CMPP_PWS_V5.FBO_rev1.pdf

HC0007-17-Q-0023

TABLE OF CONTENTS

1 Contracting Officer Representatives (COR)

1.1 Primary COR

1.2 Alternate COR

2 Title. DeCA CMPP Refresh 3 Background 4 Objectives:

5 Scope:

6 Requirements

6.1 Functional Requirements

6.2 Technical Requirements

6.3 Security Requirements

6.4 Telecommunications Requirements

7 Tasks

7.1 Task 1 – Support Existing Solution

7.1.1 Subtask 1. Maintenance of Existing Solution

7.1.2 Subtask 2. CMPP De-installation

7.1.3 Subtask 3. CMPP Stowage Disposal

7.2 Task 2 - Deliver Plans to Modernize the CMPP Solution (Hardware and Software)

7.2.1 Subtask 1. Preliminary Site Survey and Report

7.2.2 Subtask 2. Software configuration

7.2.3 Subtask 3. Hardware Configuration

7.2.4 Subtask 4. Configuration Management Plan

7.2.5 Subtask 5. Life cycle Support Plan (LCSP)

7.2.6 Subtask 6. Information Support Plan (ISP)

7.2.7 Subtask 7. Systems Engineering Plan (SEP)

7.2.8 Subtask 8. Test and Evaluation Master Plan (TEMP)

7.3 Task 3 – Provide Documentation, Training Plan and Training

7.3.1 Subtask 1. Provide Training at DeCA Headquarters (Optional)

7.4 Task 4 - Testing

7.4.1 Subtask 1. Detailed Design and Critical Design Review (CDR)

7.4.2 Subtask 2. Test Readiness Review (TRR)

7.4.3 Subtask 3. DeCA Software Initial Test & Evaluation (IT&E)

7.4.4 Subtask 4. Security Test and Evaluation (ST&E)

7.4.5 Subtask 5. High Availability (Fail-over) Testing

7.4.6 Subtask 6. Test Report

7.4.7 Subtask 7. Program Protection Plan (PPP)

7.4.8 Subtask 8. Production Readiness Review (PRR)

7.5 Task 5 - Deploy Solution

7.5.1 Subtask 1. Final Site Survey and Report

7.5.2 Subtask 2. Installation

7.5.3 Subtask 3. DeCA Software Operational Test & Evaluation (OT&E)

7.5.4 Subtask 4. Operational Test and Evaluation Test Report

7.6 Task 6 – Perform Operations and Sustainment

7.6.1 Subtask 1. Help Desk

7.6.2 Subtask 2. Hardware Maintenance

7.6.3 Subtask 3. Software Licenses and Maintenance

7.6.4 Subtask 4. On-Site Consulting Services (Labor Hours)

7.7 Task 7 – Perform Program Management

8 Performance Standards

9 Incentives 10 Place of Performance 11 Period of Performance 12 Delivery Schedule 13 Government-Furnished Equipment (GFE)/Government-Furnished Information

(GFI). 25

14 Other Pertinent Information or Special Considerations

14.1 Identification of Potential Organizational Conflicts of Interest (OCI)

14.2 Identification of Non-Disclosure Requirements

14.3 Packaging, Packing and Shipping Instructions

14.4 Inspection and Acceptance Criteria

14.5 Property Accountability

14.6 Electronic Contract Manpower Reporting Application (eCMRA)

15 Section 508 Accessibility Standards

PERFORMANCE WORK STATEMENT

Defense Commissary Agency (DeCA) Central Meat Processing Plant (CMPP) Performance Work Statement (PWS) as of March 7, 2017

Contract Number:

Task Order Number:

1 Contracting Officer Representatives (COR).

1.1 Primary COR.

Name: TBD Organization: Defense Commissary Agency (DeCA) Department of Defense Activity Address Code (DODAAC):

HQCAAA

Address: 1300 E Ave., Fort Lee, VA 23801 Phone Number: 804 734-8000 X Fax Number: 804-734-8009, x 7 E-Mail Address: TBD

1.2 Alternate COR.

Name:

Organization: Defense Commissary Agency (DeCA)

DODAAC: HQCAAA

Address: 1300 E Ave., Fort Lee, VA 23801 Phone Number: 804-734-8000, Fax Number: 804-734-8009, x E-Mail Address:

2 Title. DeCA CMPP Refresh

The CMPP PWS will enable DeCA to refresh its commercial off-the-shelf (COTS) hardware/software solution that provides DeCA an automated meat processing system with ordering, tracking, and pricing capabilities. This will allow DeCA to maintain a state-of-the art meat processing plant within the current facility located at Ramstein Air Force Base, Germany.

This PWS defines the software and hardware required by the processing plant and its business operations. It includes the associated program management, implementation, testing, logistic support planning requirements and operational support services.

3 Background.

DeCA’s mission is to deliver a premier quality-of-life benefit to the Armed Services community by satisfying customer demand for high-quality grocery and household products and providing exceptional savings. One of DeCA’s strategic goals is to provide the military community with a great shopping experience by providing the best possible service at the lowest price.

DeCA currently operates 239 commissaries, twelve central distribution centers (CDCs), area offices, headquarters, and off-site locations (e.g., employees conducting sales at National Guard and Reserve sites for a limited number of days) worldwide. Of that total, 182 stores are located within the United States including Alaska and Hawaii, and 77 stores are located in 13 countries and two territories outside of the United States.

The DeCA CMPP provides retail cuts of fresh beef and pork to approximately 33 commissaries, 4 Nexmarts and numerous DoD and State Department activities in the European theater, Africa and Southwest Asia, e.g., Embassies, Exchanges and Dining Halls. Orders to Embassies, Exchanges and Dining Halls normally go through commissaries.

CMPP is responsible for ordering and maintaining an on-hand inventory of beef and pork products to support resale demand, processing over one million pounds of fresh beef and pork a month destined for tables throughout the European arena. CMPP’s 80 employees inspect, unwrap, cut, grind, re-wrap, weigh, label, box and load into trucks and shipping containers any combination of 76 beef items and 43 pork items, including an average of 500,000 hamburger patties, 41,000 porterhouse and T-bone steaks, 25,000 roasts and 69,000 pounds of spiced beef and pork each month.

Originally acquired in 2006, several CMPP components are nearing end of service (EOS). It is becoming difficult to maintain the system to DeCA’s desired level of service on vital production lines. In some cases, this has resulted in limited cannibalization of parts to ensure the continued operations of the remaining lanes as failure rates increase and replacement equipment will become increasingly difficult and more costly to secure. In addition, maintenance cost associated with maintaining an unacceptable equipment reliability level is far too expensive and the cost of availability of spare parts has become unacceptable from a business standpoint. Production line outages impact the commissary’s mission critical meat plant productivity reducing the efficiency of DeCA’s meat processing capabilities. These impacts are highlighted by long product delivery lead times, high overtime labor, and low throughput rates. To achieve its goal of delivering a premier quality-of-life benefit to the military services, DeCA requires a technology refresh of its aging CMPP components.

4 Objectives:

The refreshed CMPP system will provide the Agency with a modernized hardware and software solution meeting DoD security and DeCA requirements to automate various aspects of CMPP operations. The refreshed solution will also provide functionality to automate aspects of the store ordering, general ledger and meat inventory processes, and CMPP replenishment, thereby improving productivity, reducing cost and delivering enhanced customer benefits and savings.

In support of the CMPP program, the contractor will provide a turn-key solution to include all hardware, software, and associated system components to support the seamless interoperability of the CMPP operations as well as implementation, deployment, training, and maintenance. The primary operations and general capabilities of the CMPP solution and associated components will not be altered by the execution of the potential technology refresh.

The new CMPP solution will include but is not limited to the replacement of meat wrapping lines, convergers, conveyors, scales, metal detectors, labelers, store ordering, CMPP inventory management, and other associated hardware and software.

The program has five major objectives:

♦ Maintain existing equipment until new solution is deployed

♦ Replace obsolete equipment, Information Technology (IT) Hardware and software;

♦ Leverage industry best practices to improve meat plant operational efficiencies;

♦ Adhere to United States Food and Drug Administration (FDA), Occupational Safety and Health Administration (OSHA) and Department of Defense (DoD) food safety requirements; and

♦ Integrate with DeCA’s Enterprise Business Solution (EBS) ordering receiving and inventory solution scheduled for deployment in FY18.

5 Scope:

The Contractor shall provide all personnel, supervision, management, materials, non-personal technical services, and equipment required to refresh and maintain the CMPP solution. Additionally, the contractor will maintain the existing CMPP hardware and software until the new solution is fully deployed. The new CMPP solution will be used to originate orders for products from suppliers, process all incoming primal, manage the storage of the product until it is needed, facilitate processing and planning activities, weigh, scan retail product for metal, label retail product, optimize the picking of product to satisfy orders, and support requirements for business and inventory data.

The contractor will provide manufacturer’s technical specifications as evidence that proposed manufactured equipment meets or exceeds the DeCA requirements as outlined in this PWS and subsequent attachments. The scope of this contract also includes proposed IT hardware and software, including any third-party software required to implement the CMPP solution, along with the maintenance, patches and upgrades to the vendor software and third party software that may not be bundled with the CMPP package that is required to implement the CMPP solution.

The functional requirements address all business capabilities including receipt of incoming product, internal operations, process product, and outgoing product; and supports and automates various aspects of DeCA’s meat plant production operations – including metal detection, weighing, labeling, and meat inventory/ordering processes.

Additionally, CMPP will meet DoD security requirements, and maintain support of its newer hardware technology, and interface with DeCA evolving environment (e.g., Enterprise Business Solution (EBS)), when deployed.

In year 6 of this contract, the contractor shall refresh/ update all Information Technology hardware and software in order to remain current with technology and to satisfy Cybersecurity and DoD patching requirements and to keep the solution and third party software under maintenance.

6 Requirements.

The Contractor shall satisfy the requirements as outlined in this PWS and the following specific requirements.

6.1 Functional Requirements.

The contractor must satisfy the Functional Requirements as outlined in Appendix A

6.2 Technical Requirements.

The contractor must satisfy the Technical Requirements as outlined in Appendix B

6.3 Security Requirements.

The contractor must satisfy the Security Requirements as outlined in Appendix C

6.4 Telecommunications Requirements

The contractor must satisfy the Telecommunications Requirements as outlined in Appendix D

7 Tasks

The contractor will provide a turn-key solution to include all hardware and software and associated system components to support the seamless interoperability of the CMPP operations as well as implementation, deployment, training, and maintenance. The primary operations and general capabilities of the CMPP solution and associated components will not be altered by the execution of the potential technology refresh.

Improvements in functional capability will help maximize commissary satisfaction and enhance the effectiveness and efficiency of DeCA’s operations. In the many years since the present solution was procured, technological capabilities have improved the functions of meat processing facility operations. It speeds the receipt, picking, production planning and shipping process for plant workers.

7.1 Task 1 – Support Existing Solution

The contractor will perform 3 subtasks in support of the existing solution: maintenance, de-installation and disposal stowage. The offeror will submit a Final Transition Plan that will contain the offeror’s approach to maintaining the existing solution, de-installation and disposal stowage of the existing hardware and software. See Table 12-1 – Delivery Schedule for the specific dates and frequency deliverables are due to DeCA.

7.1.1 Subtask 1. Maintenance of Existing Solution.

The contractor will maintain the existing CMPP solution until it is decommissioned. The maintenance task will include all necessary repairs and support required to enable DeCA’s meat processing function to perform within DeCA’s performance metric thresholds. The contractor will also support the solution by providing DeCA users tier 2 and above helpdesk support.

7.1.2 Subtask 2. CMPP De-installation.

The contractor will de-install all existing solution hardware that will be replaced with new hardware purchased under this contract; however, the contractor will not remove any processor until DeCA has certified that all operating system software has been destroyed. All wiring not planned to be used with the new solution, will be removed as part of the de-installation process.

7.1.3 Subtask 3. CMPP Stowage Disposal.

The equipment that is de-installed shall be palletized and moved to the onsite storage area designated by CMPP management. A Government representative and the contractor will utilize DeCA’s Defense Property Accountability System (DPAS) printed inventory listing to verify equipment being removed (these inventory listings will be provided by the Property Record Management Office (PRMO)). Upon completion of the inventory, the Government representative will attach the inventory listing to a DeCA Form 40-108 and provide the signed original to the DeCA CMPP Manager and a copy to the DeCA PM and COR. When disposing of the system hardware, the contractor shall comply with the disposition requirements for hard drives listed in Department of Defense Instruction (DoDI) 8500.01, "Cybersecurity" latest revision (currently March 14, 2014). The contractor and a Government representative must certify in writing after the CMPP de-installation that the disposition has been completed in accordance with DoD procedures and provide this information to the CMPP, DeCA PM, and COR.

The CMPP contractor shall comply with applicable Federal, State, and local laws (including German), ordinances, and regulations with respect to the disposal or other use of the received material.

Deliverable: Transition Plan

7.2 Task 2 - Deliver Plans to Modernize the CMPP Solution (Hardware and Software)

The contractor shall submit plans to refresh the current obsolete CMPP solution with a new solution that will significantly reduce the frequent equipment breakdowns and allow CMPP to leverage commercial best practices and system advancements to better mirror that of commercial industry. The replacement shall be well planned to meet all system requirements to include compliance with government food handling requirements. Plan the replacement of the current solution, and deployment of the new solution to the Ramstein location ensuring minimal impact to CMPP productivity. Plan the replacement of the associated Information Technology (IT) hardware and software at the Kapaun facility and install the IT server hardware and software to support the new solution. Plan the replacement of the current solution locally operated IT hardware and software, and equipment and the installation of any locally operated IT hardware and software needed to support the new solution at the CMPP simultaneously.

The CMPP solution will enable managers to enhance plant operations. Integrating improved technology will promote a more effective and efficient operation. To achieve Initial Operational Capacity, CMPP will support business practices such as facilitating production planning, order planning, product rotation, inventory management (shelf-life management, product tracking) and scanning and reading of GTIN. It will enable CMPP managers to tailor reports to their specific data and timeliness needs. CMPP is also expected to generate routine reports with minimal human intervention, allowing more standardized operational procedures. Future capabilities of the CMPP solution will provide an improved data exchange with DeCA EBS business systems, thus enabling more data forecasting accurate reporting of CMPP operations, store account, inventory management, and reporting capability.

This will help ensure that patrons’ commissary shopping experience is on par or better than that of commercial counterparts.

The contractor shall submit plans to modernize DeCA’s 8 CMPP meat processing lines and two standalone order racks. This modernization will replace the convergers, scales, metal detectors, labelers, servers, Information Technology (IT) hardware and software and other equipment required for ordering, inventory tracking, final meat processing (from weighing to outbound packaging), order fulfillment, shipping and stock replenishment as identified in the CMPP Appendix A, CMPP Functional Requirements and Appendix B, CMPP Technical Requirements. In addition, the solution shall provide industry standard reports and provide the capability for configuration, and ad hoc queries. See Table 12-1 – Delivery Schedule for the specific dates and frequency deliverables are due to DeCA.

7.2.1 Subtask 1. Preliminary Site Survey and Report.

The contractor shall conduct a preliminary survey of the CMPP and provide a detailed written report of all work required to prepare the facility to accept the new solution. DeCA will provide a staff member to accompany the team to answer questions and provide information as needed. The site survey will address security requirements, handicapped accessibility requirements, electrical wiring, wiring for LAN and telecommunications, training areas, equipment storage areas, operating environments, and continuous operations equipment. The survey shall also determine the quantities, sizes, and placement of all equipment and IT hardware and software to be installed.

The preliminary site survey report will identify the scope of the modifications required, draft list the materials required, and contain relevant draft drawings and plans. The report will also include draft shop drawings and draft schematics providing details for construction and quality control of permanent work.

7.2.2 Subtask 2. Software configuration

The CMPP solution will be a fully integrated and configured meat processing management solution capable of supporting DeCA’s operation existing within its environment. The CMPP solution must support 50 concurrent users and comply with DoD and DeCA security requirements, i.e., Risk Management Framework (RMF) Certification and Accreditation (C&A), and the Federal Information Management Security Act (FISMA) 2002, and DoDI 8510.01 latest revision (currently dated May 24, 2016).

7.2.3 Subtask 3. Hardware Configuration.

The Contractor will provide all data center and CMPP hardware devices, required for receiving, shipping, maintaining virtual inventory, and final processing including weighing, metal detection, and labeling of primal meats to be distributed to the European theatre. The offeror’s hardware configuration will include adequate levels of redundancy to ensure required performance levels.

The CMPP contractor must provide integration support based on emerging technology and industry best practices.

The contractor shall configure, deliver, and install any proposed hardware products to interface with the contractor provided software as well as current and future EBS configurations. The printing environment is IP-based at the store level and print server based above store. The contractor’s proposed software must be able to function in this environment.

7.2.4 Subtask 4. Configuration Management Plan.

The contractor shall provide configuration management and submit an Initial Configuration Management Plan. An effective configuration management plan will detail the contractor’s approach to maintaining DeCA’s hardware and software baselines as well as providing future firmware and software releases and upgrades at no additional cost. If firmware or software cannot be updated to support security requirements or functionality through the life of the contract, the contractor must provide replacement hardware or software at no cost to DeCA.

CMPP will comply with current DeCA standards and protocols developed to ensure open system interconnectivity throughout the system life cycle. All hardware and software components will be configured to allow full compatibility, interoperability and integration. CMPP will allow for replacement of individual components or insertion of new technology without disrupting service or requiring costly modification of existing components.

The contractor shall submit a Final Configuration Management plan. This plan will outline the approach to software configuration management and hardware configuration management throughout the life of the contract. The offeror will identify its baseline software and hardware configuration and equipment list required to support the refresh solution, including diagrams for DeCA to understand how the hardware and software will interact with each other, the CMPP users, and the DeCA network.

7.2.5 Subtask 5. Life cycle Support Plan (LCSP).

The offeror will submit an initial Life Cycle Support Plan to document how the sustainment strategy is being implemented. The LCSP documents the plan for formulating, implementing and executing the sustainment strategy so that the solution’s design as well as the development of the product support package are integrated and contribute to the mission requirements by achieving and maintaining the Sustainment KPP/KSAs. The LCSP is a living document, which will be updated as needed, describing the approach and resources necessary to develop and integrate sustainment requirements into the solution’s design, development, testing and evaluation, fielding and operations.

7.2.6 Subtask 6. Information Support Plan (ISP).

The offeror will submit a an initial ISP that is used by program authorities as documentation of IT and NSS needs, objectives, and interface requirements in sufficient detail to enable testing and verification of requirements. The ISP also contains interface descriptions, infrastructure and support requirements, standards profiles, measures of performance, and interoperability shortfalls

7.2.7 Subtask 7. Systems Engineering Plan (SEP).

The offeror will submit an initial Systems Engineering Plan (SEP) that describes the program’s overall technical approach, including key technical risks, processes, resources, and organization, metrics, and design considerations.

It will also detail the timing and criteria for the conduct of technical reviews. The use of mandatory tables in the SEP is intended to support more detailed technical planning during the system life cycle in order to provide effective management and control of the program’s technical progress and the execution of risk mitigation activities.

7.2.8 Subtask 8. Test and Evaluation Master Plan (TEMP).

The offeror will submit an initial Test and Evaluation Master Plan (TEMP) that describes an acquisition program’s planned Test and Evaluation (T&E) activities over a program’s life-cycle and identifies evaluation criteria for the testers. It serves as an executive summary and provides a framework within which to generate detailed T&E plans and documents schedule and resource implications associated with the T&E program.

Deliverables: Preliminary Site Survey and Report Hardware and Software Configuration and Equipment List Configuration Management Plan Life Cycle Support Plan (LCSP) Information Support Plan (ISP) Systems Engineering Plan (SEP) Test and Evaluation Master Plan (TEMP)

7.3 Task 3 – Provide Documentation, Training Plan and Training

The contractor shall provide Functional and Technical Training, these training sessions shall be open to the respective DeCA staff at Ramstein AFB, Germany, and to the DeCA Europe server center staff at Kapaun Air Station, Germany (Vogelweh), in accordance with the Training Plan. The contractor shall conduct supervisor / lead training the day prior to the first day of production with the new CMPP solution.

The contractor will provide system documentation and training materials for technical and functional users.

Technical training shall be provided for up to 10 people and include system set up, installation, system backup, troubleshooting, and technical user software and hardware maintenance procedures. Functional training shall be provided for up to 30 people and include all roles of the CMPP solution user from store ordering personnel, inbound receiving, put-away, processing retail items, shipping, inventory management and accountability, and reporting.

Training must be conducted in a manner that minimizes disruption to productivity.

The contractor will submit a Final Training Plan that provides an outline of training content, dates, times, and timelines to get Government personnel trained sufficiently. Training, User Manuals, and System Documentation will be in English and German, and include guidance to allow DeCA users to maintain the solution and self-train new personnel.

Updated user manuals, concept of operations and system documentation shall be provided with system updates, along with updated training plans and training materials. See Table 12-1 – Delivery Schedule for the specific dates and frequency deliverables are due to DeCA.

Deliverables: Training Plan

Training Classes Training Materials User Manual System Documentation

7.3.1 Subtask 1. Provide Training at DeCA Headquarters (Optional).

Should DeCA exercise this option, the contractor shall provide Functional and Technical Training at the DeCA Headquarters at Fort. Lee, Virginia. These training sessions shall be open to the respective DeCA staff located within the DeCA headquarters, in accordance with the Training Plan.

The contractor will provide system documentation and training materials for technical and functional users.

Technical training shall be provided for up to 10 people and include system set up, installation, system backup, troubleshooting, and technical user software and hardware maintenance procedures. Functional training shall be provided for up to 30 people and include all roles of the CMPP solution user from store ordering personnel, inbound receiving, put-away, processing retail items, shipping, inventory management and accountability, and reporting.

Training must be conducted in a manner that minimizes disruption to productivity.

7.4 Task 4 - Testing.

The contractor will provide a test environment and a production environment at the DeCA Europe data center, located on Kapaun Air Station, on Vogelweh Army Base, Kaiserslautern, Germany. The contractor will be responsible for all necessary testing of the solution, patches, or third party software updates prior to installation on the DeCA Test environment. The contractor shall be responsible for the installation of the solution, any patches, or third party software updates and any additional setup required to prepare the environment for DeCA testing. Once DeCA testing is completed, and a time is specified for installation of the solution, patches, or third party software updates, the contractor shall ensure successful integration into the DeCA production environments to include interfaces associated with CMPP tracking, ordering and inventory. The contractor will also submit a Test Plan that includes schedules, decision gates, roles and responsibilities and an installation/test checklist to be used as a part of Government testing and acceptance with each software delivery, patch, or third party software updates. See Table 12-1 – Delivery Schedule for the specific dates and frequency deliverables are due to DeCA.

7.4.1 Subtask 1. Detailed Design and Critical Design Review (CDR)

The contractor will deliver a detailed design of the proposed solution and conduct a critical design review with the information produced in paragraph 7.2, with the DeCA Technical Review Board (TRB) in accordance with the DoD Instruction 5000.02. Based on the results of the TRB and a review by the DeCA Program Manager (PM), authorization may be granted for continuation of program up to testing.

7.4.2 Subtask 2. Test Readiness Review (TRR)

The Government and the contractor will conduct a joint Test Readiness Review, based on the contractor’s test plan and submitted test conditions, with the DeCA TRB. Based on the results of the TRB and a review by the DeCA PM, authorization may be granted for IT&E.

7.4.3 Subtask 3. DeCA Software Initial Test & Evaluation (IT&E)

The scheduling of the IT&E shall be defined in the initial Deployment Plan, and subsequent Test Plans when software updates occur. The contractor staff will work with DeCA personnel in the IT&E of the solution software and hardware components. The IT&E testing will include load testing and response time testing. The contractor will perform any remediation necessary to correct system performance functions. The contractor shall provide equipment/facilities necessary to conduct initial integration testing of the software and hardware components to minimize interruption or impact upon the CMPP solution.

7.4.4 Subtask 4. Security Test and Evaluation (ST&E)

DeCA intends to use Government and other contractor personnel to perform DoD RMF cybersecurity scans and reviews both prior to IT&E and during IT&E. The contractor shall provide personnel, as needed, to assist in security documentation, testing, and remediation.

7.4.5 Subtask 5. High Availability (Fail-over) Testing

The contractor shall work with DeCA personnel to test system fail-over, backup, and recovery at the DeCA Europe Kapaun AFB, Germany Data Center. The contractor shall perform any remediation necessary to correct system performance.

7.4.6 Subtask 6. Test Report

The contractor shall deliver detailed reports upon completion of each testing phase that includes, at a minimum, the number of employees included in testing, locations, results of each phase of testing, scenarios tested, results of each scenario, issues logged, and mitigation and/or resolution of test issues. The contractor shall participate in test acceptance reviews, prior to the Production Readiness Review.

7.4.7 Subtask 7. Program Protection Plan (PPP)

CMPP will comply with DoD Cybersecurity standards and provide more advanced protection for its internal and external data communications. Although the CMPP solution does not use, generate, or maintain any defense-classified information, it utilizes DeCA’s network infrastructure for transmitting information to the server centers in DeCA. It will allow more stringent access control through Public Key Infrastructure (PKI) encryption.

The offeror shall submit a PPP that describes the CMPP Solution and ensures the systems have adequate protection for the technology, components, and information. This includes information that alone might not be damaging and might be unclassified, but that in combination with other information could allow an adversary to clone, counter, or defeat mission capability. The offeror shall approach the preparation of the PPP with intentions to help program offices consciously think through what needs to be protected and develop a plan to provide that protection. Once a PPP is in place, it should guide program office security measures and be updated as threats and vulnerabilities change or are better understood.

7.4.8 Subtask 8. Production Readiness Review (PRR)

The Government and the contractor will conduct a joint Production Readiness Review, with the DeCA TRB. This review is based on the Test Report and the Test Readiness Review Scenarios, and the overall readiness of the solution to be deployed. Based on the results of the TRB and a review by the DeCA PM, authorization may be granted for installation of the CMPP solution.

Deliverables: Detailed Design and Critical Design Review

Test Plan Test Readiness Review Report and Test Readiness Review Initial Test and Evaluation (IT&E) Security Test and Evaluation (ST&E) Program Protection Plan (PPP) High Availability (Fail-Over Testing) Test Report Production Readiness Review Report and Production Readiness Review

7.5 Task 5 - Deploy Solution

The contractor will deploy a fully configured solution at DeCA’s CMPP in Ramstein, Germany. Any servers that are in the solution will be located at the DeCA Europe server center at Kapaun Air Station, Germany (Vogelweh). The offeror will submit a Final Deployment Plan that provides a detailed schedule of events and clearly describes their approach to conducting a site survey, installation, configuration, and testing of all required hardware and software.

See Table 12-1 – Delivery Schedule for the specific dates and frequency deliverables are due to DeCA.

7.5.1 Subtask 1. Final Site Survey and Report.

The contractor shall conduct a final survey of the CMPP and provide a final detailed written report of all work required to prepare the facility to accept the new solution. DeCA will provide a staff member to accompany the team to answer questions and provide information as needed. The site survey will address security requirements, handicapped accessibility requirements, electrical wiring, wiring for LAN and telecommunications, training areas, equipment storage areas, operating environments, and continuous operations equipment. The survey shall also determine the quantities, sizes, and placement of all equipment to be installed.

The final site survey report will identify the scope of the modifications required, list the materials required, and contain relevant drawings and plans. The report will also include shop drawings and schematics providing details for any construction that may be necessary and quality control of permanent work.

7.5.2 Subtask 2. Installation.

The installation of the CMPP will begin on a Friday and be completed, tested, and ready for the following Monday without any impact to regular CMPP operations. The contractor will install all solution components, including hardware and software in compliance with Department of Defense Directive (DoDD) 8500.1, “Cybersecurity”, latest revision (currently March 2014). The contractor will transfer all existing data from the current version of the CMPP solution to the new CMPP solution. The contractor will also ensure that the new solution is properly installed and operational before turning it over to DeCA for acceptance. The contractor shall provide on-site support personnel at the CMPP for at least four days after DeCA begins operations.

7.5.3 Subtask 3. DeCA Software Operational Test & Evaluation (OT&E)

The scheduling of the OT&E shall be defined in the initial Deployment Plan, and subsequent Test Plans. The contractor staff will work with DeCA personnel in the OT&E of the solution software and hardware components.

The OT&E testing will begin two weeks after the solution is installed in the CMPP and will be conducted as the CMPP conducts normal business, for a period not less than 60 days and not to exceed 120 days. OT&E shall include load testing, and response time testing. Offline testing and fail-over testing will also be conducted on CMPP lighter days or near the end of the workday, in order to prevent major impacts to production. The contractor will perform any remediation necessary to correct system performance functions. The contractor shall provide equipment/facilities necessary to conduct initial integration testing of the software and hardware components to minimize interruption or impact upon the CMPP solution.

7.5.4 Subtask 4. Operational Test and Evaluation Test Report

The contractor shall deliver detailed reports upon completion of OT&E testing that includes, at a minimum, the number of employees included in testing, measured capacity of each line, results of the testing, scenarios tested and results of each scenario, issues logged, and mitigation and/or resolution of OT&E issues. The contractor shall participate in the OT&E test acceptance review, prior to DeCA formal acceptance of the CMPP Solution. DeCA acceptance will occur upon successful completion of the OT&E test acceptance review. Due to the OT&E timeframe, the warranty period shall be 2 years after the Government’s acceptance of the software and released to operational baselines. The Government will have the option to exercise software support immediately upon completion of the warranty period.

Deliverables: Final Site Survey and Report Final Deployment Plan Installation Plan Operational Test and Evaluation (OT&E) Operational Test and Evaluation Report

7.6 Task 6 – Perform Operations and Sustainment

The contractor shall provide operations and sustainment support to maintain the CMPP solution. The contractor shall provide an Operations and Sustainment Plan that explains their approach to supporting the solution through the life of the contract to include compliance with the DeCA change management process. This plan will include maintaining a help desk and performing hardware and software maintenance to include routine/preventative and unscheduled repair of failures. See Table 12-1 – Delivery Schedule for the specific dates and frequency deliverables are due to DeCA.

7.6.1 Subtask 1. Help Desk

The Government will provide Level I support through the DeCA Enterprise Service Desk. Level I consists of a 24 x 7 call center for all hardware and software issues, logging of problems within the DeCA ticketing system (Remedy), establishing a priority to the issue, providing problem resolution for recurring/minor problems such as printer, PC, network, or RF-handheld malfunctions, and escalating problems to Level II when required.

The contractor shall provide a comprehensive help desk that provides DeCA a single touch point to answer all CMPP hardware and software related issues. DeCA will establish service level agreements (SLAs) with the contractor based on the criteria outlined in this paragraph. An effective help desk plan will provide appropriate metrics and scoring methodologies including response and resolution times.

The contractor shall provide Level II support for all hardware and software acquired through this contract. The contractor shall resolve problems that are of a complex nature through the use of troubleshooting tools and knowledge of the solution. Typical problems resolved by Level II support include, but are not limited to, solving application problems or providing pre-approved workarounds to solve the problems, researching status on files, restaging and processing files, and resolving minor database problems.

The contractor shall provide Level III support for all hardware and software acquired through this contract. The contractor shall resolve problems that are of a complex nature through the use of troubleshooting tools and knowledge of the solution, or consultation with or deployment of hardware or software manufacturers, technicians, or experts. Typical problems resolved by Level III support include, but are not limited to, solving application problems or troubleshooting application or system errors, applying software patches, resolving hardware failures, replacing hardware components, recovering files, restaging and processing files, and resolving major database problems.

The contractor shall resolve any problems reported on the solution in accordance to the established Priority classifications below.

The contractor shall maintain a 24-hour, 7 days per week, 365 days per year support (call) center to provide operational support to users in Germany.

The contractor shall establish continuous telephone service within the United States to permit DeCA to report problems 24 hours per day.

The contractor shall answer and provide a live response to incoming calls within forty-five (45) seconds. All call center personnel responding to DeCA queries shall speak, write, and understand English.

The contractor shall respond to system problems using a problem priority process. The DeCA Help Desk will establish a priority for each problem upon entry into the DeCA Remedy system. DeCA has established the following priority classification and response times for calls placed to contractors on mission essential systems:

Definitions:

Response Time: Time it takes to log call and for caller to speak with an experienced technician.

On-site Response Time (if needed): Time it takes for an experienced technician to arrive on-site.

Resolution Time: Time it takes to repair.

• P1 MISSION ESSENTIAL (CRITICAL)

CMPP cannot process orders and/or Financial Accountability is at Risk Response Time: 15 minutes On-site Response Time (if needed): 2 hours Resolution Time: 6 hours

• P2 USER ESSENTIAL (HIGH)

Individuals cannot perform their job responsibilities Response Time: 1 hour On-site Response Time (if needed): 4 hours Resolution Time: 18 hours

• P3 GENERAL ISSUES (MEDIUM)

Job responsibilities cannot be performed, but an alternative is available Response Time: 4 hours On-site Response Time (if needed): 24 hours Resolution Time: 36 hours

• P4 INQUIRIES, QUESTIONS, AD-HOC REPORTS (LOW)

NON-PRODUCTION SYSTEM SUPPORT

Response Time: 24 hours On-site Response Time (if needed): 48 hours Resolution Time: 72 hours

7.6.2 Subtask 2. Hardware Maintenance.

The offeror will propose a hardware maintenance process that ensures industry standards for systems life expectancy, encourages system reliability, and fosters rapid response and repair of non-functioning equipment.

Hardware maintenance, in response to DeCA calls will be performed on-site at CMPP while minimizing impact on normal operations.

o The contractor will provide maintenance and repair services in response to DeCA calls to the contractor’s call center. If remote diagnostics are not available, the contractor will dispatch an experienced technician to the site to troubleshoot in accordance with the priority of the failure and designated on-site response. The contractor may remotely diagnose the problem and dispatch a technician with the correct part to make the repair. The contractor shall repair or replace the failing part or replace the unit containing the failing part, in order to keep the CMPP operational.

o The contractor will provide preventive maintenance on hardware in three-month increments. Preventative maintenance shall be performed on a rotating basis (a maximum of two production lines simultaneously) The maintenance date and time shall be coordinated with a minimum of one week prior notice to the CMPP supervisor, to ensure the availability of Government personnel needed to acknowledge contractor performance.

o The contractor shall recommend a set of spares for CMPP equipment to be maintained at the DeCA CMPP facility.

o When performing maintenance, the contractor will submit a report to the CMPP Manager, Program Manager, COR that identifies each item of equipment serviced to include nomenclature, model, serial number, type of maintenance performed, problems detected, problems corrected, other maintenance performed such as cleaning, dates and time of notification, arrival of repair personnel, date and time repairs completed, list of parts replaced, and signatures of person completing the repairs and the DeCA representative acknowledging repairs.

o In year 6 (option year 5) of this contract, the contractor shall refresh all Information Technology hardware in order to remain current with technology and to satisfy Cybersecurity requirements and to keep the solution hardware current with technology and under maintenance.

7.6.3 Subtask 3. Software Licenses and Maintenance

The contractor will support 50 concurrent users and maintain all software licenses and software including modifications or revisions. The contractor will provide remote system support as part of this software maintenance effort. The contractor shall furnish DeCA with all software updates including modifications, enhancements, corrections, or other revisions and supporting documentation that have been released to the commercial grocery industry. The contractor shall provide product upgrades to include both major scheduled software releases and periodic incremental releases to add minor functionality or resolve software errors. The contractor shall provide a Software Version Description Document detailing the content of all software releases as part of all upgrades.

The contractor shall warrant all COTS software and modifications to COTS software developed under this contract.

This warranty shall apply to software developed to maintain existing operational baselines as well as any software developed in support of new requirements. The warranty shall commence following acceptance of the software by the Government. Both COTS and all third party software shall be warranted for a minimum period of 2 years after the Government has officially accepted the software and released to operational baselines. The Government will not incur any additional costs to have defective software fixed (reworked) and retested to meet original Government requirements specifications when problems are identified with software during the warranty period.

Contractor software support personnel shall be available to diagnose and fix system software malfunctions and to install and adjust any new releases, enhancements, corrections, or updates that may be developed. DeCA HQ will approve all new software releases or updates before their installation. Software maintenance shall begin with completion of DeCA’s system acceptance and authorization of payment for the solution. DeCA reserves the right to accept or reject any software release.

The contractor shall provide software patch and update support for all vulnerabilities and software bug fixes identified by: (1) DeCA security scans, (2) DoD-mandated security patches, and (3) Vendor identified vulnerabilities or software issues for operating systems, databases, third party, and embedded software for all releases for all software within the CMPP solution, including any DeCA customization. All patches are to be certified within 30 days of notification, or documentation provided on the impact to the system if the patch is applied. The contractor will have 15 days to present a plan for DeCA approval on changes that must be made for the patch to be applied without impact to CMPP operations.

The DeCA Cybersecurity staff shall provide the CMPP contractor with each relevant Information Assurance Vulnerability Alert (IAVA). The CMPP contractor shall ensure that the CMPP solution complies with DoD IAVAs within the timeframe required by the IAVA documentation and report compliance to the DeCA Program Manager and DeCA Cybersecurity staff.

In year 6 (option year 5) of this contract, the contractor shall refresh / upgrade all Information Technology software in order to remain current with technology and to satisfy Cybersecurity and DoD patching requirements and to keep the solution software and third party software current and under maintenance.

When patches are identified, the vendor must test the patches in their facility on a similar configured system, present to the DeCA CMPP Configuration Control Board (CCB) to obtain DeCA permission to install the patches in the testbed for DeCA testing. The contractor will provide a cost effective, repeatable methodology for DeCA to test all patches. Once patches are tested and accepted by the CMPP, DeCA will obtain approvals and notify the Vendor on the date and time of installation into the production environment, however, the vendor may be asked to participate in a teleconference with the DeCA Technical Review Board (TRB) or Change Advisory Board (CAB) to obtain DeCA approval before installing any patches, software updates or releases, into the DeCA production environment. An effective test plan and methodology will ensure a successful timely deployment of releases that have no adverse effect on the production environment.

7.6.4 Subtask 4. On-Site Consulting Services (Labor Hours)

Throughout the period of performance, the Government will require professional services in support of the CMPP solution. These services shall be provided on an as needed basis, upon receipt of a request by the CMPP Manager, Program Manager or COR. The services may cover software optimization, troubleshooting beyond what can be solved through a patch, assistance in using, or configuring specific functionality of the software. The Contractor shall provide a qualified Subject Matter Expert (SME) with expertise in software use and design to support this task.

All visits will be tracked using a work report submitted by the Contractor at the end of their visit. This work report will contain the technicians name and title, date, start time, end time, # hours to nearest quarter hour, and work completed. A copy of the work report will be given to the CMPP Manager before leaving the premises. No services will be scheduled or provided until they have been coordinated with the CMPP manager. The maximum number of hours to be used shall not exceed 100 hours per year with an estimated 15 visits per year under this task. On-site visits for troubleshooting software or hardware issues, applying software or security patches fall under the maintenance portion of this task as described in paragraphs 7.6.2 - 7.6.3, and are not included in this subtask.

Deliverables: System Support Plan

Software Maintenance and Patch Support Hardware and Software Upgrade Support Software License Hardware Maintenance Consumable Products

Technician Work Report

7.7 Task 7 – Perform Program Management

The contractor will provide program management and oversight support throughout the contract period and keep the DeCA Program Manager and CMPP Management informed of progress and issues related to CMPP implementation and operations.