DSCA PWS GlobalNet Ops and Sus_Draft.pdf

PERFORMANCE WORK STATEMENT (PWS)

Defense Security Cooperation Agency (DSCA)

GlobalNET Operation & Sustainment

November 2024

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide GlobalNET Operation & Sustainment support. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform GlobalNET Operation & Sustainment as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: DSCA’s Office of Business Operations (OBO) Information Management and Technology (IM&T) manages a portfolio of Information Technology (IT) mission systems and services to enable the DSCA’s mission. The Defense Security Cooperation University’s (DSCU) mission is to meet the current and future global security cooperation (SC) mission through education, training, research, and workforce analysis. These efforts help develop an agile, certified, and experienced SC workforce.

DSCU provides the Department of Defense (DoD) Regional Centers (RCs) a centrally managed Information System (IS) named GlobalNET which facilitates student and alumni education and training. GlobalNET supports the mission of the Regional Center Enterprise (RCE) by providing DoD and mission partners with secure community spaces and collaborative tools to educate, connect, and empower partners to help them reach their mission goals. GlobalNET also allows students, alumni, and their cohorts to collaborate and network.

Currently, GlobalNET is an integration of two software applications: Drupal, which provides content management, and Ilias, which provides learning management. The integration of these applications relies on approximately fifty custom-developed modules along with standard modules from both applications. Additional functionality is achieved though the integration of EZProxy, Apache Solr, and Google Translate across both of the primary applications. The web-based platform is hosted in a Federal Risk and Authorization Management Program (FedRAMP) compliant facility. The hosting platform stack includes Red Hat Enterprise Linux, Apache Web Server, Relational

Database Server (RDS) Database (MySQL), and the Hypertext Processor (PHP) language.

1.2.1 Tasks: The primary tasks for provide GlobalNET Operation & Sustainment are:

A. Project and Task Management B. Operation and Sustainment C. Support Desk

1.2.2 Objectives: The objective of this requirement is to provide qualified and professional capabilities for the sustainment of the IM&T mission by operating, supporting, providing technical support for, and engaging/upgrading the GlobalNET Information System (IS).

1.3 Scope: The services will include:

IS Support Helpdesk administration

The support requested is intended to provide services for the areas shown in Part 5 below.

1.4 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and one (1) 12-month option year. The Period of Performance reads as follows:

Base Year: 26 January 2025 – 25 January 2026 Option Year 1: 26 January 2026 – 25 January 2027

1.5 General Information:

1.5.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program (QCP) is how he assures himself that the work complies with the requirement of the contract. The QCP is to be delivered within 30 days after contract award. A copy shall be submitted to the KO and COR within five (5) working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to the Quality Control (QC) system.

1.5.1.1 Inspection and Acceptance Criteria: The COR or technical representative will require up to five (5) business days from receipt of all deliverables for review and comment/acceptance. Government acceptance will be based upon the deliverables meeting accepted professional standards for technical content, workmanship, and relevance to stated functional task requirements.

1.5.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP).

This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.2.1 Identification of Non-Disclosure Requirements: The activities in this PWS will require the Contractor to receive Government Furnished Information (GFI), and access data and information proprietary to other Contractors or Government agencies and/or of such a nature that its dissemination or use, other than in performance of this PWS, would be averse to the interests of the Government and/or others. The Contractor, including Contractor personnel, subcontractors, and consultants, will not divulge or release data or information developed or obtained in performance of this PWS except to Government authorized personnel or upon written approval of the CO or COR. The Contractor will not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as required in the performance of this PWS. The limitations above do not apply to data or information that has been made public by the Government. All products, deliverables and work produced, as well as associated back-up documentation will be considered the property of the Government. The Contractors will be expected to sign Non-Disclosure Agreements (NDA) within one (1) business day of onboarding.

1.5.3 Recognized Holidays: Contractor is not required to work on federal holidays.

However, if a program occurs over a holiday period, a limited number of personnel may be needed to support a program. Prior coordination shall be made and approved between the COR and KO.

New Year’s Day Martin Luther King Jr.’s Birthday President’s Day Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

1.5.4 Hours of Operation: The contractor is responsible for conducting business between the hours of 0900 – 1530 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Contractor personnel may be required to work 630-1800 based on requirements. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.5.5 Place of Performance: The work to be performed under this contract will be executed at the Contractor’s facilities.

1.5.5.1 Telework: The Government may permit telecommuting (telework) to Contractors when determined to be in the best interest of the Government in meeting work requirements.

The contractor must identify to the COR any task/work requirements that may be performed at an alternate worksite.

The Individual Contractor Personnel shall provide services from their authorized telework worksite location IAW Department of Defense Instructions (DoDI) 1035.01 Telework Policy.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/103501p.pdf

1.5.6 Type of Contract: The government will award a Firm-Fixed Price contract.

1.5.7 Security Requirements: The overall classification of work associated with this PWS is at the SECRET level. The Contractor shall have a current facility clearance of SECRET at the time of proposal to work this effort. All personnel assigned to this contract must be U.S. citizens.

1.5.8 Special Qualifications: Within ten (10) business days of award of this contract or ten (10) days of employment, the Contractor shall ensure that all Contractor employees complete annual Government- furnished training in Information Assurance, Privacy Act, Operational Security, and other assigned training required. Any Contractor behavior deviating from standards taught in the course shall be grounds for termination of the contract. Contractor must maintain a cyber-threat security awareness certification plan.

The Contractor is expected to provide a fully trained workforce to the Government;

therefore, personal development training costs and hours are not billable to the Government. All vendor employees must have prior experience with GlobalNET.

1.5.9 Post Award Contractor/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5.

The contracting officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.5.10 Contracting Officer’s Representative (COR): Refer to DFARS Clause 252.201- 7000 “Contracting Officer’s Representative”.

1.5.11 Contract Personnel:

1.5.11.1 Key Personnel: The personnel listed below are considered essential to the work being performed under this contract. Before removing, replacing, or diverting any of the listed or specified personnel or facilities, the Contractor shall (1) notify the Contracting Officer reasonably in advance and (2) submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this contract. The Contractor shall make no diversion without the Contracting Officer's written consent.

Please see the below chart for the two (2) key personnel position, Program Manager and Application Developer.

1.5.11.1.1 Key Personnel Minimum Qualifications

SUPPORT TASK POSITION QUALIFICATIONS

PWS 5.1, 5.2, 5.3

Project Manager

Ten years of relevant experience in a large Enterprise IT and/or Federal Agency Environment

Three (3) years of relevant experience at the project management level in the chosen management methodology

Technically Competent with Microsoft Project or Jira; Project Management Professional Certified; knowledge of Information Technology Infrastructure Library (ITIL)

A four (4) year degree in the Information Technology, Information Technology Management, Database Administration, or related field from an accredited institution

5.2, 5.3 Application Developer

Five (5) years of relevant experience with large Enterprise IT and/or Federal Agency environment

Five (5) years of architecting, designing, and implementing integrated web systems

Five (5) years developing response web applications in modern hosting\

Five (5) years developing response web applications in modern hosting environment and proficient with web development

A four (4) year degree in the business management related field from an accredited institution

1.5.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. All Contractor personnel will be required to obtain, use, and display a CAC throughout the performance of this requirement.

1.5.13 Contractor Travel: Contractor will be required to travel CONUS and OCONUS during the performance of this contract to deliver training. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS. Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR. An amount will be designated in a separate CLIN to cover costs for Contractor travel. Actual travel will be coordinated with the Program Office and approved by the COR.

Contractor shall, in addition to invoice requirements, submit monthly financial and travel reports to the Contracting Officer and COR that includes all labor, travel costs, any other direct charges incurred by the Contractor. The report shall be formatted to provide breakout of labor hours per employee and related costs for the current period to date and the total amount expended to include the remaining balance on each contract CLIN. This format allows efficient, effective, and accurate tracking and provides effective insight into declining funds availability.

1.5.13.1 Safety: The Contractor shall comply with all Federal, State, and local authorities having jurisdiction, and with safety and fire regulations promulgated by the Department of Labor’s Occupational Safety and Health Administration (OSHA) under Title 29, Section 1900 of the Code of Federal Regulations. Contractor is solely responsible for compliance and cost of compliance with Federal, State, and local laws and regulations.

Contractor shall provide written notification to the Contracting Officer within twenty-four (24) hours of being notified by any Federal, State, or local agency that a safety law and/or regulation has been violated. This report shall provide at a minimum the following: time and date of the occurrence, a description of the violation, required corrective action(s), and a projected correction date.

1.5.14 Other Direct Costs: Other Direct Costs (ODCs) may include licensing and registration for servers.

1.5.15 Data Rights: Reference FAR 52.227.14 Rights in Data clause.

1.5.16 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs as defined in FAR Subpart 9.5. The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.17 Phase-In: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the thirty (30) day phase in period. During the phase in period, the Contractor shall become familiar with performance requirements to commence full performance of services on the contract start date.

1.5.18 Phase-Out Plan: The contractor shall provide a phase-out plan no later than fourteeen(14) days prior to expiration of this contract. The contractor shall maintain documentation that is assessable to designated government representatives via a web portal or other electronic means as designated by the government.

Prior to the end of the contract, the incumbent contractor shall support a fourteen (14) calendar days transition period with the in-coming contractor. The contractor shall overlap with an incoming contractor during transition and will work with Government personnel and the incoming contractor to transfer knowledge, information, and documentation for all projects and tasks related to this contract. The type of information and documentation to be transferred includes, at a minimum:

• Points of Contacts

• Location of technical and project management documentation

• Program data, databases and data management systems

• Status of ongoing technical initiatives and deliverables

• Appropriate contractor-to-contractor coordination to ensure a seamless transition

• Identify schedules, deliverables, and milestones

Commented [RLKMCWA1]: Requirement was received outside of PALT therefo0r a 90 days transition is not possible. A 14 day transition is more reasonable.

• Identify actions required of the Government

• Establish and maintain effective communication the incoming contractor/Government personnel for the period of the transition via weekly status meetings

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. BUSINESS DAY. The term business day means Monday through Friday, except the legal public holidays specified in PWS section 1.5.3.

2.1.2. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.3. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.4. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.6. DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.7. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.8. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.9. QUALITY ASSURANCE. The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.10. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.11. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.12. SUBCONTRACTOR. One that enters into a contract with a prime Contractor.

The Government does not have privity of contract with the subcontractor.

2.1.13. WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

AECA Arms Export Control Act CAC Common Access Card CFR Code of Federal Regulations CMP Comptroller Division COCOM Combatant Commander CONUS Continental United States (excludes Alaska and Hawaii) COOP Continuity of Operations COR Contracting Officer Representative CSR Certificate Signing Request CSSR Cybersecurity Service Provider CVE Common Vulnerabilities & Exposures COTS Commercial Off the Shelf DAI Defense Agencies Initiative DEAMS Defense Enterprise Accounting and Management System DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense DODI Department of Defense Instructions DSCA Defense Security Cooperation Agency DSCU Defense Security Cooperation University eMASS Enterprise Mission Assurance Support Service ERP Enterprise Resource Planning EST Eastern Standard Time FAA Foreign Assistance Act FAR Federal Acquisition Regulation FedRAMP Federal Risk and Authorization Management Program FCG Foreign Clearance Guide FIPS Federal Information Processing Standard FOIA Freedom of Information Act FSO Facility Security Officer GCC Global Combatant Command GFEBS General Fund Enterprise Business System GFI Government Furnished Information GUI Graphical User Interface HQ Headquarters IA Implementing Agencies IMT Information Management and Technology ISL Industrial Security Letter IS Information System ISCM Information Security Continuous Monitoring ISSM Information System Security Manager ITIL Information Technology Infrastructure Library ITP Insider Threat Program JTR Joint Travel Regulation KO Contracting Officer

NATO North Atlantic Treaty Organization NDA Non-Disclosure Agreement NIPSOM National Industrial Security Program Operating Manual OBO Office of Business Operations OCI Organizational Conflict of Interest ODC Other Direct Cost OPSEC Operation Security OSHA Occupational Safety and Health Administration PHP Hypertext Processor PMP Project Management Plan POA&M Plan of Action & Milestones PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RCE Regional Center Enterprise RDS Relational Database Server RMF Risk Management Framework RMP Risk Management Plan SAAR System Access Authorization Request SAP Security Assessment Package SC Security Cooperation SME Subject Matter Expert SOP Standard Operating Procedures STIG Security Technical Implementation Guidance TE Technical Exhibit TLS Transport Layer Security TPOC Technical Point of Contact UAT User Acceptance Testing URL Universal Resource Locators USWDS U.S. Web Design System VAR Visitor Authorization Request WHS Washington Headquarters Services

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: N/A.

3.2. Facilities: N/A.

3.3. Utilities: N/A.

3.4. Equipment: The Government will provide the contractor Government equipment required to complete PWS tasks.

3.5. Materials: The Government will provide the Contractor access to regulations, directives or other policy documents required to complete PWS tasks.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this contract that are not listed under Section 3 of this

PWS.

4.2 Secret Facility Clearance: The Contractor shall possess and maintain a SECRET facility clearance from the Defense Security Service. The Contractor’s employees, performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industrial Security Clearance Office. The DD 254 is provided as an attachment.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. Basic Services: The contractor shall provide services for support service for GlobalNET Operation and Sustainment.

5.2 Task 1 Project Management: The Contractor shall manage the performance of all requirements and tasks herein. The Contractor shall ensure all work performed remains within the scope of this contract or has been approved by the Government. Together the Project Management Plan (PMP), Schedule, and Risk Management Plan (RMP) should direct the day-to-day operations of the Contractor’s team. Government IT departments operate using the Agile methodology. The Government prefers the use of the Agile methodology by its contractors; however, the Government may accept another methodology. The Contractor shall identify the project management methodology it will use and provide deliverables consistent with that methodology and as directed by the Government.

5.2.1 Scheduling: The Contractor shall develop, update, and maintain a schedule no later than 10 business days following the award consistent with its overall management approach. The schedule shall include milestones, actions, and deliverables (draft and final) necessary to execute the objectives of this contract.

5.2.2 Contract Health Report: The Contractor shall prepare and submit an annual Contract Health Report that summarizes the major achievements and obstacles encountered during the year. The report must also include a list of all required training completed by each personnel performing under this contract.

5.2.3 Outage Notification: The Contractor shall notify the government of any outages longer than 10 minutes within 30 minutes of the outage during the Support Desk’s regular hours. Notification of any outage that occurs outside the normal Support Desk’s regular hours must be reported via email within 30 minutes of the beginning of the Support Desk’s regular hours.

5.2.4 Scientific and Technical Reporting: The Contractor shall complete a scientific and technical report, detailing the work accomplished under the contract in accordance with FAR 35.010. The report should include a SF298 cover form.

5.2.5 Documentation: The Contractor shall develop and maintain all documentation (meeting notes, business process, technical documentation, etc.) related to the system, assigned tasks and projects.

5.2.6 Testing: The Contractor Shall assure the quality of products, services, and deliverables through testing prior to release. Testing includes participation in reviews, audits, site visits, and User Acceptance Testing (UAT). The Contractor shall perform operational testing. The Contractor shall develop an Operational Test Plan and update it not less than 3 months before the start of testing for a major release.

5.2.7 Configuration Management: The Contractor shall ensure that all software and system changes are properly captured and published.

5.2.8 Lifecycle Management: The Contractor shall manage the entire lifecycle of the GlobalNET platform to include procurements, renewals, certificates, etc. The Contractor shall procure only Government approved items (e.g., DISA approved certificates).

For internal GlobalNET environment communications, vendor will track the expiration and ongoing maintenance regarding the removal and replacement of all Transport Layer Security (TLS) certificates per DISA instruction. This include the replacement of self-signed certificates which may be highlighted during security scanning.

For External (Public Facing) communications, vendor will track the expiration and request assistance from the TSD/Infrastructure Support Branch at least 30 days out from expiration. The TSD/Infrastructure Support Branch will submit DISA tickets for GlobalNET on behalf of the Contractor to obtain the Certificate Signing Request (CSR).

The Contractor shall procure and obtain the signed publicly trusted certificate per an approved Certificate Authority. This publicly trusted certificate will be provided to the TSD/Infrastructure Support Branch so it can be provided to DISA for replacement.

5.2.9 Risk Management Plan: The Contractor shall develop, update, maintain, and submit a comprehensive RMP no later than 10 business days following the award to address, identify, assess, and prioritize risks to monitor and reduce or eliminate risks associated with performing the work described herein. The RMP shall address how risks will be recorded, reported, mitigated, and tracked should they become. The RMP shall include any risks that could affect the project to includeresources, access, physical and cyber security, and un-planned events. Should any risk become a realized issue, the Contractor shall develop a mitigation plan to reduce or eliminate the risk, and execute that plan once approved by the Government. The RMP shall contain a mitigation summary of risk items.

The contractor shall monitor the plan and provide updates no later than three (3) business days following a change.

5.2.10 Continuity of Operations: The Contractor shall prepare, update, maintain, and submit Continuity of Operations Plan (COOP) no later than 15 business days following the award. This plan will document the restore processes and procedures, a recommendation for a backup locations and services, and detail requirements to do so.

The Government expects the Contractor to simulate the plan no more than twice a year and submit a report on findings. As required, the vendor will execute the plan to ensure continuity of operations.

The Contractor shall restore system failures 24 hours a day 7 days a week as needed. The Government recognizes that systems may fail and expects service to be restored quickly as it is used through all time zones.

The Contractor must be able to provide full data restoration within 12 hours of a catastrophic occurrence. The Contractor must be able to provide full system restoration within 24 hours in the event of a system catastrophic event. The Contractor will be required to prove the restoration was successful to the Government by comparing base-line operations with restored operations no later than 24 hours following restoration.

5.3 Task 2 Operation and Sustainment: The Contractor shall sustain the GlobalNET Information System, provide Help Desk support to GlobalNET users and administrators, and develop system reports as directed by the Government.

5.3.1 Sustain the Existing GlobalNET Platform: The Contractor shall operate, maintain, sustain, and support the GlobalNET platform to ensure the mission capability remains operational.

5.3.2 Turnkey Operation: The Contractor shall assume the operation, maintenance, sustainment, and technical support of the GlobalNET platform ensuring its enterprise operational capability, providing turnkey operation of the platform and connections to other systems.

The Contractor shall ensure the commercial off the shelf (COTS) software is kept up to date with no less than one (1) version behind the current release for longer than 3 months, unless otherwise directed by the Government. The Contractor shall provide technical support to the users and administrators of the system.

5.3.3 COTS Software Upgrades: The Contractor shall ensure the COTS software products are regularly and appropriately maintained, patched, and upgraded. The Contractor shall ensure all COTS software products are kept current with the latest version no later than 6 months following the release of a major version and 2 months following the release of a minor version or patch unless otherwise directed by the Government. The contractor shall review release packages and determine if they are any foreseeable issues in terms of functionality, capability, security, risks, etc. with applying such packages. The Contractor shall deliver its findings via an informal report to the Government PM. If approved by the Government PM, the contractor shall plan and execute the upgrade or patch; if denied, the Government PM and/or COR will provide a waiver or written guidance responding to the findings presented.

Should the Government determine that a legacy system is to be maintained at a version other than the current available release, the Contractor shall seek a waiver from the Government which should be signed by the Government Technical Point of Contact (TPOC) and COR.

5.3.4 Environments and Uptime: The Contractor shall maintain and operate the operational, test, and development environments within a secure environment such that all data at rest and in motion is encrypted using a Federal Information Processing Standard (FIPS) 140-2 approved algorithm.

5.3.4.1 The Contractor shall use all reasonable commercial efforts to ensure that all services are available 99.9% of the time in any calendar month, which translates to a maximum of 45 minutes of unscheduled unavailability per calendar month.

5.3.4.2 The Contractor shall implement patches (software, security, etc.) coordinated with user communities and ensure the minimization of system down time. Government approved down time for patching will not count against the availability requirement.

5.3.4.3 The Government desires distinct and logically separated environments for the system production operations, testing, and development. The Contractor shall ensure all GlobalNET hosted environments are located at a FedRAMP compliant facility that meets the appropriate DoD Cloud Security Model and must be aligned with the Government’s enterprise-wide Cybersecurity Service Provider (CSSP).

5.3.4.4 The Contractor shall implement strong business rules that limit the ability of errant code and/or data from one environment to change any code or settings in any higher environment. System configuration changes shall be promoted from environment to environment in a protected and methodical way using the development environment.

Production and Test environments shall be configured exactly the same. The Government will accept size differences for cost; however, the Contractor will provide assurance that the test environment can simulate and test the capacity of the production site. If required, additional environments shall be created for prototyping.

5.3.5 Backups: The Contractor shall backup and secure all system files and data in compliance with Government data retention standards. The Contractor must be able to restore the system. The Contractor’s backup solution shall maintain all transactions.

5.3.6 Disaster Failover Testing: The Contractor shall perform Disaster Failover testing by the Contractor as described in the COOP (PWS 5.2.14). The Contractor shall, on a quarterly basis, replicate the Production stack for disaster failover testing in a separate hosting region. This is typically built up and torn down within a 4-week period.

5.3.7 Cyber Security: The Contractor shall manage the Risk Management Framework (RMF)documentation using the DISA provided implementation of the Enterprise Mission Assurance Support Service (eMASS) system.

5.3.7.1 The Contractor shall provide updates within 30 days of any changes which will impact the security posture of the system. Sample tasks such as, changing architectural documents, validating technical controls are applied, updating the current RMF package, and making security recommendations to the Government Information System Security Manager (ISSM) and Government PM.

5.3.7.2 The Contractor shall support various certification and accreditation and authorization to operate activities as required by the Government.

5.3.7.3 The Contractor shall assist in the creation, development, and maintenance of security assessment packages (SAP). The Contractor shall conduct Self-Evaluations of security controls and assessment procedures. The Contractor shall provide input into plans of action and milestones (POA&Ms) and risk acceptance documentation. The Contractor shall implement Security Technical Implementation Guides (STIG’s).

5.3.7.4 The Contractor shall implement/maintain Information Security Continuous Monitoring (ISCM). The Contractor will utilize as appropriate DoD approved cyber data sources. The Contractor shall assist with the remediation of Common Vulnerabilities & Exposures (CVE) findings.

5.3.8 Domain Names & URL Management: The Contractor shall manage, coordinate the management of, or otherwise support the management of the following domain names and Universal Resource Locators (URLs) while they are used to support the GlobalNET mission:

GlobalNET Website globalnetplatform.org Africa Center for Strategic Studies acsscommunity.org Asia Pacific Center for Security Studies apcsslink.org William J. Perry Center for Hemispheric Defense Studies perry-center.org Defense Language Institute - English Learning Center dlielcnet.org DoD Civilian Leader Development dodcld.org Defense Institution Building defenseinstitutionbuilding.org.

Ministry of Defense Advisor Program modaprogram.org NATO School Oberammergau natoschool.org Partnership for Peace NET pfpnet.org Partnership for Peace Consortium pfpconsortium.org Security Cooperation Collaboration Network scconnect.org SIGS/IGPO sigs-globalnet.org

5.3.9 Web Hosting: The Contractor shall provide and maintain three FedRAMP compliant server environments—Development, Staging, and Production. The Contractor shall support Government coordination with and connections to security servers and services as directed by the Government.

5.3.9.1 Server Environments shall be managed by the Contractor. The vendor shall work to keep the production, staging, and development servers in their current operation conditions. Descriptions of the environments as they are currently configured include:

Production Servers are capable of serving up 1000 concurrent users, running Drupal and ILIAS, accessing over 3 TB of files, driven by a 70 GB (Drupal) and 20 GB (ILIAS) MySQL-compatible databases. Production Server should never exceed 50% capacity under load. Databases and the file system grow an average of 2% per month.

Staging Server can serve 250 concurrent users, running Drupal and ILIAS, accessing over 3 TB of files, driven by a 70 GB (Drupal) and 20 GB (ILIAS) MySQL-compatible databases. The Staging Server should never exceed 50% capacity under load. Databases and the file system grow an average of 2% per month.

Development Server can serve 25 concurrent users, running Drupal and ILIAS, accessing over 100 GB of files, being driven by test databases, an approximately 1 GB (Drupal) and 20 GB (ILIAS) MySQL-compatible databases. The Development Server should never exceed 50% capacity under load. Databases and the file system are relatively stable over time.

5.3.9.2 Backup & Recovery: The Contractor shall maintain the current approach or implement a new one if approved by the Government PM for Backup and Recovery.

The system is currently managed via snapshots that are made on an hourly, daily, weekly, and monthly basis and are retained for disaster recovery purposes in multiple regions.

System access logs for all environments currently occupy 250 GBs and are retained indefinitely.

5.3.9.3 Government Access: The Contractor shall allow unfettered Government access to the capabilities and environments described herein and available to the Government at all times. This includes the network, file-structure, servers, databases, etc. The Contractor shall support Cybersecurity Service Provider (CSSP) access at the direction of the Government, including CSSP required tools in the environments or within the security boundary.

All hosting services will be established and maintained in a way that can be easily transitioned to the Government without mission interruption.

5.3.9.4 Continuous Integration (CI) Pipeline currently deploys on average two (2) complete feature testing stacks per week, each feature stack mimics the Development environment. In addition, the CI pipeline deploys an average of 15 automated testing and QA stacks per week, each mimicking the Development environment. The pipeline integrates with a separate version control system and service ticket repository. The Contractor shall maintain the current approach, or implement a new one if approved by the Government PM.

5.3.10 Google Workspace Email: The vendor shall assist with the operation of DSCA using a Platform-as-a-Service Email server to communicate with the GlobalNET community. The use of a non .mil email is vital to ensuring the broadest Each account is not heavily used due to the use of GlobalNET for collaboration.

5.3.11 Issues, Changes, and Enhancements: The Contractor shall troubleshoot, identify, solution, develop, script, and correct issues at the direction of the Government. The Contactor shall inform the Government of issues and proposed changes; the Contractor shall gain the approval of the Government prior to implementing changes.

The Contractor shall coordinate with GlobalNET stakeholders to discover issues, evolving mission needs, and potential enhancements that may improve the ability to meet the GlobalNET mission. The Contractor shall create and manage a product backlog which it will review with the Government PM at least monthly.

5.3.12 Transition Support: The Contractor shall support migration and/or transition of the GlobalNET mission to a new platform as directed by the Government. The Contractor shall provide general and administrative assistance as directed by the Government in support of the migration and/or transition of the GlobalNET mission. This includes sharing knowledge, understanding, documentation, customer insights, technical transfer, and customer transition support.

The Contractor may assist in the preparation of content and processes of GlobalNET for migration to a new environment. The Contractor may, at the direction of the Government, directly assist the GlobalNET community/content leads in ensuring courses, training, information, articles, etc. are re-built and/or re-located appropriately in a new environment.

5.4 Task 3 Support Desk: The Contractor shall provide Tier 1 support from 0630–1830 Eastern Time, and Tier 2 and Tier 3 support from 0830–1700 Eastern Time except for U.S. Federal Holidays. The Contractor shall at a minimum provide the following Support Desk support:

• Provide Service Desk and Government Mission System Support Monday through Friday, using software support standard best practices.

• Isolate, identify, and repair/escalate failures, as well as answer user questions.

• Respond promptly to support requests to ensure the application operates without interruption to functional users. If the application is not available for use or has greatly reduced functionality, the division leadership shall be notified according to SOP. Application support shall include email response, ticketing tool.

• Maintain a Support Activity Report which will be used to track and report support tickets as well as the resolution of those tickets.

• Assist responding to users’ problems, needs, and concerns by either phone or email or ticketing tool (e.g., ServiceNow, ManageEngine etc.). Requests to the Help Desk shall be responded to within one (1) business day from the receipt of request. Technical support shall be available Monday through Friday during government business hours.

• Assist detecting events, incidents, and customer engagements (Health & Status monitoring), record information in ticketing system, and escalate tickets as required via standard operating procedure.

• Assist performing incident resolution to restore service via knowledge articles and SOPs.

• Assist performing in-depth, ad-hoc analysis based on operator expertise with a specified system to resolve the incident and restore service.

• Manage customer accounts (adding/deleting/changing)

• Provide after-hours support for outages deemed critical.\

• Assist resolving as many user-reported problems as expertise permits using available tools and following procedures and policies for the handling of support cases.

• Assist responding to users requests for technical assistance in person, via phone or electronically.

• Research questions using available information resources and advise users on appropriate action.

• Act as a liaison between customers and internal support staff to assure accurate problem interpretation. Maintain communications with customers during the problem resolution process.

• Act as a liaison between customers and external IT service providers and partners to ensure customer requests and inquiries are addressed in a timely and appropriate manner.

• Follow all standard help desk procedures and log all help desk interactions via Help Desk tool.

• Redirect problems to appropriate resource and identify and escalate situations requiring urgent attention.

• Document the need for new/upgraded software, hardware or other devices/appliances required to support the project completion, and create semi-detailed software/hardware specifications, so that the system manager can acquire the necessary software, hardware, devices and appliances to meet project milestones.

• Assist providing first-level contact and problem resolution for GlobalNET.

• Assist creating and providing customer training and user guide documentation.

• The Contractor PM will be responsible for tracking and ensuring all deliverable items are met.

• Provide system uptime, maintenance, and user ticket statistics when requested by the Government.

5.4.1 Onsite Tier 1 Support Augmentation: Subject Matter Experts (SMEs) from each RC respond to the majority of the issues identified by users (Tier 1). Due to the use of DoD CAC, the team will need to be able to provision accounts or provide an automated mechanism to support account creation and deletion that accommodates system authorization requirements.

In the event an issue cannot be solved by the SME, the SME may escalate to the Contractor Help Desk. The Contractor shall respond within 30 minutes of receiving the issue acknowledging the issue and assign for resolution. The Contractor will work on issues and escalate them during core business hours and will keep the SME informed of any findings.

5.4.2. Help Desk Levels of Support: Below are the definitions of the Help Desk Tiered support. At each community, Tier 1 support will be primarily provided by SMEs at each institution but may be routed directly to the Contractor’s Help Desk.

TIER 1 RC SMEs deal with majority of incoming calls and emails. RC SMEs provide the bulk of Tier 1 support including basic application software and/or hardware support (navigation, username, account set up, and password).

TIER 2 Work on issues that take some research or prolonged investigation. Provide more complex support on application software and/or hardware and is usually an escalation from Tier 1. Collect and maintain System Access Authorization Requests (SAAR) and User Agreements; create/deactivate/maintain user accounts, etc.

TIER 3 Engineering Level, advanced fault replication/resolution. Code bugs, etc.

Provide support on complex hardware and operating system software.

5.4.3 System Reports: The Contractor shall develop, manage, and execute system reports.

The Contractor shall work with the stakeholders to implement a process to allow users to submit complex reports for assistance and develop reports as directed by the Government.

5.4.4 Training: The Contractor shall provide training to stakeholders, community leads, user communities, etc. The Contractor shall develop and manage GlobalNET documentation and training materials (manuals, briefings, work guides, etc.). The Contractor shall ensure materials remain current and are updated to reflect changes in the GlobalNET environment. Documentation updates must accompany the software release when the release provides users an experience not described in the previous documentation.

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures:

• https://www.whs.mil/COVID-19

• https://comptroller.defense.gov/Portals/45/documents/fmr/current/10/10_12.pdf

• https://www.ecfr.gov/current/title-5/chapter-XVI/subchapter-B/part-2635/subpart-

H/section- 2635.807

• https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-73/subpart-

G/section-73.735-701

• https://www.acquisition.gov/far/part-35

Commented [RLKMCWA2]: OSHA should be mention here and any other regulations that the KTR will be required to follow. OSHA is mention in PWS section 1.5.13.1.

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. Attachment/Technical Exhibit List:

7.1. Attachment 1/Technical Exhibit 1 – Performance Requirements Summary

7.2. Attachment 2/Technical Exhibit 2 – Deliverables Schedule

7.3 Attachment 3/Technical Exhibit 3 – Estimated Workload Data

7.4 Attachment 4/Technical Exhibit 4 – Historical Data

7.5 Attachment 5/Technical Exhibit 5 – Information Technology Certifications/Proficiencies

7.6 Attachment 6/Technical Exhibit 6 – Proposed Other Direct Costs

7.6. Attachment 7/Technical Exhibit 7– Proposed Travel

7.7. Attachment 8/Technical Exhibit 8 – Security Requirements

TECHNICAL EXHIBIT 1

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performa…