Attachment_J-01_ITMA_PWS__TC.pdf

HQ0147-1718-R-00280004

Attachment J-01 ITMA PWS

July 2017April 27, 2018

TECHNICAL, ENGINEERING, ADVISORY and

MANAGEMENT SUPPORT (TEAMS)

Performance Work Statement (PWS) for Information Technology Management and Analysis

(ITMA)

April 27, 2018

1. Top Level Functional Requirements/Scope

1.1. Purpose

The Missile Defense Agency's (MDA) mission is to develop, test, and field an integrated, layered, ballistic missile defense system (BMDS) to defend the United States, its deployed forces, allies, and friends against all ranges of enemy ballistic missiles in all phases of flight.

The MDA Chief Information Officer (CIO), a Senior Executive Service (SES) appointment compliant with Clinger-Cohen Act (Pub. L. 104-106), is responsible for providing MDA with Enterprise (Agency-wide) Information Technology (IT) capabilities for Administrative and General Services (GENSER) capabilities servicing the MDA administrative and business requirements as well as general services for BMDS Research, Development, Test, and Evaluation (RDT&E) requirements; plus the cybersecurity lead for the BMDS fielded capabilities and MDA Enterprise. The MDA CIO appoints the MDA Information Systems Authorizing Official (AO) for all of MDA to include the BMDS fielded capabilities.

Approved for Public Release 16-MDA-8540 Figure 1.1: The Ballistic Missile Defense System

Missile defense technology being developed, tested and deployed by the United States is designed to counter ballistic missiles of all ranges—short, medium, intermediate and long. Since ballistic missiles have different ranges, speeds, size and performance characteristics, the BMDS is an integrated, "layered" architecture that provides multiple opportunities to destroy missiles and their warheads before they can reach their targets.

Ballistic missile trajectories are commonly divided into three phases of flight: boost, midcourse, and terminal. Each element will play an important role in a robust system intended to defend against hostile missiles in any phase of flight.

The BMDS system's architecture includes:

Networked sensors (including space-based) and ground- and sea-based radars for target detection and tracking;

Ground- and sea-based interceptor missiles for destroying a ballistic missile using either the force of a direct collision, called "hit-to-kill" technology, or an explosive blast fragmentation warhead; and

A command, control, battle management, and communications network providing the operational commanders with the needed links between the sensors and interceptor missiles.

The BMDS elements are:

Aegis Ballistic Missile Defense (BMD) Command, Control, Battle Management and Communications (C2BMC) Ground-based Midcourse Defense (GMD) Sensors Terminal High Altitude Area Defense (THAAD)

Each BMDS element has multiple unique components, such as: interceptors, fire control, unique sensors, element internal and external communications capabilities, unique command and control configurations, etc.

1.2 Background

The MDA mission is to develop, test, and field an integrated, layered, BMDS to defend the United States, its deployed forces, allies, and friends. The BMDS weapon system, as depicted in Figure 1.1, is made up of several elements and components. MDA is identified as a rapid acquisition agency with the mission to expedite BMDS capabilities development and testing.

MDA then fields demonstrated BMDS program capabilities as soon as they are available.

Information is a strategic asset to MDA, and as such shall be appropriately secured, shared, and made available to the maximum extent possible throughout the information life cycle to MDA workforce.

The MDA CIO office provides MDA with enterprise services, defined as: a common set of information resource capabilities designed to provide awareness of, access to, and delivery of information. Information is defined as: any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms. This advisory and assistance services requirement will ensure the Office of the CIO is able to:

Improve upon information solutions with reliable, timely, accurate information that is protected, secure, and resilient against information warfare, terrorism, criminal activities, natural disasters, and accidents.

Improve IT investment portfolio alignment with the required DoD Information Enterprise policies and guidance

Improve operational effectiveness and efficiency through superior IT Servicesservices delivery

Improve resilient communications and computing infrastructure Improve organizationally-tiered reviews, oversight, and execution to ensure IT investments are in compliance with architectures at various levels, IT standards, and related policy requirements

The MDA CIO office provides administrative net-centric enterprise services to all of MDA through a robust, globally-interconnected network environment (including infrastructure, systems, processes, and people) in which data are shared timelyquickly and seamlessly among users, applications, and platforms. MDA uses mostly DoD available shared administrative (DoD business mission area) tools, such as the Defense Agencies Initiative (DAI) electronic-business suite for government time cards, or the Defense Travel System (DTS) for government travel arrangements, or the DoD Civilian Acquisition Workforce Personnel Demonstration Project’s (AcqDemo) Contribution-based Compensation and Appraisal System (CCAS) CAS2Net system for government civilian appraisal processes. The MDA unique administrative services are all based on commercial-off-the-shelf (COTS) tools, so that sitting in a normal office environment in Alaska one can schedule the conference room for meetings while on travel to the Von Braun complex. Likewise, some administrative services are based on DoD -negotiated COTS procurements, such as Microsoft Office for emails, calendars, presentations, spreadsheets, documents, etc.

The MDA CIO office provides general net-centric enterprise services (both unclassified and classified) to MDA supporting the MDA mission for BMDS RDT&E. The general services are based on the globally interconnected, end-to-end set of information capabilities for collecting, processing, storing, disseminating, and managing information on demand to MDA government and contractor teams. The enterprise general services support such things as globally dispersed Engineering Design Reviews; test readiness reviews; element developmental laboratories technical coordination; test execution; and Executive Management Review Boards. The classified enterprise general services system is considered a ‘national security system’.

The MDA CIO has two major data centers, one on Redstone Arsenal, AL (commonly referred to as Huntsville (HSV)) and the other on Schriever Air Force Base (AFB), CO (commonly referred to as Colorado Springs (COS)) both identified as Special Purpose Processing Nodes (SPPN). The HSV data center is predominately the MDA Unclassified Center, and the COS data center is predominately the MDA Classified Center, with each providing disaster recovery, continuity of operations (DR/COOP) services to the other. Concept of Operations (CONOPS) governing the Enterprise utilizes the Information Technology Infrastructure Library (ITIL) framework and methodologies and a well-defined set of Role Based Administration (RBA) crew categories and responsibilities. The Enterprise CONOPS provides the guidance necessary to manage the increasingly complex computer and network environments while providing customers high quality supported and sustained IT services.

The MDA Enterprise includes but is not limited to: 4 Principal Sites (Fort Belvoir, VA (Headquarters - HQ); Naval Surface Warfare Center Dahlgren Division, VA (Dahlgren - DHL);

Redstone Arsenal, AL (Huntsville - HSV); and Schriever AFB, CO (Colorado Springs - COS)), 10 Major Sites, and over 135 Remote Sites connected by Wide Area Network (WAN) Services with over: 260 network enclaves connected to the MDA managed network transport as well as numerous isolated special purpose networked systems; various connections to other DoD networks; 14,000 users with about 18,000 user accounts; 3,000 wireless device users; 2,200 production servers and 400 RDT&E servers; numerous print servers with 1,000 network printers;

over 300 VTCs nodes in conference areas and office suites; and VOIP classified and unclassified telephonetelephony services.

The MDA CIO office activities related to the administrative and general services net-centric enterprise IT services are: plan, design, acquire, manage, build, populate, operate, protect, defend, maintain, and decommission.

There are many Federal and DoD regulations for implementing ITMA, see paragraph 2.1 below.

MDA is a component of DoD. The MDA Director is referred to as a “DoD Component Head” or “Head of DoD Component.” The MDA CIO is referred to as a “DoD Component CIO.”

2. Organizational Description

The CIO mission is to ensure that MDA information technology services, management and resources are administered, acquired, managed, and operated in compliance with the priorities set by the MDA Director and the goals and directives of existing statutes and DoD regulations. The MDA CIO vision is to provide effective, secure and affordable enterprise information capabilities for missile defense. MDA has standardized the delivery of core enterprise services and applications into eight Service Lines: End User Support, Unified Communications, Cybersecurity Information Assurance (IA)/ Computer Network Defense (CND), Business Automation, Portal & Data Management, Networks and Infrastructure, Data Center, and IT Planning & Solutions. See Figure 2.1 for the MDA CIO Mission, Vision, and Services depiction. MDA CIO strives to deliver integrated services through the eight Service Lines. The MDA SPPN data center configurations are both DoD Architecture Framework (DoDAF) and GlobalJoint Information Grid (GIGEnvironment (JIE) compliant and provide processing, storage, and transport of information, human interaction, systems and network management, information dissemination management, and cybersecurity functions.

Formatted: Font: 1.5 pt, Bold

Formatted: Normal, Tab stops: Not at 0.38"

Figure 2.1: MDA CIO Mission, Vision, and Services

The MDA CIO organization is depicted in Figure 2.2. Within the below CIO organization depiction the blue highlighted boxes reflect the associated requirement organizations for this contract.

Within Figure 2.2 right below the CIO is the Architecture & Engineering (A&E) Team.

The A&E Team is part of the CIO organization, comprised of Government and Contractor members. The A&E Team recommends the future MDA Enterprise (Admin/GENSERSPPN) configuration within the roadmap for implementation. The A&E Team Support requirements are contained in Performance Objective #1.

Within Figure 2.2 in the middle is the MDA 3-letter organization ICT, Information

Management & Technology Operations. The ICT organization oversees the day-to-day execution of the world-wide MDA Enterprise (Admin/GENSER). The ICT requirements are contained in Performance Objectives #23 through #6.

Within Figure 2.2 in the far right hand column, is the Regional IT Support for the major

MDA locations. The Regional IT Support organizations are the CIO’s local interface to the MDA workforce. The Regional IT Support requirements are contained within Performance Objective #2.

Figure 2.2: MDA Chief Information Officer (CIO) Organization Chart

2.1 Regulatory Guidelines

Specific regulatory guidelines are applicable throughout this requirement for accomplishment of performance objectives in Section 3. The below list identifies the regulatory guidelines and their current version, but the regulatory guidelines associated with this requirement are not limited to the below guidelines, their current version, or superseding regulations.

ICTA HQ

ICTM HSV

ICTO COS Integration & Ops Center

ICTP DHL

ICTT West

Regional IT Support MDIOC Senior Offical &

Infrastructure / Event

Support

Cyberspace

Management Office

Information

Management &

Technology Operations

Chief Information

Officer

Authorizing Offical Team Architecture &

Engineering Team

ICM ICV ICT

Headquarters

Von Braun Complex

Dahlgren Division

Western Support

IT Networks & Systems

Information Mgmt

Enterprise Ops & Eng

IT Policy & Planning

Unified Communications

Figure 2.3: Regulatory Documentation

# Title

1 National Security Presidential Directive, NSPD-23, National Policy on Ballistic Missile Defense, 16 Dec 2002

2 DoDD 5134.09, Missile Defense Agency (MDA), 17 Sep 2009

3 OMB Circular No A-130 Revised, Managing Federal Information as a Strategic Resource, 28 Jul 2016

4 Clinger Cohen Act

OMB Memorandum, “Myth-Busting 2”: Addressing Misconceptions and Further Improving Communication During the Acquisition Process, 7 May 2012

6 CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 9 Feb 2011

7 CJCSM 6510.01B, Cyber Incident Handling Program, 10 Jul 2012

8 CNSSP No. 22, Cybersecurity Risk Management, 31 Aug 2016

9 CNSSI No. 1015, Enterprise Audit Management Instruction for National Security Systems, 14 Apr 2016

10 CNSSI No. 1253, Security Categorization and Control Selections for National Security Systems, 27 Mar 2014

CNSSI No. 4014, National Information Assurance Training Standard for Information Systems Security Officers, April 2004

12 CNSSI No. 4016, National Information Assurance Training Standard for Risk Analysts, November 2005

DoD CIO Memorandum, Updated Guidance on the Acquisition and Use of Commercial Cloud Services, 15 Dec 2014

14 DoD CIO Strategy for Implementing the Joint Information Environment (JIE), 18 Sep 2013

15 DoD CIO Enterprise Service Management Framework, Edition II, 08 Nov 13

16 DoD CIO Information SharingStrategy, 04 May 2007

17 DoD CIO Lifecycle Standards for OSD IT Equipment, 15 Oct 2009

18 DoD CIO Memorandum, Migration to Windows 10 Secure Host Baseline, 20 Nov 2015

DoD CIO Memorandum, Delegation of Title 40/CCA Confirmations for Major Defense Automation Program/Major Automation Information Systems Programs, 18 May 2012

DoD CIO Memorandum, Department of Defense Commercial Mobile Device Implementation Plan, February 21, 2013

21 DoD CIO Net-Centric Services Strategy, 4 May 2007

22 DoD CIO Net-Centric Spectrum Management Strategy, 3 Aug 2006

23 DoD CIO Net-Centric Data Strategy, 9 May 2003

24 DoD CIO NetOps Strategic Vision, Dec 2008

25 DoD CIO Reference Architecture Description, Jun 2010

DoD CIO Memorandum, OMB Strategic Plan for Improving Management of Section 508 of the Rehabilitation Act of 1973, 16 Jul 2013

27 DoD CIO Information Enterprise Strategic Plan, 2010-2012

28 DoD CIO Cloud Computing Strategy, Jul 2012

29 DoD CIO Information Enterprise Architecture (DoD IEA), Version 2.0, Jul 2012

30 DoD CIO Memorandum, DoD Information Enterprise Architecture 2.0, 20 Aug 2012

DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle, May 2015

32 DoD Cybersecurity Test and Evaluation Guidebook, 1 July 2015

33 DoD Cybersecurity Culture and Compliance Initiative, 30 Sep 2015

34 DoD IEA Version 2.0, Volume I – Management Overview, Jul 2012

Regulatory Documentation

Figure 2.3: Regulatory Documentation, continued

35 DoD Information Resources Management Strategic Plan, Version 1.0, 1 Apr 2015

36 DoD IT Business Case Analysis Template, 22 Oct 2014

37 DoDI 1100.22, Policy and Procedures for Determining Workforce Mix, 12 Apr 2010

38 DoDD 3020.44, Defense Crisis Management, 4 Jun 2007

39 DoDI 3222.03, DoD Electromagnetic Environmental Effects (E3) Program, Incorporating Change 1, 8 Jan 2015

40 DoDD 3600.01, Information Operations (IO), 2 May 2013

41 DoDI 4000.19, Support Agreements, 25 Apr 2013

DoDI 4630.8 Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 30 Jun 2004

43 DoDD 4640.13, Management of Base and Long-Haul Telecommunications Equipment and Services, 5 Dec 1991

44 DoDI 4650.01, Policy and Procedures for Management and Use of the Electromagnetic Spectrum, 9 Jan 2009

45 DoDI 4650.10, Land Mobile Radio (LMR) Interoperability and Standardization, July 28, 2015

46 DoDD 4715.1E, Environment, Safety, and Occupational Health (ESOH), 19 Mar 2005

47 DODI 5015.02, DoD Records Management Program, 24 Feb 2015

48 DoDD 5144.02, DoD Chief Information Officer (DoD CIO), 21 Nov 2014

49 DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, 5 Nov 2012

DoDI 5205.13, Defense Industrial Base (DIB) Cyber Security/Information Assurance (CS/IA) Activities, 29 Jan 2010

51 DoDI 5230.24, Distribution Statements on Technical Documents, 23 Aug 2012

52 DoDD 5400.11, DoD Privacy Program, 29 Oct 2014

53 DoDI 5400.16, DoD Privacy Impact Assessment (PIA) Guidance, 14 Jul 2015

54 DoDI 5505.15, DoD Contractor Disclosure Program, 16 Jun 2010

55 DoDI 6055.01, DoD Safety and Occupational Health (SOH) Program, 14 Oct 2014

DoDI 7041.04, Estimating and Comparing the Full Costs of Civilian and Active Duty Military Manpower and Contract Support, 3 Jul 2013

57 DoDD 8000.01 Management of the Department of Defense Information Enterprise, February 10, 2009

DoDI 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 Apr 2004

DoDI 8110.01, Mission Partner Environment (MPE) Information Sharing Capability Implementation for the DoD, 25 Nov 2014

60 DoDD 8115.01, Information Technology Portfolio Management, 10 Oct 2005

61 DoDD 8140.01 Cyberspace Workforce Management, 11 Aug 2015

DoDI 8220.02, Information and Communications Technology (ICT) Capabilities for Support of Stabilization and Reconstruction, Disaster Relief, and Humanitarian and Civic Assistance Operations, 30 Apr 2009

63 DoDI 8310.01, Information Technology Standards in the DoD, 2 Feb 2014

DoDI 8320.02, Sharing Data, Information, and Information Technology (IT) Services in the Department of Defense, 5 Aug 2013

65 DoDI 8320.05, Electromagnetic Spectrum Data Sharing, 18 Aug 2011

DoDI 8320.06, Organization Unique Identification (OUID) Standards for Unique Identification of External Department of Defense Business Partners, 26 Sep 2012

DoDI 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), May 21, 2014

DoDM 8400.01-M, Procedures for Ensuring the Accessibility of Electronic and Information Technology (E&IT) Procured by DoD Organizations, 3 Jun 2011

DoDI 8420.01, Commercial Wireless Local-Area Network (WLAN) Devices, Systems, and Technologies, 3 Nov 2009

70 DoDI 8440.01, DoD Information Technology (IT) Service Management (ITSM), 24 Dec 2015

71 DoDI 8500.01, Cybersecurity, 14 Mar 2014

72 DoDI 8500.2, Information Assurance (IA) Implementation, 6 Feb 2003

73 DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 Mar 2014

74 DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

75 DoDI 8540.01, Cross Domain (CD) Policy, 8 May 2015

76 DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014

DoDI 8560.01, Communications Security (COMSEC) Monitoring and Information Assurance (IA) Readiness Testing, 9 Oct 2007

78 DoDM 8570.01-M, Information Assurance Workforce Improvement Program, 24 Jan 2012

79 DoDI 8580.01, Information Assurance (IA) in the Defense Acquisition System, 9 Jul 2004

FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

81 FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

82 FIPS PUB 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2003

83 NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012

84 NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010

NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010

NIST SP 800-39, Managing Information Security Risk, Organization, Mission, and Information System View, March 2011

NIST SP 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, 22 Jan 2015

NIST SP 800-53A revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations - Building Effective Assessment Plans, December 2014

NIST SP 800-60, Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008

90 NIST SP 800-64, Security Considerations in the System Development Life Cycle, October 2008

NIST SP 800-70 rev 2, National Checklist Program for IT Products-Guidelines for Checklist Users and Developers, February 2011

92 NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, September 2008

NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011

NSAID Net-Centric Enterprise Information Assurance (IA) Strategy Annex to the DoD IA Strategic Plan, Revision 1.0, 26 Apr 2006

USD(ATL) Memorandum, Better Buying Power 2.0: Continuing the Pursuit for Greater Efficiency and Productivity in Defense Spending, 13 Nov 2012

USD(ATL) Memorandum, Implementation Directive for Better Buying Power 2.0 -Achieving Greater Efficiency and Productivity in Defense Spending, 24 Apr 2013

97 USD(ATL) Fact Sheet, Better Buying Power, Nov 2013

2.2 Data Rights

The contractor shall comply with government data rights in accordance with the Defense Federal Acquisition Regulations Supplement (DFARS), as identified below in the PWS and incorporated in the contract:

All technical data (TD) and computer software (CS), algorithms and related models (see DFARS 252.227-7013 and 252.227-7014) to be produced or developed under this contract shall be delivered to the Government with unlimited data rights. The TD and models shall be delivered to the contracting officer in its entirety at any point during the period of performance (POP) of this contract upon written request of the contracting officer or by the end of the contract. The TD and models are to be developed with only Government funds. Do not use open source computer software unless prior written approval is received from the contracting officer. All copyrights for updated and newly developed technical data and models will be assigned to the Government (see DFARS 252.227-7020, incorporated herein).

3. Performance Objectives and Detailed Requirements

USD(ATL) Memorandum, Update on DoD Implementation Plan for Electronic Subcontract Reporting System ( eSRS), 23 Aug 2006

99 USD(ATL) Memorandum, Cash Flow Tool for Evaluating Alternative Financing Arrangements, 27 apr 2011

100 USD(ATL) DoD Efficiencies Key Points 2010

101 USD(ATL) Memorandum, Document Streamlining - Life-Cycle Sustainment Plan (LCSP), 14 Sep 2011

102 USD(ATL) Research and Technology Protection Plans, 30 Jun 2000

USD(ATL) Memorandum, Improving the Accessibility of Government Information through Section 508 of the Rehabilitation Act of 1973, as Amended (29 U.S.C. § 794d), 15 Mar 2012

104 USD(ATL) Memorandum, Update to Policy for Unique Identification (UID) of Tangible Items, 3 Sep 2004

USD(ATL) Memorandum, Update to Policy for Unique Identification (UID) of Tangible Items New Equipment, Major Modifications, and Reprocurements of equipment and Spares, 26 Nov 2003

USD(CPO) Memorandum, Advance Payments to Non-Department of Defense (DoD) Federal Agencies for Interagency Acquisitions, 1 Mar 2007

107 MDA 5013.78-M, Organizational Conflict of Interest, 13 Mar 2013

108 MDA 8000.01-INS, Information Management-Information Technology Investments and Governance

109 MDA 8000.02-DIR, Missile Defense Agency Knowledge Online Portal Management and Operations

110 MDA 8100.02-INS, Wireless Mobile Devices, Date: TBD, 2016

111 MDA 8110.01-INS, Privacy Program

112 MDA 8180.01-DIR, Enterprise Records Management

113 MDA 8190.01-DIR, Electronic Collaboration with Commercial, Educational, and Industry Partners

114 MDA 8260.02-INS, MDA Master Data Catalog

115 MDA Records Management Program and Procedures Guide

Regulatory Documentation

Formatted: Font: Bold, Condensed by 0.05 pt

Formatted: Normal

Formatted: Hidden

Table 3.0 below contains the Performance Objectives Index outlining the objectives to be performed in accordance with this Performance Work Statement (PWS). Required products for each performance objective shown in Table 3.0 are included within respective PWS paragraphs.

While the Performance Objectives stovepipealign specific activities to IT lines of business, the contractor performance in conjunction with the Government team and other CIO related contracts are to perform as an integrated team, with the MDA workforce defined as the customer.

Our cross organization cross contract coordination is the key to the success in servicing the MDA workforce. It is the Governments’ intent to revise this PWS during the contract period of performance as needed based on, but not limited to: DoD IT and Cybersecurity direction/guidance changes, ever changing cybersecurity threats, IT technology required modifications and upgrades, and/or BMDS RDT&E requirement changes.

Performance Objective Index Primary Location(s)

1) Architecture & Engineering Team Support HSV and COS

2) Executive, Regional, and IT Planning Services HQ, DHL, HSV, and

COS

3) IT NetworkNetworks & Systems Services HSV and COS

4) Information Management Services HSV and COS

5) Enterprise Operations & Engineering Services HSV and COS

6) Unified Communications Services HSV and COS

Table 3.0: Performance Objective Index and Locations

The following IT Functions listed in Table 3.0.1 below shall be performed in the performance of this effort:

# IT Functions

Perform customer outreach and evaluate customer requirements addressing business/mission needs and evaluate against existing portfolio to determine appropriate solution set

Evaluate emerging technologies to determine applicability to MDA RDT&E mission requirements and coordinate inclusion into MDA reference architectures

Organize and provide technical advisory and quality assurance across the entire development lifecycle.

Formatted: Font: Bold, Condensed by 0.05 pt

Formatted: Font: 12 pt, Not Bold, Condensed by 0.05 pt

Formatted: Heading 1, Centered, Space Before: 0 pt, Line spacing: Exactly 13.6 pt

Formatted: Font: Not Bold

# IT Functions

Ensure enterprise data is leveraged within the MDA data governance model across functional areas in support of Agency missions

Evaluate compliance with enclave security requirements in accordance with applicable DoD IA requirements

6 Perform as a technical expert to evaluate proposed and existing architectural solutions

Evaluate the security of proposed architectural solutions to ensure compliance with DoD regulations, mandates, roadmaps, and policy

Perform evaluation and review of proposed IT solutions to ensure the incorporation of DoD directed IA vulnerability solutions, e.g., IAVAs, and provide expert guidance relating to the presence of threats and vulnerabilities should the design be adopted and implemented into the MDA IT Enterprise

Review and provide expert analysis of DoD Information Systems (IS) and Platform Information Technology (PIT) systems

Perform expert analysis of IA and/or IA-enabled products to ensure compliance with DoD evaluation and validation requirements. (NIAP, APL, Common Criteria, etc…)

Provide technical expertise on enclave environment security requirements with applicable DoD cybersecurity requirements to ensure confidentiality, integrity, availability, authentication, and non-repudiation

Provide expert recommendations / guidance on best practices to mitigate vulnerabilities on information systems or system components to ensure Risk Management Framework requirements are incorporated into proposed solutions

Provide expert support to government contracting officer’s technical representatives for associate contractors in the execution and administration of new project and baseline tasks through development of descriptive task language and assisting with government cost estimates, followed by assisting with government technical evaluation and recommendations to the Contracting Officer.

Provide expert support to assist the government on quality assurance of the associate contractors’ execution of their contracted tasks. MDA/IC has established numerous tasks with incentive fee measurements that require extensive monitoring and management and the TEAMS contractor is expected to assist heavily in this area.

Advise and assist the government to improve the operational effectiveness and efficiency of the MDA Office of the CIO in the delivery of IT solutions to the Agency.

Table 3.0.1: IT Functions

3.1 Performance Objective #1: Architecture & Engineering (A&E) Team Support

3.1.1 The contractor shall provide technical expertise to perform the functions identified in Table 3.0.1 for A&E activities in support of Research, Development, Test & Evaluation (RDT&E) oversight while following the regulatory guidance identified in paragraph 2.1 and producing the Key Products/Technical Data identified in paragraph 3.1.11.

3.1.2 The contractor shall conduct research of existing and emerging technological solutions being evaluated or used within the Department of Defense and perform analysis across the

Formatted: List Paragraph, Outline numbered + Level: 2 + Numbering Style: 1, 2, 3, … + Start at: 1 + Alignment: Left + Aligned at: 0.19" + Indent at: 0.44"

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Font: Font color: Custom Color(RGB(35,31,32)), (Intl) Times New Roman, Not Expanded by / Condensed by

Agency’s functional areas using demand management patterns to provide recommendations for new capabilities or adjustments to existing capabilities to allow the Missile Defense Agency to gain efficiencies, improve uponeffectiveness, and improve cybersecurity of the IT solutions deployed to our customers and to allow the Office of the CIO to quickly adapt to current and evolving Agency mission priorities.

3.1.3 The contractor shall conduct research of existing and emerging technological solutions being evaluated or used within the Department of Defense and develop a plan for customer outreach to promote and educate customers and stakeholders on the use and value of the Agency enterprise architecture, gather user requirements, determine the gaps between the current and the target architecture, and develop plans for transitioning to target architecture. In this endeavor, the contractor shall develop an understanding of Agency lines of business, how the customers use information technology to address their mission needs, and how innovative technologies can assist the lines of business to be more effective and efficient in the performance of their mission.

3.1.4 The contractor shall provide enterprise architecture guidance, support, and coordination to customers and IT project teams; facilitating technical integration across the IT enterprise by participating in test planning, validation, and reviews.

3.1.solutions 5 The contractor shall provide oversight to the MDA CIO Data Governance program to maximize the usability, availability and security of the data used in the MDA enterprise. The contractor shall establish and maintain organizational support for the data governance program and collaborate with reliable, timely, and accuratestakeholders across the Agency to establish and gain consensus on priorities, standards, definitions, policies and rules associated with ownership and use of Agency information.

3.1.6 The contractor shall provide customer outreach and training to educate business, mission and technical communities on the purpose and benefits of data governance, and assist with obtaining acceptance and adoption of data governance practices; partnering with internal and external business and mission stakeholders to promote solutions that is protected, secure, and resilient against information warfare, terrorism, criminal activities, natural disasters, and accidents by performing the Information Assurance Workforce Systemprovide strategic value and identify opportunities for improving the quality of shared data assets.

3.1.7 The contractor shall provide A&E technical expertise to monitor and evaluate deliverables of associate contractors. The contractor shall perform research and analysis of emerging and existing technologies and use the results to evaluate A&E technical designs that are delivered and provide results of the evaluation which will include whether the designs are sound and will implement well into the existing MDA Enterprise Architecture and Engineering functions, as defined in Federal and DoD regulatory guidance. The contractor will perform quality assurance and quality control of products delivered to MDA to ensure they meet DoD and MDA compliance requirements. In addition, the contractor shall coordinate and conduct governance and portfolio management activities associated with ensuring compliance with the enterprise architecture for the proffered solutions.

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Font color: Auto

Formatted: Font: Times New Roman, 12 pt, Font color: Auto

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Font color: Auto

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Font: (Intl) Times New Roman, Not Expanded by / Condensed by

Formatted: Body Text

Formatted: Font: Font color: Auto

Formatted: Font: Font color: Auto

Formatted: Not Expanded by / Condensed by

Formatted: Font color: Auto

3.1.8 The contractor shall advise and provide assistance to the Government A&E Team members by performing expert review of consolidated integrated architecture and engineering solutions and activities to include, but not limited to, a full Enterprise network management analyses andanalysis with A&E recommendations, a full Enterprise IT systems analyses andanalysis with A&E recommendations, and a full Cybersecurity analyses andanalysis with A&E recommendations for the Enterprise unclassified, Secret and Top Secret/Sensitive Compartmented Information (TS/SCI) environments.

3.1.9 The contractor shall perform the functions as identified in Figure 3.1.1 containing the list of A&E Team Support IASAE Level II and III Functions, while executing the tasks in paragraph 3.1.3, producing the Key Products/Technical Data identified in paragraph 3.1.4.

Figure 3.1.1: A&E Team Support IASAE Level II and III Functions

# IASAE Level II Functions 1 Identify information protection needs for the Network Environment (NE).

Define NE security requirements in accordance with applicable DoD IA requirements.

3 Design secure architecture for use within the NE.

4 Design secure architecture for new or existing network system(s).

Architect/Engineer network security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.

Develop approaches to mitigate NE vulnerabilities and recommend changes to network or network components as needed.

Ensure network/system designs support the incorporation of DoD directed IA vulnerability solutions, e.g., IAVAs.

8 Develop IA architectures and designs for DoD IS/PIT.

9 Assess threats to and vulnerabilities of the NE.

Identify, assess, and recommend IA or IA-enabled products (compliant with DoD evaluation and validation requirements) for use within an NE

Ensure that the implementation of security designs properly mitigate identified threats.

12 Evaluate security architecture and design adequacy and effectiveness.

13 Ensure the implementation of NE IA policies into system architectures.

Ensure the implementation of subordinate Computing Environment (CE) IA policies is integrated into the NE system architecture.

Architecture and Engineering (A&E) Team Support

Figure 3.1.1: A&E Team Support IASAE Level II and III Functions, continued

3.1.2 Any and all of the above defined A&E Team Support IASAE Level II and III Functions may be executed for the MDA Enterprise. The IASAE must comply with the BMDS Security Classification Guide (SCG) and the respective element/component unique SCG and Program Protection Plans. Per DoDI 8500.01 personnel filling IASAE positions must be qualified and sign a Statement of Acceptance of Responsibilities.

# IASAE Level III Functions 1 Identify information protection needs for the enclave environment.

Define enclave environment security requirements in accordance with applicable DoD IA requirements.

3 Design secure architecture for use within the enclave environment .

Design secure architecture for new or existing enclave environment system(s), network(s), and computer(s).

Architect/Engineer enclave environment security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.

Develop approaches to mitigate enclave environment vulnerabilities and recommend changes to system or system components as needed.

Ensure enclave system, network, and computer designs support the incorporation of DoD directed IA vulnerability solutions, e.g., IAVAs.

8 Assess threats to and vulnerabilities of the enclave environment.

Identify, assess, and recommend IA or IA-enabled products (compliant with DoD evaluation and validation requirements) for use within an enclave environment.

Ensure that the implementation of security designs properly mitigate identified threats.

11 Evaluate security architecture and design adequacy and effectiveness.

Ensure that enclave (systems, networks, and computers) incorporate security architecture guidelines.

Ensure the implementation of enclave environment IA policies into system architectures.

Ensure the implementation of subordinate Computing Environment (CE) and NE IA policies are integrated into the enclave system architecture.

Architecture and Engineering (A&E) Team Support

Cross-CIO-Contracts (CCC) phraseology means crossing all CIO organizations as well as current and future contracted activities, to include current contracts: Joint National Integration Center Research and Development Contract (JRDC), prime Northrop Grumman; MDA Information Technology Collaborative Services (MICS), prime NMR Consulting; SAP / Joint Worldwide Intelligence Communications Systems (JWICS) IT Services, prime General Dynamics Mission Systems; MiDAESS Task Order IC-02 Cybersecurity Compliance and Risk Management, prime Torch; BMDS Cybersecurity Management (CSM) and Computer Network Defense (CND) Bridge, prime Booz Allen Hamilton; and SAP/JWICS CSM, prime Booz Allen Hamilton.

A&E consolidated integrated recommendations, once approved by the CIO, may be executed on the JRDC, MICS, and/or SAP/JWICS IT Services or follow-on contracts, with reviews and impact analysis from the BMDS CSM/CND, ITMA, CCRM and/or SAP/JWICS CSM contracts, with post installation controls validation testing by the CCRM contract.

3.1.3 The contractor shall perform the following A&E Team Support activities by executing the IASAE Level II and III Functions, listed in Figure 3.1.1, plus the regulatory guidance identified in paragraph 2.1:

a. Establish, within 30 days of contract start, and maintain the MDA Unclassified Knowledge Online (UMKO) portal site, Classified Knowledge Online (CMKO) portal site, JWICS portal site, and enterprise SAP system file repositories where all key products/technical documentation (compliant with DoDAF v2.0 requirements) such as Annual Plans with procedures, briefings, analyses, and recommendation information (plans, data, and reports); as well as metrics, trip reports, weekly activity reports, and schedules are organized, presented to the Government A&E Team members and posted to the appropriate classification portal site.

b. Establish, within 45 days of contract start, and maintain, annually, the plans with supporting procedures, to include as a minimum: CCC Current Enterprise Environment Analysis and Recommendation coordination, and reporting; Decomposing Architectural Concept Recommendations into steps/phases for contracting executable projects; and Architectural Prioritization Strategy for Decomposed Project Execution.

c. Perform annually consolidated integrated CCC Current Enterprise: Network

Management Analysis and Recommendation; IT Systems and Data Analysis and Recommendations; Cybersecurity Analysis and Recommendation; and as CCC Strategic Architectural Weaknesses Analysis and Recommendation. Provide and post the Current CCC Enterprise Strategic Analysis and Recommendation Report to the Government A&E Team for review, modification, and concurrence, and then to the CIO for review, modification, and approval.

d. Perform annually a consolidated integrated CCC Enterprise Strategic Architecture Plan, compliant with Federal, DoD (such as Information Enterprise Architecture (IEA) v2 and Architecture Framework (DODAF) v2), and MDA repositories, that recommends the big conceptual vision and concepts on improving secure Enterprise IT services over the next five

Formatted: Font color: Auto

Formatted: Font: (Intl) Times New Roman, Not Expanded by

Formatted: Condensed by 0.05 pt years addressing: the identified Current CCC Enterprise Strategic Analysis and Recommendation Reports, DoD IT and Cybersecurity direction/guidance compliance, ever changing cybersecurity threats, ever changing IT technology, emerging user requirements/issues, and/or BMDS RDT&E requirement changes. Provide and post the consolidated integrated CCC Enterprise Strategic Architecture Plan to the Government A&E Team for review, modification, and concurrence; provide to the CCC for coordination and review; and then provide and post the updated plan to the CIO for review, modification, and approval.

e. Based on the approved consolidated integrated CCC Enterprise Strategic Architecture

Plan, establish the annual CCC Enterprise Roadmap that is compliant with Federal, DoD (such as Information Enterprise Architecture (IEA) v2 and Architecture Framework (DODAF) v2), and MDA repositories for execution over the next 5 years containing the decomposed Architectural Concepts into portfolios with timelines, and service level targets for contracting executable projects; the prioritization strategy for the decomposed project execution; and any technology refresh re-alignments or challenges that may need to be addressed. Provide and post the CCC Enterprise Roadmap to the Government A&E Team for review, modification, and concurrence; provide to the CCC for coordination and review; and then provide and post the updated roadmap to the CIO for review, modification, and approval.

f. Based on the approved annual CCC Enterprise Roadmap, prepare a briefing and present the CCC Enterprise Roadmap to the CCC (IC community) for: Future Years Defense Program (FYDP) / Capital Planning and Investment Control (CPIC) planning, budgeting, and funding;

portfolio management; and contract project initiation and execution.

g. Based on the approved annual CCC Enterprise Roadmap, track the actual portfolio and contract projects, timelines, and post installation service level performance improvements.

Provide the Government A&E Team and CIO with a monthly metrics report based on this tracking. Modify future Plans and Roadmaps based on this tracking.

h. Actively participate in the MDA chartered CIO Portfolio Management and Integration

Board (PMIB) defined processes: the Project Steering Committee (PSC) review of the requirements, providing Procurement Initiation Documents (PID) package requirement content, and Engineering and Architecture Board (EAB) reviews of the design and implementation.

i. Develop and maintain a detailed schedule looking three months forward (3-month plan) and one month back (actual dates executed) containing A&E Team timelines, technical data deliveries, executive meetings, travel, and etc.

j. Prepare and deliver a weekly activity report to the Government A&E Team.

k. Activelyand actively participate in the A&E Team regularrecurring coordination meetings with the CIO; presenting schedules, metrics, technical analysis findings, reports, plans, and roadmap.

Formatted: Font color: Custom Color(RGB(35,31,32))

Formatted: Normal, Indent: First line: 0", Right: 0"

Formatted: Font: Times New Roman, 12 pt, Font color:

Custom Color(RGB(35,31,32))

Formatted: Font: Times New Roman, 12 pt, Font color:

Custom Color(RGB(35,31,32))

Formatted: Font: Times New Roman, 12 pt, Font color:

Custom Color(RGB(35,31,32))

3.1.4 10 A&E Team Support Key Products/Technical Data: plans; Current CCC Enterprise Strategic Architectural Weakness Analysis Report; CCC Enterprise Strategic Architecture Plan; CCC Enterprise Roadmap; technical positions, analysis, findings, recommendations, briefings, and reports; schedules; trip reports; monthly metrics; Executive meetings and briefings; and weekly activity report; and portal sites.

Performance Objective #1 Standards Objective Standard AQLAcceptable Quality Level

A&E Team Support

Quality – Error-free and technically accurate

No more than two validated customer complaints, in writing, within the monthly reporting period across all locations

Quality – Compliant with applicable DoD, MDA and local security directives policies, procedures and instructions for safeguarding classified information

Zero validated violations, in writing, within the monthly reporting period across all locations

Quality/Business Relations – Works independently with minimum corrective action required

No more than two corrective action events within the monthly reporting period across all locations. Note: A corrective action event is when an action is taken, in a corrective manner, due to lower than satisfactory performance

Schedule – Timely – Meets schedules. Completes actions within specified deadlines

No more than one late or missed scheduled event within the monthly reporting period across all locations

Table 3.1.1: Performance Objective #1 Standards

3.2 Performance Objective #2: Executive, Regional, and IT PolicyPlanning Services

3.2.1 The contractor shall:

Improve operational effectiveness and efficiency through superior delivery, and Improve organizationally-tiered reviews, oversight, and execution to ensure investments are in compliance with architecture at various levels, IT standards, and related policy requirements, by performing as defined in Federal and DoD regulatory guidance.

The contractor shall advise and provide assistance for local

3.2.1 The contractor shall provide expert Advisory and Assistance Services to the MDA Office of the CIO in direct support to the MDA CIO as well as support to Regional and IT Planning Services across the MDA IT Enterprise directly supporting the MDA CIO and other IC leaders to deliver IT services, perform customer outreach, collaborate with customers in support of problem resolution, provide quality control initiatives to ensure products and services being delivered by

Formatted Table associate contractors meet the governments expectations, are compliant with DoD requirements, and meet the objectives of DoD consolidation initiatives.

3.2.2 The contractor shall provide technical expertise in both Colorado Springs, CO and Huntsville, AL to monitor and evaluate deliverables of associate contractors. The contractor shall perform research and analysis of emerging and existing technologies and use the results to evaluate technical designs that are delivered and provide results of the evaluation which will include whether the designs are sound and will implement well into the existing MDA Enterprise Architecture. The contractor will perform quality assurance and quality control of products delivered to MDA to ensure they meet DoD and MDA compliance requirements.

3.2.3 The contractor shall provide expert advisory and assistance services for regional Enterprise execution and operations; including, but not limited to, identification of concerns and issues, corrective action recommendations, and implementation resolution oversight; as well as customer outreach efforts. . The contractor shall perform services supporting listed in Table

3.0.1 for regional leaders and the CIO’s Office. The contractor shall perform servicesMDA CIO in support the IT Policy and Planning (ICTP) officeof RDT&E oversight while complying with regulatory guidance.

3.2.4 The contractor shall performprovide senior IT expertise to advise and assist the government in leading and managing networking, architecture & engineering, enterprise operations, and IT projects across IT functional areas and service lanes to facilitate integrated service delivery, established acquisition timelines, and project synchronization across contracts, across service delivery models, and in compliance with federal mandates and DoD policies. Review service catalog semi-annually and recommend improvements.

3.2.5 The contractor shall perform expert evaluation and review of networks, architecture, engineering, and enterprise operations and progress toward life- cycle maintenance efforts (e.g., analyzing documented requirements, reviewing technical direction letters, and assessing technical evaluations). This includes the review and analysis of other prime contractor technical products and proposed solutions for compliance with MDA and DoD mandates while advising the government of the results.

3.2.6 The contractor shall perform the activities supporting the CIO’s Office as part of the MDA/ICTIC organization, the IC Regional Locations, and the MDA/ICTP Policy and Plans organization, as identified in paragraph 3.2.37, producing the Key Products/Technical Data identified in paragraph 3.2.4. This performance objective has no associated IA Workforce requirement9.

3.2.2 Any and all of the7 The Executive, Regional, or IT PolicyPlanning Services tasks below mayshall be executed.