IVS CS SVC SOO_DRAFT06242024.docx

UNIFIED PLATFORM COMPUTE AND STORE SERVICES

STATEMENT OF OBJECTIVES

June 27, 2024

1.0 INTRODUCTION

1.1. UNIFIED PLATFORM PROGRAM OVERVIEW

1.1.1. The Air Force Life Cycle Management Center, Unified Platform (UP) program office (AFLCMC/HNCP), is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the Department of Defense (DoD). UP provides USCYBERCOM Operational Forces a Joint cyber operations infrastructure enabling full- spectrum cyberspace operations at the operational through tactical levels of warfare as part of USCYBERCOM’s Joint Cyber Warfighting Architecture (JCWA). That infrastructure is a set of foundational capabilities that enable synchronization, integration, and interoperability for JCWA components as illustrated in Figure 1, below.

Figure 1 JCWA CONOPS – 4 Layer Model

1.2. UP VALUE STREAMS

1.2.1. UP delivers a tightly integrated suite of capabilities to enable seamlessly integrated, adaptable, and evolving warfighting capabilities comprised of multiple JCWA components and organized around three value streams: IT Infrastructure, Data, and Common Services. Figure 2 below captures the relationships between different teams and the flow of “value” to the user community.

1.2.2. IT Infrastructure includes compute and storage resources, data/message transport, and software development environment that enable rapid development and integration of applications, analytics, visualizations, and capabilities at speed and scale.

1.2.3. The Data platform and associated standards is the integrated set of technologies, standards, and processes to ingest, store, share, enrich, manage, and analyze authoritative data sources in support of offensive and defense operations with intelligence and mission partners (to include private sector).

1.2.4. Common Services include capabilities such as identity management, common access, collaboration, modeling, and communication capabilities that support integration, interoperability, and inter-program synchronization.

Enabling Teams

Figure 2:

UP Organization and Value Streams – Functional View

1.3. PURPOSE/VISION

1.3.1. UP requires support from a cohesive team of qualified professionals utilizing the Unified Platform Agile Framework (UPAF), (which is a best of breed collection of agile processes that draws from Scrum, Scaled Agile Framework (SAFe), and Kanban) to fulfill the evolving goals of a dynamic value stream. The team will work on a fixed schedule and share the vision, product backlog, and capability roadmap defined by the UPAF. To successfully accomplish tasks, contractors should be able to provide in-depth knowledge and expertise in all areas of requirement elicitation, application design, documentation, implementation, maintenance, and management of compute and store resources to ensure that requirements are met, and products comply with the IT enterprise architecture and business needs.

1.3.2. The UP Infrastructure Value Stream (IVS), as shown in Figure 3, is made up of three Product Lines (Pipeline Services, DevSecOps (DSO) Platform and Compute & Storage) and provides reliable and secure technology platforms that can be used in a self-service fashion by customers. The platforms host UP and customer common services applications that utilize data from UP Data Value Stream components.

1.3.3. The UP IVS will provide support to UP customers who want to develop software via Continuous Integration/Continuous Delivery (CI/CD) pipelines, deploy applications to UP hosted platforms and/or who wish to utilize UP cloud resources.

Figure 3:

IVS Compute and Store Product Line within the IVS

1.4. OBJECTIVE

1.4.1. Overview: This effort will provide development and engineering services for the administration, resource management, orchestration, and abstracting cloud-vendor and on-prem IT assets to support and maintain Compute and Store resources within the Infrastructure Value Stream.

1.4.2. The IT Infrastructure Compute & Store Product Line Objective: To Develop, Automate, and Integrate compute and storage resources for UP. The concept is to provide a team aligned to the IVS Compute and Store Product Line (highlighted in Figure 3), consisting of qualified professionals to ensure that UP manages IT infrastructure in a coordinated and consistent manner.

1.4.3. This team will be responsible for providing the capabilities to automate the provisioning and management of IT compute and storage. Interactions with other teams and systems are expected; many features, products and other resources required by this effort are external to the Platform Compute and Store Product Line.

2.0 PERFORMANCE REQUIREMENTS

2.1. COMPUTE AND STORE: MISSION & FUNCTIONS

2.1.1. The IVS Compute and Store Services team shall have skillsets in X-as-code, DevOps, DevSecOps, GitOps, and in the use and development of GitLab CI runners to enable orchestration, and automation.

2.1.2. The contractor shall engineer, build, and test a system using Infrastructure as Code (IaC) and GitOps to govern, maintain, provision, and operate all compute and storage resources for UP, including Commercial AWS, AWS GovCloud, UP GovCloud, C2S, M2O, DAF Cloudworks, USCC Command Cloud, Cloud One, etc. Additionally, the contractor shall engineer, build, and test IaC for physical hardware that is maintained on premises. This also includes assisting the development of new applications by aiding development teams while they onboard the JCWA DevSecOps Platform (JDSOP) and UP infrastructure.

2.1.3. The contractor team shall have the expertise necessary to competently research, develop, select, recommend, and incorporate advanced commercial technologies, state-of-the-art cybersecurity concepts, and automation processes into the IVS Compute and Store Product Line as described in Table 1.

2.1.4. The contractor team shall assist government personnel in performing evaluations and tradeoff analyses between the technologies available in the marketplace, to include licensed and/or open-source software, as well as whether to build new capabilities within government systems. Documentation, ease of use and developer experience are important considerations in the development of these processes.

· Set up enforcement of proper policies & procedures needed for each VPC/user in UP and USCC cloud accounts.

· Establish cost reporting per user/team/project/application and alert the corresponding teams and their leadership when a team approaches/exceeds defined limits. Allow personnel with a need-to-know access to live cost reporting.

· Create and maintain a self-service portal that will allow users to create their needed cloud resources and be monitored and constrained by a defined budget.

· Create a process/procedure to enable an approval chain from the portal to grant the ability to utilize cloud resources and assign/approve budget for spend.

· Engineer, build and test, automation that will orchestrate data and software artifact transfers via AWS Diode / CDS

· Manage Engineer, build and test, automation that will orchestrate data and software artifact transfers between computer and store environments (e.g. UPMS to CASPIAN).

· Each team will own the lifecycle of their application, from inception to retirement.

· All PL teams should focus on the DevOps aspect of the tools they are responsible for.

· Teams will Collaborate with the Operations Center help desk/onboarding teams when tier three support is needed.

Table 1:

The Mission & Functions of the IVS Compute and Store Product Line

2.2 TEAM INTERACTIONS

2.2.1 Overview: The IVS Compute and Store Services Team is expected to partner with other teams within the Branch to accomplish their objectives, mission, and functions. For detailed information about interactions and dependencies of these teams, see Appendix A.

2.2.2 Infrastructure Value Stream. The UP Infrastructure Value Stream is made up of three Product Lines: Pipeline Services, DSO Platform, and Compute and Store services. An Enabling Team, Developer Experience (DevX) also supports the product line. These teams all work together. The IVS Compute and Store Services team is expected to work alongside the other Product Line teams and UP Enabling Teams to accomplish the objectives in Section 1.4 as well as the overall UP and JCWA mission.

2.2.3 Other Value Streams. Unified Platform is made up of three value streams of which the Infrastructure Value Stream is one. The other two are the Data VS and the Common Services VS. These value streams work together to accomplish the objectives in Section 1.4 as well as the overall UP and JCWA mission and are aligned with the bottom three layers of the JCWA Concept of Operations in Figure 1.

2.2.4 Branch Enabling Teams. Within the Unified Platform program, there are multiple Enabling Teams that provide services and guidance to platform and stream teams throughout the branch. The IVS Compute and Store Services team works alongside the UP Enabling Teams to accomplish the objectives in Section 1.4 as well as the overall UP and JCWA mission.

2.3 IVS PRODUCT LINE OUTCOMES/BACKLOG

2.3.1 The set of preliminary user stories set forth below are provided for context purposes and does not comprise the full scope or detail of the project. The Contractor will work closely with the Government leads to perform regular user research and usability testing to develop and prioritize a full gamut of user stories as the project progresses. Individual user stories may be modified, added, retracted, or reprioritized by the Government at any time, and the Government expects that the user stories will be continuously refined during the Program Increment (PI) process. The Contractor shall refer to the Government designated backlog source (e.g., JIRA) for updated user stories and prioritization.

2.3.2 AS IVS COMPUTE AND STORE SERVICES TEAM WE WANT TO:

· Automated Cloud Account Request Portal/App:

· Develop a web portal or application where users can submit account requests.

· Implement automation for processing requests, creating accounts, and configuring access upon approval.

· System Architecture Documentation:

· Collaborate with the BCE team to document the system architecture.

· All documentation should provide insights into the design, components, and interactions within the system and between other systems and dependencies through Model Based Systems Engineering (MBSE).

· MBSE Model Creation and Maintenance

· Orchestration of Compute and Storage Resources:

· Automate the provisioning and management of compute resources based on user needs.

· Implement self-service portals for both compute and storage provisioning.

· User Policies and Guides:

· Define user policies for the provisioned resources.

· Create user guides and informative materials for each service provided.

· Cybersecurity Best Practices:

· Integrate cybersecurity best practices into the design and implementation of the system.

· Ensure timely identification and remediation of security vulnerabilities.

· Ensure compliance with relevant security standards and regulations.

· Infrastructure as Code (IaC) and Environment Management:

· Curate and manage Infrastructure as Code (IaC) resources for deploying and managing environments.

· Apply user policies and cybersecurity best practices through IaC and Configuration as Code (CaC)

· Expand capabilities into new environments such as NIPR, SIPR, and TS.

· Cost Management and Optimization:

· Implement a cost/compute metrics reporting system to visualize and understand compute and store infrastructure costs and usage over time.

· Develop a system to monitor infrastructure for unused or underused systems to optimize compute resources.

· Template Creation for Cloud Environments:

· Create templates outlining various cloud environments and the services provided within each (Terraform, Cloud formation or similar Tools).

This will streamline the provisioning process and ensure consistency across environments.

3.0 PERSONNEL REQUIREMENTS

3.1 STAFFING PLAN AND ONBOARDING SCHEDULE

3.1.1 The Contractor shall design and assemble of a team of full-time equivalents to support the Compute and Store Product Line (including all proposed labor categories (LCAT) and level of effort). The Contractor’s team, with the inclusion and leadership of the Contractor’s Key Personnel Positions (KPP) (Section 3.3), shall be capable of executing backlog user stories listed in Sections 2.3 and have the expertise to perform actions associated with the mission, functions, scope, and customer interaction defined in Section 2.1. To accomplish the Purpose/Vision and Objectives described in Section 1, the Government projects that the Contractor Team will require 6 FTE, including KPPs.

3.1.2 The contractor shall provide a stable, competent workforce and make every effort to ensure continuity and accomplishment of contract goals. Rotating personnel shall be minimized to the extent possible to avoid service interruption or inefficiencies including service delivery gaps, performance reductions or employee non-availability. Key personnel are expected to be retained for the entirety of the contract. Retention of personnel, including KPPs will be measured for the base period of the contract, subsequent options, and total contract average (measured by determining the mean value for all awarded performance periods) and will be a factor in the contractor performance assessment report. The contractor is responsible for adverse performance due to turnover, including awaiting new Common Access Cards (CAC) and access to Government systems.

3.1.3

3.1.4 Of the proposed team members, 60% must start within the twenty-one calendar days following contract award. KPPs are counted as part of the 60% and are required to begin work on the day the contract begins. The remaining 40% of the team members shall start no later than 30 days after contract award.

3.1.5 The Contractor shall provide the Government notification within 14 calendar days of any personnel’s intent on leaving the effort and backfill their positions within 21 calendar days from vacancy, or as agreed upon by the Contracting Officer. Delays in onboarding backfilled personnel, to include 8570/8140 certificates, cybersecurity awareness training, required security clearances, and/or Common Access Card issuance, will inform contractor performance metrics. The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this contract and shall be responsible and accountable for subcontractor performance and deliverables.

3.1.6 All Contractor personnel shall work alongside Government and other contracted personnel. When directed by the Government, Contractor personnel shall divide and/or be redeployed across multiple mixed teams, including Government and other contracted personnel, to pursue priorities as directed by the Government.

3.1.7 Product Owner, Scrum Master, and Data Scientist are all roles to be staffed and/or provided by the Government and made available to support Contractor personnel in executing Government priorities and requirements. Product Support functions are also considered separate from this requirement.

3.1.8 The Contractor shall author and deliver a staffing plan within 15 working days of contract start which details the acquisition and assembly of a team of full-time equivalents to support the Compute and Store Product Line including all proposed labor categories (LCAT) and level of effort) as seen in CDRL 0005.

3.2 TEAM PERSONAS

3.2.1 The goal of providing Team Personas is not to require a specific LCAT or number of LCATs, but to better illustrate the roles that the Government has identified as being related to supporting the mission requirements of the Compute and Store Product Line. The Contractor shall design and staff a team capable of executing all types of backlog user stories associated with the team which they propose, listed in Sections 2.3, and have the expertise to perform all actions associated with the mission, functions, scope, and customer interaction defined in Section 2.1.

IVS Compute and Store Services Team (6 FTEs)

Cloud Architect Subject Matter Expert (SME)

(KPP)

See Section 3.3 Works in cooperation with the IVS Compute and Store Product Line Manager and the UP-Infrastructure Lead Engineer to develop an overall architecture and implementation plan for orchestration, automation, and management of cloud objects, resources, and accounts in compliance with the DoD CIO DevSecOps Reference Design and the UP cATO.

Cloud/Software Engineering SME

(KPP)

See Section 3.3 Works with the IVS Compute and Store Product Line Manager, and Cloud Architect to ensure that the cloud infrastructure supports the needs of software developers, adheres to DoD IA standards, and the DoD CIO DevSecOps Reference Design to support the rapid fielding of customers software to the DevSecOps Platform or to UP cloud assets when applicable through IaC, CaC and orchestration.

Administration Coordination and Documentation Specialist

Works with all team members to ensure that the processes created by the team are well documented and easily understood by software developers and in some cases, cyber operators. Creates documents, diagrams, and instructional resources to assist others in learning how to use resources and apply DevSecOps principles to their applications. Administers and coordinates self-service portal that will apportion cloud resources and monitors resources, constraints, and budgets.

Table 2:

Personas of the IVS Compute and Store Services Team

3.3 KEY PERSONNEL POSITIONS (KPPs)

3.3.1 The Contractor must provide KPPs as outlined in Table 2 and Table 3. Key personnel must remain assigned to the project for the duration of the contract, unless otherwise approved by the Contracting Officer/Representative (CO/COR). The Contractor shall provide the Government notification within at least thirty calendar days of any KPP’s intent to leave the effort and backfill their position within forty-five calendar days from time of vacancy or IAW the CO approved stop-gap plan. The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this contract and accountable for subcontractor performance and deliverables.

3.3.2 The Contractor shall notify the Contracting Officer, in writing, of the proposed substitutes and their qualifications. If a KPP must be replaced, the Contractor shall provide an overlap pairing period, of at least two (2) weeks, or as agreed upon by the CO/COR, between outbound and inbound Contractor personnel to ensure continuity and information transfer. Key personnel must be employed with the firm or a subcontractor’s firm at the time of award and shall be retained, to the maximum extent possible, throughout this program. Failure to meet minimum KPP staffing requirements could result in adverse contractor performance assessment report or termination for cause.

3+ years of experience with:

· Creating CI/CD pipelines with GitLab CI and GitLab Runners or equivalent technologies

· DevOps and Platform Engineering

· Automation of build tools for modern programming languages

· Automated Tests implemented via pipelines

· Package managers: Maven/Gradle/PyPi/npm

· Cybersecurity vulnerability scanning (SAST and DAST)

· Microservice Architectures

· NIST Risk Management Framework

General Knowledge of how to use the following technologies to further development of DevSecOps CI/CD pipelines:

· DoD DevSecOps Reference Architecture

· Git/GitLab

· ArgoCD

· Ansible

· Helm Charts

· SOPS

· SonarQube

· Fortify

· Twistlock, Trivy, or NeuVector

· Cosign/Sigstore/Attestations

· DoD PKI/PKE

Threshold Credentials

· B.S. in Computer Science or Engineering field and 7+ years of experience contributing on a technical team for a software or IT project.

OR

B.S. in Information Technology, IT Management, Computer Information Systems, and 10+ years of experience contributing on a technical team for a software or IT project.

· 3+ years providing technical guidance to more junior team members.

· 2+ years leading a technical team on a software or IT project with proven performance.

Threshold Clearance

· Active TS Clearance with SCI eligibility Threshold Certification

· DoD 8570/8140 IASAE Level II within 90 days of contract award.

Objective Credentials

· M.S. in Computer Science or Engineering field and 10+ years of experience contributing on a technical team.

OR

M.S. in IT, ITM, CIS and 15+ years of experience contributing to a technical team.

· 5+ years providing technical guidance to more junior team members.

· 4+ years leading a technical team on a software or IT project with proven performance.

Objective Certification

· DoD 8570/8140 IASAE Level II within 30 days of contract award.

3+ years of experience with:

· Kubernetes, Docker, and the Open Container Initiative

· Cloud Native Computing Foundation projects

· At least two of: Python, Java, C#, JavaScript, TypeScript, Ruby, or Go

· Continuous Delivery and Deployment Automation

· Unit testing, integration testing, and end-to-end testing

· Microservice Architectures

· Cloud Computing

· NIST Risk Management Framework

General Knowledge of how to use the following technologies to further develop containerized applications and delivery to a containerized platform.

· DoD DevSecOps Reference Architecture

· RKE2

· Git/GitLab/GitOps

· Kustomize

· ArgoCD

· Flux

· Ansible

· Helm

· Terraform

· Big Bang

· Version Control

· SOPS

Cybersecurity vulnerability scanning (SAST and DAST) Threshold Credentials

· B.S. in Computer Science or Engineering field and 5+ years of experience contributing on a technical team for a software or IT project.

OR

B.S. in Information Technology, IT Management, Computer Information Systems, and 7+ years of experience contributing on a technical team for a software or IT project.

Threshold Clearance

· Active TS Clearance with SCI eligibility Threshold Certification

· DoD 8570/8140 IAT Level II within 30 days of contract award.

· Certified Kubernetes Administrator or Kubernetes or Cloud Native Security Associate at contract award.

· Certified Kubernetes Security Specialist within 90 days of award.

Objective Credentials

· M.S. in Computer Science or Engineering field and 7+ years of experience contributing on a technical team.

OR

M.S. in IT, ITM, or CIS and 10+ years of experience contributing to a technical team.

Objective Certification

· DoD 8570/8140 IASAE Level II at contract award Certified Kubernetes Security Specialist at contract award.

Table 3:

IVS Compute and Store Services Requirements

3.4 PERSONNEL SECURITY CLEARANCES and SCIF ACCESS

3.4.1 The contractor shall ensure KPPs on the contract have an active TS/SCI security clearance and access to a Sensitive Compartmented Information (SCI) Facility (SCIF) and the Environments described in Section 4.1 within 2 weeks of contract Kickoff for daily use. The contractor shall ensure that a minimum of 50% the personnel have an active TS SCI security clearance and accessibility to a SCIF within 2 weeks of kickoff for daily use.

3.4.2 KPPs Top Secret clearance must be active at time of performance start unless explicitly approved in writing from the Government Contracting Officer. The other required number of FTEs must have Top Secret clearance and access to a SCIF within 90 days of contract start unless explicitly approved in writing by the Government Contracting Officer.

3.4.3 In the event of turnover, backfilled personnel must have the required clearance and access within 2 weeks of the start date.

3.5 PRIVELEGED USER REQUIREMENTS

3.5.1 Any personnel requiring environment access at a privileged level shall meet the requirements for DoD IT privileged users in accordance with DoDI 8140.01 Cyberspace Workforce Management, DoD 8570.01-M Information Assurance Workforce Improvement Program, AFI17-130 Cybersecurity Program Management and AFMAN17-1303 Air Force Cybersecurity Workforce Improvement Program.

3.5.2 Privileged Users should possess the appropriate and current national security investigation (e.g., Tier 3, 4, 5, etc.,) commensurate with assigned tasks.

3.5.3 Personnel in privileged user roles should also possess the requisite certifications to include a cybersecurity certification at the DoDI 8140 IAT Level II or higher (e.g., CompTIA Security+ or greater).

4.0 GENERAL REQUIREMENTS

4.1 ENVIRONMENT REQUIREMENTS

4.1.1 The Contractor shall ensure necessary access through Unified Platform to develop and deliver services to required environments. These include, but are not limited to, the following:

· Cluster UP (Kubernetes Platform)

· Unified Platform Development Proving Grounds (UPDPG), i.e., Unified Platform GovCloud

· JCWA systems (Persistent Cyber Training Environment - PCTE, Battle Management, etc.)

· Existing and future Department of Defense (DoD) BDP systems

4.1.2 The Contractor shall ensure all services comply with the UP Agile Framework and the following constraints:

· Adherence to the service catalog that is available in DoD cloud computing environments

· Joint Cyber Warfighting Architecture (JCWA) Chief Engineer and Unified Platform Chief Engineer directives to include Identity, Credentialing, and Access Management (ICAM) and Single Sign-On (SSO) integration

· Unified Platform Cybersecurity rules, guidance, and policy to include Continuous Authority to Operate (cATO) change request (CR) processes, Certificate to Field (CtF) processes, software defined perimeter access restrictions, and Common Access Card (CAC) and/or External Certification Authority (ECA) PKI authentication

· Cloud Native Computing Foundation (CNCF) and Kubernetes Native applications and microservices best practices

· Compliance with the DoD DevSecOps Reference Design – https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf

· Government-designated collaboration tools and environment (R2D2 GitLab, Nexus, Jira, and Confluence)

· Inter-connectivity for Big Data Platform (BDP) which consists of a government owned code baseline for the configuration and deployment of Open-Source software including Apache Hadoop, Storm, Accumulo, Kafka, and NiFi, along with PostgreSQL, Open Search (formerly Elasticsearch), and others. Additional gov owned (custom) applications built on the platform are also part of this requirement. The actual instantiation of the BDP that UP owns/manages is known as the "Caspian Series".

4.1.3 The Contractor is permitted to utilize the SCIF facilities in San Antonio, Texas to fulfill the Environment requirements. Subject to Government approval and appropriate access to environment requirements in Section 4.1.1 and 4.1.2, contractor personnel may also remotely perform the required services from an alternative location (see Section 5).

4.2 KICK-OFF MEETING

4.2.1 Within one week of contract start, the Contractor shall support a kick-off meeting for the Government and team members at a location specified by the Government. The Contractor shall introduce team members and staff, and shall present and discuss organizational structure, administrative operations pertinent to this task order, technical approaches, and preliminary plans for performing contract tasks, format of reports and quarterly reviews, and a general overview of the overall approach to execute this contract. The Government will hold program management reviews as needed.

4.2.2 Following initial kick-off, Key personnel or other configuration approved by the Government may be required to be on-site in San Antonio, TX (and/or other location as determined by Government within the United States). See Section 4.5.

4.3 MONTHLY STATUS AND FINANCIAL REPORTING

4.3.1 The Contractor shall submit cost/financial summary reports in accordance with the sample financial report attached as part of the monthly status report required CDRL 0001 MONTHLY STATUS REPORT/COST SUMMARIES.

4.3.2 Each MSR shall summarize the efforts on the contract from the previous month and addressing any issues, Contractor employees performing work on-site compared to off-site performance, anticipated actions, and notification of any employee changes since the last report and anticipated changes within the next thirty calendar days. The MSR shall also identify subcontractors and their associated work and contain a travel expense report.

4.4 TECHNICAL DATA

4.4.1 All work performed and produced in accordance with this contract shall be under the sole ownership of the Government.

4.4.2 The contractor shall not incorporate copyrighted or licensed computer software under this contract without the Government's prior written consent. If these software components are provided as a software deliverable, the contractor shall grant the Government use of these software components at no additional charge but will provide these components with "restricted rights" as defined in DFARS 252.227-7014. If these software components are included or embedded within a software deliverable that is developed under this contract, the contractor shall grant the government "government purpose rights" as defined in DFARS 252.227-7014 in the deliverable. The contractor may specifically reserve all rights in intellectual property developed under or derived from this contract that is not specifically identified in the Statement of Work as a contract deliverable.

4.5 TRAVEL

4.5.1 After contract kick-off event, the Contractor’s team members may be expected to spend up to two weeks on-site (San Antonio, TX or as determined by Government within the United States).

4.5.2 Following initial kick-off, one week per quarter, in conjunction with PI planning (Key Personnel or other configuration approved by the Government) are required to be on-site (San Antonio, TX and/or other location as determined by Government within the United States).

4.5.3 The Contractor may be required to travel to various locations within the Continental United States (CONUS) in performance of this contract. The Contractor may be required to travel to San Antonio to access high side networks/platforms. All travel arrangements shall be pre-approved by the Contracting Officer or Contracting Officer Representative (COR) and shall be in accordance with FAR 31.205- 46.

4.5.4 The Contractor shall travel using the lowest cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use economy class, or similar accommodations to the extent they are available and commensurate with the mission requirements.

4.6 GOVERNMENT COMPUTER ACCESS REQUIREMENTS

4.6.1 Furnished Property (FP) such as laptops, and PIV Card Readers will not be issued in performing work on this contract. The contractor is required to provide all equipment necessary to perform functions related to the contract.

4.7 ORGANIZATIONAL CONFLICT OF INTEREST

4.7.1 The Contractor and subcontractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, and/ or work statements, etc.) which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in Federal Acquisition Regulation (FAR) Subpart 9.5, Organizational and Consultant Conflicts of Interest. In accepting and performing the work required by this contract, the Contractor certifies that such work does not constitute or create a conflict of interest due to other work being performed by its firm. The Contractor shall notify and submit mitigation plan to the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI.

4.8 ADMINISTRATIVE ACTIVITIES

4.8.1 The Contractor shall collaborate with stakeholders, other support contractors, and third-party vendors throughout system integration, performance, security, system acceptance, user acceptance, usability, and test and evaluation reporting.

4.8.2 The Contractor shall manage all Contractor resources and supervise all Contractor staff in the performance of work on this contract. The Contractor shall manage and coordinate its team(s) on a day-to-day basis and ensure plans are communicated to all Government and contractor team members. Likewise, the Contractor must ensure that the health and progress against those plans are adequately reported.

4.8.3 The Contractor shall conduct and report on retrospectives for overall team and Government improvement.

4.9 PLACE OF PERFORMANCE

4.9.1 LOCATION

UP PMO is primarily located in San Antonio, Texas (USA). Subject to Government approval and appropriate access to environment requirements in Section 4.1, contractor personnel may also remotely perform the required services from an alternative location (see Section 5). The Government is of the opinion that collaboration is best had in person, preference will be given to local teams, however, flexibility regarding location may be negotiated to attract the best talent the industry has to offer.

4.9.2 HOURS OF OPERATION

Overtime is not reimbursed by the Government under the terms of this contract as these are included within the price proposal. Daily, weekly, etc., labor hours shall be negotiated solely between the Contractor and its employees In Accordance With (IAW) applicable labor laws. Core hours are from 9am to 3pm and during this time, team members are to be available for meetings or other work-related collaborations. Any alternative schedule to the core hours must be approved by the COR or Contracting Officer. Paid time off (PTO) or other planned absences must be communicated no less than 72 hours ahead of the absence. PTO in excess of 40 hours must be communicated 30 days in advance, and absences of greater than 4 weeks require a backfill during the time of absence.

4.9.3 FEDERAL HOLIDAYS

Government Holidays. Holidays are not reimbursed by the Government under the terms of this contract as these are included within the price proposal and shall be negotiated solely between the Contractor and its employees IAW applicable labor laws. If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a Sunday, it is observed on Monday.

The following days are Government observed holidays:

· New Year’s Day

· Martin Luther King Day

· President’s Day

· Memorial Day

· Juneteenth

· Independence Day

· Labor Day

· Columbus Day

· Veterans Day

· Thanksgiving Day

· Christmas Day

4.10 GENERAL PERFORMANCE STANDARDS

4.10.1 The Contractor will be evaluated on the ability of their team members to contribute to goals identified through program requirements processes in collaboration with the PO during agile planning events. The Contractor will operate and collaborate within an ecosystem of Government and industry partners, within multiple Contractor teams working in parallel, and with constant interaction. The Contractor will be proactively adapting to changing requirements.

4.10.2 It is anticipated that the Contractor’s work products will continually be holistically evaluated, including some or all the following, as appropriate, and as determined by the Government:

4.10.3 Business Satisfaction: Each feature or product delivery completed by a contractor team will be evaluated by the Product Owner for that team, and by SMEs assigned to the team. At each iteration review, the functionality will be evaluated by a wider audience of Government employees.

4.10.4 Code Security and Quality: Developed code is subject to security reviews including passing scanning results. This evaluation will be performed by tools integrated with CI/CD pipelines, a contracted security team, or Government employees. Test scripts and code will be assessed for their quality and for the extent to which they test the appropriate functions.

4.10.5 Production Performance: The Contractor will be evaluated on the performance of their deployment pipeline: speed, availability and cadence, code in production: its availability, response time, usability, accuracy, and lack of defects, and improvements thereof.

4.10.6 Continuous Process Improvement: The Contractor will be assessed on the processes they implement, their conformance to Government processes, their conformance with Systems Engineering Life Cycle (SELC) and other required frameworks, and their use of retrospectives to continuously improve these processes.

4.10.7 Collaboration: The Contractor will operate within an ecosystem of federal and Contractor staff, with multiple Contractor teams working in parallel and with constant interaction with Government employees. The Contractor will be graded based on their willingness, effort, and ability to work collaboratively.

4.10.8 Productivity: The Contractor will be measured by velocity and story point completion as compared against historic team averages. The Government will evaluate the value delivered and to note any unproductive behavior.

4.10.9 Compliance: The Contractor will be assessed on maintaining system boundary authority to operate and compliance with DoD Enterprise DevSecOps mandates, including the DoD Enterprise DevSecOps Reference Design, Container Hardening guide and cybersecurity requirements, as appropriate.

4.10.10 Timeliness: Performance of technical support response times to outages and customer-initiated issues.

4.11 TRANSITION DUTIES

4.11.1 The Contractor shall begin the phase-in efforts immediately after contract award. The Contractor shall ensure adequate time to hire appropriate personnel, issue subcontracts, etc. after Task Order award. The Government will provide familiarization training of various Government organizations to the contractor should the Government determine that such familiarization training is necessary. As a minimum, the contractor shall familiarize its supervisors, key personnel and staff with performance metrics, work scheduling, procedures, and contract requirements. During the phase-in period, the contractor shall be responsible for finalizing all employee clearance requirements. The contractor shall complete the necessary steps for assumption of the operation during the phase-in period and shall meet all requirements as specified in the SOO with the beginning of full performance.

4.11.2 To ensure a smooth phase-out to the next service provider in the event no Option year is exercised, or a new contractor is selected at contract recompete, and to prevent possible decreases in productivity or service quality, the contractor shall provide a 60-calendar day phase-in period prior to Contract conclusion date. During this period, the contractor shall make available to key incoming contractor personnel, representatives of the incumbent contractor who are versed in the established operation of the functions to be performed. This service shall be made available to explain procedures for conducting Government business, show the next contractor various work sites, introduce the contractor to customer representatives, etc. During this period, the incumbent contractor shall provide required training pertaining to the current status and pending transactions and conduct transfers as needed.

4.11.3 The Contractor recognizes that the services under this contract are considered vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue services.

5. SECURITY REQUIREMENTS

5.1 PERFORMANCE WORK LOCATION AND SCIF ACCESS (if applicable)

5.1.1 Unified Platform (UP) is headquartered in San Antonio, Texas (USA). Subject to Government approval, contractor personnel may also remotely perform the required services from an alternative location.

5.1.2 Work performed under this effort will be performed on government sites, and partner facilities as outlined in the DD254, and as approved by the Contracting Officer.

5.1.3 The contractor shall maintain active TS SCI security clearance and accessibility to a Sensitive Compartmented Information Facility (SCIF) for all KPPs on the contract as well as access to the Environments described in Section 4.1 within a reasonable timeframe for daily use. For the remaining team, the contractor shall maintain at least one half of the personnel have an active TS SCI security clearance and accessibility to a SCIF within a reasonable period for daily use. The contractor has the option to fulfill the Personnel Security requirements and SCIF access in several ways or in a combination of ways.

· Option 1 - Top Secret required personnel are local to San Antonio

· Option 2 - Top Secret required personnel may be remote but may be required to be onsite to access the SCIF facilities in San Antonio up to one week, two times per month. The Contractor will be responsible for the costs associated with travel related to fulfilling the Security requirement.

· Option 3 - Subject to Government approval, the Contractor will be able to fulfill the Security Requirement with their own SCIF and Personnel local to that SCIF. Until a MOA/MOU is reached with the Government approved contractor SCIF, Top Secret required personnel fall into the category of Option 1 or Option 2.

· Option 4 – Other, if approved in writing by the Contracting Officer.

5.2 FACILITY CLEARANCE (FCL) and SAFEGUARDING

5.2.1 Portions of the work to be performed under this contract require access to classified material, up to the Top-Secret level. The prime contractor and their subcontractors must have a Top Secret FCL on day one of the contract and Top-Secret safeguarding on day one of contract if utilizing their own SCIF to perform classified work. The prime contractor and their subcontractors must have an FCL to the level of clearance of personnel they employ on day one of the contract.

5.2.2 For classified work, the contractor must have access to a SCIF capable of connecting to the relevant classified environments identified in SOO Section 4.1 at time of performance start unless explicitly approved in writing from the Government Contracting Officer.

5.3 OTHER PERSONNEL REQUIREMENTS and GOVERNMENT FACILITY ACCESS REQUIREMENTS

5.3.1 Contractor personnel without a security clearance may be authorized to perform unclassified tasks as long as they meet the minimum unclassified onboarding requirements and have a minimum of Tier 1 investigation or have been approved by the External Certification Authorities (ECA).

5.3.2 If the T1 investigation is required, the company must agree not to submit a T3 or T5 investigation for uncleared personnel while the T1 investigation is open. Any costs and administrative actions for T1 investigations will be divided between the contractor and the Government Contracting Activity (GCA) in the following manner:

5.3.2.1 The contractor will coordinate all actions and costs associated with submitting Special Agreement Checks (SAC) or fingerprints, which is a requirement in submitting T1 investigations. All costs and logistical/administrative responsibilities associated with the completion of fingerprints for all contractor personnel are hereby incorporated into the costs/price of this contract when awarded to the contractor and will not be the basis for a future equitable adjustment or claim.

5.3.2.2 Upon confirmation of favorable fingerprint results, the GCA security team will initiate and process the T1 investigation as soon as possible. If there are any issues with fingerprint results, the FSO or CSSO will need to coordinate fingerprint re-submission in the same manner.

5.4 REPORTING REQUIREMENTS

5.4.1 Employees who occupy national security positions and have access to classified information are expected to self- report changes or incidents that may impact their clearances. Only SCI cleared contractors, or contractors in the process of getting SCI Indoctrinated, must report to the COR and Government Security Office any reportable events if warranted, to include but not limited to:

5.5 SECURITY VIOLATIONS and INFRACTIONS

5.5.1 Any and all security violations and infractions committed by contractors must be reported to the COR and GCA Security Office within 12 hours of known violation and infraction. Additional documentation, actions, and penalties may be implemented.

5.6 SECURITY IN-PROCESSING/ OUT-PROCESSING and RECURRING TRAINING/READING REQUIREMENTS

5.6.1 The Contractor must provide the Employee Listing Memorandum (ELM), which lists all contractor personnel supporting this contract, to include prime contractors and subcontractors (if applicable). The ELM must be updated and submitted to the COR as changes are made to reflect all new hires, employees leaving the contract, existing employees on the contract, and all employees’ SCI requirements (if applicable), just to name a few. The FSO or security representative must also indicate the SCI SMO Code for all indoctrination assists for all personnel not located in San Antonio, TX. The COR will provide a template to the Contractor, as seen in CDRL 0002.

5.6.2 Prior to submitting the ELM, the Facility Security Officer (FSO) or security representative must perform an owning relationship and post the applicable clearance and Secret NATO (if applicable) in the Defense Information System for Security (DISS). If applicable, subcontractors must perform all DISS related actions for their personnel.

5.6.3 Additionally, all personnel must complete the following training and reading requirements within ten business days of onboarding. Record keeping of all training certificates is required by the prime (and subcontractors, if applicable), and must be submitted to the COR along with the ELM, as seen in CDRL 0003.

In-processing training requirements include:

· Initial Security Training (IST)

· Original Classification Authority (OCA)

· Initial Operations Security (OPSEC) Training

· Initial Controlled Unclassified Information (CUI) Training

· Intelligence Oversight

In-processing reading requirements include:

· Security Executive Agent Directive (SEAD) three

· Unified Platform Security Policy Memorandum

· Emergency Action Plan (EAP): Contractor personnel will review/acknowledge this EAP and send a digitally signed email to their respective Contractor Officer Representative (COR) to certify completion. Newly assigned contractors will review this EAP as part of their onboarding.

· OPSEC Plan

· Critical Information Indicators List (CIIL)

Additional required security training requirements:

· Quarterly Security Education Training Awareness (SETA) one

· Quarterly Security Education Training Awareness (SETA) two

· Quarterly Security Education Training Awareness (SETA) three

· Quarterly Security Education Training Awareness (SETA) four

5.6.4 Additional changes to documents and requirements may occur during the period of performance of this contract. If any such changes occur, the GCA Security Office reserves the right to implement changes as required. The company must submit changes in a timely manner as indicated by the GCA Security office.

5.7 OPERATIONS SECURITY (OPSEC)

5.7.1 Contractor personnel will apply OPSEC to enhance protection of classified, Controlled Unclassified Information, and critical information. The contractor Program Manager or a delegated OPSEC Coordinator will be familiar with OPSEC as described in, DoD Directive 5205.02E, DoD Manual 5202.02, and AFI 10-701.

5.7.2 Upon award, Unified Platform (UP) will provide the Operations Security (OPEC) Plan to the contractors and the contractor shall review the plan and sign the Operations Security Obligations Memo, as seen in CDRL 0004.

5.7.3 The COR will provide the contractor with the OPSEC plan and Critical Information Indicator’s List (CIIL).

Contractor personnel supporting this contract will also protect details described on the Critical Information List (CIIL) provided by the Government. The contractor shall implement associated OPSEC measures and countermeasures.

5.8 PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION (CUI)

5.8.1 The contractor shall protect CUI in accordance with Government standards set forth in the Executive Order (EO) 13556, 32 Code of Federal Regulations (CFR), Part 2002, and DoD Instruction (DoDI) 5200.48. CUI is any information that law, regulation, or government wide policy requires to have safeguarding or disseminating controls.

5.8.2 The National Archives and Records Administration (NARA) CUI Registry (http://www.archives.gov/cui/registry/category-list.html) identifies approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, and sets out procedures for the use of CUI.

5.8.3 Processing Unclassified Nonpublic DoD Information. Unless specific categories of CUI require more stringent controls, non-DoD Information Systems must be protected…