J-1 JWCC UCM Core Performance Work Statement.docx

JOINT WARFIGHTING CLOUD CAPABILITY

UNIFIED CLOUD MARKETPLACE CORE

PERFORMANCE WORK STATEMENT

Department of Defense Defense Information Systems Agency P.O. Box 549 Ft. Meade, MD 20755-0549

TABLE OF CONTENTS

PERFORMANCE WORK STATEMENT

Contract Number:

Task Order Number:

Contractor Name

1. CONTRACTING OFFICER’S REPRESENTATIVE

· Primary Contracting Officer’s Representative (COR). See Defense Information Technology (IT) Contracting Organization (DITCO) Additional Text G1 - Points of Contact (PoCs)

· Alternate COR (ACOR). See DITCO Additional Text G1 - PoCs

· Property Administrator See DITCO Additional Text G1 - PoCs

2. CONTRACT OR TASK ORDER TITLE

Joint Warfighting Cloud Capability (JWCC) Unified Cloud Marketplace (UCM) Core

3. BACKGROUND

To maintain its military advantage, the Department of Defense (DoD) requires an extensible and secure global multi-vendor cloud capability that addresses warfighting challenges at the speed of relevance. In the DoD’s overarching IT strategy for Fiscal Years (FYs) 2025 – 2029, “Fulcrum: The Department of Defense Information Technology Advancement Strategy,” the DoD Chief Information Officer (CIO) outlines strategies that will help meet the Department’s requirements by delivering innovative IT solutions to the Warfighter and expanding strategic dominance of U.S. Forces and Mission Owners (MO) in cyberspace. Failure to deliver these capabilities will lead to operational inefficiencies, delayed responses to threats, increased vulnerability to cyber-attacks, and prolonged financial burdens for maintaining legacy systems.

The CIO’s strategic objectives require a global, multi-vendor cloud infrastructure that delivers secure, worldwide access to critical warfighting data across all classification levels—Unclassified (U), Secret (S), Top Secret (TS), and Top Secret/Sensitive Compartmented Information (TS/SCI)—and all Impact Levels (ILs) 2, 4, 5, and 6 (to include Special Access Programs (SAP) in classified environments).

In support of this requirement, the JWCC UCM Core contract has established a 10-year, full-and-open multiple-award Indefinite Delivery, Indefinite Quantity (IDIQ) with U.S.-based hyperscale commercial Cloud Service Providers (CSPs) that hold DoD authorizations from IL2/4/5/6 through TS/SCI, which can provide a secure and scalable cloud architecture with capabilities available globally, from the strategic level to the operational and Tactical Edge (TE) and in denied, degraded, intermittent, or limited-bandwidth (DDIL) environments and closed-loop networks in direct support of the Warfighter.

4. OBJECTIVES

4.1. Available and Resilient Services. The solution must provide highly available, resilient cloud services that are reliable, durable, and can continue to operate despite catastrophic failure of portions of the infrastructure. To provide the resiliency and availability required by JWCC UCM Core users, CSPs must be able to meet DoD resiliency and disaster recovery requirements.

4.2. Globally Accessible. The solution must provide cloud services that are securely accessible worldwide, at all offered classification levels and ILs, through existing and emerging communication paths. Cloud Service Offerings (CSOs) must support assured access and enable interoperability between virtual enclaves that contain applications and data, ensuring seamless integration and collaboration.

4.3. Centralized Management and Distributed Control. The solution must enable the DoD to exert necessary oversight and management of cloud services. This includes the ability to apply security policies, monitor network security compliance and service usage, promulgate standardized service configurations, automate the account provisioning process, and comply with government security directives.

4.4. Ease of Use. The solution must offer efficient self-service capabilities for cloud services, enabling the rapid development and deployment of new applications and advanced capabilities. Additionally, the solution must support the portability of data and applications both within and outside the solution in standardized formats.

4.5. Service Parity. Services at all offered classification levels, and ILs must operate substantially like the corresponding commercial service in terms of capability and functionality, including its graphical user interface (GUI), command line interface (CLI), and application programming interfaces (APIs). Pricing for services must be at or below commercial pricing across all classifications. JWCC UCM Core CSPs will be required to offer all new commercial services to the DoD within 30 days of authorization.

4.6. Rapid Elasticity. Rapid scaling of the services, architectures, and capabilities offered. CSO capabilities must be elastically provisioned and released, in some cases automatically, to scale rapidly, vertically and horizontally, in response to demand and to meet mission needs.

4.7. Fortified Security and Zero Trust. The solution must employ security capabilities that enable enhanced cyber defenses and address Zero Trust (ZT) principles identified in DoD’s ZT Architecture and must provide these capabilities to MOs.

4.8. Artificial Intelligence and Advanced Data Analytics. The solution must provide Artificial Intelligence (AI) and advanced data analytics services that securely enable data-driven and timely decision-making at the tactical level (i.e., within a single data domain), the operational level (i.e., a collection of local data domains), and the strategic level (i.e., across all data domains), without using DoD data for the training of commercial CSP models.

4.9. Tactical and Operational Edge Devices and Services. The solution must include compute and storage capabilities for use at the tactical and operational edge that are able to support workloads across the range of military operations while balancing portability with capability. Edge capabilities and devices need to operate seamlessly across varying network connectivity levels, including in DDIL environments.

4.10. Third-Party Marketplace and Software as a Service. The solution must provide a Third-Party Marketplace, where vendors may offer their solutions to the DoD, inclusive of Software as a Service (SaaS) solution for use in cloud tenancies.

4.11. Integration Services. The solution must ensure seamless connectivity across diverse systems/clouds, applications, and data sources in cloud environments. The integration services should facilitate efficient data transformation, workflow automation, and secure data transmission, and serve as a comprehensive platform that simplifies and automates the process of connecting diverse systems (e.g., Hybrid Cloud) and data sources, enabling MOs to unlock the full potential of their data and applications.

4.12. On-ramping/Off-ramping of Cloud Service Providers. The Government, at its sole discretion, may exercise on-ramp or off-ramp provisions to maintain a pool of qualified, competitive Contractors. On/off-ramp criteria is defined in Section H27 of the contract.

5. SCOPE

The JWCC UCM Core contract will serve all authorized customers, federal government-wide, in the procurement of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS (collectively known as Anything as a Service (XaaS)), in support of current and future U.S. Government business and mission operations.

JWCC UCM Core will provide DoD-approved XaaS capabilities and services across all security domains, at all classification levels and ILs, from the strategic level to the TE, to include DDIL bandwidth environments and closed-loop networks. It will also introduce a centralized method for directly procuring TE devices and additional Third-Party Offerings. This capability will enable the DoD to meet evolving IT requirements, such as improved financial reporting, robust cybersecurity, and enhanced adoption, awareness, and oversight of how the DoD utilizes the cloud, and will allow capability developers and the Defense Industrial Base (DIB) to develop and field solutions rapidly.

Unless otherwise annotated, the stated objectives, requirements, and metrics in the Performance Work Statement (PWS) apply to all JWCC UCM Core CSOs, regardless of classification level or IL. The Government understands that some CSPs may propose functionality beyond what is specified in this PWS as part of their JWCC UCM Core Services. Therefore, this PWS should not be interpreted in a manner that would limit such functionality; rather, this PWS’ requirements should be considered the base or minimum requirements. All Performance Metrics listed in this PWS shall apply to all Task Orders (TOs), unless otherwise noted in the TO.

6. PERFORMANCE REQUIREMENTS

CSPs shall be required to meet all performance requirements specified within this contract and provide the contracted CSOs as delineated in this PWS. The Government will not consider or grant exceptions to any requirement unless a provision for such an exception is explicitly stated within the requirement itself.

Personnel supporting the Task/Subtasks may require access to: Secret, Top Secret, TS/SCI, Communications Security (COMSEC), Secret Internet Protocol Router Network (SIPRNet), North Atlantic Treaty Organization (NATO) Control of Secret Material in an International Command (COSMIC), Joint Worldwide Intelligence Communication System (JWICS), Special Access Program(s) (SAP), and SCI.

1. TASK 1 – PROGRAM MANAGEMENT

Contractors shall identify personnel, processes, and tools to manage and oversee the Contractor’s activities throughout the JWCC UCM Core Contract period, ensuring compliance with cost, schedule, performance, and quality requirements.

Secret, Top Secret, TS/SCI, COMSEC, SIPRNet, JWICS, SAP, and SCI Accesses are required in support of the oversight and management of the JWCC UCM Core Contract.

6.1.1. SUBTASK 1 – IDENTIFY KEY PERSONNEL

The Contractor shall identify personnel to coordinate and interface with the JWCC UCM Core COR and JWCC UCM Program Management Office (PMO) to ensure the JWCC UCM Core Contract is utilized efficiently, complies with JWCC UCM Core requirements, and incorporates commercial best practices. To ensure successful administration, operation, and lifecycle of services, the Contractor shall facilitate effective program management and submit the Program Management Plan (PMP) annex of Contract Data Requirements List (CDRL) A001, “Contract Management.”

Key Personnel The Contractor shall identify key personnel with sufficient expertise and authority to serve as the Contractor’s primary management team and PoCs.

Key personnel shall be empowered to make program and project-level decisions and commit the necessary resources to successfully execute courses of action within the scope of the JWCC UCM Core Contract. Key personnel shall monitor and report on contract status and compliance with the JWCC UCM Core Contract requirements.

Key personnel are responsible for formulating and enforcing work standards, assigning contractor schedules, reviewing work discrepancies, supervising contractor personnel, and communicating policies, purposes, and goals of the JWCC UCM Core Contract to subordinates.

Key personnel are responsible for the overall performance of this contract.

Key personnel who are authorized to act on behalf of the Contractor shall be designated in writing to the JWCC UCM Core Contracting Officer (KO).

Key personnel shall be available as needed for interaction with the JWCC UCM Core COR, JWCC UCM PMO, and JWCC UCM Core KO between 8:00 a.m. and 4:30 p.m. Eastern Time, Monday through Friday, except on federal holidays.

The JWCC UCM Core Contractor shall identify the following key personnel:

Program Manager. The Program Manager (PM) shall meet the following requirements to perform all services required by the JWCC UCM Core Contract and resultant TOs:

The PM shall be a U.S. citizen;

The PM shall possess (at the time of contract award) a fully adjudicated U.S. security clearance commensurate with the highest classification of the CSO(s) provided, pursuant to Attachment J-2, “JWCC UCM Core DD254” (where applicable);

The education and experience requirement for the PM is, at a minimum, a bachelor’s degree in a technical or managerial discipline, a Program Management Professional or Project Management Professional certification, or, at the discretion of the Government, other Program/Project Management certification;

The PM shall have at least 15 years of experience managing complex IT programs. If the PM holds an advanced degree (e.g., a master’s degree), the required minimum experience is 10 years of managing complex IT programs. Additionally, the PM shall have a minimum of five years of experience in contiguous practice in a commercial environment, at the minimum credentialed level (i.e., with a bachelor’s degree and Program/Project Management certification).

Technical Subject Matter Expert. The Technical Subject Matter Expert (SME) shall serve as the PoC for internal efforts undertaken by CSPs to support the development and implementation of cloud engineering; architecture; cloud network engineering, cloud cybersecurity strategies; identity and access management (IAM); risk assessments; Development, Security, and Operations (DevSecOps); DoD and Intelligence Community (IC) authorizations; and compliance with JWCC UCM Core cybersecurity requirements. The Technical SME shall meet the following requirements to perform all services required by the JWCC UCM Core PWS and resultant TOs:

The Technical SME shall be a U.S. citizen;

The Technical SME shall possess (at the time of contract award) a fully adjudicated U.S. security clearance commensurate with the highest classification of the CSO(s) provided, pursuant to Attachment J-2, “JWCC UCM Core DD254”;

The education and experience requirement for the Technical SME is, at a minimum, a bachelor’s degree in a technical or cybersecurity discipline and a relevant cloud engineering certification and cybersecurity certification (e.g., Security+, Certified Information Systems Security Professional (CISSP), DoD Cybersecurity Service Provider (CSSP), Certified Information Security Manager (CISM), Information Systems Security Architecture Professional);

The Technical SME shall have at least 10 years of progressive technical experience in cloud design, architecture, and cloud security, with a minimum of five years of experience in cloud security, operational security (OPSEC), application security, and network security. The Technical SME shall be the primary engineering and cybersecurity PoC for communication with the JWCC UCM PMO on matters regarding engineering aspects of CSP systems and related to the cybersecurity of CSP systems, service network monitoring, incident response, security posture sustainment, and security plan development.

Substitution of Key Personnel. The Contractor shall ensure the availability of key personnel with the requisite skills to perform the work detailed in the JWCC UCM Core PWS.

The qualifications of substituted key personnel must meet or exceed the requirements of listed in section 6.1.1.1, “Key Personnel.”

The Contractor shall notify the JWCC UCM Core KO within five days prior to the departure of any key personnel.

The Contractor shall fill any vacancies of key personnel within 30 business days.

The Contractor shall notify the JWCC UCM Core KO prior to making any changes in JWCC UCM Core personnel assigned as key personnel. The Government will review all proposed key personnel skill levels prior to accepting any substitutions.

During the first 180 days of performance, the Contractor shall make no substitutions of key personnel without authorization from the JWCC UCM Core KO.

When making a substitution, the Contractor shall provide: a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, confirmation that the proposed substitutes meet all key personnel requirements, and any additional information requested by the JWCC UCM Core KO.

The JWCC UCM Core KO will notify the Contractor within 10 calendar days after receipt of all required information of the decision on proposed substitutions.

6.1.2. SUBTASK 2 – CLOUD SERVICE PROVIDER PROGRAM MANAGEMENT OFFICE RESPONSIBILITY The Contractor shall perform the following requirements and provide the following deliverables. All requirements provided in this agreement shall be accurate, complete, and presented in a professional manner consistent with industry best practices.

6.1.2.1. Participate in meetings

6.1.2.1.1. The Contractor shall arrange, execute, and facilitate meetings, estimated to be approximately 12 per year, when requested by the JWCC UCM PMO in support of the JWCC UCM Core Contract.

6.1.2.1.2. The Contractor shall attend and participate in meetings arranged, executed, and facilitated by the Government.

6.1.2.1.3. The Contractor shall provide Presentation Materials to the JWCC UCM Core KO, COR, and PMO prior to required meetings, by submitting CDRL A002, “Presentation Materials.”

6.1.2.1.4. The Contractor shall support a kickoff meeting with the Government within 45 calendar days after contract award. The Contractor shall coordinate the kickoff meeting with the JWCC UCM Core COR. The kickoff meeting will be conducted either in-person or virtually in the National Capital Region, at the Government’s discretion, with the Contractor’s primary staff interfacing with the JWCC UCM PMO. The kickoff meeting will be conducted simultaneously with all JWCC UCM Core Contract holders in attendance. All JWCC UCM Core Contract holders will be allowed one-on-one breakout sessions, upon request, to present Contractor materials, as submitted in CDRL A002, “Presentation Materials,” and to address any specific questions regarding the JWCC UCM Core Contract. The Contractor shall agree to attend any post-award conference convened by JWCC UCM PMO or the JWCC UCM Core KO.

6.1.2.1.5. In-Progress Reviews. The Contractor shall arrange, facilitate, and execute annual In-Progress Reviews (IPRs), as well as any additional IPRs at the request of the JWCC UCM Core KO or JWCC UCM Core COR. IPRs will be conducted either in person or virtually at the Government’s request, and the Government reserves the right to include virtual attendees in in-person meetings. The Contractor is responsible for providing presentation materials by submitting CDRL A002, “Presentation Materials,” for all IPRs. Minimum content for IPRs shall include, but is not limited to, the following:

6.1.2.1.5.1. Overall JWCC UCM Core Contract execution, management, and operating status update;

6.1.2.1.5.2. Discussion of any upcoming JWCC UCM Core Service Catalog changes;

6.1.2.1.5.3. Discussion to better optimize JWCC UCM Core Services and adoption;

6.1.2.1.5.4. Discussion of training provided under the JWCC UCM Core Contract, reporting impacts including quantitative metrics, course completion rate, learning hours, assessment pass rate, and engagement rates, as well as qualitative metrics, such as a summary of feedback and survey responses from participants;

6.1.2.1.5.5. Any Government agenda items provided to the Contractor for inclusion in the scheduled IPR.

6.1.2.1.6. Technical Exchange Meetings. As requested by the JWCC UCM Core COR, the Contractor shall arrange, facilitate and execute Technical Exchange Meetings (TEMs) and optionally provide presentation materials by submitting CDRL A002, “Presentation Materials.” TEMs can include content/topics determined by the JWCC UCM Core COR or the JWCC UCM PMO.

6.1.2.2. Program Plans and Reports

6.1.2.2.1. Program Management Plan. The Contractor shall develop, implement, and maintain a PMP and submit the PMP annex of CDRL A001, “Contract Management.” The PMP shall include, but not be limited to, the following elements:

6.1.2.2.1.1. Description of the methodology and execution approach, detailing all information required in accordance with the administration of JWCC UCM Core Contract that will be used to facilitate effective overall program management;

6.1.2.2.1.2. The Contractor shall provide the JWCC UCM Core COR and KO with a list of key personnel, including associated resumes, credentials, and contact information, upon contract award and upon any changes to key personnel;

6.1.2.2.1.3. The PMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting;

6.1.2.2.1.4. Ad Hoc Reporting/Information Products. The Contractor shall work with the JWCC UCM Core KO or JWCC UCM Core COR to respond to ad hoc report requests. When requested by the JWCC UCM Core COR, the Contractor shall submit CDRL A008, “Ad Hoc Reporting/Information Products.”

6.1.2.2.2. Communication Plan. The Contractor shall provide a Communications Plan detailing internal and external communication processes and protocols by submitting the Communications Plan annex of CDRL A001, “Contract Management.”

6.1.2.2.3. Risk Management Plan. The Contractor shall provide a Risk Management Plan (RMP) which describes how risks to contract delivery are identified, tracked, mitigated, and resolved by submitting the RMP annex of CDRL A001, “Contract Management.”

6.1.2.2.4. Quality Control Plan. The Contractor shall provide a formalized Quality Control Plan (QCP) by submitting the QCP annex of CDRL A001, “Contract Management,” which includes, but is not limited to, the following:

6.1.2.2.4.1. Describe the approach for continuously meeting the performance requirements of the JWCC UCM Core PWS throughout the life of the JWCC UCM Core Contract.

6.1.2.2.4.2. The QCP shall identify a method for users to report issues with service availability, functionality, or security.

6.1.2.2.4.2.1. This capability shall be available 24 hours a day, 7 days a week, 365 days a year, worldwide without any charge or expense to the Government.

6.1.2.2.4.2.2. The Contractor shall provide near-immediate acknowledgement of user-reported issues (within five minutes of submission).

6.1.2.2.4.2.3. The Contractor will action these communications in accordance with their QCP and any relevant support package Service Level Agreements (SLA) associated with the JWCC UCM Core TO.

6.1.2.2.4.2.4. The reporting capability shall be available for all offered classification levels and ILs, so that JWCC UCM Core users can communicate the issue at the required classification level.

6.1.2.2.5. Information Technology Service Management Plan. The Contractor shall provide an Information Technology Service Management (ITSM) Plan detailing processes used to identify, report, prioritize, and monitor Service Incidents by submitting the ITSM Plan annex of CDRL A001, “Contract Management.” The ITSM Plan will describe processes for notifying JWCC UCM Core users about Service Incident status, remediation schedules, and overall priority relative to other current Service Incidents and all requirements identified in section 6.2.2.5.

6.1.2.2.6. Lifecycle Management Plan. The Contractor shall provide a Lifecycle Management Plan (LMP) by submitting the LMP annex of CDRL A001, “Contract Management,” that describes

6.1.2.2.6.1. How the Contractor shall ensure generational replacement and upgrading of all software (inclusive of firmware) and hardware (compute, memory, storage, and networking), at all offered classification levels and ILs;

6.1.2.2.6.2. How the Contractor will maintain its JWCC UCM Core Offerings so that they remain equivalent to its Commercial Offerings in features, performance, and support.;

6.1.2.2.6.3. How the Contractor’s maintenance activities shall not impact JWCC UCM Core’s DoD operations;

6.1.2.2.6.4. The Contractor’s processes for the decommission, destruction, and tracking of JWCC UCM Core infrastructure, in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-88, “Guidelines for Media Sanitization” (latest version), DoD CSP Security Requirements Guide (SRG), IC Directive (ICD) 503, and ICD 705, and as determined by the CSO’s authorization.

6.1.2.2.7. The Cybersecurity Management Plan. The Contractor shall provide a Cybersecurity Management Plan (CMP) by submitting the CMP annex of CDRL A001, “Contract Management,” which details the Contractor’s processes, approaches, plans, and methodologies to meet all requirements identified in section 6.3, “Fortified Security.”

6.1.2.2.8. The Contract Monthly Progress Report. The Contractor shall provide a Contract Monthly Progress Report (CMPR) that describes the overall performance in accordance with the terms of the JWCC UCM Core Contract by submitting CDRL A003, “Contract Monthly Progress Report.” The CMPR shall include, but is not limited to, the following:

6.1.2.2.8.1. Summary and status of deliveries or implementations of CSOs, Services, features, or infrastructure including references to pertinent requirements in this PWS;

6.1.2.2.8.2. Information about TOs;

6.1.2.2.8.3. The total dollar amount or cost of JWCC UCM Core's spend, as well as the percentage of total spend at the Top Secret level that JWCC UCM Core utilization represents;

6.1.2.2.8.4. Number, type, status (returned/In-Use), month, and year ordered, of Edge devices and services ordered or returned under TOs.

6.1.3. JWCC UCM CORE SERVICE CATALOG

6.1.3.1. The Contractor shall provide a listing of all first- and third-party CSOs and Services offered to the Government (an exhaustive list of all proposed items for inclusion in the JWCC UCM Core Catalog is provided in CDRL A004 Attachment A- “Catalog Schema”, the authorization status, and the applicable classification level or IL for each service, in accordance with Section G12, “JWCC UCM CORE CATALOG MODIFICATION,” by submitting CDRL A004, “JWCC UCM Core Service Catalog. The JWCC UCM Core Service Catalog identifies only Services authorized for DoD consumption in accordance with the JWCC UCM Core Contract.

6.1.3.2. New and modified CSOs and Services offered to the Government shall be made available for deployment within 24 hours of completion of the JWCC UCM Core Service Catalog Modification process Section G12, “JWCC UCM CORE CATALOG MODIFICATION.”

6.1.3.3. Whenever the JWCC UCM PMO notifies the Contractor of a demand signal for CSOs and Services not currently available on the JWCC UCM Core Service Catalog, the Contractor shall engage with the JWCC UCM PMO within 30 days to determine the feasibility of authorization for the service, and provide a plan and timeline to the JWCC UCM PMO for submitting the CSOs or Services for the appropriate authorization within 30 calendar days.

6.1.3.4. To allow the Government an opportunity to test/evaluate Services prior to those Services becoming authorized and incorporated into production operations, first-party Services which have not yet been authorized for use by the Government, may be enabled within the JWCC UCM Core DoD-authorized CSOs and added to the JWCC UCM Core Catalog on a preview or evaluation basis at ILs 2/4/5/6, contract-wide, so long as the following conditions are met:

6.1.3.4.1. The Contractor must submit the Service to the Government for authorization within 45 days of making the preview Service available;

6.1.3.4.2. The Service shall be noted as “NOT AUTHORIZED FOR PRODUCTION USE” in the JWCC UCM Core Service Catalog;

6.1.3.4.3. Additionally, to ensure the user is aware that the Service is not yet authorized for production use, if the Service is made broadly available to all users in a region, the service shall also be identified as “NOT AUTHORIZED FOR PRODUCTION USE” via the Contractor’s Cloud Information Portal (see section 16.G.2, “Definitions,” of this PWS)

6.1.3.4.4. The Contractor shall provide the Government with utilization information as part of the CMPR (CDRL A003, “Contract Monthly Progress Report”), listing each Service that is not authorized for production use, the TO that deploys that Service, the associated user accounts or tenancies, utilization dates and metrics, and other identifying information regarding the use of such Services. This report is intended to enable the Government to have oversight and audit the use of such Services;

6.1.3.4.5. The Contractor shall not imply to any DoD entity that such Services are available for production use;

6.1.3.4.6. If the Contractor does not intend to submit the Service for authorization, it shall not be included in the JWCC UCM Core Service Catalog and shall not be enabled for use.

Task 1 Deliverables Table

(CDRL A001, “Contract Management”)

(CDRL A002, “Presentation Materials”)

(CDRL A001, “Contract Management”)

(CDRL A001, “Contract Management”)

(CDRL A001, “Contract Management”)

(CDRL A001, “Contract Management”)

(CDRL A008, “Ad Hoc Reporting/ Information Products”)

Estimated number of events: 15 annually

(CDRL A001, “Contract Management”)

(CDRL A001, “Contract Management”)

(CDRL A003, “Contract Monthly Progress Report”)

(CDRL A004, “JWCC UCM Core Service Catalog” and CDRL A004 Attachment A – “Catalog Schema”)

*Standard Distribution: One copy of the transmittal letter without the deliverable to the KO; one copy of the transmittal letter with the deliverable to the Primary COR.

1Electronically delivered, reproducible Microsoft Office format (unless otherwise approved by the Government) to the JWCC UCM Core COR.

1. TASK 2 – OPERATIONS

All CSOs submitted by the Contractor that have been authorized for DoD use through (e.g., Federal Risk and Authorization Management Program (FedRAMP) Provisional Authorization (PA), DoD PA, IC Authority to Operate (ATO)) shall be provided on the JWCC Catalog. All authorized CSOs must be capable of operating at the operational and TE levels, including in DDIL environments. When these authorized CSOs are offered in multiple classifications, authorized Cross-Domain Solutions (CDSs) are required. The Contractor’s classified environments shall securely support implementation of SAP workloads, such that the DoD will have the ability to accomplish SAP missions using Contractor-provided JWCC UCM Core Offerings in accordance with DoD Directive (DoDD) 5205.07, DoD Manual (DoDM) 5200.01, and the Joint SAP Implementation Guide (JSIG).

Secret, Top Secret, TS/SCI, COMSEC, SIPRNet, NATO COSMIC, JWICS, SAP, and SCI Accesses are required to provide and support compute, storage, networking, and other cloud products and services at and up to the TS/SCI level.

6.1.1. SUBTASK 1 – CLOUD SERVICE OFFERINGS: MODERN AND ELASTIC CLOUD SERVICES

The Contractor must provide self-service, automated provisioning of services at scale to meet the MO’s consumption, rapid development, and deployment needs, commensurate with Commercial Offerings.

6.2.1.1. The Contractor shall allow for industry-standard network services that employ modern network protocols, including, at a minimum, Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6).

6.2.1.2. The Contractor shall not bundle any JWCC UCM Core Services in a manner that restricts a JWCC UCM Core user’s ability to acquire individual JWCC UCM Core Services. Any bundled JWCC UCM Core Services shall also be available as discrete JWCC UCM Core Services.

6.1.2. SUBTASK 2 – AVAILABILITY AND RESILIENCY

6.2.2.1. The Contractor shall provide dynamic scalability, elasticity, and resiliency through industry-standard mechanisms and activities to ensure the DoD maintains continuous operations despite catastrophic failure of portions of the Contractor’s infrastructure.

6.2.2.2. The Contractor shall implement all aspects of its Lifecycle Management Plan pursuant to PWS section 6.1.2.2.6. Exceptions to this requirement must be requested by submitting CDRL A006, “JWCC UCM Core Exception/Extension Request,” and subsequently approved by the JWCC UCM Core KO.

6.2.2.3. The Contractor’s minimum data center capabilities shall include, but not be limited to, the following:

6.2.2.3.1. The Contractor’s CSOs at each offered classification level and IL shall support the capability for workloads to dynamically scale and migrate horizontally within and between data centers to meet MO demand, without loss of function or capacity;

6.2.2.3.2. The Contractor shall ensure that each offered Service supports automated replication and failover so that JWCC UCM Core users can configure JWCC UCM Core workloads for “high availability,” as defined in NIST SP 800-113, via the JWCC UCM Core Console GUI, CLI, and APIs. Exceptions to this requirement must be requested by submitting CDRL A006, “JWCC UCM Core Exception/Extension Request,” and subsequently approved by the JWCC UCM Core KO.

6.2.2.4. The Contractor shall provide, for each CSO, automatic monitoring of resource utilization, events, failures, and service degradation via a GUI and APIs.

6.2.2.5. The Contractor shall implement its ITSM Plan to ensure notification of Service Incidents are provided to JWCC UCM Core users, the JWCC UCM Core KO, COR, and PMO.

6.2.2.5.1. Within four hours of the Government’s request, the Contractor shall provide follow-up reporting, which includes supplemental information to aid in understanding the Service Incident’s scope, severity, how the Service Incident was discovered, resolution progress, and the Mean Time to Resolve estimate, identifying any impacted JWCC UCM Core users or other significant problems by submitting CDRL A005, “Incident and Vulnerability Reports.”

6.2.2.5.2. The Contractor shall provide the JWCC UCM Core KO and JWCC UCM Core COR with a detailed after-action report for all Service Incidents within seven days of resolution of the Service Incident to allow the Government to understand the Service Incident’s root cause, impact, and appropriate follow-on actions are reported by submitting CDRL A005, “Incident and Vulnerability Reports.”

6.2.2.6. The Contractor shall provide a service health dashboard at each offered classification level and IL, allowing JWCC UCM Core users, the JWCC UCM Core COR, and TO CORs to determine the status of provided services. This dashboard shall be human and machine-readable and shall include, at a minimum:

6.2.2.6.1. The operational status of services

6.2.2.6.2. The current and historical information regarding Service Incidents:

6.2.2.6.2.1. A description of the nature of the Service Incident;

6.2.2.6.2.2. The severity level;

6.2.2.6.2.3. A mechanism to allow JWCC UCM Core users to be automatically notified of Service Incidents.

6.2.2.7. Number of Data Centers

6.2.2.7.1. At the time of award, the Contractor’s JWCC UCM Core CSOs shall operate within no fewer than two physical data centers, within the Customs Territory of the U.S., as defined in FAR (Federal Acquisition Regulation) 2.101.

6.2.2.7.2. The Contractor’s JWCC UCM Core CSOs shall, no later than 18 months after contract award, operate within no fewer than three physical data centers within the Customs Territory of the U.S., as defined in FAR 2.101. Extensions to the timeline described in this requirement must be requested by submitting CDRL A006, “JWCC UCM Core Exception/Extension Request,” and subsequently approved by the JWCC UCM Core KO.

6.2.2.7.2.1. At least two of the three physical data centers shall be geographically dispersed by at least 400 miles, as measured radially and shall utilize separate power grids or interconnections, as defined by the Office of Electricity within the U.S. Department of Energy.

6.2.2.7.3. Classified (both Secret and Top Secret) data centers may be co-located, if the Classified data center meets Facility Clearance (FCL) requirements pursuant to Attachment J-2, “JWCC UCM Core DD254,” and in accordance with applicable requirements of the DoD CSP SRG, ICD 503, ICD 705, and as determined by the CSO’s authorization.

6.2.2.7.4. All provided data centers shall strictly comply with applicable requirements of the DoD CSP SRG or ICD 503 and ICD 705, as determined by the CSO’s authorization.

6.1.3. SUBTASK 3 – GLOBALLY ACCESSIBLE

The Contractor shall provide CSOs that are securely accessible worldwide (via points of presence on all continents, except Antarctica) employing geographically diverse infrastructure and rigorous compliance frameworks at all offered classification levels and ILs, including DDIL environments, and Closed-Loop Networks.

6.2.3.1. The Contractor’s JWCC UCM Core CSOs shall be securely accessible worldwide via the JWCC UCM Core Console, at all offered classification levels and ILs.

6.2.3.2. The Contractor’s JWCC UCM Core CSOs shall provide assured access and enable interoperability among Virtual Enclaves that host applications and data.

6.2.3.3. The infrastructure providing communications for the Contractor’s CSOs shall support a total bandwidth capacity of at least 40 gigabits per second, utilizing redundant links, to peer with the DoD on each continent.

6.2.3.4. If the DoD adds new locations, the Contractor shall establish peering with the DoD within 12 months of notification, such that the latency between the Contractor’s and the DoD’s locations is less than eight milliseconds. The Contractor shall report peering with new DoD locations by submitting CDRL A008, “Ad Hoc Reporting/Information Products.”

6.1.4. SUBTASK 4 – SELF-SERVICE

The Contractor shall provide self-service capabilities which enable rapid development and deployment of applications and capabilities available from the JWCC UCM Core Service Catalog.

6.2.4.1. The Contractor shall provide a JWCC UCM Core Console with GUI, CLI, and API where authenticated JWCC UCM Core users can deploy approved applications, capabilities, and Services available from the JWCC UCM Core Service Catalog (see section 6.2.11, “Subtask 2 - JWCC UCM Core Console”).

6.2.4.2. The Contractor shall provide a Contractor’s Cloud Information Portal enabling authenticated DoD and JWCC UCM Core users to access the JWCC UCM Core Console and obtain information about the Contractor’s JWCC UCM Core products and services.

6.2.4.3. The Contractor shall provide the following information by submitting the JWCC UCM Core Ordering Guide Inputs annex of CDRL A001, “Contract Management”:

6.2.4.3.1. The process for establishing initial cloud accounts and cloud environments;

6.2.4.3.2. Contractor’s PoC information (name, title, email, phone) for contracting-related issues;

6.2.4.3.3. A link to the Contractor’s Calculator at each offered classification level and IL for Independent Government Cost Estimate development;

6.2.4.3.4. Link to the Contractor’s Cloud Information Portal;

6.2.4.3.5. Any specific process the Contractor may have to request Edge Devices and Services;

6.2.4.3.6. Any specific process the Contractor may have to request Cloud Support Packages.

6.2.4.4. Contractor’s Calculator

6.2.4.4.1. The Contractor shall provide a Calculator that reflects contractually accurate price modeling and projection, enabling authenticated DoD and JWCC UCM Core users to properly estimate and forecast cloud spending on cataloged services for budgetary planning.

6.2.4.4.2. The Contractor’s Calculator shall be available separately within each offered classification level and IL.

6.2.4.4.3. The Contractor’s Calculator shall default to show JWCC UCM Core Services in the classification where it was invoked.

6.2.4.4.4. The Contractor’s Calculator shall be behaviorally and visually consistent at each offered classification level and IL, such that it provides a consistent “look and feel.”

6.2.4.4.5. The Contractor’s Calculator shall allow filtering and selecting any single JWCC UCM Core Service or any combination of JWCC UCM Core Services offered at any classification level and IL for cost estimation.

6.2.4.4.6. The CSP shall make every reasonable effort to include Third-Party Offerings on the Contractor’s Calculator. The Contractor’s JWCC UCM Core Service Catalog or Contractor’s Cloud Information Portal shall provide a link to cost information about Third-Party Offerings that are not listed in the Contractor’s Calculator. Third-Party Offerings available on the JWCC UCM Core Service Catalog are not required to be integrated with the Contractor’s Calculator.

6.2.4.4.7. The Contractor’s Calculator shall enable users to compute and present projections to support long-term planning (minimum 12 months).

6.2.4.4.8. The Contractor’s Calculator shall provide users with the ability to select time frames (e.g., month, quarter, year) and allow for custom time frames (e.g., Q1 FY 28 to Q2 FY 30, October 2028 to January 2030), enabling accurate long-term budgeting.

6.2.4.4.9. Estimates developed using the Contractor’s Calculator shall be made available in various formats, including, but not limited to, on-screen, an image report (e.g., portable document format (PDF) document), portable tabular-data format (e.g., spreadsheet or CSV document), and exportable/downloadable in a machine-readable format that clearly breaks down the pricing by line-item for further analytical processing, including by other tools used for analysis and comparison purposes.

6.1.5. SUBTASK 5 – SERVICE PARITY

6.2.5.1. The Contractor shall provide CSOs and Services that operate Substantially Like corresponding commercial services across all offered classification levels and ILs, including GUIs, CLIs, and APIs. Exceptions, including, but not limited to, service gaps, degraded features, regional limitations, or roadmap-only capabilities that could limit mission-owner portability must be identified and requested by submitting CDRL A006, “JWCC UCM Core Exception/Extension Request,” and subsequently approved by the JWCC UCM Core KO.

6.2.5.2. Pricing for services must be at or below commercial pricing.

6.1.6. SUBTASK 6 – SERVICE DELIVERY REQUIREMENTS AND TIMELINES

The Contractor shall provide all DoD-authorized CSOs and Services for Government consumption at all offered classification levels and ILs at the time of contract award. The CSOs and Services shall be identified within the JWCC UCM Core Service Catalog, discernible by classification level and IL.

The requirements in this section are the minimum capabilities, conditions, or attributes of JWCC UCM Core. All requirements are subject to the service delivery requirements and timelines outlined in this PWS and are commensurate with their classification level, unless otherwise specified.

6.2.6.1. Additional CSOs shall be provided within 30 days of authorization for DoD use at their authorized classification levels or ILs.

6.2.6.2. Special Access Program. The Contractor shall support securely operating SAP workloads in offered classified environments and shall provide all necessary documentation and artifacts to the cognizant SAP Authorizing Official (AO) within 12 months of contract award, such that the DoD will have the ability to complete SAP missions using Contractor-provided JWCC UCM Core Offerings, pursuant to DoDD 5205.07, DoDM 5200.01, and the JSIG.

6.2.6.3. Cross-Domain Solution. When CSOs are provided to the JWCC UCM Core Contract in multiple classification levels or ILs, the Contractor’s JWCC UCM Core CSOs shall be capable of cross-domain data transfer from low to high (from a lower impact/classification level to a higher impact/classification level) for both the Management Plane and Production Plane and high to low (from a higher impact/classification level to a lower impact/classification level) for the Production Plane, as follows:

6.2.6.3.1. All CDSs provided must be in compliance with the versioning requirements described in "Cross-Domain Solution Design and Implementation Requirements: 2023 Raise the Bar Baseline Release", version 5.1 or later if superseded, and be authorized by the DoD Information Security Risk Management Committee (ISRMC).

6.2.6.3.2. The Contractor shall provide a CDS or leverage an authorized CDS that supports cross-domain data transfer from low to high (from a lower impact/classification level to a higher impact/classification level) between classification levels and ILs on the Management Plane to ensure the Contractor can securely migrate security updates to higher classification domains in a timely, consistent, repeatable, and secure manner, and maintain service parity. This CDS capability shall be delivered in conjunction with the associated classified infrastructure and JWCC UCM Core CSOs.

6.2.6.3.3. The Contractor shall provide a CDS or leverage an authorized CDS that supports cross-domain data transfer between all classification levels and ILs on the Production Plane, enabling seamless transfer of Government data, including for DevSecOps. This CDS capability shall be submitted to the DoD ISRMC for authorization within 180 days after the delivery of the associated classified infrastructure and JWCC UCM Core Offerings.

6.2.6.3.4. The Contractor shall provide a CDS or leverage an authorized CDS that supports cross-domain data transfer from high to low between all classification levels and ILs on the Production Plane, enabling Government data transfer needs. This CDS capability shall be submitted to the DoD ISRMC for authorization within 180 days after the delivery of the associated classified infrastructure and JWCC UCM Core Offerings.

6.1.7. SUBTASK 7 – EDGE DEVICES AND SERVICES

The Contractor shall provide first or third-party Edge Devices and first-party Edge Services that are available under the JWCC UCM Core Contract across the range of military operations, balancing portability, capability, and cost.

6.2.7.1. Edge services must be securely deployable worldwide including DDIL environments.

6.2.7.2. Offered Edge Services may include devices that host capabilities at the Operational or TE.

6.2.7.3. The Contractor shall provide specifications describing how the offered Edge Devices meet the following requirements by submitting CDRL A009, “Edge System Processes and Documentation,” and conducting applicable tests as prescribed by the latest Military Standard (MIL-STD)-810, U.S. Department of War Test Method Standard, Environmental Engineering Considerations and Laboratory Tests, at the request of the Government:

6.2.7.3.1. Electromagnetic (EM), acoustic, thermal, and any other device-specific emanations in all operational states to enable the Government to control the magnitude of these signatures.

6.2.7.4. The contractor shall provide Virtualized desktop capabilities and graphics processing units (GPUs) to enable AI workloads at the Edge. Exceptions to this requirement must be requested by submitting CDRL A006, “JWCC UCM Core Exception/Extension Request,” and subsequently approved by the JWCC UCM Core KO.

6.2.7.4.1. Seamless operation across network connectivity levels, including DDIL environments, at all offered classification levels and ILs.

6.2.7.4.2. Functionality in DDIL environments, as if connected, with the only features and functionality missing being those that rely on real-time interconnection services.

6.2.7.4.3. The ability to configure and manage any Services deployed or provisioned on or to the Edge Device and operate using local resources.

6.2.7.4.4. Configuration allowing a JWCC UCM Core user to set the parameters for synchronization with Contractor-provided services, including, at a minimum, the ability to control the priority order, and the…