Attch_1__PBSOW.pdf

FEDERAL LAW ENFORCEMENT TRAINING CENTERS (FLETC)

RFP HSFLGL-16-R-00026

ATTACHMENT 1

PERFORMANCE BASED STATEMENT OF WORK

FOR

STUDENT ADMINISTRATION & SCHEDULING SYSTEM (SASS)

GLYNCO, GA; ARTESIA, NM; CHARLESTON, SC;

AND CHELTENHAM, MD

DEPARTMENT OF HOMELAND SECURITY

FEDERAL LAW ENFORCEMENT TRAINING CENTERS

PROCUREMENT DIVISION

1131 CHAPEL CROSSING ROAD, BUILDING 93

GLYNCO, GEORGIA 31524

FEDERAL LAW ENFORCEMENT TRAINING CENTERS (FLETC) RFP HSFLGL-16-R-00026

STUDENT ADMINISTRATION AND SCHEDULING SYSTEM (SASS)

Introduction

This is a Performance Based Statement of Work for the Department of Homeland Security, the Federal Law Enforcement Training Centers (FLETC). The scope of this solicitation/contract encompasses four (4) site locations for the FLETC; each will be titled as follows:

SITE I Glynco, Georgia SITE II Artesia, New Mexico SITE III Charleston, South Carolina SITE IV Cheltenham, Maryland

General

a. This is a Performance Based Statement of Work (PBSOW) for the Department of

Homeland Security (DHS) FLETC.

b. The Contractor shall provide and maintain all management, supervision, manpower, training, equipment, supplies, licenses (except Oracle, McAfee AV, and Windows licenses), certificates, insurance, pre-employment screenings, reports, and files necessary to accomplish Student Administration & Scheduling

System support services as described and required in this PBSOW. The

Contractor shall perform to the standards required in this contract and may be expected to work closely with various Government authorities, at the federal, state or local levels throughout the duration of the contract; the Government will not supervise or otherwise direct the contractor.

c. This solicitation/contract contains numerous acronyms. Whenever a new term is introduced in the solicitation/contract that will be referred to by an acronym, the acronym will appear next to the term in parentheses ( ). The acronyms that will appear most frequently in this solicitation/contract are listed below for easy reference:

ATO Authority to Operate CD&M Curriculum Design and Management CIO Chief Information Officer CISO Chief Information Security Officer CLIN Contract Line Item Number CO Contracting Officer COOP Continuity of Operations Plan COR Contracting Officer’s Representative COTS Commercial-Off-The-Shelf DBA Database Administrator DHS Department of Homeland Security

DR Disaster Recovery Site DUNS Data Universal Numbering System EIT Electronic and Information Technology ELP Electronic Learning Portal EOL End of Life FAR Federal Acquisition Regulation FAST FLETC Application for Student Training FISMA Federal Information Security Management Act FLETC Federal Law Enforcement Training Centers FOUO For Official Use Only FTR Federal Travel Regulations GFE Government Furnished Equipment GFI Government Furnished Information GOTS Government-Off-The-Shelf IPT Integrated Project Team HSPD Homeland Security Presidential Directive ISSO Information Systems Security Officer ISTS In-Service Training Support IT Information Technology LD Lead Software Developer LMS Learning Management System MBI Minimum Background Investigation MD Management Directive NIST National Institutes of Standards and Technology OAST Office of Accessible Systems and Technology OMB Office of Management and Budget PBSOW Performance Based Statement of Work PCII Protected Critical Infrastructure Information PCR Program Change Request PER Personnel Security Program P&F Planning and Forecasting PHY Physical Security Program PII Personally Identifiable Information PM Project Manager PO Partner Organization POC Point of Contact POP Period of Performance PPS Principle Period of Service QCP Quality Control Plan RQ Requalification SA System Authorization SAN Storage Area Network SASS Student Administration & Scheduling System SBU Sensitive but Unclassified SDE Service Desk Express SEM Security and Emergency Management

SM Software Manager SOC Security Operations Center SSI Sensitive Security Information SP Security Plan ST Lead Software Tester TCCB Technical Change Control Board TTY Text Telephone USGCB United States Government Configuration Baseline XML Extensible Markup Language XP Export

Table of Contents

1. SCOPE

2. BACKGROUND

2.1. FLETC Mission

2.2. Student Administration & Scheduling System

2.3. Operating and Developmental Environments

3. OBJECTIVE

4. PLACE OF PERFORMANCE

5. PERFORMANCE REQUIREMENTS

5.1. SASS Project Management

5.1.1. Information Technology Security

5.1.1.1. Compliance

5.1.1.2. Contractor IT Security Plan

5.1.1.3. SASS Security Plan

5.1.2. Software License Maintenance Agreements and Inventory

5.1.3. Administrator Guide

5.1.4. Data Calls

5.1.5. Audit Support

5.1.5.1. OMB Circular A-123 Audit Support

5.1.5.2. Security Assessment Support

5.1.6. Technical and Operational Meetings

5.1.7. Configuration Management

5.1.7.1. Contractor Configuration Management Plan

5.1.7.2. Configuration Guide

5.1.7.3. Quality Control Plan

5.1.8. Reports and Documentation

5.1.8.1. Government Review

5.1.8.2. Monthly Status Report

5.1.9. Coordination

5.1.10. Project Team Participation

5.2. SASS Operations & Maintenance

5.2.1. Operations Manual

5.2.2. Hardware and Software Support

5.2.2.1. Hardware Support

5.2.2.2. Software Support

5.2.3. Backups

5.2.4. Security Threat Identification

5.2.4.1. O&M IT Security Responsibilities

5.2.4.2. Security Metrics Report

5.2.5. Life Cycle Management

5.2.5.1. Mandatory Patches

5.2.5.2. Vendor Provided Patches

5.2.5.3. Vendor Provided New Versions

5.2.5.4. End-of-Life

5.2.5.5. Emergency Patches

5.2.6. Help Desk

5.2.7. Quarterly Operations Report

5.2.8. Continuity of Operations

5.2.8.1. IT Contingency Plan

5.2.8.2. Disaster Recovery Plan

5.3. SASS Technical Engineering Services

5.3.1. Program Change Requests

5.3.2. Software Delivery

5.3.3. Technical Engineering Support Tasks

5.3.4. Software Enhancements and Developments

5.3.5. Technical Point of Contact

5.4. Development and Test Environment

5.5. Cloud Migration Support

5.6. Contractor Personnel

5.6.1. General Personnel Requirements

5.6.2. Key Personnel

5.6.2.1. Project Manager

5.6.2.2. Software Manager

5.6.2.3. Database Administrator

5.6.2.4. Lead Software Developer

5.6.2.5. Lead Software Tester

6. GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

6.1. Documentation Access

6.2. Government Furnished Information (GFI)

7. ACCESSING REQUIREMENTS (SECTION 508)

7.1. Section 508 of the Rehabilitation Act

7.2. Compliance Documents

8. TRAVEL

8.1. Post Award Conference

8.2. Program Management Reviews

8.3. Engineering Service Meetings

8.4. Operations and Maintenance Trips

9. PHASE-IN/ORIENTATION PERIOD

10. PHASE-OUT/CONTRACT COMPLETION

11. DHS ENTERPRISE ARCHITECTURE COMPLIANCE

12. INVOICES

13. APPLICABLE DOCUMENTS

14. DELIVERABLES

15. PERFORMANCE REQUIREMENTS SUMMARY

16. APPENDICES

1. SCOPE

The Federal Law Enforcement Training Centers (FLETC) requires the following enterprise Student Administration & Scheduling System (SASS) support services for the

Department of Homeland Security (DHS), FLETC:

a. The Contractor shall provide technical support and expertise for the management and administration of the FLETC enterprise SASS.

b. The Contractor shall be the Tier II point of contact for trouble calls relating to

SASS and provide help desk support as necessary.

c. The Contractor shall provide products, materials, and services that meet or exceed the requirements and performance standards as listed below.

d. The Contractor shall comply with the FLETC and DHS Management Directives, policies, approved architectures, programs, standards and guidelines for

Information Management and Information Technology (IT) Security (See Section

13: Applicable Documents).

This requirement will have a five year period of performance to include a base period of six months and five option periods. The first four option periods will be 12 months each and the fifth and final option period will be six months. There will be a 60 day phase-in period to begin at the start of the base period.

2. BACKGROUND

This Performance Based Statement of Work (PBSOW) describes the level and type of work that shall be performed by the Contractor in support of the Federal Law

Enforcement Training Centers Student Administration & Scheduling System within the

Department of Homeland Security.

2.1. FLETC Mission

The FLETC provides basic and advanced law enforcement training to over 96 Federal

Partner Organizations (POs), as well as to state, local, tribal, campus, and international law enforcement agencies. Annually, the FLETC and its POs provide nearly 500 different training programs to more than 60,000 students at the four domestic training facilities. This is equivalent to over 200,000 student-weeks of training each year.

The FLETC has four domestic training facilities: Glynco, Georgia; Artesia, New Mexico;

Charleston, South Carolina; and Cheltenham, Maryland. Additionally, the FLETC manages the International Law Enforcement Academies (ILEAs) in Gaborone, Botswana and in San Salvador, El Salvador, as well as a Regional Training Center in

Lima, Peru, and supports the International Law Enforcement Academies (ILEA) in

Budapest, Hungary and Bangkok, Thailand.

2.2. Student Administration & Scheduling System

The Student Administration & Scheduling System (SASS) is the enterprise wide training and student management system for the FLETC. The SASS is a collection of integrated commercial off-the-shelf (COTS) products (see Bill of Materials Appendix #1 for list of products). This system encompasses the majority of the FLETC’s mission-critical functions. The key functions of SASS include the following:

Administration

Contacts

Curriculum Design and Management

Financial Management

Housing

Instruction Management

Planning and Forecasting

Reporting

Scheduling

Student Administration

Visitor Registration

2.3. Operating and Developmental Environments

The FLETC has two operating instances of SASS: a Production environment located in Glynco, GA and a Pre-production/disaster recovery site (DR) located in Artesia, NM.

The SASS contractor is responsible for providing their own Test and Development Environments. The contractor shall be responsible for hardware support other than tape libraries and networking equipment located at Glynco and Artesia.

The FLETC is currently exploring cloud options to house SASS operating environments in the future. The contractor shall be able to support the migration from current operating environments to new environments in the cloud.

3. OBJECTIVE

The objective of this PBSOW is to provide performance based standards for the contractor to provide and/or develop the necessary software and support services, personnel, supervision, and management to enhance and maintain the functionality of

SASS.

4. PLACE OF PERFORMANCE

The work shall be performed remotely or at a contractor’s facility. Occasional travel may be required to support the application.

The period of performance (PoP) for this contract encompasses a base period of six months, four individual option periods of twelve months, and a fifth individual option period of six months. The base period of performance for this contract shall last a full six months following the date of award. The first four option years shall begin following the previous base or option year and continue for a full calendar year. The final option period shall begin following the fourth option period and last a full six months.

For example, if the contract was to award on September 2, 2016, the period of performance would be as follows:

Base Period – September 2, 2016 through March 1, 2017

Option 1 – March 2, 2017 through March 1, 2018

Option 2 – March 2, 2018 through March 1, 2019

Option 3 – March 2, 2019 through March 1, 2020

Option 4 – March 2, 2020 through March 1, 2021

Option 5 – March 2, 2021 through September 1, 2021

*Examples only. Award date will vary.

The principle period of service (PPS) shall be normal work days Monday through Friday from 7:00 a.m. to 7:00 p.m. (U.S. Eastern Time). Performance shall be required outside and/or beyond the principle period of service (as defined above); this includes any scheduled maintenance that requires downtime of IT services which shall be accomplished outside the principle period of service, and unscheduled maintenance to respond to an outage or emergency situation outside the principle hours of service.

Unscheduled maintenance to respond to an outage or emergency situation outside the principle period of service will be identified by the Contracting Officer’s Representative (COR) and documented via an email request prior to commencing maintenance.

Emergency and after-hours support shall be included in the firm fixed price for Operations and Maintenance. The Contractor shall be given at least one (1) hour notice prior to having to perform unscheduled work due to an outage or emergency situation outside the principle period of service. This notice may be provided before, during, or after the principle period of service. Unscheduled after hours support notification requirements may be less than one (1) hour with Contractor concurrence. Unscheduled maintenance is rare, having only occurred three times in the past five years. If unscheduled maintenance is determined to take longer than four hours to perform, the contractor shall initiate failover/disaster recovery procedures per requirement 5.2.8.2 and perform the work on the effected environment during the normal PPS.

The Federal Government observes the following holidays which shall not be considered normal work days:

New Year’s Day

Martin Luther King’s Birthday

President’s Day

Memorial Day

Independence Day

Labor Day

Columbus Day

Veterans Day

Thanksgiving Day

Christmas Day

5. PERFORMANCE REQUIREMENTS

5.1. SASS Project Management

The Contractor shall provide a qualified primary Project Manager (PM) to administer all services. The Project Manager (PM) shall be the central focal point for all contractor coordination with the Government. The PM shall have responsibility of ensuring the contractor is successfully performing all requirements of this Performance Based Work

Statement. Any issues with performance shall be brought to the attention of the PM who shall be responsible for preparing a proposed remedy or solution. The PM shall be knowledgeable of the entire scope of the project and shall work with the Government

SASS Program Manager and COR to ensure timelines, schedules, and priorities are coordinated and clearly communicated to all project team members. The contractor shall appoint a qualified Alternate PM to serve in his/her capacity when the PM is not available. Either the PM or the Alternate PM shall be available to the Government for communication at all times. All requirements stated in section 5.1 shall be priced together as one firm-fixed price requirement except for the purchase and renewal of software required by 5.1.2., which shall be priced separately on a time and materials basis. A monthly payment plan for the Firm-Fixed Price may be provided with the proposal.

5.1.1. Information Technology Security

5.1.1.1. Compliance

The Contractor shall maintain compliance with the DHS Sensitive Systems Policy

Directive 4300A, version 12.0.1, February 2016, or subsequent publication, and all other applicable information security laws, regulations and policies to include the Federal

Information Security Management Act (FISMA). See sections 5.2.4 and H Clause 29.

5.1.1.2. Contractor IT Security Plan

The Contractor shall provide, implement and maintain a tailored IT Security Plan in accordance with the list of deliverables. The plan shall be delivered to the Government in accordance with HSAR 3052.204-70, Security Requirements for Unclassified

Information Technology Resources for Government approval. Upon Government approval the plan will be incorporated into the contract as a compliance document.

5.1.1.3. SASS Security Plan

The contractor shall maintain and keep updated the SASS Security Plan (SP). This plan must detail how the IT system/application meets the required DHS 4300A security controls, as well as the NIST SP 800-53 controls. The Government will provide the current SASS SP to the contractor within 15 days after contract award. Once the contractor receives the current SP they will have 30 days to either agree to keep the same controls and abide by the current plan or submit a new Security Plan which will require approval by the contracting officer. The contractor shall abide by the current SP until a new one is approved by the contracting officer. The Contractor shall update the

SP to address all applicable security controls 30 days before the beginning of each new option period. The plan shall be reviewed by the Government Information Systems

Security Officer (ISSO) prior to acceptance. For guidance on applicable security controls, the Contractor shall use the NIST SP 800-53 moderate baseline as a guide for acceptable security countermeasures.

5.1.2. Software License Maintenance Agreements and Inventory

The Government will provide and maintain the Oracle and McAfee AV software licenses. The Contractor shall maintain all other software licensing information for all environments, devices and software covered in the scope of this contract. This includes purchasing and renewing licenses and software maintenance as necessary. Prior to the purchase of new software or related licenses or maintenance services the contractor shall provide the COR with three separate quotes for comparison. All software licenses must be approved by the COR prior to purchase. All software licenses shall be priced on a time and materials basis and shall not be included as part of the Firm Fixed Price for other requirements in Section 5.1 of this PBSOW.

The software shall be licensed to the Government. Software licensing information shall be provided to the Government as requested by the COR or PM in the form of a Bill of

Materials (BOM). The BOM shall include name of software, quantity, and renewal dates and serve as the SASS software inventory. The current SASS BOM is provided in

Appendix #1.

The contractor shall be responsible for keeping the BOM up-to-date and accurate. Any changes to the BOM, shall be coordinated through and approved by the COR. Once a change has been made to the BOM the contractor shall provide an updated BOM to the

COR within 30 days. The contractor shall also deliver an updated BOM with new license renewal dates 30 days before the beginning of each new option period.

5.1.3. Administrator Guide

The Administrator Guide documents instructions for Government SASS administrators to perform system administrative actions. The Government will provide the current

Administrator Guide to the contractor within 15 days after contract award. The contractor shall deliver an updated version 30 days before the end of each performance period and in conjunction with the execution of any modification that alters the

Administrator Guide. The Contractor shall maintain and update the Administrator

Guide as scheduled or after any significant changes, as identified in the list of deliverables.

5.1.4. Data Calls

The Contractor shall research, gather, and provide information as necessary in support of data calls received by the Program Manager, Contracting Officer, or COR.

5.1.5. Audit Support

The contractor shall support the SASS Program Office during audits intended to demonstrate SASS compliance with applicable directives, guidance, and controls. The contractor shall support these audits by participating in meetings and discussions. The contractor shall respond to audit preparations, data calls, findings remediation, request for information, etc., that may result from an audit process.

5.1.5.1. OMB Circular A-123 Audit Support

SASS is classified as a financial system and is subject to financial internal controls audits three times a year. The audit measures compliance with the Office of

Management and Budget (OMB) Circular A-123. Upon the request of the SASS

Program Office, the contractor shall assist with the development of artifacts that prove that SASS is in compliance with the appropriate controls. The quantity and nature of those artifacts are determined by the auditors at the time of inspection and are subject to change from inspection to inspection. The artifacts supporting an audit are usually screenshots taken to demonstrate a certain control in place for SASS.

5.1.5.2. Security Assessment Support

To maintain an Authority to Operate (ATO) SASS must undergo a Security Assessment every three years. The security assessment measures SASS compliance to required security controls in accordance with DHS 4300A and FISMA. The contractor shall support the SASS Program office during these assessments.

5.1.6. Technical and Operational Meetings

The Contractor shall attend meetings as required in the performance of this contract.

This includes, but is not limited to weekly status meetings, weekly Technical Change

Control Board (TCCB) meetings, discussions regarding IT operational issues, discussions regarding IT security issues, etc. FLETC will provide one Government furnished toll free line for teleconferences used primarily for coordinating SASS issues within the SASS user community and FLETC for SASS issues.

5.1.7. Configuration Management

The Contractor shall present all proposed changes to the FLETC SASS Program Office and COR prior to coordinating with the appropriate DHS Change Control Boards and/or

FLETC Technical Change Control Boards for approval prior to proceeding with the change.

5.1.7.1. Contractor Configuration Management Plan

The Contractor shall provide a Contractor Configuration Management Plan (CCMP) as part of their proposal package. This plan shall document how the Contractor performs configuration management within their organization.

The contractor shall develop the CCMP in accordance with guidance provided in NIST

SP 800-53. The CCMP shall at a minimum:

a. Address roles, responsibilities, and configuration management processes and procedures

b. Establish a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items

c. Define the configuration items for the information system and place the configuration items under configuration management, and

d. Be protected from unauthorized disclosure and modification

5.1.7.2. Configuration Guide

The contractor shall maintain a Configuration Guide. The Configuration Guide shall include the hardware and software inventories of SASS in their current configuration. A redacted version of the Configuration Document is provided in Appendix #3. The redacted version represents a snapshot in time and may not reflect the latest configuration by the time of contract award. The complete Configuration Guide with actual server names and IP addresses will be provided to the contractor within 15 days of contract award. The contractor shall deliver an updated version 30 days before the end of each performance period and in conjunction with the execution of any modification that alters the Configuration Guide.

5.1.7.3. Quality Control Plan

The Contractor shall submit a Quality Control Plan (QCP) to the Government as part of their proposal. The QCP shall demonstrate how the contractor handles quality control and will ensure compliance to the Acceptable Quality Levels established in the

Performance Requirements Summary of Section 15 of this PBSOW. The QCP shall be kept up-to-date to reflect the contractor’s current quality control policy and procedures and shall be made available to the Government upon request of the COR. The contractor shall submit any changes to the QCP to the COR for approval prior to implementation.

5.1.8. Reports and Documentation

5.1.8.1. Government Review

The Contractor shall prepare the necessary reports and documentations in accordance with the performance of this PBSOW. All reports shall be delivered in accordance with the Contractor Required Submittals listed in Section 14.

The Government will review reports within 5 working days. If updates are required, the

Contractor shall have up to 5 working days to submit a final report. If the Government does not provide comments within 5 working days, the initial submittal becomes the final.

Deliverables other than the Monthly Status Report, Security Metrics Report, and

Quarterly Operations Report will require a 15 day Government Review Period. If the

Government does not provide comments within 15 working days, the initial submittal becomes the final.

5.1.8.2. Monthly Status Report

The contractor shall provide a monthly status report to the Contracting Officer, COR, and SASS PM no later than 5 work days after the end of each month in the period of performance. The monthly status report shall include:

a. A summary of the reporting month’s key events, milestones achieved, problems encounters, resolutions enacted

b. Any changes to the contractor’s current mode of operation, business practices, or personnel currently working on this effort

c. A level of detail of the work performed by listing the PCR ticket numbers worked on during the reporting month

d. Hours worked on problem resolution, delivery status and either a completed or pending status of the ticket

e. A listing of Government Furnished Equipment that is allocated to the contractor in support of this contract effort

f. Proposed patches, upgrades, updates, or other system changes to be implemented in the next month and their potential impacts in terms of cost, schedule, and performance

g. A list of any patches, upgrades, updates, or other system changes implemented in the reporting month

A sample Monthly Status Report is provided in Appendix #4.

5.1.9. Coordination

The Contractor shall be required to coordinate with other contracted service providers and government agencies to ensure that all aspects of the FLETC enterprise SASS run efficiently. The Contractor shall coordinate with all other DHS Help Desks that are applicable for Tier I, Tier II and Tier III incidents that are beyond the immediate scope of the FLETC enterprise SASS, and shall also coordinate with all other DHS Help Desks that are applicable for all incidents that are escalated. Other contracted or provided services that may require Contractor coordination or system interface include, but are not limited to:

FLETC Momentum Financial Management System application and hardware services support

FLETC Learning Management System (LMS) Plateau/Meridian

FLETC Badging System – Easy Lobby/Velocity

FLETC Online Campus

5.1.10. Project Team Participation

The Contractor shall participate as an active member of the Integrated Project Teams

(IPTs) and other technical teams to evaluate proposed new hardware, software, IT technologies, security technologies, video technologies, and voice technologies to certify that technologies being introduced into the FLETC IT infrastructure are compatible and maintainable with the FLETC environment without introducing conflicts or unacceptable risks.

5.2. SASS Operations & Maintenance

The Contractor shall provide hardware and software support, system administration, database administration, help desk operations and periodic security assessments as identified in the SASS Operations Manual. The Contractor shall provide hot fixes, patches, upgrades, and updates to ensure the operational readiness of the current software. All requirements stated in section 5.2 shall be priced together as one firm-fixed price requirement. A monthly payment plan for the Firm-Fixed Price may be provided with the proposal.

5.2.1. Operations Manual

A redacted version of the Operations Manual is provided in Appendix #5. The redacted version represents a snapshot in time and may not reflect the latest configuration by the time of contract award. The Government will provide the complete Operations Manual with actual server names and IP addresses to the contractor within 15 days after contract award. The Contractor shall maintain and update the manual as scheduled or after any significant changes, as identified in the list of deliverables. The contractor shall deliver an updated version 30 days before the end of each performance period and in conjunction with the execution of any modification that alters the Operations Manual.

5.2.2. Hardware and Software Support

The contractor shall respond to software, hardware and/or connectivity problems that may require the contractor to install, configure, upgrade, troubleshoot, diagnose, test, monitor, and document changes within the SASS operating environments. The contractor shall provide direct end user support on the proper use and operation of

5.2.2.1. Hardware Support

The contractor shall install, configure, upgrade, troubleshoot, and maintain all hardware devices required to keep the FLETC SASS operational and secure in accordance with FLETC and DHS policies. Hardware includes but is not limited to, Security Area Network (SAN), network equipment, and servers. The contractor may also be required to move and ship components of SASS between various FLETC facilities and locations at the Government’s expense.

The contractor shall coordinate the repair of FLETC hardware devices covered by Original Equipment Manufacturer (OEM) warranties to include, but not limited to, performing initial diagnostics, contacting/escorting contractors and arranging for receipt and return of equipment. The contractor shall contact the appropriate vendor, FLETC Government personnel or other contractors for referrals of work orders to the appropriate specialist for resolution when necessary.

For hardware no longer supported by OEM warranties, the Government will be responsible for replacing the hardware end item or failing subcomponent at its own expense. The contractor shall install the new hardware or subcomponent, configure it, and be responsible for making it operational.

The contractor shall direct all hardware incidents not impacting services to the SASS PMO for review prior to taking remediating action. For all incidents impacting services that occur within the PPS, every effort should be made to contact the SASS PMO prior to taking remediating action, but if no direction is received within five minutes of alerting the SASS PMO of the incident, the contractor shall proceed while continuing to seek direction from SASS PMO at the earliest possible time. All hardware incidents impacting services that occur outside the PPS, will be identified by the COR and documented via an email request prior to commencing maintenance. The Contractor shall be given at least one (1) hour notice prior to having to perform unscheduled work due to an outage or emergency situation outside the principle period of service. This notice may be provided before, during, or after the principle period of service.

Unscheduled after hours support notification requirements may be less than one (1) hour with Contractor concurrence. Unscheduled maintenance is rare, having only occurred three times in the past five years. If unscheduled maintenance is determined to take longer than four hours to perform, the contractor shall initiate failover/disaster recovery procedures per requirement 5.2.8.2 and perform the work on the effected environment during the normal PPS.

5.2.2.2. Software Support

a. The Contractor shall install, configure, upgrade, troubleshoot, diagnose, test, monitor, document COTS software applications and to ensure compatibility with

b. The Contractor shall manage software integration and ensure total system functionality is maintained; to include coordination with other system owners or maintainers of systems that depend on SASS. The Contractor shall be responsible for contacting the appropriate vendor, FLETC Government personnel, or coordinate with other contractors for referrals of work orders to the appropriate specialist for resolution.

c. The Contractor shall Install, or coordinate with potential Cloud service provider personnel for installation, software upgrades that conform to industry standards for writing, documentation, testing and installation

d. The Contractor shall ensure all production system updates are completed after

7:00 p.m. Eastern on weekdays or a FLETC approved time during a weekend unless otherwise directed by the SASS PMO

e. The Contractor shall maintain and support the SASS database. The Contractor shall identify database issues which conflict with the performance or functionality of the installed applications. The Contractor shall identify and document database performance issues within a software tracking system, and provide

SASS PMO a proposed solution for review and approval.

f. The Contractor shall ensure that system latency shall not cause SASS web page refreshes to average more than 5.0 seconds to display entire page contents on a monthly basis. System latency caused web page refresh delays shall not exceed

8.0 seconds to display entire page contents. FLETC will investigate network latency issues at the Contractor’s written request to the program manager should they arise.

g. The contractor shall ensure SASS maintains 99.99% uptime during PPS. The availability of SASS shall be measured by the ability of users to obtain basic access to SASS and its major components. If SASS users cannot access any part of SASS Production Environment, the system is considered 100% unavailable. If users can access SASS but one or more of the components listed below are inaccessible then the system availability will be based on the operational components.

The weighted percentages for the components of SASS for purposes of measuring availability are below. For example, if the weighted percentage is

10%, then amount of time the component is unavailable shall be multiplied by 0.1 and counted against total system availability.

10%- SASS Portal hosting and any of the basic applications (CD&M, P&F, Instructor Management, Scheduling, Housing, Student Registration, Visitor

Registration, Administration)

15%- The WebFocus server used to for retrievals and reports

25%- The Scheduling servers to include scheduling and housing

50%- The Plateau LMS server

h. The contractor shall respond to security issues encountered during PPS within

0.5 hour a minimum of 95% of the time.

i. The contractor shall resolve security issues within 24 hours assuming that their resolution is within the scope of the contract a minimum of 95% of the time.

j. The contractor shall respond to Tier II help desk requests and system issues reported during PPS within 0.5 hour a minimum of 95% of the time.

k. The contractor shall respond to Tier II help desk requests and system issues reported during non-PPS by the next work day within the first hour of the PPS a minimum of 95% of the time.

l. The contractor shall resolve Tier II help desk requests and system issues reported within 24 hours a minimum of 95% of the time.

Inability to access all or portions of SASS due to any of the below listed reasons is considered outside the scope of SASS uptime measurement and will not be the contractor’s responsibility:

a. Lack of current, legitimate user access permissions

b. Network, Wi-Fi and internet outages or instability

c. Datacenter problems such as problems with electricity or cooling or physical damage to hardware (to include shaking or disconnection of components by non-contractor personnel

d. Problems with the user’s PC or other device hosting a browser that is being used to access SASS. This would include problems caused by use of browsers or versions of browsers or other PC software not defined for use with SASS

e. Problems with individual mobile computing devices

f. Problems with firewalls outside the SASS demarcation line

g. Errors or limitation in Government or third party provided hardware outside of the contractor’s control

h. Errors or limitations in COTS software outside of the contractor’s control.

5.2.3. Backups

The Contractor will conduct daily incremental and weekly full backups of SASS. Backup tapes will be stored off-site along with the remaining FLETC back-up tape sets. If

FLETC migrates to alternative backup storage SASS backups will be migrated to new location. At such time, contractor will be responsible for ensuring backups run successfully according to schedule. The contractor shall conduct a recovery test at the

Government’s request to ensure data is probably backed up. Such recovery tests shall be conducted periodically and shall be limited to a few files of the Government’s choosing.

5.2.4. Security Threat Identification

5.2.4.1. O&M IT Security Responsibilities

The Contractor shall review, test and implement the IT security guidance received from

FLETC and DHS, System Authorization (SA), System Test and Evaluations, Security

Policies, Hardening Guidelines, National Institutes of Standards and Technology (NIST), Security Plan (SP), United States Government Configuration Baseline (USGCB), and

Information Systems Security Officer (ISSO) and Chief Information Security Officer

(CISO) guidance for all enterprise IT Systems. This includes but is not limited to:

a. Identifying and reporting security incidents

b. Researching security events/incidents for technical causes and applying the appropriate fixes

c. Supporting security investigations pertaining to inappropriate staff behavior by making data available to the investigator(s)

d. Security hardening of all software

e. Installation of all required security patches

f. Developing, implementing and conducting backup and recovery procedures for all software applications and databases

g. Assist in developing, testing and implementing IT Contingency Plans

5.2.4.2. Security Metrics Report

The Contractor shall provide a monthly security metrics report documenting the performance of the requirements listed in section 5.2.4.1. The report shall be due within

5 work days after each month during the period of performance.

5.2.5. Life Cycle Management

The Contractor shall ensure the application, database, and operating system software comprising SASS is kept up to date with updates from the vendors. The contractor shall assist the Government in planning for the End of Life (EOL) for both software and hardware by notifying the Government of impending EOL dates and helping to identify recommended replacements. The contractor shall review Service Desk Express (SDE) tickets assigned to SASS by the FLETC Security Operations Center (SOC) for potential patches or actions that need to be implemented. The contractor shall decide which patches are applicable to SASS and assign a ticket using software ticketing software for those patches that are applicable.

5.2.5.1. Mandatory Patches

The contractor shall implement mandatory patches as directed by the Government, especially as it pertains to IT security as required in Section 5.2.4.1.

5.2.5.2. Vendor Provided Patches

The contractor shall identify recommended patches to the SASS Program Office prior to implementation for approval. If approved, the patch should be recorded on the configuration document.

5.2.5.3. Vendor Provided New Versions

The contractor shall identify recommended new versions to the SASS Program Office prior to implementation for approval. If approved, the version should be recorded on the configuration document.

5.2.5.4. End-of-Life

The contractor shall identify hardware and software that are approaching EOL to the

SASS Program Office. The contractor shall make recommendations for EOL replacements and assist the Government in planning for any replacement effort.

5.2.5.5. Emergency Patches

Emergency patches and updates shall be tested and installed within 48 hours of notification, or sooner based on appropriate FLETC or DHS guidance.

5.2.6. Help Desk

The SASS Contractor shall provide a Tier II help desk for SASS on normal work days from 7:00 a.m. – 7:00 p.m. Eastern Time. The Tier II help desk shall be responsible for creating SASS user accounts, resetting user’s accounts, assisting users with the system and providing technical support for the system. All issues with user hardware shall be redirected to the FLETC IT Service Desk contractor and will be tracked using the

FLETC ticketing system. The FLETC IT Service Desk contractor will field all calls for customer support that are not routed directly to the SASS Contractor via the automated

“SASS Access Request” which is available on the FLETC IT Self Service Portal; any calls that come in via the non-automated process will be assigned to the SASS Group in the ticketing system for resolution. The SASS Contractor shall detail what action was taken on a ticket in the “Comments” or “Resolution” section of the ticketing software prior to closing the ticket.

5.2.7. Quarterly Operations Report

The Contractor shall prepare a quarterly operations report. The report shall be delivered to the Contracting Officer, COR, and SASS PM within 5 work days of the end of each quarter during the period of performance. The first quarter shall end after the completion of the third calendar month after contract award. The quarterly report shall capture the metrics required by section 5.2.2.2. The report shall include:

a. Web page response/process metrics that identify all SASS pages that take more than 5 seconds to process

b. Remediation efforts to reduce response time for all pages exceeding 5.0 seconds

c. System uptime as a percentage during the quarter and a comparison to system uptime for previous quarter

d. Number of security issues reported within the PPS and the number and percentage responded to within 0.5 hour

e. Number of security issues reported outside the PPS and the number and percentage responded to within 2 hours

f. Number and percentage of security issues resolved within 24 hours

g. Recap of software patches required, taken, and not taken during the reporting quarter

h. Number of Tier II Help Desk issues received during PPS and number and percentage responded to within 0.5 hour

i. Number of Tier II Help Desk issues received outside of PPS and number and percentage responded to by the next business day

j. Number and percentage of Tier II Help Desk issues resolved within 24 hours

k. Time required to move system from the Primary Site to the Backup Site during a disaster recovery test if one was taken during the reporting quarter with a comparison to the previous time required to move the system

l. Percentage of system backups completed on time

A sample Quarterly Operations Report is provided in Appendix #6.

5.2.8. Continuity of Operations

The contractor shall abide by the Government approved IT Contingency Plan and

Disaster Recovery Plan to ensure SASS continuity of operations during the event of a system failure or disaster event.

5.2.8.1. IT Contingency Plan

The contractor shall maintain and keep updated the SASS IT Contingency Plan. The IT

Contingency Plan shall:

a. Identify essential missions and business functions and associated contingency requirements

b. Provide recovery objectives, restoration priorities, and metrics

c. Address contingency roles, responsibilities, assigned individuals with contact information

d. Address maintaining essential missions and business functions despite an information system disruption, compromise, or failure

e. Address eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented

f. Be reviewed and approved by the Government SASS Program Manager and

Information Systems Security Officer (ISSO)

The Government will provide the current SASS IT Contingency Plan to the contractor within 15 days of contract award. Upon receipt it shall be the contractor’s responsibility to maintain and notify the Government of any updates. The contractor shall provide an updated IT Contingency Plan within 45 days of contract award and 30 days before the end of each performance period and in conjunction with the execution of any modification that alters the IT Contingency Plan. All changes or updates to the IT

Contingency Plan must be approved by the Contracting Officer.

5.2.8.2. Disaster Recovery Plan

In the event of a system failure in the Production environment, the system shall be capable of full operation in a failover status within four hours. The contractor shall deliver and maintain a step-by-step process for how the disaster recovery will be performed within the 45 days of contract award. An updated version shall be delivered

30 days before the end of each performance period and in conjunction with the execution of any modification that alters the Disaster Recovery Test. The contractor shall be required to successfully demonstrate that SASS can be operational in a failover status within four hours using the procedures approved as part of the Disaster Recovery

Plan. This Disaster Recovery test shall be conducted at least once annually. The

Contractor shall include a summary report of both Failover and Failback within five work days after the conclusion of the test.

5.3. SASS Technical Engineering Services

The Contractor shall provide technical services for the daily operation of SASS. Modes of providing technical support shall include telephone, email, and delivery of data files, developing software and enhancements and creation of new reports. All Program

Change Requests shall be documented within the software ticketing system in accordance with paragraph 5.3.1 (see Appendix #2 for historical data). Application upgrades shall be tested prior to releasing on the production and pre-production environments. All requirements of section 5.3 shall be priced as a Not-to-Exceed

Amount on a Time and Materials CLIN.

5.3.1. Program Change Requests

SASS currently uses the JIRA tracking software to capture Program Change Requests

(PCRs). PCRs shall be used to capture all changes that are required to the SASS baseline code. PCRs shall be created within tracking software and be given an initial priority by the end user. The final priority will be set by the FLETC SASS Program

Office. The Contractor shall participate in a meeting at least once a week with the

FLETC to review all new PCRs submitted within the tracking system. The priority code shall be one of the following:

a. Urgent - (1): Component Failure. This issue must be responded to immediately.

The Contractor must acknowledge the PCR within 30 minutes during PPS. The

Contractor must provide a work around or software fix within 8 PPS hours.

b. High - (2): System degraded. The issue has caused limitations to operational capability of system; however, the issue is not considered critical. The software fix shall be delivered within the next software release. The Contractor is expected to provide a work around if possible.

c. Medium - (3): Some part of the system is not working but a work around has already been identified.

d. Low - (4): There is an issue with the system, but no loss of functionality.

e. Enhancement - (5): This is an improvement to the system that would enhance productivity.

The Contractor shall provide the Government SASS Program Manager, COR, and other designated SASS PMO personnel with access to the software tracking system upon request.

5.3.2. Software Delivery

The contractor shall deliver tested and functional software on a regular basis.

a. The Contractor shall deliver software releases of tested software fixes and enhancements based on the PCRs that were scheduled, fixed and tested for the software delivery. Software releases shall be delivered at least once a month but can be delivered more frequently with approval from the SASS PMO. All software deliverables shall comply with the applicable technical and functional performance criteria of Section 508 unless exempted.

b. The software shall be first placed on the pre-production system allowing for

Government acceptance testing. Following acceptance testing, the Contractor shall move the software to the production system.

c. The contractor shall ensure that no more than 10% of the PCR tickets delivered on a software delivery to pre-production require rework after Government testing.

d. The contractor shall ensure that no more than 2% of delivered PCR tickets on a software delivery to production require rework.

e. The contractor shall have a backout mechanism that would allow either environment to fall back to a previous software version in the event that a pushed drop or fix contains serious flaws.

5.3.3. Technical Engineering Support Tasks

The contractor shall provide technical engineering support. Technical engineering support includes, but is not limited to:

a. Providing fixes to software bugs, errors or other deficiencies

b. Providing operational testing of SASS software patches and versions

c. Providing technical oversight for data conversions

d. Providing technical problem support on servers, software, third party software, and database issues by responding to request for technical support within 24 hours;

e. Developing new reports or modify existing reports using WebFOCUS, Oracle and

HTML as necessary

f. Developing or modifying new scripts for data extracts, updates or modify existing scripts, as necessary

5.3.4. Software Enhancements and Developments

The Contractor shall provide software enhancements and development for SASS.

Enhancements are improvements to the current system that improve the process or efficiency of the system. Development is defined as a substantial amount of work in a functional area or new development of a capability. The enhancements and development will be documented in the ticketing system for prioritization and tracking.

An example of a potential future software development requirement will be the creation of an interface between SASS and the online campus learning environment that the

FLETC is developing for student use. The online campus will feature both Blackboard

Learn and Adobe Connect and is expected to interface with the Student Administration

& Scheduling System.

Appendix #2 to this PBSOW contains charts depicting two previous years of updates in the various functional areas to include bug fixes, development and enhancements.

Any of the functions of SASS could require development or enhancement as part of this

PBSOW. The functions of SASS are listed as follows.

5.3.4.1. Curriculum Design and Management (CD&M)

The Curriculum Design and Management (CD&M) process involves the automation of much of the curriculum design, lesson plan and…