IRS-OIT-VI SOW- Draft.pdf

FAR 2.101 and 3.104 PROCUREMENT SENSITIVE

Internal Revenue Service

Statement of Work (SOW) for

Virtualized Infrastructure

(As of 02/24/2025)

1.0 INTRODUCTION

2.0 BACKGROUND

3.0 SCOPE

4.0 TECHNICAL REQUIREMENTS

4.1. TASK 1: VIRTUALIZED INFRASTRUCTURE SOFTWARE SOLUTION

4.2. TASK 2 SOLUTION CONFIGURATION, DEVELOPMENT, AND DEPLOYMENT

4.3. TASK 3 OPERATIONS AND MAINTENANCE (O&M)

4.4. TASK 4: GENERAL PERFORMANCE REQUIREMENTS

4.5. TASK 5 PROGRAM MANAGEMENT

4.6. TASK 6 TRANSITION STRATEGY

4.7. TASK 7 INTEGRATION

4.8. TASK 8 CHANGE MANAGEMENT (CM)

4.9. TASK 9 TRAINING AND CERTIFICATION PROGRAM

5.0 ASSUMPTIONS & CONSTRAINT

6.0 KEY PERSONNEL

6.1. PROGRAM MANAGER

7.0 OTHER PERSONNEL

7.1. SYSTEMS ARCHITECT

7.2. DEVELOPER/ENGINEER

8.0 PERIOD OF PERFORMANCE

9.0 HOURS OF OPERATIONS/PLACE OF PERFORMANCE/HOLIDAYS

9.1. PLACE OF PERFORMANCE

9.2. STANDARD WORK HOURS

10.0 TRAVEL

11.0 OTHER DIRECT COSTS (ODCS)

12.0 FACILITIES AND ACCESS

13.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT

14.0 DATA RIGHTS

15.0 PROPRIETARY DATA NON-DISCLOSURE REQUIREMENTS

16.0 SAFETY ISSUES

17.0 ORGANIZATIONAL CONFLICT OF INTEREST (OCI)

18.0 SECURITY

18.1. PERSONNEL SECURITY REQUIREMENTS

18.2. OPERATIONAL SECURITY (OPSEC)

18.3. ACCESS TO GOVERNMENT DATA AND INFORMATION

19.0 QUALITY ASSURANCE

20.0 GOVERNMENT CONTRACTING OFFICER’S REPRESENTATIVE

20.1. THE COR OR GTM (IF APPLICABLE) ARE RESPONSIBLE FOR:

21.0 SCHEDULE OF DELIVERABLES

22.0 PERFORMANCE REQUIRMENTS SUMMARY

23.0 DEFINITIONS AND ACRONYMS:

23.1. DEFINITIONS:

23.2. ACRONYMS:

Sensitive But Unclassified (SBU)

1.0 INTRODUCTION

The Internal Revenue Service (IRS) Office of Information and Technology (OIT) requires a Federal Information Security Modernization Act (FedRAMP) approved tailorable commercial off the shelf (COTS) or hybrid Information Technology (IT) software and its hardware (if applicable), maintenance, related support for virtualization technologies, and professional services to support an existing multi-cloud capability and expanded automation.

2.0 BACKGROUND

The IRS administers America’s tax laws and collects revenue that helps fund the Government’s operations and public services. As such, the IRS is committed to assisting millions of taxpayers understand their tax obligations whilst pursuing those individuals who violate tax laws. To support these initiatives, OIT leverages industry best practices and innovations to improve the IRS’ compute and storage efficiency, effectiveness, quality, and process maturity while satisfying its growing demands for secure, reliable, timely, and responsive solutions.

has context menu. OIT currently uses Broadcom’s VMware solution to provide most of their compute and storage environment needs for over 15,000 virtual machines, 500 virtualization hosts, at 10+ locations.

3.0 SCOPE

IRS OIT requires a pre-approved for federal use tailorable COTS or hybrid software and its hardware (if applicable), maintenance, related support for virtualization technologies, and professional services to support an existing multi-cloud capability and expanded automation options for over 15,000 virtual machines, 500 virtualization hosts, at 10+ locations.

4.0 TECHNICAL REQUIREMENTS

4.1. TASK 1: Virtualized Infrastructure Software Solution. The Contractor must provide a virtualized infrastructure software solution that meets the following minimum requirements:

4.1.1. FedRAMP approved and meet federal regulations and standards.

4.1.2. Contains, at a minimum:

4.1.2.1. 50,000 physical compute cores

4.1.2.2. 1,000 physical processor sockets

4.1.2.3. 2.0PetaBytes (PB) Random Access Memory (RAM)

4.1.2.4. 200PB of traditional storage (Fiber Channel [FC], Network File System

[NFS], Internet Small Computer Interface [iSCSI], Non-Volatile Memory Express over Transport Control Protocol [NVMe/TCP])

4.1.3. Support multi-cloud automation and deployments, to include Preboot eXecution Environment (PXE) or on-demand International Organization for Standardization (ISO) boot provisioned virtual machines across all virtualization hosts, allowing customer (product owner) non-administrative console access to the provisioned virtual machines.

4.1.4. Support both on-premises and external cloud service providers for Government and commercial offerings.

4.1.5. Support Internet Protocol version 4 (IPv4) and IPv6.

4.1.6. Allow for custom scripting or ancillary script engine or automation engine services to provide all Day-0, Day-1, Day-2 customization tasks to include changes to virtual machine (VM) provisioning, guest configurations, and security configurations and changes.

4.1.7. Meets Federal Information Security Modernization Act (FISMA) High with the minority configured to Payment Card Industry Data Security Standard (PCI DSS) and/or Impact Level 5 (IL5) for hosts, guests, and management infrastructure.

4.1.8. Support Two-Factor Authentication globally, using principal of least privilege, using IRS active directory or Azure Entra AD credentials.

4.1.9. Software, firmware, subcomponent firmware, or source code that at no time was or will be manufactured, developed, sourced, or provided by the following countries: Cuba, Iran, Syria, North Korea, Russia, Crimea region of Ukraine, People's Republic of China, Venezuela; or any country that is prohibited from export of U.S cryptography modules; or restricted imports, export, reexport or materiel modifications with information technology, cryptography components (countries included in the Wassenaar Arrangement are generally not included in these restrictions, except for Russia and other countries not identified as country group A:1 exempt in Export Administration Regulations (EAR) Supplement No. 1 to Part 740).

4.1.10. Highly desired, but not required, for the solution to include hyperconverged storage.

4.2. TASK 2 Solution Configuration, Development, and Deployment.

The Contractor must:

4.2.1. Plan, develop, and deliver a scalable, flexible, tailorable, and robust COTS solution capable of supporting IRS’ virtualized infrastructure.

4.2.2. Deliver a Deployment Plan within four (4) weeks prior to deployment to include pre-deployment, deployment, and post-deployment activities. The deployment plan must include metrics to effectively monitor and measure end-user adoption and usage.

4.2.3. Employ robust, standardized, automated, and secure configuration management and deployment processes and tools to ensure reliable deployment of software systems and manage changes.

4.2.4. Provide efficiencies by incorporating automation for both configuration management and deployments, minimizing errors, down time and manual interventions, while enhancing traceability, and control.

4.2.5. Institute standardized deployment procedures including roll back mechanisms to rapidly address deployment issues and ensure error-free deployments in all environments.

4.2.6. Implement version control mechanisms for configuration files, scripts and software artifacts to track changes and ensure traceability.

4.2.7. Provide an approach that leverages out-of-the-box functionality to the maximum extent practicable. The offeror must provide Service-Level Agreements (SLA) as applicable.

4.2.8. According to agile principles and best practices, provide an Agile Development

Artifacts and Reports to include, at a minimum, a living product roadmap, product backlog, program increments, sprint plans, release plans, and sprint and retrospective reports to capture all requirements and business needs. The Contractor must provide the initial product roadmap withing 90 days after contract award. Utilize the product backlog to build quarterly program increments. Program Increments and Sprint Plans must receive IRS approval prior to starting work. Documents must incorporate user stories from the backlogs. The backlog items must have a clear acceptance criterion for each user story. The Contractor must review artifacts and reports as necessary during the PMR.

4.2.9. Execute all testing activities needed to ensure a production-ready solution/delivery such as: unit testing, system testing, integration, performance, and regression testing, application of automated testing, coordination with Independent Verification and Validation (IV&V) testing (IV&V testing will be performed by an independent contractor), and support of user acceptance testing.

4.2.10. In coordination with the Government, establish and maintain communications with stakeholders through an approved Strategic Communications Plan and engagement activities to ensure the solution continues to meet all end-user needs. The Contractor must provide the Strategic Communications Plan within 60 days of contract award and final within 90 days of contract award. The Contractor’s Strategic Communications Plan, at a minimum, must include an outline oof the stakeholder network and strategies to effectively identify and analyze end-user needs, plan and execute communications, and proactively engage stakeholders.

4.3. TASK 3 Operations and Maintenance (O&M).

The Contactor must:

4.3.1. Ensure all deployed configurations of the proposed solution have the necessary and appropriate O&M support to include, as a minimum, software upgrades, system maintenance, and end-user support/help desk support as required to meet the proposed implementation schedules and efficiency definitions.

4.3.2. Propose SLA as applicable.

4.3.3. Provide 24x7x365 Tier I, II, III support personnel with the knowledge, skills, and abilities to deliver remote assistance via phone, email, and web-based (through the platform’s portal) a three (3) tier support for operations 24x7x365 days/year.

4.3.3.1. Tier 0 (Self-Service, Chatbots):

• The Contractor must monitor and maintain the Tier 0 support tools such as chatbots, voice, and in-application assistance. Tier 0 requests must be properly logged and escalated to Tier 1 if they cannot be resolved by Tier 0.

4.3.3.2. Tier I: Tier I includes full incident and problem lifecycle management following industry best practices. This includes activities such as logging all end-user inquiries and addressing less complex issues such as ticket referrals, basic error handling and basic application “how-to’s”.

Specific activities may include:

• Serving as the single point of contact for all issues

• Identifying and tracking incidents

• Classifying and prioritizing incidents

• Diagnosing and resolving incidents

• Closing incidents

• Monitoring incidents and communicating incident status

• Processing user account management requests such as password resets and resolving account lockouts

4.3.3.3. Tier II: Tier II includes support for more complex issues if they cannot be resolved by Tier I. More specifically, this includes activities such as performing root cause analyses, identifying system changes, and escalating to Tier 3. Specific activities may include:

• Conducting root cause analysis

• Maintaining access request forms

• Conducting incident trend analysis of all Tier 0 through Tier 2 issues

• Processing request for the creation of new user accounts and user permission changes

• Processing user request for adding and updating configuration data

• Providing updates to vendor’s and established production catalogs

• Process workflow configuration changes

4.3.3.4. Tier III: Tier III includes complex business process assistance, bug fixes, and federally mandated and mission critical enhancements.

• Tier III support must respond to user requests within four (4) hours and update the users every forty-eight (48) hours for issues taking longer than twenty-four (24) hours to resolve. The Contractor shall resolve issues causing a critical work stoppage immediately, within twenty-four (24) hours and no later than forty-eight (48) hours from the time the request is submitted.

• Perform Tier III issue root cause analysis and resolve functional and technical issues that do not require a bug-fix. Functional Subject Matter Experts (SMEs) will work with customers to identify the issue and resolve issues that do not require software changes.

• Provide technical resources troubleshoot software problems.

4.3.4. Technical issues management with a formal Problem Management process including a trouble ticket system that assigns a unique ticket number for tracking purposes.

4.3.5. Maintain mobile Applications.

4.3.6. Identify federally mandated and mission critical enhancements.

4.3.7. Establish a Technology Lifecycle Management Plan draft within ninety (90) days after contract award and final one hundred twenty (120) days after contract award that outlines processes for implementing patches, updates, bug-fixes, security vulnerability changes, system features and updates, and other activities as necessary. Ensure the plan includes licenses, renewals, and end of life milestones.

4.3.8. Product updates and maintenance including all patches and software updates for both major and minor releases for the purpose of addressing all bug-fixes, security vulnerabilities, and system features and updates. Utilize automated testing tools to conduct regression testing to ensure bug-fixes do not impact other software or system solutions.

4.3.9. Perform biannual virtualized software Health Check Assessments to ensure the latest solution’s version and all patches are operational. Provide a Health Check Report within 30 days following the Health Check’s completion that identifies the solution’s version and patches running within the infrastructure within 30 days after completing the health check and provide steps to resolve any vulnerabilities. (Example: Host 1 running version X, missing Critical Patch X.)

4.3.10. Perform a biannual software Architecture Reviews to ensure the solution is operating according to industry standards and configured to provide the Government with optimal performance and cost efficiency. Provide an Architecture Review Summary within 30 days after completing the architecture assessment.

4.3.11. Ensure seamless continuity of operations and mitigate system outages and performance issues within 24 hours. Execute system contingency plans such as continuity of operations, risk management, IT disaster recovery, contingencies, penetration testing, and cybersecurity during disruptions and crisis events while ensuring recovery of the system following technical failures because of an outage or disaster.

4.3.12. Submit for Government approval the introduction of new technologies within

90 days of planned deployment. The Government’s approval process usually takes no longer than 90 days from submission.

4.3.13. Submit for Government Authority to Operate (ATO) certifications within six

(6) weeks of planned deployment. The Government’s approval process usually takes no longer than six (6) weeks from submission.

4.3.14. Provide the Government access to the software solution to perform random security audits and checks.

4.3.15. Conduct code and data migrations using automated configuration tools and provide data refreshes as necessary.

4.3.16. Install, maintain, and update server configuration settings and maintain server configuration documentation.

4.3.17. Technical diagnosis, usage, configuration, and installation support.

4.3.18. Identify the level of effort for each break-fix and enhancement and include a cost estimate and risks for large break-fix efforts. Once complete, submit all documentation to the Government for review and approval. The Contractor must conduct user acceptance testing for break-fixes that change business processes and performance testing to ensure changes did not negatively impact system performance.

4.3.19. Provide access to all current and relevant versions of associated user and installation documentation and manuals.

4.3.20. Adhere to Information Technology Change Control Board requirements for new software and hardware components.

4.3.21. Provide support for hardware malfunctions and hardware lifecycle management.

4.4. TASK 4: General Performance Requirements.

4.4.1. During the performance, Contractors may encounter classified information. In all cases, Contractor personnel must handle classified materials according to Government regulations. As needed, Contractors working under contract will support removal/disposal of classified materials according to the Government identified Security Office procedures.

4.4.2. All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties must identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials.

4.5. TASK 5 Program Management. Program management includes administration, change management, transition in and out services, project management, status reporting, progress tracking, corrective action planning and implementation, conflict resolution, invoice management, quality assurance, configuration management, financial management, resource management and staffing appropriate Contractor expertise with minimal gaps in service.

The Contractor Must:

4.5.1. Deliver a Monthly Progress Report (MPR) that provides the Government with reasonable assurance that the Contractor is using efficient methods and effective cost controls in executing each task. The Contractor shall propose a format for Government approval that includes, at a minimum, the following: 1) identification of contract information (i.e., award date, period of performance, award value, and anticipated completion date); 2) status of the contract; 3) discussion of activities that map back to the tasks and deliverables identified in the contract including a summary of briefings, meetings, or visits and accomplishments during the reporting period; 4) milestones achieved; 5) anticipated activity for the next reporting period; 6) problems encountered or anticipated; and 7) a forecast of the probability of completing the SOW within the required schedule.

4.5.2. Deliver a Monthly Financial Report (MFR) that provides the Government with contract financial data. The MFR must be in two (2) parts as follows. MFR Part 1, Invoicing, must include 1) fixed contract information, i.e. award date, period of performance, award value, and anticipated completion date; 2) invoiced costs for period the Contractor is submitting, amount invoiced to date, amount remaining, and % remaining by Contract Line Item Number (CLIN); 3) documentation that accounts for and justifies all travel costs for that period, including explanation of the charges (Contractor shall provide detailed back-up documentation for all travel costs at the COR’s request as part of its invoice submission). MFR Part 2, Staffing Execution Report (SER), shall 1) give the number of hours and dollars expended by CLIN by labor category by Contractor employee for that period and cumulatively, 2) compare actual execution with the Contractor’s baseline Staffing Plan submitted as part of the proposal, and 3) identify and describe causes for over/under-execution and discuss corrective actions.

4.5.3. Include earned value management (EVM) reporting in the MFR according to federal National Defense Industrial Association Integrated Program Management Division Earned Value Management Systems EIA-748-D (8/28/2018) Intent Guide (https://www.ndia.org/-

/media/sites/ndia/divisions/ipmd/division-guides-and-resources/ndia_ipmd_intent_guide_ver_d_aug282018.ashx), as applicable.

4.5.4. Provide a draft Program Management Plan (PMP) with the Offeror’s proposal.

Submit a final PMP for Government approval within thirty (30) days of contract award. Upon Government approval, implement the PMP. The PMP will be a living document and require regular updates. The plan must provide a detailed overall plan-of-action for the management of all activities under this contract; serve as the basis for Program Management Reviews (PMRs); and provide a status for all contract activities. At a minimum, The PMP must include:

• Project Scope

• Tasks

• Task and Dependencies

• Schedule

• Milestones

• Key Personnel

• Allocated Resources

• Dependences and interrelationships with other applicable projects and programs

• Communications

4.5.5. Plan and facilitate a quarterly PMR to communicate the program’s status to stakeholders and team members regarding cost, schedule, and performance. The review will evaluate and discuss program status, issues, risks, resources, funding, schedule, deliverables, and any corrective action that needs to be taken. During the PMR, the Contractor must review Agile Development Artifacts and Reports as necessary with the Government.

4.5.6. Provide a draft Integrated Master Schedule (IMS) along with the draft PMP with the Offeror’s proposal. Submit a final IMS with the final PMP within 30 days of contract award. Provide current IMS’ along with future PMP submissions. The IMS must include all major milestones, critical path activities, responsible organizations and individuals, task dependencies, and deliverables as they relate to this work. The IMS must include a current Work Breakdown Structure (WBS) that details the product and service’s requirements into discrete tasks and work packages.

4.5.7. Develop and maintain a Quality Control Plan (QCP) within thirty (30) days of contract award leading to an effective quality control program to ensure work is performed according to this SOW. The Contractor must develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

The Contractor’s quality control program will assist them in assuring that work complies with the contract’s requirements. The Contracting Officer (CO) must provide the Contractor with a written notification upon acceptance of the original QC plan and any revised iterations. Following the Government’s acceptance, the Contractor must provide their QCP to the Contracting Officer Representative (COR) upon request.

4.5.8. Assist or address accurate and timely responses to individual taskers.

4.6. TASK 6 Transition Strategy.

4.6.1. Develop and execute a successful transition for operations including a COTS solution, business processes, and compatible with existing internal and external interfaces without impacting current operations.

4.6.2. Provide a detailed draft Transition-In Plan (TIP) with the Contractor’s proposal and final within thirty (30) days after contract award that leverages relevant experience from successful transitions in other agencies and organizations and assists reducing start-up risk and supporting a smooth transition to 100% operation. At a minimum, the transition-in plan must include: integrated schedules including key milestones, status reporting, formal change control process, requirements definition, configuration, system interface planning, data migration, testing, user training, change management strategies, roll-out approach, establishment of system administration functions, and support of 3Authority to Operate (ATO) activities. Transition-in efforts must ensure no gaps in current operations or ability for end-users to perform their daily operations.

4.6.3. Develop and deliver a Transition-Out Plan (TOP) within ninety (90) days of contract closeout or within thirty (30) days of the Government’s request that will assist the Contractor’s successor in assuming responsibilities. The purpose of the TOP is to facilitate knowledge transfer to the successor, describe incumbent work products and identify their work product’s locations, describe incumbent Work-In-Progress and recurring activities for which responsibility will transfer to successor, and to document incumbent Contractor performance for the COR’s files. Transition-out efforts must ensure no gaps in current operations or ability for end-users to perform their daily operations. Assist the government with preparing knowledge transfer materials (such as technical demonstrations) and participate in activities regarding the identification and/or transfer of key policies, procedures, requirements, and technical systems to ensure a smooth transition.

4.7. TASK 7 Integration.

4.7.1. Ensure the proposed, designed/configured, implemented, tested, and deployed solution includes secured interfaces with current internal and external, systems, platforms, and databases.

4.7.2. Implement encryption, authentication, and access controls for all data exchanges to ensure data protection.

4.7.3. Incorporate logging and monitoring mechanisms to track usage, detect issues and support issue resolution.

4.7.4. Meet Federal security standards and guidance for all interfaces, utilize standard interface protocols, define performance standards, document interface requirements for all systems requiring integration, including data types, formats, and security needs.

4.7.5. Implement validation and reconciliation procedures to verify data accuracy and completeness in all system exchanges.

4.7.6. Automate data exchange and transfer processes to improve efficiency and reduce manual intervention.

4.7.7. Must allow for open integration with future third-party systems.

4.8. TASK 8 Change Management (CM). The Contractor must:

4.8.1. Inform end-users of topics such as organizational or system changes, upcoming events, available resources, and changes to the user interface and business processes.

4.9. TASK 9 Training and Certification Program.

4.9.1. Develop and implement a transition and sustainment training program for end-users. The plan, at a minimum, must include the type of training, mode, curriculum, and frequency for all instructor-led and online training activities and materials.

4.9.2. Provide and maintain “How-To” Instructional Documents and Learning

Materials within ninety (90) days of deployment and within sixty (60) days of new features or iterative deployments to support end-users and external entities.

4.9.3. Develop and deliver multi-modal training such as 1) self-paced online training,

2) instructor-led virtual training, and 3) instructor-led in-person training.

Training may include non-formal modes of content delivery such as short video tutorials, webinars, and walk-through automations demonstrating key functionality.

4.9.4. Provide a specialized training and certification program for the solution to include annual virtual instructor led training for at least eight (8) sessions with up to 14 IRS attendees.

4.9.5. Provide unlimited On-Demand Computer Based Training for end-users.

4.9.6. Deliver end-user training for deployment, changes, and updates in addition to coordinating all necessary shipments and pre-deployment calls.

4.9.7. Provide access to a comprehensive specialized training and certification program for the solution.

5.0 ASSUMPTIONS & CONSTRAINT

5.1. Industry should account for the following existing infrastructure limitations and capabilities:

5.1.1. 10+ physical locations, minimal latency of up to 150 milliseconds (ms) round-trip time (rtt) from central data center locations or 250ms rtt from cloud service providers; Wide Area Network (WAN) Maximum Transmission Unit (MTU) not to exceed 1460 bytes.

5.1.2. Approximately 1000 virtual machines are supported by warm-site replication and automatic disaster recovery and shall be accounted for by replacement offering.

5.1.3. Approximately 40% Windows-based, 55% Linux-based, 5% vendor appliance and/or containerized applications.

5.1.4. Existing container environment is OpenShift based, proposed solution must support native container hosting and management; as well as OpenShift based containerization.

5.1.5. Traditional storage presentation from highly available appliances, providing

NFS, iSCSI, or NVMe/TCP storage presentation.

5.1.6. IPv4 and IPv6 Traditional Network Presentation of layer 2/3 services, routing functions are not extended to virtualization infrastructure. Uplinks are typically trunked, without bonding to highly available switches using 10/25/40 gigabit ethernet (gbe).

5.1.7. Hypervisor/Operating System (OS) storage utilizes M.2, or Redundant Array of

Independent Disks (RAID) drives.

5.1.8. The current campus sites utilizing hyperconverged infrastructure are primarily Dell VxRail or VMware vSAN locations.

5.1.9. All hosts are currently supported by existing VMware by Broadcom Hardware

Compatibility Guide.

5.1.10. All hosts, guests and management infrastructure are configured to FISMA High, with the minority configured to PCI DSS and/or IL5.

5.1.11. Solution must support Two-Factor Authentication globally, using principal of least privilege, using IRS active directory or Azure Entra AD credentials.

5.2. Facility Security Clearance (FCL) at the SECRET level is required for contract performance.

https://www.state.gov/facility-security-clearances-faq/#Definitions

5.3. COTS software shall be FedRAMP Moderate certified at the time of proposal submission and meet any additional IRS cyber security requirements.

5.4. The final implemented solution shall have the capability and capacity to scale, without disruption or degradation in performance.

5.5. Final implementation shall have the capability to leverage the Department’s identity management solution for single sign-on to credentialed users.

5.6. The COTS software shall have the functionality to comply with Federal Government records management and retention according to Records Management by Federal Agencies (44 U.S.C. Chapter 31) | National Archives most recent.

5.7. Ensure that developmental approaches for configuring and implementing the solution result in an open design structure which does not preclude the potential to efficiently introduce new capability enhancements in future years.

5.8. Ensure compliance with USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program or most recent.

5.9. Digital Accountability and Transparency Act of 2014 PUBL101.PS

5.10. ANSI 748-A NDIA IPMD EIA-748 EVMS Intent Guide

5.11. OMB Circular A-11Part 7 CIRCULAR NO. A–11 PART 7: PLANNING, BUDGETING, ACQUISITION, AND MANAGEMENT OF CAPITAL ASSETS

6.0 KEY PERSONNEL

The Contractor must assign the proposed key personnel whose resumes are in their final proposal to this requirement. The Contractor must refer to Code of Federal Regulations (CFR) 2052.215-70 Key Personnel / Nuclear Regulatory Commission Acquisition Regulation (NRCAR) 2052.215-70 and the final contract for guidance regarding key personnel following contract award

Any proposed substitutes for the key personnel must meet or exceed the position requirements in the awarded contract for the applicable position. According to the CFR, the Contractor must notify the CO immediately regarding their intent to change Key Personnel positions. The Contractor must provide all communication regarding Key Personnel changes in writing. All replacement Key Personnel must have the requisite security clearances prior to beginning work. Upon CO and COR approval, the Contractor may provide an interim substitute Key Personnel whose resume meets or exceeds the position requirements and has an active requisite security clearance (as applicable) while the suitable replacement finalizes the security clearance process.

6.1. Program Manager, at a minimum, must have:

6.1.1. A Bachelor of Science (BS) or Bachelor of Arts (BA) from an accredited school and fifteen (15) years in management experience including three (3) years of https://www.archives.gov/about/laws/fed-agencies.html#records https://www.archives.gov/about/laws/fed-agencies.html#records https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.500-267Br1.pdf https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.500-267Br1.pdf https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.500-281Ar1.pdf https://www.congress.gov/113/plaws/publ101/PLAW-113publ101.pdf https://www.ndia.org/-/media/sites/ndia/divisions/ipmd/division-guides-and-resources/ndia_ipmd_intent_guide_ver_d_aug282018.ashx https://georgewbush-whitehouse.archives.gov/omb/circulars/a11/2002/part7.pdf https://georgewbush-whitehouse.archives.gov/omb/circulars/a11/2002/part7.pdf direct support to the US Government OR a relevant master’s degree in IT, computer science, or engineering and ten (10)+ years in management experience including three (3) years of direct support to the US Government.

6.1.2. Current public trust, or higher, clearance at contract award. Program Management support is expected to be in the range of 160 hours per period.

6.1.3. Experience communication effectively, both oral and written, with technical.

Non-technical, and executive-level customers.

6.1.4. Understanding and experience with Agile principles, processes, and methodologies.

6.1.5. Prior experience providing Program Management for a similar size and scope or similar size and IT project.

It is highly desirable for the Program Manager to have:

6.1.6. At least one (1) of the following project management certifications: Project

Management certification from the Project Management Institute (PMI) Project Management Professional (PMP), Defense Acquisition Workforce Improvement Act (DAWIA) Program and Project Managers (P/PM) certification Level III, or Federal Acquisition Certification (FAC) – P/PM certification Level II.

7.0 OTHER PERSONNEL

The Government expects the following skill sets will be needed to perform installation, integration, health checks, architecture reviews, and other types of specialized IT assistance.

7.1. Systems Architect, at a minimum, must have:

7.1.1. A BS or BA from an accredited school in IT, Computer Science, or Engineering and ten (10) years in management experience including two (2) years of direct support to the US Government OR a relevant master’s degree in IT, computer science, or engineering and seven (7) + years in management experience including two (2) years of direct support to the US Government.

7.1.2. Current public trust, or higher, clearance at contract award. System Architect support is expected to be in the range of 160 hours per period.

7.1.3. Seven (7) years of experience with virtualization technologies and be a virtualization certified professional.

7.1.4. Two (2) years of experience with the COTS product proposed in Contractor’s technical approach.

7.1.5. Understanding of and experience with Agile principles, processes, and methodologies.

The Contractor shall propose additional qualifications for this position, as needed.

7.2. Developer/Engineer, at a minimum, must have:

7.2.1. A BS or BA from an accredited school in IT, Computer Science, or Engineering and ten (10) years of experience in a relevant field OR a relevant master’s degree in IT, computer science, or engineering and seven (7) + years of experience in a relevant field OR no degree and 15 + years of experience in a relevant field.

7.2.2. Current public trust, or higher, clearance at contract award.

Developer/Engineer support is expected to be in the range of 160 hours per period2.

7.2.3. Seven (7) years of experience with virtualization technologies and be a virtualization certified professional.

The Contractor shall propose additional qualifications for this position, as needed.

8.0 PERIOD OF PERFORMANCE

The period of performance (PoP) for this task order shall be for one (1) 12-month Base period and four (4) 12-month Option periods. All support Contractors must be at the place of performance by the end of the transition period. The period of performance will be:

Base Period: Date of Award + 12 months Option Period I: 12 months after Base Period Option Period II: 12 months after Option Period I Option Period III: 12 months after Option Period II Option Period IV: 12 months after Option Period III

9.0 HOURS OF OPERATIONS/PLACE OF PERFORMANCE/HOLIDAYS

9.1. Place of Performance

Most of the work associated with this contract will be performed in Government facilities at (TBD) and in other facilities within the metropolitan Washington, DC area.

The COR will approve Contractor support provided at non-Govt locations (i.e., contractor locations). The COR will authorize Contractor Telework/Remote Work prior to the Contractor initiating Telework/Remote Work arrangements. For the purposes of this SOW, “telework” and “remote work” refer to a work flexibility arrangement by which a Contractor employee supports the requirements of this contract from an alternative worksite. An “alternative worksite” means a Contractor-approved worksite other than the location from which the Contractor employee would normally work. The Contractor is responsible for ensuring the safety and security of the alternate worksite.

Regardless of the work location, all contract terms and conditions, including security requirements and labor laws, remain in effect. The Government must not incur any additional cost or provide additional equipment for contract performance because of the Contractor’s election to work from an alternative worksite.

9.2. Standard Work Hours

The normal duty core hours are 0900 to 1500 hours, excluding 24x7x365 product support, with a one-hour lunch period Monday through Friday except Federal holidays (see below for Federal holidays) or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Contractor personnel are expected to conform to normal operating hours of 0800 to 1700 Easter Standard Time (EST) Monday through Friday. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this SOW when the Government facility is not closed for the above reasons.

- New Year’s Day - Labor Day

- Martin Luther King Jr. Day - Columbus Day

- Washington’s Birthday - Veterans Day

- Memorial Day - Thanksgiving Day

- Juneteenth National Independence Day - Christmas Day

- Independence Day

10.0 TRAVEL

Contractor will comply with FAR 31.205-46, “Travel Costs” for any travel the Government requires during the performance of this contract such as attend meetings, conferences, and training. The COR will review and approve any Contractor Travel and authorize travel expenses consistent with the substantive provisions of the FAR; other applicable Federal travel regulations; and the limitation of funds specified in this contract. Pursuant to the availability of funding, the Government expects that travel will not exceed $5,000.00 for the base period and $5,000.00 each option period. The Contractor shall provide the COR with a written request for travel prior to finalizing any travel arrangements. The COR must approve all travel prior to purchase of tickets and commencement of travel. If the Contractor does not receive written COR approval for out-of-town travel in advance of the booking and travel, the Government official inspecting and accepting vendor invoices will deny the Contractor’s request for reimbursement.

The Government will not reimburse the Contractor for travel to and from the normal place of duty. Requests for approval of costs more than maximum per diem rates according to the procedures contained in FAR 31.205-46(a)(3) must be submitted to the CO for final approval prior to commencing travel.

11.0 Other Direct Costs (ODCs)

This category includes materials, venues, and shipping expenses associated with activities such as training and visits to Government locations (other than duty station) or Contractor facilities.

ODCs could include software or membership licenses, equipment, IT hardware, renting of suitable meeting spaces or training venues.

12.0 FACILITIES AND ACCESS

Contractor personnel will work primarily on-site within Government facilities at (TBD) and in other facilities in the metropolitan Washington, DC area. For requirements where Contractor personnel work in Contractor facilities, the Contractor shall furnish the necessary workspace for the Contractor staff to provide the support outlined in this SOW to include desk space, telephones, computer equipment, network access and other items necessary to perform in a normal office environment. Contractor will ensure that Contractor employees requiring routine access to Government facilities during their performance in-process and out-process through the applicable (TBD) Security Office in Room (TBD) (e-mail address is: [TBD]). Contractor personnel working under this SOW may be issued a Personal Information Card (PIV) for access to the (TBD), allowing unescorted access. Contractor personnel shall complete the appropriate security paperwork and comply with associated policies. It is imperative that all Contractor personnel understand that Government-issued badges that allow unescorted access to Government buildings remain Government property and that they must be returned to the office that issued the badge immediately upon the decision, or notification, that he/she is no longer working under this SOW. All PIV cards must be returned to the (TBD) Office in Room (TBD).

Prior to assigning Contractor employees, under this SOW, that require access to Government facilities to this work, the Contractor’s Facility Security Officer (FSO) must submit Personnel Security Clearance (PCL) validation through use of a Visit Authorization Request (VAR) for each employee, to the (TBD) Security Office in Rm. (TBD), according to Bureau of Diplomatic Security Instructions and DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM).

13.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT

The Government will furnish the necessary workspace for the on-site Contractor staff to provide support at Government locations outlined in this SOW to include desk space, desk telephones, computer equipment, networks, and other items necessary to perform normal office functions.

Upon COR approval, the Government will provide mobile communications devices such as laptops and smartphones. The Government will not reimburse Contractors for purchase of mobile communications devices under this SOW.

14.0 DATA RIGHTS

The Government retains unlimited rights to all deliverables, analyses, reports, documentation, briefings, etc., in whatever medium or format, developed and conducted under this contract.

15.0 PROPRIETARY DATA NON-DISCLOSURE REQUIREMENTS

The Contractor must not use, disclose, or reproduce proprietary data, other than as required in the performance of this contract. These limitations do not apply to data or information that the Government has made public.

16.0 SAFETY ISSUES

The work described herein is primarily sedentary, performed in an office setting. Some walking will be required throughout the workplace facilities and at work sites. The work environment involves everyday risks or discomforts that require normal safety precautions typical of such places as conference rooms or office spaces. The Government will not reimburse the Contractor for Safety Equipment unless otherwise approved by the CO.

17.0 ORGANIZATIONAL CONFLICT OF INTEREST (OCI)

The Contractor warrants that, to the best of its knowledge and belief and except as otherwise disclosed, they do not have any organizational conflict of interest, which is defined as a situation in which the nature of work under a Government contract and a Contractor's organizational, financial, contractual or other interests are such that: award of the contract may result in an unfair competitive advantage; or the Contractor's objectivity in performing the contract work may be impaired. The Contractor must advise the CO whether it considers that an actual or potential OCI exists for this contract.

18.0 SECURITY

Performance of this contract must adhere to the corresponding DD Form 254, Department of Defense Contract Security Classification Specification and FAR 52.204-2 "SECURITY

REQUIREMENTS."

18.1. Personnel Security Requirements

Work under this contract requires Secret clearance for the Contractor’s Program Manager. All other Contractor personnel performing under this contract must have an appropriate clearance level, for example, existing Secret clearance and/or a MRPT determination.

18.2. Operational Security (OPSEC)

OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments, then helps personnel apply protective measures to mitigate unacceptable risk. The Contractor must agree to comply with the same basic OPSEC rules, requirements, and standards as Government personnel. When Contractor personnel are working primarily in Government facilities, the Government will provide instructions for OPSEC Awareness Education and Training through appropriate Government security channels and the Contractor must apply OPSEC protective measures (countermeasures) according to Government direction.

When Contractor personnel are working primarily in Contractor facilities, OPSEC Awareness Education and Training will be provided by the Contractor or through web-based Government learning sites. All Contractor support personnel are required to receive OPSEC Awareness Education and Duty-Related Training. The Contractor must comply with Bureau of Diplomatic Security Instructions and DoD Customers Operations Security Program, specifically DoDD 5205.02, “DoD Operations Security (OPSEC) Program” March 6, 2006, or current version.

18.3. Access to Government Data and Information

Contractor personnel may encounter or have access to classified material and/or have access to areas requiring security clearances during the performance of this contract.

Each Contractor employee requiring such access must have an individual security clearance commensurate with the required level of access prior to accessing materials or spaces. Contractor personnel must maintain their individual clearances for the duration of employment under this contract, or until access requirements change.

The Government may require Contractor personnel, performing under this contract, to access Government proprietary data and information. Additionally, Contractor personnel may have access to information of such a nature that its dissemination or use, other than in the performance of this contract, would be harmful to the U.S. Government. The Contractor shall not divulge or release data or information the Government provides or resulting from the implementation of this contract except to authorized Government personnel or upon written approval of the CO or COR.

The Contractor must not use, disclose, or reproduce proprietary data, other than as necessary in the performance of this contract and adhere to the Privacy Act of 1974 (5 U.S.C. 552a) and the Freedom of Information Act (5 U.S.C. 552, as amended). The limitations above do not apply to data or information that the Government releases to the public. The Contractor may require access to nonpublic information such as Planning, Programming, Budgeting and Execution (PPBE) data during this contract. If the Contractor requires access to PPBE information while performing duties under this contract, the Contractor must agree that each of its employees and others performing work with access to this information must sign a Non-Disclosure Agreement provided by the Government. The Government considers all products produced and their associated work papers resulting from the contract to be considered Government property.

Any materials received or generated in the performance of this contract must be safeguarded and disposed of according to the National Industrial Security Program Operating Manual (DOD 5220.22-M)

19.0 QUALITY ASSURANCE

The Government will evaluate the Contractor’s performance under this contract according to the Quality Assurance Surveillance Plan (QASP). The QASP outlines the Government’s plan to ensure the Contractor is performing or has performed according to the contract’s performance standards. It defines the contract’s performance standards and how the Government will apply them, the frequency of surveillance, and the minimum acceptable defect rate(s).

20.0 GOVERNMENT CONTRACTING OFFICER’S REPRESENTATIVE

The Government will identify the COR at contract award. This designation shall remain in effect throughout the period of performance (PoP), unless the CO identifies a replacement COR. In the absence of a COR, all COR duties revert to the CO. Additionally, the CO may designate, at any time, a Government Technical Monitor (GTM) to assist the COR in performing technical oversight and surveillance functions during the contract’s performance.

The COR and GTM (if applicable) will provide the Contractor with technical direction or interpretations that are in scope as it relates to the contract requirements, terms, and conditions. If the Contractor believes that the COR or GTM (if applicable) technical direction is outside the contract’s existing scope or would constitute a change to the scope, the Contractor must not act and must notify the CO immediately stating the technical direction and Contractor’s position and rationale. Furthermore, if the software solution requires improvements and other impacting factors that are outside the existing scope, the Contractor must notify the CO immediately stating the technical direction and Contractor’s position and rationale.

The COR and GTM are not authorized to change the contract’s scope of work as stated in the awarded contract or obligate the Government in any way that may impact the contract’s current cost, schedule, and performance. The CO is the only agent for the Government who has the authority to obligate the Government or change the contract terms and conditions. The CO will provide written authorization for any contract revision or obligation. Any monies incurred beyond the dollar amount specified in this contract or its modifications may not be paid and would not be subject to interest payments under the Prompt Payment Act.

20.1. The COR or GTM (if applicable) are responsible for:

20.1.1. General instructions on deliverables including limitations and deadlines.

20.1.2. The overall administration of the contract’s compliance including deliverable inspection and acceptance.

20.1.3. Monitoring the Contractor’s technical progress according to established schedules and the contract terms, conditions, specifications, and quality provisions.

20.1.4. Advising the Contractor on technical matters within the contract’s scope and ensuring the Contractor is notified of potential or actual…