ATTACHMENT_01_Performance_Work_Statement.pdf

HQ042319R0049 ATTACHMENT 01

Performance Work Statement (PWS) For

Defense MilPay Office (DMO) Integrated Support Services

July 03, 2019

Table of Contents

1 REQUIREMENT Page 3

2 DEFINITIONS AND ACRONYMS Page 2

3 GOVERNMENT FURNISHED PROPOERTY (GFP), EQUIPMENT (GFE),

INFORMATION (GFI) AND SERVICES

4 SPECIFIC TASKS Page 15

5 APPLICABLE PUBLICATIONS Page 18

6 ATTACHMENTS Page 19

PERFORMANCE WORK STATEMENT

Defense Finance and Accounting Service (DFAS)

Defense MilPay Office Integrated Support Services

1. REQUIREMENT

1.1 Background: The Defense Finance and Accounting Service (DFAS) maintains the Defense MilPay Office (DMO) system, which supports the military pay process. The DMO system is a Government- Off-the-Shelf (GOTS) suite of end-user applications designed to improve Department of Defense (DoD) military pay personnel capability to enter and access pay-related data and other information. The DMO system is a repository of applications assessable from a single sign-on. These applications include: Web Master Military Pay Account (WebMMPA), Transaction Reporting Module (Web DMO), MILPAYSAM, Business Intelligence reporting module (DMO-BI) and Worksheets. The DMO system is the input system of record and feedback interface for Defense Joint Military Pay System (DJMS) and supports both Active and Reserve Components of the Army, Navy and Air Force at DFAS Central Sites and military installations worldwide.

1.2 Hardware and Software Environment: The DMO system is composed of several interrelated web-based applications. Each application has a distinct function as described below:

• Transaction Reporting Module (Web DMO) –Web DMO is the data entry application used for creating cycles and inputting transactions into those cycles. This application also provides reports, queries, and other analytical tools to authorized pay personnel.

• Web MMPA – Web MMPA provides read only access to historical information concerning a specific service member’s pay information, including querying, transaction results, pay products, management information, customer service tools, audit trails, expanded edits and pre-filled screens for error rate reduction. The Web MMPA has a comprehensive on-line user manual in support of pay transaction processing and maintaining military pay accounts.

• DMO-BI – DMO-BI is a Cognos Analytics software based Business Intelligence reporting tool that is used as the Military Pay primary reporting engine on all Military Pay transaction processing. It has a dedicated reporting database containing historical and current Military Pay information.

• MILPAYSAM – MILPAYSAM is security database and graphical user interface that allows the DMO system security administrators to access the DMO system. Access to the DMO system is provided by CAC authentication with single sign-on capability.

• User Administration Facility – The User Administration Facility is an application that manages teams and provides information about Web DMO users and organizations.

• Central Transaction Repository (CTR) – The CTR captures all transactions processed in DJMS that are returned to the DMO system.

• Each of the web applications is hosted on a web server located at DISA DECC- Mechanicsburg. The web applications utilize several DB2 databases, a structured query language (SQL) Server Database, and an Oracle Database. There is a set of three lightweight directory access protocol (LDAP) servers dedicated for the DMO system. There is also one continuity of operations (COOP) web server located at a separate DISA site. The web, LDAP, and SQL servers are Windows virtual machines. The DB2 databases are on a zLinux mainframe. Overall the DMO resources reside at DECC Mechanicsburg. The users access the website home page DFAS MilPay Repository (DMR) at https://dmoapps.csd.disa.mil/milpayrepository, which is published in all user guide information.

1.3 Communication Environment: The DMO communications requirements will be supported on DISA’s unclassified worldwide TCP/IP network (NIPERNET).

1.4 Objective: The objective of this contract is to obtain technical and engineering services to maintain the DMO system. In accordance with this PWS, the contractor shall provide the following non-personal services:

• Software design

• Software development and test

• Database design and test

• Database administration

• Problem/performance analysis

• Data transformation and test

• Assistance in the implementation and sustainment of a web-based environment

• Coordination of technical requirements with the Defense Information Systems

Agency (DISA)

• Technical assistance to programmers

• Consulting services on matters relating to application programming, database design and application engineering

• Field Support to customers worldwide (technical and operational)

1.5 Scope: The contractor shall provide support for the DMO repository of applications. In carrying out such efforts, the contractor shall resolve coding and database problems using C#, HTML, Cognos tools, JavaScript, XML, .net, DB2/SQL, JQuery, ASP.net, UNIX Scripts, PL/SQL, Oracle development suite and JavaScript. The contractor shall also be responsible for database administration. The contractor shall be available to provide technical support to field users worldwide to include Army, Navy (Shore and Afloat), Air Force, and deployed units. The contractor shall ensure that the DMO system remains in a steady state of audit readiness through testing, validation, and controls. Contractor support may also include gathering system data and providing it to the services (Army, Navy, and Air Force) in support of the Integrated Pay and Personnel Systems (IPPS). The contractor shall adhere to the software development lifecycle (SDLC) following the waterfall and agile methodologies as appropriate.

1.6 Period of Performance: The period of performance shall be for one (1) base year of 12 months with four

(4) 12 month option years.

1.7 General Information:

1.7.1 Hours of Operation: The Contractor shall schedule work hours to coincide with the working hours of the Government facility, 6:00 a.m. to 6:30 p.m., Monday through Friday except legal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. A 40-hour workweek is required for normal work operations, with 8 and ½ hours per day based on flexible start times. The contractor personnel may start work anytime between 6:00 a.m.

through 9:00 a.m. (lunch period of ½ hour). On occasion, work may be required anytime in https://dmoapps.csd.disa.mil/milpayrepository the 7 day 24 hour window. There is no overtime rate. The contract hourly labor rates also apply for work performed outside of normal business hours.

1.7.2 Recognized Holidays:

New Year’s Day Labor Day Martin Luther King Jr’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Independence Day Christmas Day

1.7.2.1 If the holiday occurs on a Saturday the holiday will be observed on Friday. If the holiday occurs on Sunday the holiday will be observed on Monday.

1.7.3 Place of Performance and Delivery: The work in this PWS shall be performed at the following location:

Defense Finance and Accounting Service Cleveland (DFAS-CL) A. J. Celebrezze Federal Building 1240 East 9th Street Cleveland, OH 44199-2075

All labor categories except the Program Manager are based at the DFAS-CL site.

Travel to government facilities is only allowed when approved in advance by the COR.

We allow the flexibility to have Subject Matter Experts (SME) telework when the circumstances dictate the need to telework.

1.7.4 On-Call. The Contractor shall provide on-call and after-hours support for projects (i.e., DMO) under this PWS if requested by the Contracting Officer’s Representative. On-call means if a contractor should receive a telephone call at home after they have completed a normal workday or extended hours at the Government or Contractor Site, the contractor is required to perform project work to resolve a problem from their home. If the problem cannot be resolved from home the Contractor personnel working on DMO projects having to do with testing and production problems shall be required to return to the Government site to resolve the problem.

The Contractor shall keep an after-hours log of the phone call(s) and time spent connected to DISA Mechanicsburg systems while researching the problem. Time spent working after hours will decrease remaining hours required by that resource in the next business day(s). The Contractor shall submit the after-hours log to the Contracting Officer’s Representative for approval when returning to work. The after-hours log must include the following information:

• Contractor Name(s)

• Date of the call or required connectivity

• Start time of the call or required connectivity

• Stop time of the call or required connectivity

• Project supported

• Description of work accomplished

• Signature and Date for the Contract, GPOC and Contractor Project Manager

The approved after-hours log must be submitted to the Contractor Project Manager and be included in the Performance and Cost Report documentation.

1.7.5 Security Requirements: Contractor personnel will follow the security and training requirements in DFAS 2000.1, “Force Protection Program,” DoDM 5200.01-V1-4, “DoD Information Security Program,” and DFAS 5200.1-I, “Information Security Program.” Contractor personnel will follow all host security requirements in accordance with DoD 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM),” paragraph 6-105. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer Representative (COR), who in turn will notify the Contracting Officer (CO), Site Security Office and DFAS Personnel Security Office.

1.7.6 Security Education and Training: Contractor personnel will receive initial, continuous and refresher security education training in accordance with DoDM 5200.01-V3, “DoD Information Security Program – Protection of Classified Information,” and DFAS 5200.1-I. Contractor personnel will also complete all required contractor training requirements identified in the contract.

1.7.7 Access To, Accountability For, and Safeguarding Of Controlled Unclassified Information (CUI).

The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel will safeguard CUI in accordance with DoDM 5200.01, Volume 4, “DoD Information Security Program – Controlled Unclassified Information,” and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

1.7.8 Physical Security: The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of each work day, Government facilities, equipment and materials shall be secured.

1.7.9 Contractor Travel: The Contractor shall be reimbursed for travel expenses in accordance with the

FAR 31.205-46. The Contractor may be required to travel in performance of this contract.

Contractor travel is at the convenience of the Government. All travel shall be performed in accordance with the FAR 31.205-46 and the regulations cited therein and reimbursement shall not exceed the allowable as thereby specified. Reimbursement for travel in and about the local area is not authorized. Actual expenses are limited by the above regulations. All Contractor travel must be approved by the COR in advance of actual travel and shall not exceed the funding amount in accordance with the contract. No travel or subsistence charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor's local office, normal work site, or temporary work site. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, and that includes parking expenses. Reimbursement for travel in and about the local area is not authorized.

1.7.9.1 Travel Policy: The Government shall reimburse the contractor for allowable travel costs incurred by the contractor in performance of the contract in accordance with FAR Subpart 31.205-46.

1.7.9.2 All contractor travel must be approved by the COR or the Alternate COR in advance of actual travel and cannot exceed the funding amount for travel on the awarded contract.

1.7.9.3 Relocation: Relocation costs and travel costs incident to relocation are not allowable and will not be reimbursed hereunder.

1.7.10 Data Rights: Subject to the applicable DFARS clauses.

1.7.11 Installation Entry and Common Access Card (CAC) Requirements.

1.7.11.1 The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

1.7.11.2 All contractors who require unescorted access to DFAS facilities will be required to obtain a DoD CAC. Contractor will work with the assigned DFAS Contracting Officer Representative (COR)/Trusted Agent (TA) to obtain a CAC using the Trusted Associate Sponsorship System (TASS). Under no circumstances will a CAC be issued to a contractor unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

1.7.11.3 All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/TA upon departure from the program or at the conclusion of the contract, whichever comes first. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/TA and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/TA will follow agency CAC procedures in order to issue a new CAC.

1.7.11.4 The CAC contains personally identifiable information (PII) and must be treated as a controlled item. Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/TA will report any violation or suspected violation to the Contracting Officer and DFAS Trusted Agent Security Manager (TASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from a previous engagement with another agency that CAC must be returned to that agency before issuance of a new CAC.

1.8 Training:

1.8.1.1 DoD Mandatory Contractor Personnel Training Requirements: Also referred to in this document as DFAS SPIRIT Training, the contractor shall ensure that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

1.8.1.2 Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

1.8.1.3 In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

a. Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

b. Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available from Defense Information Systems Agency (DISA) “Online IA Training” link at: http://iase.disa.mil/eta http://iase.disa.mil/eta

Upon completion of the training Contractor personnel will maintain a copy of the training certificate in PDF, submit a copy to the Contracting Officer Representative (COR), attached to the request for network access as proof of completion.

c. DFAS Force Protection's Virtual SPIRIT Conference (SPIRITCON) 2018. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

d. Antiterrorism Level One. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

e. Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

f. Combating Trafficking in Persons (CTIP) Awareness Training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

http://ctip.defense.gov/

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

g. Records Management. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

h. Insider Threat (InT) Awareness Training. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

NOTE: This list of training requirements is subject to change.

1.8.2 Training Time: The average estimated time for completion of each training module is approximately two hours or less. .

1.8.3 Training Methods:

1.8.3.1 Network Training: Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

1.8.3.2 Web-based Training: for Cyber Awareness Challenge, Antiterrorism Level One, and Combating Trafficking in Persons (CTIP) Awareness Training: If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel will take the training through the DFAS Portal upon receipt of DFAS network. The contractor personnel will retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

1.8.3.3 Contractor personnel who do not require network access but require unescorted access into a DFAS facility will receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf http://ctip.defense.gov/ https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

1.8.3.4 The prime contractor official representative will provide the COR with a group list of its personnel requiring completion of the SPIRIT training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative will submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other SPIRIT Module POCs and the COR.

1.8.4 Interaction with Contractor Personnel: The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

1.8.4.1 The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

1.8.4.2 The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

a. Contractor employees required to take the training,

b. Contractor employees who have completed the training and

c. Contractor employees who are delinquent.

1.8.4.3 Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

1.8.5 Monthly Training Status Reports: The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual SPIRIT training status of all contractor personnel.

1.9 Section 508 Compliance: This requirement is applicable to Section 508 Compliance EIT

Requirements:

1.9.1 36 CFR part 1194.21 (Subpart B) Software applications and operating systems

1.9.2 36 CFR part 1194.41 (Subpart D) Information, Documentation, and Support

1.9.3 Unless the Government invokes an exemption, all EIT products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 CFR 1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed and state the degree of compliance with the applicable standards. Additionally, the contractor shall clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., contractors or other exact web page location).

The contractor shall ensure that the list is easily accessible by typical users beginning at time of award

1.9.4 The contractor shall ensure that all EIT products and services proposed that are less than fully compliant, are offered pursuant to extensive market research, which ensures they are the most compliant products available to satisfy the solicitation’s requirements.

1.9.5 If any such product or service proposed is not fully compliant with all of the standards, the contractor shall specify each standard that is not met; provide a detailed description as to how the EIT product or service does not comply with the identified standard(s); and shall also indicate the degree of compliance.

1.10 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING: The contractor shall report

ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DFAS via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government Fiscal Year (FY), which runs October 1 through September

30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2013. Contractors may direct questions to the help desk at http://www.ecmra.mil/.

1.11 Security and Privacy Act: “Information Assurance” (September 2014) - All work performed relative to the requirement identified in the Statement of Work or Performance Work Statement is unclassified and requires access to sensitive information, covered by the Privacy Act of 1974 and other Department of Defense (DoD) and DFAS regulations. Information Assurance shall be in accordance with DFAS 8500.1-R, Information Protection and Safeguards, DoD Directive (DoDD) 8500.1, (Cybersecurity). The following requirements apply to the offeror/vendor selected for contract award resulting from this solicitation. Upon notification of selection as the successful offeror/vendor, the contractor shall follow the instructions provided at (a) through (g) of this provision, as applicable.

1.11.1 Personnel Security Investigation (PSI) Requirements for Critical Sensitive (CS) positions: No classified work will be required. However, the contractor will be working with sensitive information that is covered by the Privacy Act, PII or other government regulations and is considered CS. The contractor shall ensure sensitive information is properly safeguarded at the worksite and not removed from the worksite. In addition, the contractor will be required to comply with the security requirements associated with access to the DFAS enterprise network. All contractor personnel requiring CS access to DFAS information systems will be the subjects of a Tier 5 or equivalent investigation (SSBI, PPR or SBPR). A CS position may be occupied with a pre-investigative waiver from DFAS Personnel Security provided they possess any favorably adjudicated previous U.S. Government background investigation of NAC or higher level. Those personnel who have never had a U.S. Government background investigation may occupy a CS position once the National Agency Check (NAC) portion of the Tier 5 investigation has been completed and favorably adjudicated and a waiver has been requested and approved in accordance with DoDM 5200.02.

1.11.2 Personnel Security Investigation (PSI) Requirements for Noncritical Sensitive (NCS) Positions: Contractor personnel, other than those covered by 1.11.1 above, will require a favorably adjudicated Tier 3, or equivalent NCS level or higher investigation. No classified work will be required. However, the contractor will be working with sensitive information that is covered by the Privacy Act, PII or other government regulations and is considered NCS. The contractor shall ensure sensitive information is properly safeguarded at the worksite and not removed from the worksite. In addition, the contractor will be required to comply with the security requirements associated with access to the DFAS enterprise network. All contractor personnel requiring NCS access to DFAS information systems will be the subjects of a Tier 3 or equivalent investigation (ANACI or NACLC). An NCS position may be occupied with a pre-investigative waiver from DFAS Personnel Security provided no issues of a security concern are identified by DFAS Personnel Security after a review of all information submitted by contractor personnel.

http://www.ecmra.mil/ http://www.ecmra.mil/

1.11.3 Contractor Personnel Who Do Not Qualify for a Pre-Investigative Waiver: Contractor personnel, regardless of whether CS or NCS, who do not qualify for a pre- investigative waiver may not occupy a contractor position with DFAS until the background investigation is completed and favorably adjudicated by the DoD-CAF (Department of Defense,, Consolidated Adjudications Facility). While there is no set schedule for background investigations as each one is different, this process can be lengthy and take several months to more than one year in some cases. Should a contractor company not wish to wait for the entire process to be completed, they may withdraw the contractor applicant from further consideration by notifying Personnel Security within sixty (60) days from the date Personnel Security determines the applicant to be ineligible for a waiver. The contractor company may then submit another contractor candidate for a background investigation.

1.11.4 Standard Requirements for All Incoming Contractor Personnel: IAW standard DFAS Personnel Security policy, ALL incoming contractors, regardless of whether they possess a favorably adjudicated NCS or higher investigation, must submit a Declaration for Federal Employment (OF-306), and a new set of fingerprints* to the COR, who will submit these forms with a Contractor Request for Investigation (CRI/DFAS Form 9035) to DFAS Personnel Security.

DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Office of Personnel Management (OPM) within the past 30 days;

2. The person is currently undergoing a background investigation, or reinvestigation, by OPM or any other Federal agency;

3. The person has a background investigation currently being adjudicated by the Department of Defense Consolidated Adjudications Facility (DoD-CAF) or another CAF;

4. The person has been favorably adjudicated within the past 30 days by the DoD CAF or a CAF from any other Federal agency; or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard.

1.11.5 Compliance with Personnel Security Reporting Requirements:

Contractor personnel who are involved in any of the following incidents must notify their COR immediately or without unnecessary delay, who in turn will notify the Contracting Officer (CO), Site Security Office and DFAS Personnel Security Office. Failure to report these issues may result in termination of the contractor:

- An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency;

- Violation of any court order, to include Protective Orders or Orders of Protection;

- Delinquencies on any debt for 180 days or longer;

- Federal, State or Local tax issues or delinquencies;

- Child Support delinquencies;

- Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court;

- Confrontations of a threatening or violent nature with any DFAS civilian employee, contractor personnel or visitors.

This list is not all inclusive; any situations or incidents a person is involved in and where they’re not sure if it should be reported they should notify Personnel Security regardless. DFAS Personnel Security may temporarily suspend access, systems and/or facilities, of the person involved if it is determined to be in the interest of National Security pending the outcome of an investigation of the incident.

2. DEFINITIONS AND ACRONYMS

2.1 DEFINITIONS:

2.1.1 CONTRACTOR. A supplier or contractor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime unless otherwise stated.

2.1.2 CONTRACTING OFFICER (CO). A person with authority to enter into, administer, and /or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the CO to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5 DELIVERABLE. Anything that can be physically delivered, may include non-manufactured things such as meeting minutes or reports.

2.1.6 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.7 QUALITY ASSURANCE. The contractor’s methodology to ensure that the services performed are completed according to acceptable standards.

2.1.8 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance by the Government.

2.1.9 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2. ACRONYMS

CAC Common Access Card CLIN Contract Line Item Number CO Contracting Officer CONUS Continental United States COOP Continuity of Operations COR Contracting Officer Representative COTS Commercial-Off-The-Shelf CPR Contractor Performance Report DECC Defense Enterprise Computing Centers DISA Defense Information Systems Agency DISN Defense Information Systems Network DFARS Defense Federal Acquisition Regulation Supplement DFAS Defense Finance and Accounting Service DoDD Department of Defense Directive DoDI Department of Defense Instruction

DSSR Department of State Standardized Regulations EIT Electronic and Information Technology FAR Federal Acquisition Regulation GFE Government Furnished Equipment GFI Government Furnished Information GFP Government Furnished Property IA Information Assurance IAW In accordance with IP Internet Protocol IT Information Technology ITIL Information Technology Infrastructure Library JTR Joint Travel Regulation LAN Local Area Network NIPRNET Non-secure Internet Protocol Router Network MSR Monthly Status Report NAC National Agency Check NTE Not to Exceed OCI Organizational Conflict of Interest OCONUS Outside the Continental United States PM Project Manager PO&M Plan of Actions and Milestones PWS Performance Work Statement QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan Q&A Questions and Answers SIPRNET Secret Internet Protocol Router Network SME Subject Matter Expert SOP Standard Operating Procedure SOW Statement of Work SPI Schedule Performance Index SSBI Single Scope Background Investigation SSL Site Security Liaison STIG Security Technical Implementation Guide TCO Total Cost of Ownership TOS Tracking and Ordering System TPOC Technical Point of Contact VPN Virtual Private Network WAN Wide Area Network

3. GOVERNMENT FURNISHED PROPERTY (GFP), EQUIPMENT (GFE), INFORMATION (GFI)

AND SERVICES

3.1 Government Furnished Equipment: All facilities and services (i.e., computer products-PCs, printers, telephones, software and Government provided developmental platforms) shall be furnished by the DFAS Cleveland for use within the DFAS-CL Center. DFAS will furnish office space, desks, chairs, and supplies for contractor personnel working on this contract, at Cleveland. The office space, furnishings, supplies and equipment will be of the type found in DFAS. All software resident on the computers required to complete the tasks will be made available to the contractor.

Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI.

For contractor personnel working at alternate locations agreed upon by DFAS and the contractor, logon ids will be provided to access the required platforms. DFAS shall provide the access network connection, via the Pulse Secure for any personnel not working at the DFAS site. The contractor shall be provided approximately eight

(8) Laptop computers in the form of GFP IAW FAR Clause 52.245-1. The specific brand, model, and serial numbers of the laptop to be issued will be provided after award via coordination with the COR of record.

3.2 DFAS IT Policy Concerning Contractor Furnished Equipment (CFE).

3.2.1 In Accordance With (IAW) Chapter 3 of DFAS Regulation 8400.1-R, personally owned workstations, laptop computers, software and printers, including computers connected remotely will not be connected to the DFAS Enterprise Local Area Network (ELAN). This prohibition is a security requirement to protect the ELAN from the spread of malicious logic (viruses and Trojan Horse programs) and to protect sensitive but unclassified (SBU) information from being compromised. Contractors performing duties in a DFAS facility will be provided with DFAS owned workstations and printers.

4. SPECIFIC TASKS

4.0 SPECIFIC TASKS: The specific tasks that the contractor will perform are identified in the Performance Requirement Summary (PRS), which is attached hereto and fully incorporated herein. It sets forth how the contractor’s activities will be monitored and measured. The tasks required are organized into the following system lifecycle categories: program and project management, software engineering, migration and maintenance, and database administration and support. Each category of work has specific detailed tasks that set forth the results the contractor must accomplish and the performance measures for each. A more general description of the work required to be performed and expectations governing how that work will be performed are provided below.

4.1 Contract Program Management.

The contractor shall track hours worked on various projects using codes provided to them. The tracking and updating of the above information shall be captured in a Staffing Matrix report and detailed in individual project milestone charts. The contractor shall also prepare a monthly Staffing Matrix to include each contractor performing under this contract. The Staffing Matrix shall highlight any changes from the previous report. The Staffing Matrix shall list the Contractor’s Name, Subcontractor, Start Date, Stop Date and any other information agreed to by the Government and the contractor.

4.1.1 Weekly Status Reports. The contractor shall prepare and deliver a weekly Status Report to the COR and GPOC. The contractor shall report by project/system that details the system, Government team leader, contractor(s) assigned, summary of activities for the week, progress, problems encountered and solutions to the problems.

4.1.2 Performance and Cost Report. The contractor shall prepare and deliver on a monthly basis a Performance and Cost Report and a Summary Project Status Report to the COR no later than the 10th workday of the month. The contractor shall maintain and report IAW the Government’s instructions the following: the current status of this contract; relevant information regarding problem areas and course of action taken in their resolution; potential problems anticipated;

significant activities, work progress, and contract; costs; metrics, and cost data; forecasts;

analyses; and software reuse progress metrics. The metrics shall focus on how the contractor performance rates against the acceptable level of performance (ALP) set forth in the PRS for the work performed by the contractor. The contractor shall report status and cost in accordance with the Government-approved WBS.

A soft copy of the Performance and Cost Report (not including Travel attachments) shall be attached to the contractor’s invoice. Upon the expiration of the period of performance, the contractor is responsible for submitting the final invoice within sixty days of the end of the period of performance.

4.1.3 Monthly Training Report. The contractor shall provide on a monthly basis, the status of all contractor training accomplished with dates completed and dates due. This report is to be delivered to the COR by the 10th working day of the month. (The COR will provide a sample spreadsheet for the contractors convenience at the time of the contract award)

4.1.4 Monthly GFP Report. The contractor shall provide an updated list of contractor asset information for all GFP issued. This report is to be delivered to the COR by the 10th working day of the month. (The COR will provide a sample spreadsheet for the contractors convenience at the time of the contract award)

4.1.5 Monthly Accrual Estimate. The contractor shall provide a projected number of hours per CLIN for the current month that the contractor expects to invoice. This report is due by the 10th working day of the month. (The COR will provide a sample spreadsheet for the contractors convenience at the time of the contract award)

4.1.6 Management Reviews (MRs). The contractor shall prepare and provide Management Reviews (MRs) to identify and address progress, problems, and other pertinent information. The Government may require these Management Reviews intermittently in order to address pertinent issues. The contractor shall identify all Subcontractors and address progress, problems, and other pertinent, detailed information. If required, the contractor shall ensure the following topics are available for discussion at the MR: the management of contract activities, scheduling, costs, and technical status.

4.1.7 Bi-Weekly eBiz data tracking. Contractor personnel shall track project data and time in a data format using codes provided to them by the COR on an individual and daily basis.

Submissions of eBiz data shall be delivered in a bi-weekly report to the COR.

4.2 Software Engineering, Migration and Maintenance

4.2.1 Software Maintenance Activates:

The Contractor shall support all phases of the development lifecycle for the DMO system, related applications, and interfaces, including: audit readiness compliance, requirements gathering, technical analysis, programming, testing, release management, strategy formulation input (e.g. on formulating ways to gather information from end users and customers and integrating application changes).

4.2.2 Database Application Programming and Support:

The Contractor shall evaluate the Government’s planned database designs, provide database support, and provide advice and guidance on implementing industry best practices and ensuring audit readiness compliance.

When appropriate, the contractor shall propose modifications and/or alternative designs to improve overall application performance and reliability. Such proposals shall include design and development estimates. The Contractor shall obtain concurrence from the GPOC and COR on proposed table designs prior to designating it as a final design for implementation.

4.2.3 Technical Support for Application Engineering:

The Contractor shall; ensure audit readiness compliance, provide in-depth and detailed advice on both object-based and loosely coupled component architecture, support a web environment with engineering support, provide technical support and information related to the use of relational database technologies, data transformation, and design integration in a military pay and financial management environment, and develop a plan to transition DMO’s transactions to a database or warehouse structure.

4.2.4 Business Consulting:

The Contractor shall review current technology and identify functionality that could be used to save money or promote efficiencies in current processes (business diagnostic). The Contractor shall draft reports designed to implement new requirements or capabilities or to improve audit readiness compliance. The Contractor shall provide services in the areas of application design and integration, infrastructure architecture, enterprise services, interface specifications, data requirements, data transformation and application prototyping.

The Contractor shall provide requirements documentation services to support projects; interview and facilitate the identification of new business needs and requirements and document requirements and; coordinate with other stakeholders to capture and document all necessary detail needed to adequately plan for implementing new capabilities. The Contractor shall ensure that GPOC fully vets all customer requests and other identified business needs.

4.2.5 Testing Activities:

The Contractor shall develop, maintain, execute and review technical/engineering test plans for applications, including web and large batch applications. The Contractor shall write test scripts, test data, enter unit scripts into programming, and monitor results of tests and ensure audit readiness. The Contractor shall provide professional advice and guidance on testing activities.

4.2.6 Agile Development Support and Meeting Attendance:

In supporting the DMO system, some of these projects may be managed as Agile projects. If so, the Contractor shall attend required daily stand up meetings and provide feedback and analysis on issues discussed. Supporting Agile development activities also includes sprint planning meeting, backlog grooming and other such Agile procedures or concepts.

4.3 Database Administration and Support

The Contractor shall perform database administration activities for identified databases (IBM DB2, Oracle, & SQL) to ensure applications are operating as designed and are audit ready. The Contractor shall take all steps necessary to keep applications functioning properly and when requested, create a strategy and plan for integrating application changes seamlessly into a portal environment.

The Contractor shall evaluate the Government’s planned database designs for military pay functionality, and DMO System to ensure they achieve overall program objectives. When appropriate, the Contractor shall propose modifications and/or alternative designs to improve overall application performance and reliability. The Contractor shall ensure the database meets the requirements of the final design.

5. APPLICABLE PUBLICATIONS

5.0 APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

Applicable publications will be provided after contract award as required:

5.1 Global Software Development Plan (GSDP)

5.2 Software Configuration Management Plan (SCMP)

5.3 DFAS 8430.1-R, (Automated Information Systems)

5.4 DFAS 8430.01-I “System Life Cycle (SLC) Management”

5.5 Department of Defense Financial Management Regulation (DoD FMR) 7000.14-R, Vol. 5 – see http://comptroller.defense.gov/fmr/05/index.html

5.6 Various Treasury Management Regulations-see http://fms.treas.gov/regulations.html http://comptroller.defense.gov/fmr/05/index.html http://fms.treas.gov/regulations.html

PART 6

ATTACHMENTS

6. Attachment List:

6.1 Attachment 1 – Performance Requirements Summary

6.2. Attachment 2 – Deliverables Schedule

6.3 Attachment 3 – Estimated Workload Data

6.4 Attachment 4– Systems Information/Required Skill Sets

6.1 - ATTACHMENT 1

Performance Requirements Summary

Task Work Objective Outcome/

Result Acceptable

Performance Level

Surveillance Method -

Monitoring

4.2 Software Engineering, Migration, and Maintenance

4.2.1 Software Maintenance Activities

The Contractor shall support all phases of the development lifecycle for the DMO system, related applications, and interfaces, including:

audit readiness compliance requirements gathering technical analysis programming testing release management strategy formulation input (e.g. on formulating ways to gather information from end users and customers and integrating application changes).

The Contractor understands DMO system issues and develops solutions, which the Contractor submits to the government for approval and then implements.

Meets identified schedule 85% of the time during rating period.

Monthly review performed by

GPOC.

4.2.2 Database Application Programming and

Support

The Contractor shall evaluate the Government’s planned database designs, provide database support, and provide advice and guidance on implementing industry best practices and ensuring audit readiness compliance.

When appropriate, the contractor shall propose modifications and/or alternative designs to improve overall application performance and reliability. Such proposals shall include design and development estimates. The Contractor shall obtain concurrence from the GPOC and COR on proposed table designs prior to designating it as a final design for implementation.

The DMO system achieves functionality, performance, integrity, and audit readiness.

DMO system is functioning 98% of the time.

Information in the DMO system is immediately available 98% of the time.

The integrity of the information in the DMO system is intact 100% of the time.

Monthly review performed by

GPOC.

4.2.3 Technical Support for Application

Engineering

The Contractor shall:

ensure audit readiness compliance provide in-depth and detailed advice on both object-based and loosely coupled component architecture support a web environment with engineering support provide technical support and information related to the use of relational database technologies, data transformation, and design integration in a military pay and financial management environment; and develop a plan to transition DMO’s transactions to a database or warehouse structure.

Contractor provides the government with a written analysis that encompasses all material and relevant details necessary to create a successful design.

Working software meets the needs of the customers and is audit ready.

Meets identified schedule 85% of the time during rating period.

Items of software developed will be evaluated and 85% defect free and returned for re-work no more than twice.

Monthly review performed by

GPOC.

4.2.4 Business Consulting

The Contractor shall review current technology and identify functionality that could be used to save money or promote efficiencies in current processes (business diagnostic).

The Contractor shall draft reports designed to implement new requirements or capabilities or to improve audit readiness compliance.

The Contractor shall provide services in the areas of application design and integration, infrastructure architecture, enterprise services, interface specifications, data requirements, data transformation and application prototyping.

The Contractor shall provide requirements documentation services to support projects;

interview and facilitate the identification of new business needs and requirements and document requirements and; coordinate

The DMO system is continuously improving in terms of cost-savings and audit readiness.

The GPOC receives quarterly summarized reports of the improvement possibilities.

All reports, analysis, and requirements documentation are sufficiently detailed and all material items were identified.

Review reports, requirements documentation and proposals submitted.

with other stakeholders to capture and document all necessary detail needed to adequately plan for implementing new capabilities.

The Contractor shall fully review all customer requests and other identified business needs and report on such items.

4.2.5 Testing Activities

The Contractor shall develop, maintain, execute and review technical/engineering test plans for…