HTC711-13-R-D008-0001_Amendment.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to remove the page limit for the Price Volume, revise Sections L2, L3, and L4 of the solicitation, and make minor updates to the PWS in Section C.

POC for this action is Jen Knobeloch, jennifer.knobeloch@ustranscom.mil.

1. CONTRACT ID CODE PAGE OF PAGES

S 1 42

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 18-Jul-2013

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HTC711-13-R-D008

X 9B. DATED (SEE ITEM 11)

27-Jun-2013

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

18-Jul-2013

CODE

USTRANSCOM-AQ - HTC711

508 SCOTT DR

SCOTT AFB IL 62225-5357

HTC711 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HTC711-13-R-D008

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

CONTRACT LEVEL PERFORMANCE WORK STATEMENT

ANALYSIS OF MOBILITY PLATFORM

4 April 2013

1.0 DESCRIPTION OF SERVICES

1.1 Background.

The Analysis of Mobility Platform (AMP) is a transportation modeling and simulation framework used to obtain an end-to-end simulation of the Defense Transportation System (DTS). The primary AMP users include programmatic analysts at the United States Transportation Command (USTRANSCOM), Joint Staff J4 and J8, Office of the Secretary of Defense (OSD) Cost Assessment and Program Evaluation (CAPE), Military Surface Deployment and Distribution Command’s Transportation Engineering Agency (SDDCTEA), and the United States Army’s Center for Army Analysis (CAA). The Joint Distribution Process Analysis Center (JDPAC) is the functional manager for

AMP.

The AMP-Port Analysis Tools (AMP-PAT) is an analysis and decision support tool to assist Combatant Command planners, Joint Staff, OSD, CAA, and USTRANSCOM analysts in refining transportation enabler requirements during Time-Phased Force and Deployment Data (TPFDD) development processes and to provide throughput analysis for airports and seaports. AMP-PAT is used to support throughput analysis in a stand-alone mode or runs dynamically as an AMP federate. AMP-PAT includes the following six tools:

Airport Rapid Analysis Tool (ARAT) Airport Throughput Tool (ATT) Airport Simulation Tool (AST) Seaport Rapid Analysis Tool (SRAT) Seaport Throughput Tool (STT) Seaport Simulation Tool (SST)

1.2 Scope. The contractor shall plan for all general tasks identified in this Performance Work Statement (PWS) required to maintain, support, and enhance AMP. Note: Any reference to AMP within the document includes AMP-PAT. Contractor estimates and timelines shall be determined based on the specific tasks and deliverable due dates specified in each individual task order (TO). The contractor shall coordinate with the AMP Program Manager (PM) to ensure that all activities are well synchronized and integrated with other USTRANSCOM modeling and simulation (M&S) efforts, and that replicated or overlapping efforts do not occur.

1.3 General Tasks. Each TO shall exist within the scope of the task areas listed below. Specific tasks shall be specified and performed under individual TOs.

Contract Management Technical Support for Studies and Analyses

Requirements Management Support for Design and Development Maintenance Application Administration Security Engineering and Cyber Security Requirements Support for Annual AMP Contingency Plan Review Configuration Management Enhancements New Capability

1.3.1 Task Area 1 - Contract Management. This task area shall encompass overall contract management. The contractor shall provide a contract management function that tracks the performance of the work. Point of Contact (POC) information for the person(s) performing the contract management function shall be designated in writing to the Contracting Officer (CO) with a copy to the Contracting Officer’s Representative (COR) no later than the date of the Post-Award Conference. POC information shall include name, title, phone number, and e-mail address. The contractor shall ensure all personnel assigned to this contract meet the minimum requirements specified in the contractor’s proposal, in accordance with (IAW) the labor category descriptions generic resumes provided as part of the contractor’s staffing approach. In support of this task, the contractor shall provide documents such as Monthly Status Reports (MSR), Trip Reports, In-Process Reviews (IPR), and Integrated Master Schedules (IMS). The contractor also shall provide demonstration and teleconference support. The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for th eAir Force via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2013. Contractors may direct questions to the help desk at:

http://www.ecmra.mill

1.3.2 Task Area 2 – Technical Support for Studies and Analyses. The contractor shall support planning and execution of analytical studies. This shall require software modifications, analysis of study requirements and products, and on-site support. As appropriate to the specific study, the contractor shall work with other model development contractors to define upgrades and enhancements to software of AMP and other models, and coordinate release and testing schedules. The contractor also shall modify AMP software and enhance the graphical user interfaces (GUI) and/or charts. In support of this requirement, the contractor shall conduct integration and testing, and perform trouble-shooting to repair or modify software problems identified during model execution.

1.3.3 Task Area 3 - Requirements Management. The contractor shall be responsible for facilitation and support of the administration of the AMP requirements management process. The contractor shall maintain the traceability of all requirements from capabilities needs through design and test; document all changes to those requirements and record the rationale for those changes throughout the system lifecycle. Requirements traceability shall be confirmed at each technical review (e.g., IPRs, test readiness reviews (TRR), operational readiness reviews (ORR), production readiness reviews (PRR), Requirements Definition Document (RDD) reviews).

As requirements are entered into the automated requirements tracking tool, the contractor shall assess each requirement and provide an impact assessment that includes an analysis of level of effort and impacts to program costs and program schedule. The contractor shall record these assessments in its automated requirements management tool. The contractor shall provide the Government (PMO and FM personnel) remote access to this tool. The contractor shall employ this tool as a repository and to input, track, trace, and manage requirements, including software problem reports. The contractor shall document its internal requirements management process in a requirements management plan whose template the Government will provide.

1.3.4 Task Area 4 – Support for Design and Development. The contractor shall design and develop software to provide new capability for AMP. The contractor shall:

(a) Propose release content and schedules based upon Government requirements and priorities

(b) Provide necessary models and simulations to support the verification, validation, and authentication (VV&A) process

(c) Provide software size (executable lines of code and function points), cost, and schedule estimates, and include justification and methodology used to derive the estimates

The contractor shall ensure that the AMP software is developed to be compatible with the current and any projected USTRANSCOM software configurations (e.g., United States Air Force (USAF) Standard Desktop Configuration (SDC), network, security, Internet browser). The Government will furnish the contractor with the approved USTRANSCOM software configurations. The contractor shall provide a Software Requirements Specification (SRS) that describes the user’s functional requirements in detail and in a form that will support design and development of software to satisfy functional and technical requirements.

The contractor’s test and evaluation (T&E) processes shall complement the Government T&E processes to include the Government T&E Master Plan (TEMP). Activities shall include developing a master T&E strategy; determining testability of change requests; producing test plans; tracing requirements through multiple documents to test procedures; supporting application certification efforts; performing test and operational readiness reviews and supporting production readiness reviews; supporting Government T&E observation of the contractor’s T&E (e.g., GWT); documenting test results; objectively analyzing data; participating in weekly teleconferences with functional community and program management community representatives; conducting risk analysis; capturing T&E metrics;

testing performance; supporting operational test events; and improving T&E processes.

Each release must undergo Information Assurance (IA) review to determine the degree to which the changes incorporated into the software impact the security of the application, or include the implementation of a new operating system, database, or interface. This review is accomplished by submitting update requests through the Cyberspace Infrastructure Planning System (CIPS). The contractor shall assist the Government in achieving software acceptance through the USTRANSCOM security CIPS process by accomplishing tasks described in Paragraph 1.3.7. Successful completion of this process will result when the USTRANSCOM Information Assurance Manager grants his/her approval of the updated product version within CIPS.

The contractor shall follow the software release process addressed in the Government AMP Configuration Management Plan (CMP). The contractor also shall deliver software source code with each release. Using the processes described in the CMP, the PMO’s Configuration Control Board (CCB), chaired by the PM, will determine the contents of each software release after consideration of the Configuration Working Group’s recommendations and the functional user’s priorities. The contractor shall provide software version descriptions, software releases, and updated software user manuals.

1.3.5 Task Area 5 – Software Maintenance. The contractor shall provide software maintenance for AMP, Joint Mobility Closure Estimator (JMCE), AMP-PAT, the Rapid Course of Action Analysis Tool (RCAT), and AT21-related AMP capability. The contractor shall correct problems that AMP users encounter with the software, and shall conduct unit, integration, regression, and security testing of these fixes. The contractor shall maintain the data objects, run-time infrastructure, and adapt to changes in the AMP component models to ensure federated runs are operational. As software problems are corrected, the contractor shall adhere to the test and release requirements described in Paragraph 1.3.4 above.

The contractor shall:

(a) Facilitate and support the administration of the AMP problem reports management process

(b) Code, test, document, and support full integration of software and software releases

(c) Propose release content and schedules based upon software maintenance priorities directed by the

AMP Configuration Control Board (CCB)

(d) Provide software level of effort, cost, and schedule estimates, and include justification and methodology used to derive the estimates

(e) Provide configuration management (CM), quality assurance (QA), and documentation for all AMP software

1.3.6 Task Area 6 - Application Administration. The contractor shall provide on-site application administration and support to USTRANSCOM system administrators and functional users. This shall include model user training and the following activities:

(a) Plan, schedule, and support installation of AMP software, to include application patches and updates.

Troubleshoot AMP installation problems. Support Functional Area Communications Computer System Manager installation of AMP application software on SIPRNET clients, as necessary.

(b) Support optimization, operation, troubleshooting, backup, recovery, modification, and upgrade of software. Debug AMP software and support testing of the application (e.g., USTRANSCOM Test Lab, support of GWT and UAT).

(c) Provide technical support for hardware refresh efforts

(d) Provide Help Desk support to assist functional users troubleshoot and correct AMP problems

(e) Keep information located on the AMP webshare site current, including keeping the web pages updated with the latest downloadable AMP software releases, sample data, and AMP User Group materials

(f) Assist Government security and networking personnel to resolve application-related issues.

The contractor shall keep the AMP Application Administration Manual updated. The contents of the manual shall include account administration; software installation; obtaining, generating, and updating reference files, shared drives, and web pages; troubleshooting and resolving operating system conflicts; maintaining logs; and creating reports, as required.

The contractor shall provide training on the use of the AMP modeling tools. USTRANSCOM will coordinate and provide the training classroom (including hardware) if such training is required. Training shall be consistent with industry standards and result in the trainees’ full understanding of the capabilities and the designed use of the associated software applications and GUIs.

The contractor shall update training materials for classroom, self-paced, or computer-based training. The training materials shall include descriptions of course content, scenario descriptions, and practical exercises.

1.3.7 Task Area 7 - Security Engineering and Cyber Security Requirements.

1.3.7.1 Task 7 Subtask 1 – Security Engineering Requirements.

The contractor shall evaluate all AMP software releases to ensure security issues are identified and addressed using the Defense Information System Agency (DISA) Application Security and Development Checklist and Security Technical Implementation Guide (STIG). The contractor shall conduct code reviews and apply required security features for all AMP software.

1.3.7.1.1 The contractor shall monitor and analyze IA Vulnerability Management (IAVM) Notices, USTRANSCOM Security Notifications, United States Cyber Command (USCYBERCOM) and vendor security advisories and make recommendation to the Government for applicability to AMP.

The contractor shall prepare an initial analysis and assessment for high impact (risk) advisories (based on the STIG Finding Severity Category listed in the IA Vulnerability Advisories [IAVA] and IA Vulnerability Bulletins [IAVB]) and submit them to the PM and USTRANSCOM AMP Engineer. All STIG Finding Severity Category I and II IAVAs and IAVBs are considered high impact.

The contractor shall prepare an analysis for other than high impact advisories and provide it to the USTRANSCOM AMP Engineer.

The contractor shall provide a summary of security analysis and assessment results during weekly teleconferences and an update in the MSR.

1.3.7.1.2 The contractor shall analyze applicable security bulletins to determine impact, identify mitigating factors, and develop recommendations to the Government regarding potential courses of action. Contractor recommendations shall be compliant with AMP, USTRANSCOM, and DOD security requirements. The contractor shall ensure that patch deployments and other significant security activities are documented in the IMS.

1.3.7.1.3 Application Design, Information System Security Engineering Principles. The contractor shall ensure that information system security engineering is employed during all changes to the application architecture. As part of the contractor’s change control process, the contractor shall ensure participation by an Information System Security Engineer or an IA representative qualified as an Information Assurance Technical (IAT) Level I, IAW DOD 8570.01-M, Information Assurance Workforce Improvement Program, to evaluate the impact of each change on security. The contractor shall document the results of this evaluation in the contractor’s requirements management tool.

1.3.7.1.4 Software Assurance and Security Engineering Practices. In coordination with the Government, the contractor shall design, develop and implement secure applications and configurations using the DISA Application Security and Development Checklist and STIG. The contractor also shall adhere to vendor security guidance, industry best practices, such as those discussed in the documents located at http://www.safecode.org/publications/SAFECode_BestPractices0208.pdf and https://www.isc2.org/uploadedFiles/(ISC)2_Public_Content/Certification_Programs/CSSLP/ISC2_WPIV.pdf; and applicable vendor product security patches. The contractor shall ensure applications comply with the DISA Application Security and Development Checklist and STIG; DOD Instruction (DODI) 8500.2, Information Assurance Implementation; and DODI 8551.1, Ports, Protocols, and Services Management (PPSM) (current version).

For all software releases, the contractor shall conduct software security testing in accordance with the DISA Application Security and Development Checklist and STIG and, for major releases and reaccreditations, submit the completed checklist to the Government in accordance with Paragraph 1.4, Deliverables. As validation of continued compliance with the STIG, the developer shall submit application code scan reports for each software release as indicated in the deliverables table. The contractor’s Information System Security Engineer shall participate in Government and contractor formal and informal design reviews to identify potential security weaknesses, deficiencies, and/or vulnerabilities in the design. The Information System Security Engineer also shall ensure appropriate security requirements are included as part of the requirements traceability matrix. As part of the contractor’s change control process, the contractor shall ensure participation by the Information System Security Engineer or an IA representative qualified IAW DOD 8570.01-M, Information Assurance Workforce Improvement Program, to evaluate the impact of each change on security.

1.3.7.1.4.1 Use of Automated Code Scanning Tool. The contractor shall use an automated tool to scan the application source code to identify and remediate vulnerabilities or weaknesses in the application design/coding, such as those described in the Common Weakness Enumeration/System Administration, Networking, and Security Institute (CWE/SANS) TOP 25 Most Dangerous Programming Errors (http://www.sans.org/top25-programming-errors) and OWASP Top Ten (http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), that could be exploited by unauthorized sources.

1.3.7.1.5 Non-Secure Software. If the Government determines, after a security audit (e.g., security test and evaluation (ST&E)), that software delivered under this contract is non-secure, the Government will provide written notice to the contractor of each non-conformity. Software will be “non-secure” under this contract if it contains a programming error listed on the current approved version of the CWE/SANS TOP 25 or a web application security flaw listed on the current approved version of the OWASP Top Ten. Such notice will constitute revocation of acceptance of delivered software. The contractor shall have twenty (20) business days after receipt of such notice (Remedy Period) to remedy each non-conformity by modifying/replacing and redelivering the software to the Government, or shall notify the Government within 10 business days as to why the remedy cannot be implemented in 20 business days, and propose a timeline for correction. If the Government determines, after a security audit following a Remedy Period, that the redelivered software is non-secure, and thus non-conforming, the Government may reject the delivery, provide notice of the non-conformance, and document the contractor’s performance record.

Alternatively, the Government may accept non-conforming software, receive appropriate consideration (equitable price reduction on a fixed price contract, reimbursement for costs of security audit, reimbursement for costs to correct the non-compliances, etc.), and document the contractor’s performance record.

1.3.7.1.6 Source Code Configuration Control (Versioning). The contractor shall use a strict version control process for software development.

1.3.7.2 Task 7 Subtask 2 – Cyber Security Requirements.

1.3.7.2.1 Requirements for Contractor Provision of Security Plan and IA Controls. The contractor shall establish an IA Program to implement and sustain appropriate IA management, operational, and technical controls and processes required to safeguard DOD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied must be commensurate with the risks (i.e., consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The contractor shall submit for Government approval an overarching security plan that describes its strategy for implementation of IA and Industrial Security requirements throughout the life of the contract. The security plan shall address the security controls described in National Institute of Standards and Technology (NIST) Special Publication 800-53 (current version), Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.nist.gov/publications/PubsSPs.html), and shall be tailored in scope and depth appropriate to the effort, the specific unclassified DOD information.

1.3.7.2.2 Developer Environment. The contractor development environment shall be physically and logically isolated from other networks, to include its enterprise unclassified network. Security guidelines for the environment must be documented and the security program implemented shall address the security controls described in NIST Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.nist.gov/publications/PubsSPs.html).

1.3.7.2.3 Remote Access. Contractor Furnished Equipment (CFE) employed for remote access to a Government network shall meet equivalent Government Furnished Equipment (GFE) IA computing requirements. The contractor shall ensure that all CFE (hardware and software) employed to access these environments meet the following minimum Government IA requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

(a) Use of personal systems is prohibited;

(b) OSs and applications shall be configured for compliance with the DISA Gold Disk and applicable

STIGs;

(c) DOD approved anti‐virus and anti‐spyware software shall be installed and signatures shall be configured to automatically update on a daily basis;

(d) DOD approved personal firewall shall be utilized and configured to permit traffic by exception only, dropping all other traffic. If the personal firewall provides intrusion detection or prevention; the signatures or rules shall be updated at the same intervals as the anti‐virus software;

(e) Computers shall be IAVM compliant;

(f) Computers shall be scanned with the DOD version of E‐eye Retina vulnerability scanner (or current approved DOD scanner solution) at a minimum of every twenty (20) business days. All vulnerabilities shall be remediated and reported to the AMP Information Assurance Manager (IAM).

(g) Contractor employees shall possess a current Government issued Common Access Card (CAC) and install Government certified CAC readers; and

(h) Verification of compliance with these requirements shall be provided to an appointed Government representative on a monthly basis.

1.3.7.2.4 Information Assurance Training. The contractor’s employees physically assigned to USTRANSCOM / Transportation Component Commands (TCC) at Scott AFB shall attend/complete security training as prescribed by DOD and USTRANSCOM/TCC instructions. At a minimum, this includes Employee Initial Security Training, Annual Security Awareness Training, Operations Security (OPSEC), DOD Antiterrorism Level 1 Training, Personally Identifiable Information (PII) Training and Security Stand-Down Day Training scheduled by the

Commander of the organization to which the employee is assigned. Contract employees assigned elsewhere shall attend security training established by their respective government security offices and/or installations. The contractor shall deliver to the Government documentation verifying completion of required contractor security training.

1.3.7.2.5 Information Assurance Workforce Improvement Program (IAWIP). The contractor shall:

(a) Ensure that personnel accessing information systems performing information assurance functions have the proper and current information assurance certification (IAT Level I) to perform information assurance functions in accordance with DOD 8570.01‐M, IAWIP. The contractor shall meet the applicable information assurance certification requirements, including:

1) DOD‐approved information assurance workforce certifications ( IAT Level I), as listed in DOD 8570.01‐M; and

2) Appropriate operating system certification for information assurance technical positions as required by DOD 8570.01‐M

(b) Upon request by the Government, the contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(c) Contractor personnel who do not have proper and current certifications shall be denied access to DOD information systems for the purpose of performing information assurance functions.

The contractor shall provide documentation verifying IAWIP certifications.

1.3.7.2.6 Support of Computer Network Defense Service Provider (CNDSP) / Host-Based Security System (HBSS). The contractor shall comply with all applicable subscriber-related CNDSP / HBSS requirements as stipulated under subscriber responsibilities in the CNDSP Memorandum of Agreement (MOA) between USTRANSCOM and the Army Research Laboratory (CNDSP), 17 April 2012. Appendix F contains a sample MOA that describes the responsibilities of the involved parties.

1.3.8 Task Area 8 - Support for Annual AMP Contingency Plan Review. Each year the PMO engineer selects certain possible scenarios from the AMP Contingency Plan for review. The contractor shall participate in this annual review and shall modify portions of the program contingency plan applicable to the application administrator’s role as the Government representatives deem necessary.

1.3.9 Task Area 9 - Configuration Management (CM). CM support is required to meet USTRANSCOM technical and security requirements. The CM process facilitates orderly configuration identification, change identification and control, status reporting, and configuration auditing of product information for such beneficial purposes as to revise capability; improve performance, reliability, or maintainability; extend life; reduce cost; reduce risk and liability; or reduce defects. CM ensures that changes take place in an identifiable and controlled process and do not adversely affect the properties of the other system or interfaces.

CM establishes and maintains the integrity of the products of a project throughout the project life cycle. CM involves identifying the configuration items of products developed and delivered to the customer, systematically controlling changes to the configuration, and maintaining configuration traceability. The contractor’s configuration management processes must complement the Government CM processes. Activities shall include developing a CMP; identifying hardware or software configuration items; implementing a change control process and providing an automated configuration management tool to assist in change control; evaluating change requests; tracking hardware and software, warranties, maintenance support agreements, and software licensing; participating in configuration working groups or, by PM request, configuration control boards; conducting configuration status accounting and audits and providing associated reports; and improving CM processes.

1.3.10 Task Area 10 - Enhancements. For purposes of this PWS, an enhancement is a refresh or a minor improvement to a capability that already resides in the software, but that does not rise to the level of changing the inherent capability of the software. An enhancement does not include a fix to a problem with the software. As directed by the PM via the Configuration Control Board process described in the government CMP, the contractor shall provide new software that will include enhancements to AMP. Enhancements shall be identified on a task order basis. Projected enhancements are included in Appendix D.

1.3.11 Task Area 11 – New Capability. For purposes of this PWS, new capability consists of capability that currently does not exist in the software. As directed by the PM via the Configuration Control Board process described in the Government CMP, the contractor shall provide software that will include new capability in AMP.

The contractor shall design, develop, and fully integrate all new capabilities and, as specified by requirement, provide requisite documentation for each new capability. New capability shall be identified on a task order basis.

Projected new capability requirements are included in Appendix E.

1.4 Deliverables. Deliverables shall be identified in each individual task order. The contractor shall deliver data and software (with applicable data rights) as set forth in the below tables. IAW Defense Federal Acquisition Regulation Supplement (DFARS) 252.227-7013 and DFARS 252.227-7014, the Government obtains under this contract “unlimited rights” to all non-commercial computer software, software source code, computer software documentation, enhancements, technical data, and similar non-commercial data developed exclusively at Government expense and delivered to the Government under this contract. “Unlimited rights” means rights to use, modify, reproduce, release, perform, display or disclose in whole or in part, in any manner and for any purpose whatsoever, and to have the ability to authorize others to do so. The contractor agrees that regardless of how contractor provided data/software is developed or modified during contract performance, the contractor will deliver data/software marked IAW requirements in DFARS 252.227-7013, 252.227-7014, and other applicable references.

For all other non-commercial data delivered under this contract, the Government has the right to use, modify, reproduce, release, display or disclose, in whole or in part, in any manner and for any purpose whatsoever, and to have or authorize others to do so.

The contractor shall prepare all deliverables using a Government-supported version of Microsoft Office (including Access, as necessary) or Microsoft Project software, with the exception of source code, which the contractor shall provide in native code language. The contractor shall upload files directly into the USTRANSCOM-provided Joint Deployment Planning and Analysis Center webshare. If the contractor is unable to load the deliverable file(s) on the webshare, then the contractor shall provide a soft copy of each deliverable via e-mail to ustcaq-cm@ustranscom.mil.

Should this second method of transmittal prove unsuccessful, the contractor shall provide the required deliverables on compact disk (CD) or digital video disk (DVD) with a typewritten label that states contract and task order number, PWS task number, and deliverable title(s). Multiple deliverables may be combined on a single CD or

DVD.

The contractor shall provide the deliverables according to the delivery schedule specified in each task order.

2.0 SERVICE DELIVERY SUMMARY (SDS). An SDS shall be identified on each individual task order. The SDS represents the most critical contract performance objectives that, when met, will ensure contract performance is satisfactory. Although not all PWS requirements are listed in the SDS, the contractor shall comply with all requirements in the PWS.

2.1 Inspection and Acceptance. A deliverable is a specific measurable, tangible, and verifiable activity, outcome, result, item, or product that the contractor shall provide and that will require formal Government acceptance and approval. The Government will review, assess and provide comment, as required.

Unless otherwise specified within an individual task order, final inspection and acceptance of all work performed, reports, or other deliverables shall be performed at the place of delivery. The PM will notify the contractor of deliverable acceptance or provide comments in writing. After receipt of government comments, the contractor, if necessary, shall revise and resubmit the final deliverable to the PM within the number of business days specified in the deliverable table within the individual task order.

3.0 GOVERNMENT-FURNISHED PROPERTY AND SERVICES

3.1 Government-Furnished Equipment (GFE). GFE, if any, shall be specified in each individual task order.

3.2 Government Furnished Information (GFI). GFI, if any, shall be specified in each individual task order.

3.3 Facilities. Facilities, if any, will be specified on each individual task order.

3.4 Secure Communications. The Government will provide the equipment and leased line to support the SIPRNET connection in support of the SIPRNET requirement described in Paragraph 4.1.1 of this PWS.

3.5. Annual Inventory. The Government will conduct an annual on-site inventory of all GFE. The contractor shall provide a listing of all GFE assigned to this contract and support a ‘hands on’ inspection of the GFE contained within its facility.

4.0 GENERAL INFORMATION

4.1 Place of Performance. Unless otherwise stipulated in an individual task order, the primary place of development and most sustainment activity shall be at the Contractor’s location off -base. Some sustainment activity shall be conducted on Scott AFB. To accommodate the contractor’s on-site support personnel, the Government will provide controlled working space, phone, computer, fax, and connections to the Non-Secure Internet Protocol Router Network (NIPRNET) or the Secure Internet Protocol Router Network (SIPRNET), as required, at no cost to the contractor.

4.1.1 Secure Internet Protocol Router Network. It is a requirement of this contract that the contractor use a secure SIPRNET network connection, maintained at the contractor’s facility in a secure space IAW DODM 5200.01, DOD Information Security Program, Volume 3. The Government will provide the equipment and leased line to support the SIPRNET connection. Before the SIPRNET is established in the contractor’s location, the contractor must have a physical safeguarding level of SECRET from the Defense Security Service (DSS).

4.2 Travel. Performance under this PWS may require contractor travel within and outside the Continental United States (OCONUS). The Government will reimburse the contractor for travel expenses subject to the current Federal Acquisition Regulation (FAR) and Federal Travel Regulation (FTR). All contractor travel shall be coordinated with and validated by the PM prior to incurring any travel expenses. Travel requests shall be submitted in writing at least five (5) business days in advance from the travel commencement date and shall consist of:

Title, Purpose/Objective, Expected Outcome Date, Time (window), and Location Proposed Itinerary Proposed Meeting/Activities Agenda Number of Contractor Participants Desired Government Participants Requested Government Support Estimated Costs

The contractor shall identify personnel who will be traveling in sufficient time to obtain the lowest possible rates for airfare, rental car and lodging. Contractor invoices (along with associated receipts) shall support all travel reimbursement requests. The Government will not reimburse local travel and related expenses to the contractor for daily travel to or from the place of performance stipulated in each individual task order. Contractors shall not use General Services Administration city pair contracts. Contractors shall submit a trip report following each trip in support of this contract. For group travel, the contractor shall submit only one trip report for each group trip.

4.3 Hours of Operation and Federal Holidays. Unless specified under individual task orders, normal duty hours are between 0730 and 1630, Monday through Friday, with the exception of Federal holidays. If on-site contractor personnel deem it necessary to work outside normal duty hours, it must be coordinated with the COR assigned to the task order. The following will be observed as Federal holidays: New Year's Day, Martin Luther King's Birthday, President's Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving Day, and Christmas Day. Note: Any of the above holidays falling on a Saturday shall be observed on the preceding Friday. Holidays falling on a Sunday shall be observed on the following Monday.

4.4 Other Direct Costs (ODC). The Government will reimburse allowable other direct costs (ODCs) incurred in the performance of this PWS. ODCs may include, but are not limited to, software, group teleconferencing fees and membership/conference fees. The primary or alternate COR will approve all ODCs prior to the incurring of any expenses. The contractor shall submit ODC requests in writing to the COR at least five (5) business days in advance of incurring any expenses. The request shall contain estimated costs. The contractor shall submit at least two quotes for high dollar value items. Contractor invoices (along with associated receipts) shall support all ODC reimbursement requests. Note: General and Administrative overhead charges will not be accepted or paid for approved ODC purchases. General and Administrative overhead charges may be applied to approved ODC purchases. Not all task orders may require ODCs.

4.5 Period of Performance. The period of performance for this contract shall consist of a base period with three optional periods through 30 September 2013:

Base Period: 1 Oct 2013 to 30 Sep 2014 Option Period 1: 1 Oct 2014 to 30 Sep 2015 Option Period 2: 1 Oct 2015 to 30 Sep 2016 Option Period 3: 1 Oct 2016 to 30 Sep 2017

4.6 List of Appendices.

APPENDIX TITLE

A Reference Publications

B List of Acronyms

C Non-Disclosure Agreement

D Projected Enhancements

E Projected New Capability

F Sample CNDSP Memorandum of Agreement

G DD 254, Contract Security Classification Specification

4.7 Section 508 Accessibility Standards. Part 1194.21, Software Applications and Operating Systems, of Section 508 Accessibility Standard(s) of the Rehabilitation Act (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105‐220), 7 Aug 1998, applies to this acquisition.

4.8 Quality Assurance

The contractor shall support Government agency reviews and audits of all services and support provided under this PWS. The contractor shall support Quality Assurance reviews conducted by the Government. The Government reserves the right to authorize an independent verification and validation of the contractor’s procedures, methods, data, equipment, and other services provided during the performance of this PWS.

4.9 Handling of Non-Public Information

In performance of this contract, the contractor may have access to sensitive, non-public information. The contractor agrees:

(a) To use and protect such information from unauthorized disclosure IAW DTM 08‐027 ‐ Security of Unclassified DOD Information on Non‐DOD Information Systems, Incorporating Change 1, September 16, 2010, Attachment 2

(b) To use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for personal or commercial purpose

(c) To obtain permission of the Government PM before disclosing/discussing such information with a third party

(d) To return and/or electronically purge, upon Government request, any non‐public, sensitive information no longer required for contractor performance

(e) To advise the CO or COR of unauthorized releases of such information

(f) The contractor shall have its employees assigned to this contract execute a non‐disclosure agreement for delivery to the Government. The Government will require contractor personnel to sign a non‐disclosure agreement to protect non‐public information of other contractors and/or the Government. Non‐disclosure agreements are provided at Appendix C.

4.10 Employment of Foreign Nationals.

For purposes of this clause, foreign nationals are all persons not citizens of, not nationals of, or immigrant aliens to the US. A foreign representative is anyone (regardless of nationality) acting as an agent, representative, official, or employee of a foreign government, a foreign-owned or influenced firm, corporation, or person. Nothing in this clause is intended to waive any requirement imposed by any other US Government agency with respect to employment of foreign nationals or export control. Foreign Nationals are not allowed to access classified information, nor are they allowed to fill Automated Data Processing (ADP)-I positions as defined in regulation DOD 5200.2-R, Personnel Security Regulation, Appendix 10.

4.11 Acquisition Streamlining

IAW DFARS 252.211-7000, the contractor shall submit acquisition streamlining recommendations electronically.

The Contracting Officer will provide more specific submission instructions upon award.

5.0 SECURITY (PHYSICAL, PERSONNEL, INFORMATION, ANTITERRORISM / FORCE

PROTECTION AND INDUSTRIAL SECURITY)

5.1 General Security Information

The overall classification of work associated with this PWS will be at the SECRET level.

Each task order will contain a DD 254 that will outline the security requirements for classified access to perform the deliverables and task orders in support of these contracts. All contract work associated with this PWS and all task orders deal directly with supporting current operations and decision making for the Distribution Process Owner (DPO) for the DOD. An overall completed / signed DD 254 is attached to this PWS. Safeguarding of classified material at contractor locations is at the SECRET level. The safeguarding level must be approved in writing by DSS before any classified will be stored at the contractor facility. All background investigation levels, access to classified areas and materials, assigned IT/ ADP levels required by the Contractor and security stipulations for this classified contract (including any task orders assigned in the future) will be approved by one of the following: CO, COR or the functional manager, before the start of the contract or any task orders under this contract. The Contractor will not divulge any financial, planning, programming, or budgeting information without the express consent of the Government as outlined in OPSEC and Information Security regulations or be held liable for punitive damages incurred as a result of release of such information. The Contractor shall comply with all appropriate provisions of the applicable security regulations while assigned to this contract for DOD and USTRANSCOM.

5.2 Personnel Security Requirements

Personnel performing services under this contract, to include sub-contractors and/or partners, shall be citizens of the United States of America. Dual citizens will not be authorized interim or final security clearance determinations within DOD. Any U.S. citizens who currently have (either expired or active) foreign passports will not be able to obtain or hold an interim/final security clearance determination within DOD; they are considered dual citizens. All Contractor personnel shall possess the appropriate personnel security investigation for the position(s) occupied as directed in section 5.1; these levels will be stipulated by the CO/COR or functional manager of the contract.

The following guidance will be followed when determining position sensitivity levels and background investigation levels for this contract depending on requirements and Task Orders:

POSITION LEVEL:

Information Technology (IT)-II, Automated Data Processing (ADP)-II, or Non-Critical Sensitive Positions (SECRET)

IT/ADP-II and Non-Critical Sensitive Positions are those positions that have: access to SECRET or CONFIDENTIAL information; Security police/provost marshal-type duties involving the enforcement of law and security duties involving the protection and safeguarding of DOD personnel and property; Category II-IT/ADP-II positions; duties involving education and orientation of DOD personnel; duties involving the design, operation, or maintenance of intrusion detection systems deployed to safeguard DOD personnel and property; any other position so designated by the head of the Component or designee.

BACKGROUND INVESTIGATION REQUIREMENTS:

(IT-II/ADP-II/Non-Critical Sensitive) Background Investigation Requirement for SECRET:

Positions designated by the Government at the Non-Critical Sensitive/ADP-II/IT-II rating require a National Agency Check with Local Credit (NACLC) (or acceptable periodic reinvestigation) favorably adjudicated (a favorable adjudication grants eligibility at the SECRET level as prescribed by DOD 5200.2-R). The IT-II/ADP-II requirement mandates the Contractor have a minimum Facility Clearance Level (FCL) at the SECRET (or higher) level due to investigation submissions as directed in DOD 5220.22-M, DOD 5200.1-R and Joint Personnel Adjudication System

(JPAS).

POSITION LEVEL:

Information Technology (IT)-III

Automated Data Processing (ADP)-III

Non-Sensitive Positions (POSITION OF TRUST DETERMINATION) (NO CLASSIFIED ACCESS):

All other positions involved in computer activities and Common Access Card (CAC). No clearance is granted for classified access and only a Position of Trust (PoT) is awarded and posted in the JPAS.

BACKGROUND INVESTIGATION REQUIREMENTS:

(IT-III/ADP-III/Non-Sensitive) Background Investigation Requirements for POSITION OF TRUST Determinations (NO CLASSIFIED ACCESS):

Positions designated by the Government at the Non-Sensitive/ADP-III/IT-III rating require a National Agency Check with Inquiries (NACI) (or acceptable investigation/reinvestigation) favorably adjudicated (a favorable adjudication issues a Position of Trust determination as prescribed by DOD 5200.2-R and DOD DTM 08-003.

Favorable NACI or equivalent investigation results must be posted in JPAS before a CAC or NIPRNET access will be granted. To obtain interim CAC/NIPRNET access, NACI investigations will be opened with fingerprint, name and criminal records checks returned favorably before the credentials (CAC and NIPRNET) are issued.