IPPS-A Army Military Payroll PWS - DRAFT - 21 NOV 2023.pdf

CUI

Integrated Personnel and Pay System – Army

(IPPS-A)

Army Military Payroll

Performance Work Statement (PWS)

DRAFT

W91CRB-24-R-0003

November 21, 2023

Prepared by:

IPPS-A Product Manager (PdM) Future Capabilities Office

IPPS-A AMP PWS - DRAFT CUI

November 21, 2023 ii

THIS PAGE INTENTIONALLY LEFT BLANK 14

November 21, 2023 iii

Table of Contents 17

1.0 Introduction ......................................................................................................... 1 18

1.1 Description of Services ...................................................................................... 1 19

1.2 IPPS-A Description ............................................................................................. 3 20

1.2.1 Background .............................................................................................. 3 21

1.2.2 IPPS-A Overarching Objectives ............................................................... 4 22

1.2.3 Army Military Payroll Description .............................................................. 5 23

1.3 Scope ................................................................................................................... 7 24

1.4 Period of Performance ....................................................................................... 8 25

1.5 Contract Type ..................................................................................................... 8 26

1.6 Contract Structure .............................................................................................. 8 27

1.7 General Information Requirements ................................................................... 9 28

1.7.1 Quality Control and Assurance ................................................................. 9 29

1.7.2 Recognized Federal Holidays................................................................. 10 30

1.7.3 Hours of Operation ................................................................................. 10 31

1.7.4 Place of Performance ............................................................................. 11 32

1.7.5 Security Requirements ........................................................................... 11 33

1.7.6 Contracting Officer’s Representative (COR) .......................................... 16 34

1.7.7 Agile Qualifications ................................................................................. 16 35

1.7.8 Key Personnel ........................................................................................ 16 36

1.7.9 Contractor Key Personnel Replacement ................................................ 20 37

1.7.10 Identification of Contractor Employees ................................................... 20 38

1.7.11 Contractor Travel .................................................................................... 20 39

1.7.12 Other Direct Costs (ODCs) ..................................................................... 21 40

1.7.13 Organizational Conflict of Interest (OCI) ................................................. 21 41

1.7.14 Government Rights ................................................................................ 21 42

1.7.15 Contractor Manpower Reporting ............................................................ 22 43

2.0 Reference Materials .......................................................................................... 22 44

3.0 Government Furnished Property (GFP), Items, and Services ...................... 22 45

3.1 Equipment (GFE), Facilities, and Supplies ..................................................... 22 46

3.2 Hardware, Software, and Technology Services and Materials ..................... 23 47

4.0 Contractor Furnished Items ............................................................................. 24 48

5.0 Performance Requirements – Specific Tasks ................................................ 24 49

November 21, 2023 iv

5.1 Task 1: Program Management ........................................................................ 24 50

5.2 Task 2: Solution Configuration, Development, and Test ............................. 28 51

5.3 Task 3: Solution Integration ........................................................................... 35 52

5.4 Task 4: Release and Deployment .................................................................... 38 53

5.5 Task 5: Government Software Reuse Integration .......................................... 39 54

5.6 Task 6: Training Material Development .......................................................... 39 55

5.7 Task 7: Production Operations Transition ..................................................... 40 56

5.8 Task 8: Training Delivery [OPTIONAL] ........................................................... 41 57

6.0 Deliverables ...................................................................................................... 42 58

6.1 Deliverable Procedures .................................................................................... 42 59

6.2 Deliverables Schedule ..................................................................................... 43 60

Appendix A: Reference Materials .......................................................................... 47 61

Appendix B: List of References ............................................................................. 55 62

List of Figures 65

Figure 1. AMP Notional Capability Groupings by Category ............................................. 5 66

Figure 2. AMP Notional Capability Groupings by Component Population ....................... 6 67

Figure 3. Notional 12-week PI ......................................................................................... 6 68

Figure 4. Business Process Mapping to Capabilities ...................................................... 7 69

List of Tables 72

Table 1. AMP CLIN Structure .......................................................................................... 8 73

Table 2. Deliverables List .............................................................................................. 43 74

Table 3. PWS References ............................................................................................. 55 75

November 21, 2023 1

1.0 Introduction 78

This is a non-personal services contract to obtain Contractor services to develop an 79 Army Military Payroll (AMP) solution using the Oracle PeopleSoft Global Payroll 80 application. The Army launched the Integrated Personnel and Pay System – Army 81 (IPPS-A) Increment II (Inc II) production baseline for Human Resources (HR) 82 processing in December 2022 utilizing PeopleSoft Human Capital Management (HCM). 83 The new AMP capability will be integrated with the IPPS-A production baseline. 84

The development will consider (1) Agile execution combined with Development, 85 Security, and Operations (DevSecOps) for all activities / tasks to allow for Continuous 86 Integration / Continuous Delivery (CI/CD) and compliance with the Continuous Risk 87 Management Framework (cRMF), (2) task automation to reduce / eliminate manual 88 effort, and (3) innovation and creativity in problem-solving. 89

For this contract, Agile execution is defined as a group of software methods (e.g., 90 Scrum, Kanban, SAFe®) based on iterative and incremental development and 91 deployment of software capabilities for end users, where requirements and solutions 92 evolve through collaboration between cross-functional teams. These teams include the 93 Government and Contractor communities working across parallel environments where 94 capabilities are implemented, and production system capability support is ongoing. 95

Contractors will apply and perform Agile execution in varying degrees to all aspects of 96 the program life cycle across and within key activities. This includes applying agile 97 methodologies where applicable within the agile processes to perform the following 98 activities: requirements analysis, elicitation, elaboration, and decomposition; 99 architecture; design; development, implementation; test; integration; training material 100 development; and deployment, in addition to support functions such as program 101 management (planning, reporting), configuration management, change control, release 102 management, quality assurance, and cybersecurity. 103

The Government will not exercise any supervision or control over the service providers 104 performing the services herein. Such service providers shall be accountable solely to 105 the Contractor who, in turn, is responsible to the Government. 106

1.1 Description of Services 107

The Contractor will provide all personnel, supervision, and other items and non-personal 108 services necessary (except for those specified as Government Furnished in Section 3 of 109 this document) to perform the IPPS-A AMP services, as defined in this Performance 110 Work Statement (PWS). 111

Agile and DevSecOps methodologies will apply for incremental and value-added 112 delivery from requirements analysis / elaboration and business process reengineering 113 (BPR), through architecture, design, development, implementation, and testing, to 114 integration with the IPPS-A production baseline with minimum cybersecurity 115 vulnerabilities. 116

Integration with the IPPS-A production baseline will be performed with the IPPS-A 117 Capability Support Team. The IPPS-A Capability Support Team is responsible for the 118

November 21, 2023 2 integration, baseline testing, cybersecurity compliance, release, and deployment of 119 functionality into the IPPS-A production baseline for operational use. The Contractor 120 will be required to synchronize tasks and associated activities with the IPPS-A 121 Capability Support Team and participate in agile teams, where applicable, to ensure 122 smooth integration of AMP functionality into the IPPS-A production baseline. 123

The Government will provide the development environment(s) to support Contractor 124 development activities. Each environment will contain the IPPS-A baseline and 125 associated software applications and tools (see Reference 001 - IPPS-A Software 126 Baseline Applications and Tools.xls). The Government will not restrict the Contractor to 127 only using these applications and tools. The Contractor may implement additional 128 applications and tools, with justification and Government approval, within the 129 Government environments. Additional applications and tools that the Contractor 130 implements must align with the IPPS-A applications and tools so when the AMP 131 software is promoted to the IPPS-A integration environment, the IPPS-A tools will 132 function properly with the AMP software. The Government will give the Contractor 133 access as to the IPPS-A applications and tools at the level necessary to perform the 134 required work. The Contractor will give the Government access to all applications and 135 tools within the environments used by the Contractor to allow Government visibility into 136 all components. 137

The IPPS-A Program Management Office (PMO) has yet to establish an DevSecOps 138 pipeline. The Contractor is required to align with the IPPS-A environments and 139 processes in place, to include security policies within the IPPS-A production baseline, 140 and as they progress to a DevSecOps pipeline. 141

The Government will provide the Integration environment and associated tools to 142 support the integration and test of the AMP functionality into the IPPS-A production 143 baseline for release. The IPPS-A Capability Support Team will administer and maintain 144 the Integration environment, will ensure the currency of the IPPS-A baseline, tools, and 145 test data in that environment based on an agreed upon cadence, and will support the 146 Contractor activities in that environment, such as incremental testing and cybersecurity 147 scans. Likewise, the Contractor will support the IPPS-A Capability Support Team 148 baseline activities in that environment to ensure readiness of the AMP functionality for 149 release. 150

The IPPS-A PMO uses the Scaled Agile Framework (SAFe®) for program office 151 operations. The Contractor will integrate efforts (e.g., activities and tools) with the 152 Government for Agile Release Train (ART) workflow to support agile planning and 153 continuous product delivery. The Contractor will apply an agile development framework 154 within their Agile Teams and will synchronize their effort with the Government ART 155 workflow. The Contractor’s agile framework will define interactions between key roles 156 such as Business Owners, Solution Architects, Release Train Engineers, Product 157 Owners, Scrum Masters, and Team Coaches. These interaction definitions will clearly 158 delineate roles and responsibilities to ensure continuous alignment of program 159 roadmaps and transparency in execution activities and reporting. 160

For this PWS, where addressed as part of capability development and delivery, 161 “release” is defined as moving capability to integration environment followed by the 162

November 21, 2023 3 production environment; and “deploy” is defined as users having access to the new 163 capability in the production environment. 164

1.2 IPPS-A Description 165

1.2.1 Background 166

IPPS-A Inc II is both a Defense Business System and a National Security System 167 (categorized as "Sensitive Activities") based on operational requirements on the Non-168 secure Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol 169 Router Network (SIPRNet). IPPS-A is under the Milestone Decision Authority (MDA) of 170 the Army Acquisition Executive (AAE). It is managed by the Army Program Executive 171 Office Enterprise Information Systems (PEO EIS), Project Manager (PM) IPPS-A, 172 located in Arlington, VA. PEO EIS develops, acquires, and deploys tactical and 173 management Information Technology (IT) systems and products and is a Systems 174 Acquisition, Development, and Integration Center of Excellence. 175

The IPPS-A Inc II mission is to develop and deliver a single, integrated, multi-176 component HR and Army Military Payroll system that streamlines Army HR and military 177 pay, enhances the efficiency and accuracy of Army Personnel and Pay procedures, and 178 supports Soldiers and their families. 179

IPPS-A Inc II is being developed and deployed incrementally in a series of software 180 releases to the Total U.S. Army Force (Active Army, Army National Guard, and Army 181 Reserves). A major software release was completed in January 2023, providing Military 182 HR capabilities, and bringing the Total U.S. Army Force into a single authoritative 183 system. This software release serves as the IPPS-A production baseline and is in the 184 Capability Support phase. 185

The IPPS-A production baseline primarily uses Oracle PeopleSoft Enterprise Resource 186 Planning (ERP) Commercial-Off-The-Shelf (COTS) software to deliver the functionality, 187 consisting of the following applications: 188

PeopleSoft HCM 9.2 189

PeopleSoft HCM 9.2 Peoplesoft Update Manager (PUM) Image 32 (or higher) 190

PeopleSoft Customer Relationship Management (CRM) 9.2 PUM Image 16 (or 191 higher) 192

PeopleSoft Enterprise Learning Management (ELM) 9.2 PUM Image 17 (or 193 higher) 194

PeopleSoft Tools version 8.60 (or higher) 195

Oracle database 19c version 12.2.0.3 (or higher) 196

Additional Oracle products, along with Ab Initio, OBIEE Stonebranch, Apache Kafka 197 Confluent, and Cameo software products comprise the baseline. See Reference 001 198 (Reference 001 - IPPS-A Software Baseline Applications and Tools.xlsx) for a complete 199 list of IPPS-A software products. 200

November 21, 2023 4

The IPPS-A solution and all its environments are currently hosted on-premises with the 201 Defense Information Systems Agency (DISA). See Reference 002 (Reference 002 - 202 IPPS-A Technical Environment Designs.pdf) for a description of the IPPS-A hardware. 203

1.2.2 IPPS-A Overarching Objectives 204

Overall IPPS-A program objectives include: 205

Provide incremental releases based on Agile execution and DevSecOps using 206 automated CI/CD pipelines, aligned with the IPPS-A production baseline 207 architecture and processes 208

Use Agile development methods, where functional and technical development 209 team members and the Army collaborate daily 210

Provide preventive and corrective cybersecurity and information assurance to not 211 only meet cRMF compliance requirements but to provide robust and innovative 212 defense of soldier data 213

Provide complete visibility of the Total Force in one system for over 1 million 214 Soldiers 215

Enable the Army to better manage the talents of the Total Force based on their 216 Knowledge, Skills, and Behaviors (KSBs) to optimize Soldiers’ contributions to 217 Army Readiness 218

Deliver full audit compliance for pay, benefits, and HCM transactions per the 219 Federal Information Systems Control Audit Manual (FISCAM) and National 220 Institute of Standards and Technology (NIST) guidelines. 221

Improve Soldiers’ lives by reducing pay and personnel errors and providing full 222 transparency of actions 223

Subsume applicable legacy systems and eliminate interfaces 224

Reduce point-to-point interfaces 225

Simplify application integration and open application data to enable collaboration 226 and innovation via techniques such as Use Application Programming Interfaces 227 (APIs) 228

Execute HR Transformation, Army Military Payroll Transition and Business 229 Process Reengineering in conjunction with fielding IPPS-A to create a 21st 230 century Talent Management system and a HR data-rich environment 231

Use modern data architecture best practices to improve accessibility, increase 232 high data velocity, increase data throughput for low latency and reduce reliance 233 on any single technology or vendor 234

Allow for future Machine Language and Artificial Intelligence utilization 235

Comply with the seven data-centric Department of Defense (DoD) Data Strategy 236 VAULTIS goals, i.e., making data (1) Visible, (2) Accessible, (3) Understandable, 237

(4) Linked, (5) Trustworthy, (6) Interoperable, and (7) Secure 238

November 21, 2023 5

Apply Human Centered Design techniques to improve the user experience 239

Improve Return on Investment and lower total cost of ownership 240

The objective of this contract is to develop an AMP solution using the Oracle PeopleSoft 241 Global Payroll application, which will be integrated with the IPPS-A production baseline. 242

1.2.3 Army Military Payroll Description 243

For planning purposes, Army Military Payroll capabilities have been notionally grouped 244 in two ways as follows; however, these are not deemed to be the only means to achieve 245 an AMP solution: 246

Five (5) main development and release categories as depicted in Error! 247 Reference source not found. 248

Three (3) incremental releases based on population by component as depicted in 249 Figure 2 250

Figure 1. AMP Notional Capability Groupings by Category 252

November 21, 2023 6

Figure 2. AMP Notional Capability Groupings by Component Population 255

In addition, the Government has developed a notional Planning Interval (PI) Model to for 256 each notional grouping that depicts the sequencing and evolution of functionality across 257 a series of 12-week PIs (see Reference 003 (Reference 003 - IPPS-A AMP PI Notional 258 Plan and PI 1 - 3 (24 OCT 2023).pdf). Figure 3 provides a depiction of a notional 12-259 week PI. 260

Figure 3. Notional 12-week PI 263

November 21, 2023 7

As part of the IPPS-A baseline development effort, the following potential payroll 264 capabilities have been identified and may be included in the future production baseline: 265

22 pay triggers for absences, jobs, benefits, special pay requests, … 266

4500+ Pay business rules 267

178 Pay elements defined in PeopleSoft Global Pay 268

369 total Pay elements defined 269

90 Pay scenarios 270

Figure 4 depicts the alignment of capabilities to business process maps. The accounting 271 integration capabilities listed below are linked to maps and requirements that reflect 272 IPPS-A operating as a financial feeder system rather than serving as a subledger. The 273 Army is reviewing this approach and may shift to a subledger approach. 274

Figure 4. Business Process Mapping to Capabilities 276

For a complete of the AMP Requirements, see Reference 004 (Reference 004 - 277 IPPS-A Functional Requirements List.xls). 278

For a description of the AMP Business Process Maps, Format Identifiers (FID) 279 Transaction Identification Numbers (TINs), Interfaces, and Pay Elements, see 280 Reference 005 (Reference 005 - IPPS-A AMP Business Process Maps - Interfaces - 281 Pay Data.zip). 282

1.3 Scope 283

The Army requires the following services to deliver an AMP solution as follows: (1) 284 manage, (2) design, configure, build, and test, (3) integrate and test the AMP solution 285 with the IPPS-A production baseline in the integration environment, (4) support AMP 286 release and deployment activities, (5) assess Government software for reusability, (6) 287 develop AMP training material, and (7) transition AMP functionality to production 288 operations. 289

November 21, 2023 8

These services will be acquired across the following tasks: 290

Task 1: Program Management 291

Task 2: Solution Configuration, Development, and Test 292

Task 3: Solution Integration 293

Task 4: Release and Deployment Support 294

Task 5: Government Software Reuse Integration 295

Task 6: Training Material Development 296

Task 7: Production Operations Transition / Transition Out 297

Task 8: Training Delivery [OPTIONAL] 298

1.4 Period of Performance 299

The period of performance for this contract is up to seven (7) years. The performance 300 will primarily consist of Program Management Contract Line Item Numbers (CLINs) and 301 a series of 12-week Planning Intervals (PIs) agile software development under an 302 overarching CLIN supporting. The Program Management CLIN will have an initial 303 duration of 12 months with continued performance every 6-months, thereafter for seven 304

(7) years as Option Periods. Based on the requirements and need of the Government, 305 PIs may overlap and be concurrently performed under the total duration of the contract. 306

The Base Period begins on the designated date defined at contract award. PI Periods 307 begin when exercised by the Government in concert with the Program Roadmap 308 maintained by the Contractor and concurred with by the Government. Contractor 309 performance will be monitored, and results will be reviewed when deciding to exercise a 310 PI Period. 311

1.5 Contract Type 312

This is a Hybrid contract including Firm Fixed Price (FFP), Cost Plus Fixed Fee (CPFF) 313 Level of Effort (LOE), CPFF Completion, and Cost Reimbursable (no fee) line items for 314 Travel and Other Direct Costs (ODCs). 315

1.6 Contract Structure 316

The contract structure is depicted in Table 1, broken out by task and the respective 317 scope. 318

Table 1. AMP CLIN Structure 319

CLIN # Description Scope Period of

Performance APPN CLIN Type

X001 Transition In (Part of Task 1) On-boarding Activities Knowledge Transfer

6-month period RDTE CPFF

X002 Task 1: Program Management Program Planning and Reporting Program Management (Cost, Schedule, Performance, Quality) Sprint 0 (Roadmap Planning)

Contract Duration;

6-month periods

RDTE CPFF LOE

November 21, 2023 9

CLIN # Description Scope Period of

Performance APPN CLIN Type

X003 PI CLIN

Task 2: Solution Configuration, Development, and Test Task 3: Solution Integration Task 4: Release and Deployment Task 5: Government Software

Reuse Integration Task 6: Training Material

Development

Planning Interval (PI) Planning Sprint Execution Code Delivery Baseline Integration Baseline Release Planning Release Readiness Deployment Readiness Data Migration / Conversion Post Deployment Support Reuse Analysis Reusable Code Integration Training Planning and Management Training Material Development

12-week PIs incrementally funded via SLIN (one overarching Not To Exceed (NTE) total value CLIN spanning 12 months)

RDTE CPFF LOE

and/or

CPFF

Completion

X004 SURGE PI CLIN

Task 2: Solution Configuration, Development, and Test Task 3: Solution Integration Task 4: Release and Deployment Task 5: Government Software

Reuse Integration Task 6: Training Material

Development

Planning Interval (PI) Planning Sprint Execution Code Delivery Baseline Integration Baseline Release Planning Release Readiness Deployment Readiness Data Migration / Conversion Post Deployment Support Reuse Analysis Reusable Code Integration Training Planning and Management Training Material Development

Contract Duration;

12-month CLIN periods

RDTE CPFF

X005 Task 7: Production Operations Transition

Transition Out Planning Transition Out Implementation initial Off-boarding Activities

Last 120 Days of Contract

RDTE FFP

X006 Task 8: Training Delivery

[OPTIONAL]

Training Preparation Training Delivery to End Users

6 months prior to Production Release until Complete

RDTE FFP

X007 Licenses Additional Development Tool Licenses

Contract Duration;

6-month periods

RDTE FFP

X008 Travel Actual Travel Costs Contract Duration;

6-month periods

RDTE CR

X009 Other Direct Costs (ODCs) Actual ODCs Contract Duration;

6-month periods

RDTE CR

X010 Transition Out (Part of Task 7) Final Off-boarding Activities Contract Closeout

60 days RDTE CPFF

X011 Contractor Manpower Reporting Manpower Reports Contract Duration Not Separately Priced

X012 Contract Data Requirements List

(CDRL)

Required Documentation Contract Duration Not Separately Priced

1.7 General Information Requirements 320

1.7.1 Quality Control and Assurance 321

The Contractor will maintain an effective quality control program to ensure services are 322 performed as agreed to in the contract. This will include the following: 323

Updating and implementing procedures to identify, prevent, and ensure the non-324 recurrence of defective services, to include products and software 325

November 21, 2023 10

Using programmatic and technical metrics as quality measures to assess 326 performance, progress, speed, cybersecurity, and quality of the product team, 327 leveraging automated tools to the maximum extent practicable 328

The Government will evaluate the Contractor’s performance in accordance with the 329 IPPS-A AMP Quality Assurance Surveillance Plan (QASP) (see Attachment 1). The 330 QASP describes the performance levels the Contractor must achieve to satisfy the 331 contract performance requirements. The Contractor shall meet the threshold 332 requirements outlined in the QASP to receive a Satisfactory rating in the monthly 333 Contracting Officer’s Representative (COR) report and annual Contractor Performance 334 Assessment Report (CPAR). The Contractor shall report performance against the 335 metrics outlined in the QASP during program reviews per the cadence established 336 between the Government and Contractor. The report must show the current and 337 previous two months. If the Contractor fails to meet any QASP metric, the Government 338 will notify the Contractor through the Contracting Officer and will require a response 339 within five (5) business days of receipt of the official notice by the Contracting Officer 340 describing their corrective action plan to meet the QASP metric. If the Contractor is 341 unable to meet the threshold requirement, the Government may decide to not award 342 subsequent options to the Contractor. 343

The Government will perform random After Action Reviews (AARs) at the PI and/or 344 sprint level for up to 100% of the PIs exercised. This surveillance method is appropriate 345 for a deliverable or performed service which will capture best practices, bottlenecks, and 346 future PI/sprint development processes for implementation. 347

1.7.2 Recognized Federal Holidays 348

New Year’s Day 349

Martin Luther King Jr.’s Birthday 350

Presidents Day 351

Memorial Day 352

Juneteenth National Independence Day 353

Independence Day 354

Labor Day 355

Columbus Day 356

Veteran’s Day 357

Thanksgiving Day 358

Christmas Day 359

1.7.3 Hours of Operation 360

The Contractor shall be responsible for conducting normal operations between the 361 hours of 8am to 5pm Monday thru Friday, core hours being 9am to 3pm Monday 362 through Friday except for Federal Holidays, Government closure due to local or national 363 emergencies, administrative closings, or similar Government directed facility closings. 364

November 21, 2023 11

Contractor personnel identified as key personnel and/or leads shall be available 365 between the hours of 8am to 5pm Monday thru Friday. 366

1.7.4 Place of Performance 367

All activities requiring Government participation (e.g., planning, demonstrations, 368 reviews) will take place at the IPPS-A PMO facility, currently located at the Polk 369 Building, 2521 South Clark Street, Arlington, VA 22202, unless otherwise determined 370 based on the specific activity. For activities conducted at the IPPS-A PMO facility, the 371 Government will provide hotel-type space for Contractor use. The Contractor facility 372 may also be used for key events. Key events will be coordinated in advance to include 373 associated logistics. 374

All work related to Sensitive Activities (SA) will be performed at the designated IPPS-A 375 PMO secure area approved for classified discussion and work. The IPPS-A PMO 376 secure area is currently located at the Polk Building, 2521 South Clark Street, Arlington, 377

VA 22202. 378

Travel between the Contractor facilities and Government facilities will not be reimbursed 379 as a travel expense. 380

Temporary duty (TDY) travel to other designated locations will be required to attend 381 meetings, demonstrations, and data centers. 382

The number of TDY trips is unknown. The Contractor will not be reimbursed for travel to 383 and from their normal place of business within the Continental United States (CONUS) 384 (Convenience Travel). For performance of this contract, outside the local area is defined 385 as greater than 50 miles from the IPPS-A PMO facility. Travel will be reimbursed as 386 actual costs incurred in accordance with Joint Travel Regulations (JTR). All necessary 387 travel shall be approved in advance by the COR. 388

Contractor personnel will be subject to all travel regulations in effect at the time of the 389 anticipated travel. Contractors are not authorized city pair (i.e., Government discount) 390 air fares. 391

1.7.5 Security Requirements 392

The DD254 is provided as Attachment 3. The security classification guidance for 393 classified information requirements is in accordance with the attached DD254. 394

The Contractor will possess and maintain a Facility Clearance Level of SECRET from 395 the Defense Counterintelligence Security Agency (DCSA). 396

Contractor personnel performing work under this contract will have a valid active 397 SECRET security level clearance. 398

The Contractor will ensure the protection of Classified Information, Controlled 399 Unclassified Information (CUI), Personal Identifiable Information (PII) or Privacy Act 400 Data, Controlled Technical Information (CTI) [as required], and Critical Program 401 Information (CPI) [as required]. 402

November 21, 2023 12

The Contractor will ensure the aforementioned information is properly safeguarded in 403 accordance with the applicable requirements to protect adequately against unauthorized 404 disclosure. 405

The Contractor will review DoD, DA, and PEO EIS specific instructions, security 406 policies, procedures, training, and other requirements stipulated in the National 407 Industrial Security Program (NISP) and National Industrial Security Program Operating 408 Manual (NISPOM), and any supplements thereto are applicable, to include, the Federal 409 Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement 410 (DFARS), data usage agreements and memoranda of agreement, and security 411 provisions and/or clauses. 412

1.7.5.1 Authorities and Scope 413

This paragraph addresses contractor access to, or possession of, collateral (non-SCI) 414 classified information, CUI, PII, CTI or CPI in connection with the performance of this 415 contract. However, it is also applicable to safeguarding the same information in 416 connection with all aspects of pre-award activity, including preparation of bids and 417 proposals and pre-award negotiations, and all aspects of post-award activity. Moreover, 418 the requirements are equally applicable to the safeguarding of the same information not 419 released or disclosed under a procurement contract, agreements or programs 420 participated in by a firm, organization, or individual on a voluntary or grant basis. 421

For the purposes of this contract, unless otherwise specified, the term “access” will be 422 used to denote any of the aforementioned categories of information released to 423 industry. Additionally, the term Requiring Activity (RA) applies to any element requiring 424 Contractor access. 425

All functional Security, Force Protection, Antiterrorism, Operations Security (OPSEC), 426 Cybersecurity and Counterintelligence requirements, policies, and procedures identified 427 in this PWS are applicable to all of DoD and Army (military, civilian and Contractor) 428 personnel performing services on this contract. This includes IPPS-A integrated portfolio 429 efforts, other integrated ERP program efforts that support the implementation of the 430 AMP solution or where the Army and / or PEO EIS, as the Cognizant Security Office 431 (CSO), is required to implement security procedures, program protection planning, 432 additional required training identified through updated policy, or exercise security and/or 433 protection duties. This also includes all Executive Orders, policies, laws, statutes, as 434 promulgated in DoD and Department of Army (DA) Directives, Regulations, Instructions 435 and Manuals as provided in the following references. 436

1.7.5.2 Security Requirements for Overseas Travel 437

For travel requirements/restrictions to any foreign country, see the Foreign Clearance 438 Guide (FCG) at the following website for applicable information: 439 https://www.fcg.pentagon.mil/fcg.cfm 440

November 21, 2023 13

1.7.5.3 Physical Security 441

The Contractor will be responsible for safeguarding all Government equipment, 442 information and property provided for Contractor use. At the close of each work period, 443 Government facilities, equipment, and materials shall be secured. 444

1.7.5.4 Disclosure of Information 445

The Contractor will not release to anyone outside the Contractor's organization any 446 classified information, regardless of medium (e.g., film, tape, document, etc.), pertaining 447 to any part of this contract or any program related to this contract, unless: (1) The COR 448 has given prior written approval by the cognizant classified information owner and (2) 449 the cognizant classified information owner has approved its release as part of contract 450 performance. 451

Classified information will not be authorized for release regardless of medium (e.g., film, 452 tape, document), for any part of this contract or any program related to this contract. All 453 unclassified information or CUI regardless of medium (e.g., film, tape, document), 454 pertaining to any part of this contract or any program related to this contract, shall be 455 reviewed and approved for release through standard Army processes before it is 456 provided to the public, including via posting to publicly accessible websites. 457

Request for approval will identify the specific information to be released, the medium to 458 be used, and the purpose for the release. The Contractor will submit its request to the 459 COR at least forty-five (45) days before the proposed date for the release. The 460 Contractor shall include a similar requirement in each subcontract under this contract. 461 Subcontractors will submit requests for authorization to release through the prime 462 Contractor to the COR. The Contractor's procedures for protecting against unauthorized 463 disclosure of information shall not require DoD employees or Armed Forces (AF) 464 members to relinquish control of their work product, whether classified or not, to the 465 Contractor. 466

1.7.5.5 Visiting Facilities 467

Pursuant to Section 808 of Public Law (P.L.) 102-190 (DFARS 204.402), DoD 468 employees or members of the AF who are assigned to or visiting a Contractor facility 469 and are engaged in oversight of an acquisition program will retain control of their work 470 product. Classified work products of DoD employees or members of the AF will be 471 handled in accordance with DoD 5220.22-M. Contractor procedures for protecting 472 against unauthorized disclosure of information will not require DoD employees or 473 members of the AF to relinquish control of their work products, whether classified or not, 474 to a Contractor. If a visit to a Contractor facility will require access to classified 475 information, the visitors must give the Contractor advance written notice. 476

1.7.5.6 Key Control 477

The Contractor will establish and implement methods of making sure all keys / key 478 cards issued to the Contractor by the Government are not lost or misplaced and are not 479 used by unauthorized persons. NOTE: All references to keys include key cards. No 480 keys issued to the Contractor by the Government will be duplicated. The Contractor will 481

November 21, 2023 14 develop procedures covering key control that will be included in the Quality Control Plan 482 (QCP). Such procedures will include turn-in of any issued keys by personnel who no 483 longer require access to locked areas. The Contractor will immediately report any 484 occurrences of lost or duplicate keys/key cards to the COR. 485

a. In the event keys, other than master keys, are lost or duplicated, the Contractor 486 will, upon the direction of the COR, re-key or replace the affected lock or locks; 487 however, the Government, at its option, may replace the affected lock or locks or 488 perform re-keying. When the replacement of locks or re-keying is performed by 489 the Government, the total cost of re-keying or the replacement of the lock or 490 locks will be deducted by the Government from the monthly payment due the 491 Contractor. In the event a master key is lost or duplicated, all locks and keys for 492 that system will be replaced by the Government and the total cost will be 493 deducted by the Government from the monthly payment due the Contractor. 494

b. The Contractor will prohibit Government issued keys by any persons other than 495 the Contractor’s employees. The Contractor will prohibit the opening of locked 496 areas by Contractor employees to permit entrance of persons other than 497 Contractor employees engaged in the performance of assigned work in those 498 areas, or personnel authorized entrance by the COR. 499

1.7.5.7 Lock Combinations 500

The Contractor will establish and implement methods of ensuring that all lock 501 combinations are not revealed to unauthorized persons. These procedures shall be 502 included in the Contractor’s QCP. 503

1.7.5.8 Security Education Training and Awareness (SETA) 504

All DA SETA requirements identified in this PWS are applicable to all of DoD and Army 505 (military, civilian and Contractor) personnel performing services on the IPPS-A contract 506 and IPPS-A integrated portfolio efforts in accordance with DoDM 5220.22, DoDM 507

5200.01 Volume 1-3, DoDI 5200.48, Army Regulation (AR) 350-1, AR 380-12, AR 25-2, 508 and DA Pamphlet (PAM) 25-2-6. 509

1.7.5.9 Special Qualifications 510

Contractor personnel performing work under this contract will have the appropriate 511 personnel security investigation (PSI) completed and favorably adjudicated by the DoD 512 CAF; and granted eligibility for access to classified information. 513

The Contractor will be responsible for ensuring that employees providing cybersecurity 514 services possess and maintain current Information Assurance Technician (IAT) Level I 515 (COMPTIA A+ CE) or II (COMPTIA Security + CE) professional certification per Army 516 and DoD regulation at the time of contract award, and during the execution of the 517 contract. 518

The Contractor will ensure the following: 519

a. All employees complete Cybersecurity Awareness training annually, as outlined 520 by the DA PAM 25-2-6, “Cybersecurity Training and Certification Program”, April 521

November 21, 2023 15

8, 2019. Employees will also complete additional relevant security trainings, i.e., 522 Privacy Information Handling, as required by the Government. 523

b. All DA Contractor personnel who have access to Federally-controlled information 524 systems are assigned to an Automated Data Processing (ADP) Position 525 Category which is designated at one of three ADP levels, positions which are 526 designated at one of three information technology (IT) levels, each requiring a 527 certain level of investigation and clearance, as follows (see A Release 3 80-5, 528 Appendix K for position descriptions): 529

1) ADP-I for an IT position requiring a Single Scope Background 530 Investigation (SSBI) or SSBI equivalent; 531

2) ADP-II for an IT position requiring a National Agency Check with Law and 532 Credit (NACLC equivalent); and 533

3) ADP-III for an IT position requiring a National Agency Check with Inquiries 534 (NACI) or equivalent. 535

4) Previously completed security investigations may be accepted by the 536 Government in lieu of new investigations if determined by the PEO EIS 537 security office to be essentially equivalent in scope to the PWS 538 requirements. The length of time elapsed since the previous investigation 539 will also be considered in determining whether a new investigation is 540 warranted. To assist the Government in making this determination, the 541 Contractor must provide the following information to the respective PEO 542 EIS security office. This information must be provided for each Contractor 543 employee who will perform work on a PEO EIS system and will require 544 access to Federally-controlled information systems: 545

Full name, with middle name, as applicable, with social security 546 number 547

Citizenship status with date and place of birth 548 Proof of the individual’s favorable adjudicated background 549 investigation or NACI, consisting of identification of the type of 550 investigation performed, date of the favorable adjudication, and 551 name of the agency the performed the investigation 552

Company name, address, phone, and fax numbers with email 553 address 554

Location of on-site workstation or phone number if off-site; and 555 Order or contract number and expiration date; and name of the 556

Contracting Officer. The Contracting Officer will ensure that the 557 Contractor is notified as soon as a determination is made by the 558 assigned or cognizant PEO EIS security office regarding 559 acceptance of the previous investigation and clearance level. 560

5) If a new investigation is deemed necessary, the Contractor and 561 Contracting Officer will be notified by the respective PEO EIS security 562 office after appropriate checks in the DoD databases have been made. 563

November 21, 2023 16

6) If the Contractor employee requires access to classified information and 564 currently does not have the appropriate clearance level and/or an active 565 security clearance, the PEO EIS security office will relay this information to 566 the Contractor and Contracting Officer for further action. 567

7) The Contracting Officer will ensure that the respective PEO EIS security 568 office initiates the investigation for the required clearance level(s) of the 569 Contractor personnel. 570

8) It is the Contractor’s responsibility to ensure that adequate information is 571 provided, and that each Contractor employee completes the appropriate 572 paperwork, as required either by the Contracting Officer and the PEO EIS 573 security office, to begin the investigation process for the required 574 clearance level. 575

1.7.6 Contracting Officer’s Representative (COR) 576

The COR will be identified by separate letter. The COR monitors all technical aspects of 577 the contract and assists in administration. The COR is authorized to perform the 578 following functions: assure that the Contractor performs the technical requirements of 579 the contract; perform inspections necessary in connection with performance; maintain 580 written and oral communications with the Contractor concerning technical aspects of the 581 contract; issue written interpretations of technical requirements, including Government 582 drawings, designs, specifications; monitor Contractor's performance and notify both the 583 Contracting Officer and Contractor of any deficiencies; coordinate availability of 584 Government furnished property; and provide site entry of Contractor personnel. A letter 585 of designation issued to the COR, a copy of which is sent to the Contractor, states the 586 responsibilities and limitations of the COR, especially regarding changes in cost or 587 price, and estimates or changes in delivery dates. The COR is not authorized to 588 change any of the terms and conditions of the resulting contract. 589

1.7.7 Agile Qualifications 590

The Contractor shall ensure personnel performing work under this contract have the 591 necessary Agile certifications and/or experience to perform their assigned role to deliver 592 functionality in compliance with the Contractor’s agile methodology, leveraging best 593 practices of Agile software development. 594

1.7.8 Key Personnel 595

Key personnel are those people considered essential to successful Contractor 596 performance. All key personnel must be on board at contract award. The Contractor will 597 not replace any personnel designated as key personnel without providing written notice 598 to the Contracting Officer and COR at least 48 hours upon Contractor receipt of a 599 voluntary notice or Contractor decision to replace personnel. The notice will provide a 600 detailed explanation of the circumstances necessitating the substitution. Qualifications 601 of substitute key personnel shall be equal to, or greater than, those of the person(s) 602 being replaced. 603

November 21, 2023 17

The Contractor will fill the following Key Personnel positions for the purposes of this 604 contract. 605

1.7.8.1 Program Manager (PM) 606

The Contractor will assign an individual to serve as a Program Manager (PM) for this effort. 607 This individual will be the single point of contact for the Government Task Monitor (GTM) and 608 COR. The PM will be responsible for the performance of the work. The name of this person 609 and an alternate, who will act for the Contractor when the PM is absent, will be designated in 610 writing to the Contracting Officer. The Contractor PM and alternate will have full authority to act 611 for the Contractor on all matters relating to daily operation of this contract. The Contractor PM 612 or alternate will be available in accordance with paragraph 1.7.3 Monday through Friday 613 except Federal holidays or when the Government facility is closed for administrative reasons. 614

The PM will have the following experience and qualifications: 615

a. 10 or more years of acquired knowledge in planning, directing, and managing 616 projects/operations in an organization similar in size to this acquisition with at least 617 managing two major software development implementations, to include agile 618 development 619

b. 10 or more years of acquired knowledge and supervision of employees of various labor 620 categories and skills in efforts similar in size and scope as this acquisition 621

c. 10 or more years of acquired knowledge of industry accepted standards and best 622 practices related to Project Management 623

d. Proven track record on delivering on time and within budget for large/complex projects 624

e. 8 or more years of experience managing the entire agile software development lifecycle, 625 including frequent production delivery 626

f. 5 or more years of experience with researching and fielding new and innovative 627 technology 628

g. 10 or more years of hardware and software procurement experience 629

h. 10 or more years of program management experience 630

i. 10 or more years of program management experience in Federal, DoD, Army, or 631

Intelligence Community (IC) 632

j. 10 or more years of IT experience in the Federal, DoD, Army, or IC 633

k. Project Management Professional Certification required 634

l. Agile Project Manager Certification required 635

m. Agile Product Owner Certification preferred 636

n. Bachelor’s degree in an IT related field, or equivalent experience (minimum 18 years) 637

1.7.8.2 PeopleSoft Global Payroll Systems Architect 638

The PeopleSoft Global Payroll System Architect will have the following experience and 639 qualifications: 640

a. Proven experience of at least one full implementation experience with PeopleSoft 641 Global Payroll working with multiple teams composed of technical and functional 642 analysts 643

b. 8 or more years of configuring business rules, and performing Configuration, Design 644 and Development of PeopleSoft HR and Global Payroll 645

November 21, 2023 18

c. Understanding of PeopleSoft Global Payroll Business Processes and how it integrates 646 with HR, Time & Labor, PeopleSoft Financial Supply Chain Management (FSCM), and 647 external general ledger systems 648

d. 10 or more years of development experience with PeopleTools (e.g., Application 649 Designer, Component Interface, Application Engine, Integration Broker), and SQL 650

e. 3 or more years of experience of configuration, design and development of PeopleSoft 651 Payroll Rules Engine and Processing Framework 652

f. 5 or more years of experience translating Functional and Technical Requirements for 653 implementation in a defense business system 654

g. 5 or more years of experience interacting and presenting work to senior leadership 655

h. 5 or more years of experience effectively analyze and demonstrate business processing 656 reengineering of legacy Business Processes in favor of PeopleSoft…