MIOES PWS -- IT Enterprise Services PWS 29 Jan 2025.pdf

PERFORMANCE WORK STATEMENT 5

Missile Defense Agency Information Technology & Engineering Solutions 7

(MIOES) 8

Contract Number: TBD 10

ENTERPRISE IT SERVICES AND SERVICE DELIVERY 13

Task Order Number: F-8000 16

Period of Performance: TBD 20

MIOES Task Order 2- Enterprise Services and Service Delivery .................................................................... 5 24

1.0 Background ..................................................................................................................................... 5 25

2.0 Scope ............................................................................................................................................... 5 26

3.0 Contract Data Requirements List (CDRL) ........................................................................................ 5 27

4.0 Service Summary Items ................................................................................................................... 6 28

5.0 Government Property ..................................................................................................................... 6 29

6.0 Other Requirements ....................................................................................................................... 6 30

7.0 Other Issuances ............................................................................................................................... 6 31

8.0 Programmatic and Functional Services ........................................................................................... 6 32

8.1 Contract Level Management ....................................................................................................... 6 33

Reference Basic PWS 8.1 ....................................................................................................................... 6 34

8.2 Task Order Management ............................................................................................................ 7 35

8.2.1 Task Order Program Management and Leadership ............................................................. 7 36

8.2.2 Task Order Measurement and Control ................................................................................ 8 37

8.2.3 Data Accession List (TO Level) .................................................................................................. 8 38

8.2.4 Task Order Close-Out ........................................................................................................... 8 39

8.3 Security Administration ............................................................................................................. 9 40

8.4 Monitoring and Reporting ......................................................................................................... 9 41

8.5 Incident Handling, Problem Management and Disaster Recovery ......................................... 10 42

8.6.1 Routine Back-Up, Roll-back, Recovery and Restoration Services .................................... 11 43

8.6.1.1 User Account and Backup and Recovery ................................................................... 12 44

8.6.1.2 System and Network Backup and Disaster Recovery ............................................... 12 45

8.7 Technology Integration ........................................................................................................... 13 46

9.0 Portfolio Management Services .................................................................................................. 13 47

9.1 Management Information System (MIS)................................................................................. 13 48

9.2 Portfolio Management Plan and Strategy ............................................................................... 15 49

9.3 Cost Management .................................................................................................................. 15 50

9.4 Foreign Military Sales IT Services and Case Requirements ..................................................... 15 51

10.0 Information Technology Services .............................................................................................. 15 52

10.1 ITSC Objectives and Standards ................................................................................................ 15 53

10.2Solutions Development and Implementation .......................................................................... 16 54

10.3 Customer Relations ............................................................................................................... 17 55

10.4 Continuous Improvement (CI) ............................................................................................... 17 56

10.5 Lifecycle Management Standards for IT Assets .................................................................... 18 57

10.6 Configuration and Change Management (CM/ChM) .............................................................. 19 58

10.7 Engineering Architecture Management ................................................................................ 19 59

10.7.1 IT Reform, Strategy, and Transition Planning ................................................................ 19 60

10.7.2 IT Enterprise Architecture ............................................................................................. 21 61

10.7.3 IT Systems Engineering ................................................................................................. 21 62

11.0 Collateral Support Services ....................................................................................................... 22 63

11.1 Integrated Service Desk (Tier I & II)....................................................................................... 22 64

11.1.1 IT Services for Premium Users....................................................................................... 23 65

11.2Tier III Services ......................................................................................................................... 24 66

11.2.1 Server Administration .................................................................................................... 24 67

11.2.2 Network Administration .................................................................................................. 25 68

11.2.3 Telecommunication Administration ................................................................................ 25 69

11.2.4 Guest Network Services ................................................................................................... 26 70

11.2.5 Point of Sale (POS) support .............................................................................................. 27 71

11.2.6 Storage Administration .................................................................................................... 27 72

11.3 Application Administration ..................................................................................................... 28 73

11.3.1 General Application and Web Administration ................................................................. 28 74

11.3.2 General Database Management and Administration Services ...................................... 29 75

12.0 Infrastructure Services ................................................................................................................ 29 76

13. 0 COMSEC Services ....................................................................................................................... 30 77

14.0 Sensitive Compartmented Information Facility/Special Access Program (SCIF/SAP) Support 78 Services ............................................................................................................................................... 31 79

15.0 Data Center Management & Operations .................................................................................... 31 80

16.0 Cloud Services ............................................................................................................................. 32 81

17.0 Development Security Operations (DevSecOps) ........................................................................ 33 82

18.0 Model-Based System Engineering (MBSE) .................................................................................. 34 83

19.0 Integrated Digital Data Environment (IDDE) ............................................................................... 34 84

20.0 Federated Identity Management / Automated Access Provisioning .......................................... 35 85

21.0 Cross Domain Solution Services ................................................................................................ 36 86

22.0 Dedicated Customer System Support (Customer Funded) ......................................................... 36 87

22.1 DV ............................................................................................................................................ 38 88

22.2 DX Facility Related Control System (FRCS) .............................................................................. 39 89

22.3 SN ............................................................................................................................................ 39 90

22.4 TC ............................................................................................................................................ 39 91

22.5 IP ............................................................................................................................................. 40 92

22.6 VIPC ......................................................................................................................................... 40 93

23.0 Dedicated Customer Support (Customer Funded) .................................................................... 40 94

23.1 AB ............................................................................................................................................ 41 95

23.2 GM ........................................................................................................................................... 41 96

23.3 DG ............................................................................................................................................ 41 97

23.4 DV ............................................................................................................................................ 42 98

24.0 IDDE for Two Letter Customers .................................................................................................. 42 99

24.1 GM IDDE .................................................................................................................................. 42 100

24.2 AB IDDE ................................................................................................................................... 42 101

25.0 Development Security Operations (DevSecOps) for Two Letter Customers ............................ 43 102

25.1 GM DEVSECOPS ....................................................................................................................... 43 103

26.0 Cross Domain Solution Services for Two Letter Customers ........................................................ 43 104

26.1 BC CDS ..................................................................................................................................... 43 105

26.2 DT CDS ..................................................................................................................................... 44 106

27.0 Model-Based System Engineering (MBSE) for Two Letter Customers ...................................... 44 107

27.1 GM MBSE............................................................................................................................... 44 108

28.0 Solutions Development and Implementation for Two Letter Customers .................................. 44 109

MIOES Task Order 2- Enterprise Services and Service Delivery 123

1.0 Background 125

The Office of the CIO is responsible for providing Information Technology (IT) Governance 127 across the Missile Defense Agency, this includes but is not limited to establishing the policies for 128 the procurement and acquisition of information technology products and services and the 129 management of IT projects servicing agency stakeholders and customers. IC is responsible for 130 customer outreach, execution, management and oversight of the CIO’s portfolio of enterprise 131 assets and acquired services. 132

2.0 Scope 134

Task Order 2 enables IT services critical to the agency CIO's mission to confirm that IT services 135 and resources are administered, acquired, managed, operated, and cyber defended in compliance 136 with the goals and directives of existing statutes and DoD regulations and the priorities set by the 137 MDA Director and CIO. The primary scope of this PWS encompasses Portfolio Management, 138 Planning and Integration, Architecture and Engineering, Network Operations, End User Services 139 and Service Delivery. The key for successful execution of the MIOES contract is the understanding 140 that all Task Orders are to be fully integrated and aligned. Any modifications to any Task Order 141 must be fully vetted across all Task Orders to reduce; potential risks, cause interruption of services 142 or delays, duplicative efforts, or otherwise negatively impact the agency. 143

3.0 Contract Data Requirements List (CDRL) 145

The point of delivery for all CDRL products, except as noted in Exhibit C, is the Electronic Content 146 and Records Tool (E-CaRT) system. The contractor shall deliver all such products by saving and 147 profiling them in E-CaRT, with the appropriate notification of delivery letter transmitted 148 electronically to the Government’s Data Management Office (DMO). Reference Exhibit C for 149 specific CDRL delivery instructions. 150 Task CDRL DID Title

8.2.1.3 A001 DI-MISC-

80368A/T Status Report, [Month Ending]

8.2.2.2 A002 DI-MGMT-

81861C

Integrated Program Management Data and Analysis Report (IPMDR) (Schedule Only) (For FFP tasks)

8.2.2.2 A003 DI-MGMT-

81861C

Integrated Program Management Data and Analysis Report (IPMDR) (Full) (For CPIF tasks)

8.2.3.1 A004 DI-MGMT-

81453A

Data Accession List (DAL)

8.2.4.1 A005 DI-MISC-

80508B/T

Task Order Close-Out

10.5 A006 DI-MISC-

80508B/T

Lifecycle Plan

8.6 A007 DI-MISC-

COOP-DR Testing and Training Plan

8.6 A008 DI-MISC-

Disaster Recovery Plan and Incident Response Plan

9.2 A009 DI-MISC-

Service Portfolio Management Strategy Plan

10.3 A010 DI-MISC-

80508B/T

Customer Relations Management (CRM) Plan

10.6 A011 DI-MISC-

Configuration and Change Management Plan

10.7.1 A012 DI-MISC-

Information Technology Updates and Refreshment Strategy

4.0 Service Summary Items 154

• TBD 155

5.0 Government Property 157

The contractor is required to be in compliance with FAR 52.245-1, Government Property. The 158 Logistics and Product Services task order under the MIOES contract will provide the following 159 integrated service capabilities and requirements for all task orders under this contract: warehouse 160 operations, inspection, shipping, receiving, tagging, cataloging, packaging, handling, storage, 161 transportation (local and third party) and life cycle property management from receipt, periodic 162 inventories to disposal operations. All other activities required to be in compliance with FAR 163 52.245-1, shall be performed under this task order and will be adhere to the property management, 164 asset management and accountability requirements as specified within the MOES Property 165 Management and Logistics Services Task Order. 166

6.0 Other Requirements 168

None 169

7.0 Other Issuances 171

In addition to the issuances identified in the Contract, the following are applicable to this task 172 order: 173

Document ID Title Originator Date

TBD

TBD

8.0 Performance Objectives and Standards 176

8.1 Contract Level Management (CPFF) 178

Reference Basic PWS 8.1 179

8.2 Task Order Management (CPFF) 181

8.2.1 Task Order Program Management and Leadership 183

The contractor shall provide task order (TO) level program management and leadership ensuring 184 execution, oversight, and administration of all TO requirements within the integrated framework 185 of the contract. The contractor shall monitor performance, manage risks, and provide quality 186 deliverables, adhering to DoD and Agency standards. 187 Standards: 189

8.2.1.1 Lead, manage, and execute TO activities in accordance with the MIOES Program 190 Management Plan. 191

8.2.1.2 Manage technical, cost, and schedule performance and associated risks and 192 provide updates at the Risk Review Boards. 193

8.2.1.3 Provide situational awareness by reporting on items such as the following: Status 194 of technical, cost, and schedule performance, significant accomplishments and customer 195 concerns, TO risks, mitigation, and remediation status, performance trends and progress 196 against Quality Assurance Surveillance Plan (QASP) metrics. (CDRL A001) 197

8.2.1.4 Operate within and follow the contract wide processes and governance models in 198 executing systems engineering, mission assurance, quality assurance, configuration 199 management requirements outlined in the PWS. 200

8.2.1.5 Participate in and deliver Integrated Product Team artifacts in preparation of TO 201 modifications and follow-on TOs 202

8.2.1.6 Develop and deliver proposals in accordance with the RFP letter from the PCO, 203 for TO modifications and follow-on task orders 204

8.2.1.7 Prepare for and participate in audits, such as Inspector General, IT security, cyber 205 security, physical security, GAO, property, environmental, health and safety. 206

8.2.1.8 Comply with export control requirements (e.g., ITAR, 22 CFR 120-130) and 207 technical assistance agreements. 208

8.2.1.9 Comply with the MDA and MDIOC Facility Systems Engineering Plans (SEP) 209

8.2.1.10 Provide a cleared, cyber workforce certified IAW DoDM 8140.03, with all 210 positions documented in the Cyber Workforce Qualifications Tracker (CWQT): 211 o Position Title, Description, and DoD Cyberspace Workforce Framework (DCWF) 212 Cyber Code Alignment. 213 o Security Clearance, Sensitivity Level, and System Privilege Level. 214 o Verification and quarterly validation of contractor-filled roles in agency CWQT. 215

8.2.1.11 Lead, manage, and execute TO activities in accordance with the Cyber 216 Resiliency Management Plan delivered under the Cybersecurity task order. 217

8.2.1.12 Develop a Cyber Workforce Training Plan for contractor personnel, aligning 218 with the DoD Cyber Workforce Framework (DCWF). 219

8.2.1.13 Identify and recommend Artificial Intelligence and Automation (alternate 220 solutions) when and where practical to gain efficiencies or cost reductions. Provide 221 recommendations to the COTR in the monthly status reports. 222

8.2.1. 14 Leverage automation practices and tools where practical throughout the Task 223 Order and report on automation practices in the monthly status report. 224

8.2.2 Task Order Measurement and Control 225

The contractor shall monitor, measure, control, and report contract cost, schedule, and 226 performance metrics at the TO level. 227 Standards: 229

8.2.2.1 Implement and administer a compliant Earned Value Management System 230

(EVMS) 231

8.2.2.2 Deliver the Integrated Program Management Data and Analysis Report 232

(IPMDAR) 233

o Deliver an IPMDAR (schedule only) for FFP tasks. (CDRL A002) 234 o Deliver an IPMDAR (full) for CPIF tasks (CDRL A003) 235

8.2.2.3 Integrate the TO Integrated Master Schedule (IMS) into the MIOES Integrated 236 Schedule (IIS) (IIS dictated in the IPMDAR) 237

8.2.2.4 Perform a Baseline Review or Integrated Baseline Review within 90 days of 238 contract award for CPIF tasks. 239

8.2.2.6 Provide subcontracting and limitation of funds oversight, and execution of TO 240 modifications and awards 241

8.2.2.7 Provide management, oversight and quality control for program control 242 documentation, processes, and reports. 243

8.2.3 Data Accession List (TO Level) 245

The contractor shall provide a Data Accession List (DAL). 246

8.2.3.1 Deliver the DAL, providing a medium for identifying contractor internal data 248 which has been generated. (CDRL A005) 249

8.2.3.2 Provide a document reference number for each DAL item for rapid retrieval from 250 contractor data sources. 251

8.2.4 Task Order Close-Out 253

The contractor shall execute TO close out procedures, consolidate TO data, to provide seamless 254 closeout of TO activities. 255 Standards: 257

• Perform a TO closeout that consolidates all TO data and deliver a Task Order Close-Out 258 Report. (CDRL A006) 259

8.3 Security Administration 262

(Firm Fixed Price) 263

The contractor shall provide security administration IAW applicable DoD, Agency, and local 264 security directives, classification guides, policies, procedures, and instructions in the 265 safeguarding of controlled and classified information, including proper document marking, 266 classification, storage, accountability, transmittal, and destruction. 267 Standards: 269

• Manage international security IAW DoD and Agency requirements (Foreign Disclosure 271 [FD], ITAR, Trade Act Agreement [TAA]). 272

• Protect CPI and CT IAW DoDI 5200.39, Critical Program Information (CPI) Protection 273 within the DoD. 274

• Execute security protections which include marking and Handling IAW DoDI 5200.01 275 Volumes 1-IV. 276

8.4 Monitoring and Reporting 278

(Firm Fixed Price) 279 The contractor shall provide continuous security and performance monitoring services for the 280 infrastructure, including servers, networks, and applications. These services will support 281 proactive threat detection, performance optimization, and compliance with DoD cybersecurity 282 policies, including DISA STIGs, RMF, and NIST 800-53. 283 Standards: 285

• Operate a 24/7/365 Global Network Operations Security Center (GNOSC) to monitor, 286 diagnose, and resolve network issues for government-identified CIO applications and 287 services. 288

• Establish network baseline expectations and monitor performance properties for 289 classified/unclassified systems, including latency, loss, jitter, throughput, bandwidth 290 utilization, circuit degradation, and other government-provided indicators. 291

• Detect deviations from baseline parameters and institute automated alerts to provide 292 consistent insights into network performance and provide notifications to monitoring 293 personnel. 294

• Define trends to identify the source and nature of network performance reliability issues, 295 including latency, response time, reliability, and alerts. 296

• Take corrective actions to restore network performance to approved baseline parameters 297 and monitor reliability to mitigate vulnerabilities, such as Single Points of Failure 298 (SPoFs). 299

• Provide warning notifications to the WAN Management Team per the COOP/DR plan, 300 notifying the government within 30 minutes of: 301 o Circuit utilization: 302 50% (initial notification). 303 80% (secondary notification). 304 Monthly updates to the COTR for consistent utilization above 80%. 305 o Perceptible trends: 306 More than three outages in one month. 307 Six outages in three months. 308 o Circuit degradation: 309 Circuits below 70% operational for one month. 310

• Submit status reports on circuit utilization, degradation, identified trends, and overall 311 utilization, with updates until issues are resolved via dashboard. 312

• Conduct performance trend analysis to support capacity planning, regular testing to 313 validate SLA compliance, and vulnerability scans per DoD timelines. 314

• Deliver key reports: weekly security monitoring, monthly performance monitoring, 315 quarterly STIG checklists, and semi-annual configuration compliance via dashboard. 316

• Meet KPIs: MTTD ≤ 10 minutes, MTTR ≤ 4 hours, uptime ≥ 99.9%, and 100% 317 compliance with DoD security directives. 318

• Maintain documentation of configurations, maintenance activities, and compliance 319 audits, while documenting design and architecture changes per configuration 320 management policies. 321

8.5 Incident Handling, Problem Management and Disaster Recovery 323 (Cost Plus Fixed Fee) 324

The contractor shall manage and resolve incidents and problems across the entire infrastructure. 325 The includes incident detection, response, resolution, root cause analysis, and proactive problem 326 management for all servers, applications, and networks, with a focus on mission-critical 327 operations and compliance with DoD and Agency directives. 328 Standards: 330

• Develop, maintain, and execute the COOP-DR Testing and Training Plan. (CDRL A008) 331

• Maintain disaster recovery and COOP plans, conducting semi-annual failover exercises 332 to provide operational readiness. 333

• Develop and maintain the Disaster Recovery and Incident Response Plan (CDRL A009) 334 and align with GNOSC SOPs and the government Incident Response Management Plan. 335

• Conduct annual DR tests, report findings to the PM, and provide compliance updates to 336 the ISSM. 337

• Monitor security logs, respond to incidents within one hour, resolve them within 24 338 hours, and escalate as needed. 339

• Document and report incidents with detailed analysis, provide After Action Reports 340 (AARs) to the COTR within 24 hours, and conduct root cause analysis for recurring 341 issues. 342

• Mitigate bottlenecks, apply patches per DoD timelines, and maintain DISA STIG-343 compliant configurations, notify ISSM of security-relevant status updates. 344

• Coordinate network restoral actions with external providers and OGAs (e.g. DISA, 345 DREN). Assist Mission Partners with communication restoration activities. 346

• Propose solutions to prevent future issues, implement corrective actions, and reduce 347 incident impacts. 348

• Maintain detailed records (within 99 % accuracy) of configurations, updates, and 349 incidents while delivering Monthly Status Reports and Quarterly Compliance Audit 350 Reports via automated dashboards. 351

8.6 Restoration of Enterprise IT services 353

(Cost Plus Fixed Fee) 354

The contractor shall provide comprehensive incident management services, including detection, 355 logging, analysis, resolution, and reporting, ensuring rapid restoration of IT services and 356 minimizing disruptions to operations. All activities shall align with Agency and DoD policies, 357 emphasizing continuous improvement and effective communication. 358

Standards: 359

• Develop and execute an Incident Management Plan to restore IT services, using 360 monitoring tools, data analysis, and user feedback to identify and log incidents 361 systematically. 362

• Categorize incidents by impact and urgency, prioritize resolution efforts, and 363 communicate progress and plans via a dashboard. 364

• Maintain a Monthly Problem Report detailing open problems, resolution times, service 365 impacts, workarounds, and improvement actions and deliver metrics via dashboard. 366

• Implement workarounds to mitigate immediate impacts while addressing root causes to 367 prevent recurrence. 368

• Conduct root cause analyses (RCA) and iterative process improvements to enhance 369 system reliability, response times, and customer satisfaction. 370

• Use automated tools and dashboards to monitor trends, track metrics, and provide real-371 time updates on incident statuses and resolutions. 372

• Collaborate with government and internal teams to align with policies and provide 373 transparency in incident management efforts. 374

8.6.1 Routine Back-Up, Roll-back, Recovery and Restoration Services 376 The contractor shall perform and maintain routine backups, provide recovery or restoration 377 services. for IC managed or serviced; systems, networks, user accounts, applications, databases, 378 desktop data, to maintain availability, integrity and compliance with DoD and Disaster 379

Recovery. Continuity of Operations, Incident Response Management, and Cybersecurity Plans 380 and Policies. 381

8.6.1.1 User Account and Backup and Recovery 382

The contractor shall perform routine back-ups and recovery of IC managed desktop data to 383 restore user data in the event of system failure. 384

Standards: 385

• Periodically test backup, recovery, and rollback processes to support data availability and 386 integrity. 387

• Maintain records of desktop configurations, service activities, and security compliance 388 checks. 389

• Document solutions and update a knowledge base to streamline troubleshooting and 390 support. 391

• Provide real-time reports on support activities, resolution times, and compliance via an 392 automated dashboard. 393

• Respond to service requests within two hours and resolve issues within 24 hours or 394 escalate as needed. 395

• Achieve a user satisfaction rating of 95%+ and provide system uptime of 99.9% to 396 support mission-critical operations. 397

• Deliver monthly service reports to the COTR detailing request types, resolution times, 398 and user satisfaction metrics via an automated dashboard. 399

• Submit quarterly compliance audit reports to the COTR summarizing findings and 400 remediation actions. 401

• Provide incident reports within 24 hours, documenting all security incidents and 402 resolution actions. 403

8.6.1.2 System and Network Backup and Disaster Recovery 404

The contractor shall establish and maintain network configuration backups and disaster recovery 405 plans to provide quick restoration of services in the event of a network failure. 406

Standards: 407

• Implement and test backup and disaster recovery processes to deliver data integrity and 408 availability for critical system, network, application, databases, end-user, and server 409 resources. 410

• Conduct quarterly backup and recovery tests, documenting results and ensuring 411 RTOs/RPOs meet mission requirements and DoD standards. 412

• Take corrective actions for recovery failures, retest, and adjust processes as needed to 413 maintain compliance. 414

• Maintain up-to-date documentation of application configurations, maintenance activities, 415 incidents, and compliance audits, ensuring alignment with Agency and DoD policies. 416

• Respond to critical incidents IAW DoD 6510.01 within one hour and resolve within 24 417 hours or escalate as necessary. 418

8.7 Technology Integration 420

(Firm Fixed Price) 421

The contractor shall perform an analysis and findings of potential improvements and 422 technologies that show high promise for returning value. 423 Standards: 425

• Present at a minimum three business case analysis for each recommendation that assesses 426 the return against the total investment (both one-time and full life cycle costs) and 427 associated risks (equal to or better capability at a reduced cost) on a yearly basis. 428

• Address the following in the business case analysis. 429 o Demonstrate compliance with federal regulations, program management 430 directives, and the cybersecurity requirements as specified in Task Order 3 431 o Demonstrate all recommended security relevant devices are on the Approved 432

Products List (APL) 433 o Verify a trusted supply chain for product acquisition and selection 434

• Display candidate and government accepted improvements within the Management 435 Information System (MIS) dashboard for government review and Government situational 436 awareness 437

9.0 Portfolio Management Services 439

(Cost Plus Fixed Fee For RFP Proposal, with eventually transition to FFP over time) 440 The contractor shall deliver program management services to support mission-critical operations 442 and provide effective oversight of the IT portfolio. The contractor shall enable the government 443 program office to manage, monitor, and make informed decisions regarding enterprise and 444 business management operations while ensuring alignment with organizational goals and 445 regulatory requirements. 446

9.1 Management Information System (MIS) 448

The contractor shall establish, maintain, and use a non-proprietary integrated Management 449 Information System (MIS) to support decision-making, coordination, control, analysis, trend 450 visualization, and forecasting within the program portfolio, including requests from Two Letter 451 customers and stakeholders. The MIS shall integrate people, processes, and technology from a 452 portfolio perspective across the entire IT Service Management Life Cycle, encompassing 453 requirement planning, budget authorization, implementation, operation, maintenance, and 454 decommissioning/retirement. The MIS shall be designed to promote agility and flexibility, 455 enabling future capability growth. 456 Standards: 458

• Deliver a real-time, continuous, automated reporting capability within six months of 459 award. 460

• Deliver accurate and timely updates for all project requirements, including cost, 461 schedule, performance, and project milestones. 462

• Develop and maintain automated dashboards that report: 463 ο Project Status and Programmatic Information: Key metrics for progress and 464 performance. 465 ο Service Request Metrics: Including ticket resolution times, first-contact resolution 466 rates, user satisfaction, recurring incidents, and ticket status (open vs. closed). 467 ο Security and Performance Data: Real-time and historical data on server, network, 468 and application performance, uptime, compliance status, and identified 469 risks/incidents. 470 ο Network Availability and System Health: Situational awareness with alert 471 notifications for degraded performance and outages. 472 ο Security Compliance: Findings from monthly access audits and compliance 473 checks, including remedial actions taken. 474 ο Storage Utilization: Overall storage status and Two Letter element usage of 475 storage assets. 476

• Provide built-in alert schedules for approaching milestones and notifications when 477 agreed to baseline cost thresholds exceed 85%. 478

• Provide a capability that can ingest and process multiple report formats and data types, 479 facilitating seamless integration and reporting. 480

• Create visualization models to depict the health and performance of the program 481 portfolio, highlighting key trends and metrics. 482

• Archive and retain all data for a minimum of seven years from the time of entry to 483 support future analysis and compliance. 484

• Track all project phases within the MIS for Two Letter customers. 485

• Provide multi-level reporting tailored to individual end-users, locations, or funding 486 organizations, as requested. 487

• Track and report training completion rates, including the percentage of users who have 488 completed required Cyber Workforce training programs. 489

• Submit a list of software licenses and hardware to be procured for Government approval 490

180 days before renewal dates and before purchases are made via the MIS. Obtain 491 approval from the COTR for all acquisitions. 492

• Provide itemized lists of hardware/software, quantities, costs (original and current), 493 running totals, End-of-Life (EoL) and End-of-Service (EoS) dates, Two Letter funding 494 allocations, and user assignments via the MIS dashboards. 495

• Maintain technical, physical, and administrative control over all authorized software, 496 including a comprehensive inventory in hard and/or digital formats and make inventory 497 results available within the MIS. 498

9.2 Portfolio Management Plan and Strategy 500

The contractor shall develop, maintain and execute a Service Portfolio Management Strategy. 501

Standards: 502

• Specify the long-range goals of the Service Portfolio Management process, establish roles 503 and responsibilities, and identify any guidelines and/or constraints on the design. 504

• Analyze all existing infrastructure as part of the requirements engagement process to 505 provide efficient utilization. 506

• Define the verification methodologies and criteria for each requirement and then tie each 507 one to a specific verification procedure. 508

• Provide and maintain a Service Portfolio Management Strategy Plan. (CDRL A010). 509

9.3 Cost Management 511

The contractor shall provide cost management information for individual customer billing and 512 accounts receivable, defining cost. 513

Standards: 515

• Track all Two and Three Letter costs including user usage, consumption and attributes 517 for all IT systems, services and applications within 6 months of contract inception. 518

• Communicate cost and performance to the stakeholders, alert if schedule and cost 519 exceeds established thresholds. 520

• Identify project-specific cost controls and manage costs within authorized budget. 521

9.4 Foreign Military Sales IT Services and Case Requirements 523 (Firm Fixed Price) 524

The contractor shall provide capabilities and services to Foreign Military Sales (FMS) office 525 personnel supporting security assistance and FMS activities as outlined in the FMS SLA. (This 526 task will not be priced or evaluated with the RFP. This task will be negotiated during the 527 MIOES Phase-In period when the workload associated with these requirements has been 528 defined.) 529

Standards: 530

• Provide unclassified and classified end user equipment, software, and printers 531

• Provide shipping and travel for service personnel 532

• Provide IT requirements as defined in each Letter of Agreement (LoAs) 533

10.0 Information Technology Services 535

(Firm Fixed Price) 536

10.1 ITSC Objectives and Standards 537

(Firm Fixed Price) 538

The contractor shall manage IT service catalog (ITSC) throughout the lifecycle of the service. 539

Standards: 541

• Develop, implement, maintain and utilize workflows to allow customers to submit 543 standard service requests that are assigned based on the service request type and customer 544 responses 545

• Validate the IT Service Request Fulfillment process adheres to government program 546 office IC Portfolio Management Business Rules. 547

• Follow the Governments Commodity IT Process (IAW current IT Business Rules) to 548 provide request details and cost to the Government for approval prior to procurement. 549

• Update all service/cost models in the IT service catalog every 6 months. 550

• Submit for approval "3" new service catalog items every 6 months and report on the 551 status of this analysis in the monthly status report. 552

• Validate 100% of services have a cost model, and track the cost for Two Letter customer 553 billing. 554

• Provide customer facing interface to allow customers to view current cost and projected 555 reoccurring cost by Two Letter. 556

• Document each requirement in the Service Pipeline and Service Catalog to include the 557 requirement’s function, stakeholder, resource utilization, including an assessment of 558 existing infrastructure, and prioritization. 559

• Update the Service Portfolio as requests for new, change, or retirement of services are 560 received from customers and stakeholders within seven calendars days of the required 561 change. 562

10.2 Solutions Development and Implementation 564

(Cost Plus Fixed Fee) 565 The contractor shall develop, implement and deliver IT solutions that meet DoD and Agency 566 compliance requirements throughout the system development lifecycle. (This task will not be 567 priced or evaluated with the RFP. This task will be negotiated during the MIOES Phase-In 568 period when the workload associated with these requirements has been defined.) 569 Standards: 571

• Track progress and performance against cost and schedule baselines - provide near real 572 time report that includes dependencies and resources to Government Contracting Officer's 573 Technical Representative COTR throughout the lifecycle 574

• Communicate in writing any cost estimate, schedule, or requirements/scope changes in 575 projects 576

• Conduct a final project review at project closeout to validate service delivery, transition 577 to Operations & Sustainment (O&S), all artifacts delivered, cost accounts have been 578 closed within 14 days of transition to O&S 579

• Provide quality assurance and quality control functions consistent with AGILE, 580 Waterfall, ITIL, and PMI standards and best practices by personnel with requisite 581 qualifications 582

• Develop and automate portfolio briefings for Two Letter reviews as directed by the 583 customer (~4 annually) 584

• Validate the secure design, development, test, implementation, maintenance, and 585 evaluation of information system security throughout the systems development lifecycle 586 IAW 10.5 Lifecycle Management Standards for IT Assets, 10.7.2 Enterprise 587 Architecture, 10.7.3 IT Systems Engineering and TO XXX 8.3.4 Cybersecurity Project 588 Integration 589

• Provide end-to-end project management throughout the development lifecycle. 590 o Capture Dependencies and resources down to the position number 591

• Establish and manage dashboard, with monthly reports on project progress, resource 592 utilization, dependencies, compliance status, and risk mitigation activities. 593

10.3 Customer Relations 595

(Firm Fixed Price) 596

The contractor shall provide a customer-focused management plan and strategy for IT service 597 delivery. The contractor shall prioritize effective customer relations, ensuring positive user 598 experiences, efficient communication, and continuous improvement of IT services. 599 Standards: 601

• Develop and deliver a Customer Relations Management (CRM) plan. (CDRL A011) 602

• Streamline and centralize customer interactions, recording responses to enhance service 603 delivery. 604

• Solicit and analyze customer feedback to identify trends, pain points, and opportunities 605 for improvement. 606

• Conduct outreach surveys and provide actionable insights to the COTR. 607

• Utilize automated solutions to handle at least 40% of user inquiries and maintain a self-608 service knowledge repository with performance dashboards, provide this metric via the 609 MIS dashboard at least monthly. 610

• Update a quarterly User Experience Tracker with survey data, feedback, recurring issues, 611 and modernization opportunities. 612

• Minimize day-to-day operational disruptions through detailed planning with customer for 613 upgrades; maximize use of scheduled after business hour maintenance windows for 614 customer impacting work. 615

10.4 Continuous Improvement (CI) 617

(Cost Plus Fixed Fee) 618

The contractor shall establish a CI program to monitor performance, gather feedback, and 619 identify and implement opportunities for cost control, process optimization, and performance 620 enhancements. The program shall align with DoD operational goals and foster a culture of 621 continuous improvement within the workforce. (Note: this task will be moved to paragraph 8.2 622 for the final RFP) 623 Standards: 625

• Monitor IT performance and provide quarterly recommendations to improve response 626 times and user satisfaction. 627

• Regularly collect and analyze user feedback to identify training, staffing, or resource 628 needs and prioritize CI opportunities. 629

• Report performance metrics, incident trends, resolution times, and user satisfaction via an 630 automated dashboard. 631

• Identify at least two cost control, process optimization, or performance improvement 632 opportunities every six months and present them in the Status Report. 633

• Develop and submit a CI implementation plan, including an Organizational Impact 634 Assessment (OIA) detailing resources, costs, operational impacts, schedules, risks, and 635 training requirements. 636

• Execute the CI plan, measure outcomes, and report results, including cost savings, in the 637 Task Status Report. 638

• Recommend process amendments to align government and contractor workflows for 639 improved efficiency, provide these recommendations to portfolio manager at least 640 monthly. 641

10.5 Lifecycle Management Standards for IT Assets 642

(Firm Fixed Price) 643

The contractor shall adhere to lifecycle management standards to maintain accountability and 644 visibility of assets from acquisition through disposition (Throughout the entire Lifecycle). 645 Assets are to be procured, deployed, managed, secured, and retired in compliance with DoD and 646 Agency policies, minimizing risks to operations and maintaining mission readiness. 647 Standards: 648

• Identify and assess asset requirements based on mission needs, security standards, 649 and budget constraints, aligning with DoD policies and conducting cost-benefit 650 analyses. 651

• Develop and deliver Lifecycle Plan within 1 year of contract award (CDRL A007). 652

• Develop procurement plans, ensuring compliance with DoD acquisition regulations 653 and COTR approvals before purchases. 654

• Use approved procurement channels, DoD Wide Contracts, maintain third-party 655 support agreements, and validate timely invoice payments. 656

• Enforce supply chain security by verifying vendor compliance with DoD frameworks 657 like CMMC, TAA compliancy and documenting asset specifications, warranties, and 658 contracts. 659

• Deploy assets securely, adhering to DISA STIGs and DoD security standards, 660 configuring EDR tools, integrating with ICAM systems, and recording details in the 661

CMDB. 662

• Maintain assets through regular security assessments, patch management, 663 performance monitoring, and preventive maintenance, ensuring SLA compliance. 664

• Decommission assets securely, following data sanitization standards, updating the 665 CMDB, and disposing of assets through authorized channels. 666

• Conduct lifecycle management audits, ensuring RMF and cybersecurity policy 667 compliance, and monitor assets for vulnerabilities and incidents. 668

• Track asset usage, service association, and lifecycle phases, providing metrics on 669 inventory usage, security compliance, cost reductions, and secure disposal. 670

• Review and update lifecycle policies regularly, incorporating stakeholder feedback, 671 emerging technologies, and evolving mission needs. 672

• Enforce supply chain risk management best practices to enhance cyber resiliency and 673 conduct annual audits to validate alignment with DoD and agency policies. 674

10.6 Configuration and Change Management (CM/ChM) 676

(Firm Fixed Price) 677

The contractor shall implement and maintain a unified Configuration Management (CM) and 678 Change Management (ChM) program to systematically manage IT system configurations and 679 changes in an effective manner to minimize disruption to the mission. The integrated program 680 shall provide system integrity, minimize disruption, maintain security, and align with ITIL best 681 practices, NIST SP 800-128, and DoD RMF standards. 682

Standard: 683

• Develop and deliver a Configuration and Change Management Plan (CCMP) outlining 684 processes, risk management, and validation protocols (CDRL 012). 685

• Assess, prioritize, and present significant Change Requests (CRs) to the CAB for 686 approval, executing and validating approved changes, and documenting lessons learned. 687

• Conduct security impact assessments, detect unauthorized changes, and update 688 configuration baselines post-change. 689

• Identify, baseline, and document all Configuration Items (CIs), including hardware, 690 software, and networks, ensuring alignment with operational and security standards. 691

• Standardize change management processes to prevent unauthorized changes and validate 692 all changes are reviewed, tested, implemented, and validated against baselines. 693

• Maintain an authoritative CMDB to track CIs, relationships, and updates, ensuring >98% 694 accuracy and reflecting the as-built state post-change. 695

• Conduct annual Configuration Audits and provide metrics on Change Success Rate 696 (>90%), CMDB Accuracy (>98%), and post-change incident rates (<5%). 697

• Develop a Forward Schedule of Change (FSoC) to plan and communicate authorized 698 changes. 699

• Notify stakeholders monthly about changes, impacts, and risks, and provide updates on 700 change outcomes and metrics. 701

• Provide initial and annual refresher training on CM/ChM processes and tools, ensuring 702 knowledge transfer for operational continuity. 703

10.7 Engineering Architecture Management 705

(Cost Plus Fixed Fee) 706

10.7.1 IT Reform, Strategy, and Transition Planning 707

The contractor shall develop and implement strategies that improve user experience and increase 708 mission success while maintaining compliance, cybersecurity, speed of delivery and improving 709 performance and efficiency. 710

Standards: 711

• Develop and deliver 3-year and 5-year IT strategies with updates annually that align 712 with Federal, DoD and agency policy and compliance requirements. Reference 713 Information Technology Updates and Refreshment Strategy Plan (CDRL A013). 714

• Identify opportunities to automate recurring labor-intensive activities to maximize 715 available resources, gain efficiencies or process improvements. Maintain an 716 authoritative source of improvement topics which the government can review on 717 demand and select candidate items that can be implemented upon availability of 718 resources. Include expected level of resources to implement, timeline, the future 719 reduction in resources, and return on investment. 720

• Develop, maintain and improve automated system including input from user 721 experience satisfaction surveys and profiling tools that track and identify user 722 experience issues. (e.g. unresponsiveness, crashing, packet drops, inefficient data 723 flows, time to load an application)Establish a system profile baseline (performance 724 characteristics) and capture changes, improvements, or degradation in user experience 725 on a quarterly basis. 726

10.7.2 IT Enterprise Architecture 728

The contractor shall develop and use IT architectures that maximize value, improve user 729 experience, maintain compliance, includes cybersecurity requirements, articulate 730 interdependencies and interfaces, and enable governance and oversight.