Attachment 1 - Statement of Objectives Version 1 8.25.11.doc

HT0011-11-R-0003

Attachment 1 – Statement of Objectives, Version 1 (8/25/11)

STATEMENT OF OBJECTIVES (SOO)

PACIFIC JOINT INFORMATION TECHNOLOGY CENTER (Pacific JITC) Table of Contents

BACKGROUND & SCOPE

51.1

BACKGROUND

51.2

SCOPE

51.3

NON-PERSONAL SERVICES

51.4

SEVERABLE / NON-SEVERABLE SERVICES

61.5

INHERENTLY GOVERNMENTAL FUNCTIONS

61.6

ACQUISITION FUNCTIONS CLOSELY ASSOCIATED WITH INHERENTLY GOVERNMENTAL FUNCTIONS

REQUIREMENTS

62.1

PROGRAM MANAGEMENT

62.1.1

TASK MANAGEMENT

62.1.2

MONTHLY PROGRESS REPORT (MPR) – DELIVERABLE 2

62.1.3

SUBCONTRACTOR EXPENDITURES REPORT – DELIVERABLE 3

62.1.4

CONTRACT WORK BREAKDOWN STRUCTURE (CWBS) – DELIVERABLE 4/ DELIVERABLE 5

72.1.5

EARNED VALUE MANAGEMENT (EVM) – DELIVERABLE 7/DELIVERABLE 8

72.1.6

TRANSITION SUPPORT DELIVERABLE 9

72.1.7

PROGRAM MANAGEMENT PLAN – DELIVERABLE 10

72.1.8

QUALITY CONTROL PLAN – DELIVERABLE 11

72.1.9

CONTINGENCY OPERATIONS PLAN – DELIVERABLE 12

82.1.10

OPERATIONS DURING EMERGENCY SITUATIONS

TASK ORDER ISSUANCE PROCESS

83.1

TASK ORDER PROPOSAL REQUEST (TOPR)

83.2

TASK ORDER PROPOSAL (TOP)

93.3

ISSUANCE OF TASK ORDERS

93.4

REQUEST FOR POST AWARD ACTION

93.5

REVISED TASK EXECUTION PLAN

103.6

MEETINGS AND REVIEWS

103.6.1

POST-AWARD CONFERENCES

103.6.2

PROGRAM REVIEWS

103.6.3 IN-PROGRESS REVIEWS (IPRs)

103.6.4

OTHER GOVERNMENT MEETINGS

CONTRACT TASKS

104.1.1

CONCEPT OF OPERATIONS (CONOPS,) STUDIES & ANALYSES

104.1.2

PROOF OF CONCEPT, CONCEPT MODELING & SIMULATION DEVELOPMENT

114.1.3

TEST & EVALUATION

124.1.4

TECHNOLOGY INSERTION, INTEGRATION & TRANSITION SUPPORT

124.1.5

INSTALLATION SERVICES

124.1.6

TECHNICAL DATA MANAGEMENT SERVICES

134.1.7

TRAINING SUPPORT

134.1.8

OPERATIONAL EXERCISE SUPPORT

134.2

METHOD OF DELIVERY

134.3

SHIPPING

134.4

DELIVERY SCHEDULE ABBREVIATIONS

144.5

DELIVERABLE / DELIVERY SCHEDULE

154.6

NON-DISCLOSURE / NON-USE AGREEMENT – DELIVERABLE 1

164.7

INFORMATION ASSURANCE

164.7.1

PUBLIC KEY INFRASTRUCTURE

164.7.2

PHYSICAL SECURITY

164.7.3

PERSONNEL SECURITY

174.7.4

SECURITY DESIGN AND CONFIGURATION

214.7.5

ENCLAVE AND COMPUTING ENVIRONMENT

234.7.6

PHYSICAL AND ENVIRONMENTAL

244.7.7

CONTINUITY

244.7.8

ENTERPRISE ARCHITECTURE (EA)

254.7.9

MHS ENTERPRISE ARCHITECTURE REQUIREMENTS -- SPECIAL REQUIREMENTS

284.7.10

INTERNET PROTOCOL VERSION 6 (IPV6)

284.8

PROTECTION OF INFORMATION

284.8.1

CONTRACTOR EMPLOYEES

294.8.2

BUSINESS ASSOCIATES

324.8.3

PUBLIC KEY INFRASTRUCTURE AUTHENTICATION AND ENCRYPTION.

324.9

ACCESS REQUIREMENTS

324.9.1

CONTRACTOR ACCESS TO HA/TMA NETWORK/DOD SYSTEMS

334.10

DEVELOPMENT

334.11

QUALITY ASSURANCE

334.11.1

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

344.11.2

PERFORMANCE REQUIREMENTS SUMMARY MATRIX

344.11.3

PERFORMANCE EVALUATION PROCESS

Error! Bookmark not defined.4.11.4

SECTION 508 REQUIREMENT

APPLICABLE DOCUMENTS AND DEFINITIONS

345.1

COMPLIANCE DOCUMENTS & REFERENCE DOCUMENTS

GLOSSARY OF ACRONYMS

1 BACKGROUND & SCOPE

1.1 BACKGROUND

The Pacific Joint Information Technology Center (Pacific JITC) based in Maui, Hawaii is the Military Health System (MHS) recognized center for research studies, proof of concept demonstrations and prototyping of Information Management/Information Technology (IM/IT) products and services to support Department of Defense (DoD) medical readiness requirements and IT modernization needs across the medical continuum of care. Pacific JITC’s mission is:

“To rapidly research, test and develop warfighter medical solutions and products, through pilots or prototypes that provide mission critical value and actionable information to the DoD, including the Services, Combatant Commanders, and the Department of Veterans Affairs (VA).”

Selection of tasks and funding is based on highest priority, best technical/research approach and highest confidence for feasibility for those that have the greatest potential to be transitioned to products with Program Objective Memorandum (POM) core funding within 6-36 months – “Relevant Requirements – Rapid Results”.

This Statement of Objectives (SOO) provides the general requirements for the Contractor’s services for medical IM/IT related research studies, proofs of concepts, prototyping and demonstrations of advanced technology to address specific medical information needs.

1.2 SCOPE

This SOO provides general requirements. Specific requirements will be defined in subsequent Performance Work Statements (PWS) for individual task orders. In all cases the Contractor shall provide all resources and perform all necessary functions in accordance with industry acceptable practices and standards in delivering biomedical/clinical, technical and other research and development services.

These services will support and/or provide:

· Services will be in support of medical IM/IT research studies and creating related proofs of concept, pilots, prototypes and Advanced Concept Technology Demonstrations (ACTDs) and could also include migrating successful ACTDs to acquisition programs using the Business Capability Lifecycle (BCL) approach.

· Project planning, and developing project plans under Government direction. Acquisition of materials and personnel, and project execution to accomplishment of defined objectives.

1.3 NON-PERSONAL SERVICES

This award identifies services that are strictly non-personal in nature.

1.4 SEVERABLE / NON-SEVERABLE SERVICES

This award identifies services that are severable in nature.

1.5 INHERENTLY GOVERNMENTAL FUNCTIONS

This requirement has been reviewed and contains no services that are inherently governmental functions.

2 REQUIREMENTS

2.1 PROGRAM MANAGEMENT

2.1.1 TASK MANAGEMENT

The Contractor shall provide sufficient management to ensure that the contract tasks are performed efficiently, accurately, on time, and in compliance with the requirements of this document. Specifically, the Contractor shall designate a single manager to oversee this task and supervise staff assigned to this task. The Contractor shall ensure that a Monthly Progress Report (Deliverable 2) is submitted outlining the expenditures, billings, progress, status, and any problems/ issues encountered in the performance of the tasks.

2.1.2 MONTHLY PROGRESS REPORT (MPR) – DELIVERABLE 2

The Contractor shall ensure that a MPR is submitted for each individual task order outlining the expenditures, billings, progress, status, and any problems/ issues encountered in the performance of the tasks (Deliverable 2). This must be submitted in the format and using tools prescribed by Pacific JITC (to be determined).

The MPR shall include the labor hours expended, by labor category, for each task and sub-task.

The MPR shall measure the Contractor’s cost and schedule performance using either the Government-approved Work Breakdown Structure (WBS) or a separate arrangement as mutually agreed upon by the Government and the Contractor. The Contractor shall require all Subcontractors to provide input to the MPR where there are critical or significant tasks related to the prime contract. Critical or significant tasks shall be defined by mutual agreement between the Government and Contractor.

2.1.3 SUBCONTRACTOR EXPENDITURES REPORT – DELIVERABLE 3

If Subcontractors are used, the Contractor shall prepare and deliver a Subcontract Expenditures Report (Deliverable 3) that discloses actual subcontract expenditures by company name, business size standard (i.e. Native Hawaiian Owned, Woman Owned Business, Veteran Owned Business, etc.), and other socioeconomic programs (i.e. Indian Incentive Program, Historically Black Colleges and Universities and Minority Institutions, etc.).

2.1.4 CONTRACT WORK BREAKDOWN STRUCTURE (CWBS) – DELIVERABLE 4/ DELIVERABLE 5

Contract Work Breakdown Structure (CWBS) is required for each task order. (Deliverable 4)

For each CWBS, a CWBS dictionary shall be submitted with all the acronyms used in the CWBS (Deliverable 5).

2.1.5 EARNED VALUE MANAGEMENT (EVM) – DELIVERABLE 7/DELIVERABLE 8

Earned Value Management (Deliverables 7 and 8) will be defined in the task orders as required.

2.1.6 TRANSITION SUPPORT DELIVERABLE 9

Outgoing Transition Plan (Deliverable 9) will be defined in the task orders.

2.1.7 PROGRAM MANAGEMENT PLAN – DELIVERABLE 10

The Contractor shall develop a Program Management Plan (Deliverable 10) that shall require Government approval. This plan shall be applied by the Contractor to manage, track and evaluate the Contract performance. The Program Management Plan shall consist of control policies and procedures in accordance with standard industry practices for project administration, execution and tracking.

The Program Management Plan shall include the following:

· Identification of milestones where Government information/activity is required and timeline dependencies for subsequent Contractor activities;

· An Integrated Master Management Plan (IMMP) describing the Contractor’s overall management approaches, policies and procedures including suggested project metrics; and,

· A detailed staffing plan.

The Program Management Plan shall be due five (5) calendar days after the award of the task order.

2.1.8 QUALITY CONTROL PLAN – DELIVERABLE 11

The Contractor shall prepare and adhere to a Quality Control Plan (QCP). The QCP will initially be submitted with the vendor’s proposal and shall be updated 30 calendar days following award of the IDIQ (Deliverable 11). The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work and be applicable to the entire IDIQ and all subsequent task orders. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in the SOO and Task Order Request for Proposal (TOPR).

2.1.9 CONTINGENCY OPERATIONS PLAN – DELIVERABLE 12

The Contractor shall develop and submit a Contingency Operations Plan to the Government. The Contingency Operations Plan shall be due ten (10) calendar days after the award of the contract, and will be updated on an annual basis (Deliverable 12). The Contingency Operations Plan shall document Contractor plans and procedures to maintain TMA support during an emergency. The Contingency Operations Plan shall include the following:

· A description of the Contractor’s emergency management procedures and policy

· A description of how the Contractor will account for their employees during an emergency

· Planned temporary work locations or alternate facilities

· How the Contractor will communicate with TMA during emergencies

· A list of primary and alternate Contractor points of contact, each with primary and alternate:

· Telephone numbers

· E-mail addresses

· Procedures for protecting Government furnished equipment (if any)

· Procedures for safeguarding sensitive and/or classified Government information (if applicable)

2.1.10 OPERATIONS DURING EMERGENCY SITUATIONS

Individual task order contingency operation plans will be defined in each task order and shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life threatening emergency, the COR shall immediately make contact with the Contractor Task Manager to ascertain the status of any Contractor personnel who were located in Government-controlled space affected by the emergency. When any disruption of normal, daily operations occur, the Contractor Task Manager shall promptly open an effective means of communication and verify:

· Key points of contact (Government and Contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

· Essential work products expected to continue production by priority

The Contractor Task Manager, in coordination with the COR, must make use of the resources and tools available to continue TMA contracted functions to the maximum extent possible under emergency circumstances. The Contractor shall obtain approval from the COR and Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

3 TASK ORDER ISSUANCE PROCESS

3.1 TASK ORDER PROPOSAL REQUEST (TOPR)

Upon identification of a requirement for a task order, the Government will issue a Task Order Proposal Request (TOPR) to all of the ID/IQ contract holders. Task Orders will be competed using a fair opportunity in accordance with FAR 16.5. The Contractor shall respond to requests from authorized individuals only as identified in the contract. The TOPR does NOT constitute an authorization to start work or incur costs. The Government is not required to issue a task order from a TOPR.

3.2 TASK ORDER PROPOSAL (TOP)

The Contractor shall submit a Task Order Proposal (TOP) within ten (10) calendar days of receipt of the TOPR or as otherwise specified in the TOPR,. Unless otherwise specified by the Government, the TOP size shall not exceed twenty-five (25) total text pages. The following information shall be provided:

a. The following shall be addressed in every TOP:

· Proposal Summary including:

· Task Order Proposal Request number;

· Date submitted;

· Contractor’s name;

· Contractor task leader contact information;

· Primary Subcontractor(s) (as applicable);

· Proposed start and finish dates;

· Proposed total cost with separate option or CLIN pricing, as applicable;

· Subcontracting Plan;

· Reference to any unique terms or conditions, or any requests to deviate from standard contract terms and conditions.

· Complete description of the technical approach to satisfying task requirements.

· A Work Breakdown Structure (WBS) and a detailed project implementation schedule and milestones.

b. The following shall be addressed only in TOPs for CPFF tasks:

· The proposal summary required above shall also state the total dollars and percentages for labor, materials and ODCs;

· The cost proposal shall be submitted in spreadsheet format. The first tab shall be a summary to include a top level rollup of the costs by labor, materials, other direct costs (ODC), and total task order cost. Labor shall further be broken out by labor category and hours. A separate tab shall be used for the prime and each Subcontractor.

· The nature and cost associated with each ODC shall be described. Equipment/Material costs shall detail material costs and material handling or G&A costs, as applicable.

c. The following shall be addressed only in TOPs for FFP tasks:

· Clear statement of the total price.

· A performance-based milestone payment schedule, as applicable.

3.3 ISSUANCE OF TASK ORDERS

Upon Government acceptance of a TOP, the Contracting Officer will issue a Task Order to the Contractor. Contractor work shall commence only after issuance of the Task Order by the Contracting Officer or other authorization given by the Contracting Officer.

3.4 REQUEST FOR POST AWARD ACTION

Upon identification of the need for a modification to a Task Order, the Government will issue a Request for Post Award Action, designated by an action number, to the Contractor. The Contractor shall respond to requests from these authorized individuals only as identified in the contract. The Government’s Request for Post Award Action does NOT constitute an authorization to start work or incur costs. A Request for Post Award action may include, but is not limited to, cost and no cost changes, period of performance extensions, within scope changes, shipping or inspections changes, etc.

3.5 REVISED TASK ORDER PROPOSAL

Within seven (7) calendar days of receipt of the Request for Post Award Action, the Contractor shall submit a Revised Task Order Proposal (TOP). The Revised TOP format will be consistent with that of paragraph 3.2. The Government will either accept the TOP or enter discussions as soon as practical after TOP receipt. When requested, the Contractor shall provide an updated TOP to address the results of such discussions.

3.6 MEETINGS AND REVIEWS

3.6.1 POST-AWARD CONFERENCES

The Government intends to convene a Post-Award Conference with the Contractor(s) within thirty (30) days after contract award. The Contracting Officer will notify the Contractor(s) of the specific date, location and agenda within fifteen (15) days after contract award.

3.6.2 PROGRAM REVIEWS

Program Reviews shall be conducted quarterly or as required by the Contracting Officer (CO), or Contracting Officer’s Representative (COR) or Government Task Leader (GTL) for the contract / task order. Specific dates, locations, agenda and attendance requirements will be specified by the appropriate Government representative, at least seven (7) calendar days prior to the meeting.

3.6.3 IN-PROGRESS REVIEWS (IPRs)

The Contractor shall plan and conduct regular, Monthly In-Progress Reviews (IPR) with the Government to review progress and status of activities under each task order. These IPRs may be held via video-teleconference or collaborative software applications. The Government reserves the right to hold IPRs more frequently based on risk assessments and program progress.

Each review shall provide insight into expenditures, staffing, progress, risks, and status of Government Furnished Equipment (GFE), including Contractor purchased, Government owned items. The Contractor shall provide project briefings addressing cost/price, schedule, performance, and status of each key element of the task order, noting any problems or risks and alternative and recommended solutions.

The Contractor shall ensure that agendas and meeting materials are provided to Government participants prior to the meeting and that data presented at program reviews is current within not more than fifteen (15) days.

3.6.4 OTHER GOVERNMENT MEETINGS

The Contractor, at the direction of the Government shall schedule and participate in other Government meetings as directed. Participation will be via telecon, video-telecon or collaborative software tools unless travel for on site representation is directed by the Government or required by the Contractor to meet performance requirements.

4 CONTRACT TASKS

4.1.1 CONCEPT OF OPERATIONS (CONOPS,) STUDIES & ANALYSES

The Contractor shall prepare Concept of Operations (CONOPS) documents, Analysis of Alternatives (AoA), perform studies and other analyses related to Medical IM/IT, as required by applicable Task Orders. Results shall be documented as required by the applicable Task Order.

4.1.2 PROOF OF CONCEPT, CONCEPT MODELING & SIMULATION DEVELOPMENT

The Contractor shall implement a systems oriented, verifiable, repeatable and iterative process for development of proofs of concept and/or prototype software development. The requirements analysis and design phase shall be based upon the development of use cases and the implementation of the Unified Modeling Language (UML) in order to produce a description of the internal structure and organization of the system that will serve as the basis for its construction. The key activities the Contractor shall implement during this phase are:

· Software Architecture Design – A software architecture design illustrates the abstract representation of the system. The architecture addresses various subsystems (how the system is decomposed and organized into subsystems) and their interfaces.

· Software Architecture Review – Architecture is reviewed to make sure the software system meets the requirements of the system, as well as to ensure its agility in accommodating future requirements. The review board includes proper representation from the requirements, security, integration and quality assurance teams.

· Software Design Document – This document is created to provide a detailed view of the system. It includes subsystem design, screen layouts for user interfaces, business rules, process diagrams, pseudo-code, integration schemas and other documentation.

· Software Design Review – Software Design Review then focuses on system and subsystem design. Design is analyzed and evaluated to determine whether the design satisfies requirements. Review includes examining and evaluating various alternative solutions and trade-offs that leads to subsequent development activities. The goal of this review phase is to ensure that the produced code is reusable, that it is modular and that these modules can be enhanced per build, which does not require a total re-write for additional feature implementation.

The Contractor shall utilize an iterative approach to the Development. This iterative approach is based upon the construction of working, meaningful software components through a combination of coding, validation, and testing (unit testing) by a development team. The Contractor shall apply a systems engineering approach to ensure that mission objectives and system criteria requirements are fulfilled. If applicable, design concepts shall include provisions for continuous technological improvement to maximize opportunities for product improvement available from emerging technological advances in the commercial market place. The Contractor shall adhere to industry standards and “best of breed” commercial practices. Commercial products and processes shall be utilized wherever possible. Use of Agile development processes like Scrum, Agile Modeling, Agile Unified Process (AUP) is encouraged. The key activities the Contractor shall implement during this phase are:

· Code reviews - A peer-to-peer code review is done to identify and fix mistakes overlooked in the initial development phase, improving overall code quality. Code reviews also look for security vulnerabilities thereby improving software security, use of tested design patterns and coding practices including documentation.

· Code Versioning- All artifacts and source code is managed in a software repository. This helps team collaboration on tasks, and maintainability via multiple braches.

· Build Cycle- Build plan is put in place. Builds are done from the code in repository ensuring the checked in code results in clean build.

· Unit Testing- Each developer tasked with a module is responsible for creating individual module test cases. Unit test results are documented.

4.1.3 TEST & EVALUATION (T&E)

The Contractor shall define and develop test programs, plans, and procedures, conduct testing, and evaluate and document results as required by applicable task orders. Such testing may include:

· Hardware and software component testing.

· Subsystem and system level development testing.

· System compatibility testing.

· Acceptance testing.

· Functional testing.

· Integration testing.

· Field-testing and evaluation.

The Contractor shall conduct testing in total or shall support Government test personnel as specified by applicable task orders. The Contractor shall ensure that all hardware, software, test equipment, instrumentation, supplies, facilities, and personnel are available and in place to conduct or support each scheduled test.

The Contractor shall develop test plans, test procedures and test reports as required by applicable Task Orders.

4.1.4 TECHNOLOGY INSERTION, INTEGRATION & TRANSITION SUPPORT

The Contractor shall make proof of concept, and/or prototype new health IT related software/ hardware technologies capable of integration into existing system architectures as required by applicable task orders. The Contractor shall manage the baseline configuration of the platforms, systems, subsystems and items acquired under this contract as required by applicable task orders. Such support includes:

· Collection, review, tracking and archiving of Configuration Control Documents.

· Development of automated databases to track hierarchical components.

· Maintenance of Product Data.

· Support to Configuration Control Boards.

The Contractor shall provide transition support to prototype/proof of concept systems as specified in individual task orders. This support includes all documentation, including source code, required to hand-off the prototype or proof of concept for full acquisition.

4.1.5 INSTALLATION SERVICES

The Contractor shall install proof of concept and/or prototype hardware and software/firmware as required by applicable Task Orders. The Contractor shall conduct studies, engineering site surveys, develop architectural diagrams, network topology descriptions and other technical artifacts as required, detailing installation design. The Contractor shall assist the Government in identifying all equipment and utilities required for future installation at the installation site, including Government Furnished Equipment/Material. The Government, with Contractor assistance, shall ensure that the required equipment, utilities, and resources are available at the installation site.

4.1.6 TECHNICAL DATA MANAGEMENT SERVICES

The Contractor shall review, develop and/or submit Product Data in accordance with applicable task orders. Product data may define one or more configuration items, associated manufacturing processes and associated test procedures. Various types of Product Data, including engineering drawings, specifications, software configuration documentation, interface control documentation, quality assurance provisions, and/or commercial item descriptions may be required. Furthermore, Product Data may provide:

· Complete design disclosure;

· Form, fit and function requirements;

· Performance specifications;

· A combination thereof.

The Government shall own unlimited data rights to all data produced under the contract and task orders.

4.1.7 TRAINING SUPPORT

The Contractor shall identify training requirements and shall obtain or develop training programs for platforms, systems, subsystems or critical items to support technology transition or operational exercise support, as required by applicable task orders.

The Contractor shall develop training manuals and other training documentation or training aids as required. Electronic training applications such as computer-based training shall be employed to enhance the effectiveness of training materials and courses when cost-effective. The Contractor may conduct training for Government personnel or foreign national personnel, if directed by Government personnel in the appropriate Letter Of Agreement, to ensure proper operation, repair, maintenance, and testing of platforms, systems, subsystems or items. The Contractor may be required to furnish personnel to perform such training.

4.1.8 OPERATIONAL EXERCISE SUPPORT

The Contractor shall provide support for the deployment of systems to operational exercises and evaluations as specified in individual task orders

4.2 METHOD OF DELIVERY

Electronic copies shall be delivered using Microsoft Office suite of tools (for example, MS WORD, MS EXCEL, MS POWERPOINT, MS PROJECT, or MS ACCESS format), unless otherwise specified by the COR. Electronic submission shall be made via email, unless otherwise agreed to by the COR.

4.3 SHIPPING

The Contractor shall use the U.S. Postal Service standard delivery for delivery of materials, equipment, or required hardcopy documents. The COR must approve all exceptions to this requirement.

4.4 DELIVERY SCHEDULE ABBREVIATIONS

The following abbreviations are used in the delivery/deliverable schedule:

4.5 DELIVERABLE / DELIVERY SCHEDULE

A summary of deliverables follows. Copies are to be provided to the Government officials indicated in electronic file (E), and/or hard copy (H).

CS

Signed statements are due, from each employee assigned, prior to performing ANY work on this task.

CS

CS

CS

(DI-MGMT-81334C CWBS)

COR CO

CS

NLT 10 DACA

CS

Not Applicable

(DI-MGMT-81466ACPR)

COR CO

CS

Monthly for each Task Order awarded

(DI-MGMT-81468)

COR CO

CS

Monthly for each Task Order awarded

NLT 30 days before end of Task Order

CS

4.6 NON-DISCLOSURE / NON-USE AGREEMENT – DELIVERABLE 1

The Contractor shall ensure that the Non-Disclosure Statement (Deliverable 1) is signed by all staff assigned to or performing on the contract and subsequent task orders before performing any work, including all Subcontractors and consultants. The Non-Disclosure / Non-Use statement shall be cosigned by a corporate official (Contractor Task Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor.

4.7 INFORMATION ASSURANCE

4.7.1 PUBLIC KEY INFRASTRUCTURE

The Contractor shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between DoD and its Contractors, the Contractor shall obtain all necessary certificates. The Contractor shall turn over to the Government all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Contractor shall provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions.

4.7.2 PHYSICAL SECURITY

The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data and equipment to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security Audit (PSA) of the Contractor's internal information management infrastructure to be performed by the Government. The MHS Physical Security Audit Matrix is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls.

The Contractor shall correct any deficiencies identified by the Government of the Contractor's physical security posture. The Contractor shall be required to follow all requirements in the MHS Information Assurance Policy. New MHS policies will be posted to the following website:

http://www.tricare.osd.mil/tmis_new/IA.htm.

4.7.3 PERSONNEL SECURITY

The Contractor shall comply with DoD Directive 8500.1, "Information Assurance (IA)," DoD Instruction 8500.2, "Information Assurance (IA) Implementation," DoD Directive 5400.11, "DoD Privacy Program," DoD 6025.18-R, "DoD Health Information Privacy Regulation," and DoD 5200.2-R, "Personnel Security Program Requirements."

The Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

· Follow the TMA Privacy Office guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) security clearances and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III and Secret Clearance, where their duties meet the criteria of the position sensitivity designations. Contact the TMA Privacy Office for guidance on the appropriate ADP/IT levels for personnel on the contract. The TMA Privacy Office procedures for personnel security are listed on the following website: http://www.tricare.osd.mil/tmaprivacy/personnel-security.cfm

· Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to Military Health System (MHS) Sensitive Information (SI).

· Immediately report to the TMA Privacy Office and deny access to any automated information system (AIS), network, or MHS SI information if a CONTRACTOR employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for security reasons.

· Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks, and/or MHS SI information.

The Contractor shall ensure that all Individuals requiring access to sensitive information are processed for access authorization in accordance with DoD personnel security policies. The Contractor shall ensure that all authorized users maintain the appropriate ADP/IT category classification for a position of public trust specific to their role.

The Contractor shall ensure that only individuals who have a valid need-to-know that is demonstrated by assigned official Government duties and who satisfy all personnel security criteria (e.g., IT position sensitivity background investigation requirements outlined in DoD 5200.2-R) are granted access to information with special protection measures or restricted distribution as established by the government.

4.7.4 SECURITY DESIGN AND CONFIGURATION

The Contractor shall support comprehensive Information Assurance (IA) reviews of all government-owned, Contractor-managed information system annually. These reviews will be coordinated with the government Program Office and will be used to evaluate existing IA policies and processes to ensure that they fully support the goal of uninterrupted operations. The Contractor shall produce a Plan of Action and Milestones (POA&M) document identifying the milestones and schedule necessary to remediate any identified vulnerabilities.

The Contractor shall ensure wherever possible all system security designs incorporate the use of single sign-on, PKE, smart cards and biometrics when identification, authentication, and authorization is required.

The Contractor shall ensure that all government-owned Contractor-managed system assets and applications are configured in accordance with the most current Security Technical Implementation Guidance (STIG). The Contractor shall monitor all government-owned Contractor-managed assets for compliance and shall report monthly on the status of each. The Contractor shall provide a detailed report identifying all undocumented control/security configuration violations and shall also provide a high-level report that identifies quantities of category I, II, and III findings to be presented to the COR.

The Contractor shall incorporate all applicable DoD security and Information Assurance (IA) requirements into the design of any product of this proposal. The Contractor shall present design documentation to government IA representatives prior to product development. Design documentation shall identify the proposed architecture and clearly define the accreditation boundary of the system; the architecture shall specifically:

· Address the Ports, Protocols, and Services (PPS) proposed to be used to transport data and communicate between systems.

· Identify all external interfaces, the information being exchanged, and the protection mechanisms associated with each interface

· Identify user roles required for access control and the access privileges assigned to each role

· Address unique security requirements (e.g., encryption of key data elements at rest)

· Identify categories of sensitive information processed or stored by the AIS application, and their specific protection plans (e.g., Privacy Act, HIPAA)

The Contractor shall ensure that the acquisition or outsourcing of IT services in support of government-owned, Contractor-managed systems addresses Government, service provider, and end user IA roles and responsibilities.

The Contractor shall obtain assurance that the outside entity will appropriately safeguard PHI and that those assurances relate to all exchanges of said PHI, and that any contract/agreement will specify all required element necessary to ensure safeguarding of the data.

Emerging mobile code technologies that have not undergone a risk assessment by NSA and been assigned to a Risk Category by the DoD CIO is not used The Contractor shall ensure that the use of mobile code in the design of any system or system component meets the following requirements:

· Category 1 mobile code is signed with a DoD-approved PKI code signing certificate; use of unsigned Category 1 mobile code is prohibited; use of Category 1 mobile code technologies that cannot block or disable unsigned mobile code (e.g., Windows Scripting Host) is prohibited.

· Category 2 mobile code which executes in a constrained environment without access to system resources (e.g., Windows registry, file system, system parameters, network connections to other than the originating host) may be used.

· Category 2 mobile code that does not execute in a constrained environment may be used when obtained from a trusted source over an assured channel (e.g., SIPRNET, SSL connection, S/MIME, code is signed with a DoD-approved code signing certificate).

· Category 3 mobile code may be used.

· All DoD workstation and host software are configured, to the extent possible, to prevent the download and execution of mobile code that is prohibited.

· The automatic execution of all mobile code in email is prohibited; email software is configured to prompt the user prior to executing mobile code in attachments.

The Contractor shall incorporate the use of encryption to protect the confidentiality and integrity of sensitive data communications. The Contractor shall ensure that only NIST FIPS 140-2 validated cryptography (e.g., DoD PKI class 3 or 4 token) is used to implement encryption (e.g., AES, 3DES, DES, Skipjack), key exchange (e.g., FIPS 171), digital signature (e.g., DSA, RSA, ECDSA), and hash (e.g., SHA-1, SHA-256, SHA-384, SHA-512). Newer standards shall be recommended as they become available.

The Contractor shall ensure that all user interface services (e.g., web services) are physically or logically separated from data storage and management services (e.g., database management systems). Separation may be accomplished through the use of different computers, different CPUs, different instances of the operating system, different network addresses, combinations of these methods, or other methods as appropriate.

The Contractor shall not use binary or machine executable public domain software products and other software products with limited or no warranty, such as those commonly known as freeware or shareware in the design/development of government systems unless they are necessary for mission accomplishment, there are no alternative IT solutions available, and approved by the COR. Such products shall be assessed for information assurance impacts, and shall be required to be approved for use by the JMIS DAA. This requirement is due to the fact that such software products are difficult or impossible to review, repair, or extend, given that the Government does not have access to the original source code and there is no owner who could make such repairs on behalf of the Government.

The Contractor shall document all Ports, Protocols, and Services (PPS) traversing DoD networks specific to the electronic communications of government-owned Contractor-managed systems. PPS documentation shall identify the Port, Protocol, Service, Source IP address, Destination IP address, and description of communication. PPS detail shall be included as a sub-section of deliverable "x" Interface Control Document (ICD).

The Contractor shall ensure that all appointments to required IA roles, e.g., IAM/IAO, are established in writing, to include assigned duties and appointment criteria such as training, security clearance, and IT-designation.

The Contractor shall ensure that a Security Management Plan (SMP)) is established (Deliverable XX) that describes the technical, administrative, and procedural IA program and policies that govern the government-owned, Contractor-managed information system, and identifies all IA personnel and specific IA requirements and objectives (e.g., requirements for data handling or dissemination, system redundancy and backup, or emergency response).

The Contractor shall ensure compliance with DoD 8570.1 and DoD 8570.01_M. The Contractor shall provide a list of all contract personnel requiring system privilege level access. The Contractor shall define personnel into Information Assurance Technical (IAT) and Information Assurance Management (IAM) categories per DoD 8570.01-M (deliverable “x”): IAT and IAM categories shall be further broken into privilege levels I, II, and III.

The Contractor shall ensure that all personnel identified as requiring privilege level access to computers, systems, and networks are appropriately certified in accordance with the approved programs specified in DoD 8570.01-M. The Contractor shall only provide privileged access to those approved by the COR. Personnel requiring privileged access who does not meet the requirements of DoDI 8570.01-M shall be supervised by an appropriately certified and approved individual. Supervision shall only be approved for six months from date of contract. Those persons not certified within the allotted time shall not be approved for privileged access past that time.

The Contractor shall ensure that appropriate certifications are identified as a condition of employment for new employees. The Contractor shall ensure that new employees acknowledge and agree to obtain the appropriate certification for the position to be filled within six (6) months of employment.

The Contractor shall ensure that all personnel requiring privileged computer, system or network access have completed and signed an INFORMATION SYSTEM PRIVILEGED ACCESS AGREEMENT AND ACKNOWLEDGEMENT OF RESPONSIBILITIES.

Additional information and detail is available at the following links:

http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf

HYPERLINK "http://www.dtic.mil/whs/directives/corres/html/857001m.htm http://www.dtic.mil/whs/directives/corres/html/857001m.htm

The Contractor shall isolate their security support structure by means of partitions, domains, etc., including control of access to, and integrity of, hardware, software, and firmware that perform security functions. The security support structure shall maintain separate execution domains (e.g. address spaces) for each executing process.

The Contractor shall ensure that all government-owned Contractor-managed systems’ initialization, shutdown, and aborts are configured to ensure that the system remains in a secure state. The Contractor shall document testing procedures to validate this condition and shall periodically run them at the direction of the government to ensure the integrity of the system state.

The Contractor shall ensure that a current and comprehensive baseline inventory of all software (SW) (to include manufacturer, type, and version and installation manuals and procedures) required to support government-owned, Contractor-managed information system operations is provided to the government CCB and is maintained as part of the C&A documentation. A backup copy of the inventory is stored in a fire-rated container or otherwise not collocated with the original.

IDENTIFICATION AND AUTHENTICATION

The Contractor shall ensure that where PKI is used within the architecture of government-owned Contractor-managed systems/networks, Symmetric Keys are produced, controlled and distributed using NSA-approved key management technology and processes. Asymmetric Keys shall be produced, controlled and distributed using DoD PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key.

The Contractor shall ensure that Identification and authentication is accomplished using the DoD PKI Class 3 or 4 certificate and hardware security token (when available) or an NSA-certified product.

The Contractor shall ensure that all group authenticators for access to government-owned Contractor-managed assets are used only in conjunction with an individual authenticator. Any use of group authenticators not based on the DoD PKI must be explicitly approved by the Joint Medical Information Systems (JMIS) Designated Approving Authority (DAA). The Contractor shall develop procedures for assigning group accounts and distributing individual authenticators. These procedures shall provide specific information necessary to ensure that those requesting access to sensitive information are identified to be whom they claim. The Contractor shall maintain a list of all users and their assigned groups; this list shall be presented to the government immediately upon request.

The Contractor shall ensure that access to Government-Owned, Contractor-Managed assets are gained through the presentation of an individual identifier (e.g., a unique token or user login ID) and password. For systems utilizing a logon ID as the individual identifier, passwords shall, at a minimum:

· Passwords must be at least 15 characters long

· Passwords must contain a mix of upper case letters, lower case letters, numbers, and special characters

· When a password is changed, the user must not be able to use personal information such as names, telephone numbers, account names, or dictionary words

· Passwords must expire after 60 days

· The user must not be able to reuse any of their previous 10 passwords

· The user must not be able to change passwords more than once a day except in the case of an administrator or privileged user. Privileged users may be required to reset user’s forgotten passwords and the ability to change passwords more than once per day

· When a password is changed, the new password must differ from the previous password by at least four characters

· (APP3320.1: CAT II) The Designer will ensure the application has the capability to require account passwords having a minimum of 15 alphanumeric characters in length.

· (APP3320.2: CAT II) The Designer will ensure the application has the capability to require account passwords contain a mix of upper case letters, lower case letters, numbers, and special characters.

· (APP3320.3: CAT II) The Designer will ensure the application has the capability to require account passwords be changed every 60 days or more frequently.

· (APP3320.4: CAT II) The Designer will ensure passwords do not contain personal information such as names, telephone numbers, account names, or dictionary words.

· (APP3320.5: CAT II) The Designer will ensure the application has the capability to limit reuse of account passwords within the last 10 password changes.

· (APP3320.6: CAT II) The Designer will ensure the application has the capability to limit user changes to their account passwords once every 24 hours with the exception of privileged or administrative users.

· (APP3320.7: CAT II) The Designer will ensure the application has the capability to require new account passwords differ from the previous password by at least four characters when a password is changed.

4.7.5 ENCLAVE AND COMPUTING ENVIRONMENT

The Contractor shall ensure that access control mechanisms exist to validate that all government-owned Contractor-managed system data is accessed and changed only by authorized personnel. The Contractor shall record in transaction logs, all access and changes to the data and shall review them periodically or immediately upon system security events. The Contractor shall ensure that change threats from code or system problems are included, and shall provide documented procedures for verification.

The Contractor shall ensure that all privileged user accounts are established and administered in accordance with a role-based access scheme that organizes all system and network privileges into roles (e.g., key management, network, system administration, database administration, web administration). The Contractor shall identify all privileged role assignments and shall report those assignments quarterly and at the request of the COR.

The Contractor shall ensure that all government-owned Contractor-managed systems are configured in accordance with the most current DoD Information Systems Agency (DISA) Security Technical Implementation Guidance (STIG).

The Contractor shall ensure change controls for software development are in place to prevent unauthorized programs or modifications to programs from being implemented. Change controls include review and approval of application change requests and technical system features to assure that changes are executed by authorized personnel and are properly implemented.

The Contractor shall ensure good engineering practices with regards to the integrity mechanisms of COTS, GOTS, and custom developed solutions are implemented for incoming and outgoing files, such as parity checks and cyclic redundancy checks (CRCs).