JARVISS_DRAFT_PWS_15NOV2024.pdf

PERFORMANCE WORK STATEMENT

JOINT ANALYTIC REAL-TIME VIRTUAL INFORMATION

SHARING SYSTEM (JARVISS)

15 November 2024

1.0 OBJECTIVE:

The objective of this non-personnel services contract is to secure continued services for the Joint Analytic Real-time Virtual Information Sharing System (JARVISS) in support of the U.S. Army Antiterrorism (AT) Program and other Department of Defense (DoD) users.

The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government. The Contractor has no decision authority over the Government; the services and tasks outlined within the PWS are not inherently governmental functions.

1.1 Background:

The U.S. Army, Office of the Provost Marshal General (OPMG) seeks to continue software licensing renewal agreements, operations, maintenance, and sustainment support for the Commercial-Off-The-Shelf (COTS) threat information sharing tool for use in their antiterrorism (AT), protection, law enforcement (LE), and other supported missions. This requirement shall also provide for application patches, enhancements, security resolutions, training, and help desk services. The JARVISS System provides real-time threat information-sharing capabilities across the Army Enterprise and with DOD and other government partners. This web-based application provides a customized configuration provided solely to the U.S. Government hosted on an approved Government cloud solution (further defined in later paragraphs).

1.1.1 The JARVISS System enables DOD installations, command headquarters, stand-alone facilities (SAFs), and the AT/FP and LE communities to receive real-time unclassified threat information as attacks/incidents unfold.

1.1.2 JARVISS enhances the Army/DOD’s information-sharing capabilities by standardizing baseline threat information-sharing policy and operations, and allows users to view common threat information and references before, during, and after an incident.

The real time reporting of threat information shall be available through both a web log-in and a mobile application to all licensed users. The mobile application shall be accredited for use on Government phones and shall be available on DOD Application stores as specified in para.2.7.2. Additionally the applications shall be available through the Apple App Store and Google Play for personal phones

1.1.3 JARVISS increases the Army’s threat assessment and analysis capabilities. The Army’s threat analysis, assessment, and synthesis capabilities are enhanced through better integration and timely sharing of relevant unclassified threat data between DOD agencies and organizations.

1.1.4 JARVISS enhances the Army’s ability to receive and catalog suspicious activity reports from the community and improves threat collection to allow investigative and preventive actions that deter or detect possible threat actions before they occur.

JARVISS also improves threat analysis to identify trends and provide link analysis related to suspicious activity reports received from the community.

2.0 SCOPE OF WORK:

This Performance Work Statement (PWS) establishes requirements to provide for software license renewals, operations, maintenance, and sustainment support for the JARVISS application.

2.1 Task 1 – System Operations and Maintenance Support - Army The Contractor shall provide licenses for 1,800 full users, 10,000 basic users, 50 concurrent users, and 700 administrator licenses.

2.1.1 The Contractor shall provide user licenses that allow for the following permissions/rights levels:

2.1.1.1 Full User License – Provides access to all of the functions available within the system to include, but is not limited to, threat notification, incident management, threat reporting, real- time communications, data set analysis, link analysis, social media reporting, asset assessment, JARVISS 360 and, both JARVISS 360 mobile applications (360 and ManageBridge). A full user shall have the ability to configure the user dashboard to meet specific requirements.

2.1.1.2 Basic User License – Access to incident management and threat reporting to include the ability to submit reports. Has the ability to receive threat notifications, incident reports, and real-time communications at a minimum with the use of a desktop system or the JARVISS 360 mobile application. A basic user shall automatically receive pop-up messages, mobile application notifications, and e-mail notification of threat information.

2.1.1.3 Concurrent User License – Access to the system by an organization that requires more than one user to log in to the system on the same account. A concurrent user license shall have all of the features available to a full user. The concurrent license shall be set-up for access using an Alternative Smart Card Login (ASCL) token.

2.1.1.4 Administrator – Users with administrative rights to the system shall have a full user license with the ability to authorize new user accounts, delete old accounts, lock/unlock accounts, and delete posted content. Additionally, the administrator shall have the ability to audit accounts and retrieve an activity report for users.

2.1.1.5 System Usage: The system shall allow for simultaneous use by 100% of the licensed amount of registered users at any given time.

2.1.1.6 The Contractor shall ensure user accounts are able to be immediately authorized by an administrator.

2.1.1.7 The Contractor shall ensure users can access the site from personal and Government computers and smartphones using the Windows, Android, or IOS operating systems.

2.1.1.8 The Contractor shall ensure the system provides a prompt/notification to turn on location settings when the system is in use on a mobile platform.

2.1.1.9 The Contractor shall ensure that the user location is selectable, allowing two locally configured data streams to include a user’s home station and their current location while traveling.

2.1.2 The Contractor shall maintain knowledge of the software or website requirements, functional allocations, design environment, and component structure sufficient to maintain and modify the application, release of software to address all change requests, deficiency reports, field generated enhancements, and changes as required by the Government Program Manager. The Contractor shall be required to provide analysis and recommendations to support the modification, expansion, or integration of the application in an effort to meet emerging DoD, Army, law enforcement/security forces functional and/or technical requirements.

2.1.3 The Contractor shall continually monitor the system (to include the mobile application) to ensure everything is functioning correctly. The Contractor shall conduct preventative and routine maintenance as required. Any scheduled maintenance affecting system operation will require notification (24 hours in advance) to all users before it is performed.

2.1.4 The Contractor shall notify the Army Contracting Officer’s Representative (COR) of any concerns related to the continued operation of the system, such as system degradation, lag, and unscheduled downtime. Routine system maintenance will be coordinated in advance and must be approved by the Army COR. The Contractor shall ensure that the website and mobile platforms remain at full operational capability to promptly report any security issues or threat information that may arise in real-time.

2.1.5 The Contractor shall be responsible for providing Help Desk support to users worldwide. Help Desk business hours shall be 24 hours a day/7 days a week, 365 days a year. The Contractor shall maintain a call and e-mail log to identify types of requests and the installation and/or office the request is from. An electronic log shall be maintained and shall be accessible to the JARVISS Program Manager.

2.1.5.1 The Contractor shall provide and maintain a Help Desk and Quality Assurance team knowledgeable in the operations of the system. The Contractor shall deliver technically knowledgeable personnel with system experience to handle inquiries, training, and immediate resolution of customer issues, or be efficient enough to document in detail the issues to allow a technician or developer the capability to correct, test, and develop a fix.

2.1.5.2 Minor issues (e.g., specific user issues, inability to pull data, data refreshing delayed) shall be addressed within 24 hours (1 business day) of receipt; however technical fixes of a more substantial nature (e.g., customized system configuration resets to the default setting, major loss of historical data) shall be fixed within three

(3) business days. When extensive fixes or system changes are required, necessitating time to study, develop a solution, code in and test the fix, and make release of the final product, the customer will be immediately notified of the problem and be provided an estimated date of completion.

2.1.5.3 The Contractor shall IAW established industry standards, minimize any downtime to the customer and immediately notify all user activities when an emergency fix is required and the duration of the anticipated fix, develop and maintain a schedule of maintenance requirements, and immediately upon discovery provide advance notification of anticipated downtime.

2.1.6 The Contractor shall coordinate all future system changes with the Government prior to implementation - the COR must approve the change (Note: Any/all changes that affect the requirement stated on contract must be approved in advance and the contract modified, by the Contracting Officer, prior to any implementation).

2.1.7 The Contractor shall maintain all system interfaces required to keep applicable modules operational.

2.1.8 The Contractor shall implement access control features such as access permissions in accordance with applicable Federal, DoD, and Army regulations and policies.

2.1.9 The Contractor shall develop specific DoD user guides and reference functions available 24/7 on-line. The Contractor shall modify user manuals and training manuals in accordance with changes resulting from updates to the systems web and/or mobile applications.

2.1.10 The Contractor shall maintain the system at a 99% reliability rate, reliability meaning the system is up and functioning as intended for 99% of the time. Reliability rate of the network upon which the software is hosted is outside the bounds of this contract. The system shall be hosted on a government-approved web hosting (cloud) service with built-in redundancies (further defined in later paragraphs).

2.1.11 The Contractor shall standardize the implementation of the system for use across Army/DOD installations and stand-alone facilities (SAF), but allow for local customization by full, concurrent, and admin users.

2.1.12 The Contractor shall deliver services to ensure system security and integrity as there may be data elements subject to the Privacy Act or categorized as Controlled Unclassified Information (CUI). All information provided to the Government is henceforth owned by the Government and its disposition is at the discretion of the Government.

2.1.13 The Contractor shall provide the capability within the system to allow full users to locally save an incident report for later analysis and reporting requirements.

The system itself shall have the ability to archive significant events and save data for pattern analysis as well as historical analysis. Data shall be stored for at least five (5) years for standard data and up to ten (10) years for significant data relevant to future analysis. Note: Some LE data and other data may be limited to a shorter timeframe based on applicable laws, orders or regulations.

2.1.14 The Contractor shall provide a system that includes utilizing passwords and User IDs and use of the DoD Common Access Card (CAC) for logging in to the system.

2.1.15 The Contractor shall provide a user registration process that requires users to identify their command hierarchy as well as their geographic hierarchy (i.e.Combatant Command (COCOM), Army Service Component Command (ASCC), Region, State, Installation, and Unit/Stand-Alone Facility).

2.1.16 The Contractor shall provide Government system administrators with the ability to pull a roster of current and/or past users based on user hierarchy. The roster will include date/time of last log-in. A full query of user logins and activity can be made by the administrator with printable options.

2.1.17 The Contractor shall implement proposed system alterations as prioritized by the Government. All systemic improvements to the system are considered sharable with all licensed users unless specific to the Government system.

2.1.18 The Contractor shall work with the Government to update the Concept of Operations (CONOP) when needed. The CONOP shall be reviewed annually and updated at least every 3 years or sooner if required.

(See Contract Data Requirements List – Exhibit B001, DI-MGMT-80061A).

2.1.19 The Contractor shall maintain a unique splash page as required for DoD information systems. The page will feature all applicable warnings required and will have the statement that the following website is restricted to authorized U.S. Government users.

2.2 Task 2 - General System Requirements

The Contractor will work with the users to ensure the system is delivering data as intended and will provide recommended courses of action for improvements in use and customization.

2.2.1 The Contractor shall provide the capability to facilitate real-time sharing of threat information as events/incidents unfold. Threat information is defined as: Any activities that pose a danger, hazard, or risk of harm to personnel, resources, installations, and facilities. This can include but is not limited to: extreme weather, natural disasters, criminal activity, domestic/international terrorist threats, terrorist and extremist activities, insider threats and other activities that threaten the survivability and mission accomplishment of military personnel, civilian employees, family members, contractors and units. In addition, the system will highlight other information of interest as configured by the specific user/location.

2.2.2 The Contractor shall configure the system to display all critical data (e.g., type, time/date, and location) of specific event/incidents (e.g., suspicious activity, suspicious object, suspicious substance, bomb threats, chemical incident, explosion, hazardous incident, power outage, radiological incident, transportation incident). Historical data shall be immediately retrievable for reference.

2.2.3 The Contractor shall provide the capability to provide geo-referenced data of threats and suspicious activity reporting through a web mapping service (e.g., Google Maps®, Bing® OpenGIS®). This mapping service shall provide both a satellite overlay function and a map function that can be combined or clicked between. The maps will include the location of key Government facilities to include but not limited to schools, police stations, hospitals, and fire departments. Map data shall be updated with the most recently available commercial satellite overlays and road map information.

2.2.4 The Contractor shall provide the ability for organizations (e.g., command HQs, installations, and stand-alone facilities (SAFs)) to specify the types of threat or other information to receive that is within their area of interest.

2.2.5 The Contractor shall provide the capability for organizations to configure their own business rules for, but not limited to, pop-up/mobile application/Email notification and the ability to create and edit groups of users.

2.2.6 The Contractor shall provide the capability to feed-in and extract threat data from current and future Government and commercial data bases (e.g. Computer Aided Dispatch (CAD), Army Mapper, Homeland Security Infrastructure Program (HSIP) Gold, Web Emergency Operations Center (EOC), Open Source Center (OSC) without collecting and/or storing Personal Identifiable Information (PII) data unless the proper certifications are in place and storage is requested by the Government.

2.2.7 The Contractor shall provide the capability to feed-in and extract information from various social media (e.g., Twitter®, Facebook®, Reddit®, etc.),and future public social media sources as they become available.

2.2.8 The Contractor shall provide the capability to feed-in and extract information from various open-source and Government data layers. These data layers may include but are not limited to: Airline Flight Statistics, Businesses (locations and information), Chemical Facilities (locations and information), Consumer Attractions, Country Risk Score, Cyber Attacks, Geography, Ports (locations and information), Proximity Reports, Ship Movements (5‐Yr Historic, Satellite, Terrestrial), Significant

Dates, Socio‐Demographics, Terrorism (Historical), Traffic (Real‐Time), U.S.

Embassies (locations and information), and Weather (Current/Forecast/Radar/Severe).

2.2.9 The Contractor shall provide the capability to feed-in and extract information from various open-source and Government Telecommunications and Energy related data layers. These data layers will include but are not limited to:

Telecommunications - Dialing Data, International Telecom Traffic, Internet Geography, Internet Service Providers, IP Addresses, Submarine Cable, Telecom Market, Wi-Fi Hotspots, Wireless Coverage, and Television News (Domestic and Foreign) and Energy - Crude Oil Pipelines and Facilities, Electric Charging Stations, Emissions, Gas and Power Facilities, Gas Storage, Liquefied Natural Gas (LNG) Terminals, Natural Gas Infrastructure, Offshore Rigs, Oil Refining Facilities, Power Plants, Tank Terminals, and Wind Farms.

2.2.10 The Contractor shall provide the capability to display locations of unclassified fixed Army/DOD installations and facilities (e.g., CONUS and OCONUS), contact information for AT Officers, the Provost Marshal’s Office (PMO), Director of Emergency Services (DES), Army Commands (ACOM), Army Service Component Commands (ASCC), Direct Reporting Units (DRU), Army National Guard (ARNG), U.S. Army Reserve (USARC) and command operations centers (or equivalent) listing and basic identifying information (organization name, organization address, contact information). Contact information shall be updated on a quarterly basis at a minimum.

2.2.11 The Contractor shall provide the capability to integrate and visually display infrastructure information geospatially, temporally, and by priority with identification and contact information.

2.2.12 The Contractor shall ensure the system will support the ability to integrate external provided geomatics material. Maps must be interactive, allowing users to geo-locate incidents/events, resources, facilities, and other critical information, as well as retrieve detailed information on pre-existing incidents, resources, and infrastructure. Maps must be dynamic, updating automatically as new incidents are added or refreshed.

2.2.13 The Contractor shall provide the capability to import and export common Geographic Information System (GIS) file formats to include Keyhole Markup Language (KML) and must be Open Geospatial Consortium (OGC) compliant.

2.2.14 The Contractor shall ensure the system is compliant with DoD and Government requirements and that any cloud service used is also compliant.

Cloud Service Providers (CSPs) doing business with federal agencies should review the Security Assessment Framework and Guide to Understanding FedRAMP. They should also become familiar with FedRAMP’s four process areas: Document, Assess, Authorize, and Monitor, which align to the NIST Risk Management Framework (RMF) covered in NIST SP 800-37. Once familiar with the requirements, CSPs should complete a FedRAMP Initiation Request and follow one of three paths for achieving an authorization: Joint Authorization Board (JAB) Provisional Authorization (P-ATO), Agency Authorization, or CSP Supplied Package.

2.2.15 The Contractor shall ensure the application is capable of being accessed from Government and DoD systems without any loss of functionality. System features, add-ons, audio, and video features must be configured to operate smoothly on all networked Government computers.

2.2.16 The Contractor shall ensure the system is joint interoperable, meaning that it is capable of being shared with other services and other members of the law enforcement or intelligence communities. The Government will reserve the right to share its licenses with these groups for coordination of efforts at the local level.

This should include the ability for login to the IL2 system from non-DOD networks.

2.2.17 The Contractor shall ensure the system has a separate, unique log-in portal specific to law enforcement that is capable of storing and sharing law enforcement data. This portal should be capable of communicating with the regular site for reporting, incident management and normal communication, but the law enforcement portal will be the only site capable of storing, accessing, or sharing law enforcement sensitive data.

2.2.18 The Contractor will provide a representative that can provide a demonstration and briefing on the system at any required Government engagements in support of program objectives.

2.3 Task 3 - System Functional Requirements

2.3.1 Threat Sharing/Information Requirements.

2.3.1.1 The Contractor shall provide the capability to facilitate real-time sharing of threat information. Real-time is defined as forwarding of threat information within 90 seconds (or less) of the information reaching any of the used data sources or data layers. The information shall provide a pop-up notification for incidents occurred, ongoing or imminent that involve serious harm to personnel or resources and/or severe damage or casualties.

2.3.1.2 The Contractor shall provide the capability to translate foreign web, radio and television media sources to pull additional threat information. The system should be able to translate spoken broadcasts and provide information based on the transcript data.

2.3.1.3 The Contractor shall provide threat and suspicious activity reporting include geo-referenced data in near-real time using standardized format compatible with Common Operating Picture (COP) systems.

2.3.1.4 The Contractor shall provide the capability to report multiple incidents/events concurrently and monitor for situational awareness. The contractor shall also provide users with a support tab to view common system information, incident management information and references.

2.3.1.5 The Contractor shall provide the capability to display the location of Government and commercial facilities and include basic identifying information (facility: name, address, and contact information).

2.3.1.6 The Contractor shall provide the capability for users to search critical information required to answer emergency response inquiries, such as chemical and biological inquiries through access to appropriate military/civilian systems.

2.3.1.7 The Contractor shall provide the capability to facilitate real-time sharing of threat information to a broad set of supported devices and data formats. This includes notifications using Lotus Notes, MS Outlook, as well as handheld devices such as smart phones and tablets.

2.3.2 Collaboration Tools Requirements.

2.3.2.1 The Contractor shall provide a chat capability between all users of the desktop application and mobile application. Access to the chat feature will be configurable by an administrator. A full system user shall be able to initiate the chat function with any basic user giving them chat capability until the session is terminated. The chat function shall additionally allow the creation of group chat sessions for collaboration and use during on-going incidents.

2.3.2.2 The Contractor shall provide the capability to allow users from across the enterprise to find other users from specific AORs/regions based on specific information (e.g., Government role, Government contact number, and Government address).

2.3.2.3 The Contractor shall provide the capability to support multi-user collaboration and online presence awareness.

2.3.2.4 The Contractor shall provide the capability to support on-going collaboration where users can share documents in folders and participate in threaded discussions over an extended period of time within the business rules established by the CONOP.

2.3.2.5 The Contractor shall provide support to full users who have questions related to the configuration of projects within the system. This help should be provided through the helpline or via e-mail.

2.3.3 Threat Information Management Requirements.

2.3.3.1 The Contractor shall provide the capability to present and update information on a standard and consolidated status display that includes capabilities such as active/recent incidents, and online users.

2.3.3.2 The Contractor shall provide the capability to display all critical data of specific event/incidents; incident data shall refresh every 1 minute at a minimum.

2.3.3.3 The Contractor shall provide the capability to allow users to link related incidents (e.g., update to one incident updates both or incidents combine;

option to view joint timeline; etc.) within the system for threat patterns or trend analysis.

2.3.3.4 The Contractor shall provide the capability to deliver access to information in an easily understood format and readily available for decision-makers based on their plans.

2.3.3.5 The Contractor shall provide the capability to integrate (import) information from multiple sources in their existing schema and format. The system allows to integration (i.e., import of) data from external systems solutions leveraging industry standard formats, such as .csv and .xls.

2.3.3.6 The Contractor shall provide the capability to document and capture information in a searchable, enterprise-level database, facilitate the exchange of information needed by decision-makers, automatically generate specific reports and post them to the appropriate location, and create shared event timelines.

2.3.3.7 The Contractor shall provide the capability to support the prototyping and deployment of ad hoc views of information and resources with ability to select data content and filters associated with the views. The ability to filter out repeat reporting of the same incident shall be a selectable option.

2.3.3.8 The Contractor shall provide the capability to filter data and to generate specific threat data sets and specific views of information and data based on an individual’s role within an organization or operation or their geographic location or upon specific criteria established by the local user.

2.3.3.9 The Contractor shall provide the capability to provide a variety of document control options and have the ability to make automatic updates to all shared reports. The system shall have the ability to generate specific locally formatted reports and command briefs based on the local users’ specific needs.

2.3.3.10 The Contractor shall provide the capability to generate both pre-formatted and custom reports based on XML and other standard formats; and present information in report or map/graphical formats. These reports will be able to be customized by command and will be able to be uploaded and shared within JARVISS

2.3.3.11 The Contractor shall provide the capability to extract information from specific Government reporting tools such as, but not limited to, iWatch Army and other DOD reporting platforms. The Contractor shall conduct all required coordination for access to these systems.

2.3.3.12 The Contractor shall facilitate a connection with the FBI e-Guardian program, where data uploaded into JARVISS can be pushed to the e-Guardian system. Upon approval by the Government Program Manager and FBI, JARVISS shall also be configured to ingest and store data provided from the FBI to JARVISS. This information shall be confined to the IL-4 environment and will not be shared outside of JARVISS.

2.3.3.13 The Contractor shall generate pre-formatted incident reports for all large incidents of interest as identified by the Army Threat Integration Center (ARTIC) and deliver those reports to the ARTIC for further analysis and dissemination.

2.4 Task 4 - Performance, Availability, and Reliability Requirements

2.4.1 The Contractor shall provide the capability to operate over a high-speed Internet connection, mobile /4G/4G LTE/5G, FirstNet, and future wireless networks.

2.4.2 The Contractor shall make every effort to meet the DOD Continuity of Operations (COOP) standards in accordance with DoDD 3020.26 and appropriate regulations. At a minimum the servers hosting the system shall have a reliable geographically separated back-up to ensure seamless continued operation.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/30202 6p.pdf

2.4.3 The Contractor shall provide the capability to replicate information between sites to support degraded modes of operation.

2.5 Task 5 - Maintenance and Support Requirements

The Contractor shall address any undiscovered system anomalies or required improvements (includes bug fixes, issue reporting and handling, and testing of code changes) in a timely manner, resolving minor issues within 72 hours and providing the government with an estimated completion date for any major problems requiring additional time within 24 hours. The Contractor shall review client and customer feedback and develop recommended designs for incorporation into each release. The Contractor shall present the designs to the sponsor for recommendations and shall include those recommendations, where feasible into the design before proceeding with development.

2.5.1 The Contractor shall coordinate any changes with the configuration of the main site or mobile application with the COR prior to implementation.

2.5.2 The Contractor shall provide the capability to provide a complete indexed http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/30202 and context-sensitive help function to assist users in performing system functions and procedures.

2.5.3 The Contractor shall provide the capability for users to print sections of the help page as required.

2.6 Task 6 – Training and Local System Configuration Requirements

2.6.1 The Contractor shall provide in-person and online user training (to include demonstrations) to current and future users of the system (approximately 1 demo and 3-4 training events per week).. Specific date, time, location, and approximate number of attendees will be coordinated with the Contractor no later than 30 calendar days prior to the required class start date. A report based on survey results will be required following each in-person training event (See Contract Data Requirements List – Exhibit E001- DI-MGMT-80257 and para. 2.6.4)

2.6.2 The Contractor shall be responsible for all aspects of the training to include the online training environment, files, charts, or materials required to conduct training, and hardware considerations including ensuring the workstations, internet connectivity, and mobile capability is available and functional. If the training will be held at a Government location, the Contractor is relieved of providing workstations, internet connectivity, and projection capability. The Contractor shall notify the Government, in writing, of any requirements needed to support the training. This notification shall be no later than 10 days following notification of the training requirement.

2.6.3 When the Contractor makes systemic changes including upgrades, performance drivers, or technical patches, command users shall be provided with technical documents and appropriate training. These products and trainings are to be provided either at the time of release, or in advance of that activity, with at least a 95% on-time delivery rate for materials and/or training, or both, in an effort to reduce or eliminate any lapse in capability.

2.6.4 The Contractor shall administer a course evaluation and feedback surveys to trainees and capture suggestions and recommendations from users for system enhancements. All recommendations and evaluations will be submitted to the COR for review at In Process Reviews (IPR) meetings set-up by the government. When training occurs, this requirement shall be deemed a deliverable.

2.6.5 The Contractor shall provide the capability to deliver full user, basic user, and administrator training for the system (e.g., user’s guide, embedded screen shots, videos and FAQ, and job aids). Training requirements and travel specified in paragraph 2.6.8.

2.6.6 The Contractor shall ensure the system interface is easy to understand with the availability of online training for new users and refresher training. In addition, a searchable list of frequently asked questions and answers for the system will be made available, allowing users to quickly get answers without accessing the full user’s guide.

2.6.7 The Contractor shall use embedded videos demonstrations of key system operations/procedures and ensure training materials are available for extraction for off-line training purposes.

2.6.8 The Contractor shall ensure well-qualified personnel travel to installations to conduct local system configuration and establish the local business rules for identified installations. Travel () will include CONUS and overseas (OCONUS) locations and contracted personnel will be required to possess a passport and meet all visa requirements for travel to specific countries. The Contractor shall provide trainers for all scheduled training events. Travel may involve travel to austere locations and could require immunizations or additional health precautions. The Government will provide sufficient time to allow for any required immunizations as well as visa and passport processing, based on average processing times.

2.6.8.1 This travel will be conducted in conjunction with a short training and system familiarization session.

2.6.8.2 Travel will include approximately 25 trips annually and may include locations outside of the United States (Estimated a maximum of 3 trips outside of the U.S./year). These trips will be used for system configuration or user training depending on the specific needs of the Government. Travel will require 1 or 2 personnel to be on-site for approximately 1 to 3 days (longer if overseas) at each location determined by the Government Program Manager based on the size/composition of the class. After local system configuration is complete at all sites, additional travel will be at the discretion of the Government.

2.7 Task 7 – Mobile Reporting Application

The Contractor shall provide a technical refresh of the mobile application migrating the backbone of the application to the FedRAMP Moderate and Impact Level 2-approved Critical Event Management (CEM) platform. The CEM platform will include a Mobile SOS button and Safe Corridor features that allow users to notify proper officials when they need help, or voluntarily check-in when they feel they are in a potentially dangerous situation. The mobile application shall also be capable of reporting suspicious activities from a mobile device. This application shall have basic functions to include a description of the activity, location, and the ability to attach pictures. The application will feed this info into the larger JARVISS system for analysis. This application should be capable of being shared with family and community members. Additionally the application will include a travel risk management function, crisis management coordination and other features to enhance DOD response to events.

2.7.1 The Contractor shall add additional reporting buttons to the mobile application to include reporting for Sexual Harassment and Assault Reporting (SHARP), Unsafe Conditions, and Harmful Behaviors reporting that will be developed to follow local installation or facility workflows.

2.7.2 The Contractor shall work with Army CIO/G-6 and DISA to initiate full accreditation of the Mobile Applications and Desktop Applications for JARVISS 360 and ManageBridge. The Mobile Applications should be accredited/certified for DOD phones in the DISA app store, MDM enclave and FirstNET (for all MILDEPS) as well as various other certifications needed for broader JARVISS 360 adoption.

2.7.3 The Contractor shall provide 45,000 contacts (facilities and personnel) for the JARVISS 360 Application and Mobile Applications to facilitate fielding to standalone facilities and users.

2.8 Task 8 – Trip Reports and Meeting Minutes Requirements

During the execution of each active task, contractor personnel traveling or attending meetings, conference calls, VTCs, and other similar interactions, shall upon the conclusion of these meetings produce trip report, notes and/or meeting minutes from the event within five working days documenting the event and providing recommendations for future activities and actions. (See Contract Data Requirements List – Exhibit F001, DI-ADMN-81505).

2.9 Task 9 – System Modification

The Contractor shall be capable of making changes to database structure, processes, interfaces, tables and/or other elements of the system to accommodate policy/operational changes that necessitate modification to the system to meet functional requirements as requested by the Government. Any contract modification requests will be submitted to the Contractor by the Contracting Office to allow the Contractor time to evaluate the scope of the requested modification and to provide a proposal (if required).

Absolutely no changes that affect the requirement as stated on contract shall be started or implemented prior to Contracting Officer approval.

2.9.1 The Contractor, upon Government approval, shall design and implement the identified modification. All changes shall be documented via the JARVISS product baseline. All modifications shall be tested and validated to the Government’s satisfaction (in a stage environment) prior to being introduced to the JARVISS production system.

2.9.2 The Contractor shall upon award, begin planning efforts for the integration of Automated Installation Entry (AIE) and Computer Aided Dispatch (CAD) data to the platform.

2.10 Task 10 – Social Media Direct Alerting

The Contractor shall provide an enhanced social media reporting feed with an emphasis on speed to notification. This feed will allow all full, concurrent, and administrator users to share and provide updates to the incident.

2.11 Task 11 – Sand Table/Exercise Mode

The Contractor shall maintain an Exercise mode within the JARVISS platform which will allow users to conduct training and exercises without interfering with the live system. The Sand Table/Exercise Mode will allow geographically separated users the ability to update and use the system with all available data layers and incident reports in a segregated version of the system. The training/exercise coordinator will be able to select/invite participants and lock participation. After completion of an exercise/training session, users will have the ability to save the session.

2.12 Task 12 – U.S. Air Force and U.S. Space Force

The Contractor shall provide the AF and USSF with licenses to JARVISS for use as a common operating picture. The AF/USSF will have licenses for 24 full users, and 9 administrator licenses. The AF/USSF will also require two in-person training sessions held in the CONUS.

2.12.1 JARVISS 360 Licenses & Support Services.

The Contractor will provide JARVISS 360 licenses for the Air Force and Space Force. This includes licenses for existing users under AFMC and AFNORTH, and adds additional licenses for AFRL and the 88th Security Forces Squadron. The contractor will also provide support services to include implementation, training and support for exercises. The contractor will also be required to travel as needed to support events and exercises.

Licenses required are:

• Users: 73

• Contacts and Assets: 1850

• Travel Protector Licenses: 50

2.13 Task 13 – Dashboard & Analytic Enhancements

The contractor shall continue to support and expand the dashboard and data visualization enhancements to further improve upon the Threat Information Management capabilities as outlined in task 2.3.3. The dashboard capability will further enhance Army’s threat analysis, assessment, and synthesis capabilities by presenting a simplified and summary view of relevant threat Incident data, metrics and trends. The dashboard will be capable of synthesizing data at the command and site (Base, camp, fort, garrison, post, station) organization levels and will allow users to compare data between organizations. Following the initial development of a dashboard to support the law enforcement user community an additional risk analytics dashboard will be developed with expanded data sets to aid the Protection community. The dashboard must be capable of consuming additional data sets that provide additional context. Datasets include but are not limited to; crime data, risk events, weather, sensor data and other data sets. The dashboard will be accessible from the JARVISS user interface and all software and data will be contained within the JARVISS IL4 AWS cloud.

2.13.1 Dashboard coordination

The contractor shall continue to work with all Army and DOD stakeholders on the development of data-centric dashboard common operating pictures. This will include continued coordination with the Johns Hopkins University Advanced Physics Lab, the US Army Corps of Engineers and Army DEVCOM on AI2FP, VTIME, FirstNet and other associated efforts.

2.14 Task 14 – RMF 2.0, CONMON, ECMA SaaS Registration

The contractor shall conduct all required tasks to comply with the Risk Management Framework 2.0, Continuous Monitoring (RMF 2.0/CONMON) processes for maintaining a compliant cybersecurity environment. JARVISS is no longer required to migrate to Cloud Army (cArmy), now that it has ben registered and approved as a Software as a Service (SaaS) application with ECMA.

The JARVISS 360 application will maintain a FedRAMP Moderate ATO, in addition to pursuing and achieving Impact Level 4 (IL4). Target date for IL4 development completion is the end of calendar year 2025 with ATO review to follow. The contractor will register the existing JARVISS 360 application with ECMA as a SaaS in preparation for IL4 ATO.

2.15 TASK 15 - JARVISS Technology Refresh

The contractor will provide JARVISS users with licenses to the Everbridge CEM Platform to expand the suite of capabilities provided to the Army under the JARVISS program. The application, currently referred to as JARVISS 360 under this contract, will provide users with control over how information is disseminated and operationalized. It will also provide enhanced reporting and planning capabilities. JARVISS 360 will also provide collaboration and communications capabilities to further enhance information sharing, situational awareness and coordination around identified threats. The platform will also provide users with the ability to load travel itineraries into the system so users have enhanced situational awareness and alerting on dynamic assets in their command or area of responsibility. The contractor will provide the Army with documentation detailing these capabilities inherent in the software and how they align with the task objective.

2.15.1 JARVISS 360 Licenses

The Contractor will provide the following licenses to support the initial phases of JARVISS 360 fielding for the US Army:

• 500 Users

• 45,000 Contacts and Assets

• 200 Traveler Protector Licenses

2.15.2 Establish JARVISS 360 Baseline Capabilities

The contractor will perform the following tasks to implement an initial baseline set of

JARVISS 360 capabilities for each command to include general user and admin training, asset, group and contact management, establishing communications templates, alerting workflows and alert management.

2.15.3 JARVISS 360 Implementation & Training Support

The contractor will collaborate with current and future commands to deliver JARVISS 360 tailored to each command's specific use cases. The initial implementation will involve creating a comprehensive onboarding project plan that includes assistance in establishing the baseline set of capabilities at a minimum. The contractor will prepare each command and user by providing a ‘train-the-trainer’ model enabling them to effectively leverage JARVISS 360 capabilities.

2.15.4 Ongoing Support for JARVISS 360:

Following implementation, the Contractor will continue to support each command in maximizing JARVISS 360's capabilities beyond the established baseline. This ongoing support will include regular virtual training to accomplish system reviews, updates to configured workflows as threat landscapes evolve, and on-demand assistance to troubleshoot issues and optimize system performance. The Contractors will also provide additional training sessions as needed to ensure sustained adoption, encourage user proficiency, and enhance incident response strategies across the commands.

2.16 Task 16 – Future Mission Partners

The contractor will provide the Army with a series of predetermined packages for JARVISS and JARVISS 360 licenses and support services to support the addition of future mission partners to the contract. Contractor will provide a series of packages such as “small, medium, and large” to accommodate a variety of different agencies or commands.

3.0 Contract Management

3.1 Project Manager

The Contractor shall identify a Project Manager to oversee Contract execution and ensure all goals and objectives are met within the terms of the contract. The Contract Project Manager shall be responsible for the overall task planning, execution, control and quality; spanning technical, schedule, cost, and contract, for Contract fulfillment. The Contract Project Manager shall serve as the primary point of contact with the Government and shall have full authority to make binding commitments on behalf of the Contractor. The Project Manager shall have the ability to obtain a U.S. SECRET security clearance; and the ability to travel to U.S. and overseas locations. The Project manager shall have the following qualifications at a minimum: B.A./B.S. from an accredited university; familiarity with Army structure, mission, and command hierarchy; proficient at public speaking, writing reports and statistical analysis; intimate understanding of the capabilities, functions and limitations of the system; and the ability to travel to U.S. and overseas locations.

(See Contract Data Requirements List – Exhibit C001, DI-MGMT-80061A; D001, DI- MGMT-81892; and F001, DI-ADMN-81505) for report requirements.

3.2 Project Orientation Meeting

Within five (5) working days of the award of this Task Order, the Contractor shall participate in a Project Orientation Meeting. The Government will conduct the Project Orientation Meeting with Contractor personnel and other Government representatives to review and discuss administrative matters, Government Furnished Information/ Government Furnished Materials/Government Furnished Equipment (GFI/GFM/GFE), the milestone schedule, review cycles, and invoicing. The Government will hold this meeting at a Government location (in person) or it will be held virtually.

3.3 Contract Management Plan

The Contractor shall develop and maintain throughout the Contract’s period of performance, a Contract Management Plan (CMP) that shall be used as a foundation for information and resource management planning (See Contract Data Requirements List – Exhibit A001, DI-MGMT-80004A). The CMP shall include, but not be limited to, the following:

1. Contractor program organization chart and Organizational Interfaces.

2. Process Management and Control Plan.

3. Contract Deliverables Plan.

4. Quality Control Implementation.

5. Subcontract Management Plan (if required).

The Contractor shall ensure that all other planning and execution activities and deliverables (i.e., Contractor Work Breakdown Structure, Integrated Master Schedule, etc.) are integrated with the CMP. The Contractor shall keep the CMP up-to-date and accessible to appropriate Government personnel electronically at any time, and shall be prepared to brief any CMP content to the Government at short notice (within 48 hours). The CMP shall be used as a foundation for the Monthly Status Report.

3.4 Monthly Status Report

The Contractor will provide a monthly report that shall provide the status of Contract activities and present the report to the Government during a monthly program management review. (See Contract Data Requirements List – Exhibit G001, DI-MISC-80508B). At a minimum the monthly report shall address:

1. Major Accomplishments.

2. On-Going and Upcoming Activities.

3. Performance Metrics.

a. System Performance metrics

b. Deliverable Status (i.e. on-time, overdue, accepted, rejected, quality).

4. Variance to Cost and Schedule.

5. Risks and Mitigations.

6. Issues (problems affecting achievement of technical, or schedule goals, or personnel).

The Government will conduct monthly In Progress Reviews (IPRs) throughout the contract period of performance. The Government expects that the IPR will cover all aspects of quality, resource utilization, and funding/invoicing. The Government COR will schedule the reviews.

3.5 Contract Manpower Reporting

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor is required to completely fill in all the information in the format using the following web address: https://sam.gov

"The Contractor shall report ALL Contractor labor hours (including sub-contractor labor hours) required for the performance of services provided under this contract including all items and services listed under all the line items via a secure data collection site.