U) The Contractor will provide the FS3i Help Desk that will perform as the single point of entry for FS3i-related trouble tickets. The FS3i Help Desk will act as the coordinator between the NGA Help Desk / other organization Help Desks, and the underlying FS3i Task Order Tier 2 and Tier 3 Help Desks. This hierarchy is shown in Figure 4.1.

(U) The FS3i Help Desk will provide the relevant services as defined in Table 4.1. The FS3i Help Desk will collect and report on service ticket-related metrics, such as, but not limited to, response time, time to correct, number of tickets, tickets assigned to which task order, and status of tickets pushed up to the NGA or other help desks.

Figure 4.1 – (U) Help Desk Hierarchy

(U) The Contractor will provide an FS3i Help Desk reporting process that includes but is not limited to:

(U) Key Performance Indicators (KPIs)

a. First Response Time (FRT)/Average Speed to Answer: How quickly users get the first reply.

b. Resolution Time/Mean Time to Resolution (MTTR): Total time from ticket opening to closing.

c. First Contact Resolution (FCR) Rate: Percentage of issues solved in the first interaction.

d. Customer Satisfaction (CSAT): Direct feedback on satisfaction with support.

e. Ticket Volume: Total incoming requests, often broken down by channel (phone, chat, email).

f. Ticket Backlog: Number of open, unresolved tickets.

g. SLA Compliance: Meeting agreed-upon service level targets.

(U) Efficiency & Operational Metrics

a. Average Handle Time (AHT): Time spent on a single interaction (talk time + hold time + wrap-up).

b. Agent Utilization Rate: Percentage of time agents spend on productive work.

c. Escalation Rate: How often tickets get moved to higher support tiers.

d. Transfer Rate: How often tickets are transferred between agents or teams.

(U) User Experience Metrics

a. Customer Effort Score (CES): How much effort a user had to exert to get their issue resolved.

b. Net Promoter Score (NPS): Likelihood of users recommending your service.

4.2 (U) FS3i Cloud Management Services

(U) The Contractor will provide FS3i Cloud Management plans, processes, and procedures that coordinate cloud management across all FS3i task-orders. This may include but is not limited to:

· Plans and processes to implement an efficient and secure Cloud enterprise, such as using the AWS Well Architected Framework.

· Cloud rightsizing and capacity management plan and processes,

· Storage monitoring and cleanup process,

· Instrumenting Cloud with alerts, and alarms,

· Automation plan and approach to automate Cloud provisioning, monitoring and self-healing.

· Optimizing the automation of Continuous Integration and Continues deployment (CI/CD) processes,

· Overseeing execution of plans and processes and identifying opportunities for improvement.

· Adhere to DoW and NGA’s Cloud security processes and controls.

(U) The Contractor will establish and institutionalize a Cloud monitoring process (CDRL A008, A037) that is followed by all FS3i task-orders. This includes but is not limited to:

· Monitoring Cloud resources and applications, providing insights and alerts for automation,

· Facilitating event-driven automation by routing events between different AWS services.

(U) The Contractor will provide Cloud automations supporting the use of various Cloud services and tools to automate tasks and processes related to infrastructure provisioning, configuration, deployment, and management. The outcome of ongoing Contractor’s efforts includes but is not limited to:

· Improving Security: Follow and meet the DoW and NGA security standards and processes, in addition to exercising Cloud security best practices,

· Improving efficiency and Speed: Faster deployments, resource provisioning, infrastructure changes, speeding time-to-field, and reducing operational overhead,

· Increasing consistency and repeatability: Ensuring that infrastructure and applications are set up and deployed consistently, reducing the risk of configuration drift and errors.

· Institutionalizing scalability and agility: Facilitating the scaling of infrastructure and applications to meet fluctuating demands and adapting to changing business needs.

· Establishing a cost optimizing culture: Continuously optimize the cost, leveraging the Cloud automation capabilities to right-size the Cloud services, architecting the Cloud infrastructure with the cost in mind.

(U) The Contractor will establish an automation plan and processes that are followed by all FS3i Task-Orders. This includes but is not limited to:

· Automation of security tasks (e.g., deploying security patches) reducing the risk of vulnerabilities,

· Use AI, machine learning, and automation to provide self-healing capability to automatically predict, detect, fix, and respond to operational problems,

· Leveraging Cloud services and tools to automate remediation of common failure scenarios, like restarting services or scaling resources,

· Leveraging Cloud services and tools to predict potential failures and proactively implement corrective actions,

· Automation of some database functions such as fixing corrupted databases or optimizing database queries.

(U) The Contractor will provide a Cloud status report for Program Management Review (PMR) that outlines the Cloud optimization, right sizing, and cost savings.

4.3 (U) FS3i Cyber Security Lead

(U) The Contractor will provide an FS3i Cyber Security Lead function. The FS3i Cyber Security Lead will provide overall FS3i contract cyber security guidance, policy, procedures and standard practices that apply across all FS3i Task Orders.

(U) The Contractor will coordinate, manage, and implement NGA and higher-level directed Cyber Security tasking that impact across all FS3i Task-Orders.

(U) The Contractor will ensure all FS3i Task Orders adhere to the Security requirements outlined in the latest version of the NGA Acquisition Design Elements (ADEs).

4.4 (U) FS3i Configuration Management Services

(U) The Contractor will manage, coordinate, and support a common configuration management process across all FS3i Task-Orders.

(U) the Contractor will provide a Configuration Management plan that includes Configuration Management Processes and procedures for all FS3i Task-Orders (CDRL A013).

(U) The Contractor will establish and institutionalize configuration management best practices, and follow DoW, and NGA configuration management standards, processes, and controls.

(U) The Contractor will provide configuration management guidance to all FS3i task-orders.

(U) The Contractor will provide an FS3i configuration management plan. The plan should include:

· Alignment with the NGA, Intelligence Community, and DOW configuration management policies and processes.

· The approach to manage and control IT assets and their configurations, promoting consistency, stability, and compliance through defined policies and processes.

· Automation of configuration management processes that includes but is not limited to:

· Automated discovery and identifying Configuration Items (CIs) and automatically populate a Configuration Management Database (CMDB) with information about hardware and software components.

· Managing the configuration management process by systematically identifying, tracking, and controlling changes to IT assets and their relationships to ensure a desired state and consistent performance throughout their lifecycle.

· Monitoring and auditing to ensure the accuracy, consistency, and completeness of configuration data.

(U) The Contractor will outline the steps and processes that show how the configuration management improves baselining, change management, incident management, and problem management.

(U) The Contractor will make recommendations for the scope of NGA’s CMDB, i.e., what data to stored, relationship between FS3i controlled CIs and CIs under control of other contracts and government.

(U) The Contractor will define, identify, and track the CIs under FS3i control for all FS3i Task-Orders. This may include:

· Design documents, ConOps, architecture artifacts,

· State of CIs, IOC, and FOC,

· Mapping CIs to organizations, domains (Sea, Land, AIR, etc.), systems, system components, etc.

· Tracking CIs provenance, a process to define CI, and deprecate CIs,

· Aggregation of CIs by organization, security domains, systems, system components,

· Identify CI ownership e.g., NGA.

(U) The Contractor will ensure a stable and reliable configuration management database, and processes. This includes but is not limited to:

· Well maintain CMDB.

· Automated processes, supporting robust change management, enforcing standardization, prioritizing compliance, and embracing Infrastructure as Code (IaC).

(U) The Contractor will ensure compatibility between CIs among all the contracts that support MC&G configuration management.

(U) The Contractor will provide an FS3i configuration management reporting process that includes but is not limited to:

· An easy-to-read monthly report identifying anomalies and discrepancies between operating systems, software, and software versions between development, test, and operational baseline for a given operational baseline,

· Where applicable, an easy-to-read report that shows discrepancies in configurations for the end-to-end systems that are partly under Contractor’s configuration management care,

· A risk assessment for important[footnoteRef:2] discrepancies and anomalies that the Contractor identified in the report, [2: (U) The Contractor provides ranking of configuration discrepancies and anomalies for the purpose of risk assessments. Example of ranking could be High, Medium, and Low. ]

· An integrated dashboard that provides an end-to-end view of FS3i systems, their current operational status, current discrepancies and problems outstanding, and their CIs including the ability to drill down to the components of the system and identify the CIs, discrepancies, and anomalies,

· Time span when discrepancies and anomalies existed.

(U) To support the NGA GEOINT Enterprise Architecture (GEA), the Contractor will document Service Descriptions for any developed services with the Service Description Table in format consistent with the current NGA Configuration Management (CM) baselines products.

(U) The Contractor will provide FS3i direction on NGA CORE tool adoption and usage, given considerations for cost, schedule, and performance.

(U) The Contractor will ensure all FS3i capabilities are integrated with NGA's Enterprise Monitoring tools to monitor the CMDB, and other tools supporting the configuration management.

(U) The Contractor ensure all FS3i capabilities properly account IT Assets in NGA’s CMDB. All required fields must be properly filled and updated within 90 days of location/status change.

(U) The Contractor will identify systems, devices, and applications that are not properly configured for discovery and tracking within the current enterprise configuration management tools and ensure the relevant FS3i Task Order completes the required work.

(U) The Contractor will deliver a monthly report outlining assets, i.e., software and hardware that are reaching their End-of-Service (EOS) and End-of-Life (EOL) within 9 months for the report.

4.5 (U) FS3i Solution Architecture Services

(U) The Contractor will produce an integrated FS3i solution architecture by consolidating the discrete architecture products for the capabilities that are developed under the FS3i Task Orders.

(U) The Contractor will adhere to DoW and NGA solution architecture standards and processes.

(U) The Contractor will provide overall FS3i recommendations for:

· System and capability consolidation and duplication

· New technology insertion opportunities

· Enterprise cost reduction options

· Enterprise risk and mitigation,

(U) For each solution architecture tasking, the Contractor will follow the design best practices; this may include but is not limited to:

· Developing a high-level traceability matrix mapping the solution to the requirements and use cases,

· Recommending changes to the architecture that reduces the cost of development, deployment, and maintenance and results in maximizing the Return on Investment (ROI).

· Identify opportunities for instrumenting applications or systems to provide relevant metrics and self-healing capability,

· Architecting robust monitoring and logging to track the health and performance of developed solutions,

· Designing architecture that results in a scalable, flexible, reusable, and secure solution,

· Developing an architecture that provides resiliency, failure tolerance, and failure recovery,

· Identify opportunities to modernize the existing systems under FS3i to reduce complexity, maintenance, and cost, i.e. use of Serverless architecture patterns, Event-Driven architecture, Microservices architecture etc.

(U) The Contractor will identify opportunities for modernizing the FS3i solution architecture to use modular design and Microservices, this may include but is not limited to:

· Loosely coupled, fine-grained, and deployable, services, that each service can be developed, deployed, and scaled independently, allowing for faster iteration and easier maintenance,

· Securely communicating between Microservices that meets DoW and NGA security requirements, and controls i.e., use of zero trust approach,

· Designing APIs that follow relevant GEOINT standards and have the capability to be automatically tested for standards compliance,

· Leveraging NGA’s API Developer Portal, document and register APIs on all domains where the APIs are available,

· Designing APIs that shall:

· Follow the NGA API Development guidance,

· Must meet NGA’s standard and guidance for discovery and security.

(U) The Contractor will provide an integrated dashboard / status mechanism of the FS3i enterprise’s ability to meet the System Performance requirements as defined in each of the FS3i Task Orders.

(U) The table below is Unclassified in its entirety.

FS3i

WBS#

The Contractor will meet the requirements outlined in the section 4.4 of this PWS.

The Contractor will provide metric collection and analysis services in as it relates to providing the FS3i Tier 1 Help Desk per Section 4.1.

The Contractor will collect metrics as defined in the services stated in Section 4.2. The Contractor will also provide an integrated FS3i System Status Dashboard that aggregates the individual system status reporting from the systems across all FS3i Task Orders as described in Section 4.4.

The Contractor will provide an FS3i contract Cyber Security Manager in accordance with FS3i Base IDIQ PWS section 6.28. The scope of this manager is defined as providing guidance, policy, procedures and standard practices that are common across all FS3i Task Orders.

Table 4.1: (U) List of FS3i Contract-Level Common Services Requirements This Table is Unclassified in its entirety.

5 (U) Commercial Off the Shelf COTS HW/SW Procurement Support

(U) This section outlines the requirements for the COTS HW Procurement and Software / COTs procurement support for MC&G.

(U) Per Government direction, the Contractor shall procure the Government required hardware.

5.1 (U) COTS HW/SW Procurement Support Requirements

(U) The Contractor will coordinate with GPMO and Key Stakeholders to identify MC&G software licensing requirements, ensure compliance to both SAM and NGA standards but not limited to security and accessibility standards.

(U) The Contractor will provide the necessary information to the SAM office for timely procurement of software licenses and verify they are consistent with NGA security, accessibility and sustainability standards. This includes but is not limited to:

· Following MC&G process for software procurement and meeting SAM’s office requirements for software procurement,

· Ensuring the recommended software meets all DoW, IC, and NGA security requirements, and

· Ensuring the software meets all current and future operational requirements.

(U) The Contractor will maintain a comprehensive list of software that supports each MC&G and SF programs and cross validate the list with the CMDB.

5.2 (U) SW Support Security Requirements

(U) The Contractor will ensure all security requirements of the contract are satisfied in accordance with section 7.5 and 7.6 of the FS3i Base IDIQ PWS where applicable.

(U) The Contractor will ensure the software has been Software Whitelist Assurance Process (SWAP) approved. If the Software is not on the SWAP, the Contractor will work with the requesting GPMO to obtain the required information necessary to support and obtain the SWAP approval.

(U) The Contractor will adhere to the Classified Work performance security requirements in accordance with section 7.6.1 of the FS3i Base IDIQ PWS.

(U) The Contractor will adhere to the Unclassified Work performance security requirements in accordance with section 7.6.4 of the FS3i Base IDIQ PWS.

(U) The table below is UNCLASSIFIED in its entirety.

The Contractor will prepare and record any Software Licenses deemed a risk or issue and provide to the GPMO within 24hrs.

The Contractor will adhere to automation requirements in accordance with section 6.4 of the FS3i Base IDIQ PWS.

The Contractor will use existing NGA’s Asset Management capabilities to automate software license management process.

The Contractor will establish and maintain automated license expiration detection and reporting.

The Contractor will send automated notifications tracking expiration dates nine (9) months before the expiration date.

The Contractor will notify the GPOC and the Government stakeholders about the expiration date.

· Software is the “Best-of-breed” for NGA environment,

· The software has a history of faster innovation cycles,

· Ease of integration with the infrastructure and other systems,

· Easy to customize and change its workflow or add new workflows,

· It has responsive and knowledgeable customer service and technical support,

· It has easy to read and complete diagnostics, design, and architecture documentation.

· If applicable, it will have user friendly user interfaces, and easy to install and deploy in operations.

Table 5.1: (U) List of requirements for SW Procurement Support services. This Table is Unclassified in its entirety.

6 (U) Foundation GEOINT Enterprise Systems (FGES)

(U) The FGES requirements are intended to provide services that harmonize, coordinate, operate the capabilities, processes, and procedures across all task-orders under FS3i.

(U) The Contractor will provide the services (WBS 1 through WBS 4) outlined below to meet the requirements for FGES.

· WBS 1: Software Development

· WBS 2: Integration

· WBS 3: Software Maintenance

· WBS 4: Operations Support

(U) WBS 1: The contract will provide services to develop new capabilities that did not previously exist. This does not extend, adapt or modify existing services that already perform the same function for which is covered under Adaptive, Perfective, Preventive and Corrective Maintenance (sections 6.16 through 6.19 inclusive). It may adapt existing capabilities that perform a similar function, but for a different purpose, and are reused for a new application.

(U) WBS 2: Integration is the process of integrating new/existing capabilities/services/micro-services from development and Integration efforts/Release Trains through the DevOps pipeline into operations. Note: Developers/Sustainer Release Trains may be Government and/or other non-FS3i Contractors. Already developed, operational, or commercially available hardware or software capabilities may be integrated into existing environments / architectures.

(U) WBS 3: Software Maintenance services provide four categories of maintenance. They are:

· Adaptive Maintenance

· Corrective Maintenance

· Perfective Maintenance

· Preventive Maintenance

(U) WBS 4: Operations Support service sustains the operational baseline, provides services such as performance management and engineering, etc.

(U) The Contractor will provide an Operations Support Plan (OSP) that outlines the Contractor’s approach, processes, and workflows are scale and size appropriate for operational support of FS3i (CDRL A030).

(U) The Contractor will meet the requirements for FGES capabilities, and systems. FGES capabilities and systems are:

· Citrix Shared Service

· Citrix Direct Connect

· Proxies

· License Servers

· ECDS Integration Services

· Cloud Management Services

· AWS Services

· Storage Pool

· S3 Software Artifacts (Installers)

· AWS Storage Gateway

· IAM Roles/Polices

· SSM Integration

· VDSS Integration Services

· Enhance visibility across your entire infrastructure.

· Boost operational efficiency with automation.

· Simplify node management at scale in any environment.

6.1 (U) Citrix Shared Service

(U) The Contractor will provide, where applicable, Software development, Integration, Software maintenance, and Operations support services for Citrix Shared Services as they are outlined in table 6.1 below.

(U) The Contractor will follow and meet Citrix Shared Services best practices. This includes but is not limited to:

· Securing Citrix environment based on the DoW and NGA security standards and controls,

· Securing data in transit based on the DoW and NGA security standards and security controls,

· Optimizing network bandwidth usage,

· Securing communications between Delivery Controller and License Server,

· Optimization of VDA performance,

· Collecting diagnostic and performance data (CDRL A008, A037).

6.2 (U) Citrix Direct Connect

(U) The Contractor will provide, where applicable, Software development, Integration, Software Maintenance, and Operations Support for Citrix Direct Connect as they are outlined in table 6.1 below.

(U) The Contractor will follow and meet Citrix Direct Connect best practices. This includes but is not limited to:

· Secure communications with Delivery Controller based on DoW and NGA standards and security controls,

· Secure Communication between VDA and Delivery Controller based on DoW and NGA standards and security controls,

· Secure communications between Delivery Controller and License Server based on DoW and NGA standards and security controls,

· Securing traffic between the client and the VDA based on DoW and NGA standards and security controls,

· Securing data in transit and at rest,

· Optimizing performance and minimizing latency,

· Providing metrics and performance analysis report that shows user experience and response time.

6.3 (U) Proxies

(U) The Contractor will provide Integration, Software Maintenance, and Operations Support for Proxies systems as they are outlined in table 6.1 below.

(U) The Contractor will follow and meet DoW and NGA standards and security controls for configuring, maintaining, integrating with security appliances, and managing Proxies.

6.4 (U) License Servers

(U) The Contractor will provide Integration, Software Maintenance, and Operations Support for License Servers as they are outlined in table 6.1 below.

(U) The Contractor will meet License Server security requirements based on the DoW and NGA standards and security controls.

(U) The Contractor will provide the capability to maintain and manage different types of License Servers, including but is not limited to:

· On-Premises: These servers are hosted and managed within the organization's infrastructure.

· Cloud-Based: These servers are hosted by a third-party provider and accessed remotely.

· Publisher-Specific: Some license servers are provided by software publishers to manage licensing for their products.

6.5 (U) Enterprise Cross Domain Services (ECDS) Integration Services

(U) ECDS is the existing capability to transfer data between different security domains. The software and codes that automate this data transfer considered to be ECDS Integration Services.

(U) The Contractor will provide, where applicable, Software development, Integration, Software Maintenance, and Operations Support for any code that the Contractor provisions to improve / automate the high-to- low data transfer leveraging ECDS. The requirements are outlined in Table 6.1 below.

6.6 (U) Storage Pool

(U) The Contractor will provide Integration, Software Maintenance, and Operations Support for Cloud Management Services as they are outlined in table 6.1 below.

(U) The Contractor will maintain Storage Pool and continuously reduce to cost of maintaining the Storage Pool.

(U) The Contractor will ensure the Storage pool meets the DoW and NGA security standards and security controls in all security domains.

6.7 (U) S3 Software Artifacts (Installers)

(U) The Contractor will provide sustainment for S3 buckets.

6.8 (U) Identity and Access Management (IAM) Roles/Polices

(U) The Contractor will provide IAM management for FS3i.

6.9 (U) AWS Systems Manager (SSM) Integration

(U) The Contractor will provide, integration and sustainment for SSM.

6.10 (U) Virtual Data Center Security Stack (VDSS) Integration

(U) The Contractor will provide, integration and sustainment of VDSS.

(U) Table 6.1 below outlines the requirements for section 6 “Foundation GEOINT Enterprise Systems (FGES)” of the PWS.

(U) The table below is Unclassified in its entirety.

The Contractor will provide the format for capturing and presenting the backlog. At the minimum the backlog should contain:

· Description of backlog item and its relation and dependencies to other backlog items.

· Government assigned priority of the backlog.

· The Contractor’s estimates Level of Effort (LOE) needed to deliver the backlog.

· The Contractor’s estimated date when the backlog item is completed and delivered.

· The main Government stakeholders of the backlog items.

· Where applicable, the Contractor provides drawings and explanations for the backlog and its solution.

· The Contactor provides risk and mitigation for each backlog including any explanation for any obstacle in meeting the backlog requirements.

· The Contractor will provide any cyber security concerns.

The Contractor will provide software documentations that help users understand and use the software effectively. This includes but is not limited to:

· Instruction manual - That provide step-by-step instructions for common tasks and that describe the features and capabilities of the software.

· Reference manuals: That provide detailed technical information about the software, such as its API, Microservices, software components, data structures, and algorithms.

· Installation guides: That provide instructions for installing and setting up the software on different types of systems. It is also important to provide system documentation that describes the hardware and software components that make up the system, as well as the interactions between those components (CDRL A011).

The Contractor will meet the requirements for solution architecture outlined in section 4.5 of this PWS.

The Contractor will provide Configuration Management services, including SW/HW in accordance with section 6.3 of the FS3i Base IDIQ PWS.

The Contractor will meet the Configuration Management requirements stated in the section 4.4 of this PWS.

Contractor will meet requirements stated in CDRL A039 - Automation Deployment Instructions.

The Contractor will provide release management services in accordance with section 6.5 of the FS3i Base IDIQ PWS.

The Contractor will collaborate with the Operations Support Contractor and provide input into the Release Plan in accordance with CDRL A021. The Release Plan is updated before each Release Planning Event (RPE).

The Contractor will coordinate release planning events with all Government and Contractor stakeholders.

The Contractor will provide the format for capturing and presenting the backlog. At the minimum the backlog should contain:

· Description of backlog item and its relation and dependencies to other backlog items.

· Government assigned priority of the backlog.

· The Contractor’s estimates Level of Effort (LOE) needed to deliver the backlog.

· The Contractor’s estimated date when the backlog item is completed and delivered.

· The main Government stakeholders of the backlog items.

· Where applicable, the Contractor provides drawings and explanations for the backlog and its solution.

· The Contactor provides risk and mitigation for each backlog including any explanation for any obstacle in meeting the backlog requirements.

The Contractor will deliver an Integration Management Plan (CDRL A031) that includes an Integration Readiness Review Checklist (IRRC), The final data-deliverable Integration Package and the Sub-system Integration Plan (SIP) (in the formats that are described in the Technical Library), include criteria for passing the operational readiness review.

· The Integration Package is comprised of relevant documents described in the Technical Library document list in Appendix E along with a completed Integration Readiness Review checklist as described in the Integration Management Plan (CDRL A031).

· The Sub-system Integration Plan (SIP) is comprised of a Work Breakdown Structure (WBS) with associated cost (CDRL A035) that aligns with the Capability Integration Schedule (CDRL A034) and a Requirements Traceability Matrix (RTM) (CDRL A033) that corresponds to the Risk/Issues/Opportunity Register (RIOR) (CDRL A036).

The Contractor will organize and facilitate a government Integration Readiness Review and invite all relevant attendees to address.

The Contractor will establish and institutionalize CSI processes and procedures.

The Contractor will outline the CSI accomplishments in each Program Management Review (PMR) meetings.

CDRL A042 - Continual Service Improvement (CSI)/Business Process Reengineering (BPR)

CDRL A043 - Request for Change (RFC) Management Impact Assessment.

The Contractor will adhere to the DevSecOps Management services in accordance with section 6.11 of the FS3i Base IDIQ PWS.

The Contractor will provision and maintain environments on each security domains for development efforts as defined by the Government.

The Contractor will lead and provide expertise during testing and deployment of GOTS, COTS, FOSS, and new or changed software to the EM operational baselines.

The Contractor will perform integration services on all security domains as required.

The Contractor will execute all integration tasking required for delivery of new/updated software baselines from one environment to the next to expose the capabilities/services to the users for testing and deployment into operations.

The Contractor will perform the required integration tasks for development as outlined in the deployment instructions as defined in IPF Capability Delivery SOP.

The Contractor will ensure integration activities meet program and product owner requirements.

The Contractor will provide updates into the configuration management system about the hardware and software changes to the operational baseline because of the Contractor’s actions.

The Contractor will update the Version Description Document for the integrated portion of the whole. (CDRL A019).

The Contractor will develop in, cooperation with the Government, an Integrated Testing process and associated plans, events, procedures, and checklists scaled appropriate to the baseline. Deliver an integration Test Readiness Review checklist (CDRL A027).

The Contractor will develop scenarios and checklist in support of Government-managed Independent Verification and Validation (IV&V) events.

The Contractor’s scenarios will track traceability from high-level requirements (from its origins), through its development and specification, to its subsequent testing scenarios, and through all periods of on-going refinement and iteration in any of these phases.

The Contractor will produce an Integration Test Report that includes traceability of software functions to the requirements, number of passed and failed, and a brief description of reasons for the failures.

CDRL A044 - Integration Test Report

The Contractor will use the Government directed Knowledge Management process in accordance with section 6.15 of the FS3i Base IDIQ PWS.

The Contractor will provide input and track DRs, and Root cause in the Knowledge Management system.

The Contractor provides the Performance Metrics as they are listed in Appendix B of this task order.

The Contractor will adhere to the Metric Collection and Analysis requirements in accordance with section 6.27 of the FS3i Base IDIQ PWS.

The Contractor provides the capability to collect costs, operational and performance metrics for sub-systems, sub-system components (CDRL A008, A037).

The Contractor will provide performance metrics consistence with the NGA “Software Way”.

The Contractor will collect Sprint / Scrum metrics in accordance with the metrics stated in the IPF Capability Delivery SOP[footnoteRef:3]. [3: (U) Foundation GEOINT Capability Delivery Standard Operating Procedure (SOP)

The Contractor will adhere to the…