Attachment_J-01_ITMA_PWS__Clean.pdf

HQ0147-18-R-0004

Attachment J-01 ITMA PWS

April 27, 2018

TECHNICAL, ENGINEERING, ADVISORY and

MANAGEMENT SUPPORT (TEAMS)

Performance Work Statement (PWS) for Information Technology Management and Analysis

(ITMA)

1. Top Level Functional Requirements/Scope

1.1. Purpose

The Missile Defense Agency's (MDA) mission is to develop, test, and field an integrated, layered, ballistic missile defense system (BMDS) to defend the United States, its deployed forces, allies, and friends against all ranges of enemy ballistic missiles in all phases of flight.

The MDA Chief Information Officer (CIO), a Senior Executive Service (SES) appointment compliant with Clinger-Cohen Act (Pub. L. 104-106), is responsible for providing MDA with Enterprise (Agency-wide) Information Technology (IT) capabilities for Administrative and General Services (GENSER) capabilities servicing the MDA administrative and business requirements as well as general services for BMDS Research, Development, Test, and Evaluation (RDT&E) requirements; plus the cybersecurity lead for the BMDS fielded capabilities and MDA Enterprise. The MDA CIO appoints the MDA Information Systems Authorizing Official (AO) for all of MDA to include the BMDS fielded capabilities.

Approved for Public Release 16-MDA-8540 Figure 1.1: The Ballistic Missile Defense System

Missile defense technology being developed, tested and deployed by the United States is designed to counter ballistic missiles of all ranges—short, medium, intermediate and long. Since ballistic missiles have different ranges, speeds, size and performance characteristics, the BMDS is an integrated, "layered" architecture that provides multiple opportunities to destroy missiles and their warheads before they can reach their targets.

Ballistic missile trajectories are commonly divided into three phases of flight: boost, midcourse, and terminal. Each element will play an important role in a robust system intended to defend against hostile missiles in any phase of flight.

The BMDS system's architecture includes:

Networked sensors (including space-based) and ground- and sea-based radars for target detection and tracking;

Ground- and sea-based interceptor missiles for destroying a ballistic missile using either the force of a direct collision, called "hit-to-kill" technology, or an explosive blast fragmentation warhead; and

A command, control, battle management, and communications network providing the operational commanders with the needed links between the sensors and interceptor missiles.

The BMDS elements are:

Aegis Ballistic Missile Defense (BMD) Command, Control, Battle Management and Communications (C2BMC) Ground-based Midcourse Defense (GMD) Sensors Terminal High Altitude Area Defense (THAAD)

Each BMDS element has multiple unique components, such as: interceptors, fire control, unique sensors, element internal and external communications capabilities, unique command and control configurations, etc.

1.2 Background

The BMDS weapon system, as depicted in Figure 1.1, is made up of several elements and components. MDA is identified as a rapid acquisition agency with the mission to expedite BMDS capabilities development and testing. MDA then fields demonstrated BMDS program capabilities as soon as they are available.

Information is a strategic asset to MDA, and as such shall be appropriately secured, shared, and made available to the maximum extent possible throughout the information life cycle to MDA workforce.

The MDA CIO office provides MDA with enterprise services, defined as: a common set of information resource capabilities designed to provide awareness of, access to, and delivery of information. Information is defined as: any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms. This advisory and assistance services requirement will ensure the Office of the CIO is able to:

Improve information solutions with reliable, timely, accurate information that is protected, secure, and resilient against information warfare, terrorism, criminal activities, natural disasters, and accidents.

Improve IT investment portfolio alignment with the required DoD Information Enterprise policies and guidance

Improve operational effectiveness and efficiency through superior IT services delivery Improve resilient communications and computing infrastructure Improve organizationally-tiered reviews, oversight, and execution to ensure IT investments are in compliance with architectures at various levels, IT standards, and related policy requirements

The MDA CIO office provides administrative net-centric enterprise services to all of MDA through a robust, globally-interconnected network environment (including infrastructure, systems, processes, and people) in which data are shared quickly and seamlessly among users, applications, and platforms. MDA uses mostly DoD available shared administrative (DoD business mission area) tools, such as the Defense Agencies Initiative (DAI) electronic-business suite for government time cards, or the Defense Travel System (DTS) for government travel arrangements, or the DoD Civilian Acquisition Workforce Personnel Demonstration Project’s (AcqDemo) Contribution-based Compensation and Appraisal System (CCAS) CAS2Net system for government civilian appraisal processes. The MDA unique administrative services are all based on commercial-off-the-shelf (COTS) tools, so that sitting in a normal office environment in Alaska one can schedule the conference room for meetings while on travel to the Von Braun complex. Likewise, some administrative services are based on DoD-negotiated COTS procurements, such as Microsoft Office for emails, calendars, presentations, spreadsheets, documents, etc.

The MDA CIO office provides general net-centric enterprise services (both unclassified and classified) to MDA supporting the MDA mission for BMDS RDT&E. The general services are based on the globally interconnected, end-to-end set of information capabilities for collecting, processing, storing, disseminating, and managing information on demand to MDA government and contractor teams. The enterprise general services support such things as globally dispersed Engineering Design Reviews; test readiness reviews; element developmental laboratories technical coordination; test execution; and Executive Management Review Boards. The classified enterprise general services system is considered a ‘national security system’.

The MDA CIO has two major data centers, one on Redstone Arsenal, AL (commonly referred to as Huntsville (HSV)) and the other on Schriever Air Force Base (AFB), CO (commonly referred to as Colorado Springs (COS)) both identified as Special Purpose Processing Nodes (SPPN). The HSV data center is predominately the MDA Unclassified Center, and the COS data center is predominately the MDA Classified Center, with each providing disaster recovery, continuity of operations (DR/COOP) services to the other. Concept of Operations (CONOPS) governing the Enterprise utilizes the Information Technology Infrastructure Library (ITIL) framework and methodologies and a well-defined set of Role Based Administration (RBA) crew categories and responsibilities. The Enterprise CONOPS provides the guidance necessary to manage the increasingly complex computer and network environments while providing customers high quality supported and sustained IT services.

The MDA Enterprise includes but is not limited to: 4 Principal Sites (Fort Belvoir, VA (Headquarters - HQ); Naval Surface Warfare Center Dahlgren Division, VA (Dahlgren - DHL);

Redstone Arsenal, AL (Huntsville - HSV); and Schriever AFB, CO (Colorado Springs - COS)), 10 Major Sites, and over 135 Remote Sites connected by Wide Area Network (WAN) Services with over: 260 network enclaves connected to the MDA managed network transport as well as numerous isolated special purpose networked systems; various connections to other DoD networks; 14,000 users with about 18,000 user accounts; 3,000 wireless device users; 2,200 production servers and 400 RDT&E servers; numerous print servers with 1,000 network printers;

over 300 VTCs nodes in conference areas and office suites; and VOIP classified and unclassified telephony services.

The MDA CIO office activities related to the administrative and general services net-centric enterprise IT services are: plan, design, acquire, manage, build, populate, operate, protect, defend, maintain, and decommission.

There are many Federal and DoD regulations for implementing ITMA, see paragraph 2.1 below.

MDA is a component of DoD. The MDA Director is referred to as a “DoD Component Head” or “Head of DoD Component.” The MDA CIO is referred to as a “DoD Component CIO.”

2. Organizational Description

The CIO mission is to ensure that MDA information technology services, management and resources are administered, acquired, managed, and operated in compliance with the priorities set by the MDA Director and the goals and directives of existing statutes and DoD regulations. The MDA CIO vision is to provide effective, secure and affordable enterprise information capabilities for missile defense. MDA has standardized the delivery of core enterprise services and applications into eight Service Lines: End User Support, Unified Communications, Cybersecurity Information Assurance (IA)/ Computer Network Defense (CND), Business Automation, Portal & Data Management, Networks and Infrastructure, Data Center, and IT Planning & Solutions. See Figure 2.1 for the MDA CIO Mission, Vision, and Services depiction. MDA CIO strives to deliver integrated services through the eight Service Lines. The MDA SPPN data center configurations are both DoD Architecture Framework (DoDAF) and Joint Information Environment (JIE) compliant and provide processing, storage, and transport of information, human interaction, systems and network management, information dissemination management, and cybersecurity functions.

Figure 2.1: MDA CIO Mission, Vision, and Services

The MDA CIO organization is depicted in Figure 2.2. Within the below CIO organization depiction the blue highlighted boxes reflect the associated requirement organizations for this contract.

Within Figure 2.2 right below the CIO is the Architecture & Engineering (A&E) Team.

The A&E Team is part of the CIO organization, comprised of Government and Contractor members. The A&E Team recommends the future MDA Enterprise (SPPN) configuration within the roadmap for implementation. The A&E Team Support requirements are contained in Performance Objective #1.

Within Figure 2.2 in the middle is the MDA 3-letter organization ICT, Information

Management & Technology Operations. The ICT organization oversees the day-to-day execution of the world-wide MDA Enterprise (Admin/GENSER). The ICT requirements are contained in Performance Objectives #3 through #6.

Within Figure 2.2 in the far right hand column, is the Regional IT Support for the major

MDA locations. The Regional IT Support organizations are the CIO’s local interface to the MDA workforce. The Regional IT Support requirements are contained within Performance Objective #2.

Figure 2.2: MDA Chief Information Officer (CIO) Organization Chart

2.1 Regulatory Guidelines

Specific regulatory guidelines are applicable throughout this requirement for accomplishment of performance objectives in Section 3. The below list identifies the regulatory guidelines and their current version, but the regulatory guidelines associated with this requirement are not limited to the below guidelines, their current version, or superseding regulations.

ICTA HQ

ICTM HSV

ICTO COS Integration & Ops Center

ICTP DHL

ICTT West

Regional IT Support MDIOC Senior Offical &

Infrastructure / Event

Support

Cyberspace

Management Office

Information

Management &

Technology Operations

Chief Information

Officer

Authorizing Offical Team Architecture &

Engineering Team

ICM ICV ICT

Headquarters

Von Braun Complex

Dahlgren Division

Western Support

IT Networks & Systems

Information Mgmt

Enterprise Ops & Eng

IT Policy & Planning

Unified Communications

Figure 2.3: Regulatory Documentation

# Title

1 National Security Presidential Directive, NSPD-23, National Policy on Ballistic Missile Defense, 16 Dec 2002

2 DoDD 5134.09, Missile Defense Agency (MDA), 17 Sep 2009

3 OMB Circular No A-130 Revised, Managing Federal Information as a Strategic Resource, 28 Jul 2016

4 Clinger Cohen Act

OMB Memorandum, “Myth-Busting 2”: Addressing Misconceptions and Further Improving Communication During the Acquisition Process, 7 May 2012

6 CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 9 Feb 2011

7 CJCSM 6510.01B, Cyber Incident Handling Program, 10 Jul 2012

8 CNSSP No. 22, Cybersecurity Risk Management, 31 Aug 2016

9 CNSSI No. 1015, Enterprise Audit Management Instruction for National Security Systems, 14 Apr 2016

10 CNSSI No. 1253, Security Categorization and Control Selections for National Security Systems, 27 Mar 2014

CNSSI No. 4014, National Information Assurance Training Standard for Information Systems Security Officers, April 2004

12 CNSSI No. 4016, National Information Assurance Training Standard for Risk Analysts, November 2005

DoD CIO Memorandum, Updated Guidance on the Acquisition and Use of Commercial Cloud Services, 15 Dec 2014

14 DoD CIO Strategy for Implementing the Joint Information Environment (JIE), 18 Sep 2013

15 DoD CIO Enterprise Service Management Framework, Edition II, 08 Nov 13

16 DoD CIO Information SharingStrategy, 04 May 2007

17 DoD CIO Lifecycle Standards for OSD IT Equipment, 15 Oct 2009

18 DoD CIO Memorandum, Migration to Windows 10 Secure Host Baseline, 20 Nov 2015

DoD CIO Memorandum, Delegation of Title 40/CCA Confirmations for Major Defense Automation Program/Major Automation Information Systems Programs, 18 May 2012

DoD CIO Memorandum, Department of Defense Commercial Mobile Device Implementation Plan, February 21, 2013

21 DoD CIO Net-Centric Services Strategy, 4 May 2007

22 DoD CIO Net-Centric Spectrum Management Strategy, 3 Aug 2006

23 DoD CIO Net-Centric Data Strategy, 9 May 2003

24 DoD CIO NetOps Strategic Vision, Dec 2008

25 DoD CIO Reference Architecture Description, Jun 2010

DoD CIO Memorandum, OMB Strategic Plan for Improving Management of Section 508 of the Rehabilitation Act of 1973, 16 Jul 2013

27 DoD CIO Information Enterprise Strategic Plan, 2010-2012

28 DoD CIO Cloud Computing Strategy, Jul 2012

29 DoD CIO Information Enterprise Architecture (DoD IEA), Version 2.0, Jul 2012

30 DoD CIO Memorandum, DoD Information Enterprise Architecture 2.0, 20 Aug 2012

DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle, May 2015

32 DoD Cybersecurity Test and Evaluation Guidebook, 1 July 2015

33 DoD Cybersecurity Culture and Compliance Initiative, 30 Sep 2015

34 DoD IEA Version 2.0, Volume I – Management Overview, Jul 2012

Regulatory Documentation

Figure 2.3: Regulatory Documentation, continued

35 DoD Information Resources Management Strategic Plan, Version 1.0, 1 Apr 2015

36 DoD IT Business Case Analysis Template, 22 Oct 2014

37 DoDI 1100.22, Policy and Procedures for Determining Workforce Mix, 12 Apr 2010

38 DoDD 3020.44, Defense Crisis Management, 4 Jun 2007

39 DoDI 3222.03, DoD Electromagnetic Environmental Effects (E3) Program, Incorporating Change 1, 8 Jan 2015

40 DoDD 3600.01, Information Operations (IO), 2 May 2013

41 DoDI 4000.19, Support Agreements, 25 Apr 2013

DoDI 4630.8 Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 30 Jun 2004

43 DoDD 4640.13, Management of Base and Long-Haul Telecommunications Equipment and Services, 5 Dec 1991

44 DoDI 4650.01, Policy and Procedures for Management and Use of the Electromagnetic Spectrum, 9 Jan 2009

45 DoDI 4650.10, Land Mobile Radio (LMR) Interoperability and Standardization, July 28, 2015

46 DoDD 4715.1E, Environment, Safety, and Occupational Health (ESOH), 19 Mar 2005

47 DODI 5015.02, DoD Records Management Program, 24 Feb 2015

48 DoDD 5144.02, DoD Chief Information Officer (DoD CIO), 21 Nov 2014

49 DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, 5 Nov 2012

DoDI 5205.13, Defense Industrial Base (DIB) Cyber Security/Information Assurance (CS/IA) Activities, 29 Jan 2010

51 DoDI 5230.24, Distribution Statements on Technical Documents, 23 Aug 2012

52 DoDD 5400.11, DoD Privacy Program, 29 Oct 2014

53 DoDI 5400.16, DoD Privacy Impact Assessment (PIA) Guidance, 14 Jul 2015

54 DoDI 5505.15, DoD Contractor Disclosure Program, 16 Jun 2010

55 DoDI 6055.01, DoD Safety and Occupational Health (SOH) Program, 14 Oct 2014

DoDI 7041.04, Estimating and Comparing the Full Costs of Civilian and Active Duty Military Manpower and Contract Support, 3 Jul 2013

57 DoDD 8000.01 Management of the Department of Defense Information Enterprise, February 10, 2009

DoDI 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 Apr 2004

DoDI 8110.01, Mission Partner Environment (MPE) Information Sharing Capability Implementation for the DoD, 25 Nov 2014

60 DoDD 8115.01, Information Technology Portfolio Management, 10 Oct 2005

61 DoDD 8140.01 Cyberspace Workforce Management, 11 Aug 2015

DoDI 8220.02, Information and Communications Technology (ICT) Capabilities for Support of Stabilization and Reconstruction, Disaster Relief, and Humanitarian and Civic Assistance Operations, 30 Apr 2009

63 DoDI 8310.01, Information Technology Standards in the DoD, 2 Feb 2014

DoDI 8320.02, Sharing Data, Information, and Information Technology (IT) Services in the Department of Defense, 5 Aug 2013

65 DoDI 8320.05, Electromagnetic Spectrum Data Sharing, 18 Aug 2011

DoDI 8320.06, Organization Unique Identification (OUID) Standards for Unique Identification of External Department of Defense Business Partners, 26 Sep 2012

DoDI 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), May 21, 2014

DoDM 8400.01-M, Procedures for Ensuring the Accessibility of Electronic and Information Technology (E&IT) Procured by DoD Organizations, 3 Jun 2011

DoDI 8420.01, Commercial Wireless Local-Area Network (WLAN) Devices, Systems, and Technologies, 3 Nov 2009

70 DoDI 8440.01, DoD Information Technology (IT) Service Management (ITSM), 24 Dec 2015

71 DoDI 8500.01, Cybersecurity, 14 Mar 2014

72 DoDI 8500.2, Information Assurance (IA) Implementation, 6 Feb 2003

73 DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 Mar 2014

74 DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

75 DoDI 8540.01, Cross Domain (CD) Policy, 8 May 2015

76 DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014

DoDI 8560.01, Communications Security (COMSEC) Monitoring and Information Assurance (IA) Readiness Testing, 9 Oct 2007

78 DoDM 8570.01-M, Information Assurance Workforce Improvement Program, 24 Jan 2012

79 DoDI 8580.01, Information Assurance (IA) in the Defense Acquisition System, 9 Jul 2004

FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

81 FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

82 FIPS PUB 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2003

83 NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012

84 NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010

NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010

NIST SP 800-39, Managing Information Security Risk, Organization, Mission, and Information System View, March 2011

NIST SP 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, 22 Jan 2015

NIST SP 800-53A revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations - Building Effective Assessment Plans, December 2014

NIST SP 800-60, Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008

90 NIST SP 800-64, Security Considerations in the System Development Life Cycle, October 2008

NIST SP 800-70 rev 2, National Checklist Program for IT Products-Guidelines for Checklist Users and Developers, February 2011

92 NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, September 2008

NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011

NSAID Net-Centric Enterprise Information Assurance (IA) Strategy Annex to the DoD IA Strategic Plan, Revision 1.0, 26 Apr 2006

USD(ATL) Memorandum, Better Buying Power 2.0: Continuing the Pursuit for Greater Efficiency and Productivity in Defense Spending, 13 Nov 2012

USD(ATL) Memorandum, Implementation Directive for Better Buying Power 2.0 -Achieving Greater Efficiency and Productivity in Defense Spending, 24 Apr 2013

97 USD(ATL) Fact Sheet, Better Buying Power, Nov 2013

2.2 Data Rights

The contractor shall comply with government data rights in accordance with the Defense Federal Acquisition Regulations Supplement (DFARS), as identified below in the PWS and incorporated in the contract:

All technical data (TD) and computer software (CS), algorithms and related models (see DFARS 252.227-7013 and 252.227-7014) to be produced or developed under this contract shall be delivered to the Government with unlimited data rights. The TD and models shall be delivered to the contracting officer in its entirety at any point during the period of performance (POP) of this contract upon written request of the contracting officer or by the end of the contract. The TD and models are to be developed with only Government funds. Do not use open source computer software unless prior written approval is received from the contracting officer. All copyrights for updated and newly developed technical data and models will be assigned to the Government (see DFARS 252.227-7020, incorporated herein).

3. Performance Objectives and Detailed Requirements

Table 3.0 below contains the Performance Objectives Index outlining the objectives to be

# Title

USD(ATL) Memorandum, Update on DoD Implementation Plan for Electronic Subcontract Reporting System ( eSRS), 23 Aug 2006

99 USD(ATL) Memorandum, Cash Flow Tool for Evaluating Alternative Financing Arrangements, 27 apr 2011

100 USD(ATL) DoD Efficiencies Key Points 2010

101 USD(ATL) Memorandum, Document Streamlining - Life-Cycle Sustainment Plan (LCSP), 14 Sep 2011

102 USD(ATL) Research and Technology Protection Plans, 30 Jun 2000

USD(ATL) Memorandum, Improving the Accessibility of Government Information through Section 508 of the Rehabilitation Act of 1973, as Amended (29 U.S.C. § 794d), 15 Mar 2012

104 USD(ATL) Memorandum, Update to Policy for Unique Identification (UID) of Tangible Items, 3 Sep 2004

USD(ATL) Memorandum, Update to Policy for Unique Identification (UID) of Tangible Items New Equipment, Major Modifications, and Reprocurements of equipment and Spares, 26 Nov 2003

USD(CPO) Memorandum, Advance Payments to Non-Department of Defense (DoD) Federal Agencies for Interagency Acquisitions, 1 Mar 2007

107 MDA 5013.78-M, Organizational Conflict of Interest, 13 Mar 2013

108 MDA 8000.01-INS, Information Management-Information Technology Investments and Governance

109 MDA 8000.02-DIR, Missile Defense Agency Knowledge Online Portal Management and Operations

110 MDA 8100.02-INS, Wireless Mobile Devices, Date: TBD, 2016

111 MDA 8110.01-INS, Privacy Program

112 MDA 8180.01-DIR, Enterprise Records Management

113 MDA 8190.01-DIR, Electronic Collaboration with Commercial, Educational, and Industry Partners

114 MDA 8260.02-INS, MDA Master Data Catalog

115 MDA Records Management Program and Procedures Guide performed in accordance with this Performance Work Statement (PWS). Required products for each performance objective shown in Table 3.0 are included within respective PWS paragraphs.

While the Performance Objectives align specific activities to IT lines of business, the contractor performance in conjunction with the Government team and other CIO related contracts are to perform as an integrated team, with the MDA workforce defined as the customer. It is the Governments’ intent to revise this PWS during the contract period of performance as needed based on, but not limited to: DoD IT and Cybersecurity direction/guidance changes, ever changing cybersecurity threats, IT technology required modifications and upgrades, and/or BMDS RDT&E requirement changes.

Performance Objective Index Primary Location(s)

1) Architecture & Engineering Team Support HSV and COS

2) Executive, Regional, and IT Planning Services HQ, DHL, HSV, and

COS

3) IT Networks & Systems Services HSV and COS

4) Information Management Services HSV and COS

5) Enterprise Operations & Engineering Services HSV and COS

6) Unified Communications Services HSV and COS

Table 3.0: Performance Objective Index and Locations

The following IT Functions listed in Table 3.0.1 below shall be performed in the performance of this effort:

# IT Functions

Perform customer outreach and evaluate customer requirements addressing business/mission needs and evaluate against existing portfolio to determine appropriate solution set

Evaluate emerging technologies to determine applicability to MDA RDT&E mission requirements and coordinate inclusion into MDA reference architectures

Organize and provide technical advisory and quality assurance across the entire development lifecycle.

Ensure enterprise data is leveraged within the MDA data governance model across functional areas in support of Agency missions

Evaluate compliance with enclave security requirements in accordance with applicable DoD IA requirements

6 Perform as a technical expert to evaluate proposed and existing architectural solutions

# IT Functions

Evaluate the security of proposed architectural solutions to ensure compliance with DoD regulations, mandates, roadmaps, and policy

Perform evaluation and review of proposed IT solutions to ensure the incorporation of DoD directed IA vulnerability solutions, e.g., IAVAs, and provide expert guidance relating to the presence of threats and vulnerabilities should the design be adopted and implemented into the MDA IT Enterprise

Review and provide expert analysis of DoD Information Systems (IS) and Platform Information Technology (PIT) systems

Perform expert analysis of IA and/or IA-enabled products to ensure compliance with DoD evaluation and validation requirements. (NIAP, APL, Common Criteria, etc…)

Provide technical expertise on enclave environment security requirements with applicable DoD cybersecurity requirements to ensure confidentiality, integrity, availability, authentication, and non-repudiation

Provide expert recommendations / guidance on best practices to mitigate vulnerabilities on information systems or system components to ensure Risk Management Framework requirements are incorporated into proposed solutions

Provide expert support to government contracting officer’s technical representatives for associate contractors in the execution and administration of new project and baseline tasks through development of descriptive task language and assisting with government cost estimates, followed by assisting with government technical evaluation and recommendations to the Contracting Officer.

Provide expert support to assist the government on quality assurance of the associate contractors’ execution of their contracted tasks. MDA/IC has established numerous tasks with incentive fee measurements that require extensive monitoring and management and the TEAMS contractor is expected to assist heavily in this area.

Advise and assist the government to improve the operational effectiveness and efficiency of the MDA Office of the CIO in the delivery of IT solutions to the Agency.

Table 3.0.1: IT Functions

3.1 Performance Objective #1: Architecture & Engineering (A&E) Team Support

3.1.1 The contractor shall provide technical expertise to perform the functions identified in Table

3.0.1 for A&E activities in support of Research, Development, Test & Evaluation (RDT&E) oversight while following the regulatory guidance identified in paragraph 2.1 and producing the Key Products/Technical Data identified in paragraph 3.1.11.

3.1.2 The contractor shall conduct research of existing and emerging technological solutions being evaluated or used within the Department of Defense and perform analysis across the Agency’s functional areas using demand management patterns to provide recommendations for new capabilities or adjustments to existing capabilities to allow the Missile Defense Agency to gain efficiencies, improve effectiveness, and improve cybersecurity of the IT solutions deployed to our customers and to allow the Office of the CIO to quickly adapt to current and evolving Agency mission priorities.

3.1.3 The contractor shall conduct research of existing and emerging technological solutions being evaluated or used within the Department of Defense and develop a plan for customer outreach to promote and educate customers and stakeholders on the use and value of the Agency enterprise architecture, gather user requirements, determine the gaps between the current and the target architecture, and develop plans for transitioning to target architecture. In this endeavor, the contractor shall develop an understanding of Agency lines of business, how the customers use information technology to address their mission needs, and how innovative technologies can assist the lines of business to be more effective and efficient in the performance of their mission.

3.1.4 The contractor shall provide enterprise architecture guidance, support, and coordination to customers and IT project teams; facilitating technical integration across the IT enterprise by participating in test planning, validation, and reviews.

3.1.5 The contractor shall provide oversight to the MDA CIO Data Governance program to maximize the usability, availability and security of the data used in the MDA enterprise. The contractor shall establish and maintain organizational support for the data governance program and collaborate with stakeholders across the Agency to establish and gain consensus on priorities, standards, definitions, policies and rules associated with ownership and use of Agency information.

3.1.6 The contractor shall provide customer outreach and training to educate business, mission and technical communities on the purpose and benefits of data governance, and assist with obtaining acceptance and adoption of data governance practices; partnering with internal and external business and mission stakeholders to promote solutions that provide strategic value and identify opportunities for improving the quality of shared data assets.

3.1.7 The contractor shall provide A&E technical expertise to monitor and evaluate deliverables of associate contractors. The contractor shall perform research and analysis of emerging and existing technologies and use the results to evaluate A&E technical designs that are delivered and provide results of the evaluation which will include whether the designs are sound and will implement well into the existing MDA Enterprise Architecture. The contractor will perform quality assurance and quality control of products delivered to MDA to ensure they meet DoD and MDA compliance requirements. In addition, the contractor shall coordinate and conduct governance and portfolio management activities associated with ensuring compliance with the enterprise architecture for the proffered solutions.

3.1.8 The contractor shall performing expert review of consolidated integrated architecture and engineering solutions and activities to include, but not limited to, a full Enterprise network management analysis with A&E recommendations, a full Enterprise IT systems analysis with A&E recommendations, and a full Cybersecurity analysis with A&E recommendations for the Enterprise unclassified, Secret and Top Secret/Sensitive Compartmented Information (TS/SCI) environments.

3.1.9 The contractor shall prepare and deliver a weekly activity report to the Government and actively participate in recurring coordination meetings; presenting schedules, metrics, technical analysis findings, reports, plans, and roadmap.

3.1.10 A&E Team Support Key Products/Technical Data: technical positions, analysis, findings, recommendations, briefings, and reports; schedules; trip reports; monthly metrics;

Executive briefings; and weekly activity report.

Performance Objective #1 Standards Objective Standard Acceptable Quality Level (AQL)

A&E Team Support

Quality – Error-free and technically accurate

No more than two validated customer complaints, in writing, within the monthly reporting period across all locations

Quality – Compliant with applicable DoD, MDA and local security directives policies, procedures and instructions for safeguarding classified information

Zero validated violations, in writing, within the monthly reporting period across all locations

Quality/Business Relations – Works independently with minimum corrective action required

No more than two corrective action events within the monthly reporting period across all locations. Note: A corrective action event is when an action is taken, in a corrective manner, due to lower than satisfactory performance

Schedule – Timely – Meets schedules. Completes actions within specified deadlines

No more than one late or missed scheduled event within the monthly reporting period across all locations

Table 3.1.1: Performance Objective #1 Standards

3.2 Performance Objective #2: Executive, Regional, and IT Planning Services

3.2.1 The contractor shall provide expert Advisory and Assistance Services to the MDA Office of the CIO in direct support to the MDA CIO as well as support to Regional and IT Planning Services across the MDA IT Enterprise directly supporting the MDA CIO and other IC leaders to deliver IT services, perform customer outreach, collaborate with customers in support of problem resolution, provide quality control initiatives to ensure products and services being delivered by associate contractors meet the governments expectations, are compliant with DoD requirements, and meet the objectives of DoD consolidation initiatives.

3.2.2 The contractor shall provide technical expertise in both Colorado Springs, CO and Huntsville, AL to monitor and evaluate deliverables of associate contractors. The contractor shall perform research and analysis of emerging and existing technologies and use the results to evaluate technical designs that are delivered and provide results of the evaluation which will include whether the designs are sound and will implement well into the existing MDA Enterprise Architecture. The contractor will perform quality assurance and quality control of products delivered to MDA to ensure they meet DoD and MDA compliance requirements.

3.2.3 The contractor shall provide expert advisory and assistance services for regional Enterprise execution and operations; including, but not limited to, identification of concerns and issues, corrective action recommendations, and implementation resolution oversight. The contractor shall perform services listed in Table 3.0.1 for regional leaders and the MDA CIO in support of RDT&E oversight while complying with regulatory guidance.

3.2.4 The contractor shall provide senior IT expertise to advise and assist the government in leading and managing networking, architecture & engineering, enterprise operations, and IT projects across IT functional areas and service lanes to facilitate integrated service delivery, established acquisition timelines, and project synchronization across contracts, across service delivery models, and in compliance with federal mandates and DoD policies. Review service catalog semi-annually and recommend improvements.

3.2.5 The contractor shall perform expert evaluation and review of networks, architecture, engineering, and enterprise operations and progress toward life- cycle maintenance efforts (e.g., analyzing documented requirements, reviewing technical direction letters, and assessing technical evaluations). This includes the review and analysis of other prime contractor technical products and proposed solutions for compliance with MDA and DoD mandates while advising the government of the results.

3.2.6 The contractor shall perform the activities supporting the CIO’s Office as part of the MDA/IC organization, the IC Regional Locations, and the MDA Policy and Plans organization, as identified in paragraph 3.2.7, producing the Key Products/Technical Data identified in paragraph 3.2.9.

3.2.7 The Executive, Regional, or IT Planning Services tasks below shall be performed.

3.2.8 The contractor shall perform the following Executive, Regional, and IT Planning Services activities in accordance with the regulatory guidance identified in paragraph 2.1:

a. Day-to-Day. The contractor shall assist in the technical and business operations covering all Executive, Regional, or IT Planning Services activities. Monitor day-to-day execution and operations of current and new networks and systems and provide expert analysis and guidance relating to compliance with DoD roadmaps and consolidation initiatives. Assist with developing strategies and plans, for emerging and future technology initiatives based on the A&E products.

Maintain, review, and update processes and procedures.

1) Assist with and provide recommendations on developing Executive, Regional, or IT

Planning Services strategy, conducting reviews of existing technologies and systems, reviewing policies Federal, DoD, and MDA guidance, processes, and procedures for CIO related activities.

2) Review and evaluate current configurations, Security Technical Implementation Guide

(STIG) / Information Assurance Vulnerability Management (IAVM) checklists, and new technologies for technical soundness, performance, and adherence to standards, plans, goals, and security considerations.

3) Prepare briefings, white papers, information papers, recommendations, governance metrics, and policy assessments.

4) Engage in daily execution processes, such as classified document accountability, draft electronic tasking (referred to as E-Tasker) responses, and maintenance of policy, planning, and investment records.

5) Identify MDA directives, instructions, manuals, guidance, workflows, and processes impacts and recommended changes required to comply with Federal and DoD guidance and associated reporting.

6) Support the development, maintenance, execution, and monitoring of 2LTR Annual

Service Level Agreements (SLA) construct and actual Quarterly IT Service (Core vs Customer) Metrics Reporting by providing the related metrics.

7) Engage in customer identified concerns and present recommendations to the

Government Regional Leads.

8) Prepare and submit trip reports.

9) Assist and support MDA Office of the CIO government leads in support of meetings, conferences, presentations, and briefings as requested.

10) Prepare and deliver a weekly activity report covering all Executive, Regional, or

IT Planning Services activities.

b. Executive Services. The contractor analyst shall perform the following executive services for the CIO.

1) Maintain/post the CIO IT-related Directives, Policies & Guidance Documents

Reference Materials Library on the MDA UMKO and CMKO portal sites.

2) Administer the electronic tasking (E-Tasker) CIO organization unclassified and classified mailboxes for incoming taskers, both from organizations internal and external to MDA, distribute tasking to the correct CIO organization, schedule and monitor tasking response, review tasking response for correct format, coordinate CIO review and approval of tasking response, and once approved distribute response to either internal or external MDA organization.

3) Orchestrate the CIO staff meeting: schedule the meeting, propose the agenda, identify and secure approval of venue for events, prepare and distribute meeting notices, distribute agenda, distribute call for charts containing Internal Controls and DoD reporting metrics, assist with access control, post briefings (shall include executive-level CIO information and/or decision briefings), prepare Executive read-ahead package, facilitate meeting, prepare minutes and action item tracking, post approved minutes to include decisions, track action item closure, and provide recommendation for action item closure. Note: CIO staff includes all CIO organizations both Government and Contractor members. Note: CIO Staff Meeting documentation is posted to the

UMKO.

4) Prepare CIO technical and financial briefings, whiteboards, and white papers for CIO communications during executive level meetings and briefings, internal and external to the agency.

5) Maintain currency with DoD guidance, IT technology, and IT business practices.

Provide recommendations to the CIO on potential changes based on DoD guidance, IT technology, and IT business practices

6) Draft the overall CIO weekly activity report from across the CIO organization, for CIO communications to other executives.

c. IT Governance and Management Services. As noted in paragraph 3.0, while the Performance Objectives stovepipe specific technical activities, the contractor’s performance in conjunction with the Government team and other IT-related contract actions are to perform as an integrated team, with the MDA workforce defined as the customer.

1) Orchestrate the IT Technical Board Meetings. The contractor shall perform administration, quality assurance and oversight management of the MDA IT-related chartered board processes. The contractor shall schedule the meeting; propose the agenda in coordination with the production contractors, identify and secure approval of venue for events (some technical meetings and associated documentation are classified), prepare and distribute meeting notices;

distribute agenda; compile production contractor submitted briefings; manage production contractor briefing templates; prepare read-ahead package; facilitate meeting; prepare minutes and action item tracking, secure approval, post approved minutes to include decisions and action items; prepare, secure approval, and distribute Project Champion letter assignments; track action item closure; and ensure board data is populated into respective dashboards. The contractor shall provide monthly status/performance metrics and trending analysis to the Government.

2) Orchestrate the IT Governance Workflows. The contractor shall, on an annual basis, orchestrate the review process of the IT Governance workflows and update the workflows as appropriate. The IT Governance Workflows address: Asset Management, Business Automation Management, Cybersecurity Management, Financial Management, IT Services Management, Privacy and Records Management, Service Level Agreements (SLAs), and Unified Communications; as well as things like E-Tasker and MDA Workforce in-processing. The contractor shall orchestrate the establishment of new workflows based on: the need for more detailed refinement of a current workflow, DoD IT and/or Cybersecurity direction/guidance changes, and/or MDA oversight/requirement changes. This will also include interaction with Director of Acquisition processes that shall result in IT investments and Services delivery. The contractor shall seek opportunities to support governance workflows related to IT requirements fulfillment associated with any 2 lt requirement or acquisition vehicle.

d. Regional IT Services. The contractor IT/Network specialist shall perform the following activities for their Region.

1) Lead and assist with customer outreach and resolution of IT service issues.

2) Engage in facility workspace management and planning at each region, tracking all local and Enterprise-related proposed changes as well as verifying physical security plans; to include office consolidation and facility infrastructure planning, implementation, and/or migration.

3) Engage and support the acquisition process for unique regional requirements by proactively participating in the MDA chartered Project Steering Committee (PSC) review and approval of the requirements, providing Procurement Initiation Documents (PID) package requirement content, and Engineering and Architecture Board (EAB) reviews of designs and implementations.

4) Monitor, assess, and report monthly the trending metrics by region on: inventory levels, regional project status, open and closed IT request status, and in/out processing moves.

e. IT Policy and Planning Services. The contractor analyst shall assist the IT Policy and

Planning office with the overall CIO office Planning, Programming, Budgeting, and Execution (PPBE) processes for the CIO’s portfolio management integration of the CIO approved architecture with the current baseline inventories to identify the investment best mix for Capital Planning and Investment Control (CPIC) while continuously monitoring cost, schedule and performance. While most of the CIO activities support the Enterprise Information Environment (EIE) Mission Area (EIEMA), some CIO activities support the Warfighting Mission Area (WMA) or the Business Mission Area (BMA).

1) Assist with CIO office PPBE activities to include external organization/vendor coordination, such as circuit ordering and billing reconciliation.

2) Perform and provide critical analysis, recommendations, alternatives, and documentation for interface activities to external agencies such as Office of the Secretary of Defense (OSD), Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics (OUSD(AT&L), High Performance Computer Modernization Program (HPCMP), and the Defense Information Systems Agency (DISA).

3) Assist with CIO office DoD database population, analysis and reporting, ensuring consistency across the DoD IT Portfolio Registry (DITPR), IT Systems Inventory Database, DoD

Information Technology Investment Portal (DITIP), and the Select and Native Programming- Information Technology (SNaP-IT) reporting. Provide DITPR and DITIP Reports. These activities require across organization coordination with the MDA DITPR Administrators, MDA IT Systems Inventory lead, and the respective MDA ISSM/ISSO prior to any modifications.

Ensure reported metrics are available for E-Tasker response authors.

4) Assist in collecting and analyzing data and develop IT reports required for DoD, OSD, and Federal government (for example: Organizational Execution Plan (OEP), Data Center Reports, Out of Cycle OEP Responses, Cloud Computing Report, and etc.).

5) Coordinate, prepare, and secure approval for internal agency Service Level

Agreements (SLAs) in accordance with the Director’s approved IT business rules.

6) Maintain, annually, the SOP to include as a minimum: Collecting Service Line appendix data; Forecasting cost through the Future Years Defense Program (FYDP);

Orchestrating 2LTR SLA coordination and Technical Interchange Meetings (TIMs); SLA Finalization Verification with 2LTR; Approval Signature Process (CIO and 2LTR); Distribution of Signed SLA; and Execution of Signed SLA.

f. MDA National, Multinational, and other Conferences Orchestration. The IT/Network

Specialist shall orchestrate IT services for conferences and meetings pertaining to networks, architecture, engineering, and enterprise operations at department, Agency, DoD, Federal, and/or private sector meetings. Make recommendations and engage in assigned forums, which include efforts such as reviewing documentations presented, proposing agenda, identifying location, identifying IT configurations and configuration facility and security requirements, assisting with presentations, and preparing for meetings.

1) Maintain annually the SOP to include but not limited to: orchestrate Conference IT requirement coordination; conference planning, scheduling, and acquisition/procurement documentation; conference configuration modification/update staging and testing; and meaningful metrics.

2) Present 120 day-out (120 days prior to conference) Conference briefing on conference plans, configurations, activities, and status.

3) Present 60 day-out Conference briefing on conference plans, configurations, facility preparations, security preparations, activities, and status.

4) Present 10 day-out Conference briefing on conference plans, configurations, facility preparations, security preparations, activities, and status. Track contractor readiness (to include shipments and travel).

5) Provide Conference Report containing as a minimum: metrics, observations, and lessons learned.

3.2.8 Executive, Regional, and IT Policy Support Provider Key Products/Technical Data:

SOPs; regionally unique scheduling, monitoring, tracking, and reporting; CIO Staff Meeting announcements, agenda, briefings, minutes, and action item tracking; CIO E-Tasker unclassified and classified mailbox tasking and responses; Executive meeting briefings, whiteboards, and white papers; CIO weekly activity report; Workflows; SLAs; Conference briefings and reports; technical positions, findings, and reports; schedules; trip reports; and monthly metrics.

Performance Objective #2 Standards Objective Standard AQL

Executive, Regional, and IT Policy Support

Quality – Error-free and technically accurate

No more than two validated customer complaints, in writing, within the monthly reporting period across all locations

Quality – Compliant with applicable DoD, MDA and local security directives policies, procedures and instructions for safeguarding classified information

Zero validated violations, in writing, within the monthly reporting period across all locations

Quality/Business Relations – Works independently with minimum corrective action required

No more than two corrective action events within the monthly reporting period across all locations.