Attachment_1_SI_Consolidation_PWS_Amend_0001.docx

Marine Corps Systems Command Program Manager Information Systems & Infrastructure

Total Force Information Technology Systems (TFITS) Systems Integrator (SI) Consolidation Overarching Performance Work Statement

February 2014 Table of Contents

List of Figures

List of Tables

TFITS SI Consolidation Performance Work Statement

Introduction Purpose and Scope.

Product Manager (PdM), Total Force IT Systems’ (TFITS) primary objective is to continue providing needed Marine Corps Information Technology (IT) systems in an environment of reducing budgets. One initiative is to reduce the number of Systems Integrators (SIs) supporting programs within the PdM TFITS portfolio of systems. The purpose of this Performance Work Statement (PWS) is to establish a contract for the transfer and performance of SI services, currently provided by multiple SIs, to a single SI with the objectives to eliminate redundancy, improve utilization of SI resources, standardize business processes, improve process and product quality and reduce Marine Corps lifecycle ownership costs. The systems planned for transition are operational and listed in Table 1. SI services will include:

· System Transition (transition of SI responsibilities and any hardware/software systems from incumbents to this contract)

· Post Deployment Software Support

· Software Development

Table 1. PdM TFITS Managed Portfolio Background.

PdM TFITS is a Product Manager within the Information Systems and Infrastructure organization (Program Manager, Marine Corps, 110) (see Figure 1) responsible for IT Systems in the domains of Logistics, Transportation and Force Management.

Figure 1. Organization Structure The Advocates for the fifteen systems being consolidated are indicated in Figure 2. Appendix C summarizes the SI support requirements for each program.

Figure 2. PdM TFITS Advocates Table 2 identifies the technologies being used by the systems being consolidated.

Table 2. TFITS Technologies

Table 3 identifies the TFITS plans that provide overarching guidance for the all of TFITS Projects. These documents form the foundation for the common best business practices implemented as part of the Consolidated Contract as well as the development of the TFITS Consolidated SI (TCSI) plans.

Table 3. TFITS Management Plans

Table 4 identifies the notional consolidation timeline.

Table 4. Notional Consolidation Timeline Government Approach to Contract Management.

The overall Contract shall be managed through the Overarching Performance Work Statement (PWS), Quality Assurance Surveillance Plan (QASP), six (6) Management Plans (Transition Management Plan (TrP), Post Deployment Software Support Plan (PDSSP), Software Development Plan (SDP), Project Management Plan (PMP), Quality Assurance Program Plan (QAPP), and Configuration Management Plan(CMP)), and task specific Annexes developed by the TCSI and approved by the Government. The TCSI’s six (6) management plans shall establish the overarching strategy and plan to manage all aspects of the consolidated contract.

During the performance of the TCSI activities, the TCSI may be required to coordinate certain efforts with contracted Program Management Office (PMO) support.

Task Orders (TOs) TOs will be issued based on TCSI responses to a Government need. The TCSI’s response shall include a Task Management Plan (Annex to the Project Management Plan), Integrated Master Schedule (IMS), and an Annex to either the TrP, PDSSP, or SDP. Each TO may contain the following aspects and parameters that are specifically tailored to the system requirements:

Key Task Milestones.

Performance Standards.

Applicable Documents/References.

Deliverables and Schedule.

Government Furnished Equipment (GFE) and Information (GFI).

Period of Performance.

Place of Performance.

Travel and Other Direct Costs (ODCs).

Transition The TCSI shall prepare and submit a TrP to describe the TCSI’s plan for transitioning systems from the current incumbent to the TCSI. The TCSI shall provide the following information in their TrP:[footnoteRef:1] [1: System specific needs will be described in the TO.]

System Knowledge Transfer.

The TCSI shall have complete and comprehensive understanding of the transitioning system.

At a minimum, System Knowledge Transfer includes the following:

Existing engineering and technical documentation.

Existing user documentation.

TCSI System Instantiation.

The TCSI shall have the capability to conduct defect management which includes the ability to replicate system failures, test software patches prior to production release, and test system development efforts.

At a minimum, TCSI System Instantiation includes the following:

Production System Software.

A current copy of the production system software, including source code, will be provided as part of the transition process to support Post Deployment Software Support (PDSS) activities and instantiation of a production representative system in the TCSI’s environment.

Development and TCSI Test Hosting Environment.

The TCSI shall provide the development and TCSI test hosting environment for the production representative system instantiation. The TCSI’s hosting environment shall be representative of the constraints and limitations of the production environment.

Test & Evaluation.

The TCSI shall have complete understanding (activities, notional timeline) of what is required to validate there is a complete functioning replication of the production system to support the range of TCSI functions.

Critical PDSS Activities.

The TCSI shall provide a detailed and executable plan to transfer on-going service support and service delivery activities from any incumbent SI.

At a minimum, this includes:

Database administration.

System administration.

Cybersecurity.

System interfaces.

Help desk.

Training/and Training materials.

Transition Activity with the Government and SI Incumbent The TCSI shall engage in the following activities throughout a 30-day transition period:

Obtain administrative access, from the current SI, to the system as well as system interfaces.

Obtain points of contact (POCs), from the current SI, to include telephone numbers and email addresses for the system, Functional advocates, programmatic and technical POCs for interfacing system, and POCs for current hardware and software maintenance agreements.

Schedule and attend up to five days of observing the current SI during the conduct of system maintenance and administration during regular business hours. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Schedule and attend up to five days of conducting system maintenance and administration while the current SI observes during regular business hours. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Schedule, plan, provide agenda, provide meetings attend, and participate in up to three, day long, working group sessions and/or meetings to facilitate knowledge transfer on system functionality. Days can be, but are not required to be, consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Obtain physical access from current SI for all system hardware and software within the Authority to Operate (ATO) boundary and/or Government owned for inspection and audit.

Transition Contingency The TCSI shall provide a response for mitigating risks should a transition period not occur.

PDSS

The TCSI shall submit a PDSS Plan (PDSSP) to describe the TCSI’s comprehensive PDSS approach to include: Service Support, Service Delivery, and Sustainment Logistics. The TCSI shall provide that the following information is included in their PDSSP:[footnoteRef:2] [2: System specific needs will be described in the TO.]

Management Plans: The PDSSP shall address how the TCSI approach aligns with the TFITS Management Plans (see Table 3).

Savings: The TCSI shall describe specific PDSS areas where life cycle cost savings will be realized through economies of scale, resource optimization, service consolidation, and automation.

Service Support.

Development and TCSI test hosting environment.

The TCSI shall maintain a development and TCSI test hosting environment that functionally reflects the production environment.

Help Desk.

The help desk is the single user point of focus for support and for the reporting of incidents. The help desk processes include tracking and escalation procedures. In addition, the help desk is responsible for disseminating information regarding planned outages and/or implementation of changes impacting production services.

The TCSI’s help desk will provide technical support and application assistance to users. Specific help desk coverage hours shall be addressed by each TO requesting help desk support. The TCSI shall observe industry “best practices,” such as Information Technology Infrastructure Library (ITIL) v3 with the objective to receive, track, communicate (status to the user) and resolve user calls.

At a minimum, the Help Desk shall provide and consist of the following:

Respond to, complete and close help desk requests within a time specified by the TO.

Resolve system access issues and assist system users in basic system functions.

Escalate requests beyond the capability of the help desk to resolve to more advanced support personnel.

Escalate requests to Incident Management to resolve system failures.

Incident Management.

The primary focus of Incident Management is the restoration of services following an incident. Incident Management is primarily a reactive process; its processes provide guidance on diagnostic and escalation procedures required to quickly restore services. Incident Management processes are closely integrated with help desk, problem management and change management processes.

The Government seeks an Incident Management Model with predefined steps that will provide diagnostic and escalation procedures to ensure quick restoration of services.

At a minimum, Incident Management shall consist of, or provide, the following:

Detect and record incident details.

Resolve incidents within timeframes described in the TO.

Prioritize incidents in terms of impact and urgency with the objective to minimize user impact.

Escalate incidents.

Help desk verification that the incident is closed and the system user is satisfied with solution.

Problem Management.

The primary focus of Problem Management is to identify the causes of service issues and conduct corrective work to prevent recurrences. Problem Management processes are reactive in responding to incidents and proactive in identifying and preventing future incidents. The TCSI’s processes are closely integrated with Incident Management, Change Management and Availability Management. Although Availability Management performs the lead role in component failure and system outage analyses, Problem Management performs an important role in obtaining data and analyzing data in support of the analyses.

At a minimum, the TCSI shall:

Record, manage and escalate service problems as appropriate.

Analyze historical data to support predictive analysis to eliminate potential incidents before they occur and to identify work-arounds.

Diagnose root cause and eliminate recurrences.

Prioritize problems, in terms of impact and urgency, to minimize User impact.

Develop workarounds or other solutions to incidents.

Identify, develop and submit Engineering Change Proposals (ECPs) to Change Management to eliminate known problems.

Configuration Management (CM).

CM processes guide the collection, archiving and reporting of individual infrastructure component specifications. The Configuration Database is the single repository of configuration information for the enterprise. In addition to configuration information, the database contains information regarding the relationships and dependencies among infrastructure components.

CM processes closely integrate with Change Management processes because risk assessments shall take into consideration any relationships and dependencies that may be affected by requested changes to production operations. CM databases are also used by Capacity Management, Availability Management and IT Service Continuity Management processes to accurately perform their work.

At a minimum, CM shall meet the Government’s CM requirements as established by the Government’s CM Plan as well as:[footnoteRef:3] [3: System specific needs will be described in the TO.]

Maintain the Configuration Item Technical Database (CITDB).

Identify new Configuration Items (CIs) and entering them into the CITDB.

Collect, record and maintain accurate information about CIs.

Establish and implement configuration control and approval processes required to change a CIs attributes and re-baseline the CIs.

Change Management.

Change Management manages changes being introduced into the system. Change Management assesses risks of individual changes, uses configuration information to identify dependencies and other impacted applications and systems, and after analyzing the information, authorizes or denies change requests. The goal of Change Management is to identify application code, functional and performance defects and intercept them before Users are impacted.

The TCSI shall prepare written system change approaches and estimated costs and schedules for the Configuration Control Board (CCB). The authoritative source of all system ECPs is the Government’s ECP Tracker System. The TCSI may propose changes but must receive approval from the Government to execute ECPs. The TCSI will demonstrate how its processes align with TFITS Management Plans.

At a minimum, Change Management shall meet the Government’s Change Management requirements as established by the Government’s CM Plan as well as perform the following:

Contribute and record decisions and updates to any relevant products in tailored Systems Engineering Technical Review (SETR) events, Functional Review Boards (FRBs), Engineering Review Boards (ERBs) and CCBs.

Maintain and update system integrator specific data elements of the Government’s ECP Tracker System.

Provide a Rough Order of Magnitude (ROM) for ECPs at the ERB. Provide a detailed estimate for those ECPs approved by the CCB.

Identify application code defects as well as functional and performance defects and submit ECPs as appropriate.

Release Management.

Release Management is closely integrated with Change Management. Release Management manages changes to the environment such as installing vulnerability patches, software changes and/or refreshing technology.

At a minimum, the TCSI shall:

Provide all technical and non-technical aspects of a release, including the update and maintenance of system baselines, system documentation, user documentation, training documentation, and supply support material.

Plan and support the successful roll-out of software and related hardware including the required test, evaluation and Government acceptance processes.

Design, implement and support efficient procedures for the distribution and installation of changes to IT systems.

Coordinate and prepare the system user community for new release capabilities.

Ensure implementations are traceable, secure, and that only correct, authorized and tested versions are installed.

Coordinate and plan releases with Change Management.

Provide master copies of all software are secure and that the CITDB is updated.

Provide that all hardware being rolled out or changed is secure and traceable, using the service of CM.

Document release plans in a Deployment Plan that at a minimum contains anticipated changes to be deployed (e.g. vulnerability patches, software upgrades, defect patches), plan of action and milestones leading up to monthly deployment, configuration items that need to be updated (e.g. technical documentation, System Maintenance and System Administration Manual, CITDB, User Manual, Training Material), and a contingency plan.

Cybersecurity Management.

Marine Corps Order 5239.2A establishes an information systems lifecycle management approach to protect critical Marine Corps information and intelligence. The TCSI shall support the requirements of MCO 5239.2A by establishing and implementing proactive protection, detection, reaction, disaster recovery and restoration capabilities to include the detection and reporting of unauthorized activities. The level of protection will be aligned with the Mission Assurance Category (MAC) code assigned to each system.

The TCSI shall have knowledge of and support all certification and accreditation (C&A) activities throughout the system lifecycle in accordance with the latest releases or revisions of the following policies:

-DODI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP) Instruction, 28 Nov 2007 -DODD 8570.1, Information Assurance (IA) Workforce Improvement Program -DODD 8500.1E, Information Assurance, 24 Oct 2002 -DODI 8500.2 IA, Implementation, 6 Feb 2003 -SECNAVINST 5239.3B, DON IA Policy, 17 June 2009 -Federal Information Security Management Act (FISMA).

-United States Marine Corps Enterprise Cybersecurity Directive (ECSD) 018.

-Marine Corps Certification and Accreditation Process, Version 3.0, 7 December 2012.

At a minimum, the TCSI shall:

Assist in obtaining and maintaining an ATO, review and update documentation (to include but not limited to the Systems Information Profile (SIP), DIACAP Implementation Plan (DIP), and CyberEngineering Plan).

Ensure all DoD information system Cybersecurity related documentation is current and accessible to properly authorized individuals.

Provide awareness and prevention through assessment and implementation of best practices (system scans, vulnerability alerts, vendor notifications, Security Technical Implementation Guides (STIGs)).

Facilitate, participate in and provide timely completion of Annual Security Reviews, Annual Security Control testing, Annual Contingency Plan testing, and quarterly update and submission of quarterly Plan of Action & Milestones (POA&M) updates in compliance with the FISMA.

Utilize the Government’s IA tool to submit, maintain, and review C&A documentation and workflow. The Government will assist in gaining access to the tool, as well as training for the tool.

Work with the Government engineering team to register any software implemented on the systems for Marine Corps use in Department of the Navy Application and Database Management System (DADMS) prior to any system upgrade. The TCSI shall complete and submit DADMS questionnaire as required.

Facilitate the protection of US Government sensitive unclassified and classified information by working closely with the government Information Systems Security Manager (ISSM), Information Systems Security Officer (ISSO) and staff.

Review, implement and report applicable Information Assurance Vulnerability Management (IAVM) and Operational Directives (OPDIRs).

Confirm compliance of annual IA awareness training status.

Review vulnerability assessment scans provided and provide technical guidance on remediation (including use of STIGS), and develop POA&M.

Review documentation, support pre-assessment, review vulnerability scans, test result evaluation, and review POA&M for Independent Verification and Validation (IV&V) test events as necessary.

Review documentation, support pre-assessment, review vulnerability scans, test result evaluation, and review POA&M for Command Cyber Readiness Inspection (CCRI) events.

Service Delivery.

Service Delivery processes assist in the identification of delivered or provided services, tailoring of services, the timely provision of services, resources, capabilities and capacities to meet each system’s needs.

Service Level Management.

Service Level Management (SLM) processes provide a framework by which services are defined, levels of service required to support business processes agreed upon and Service Level Agreements (SLAs) developed to satisfy the agreements. SLM processes can clearly define IT and business roles and responsibilities and establish clear goals for service delivery so success factors can be established, measured and reported.

At a minimum, the TCSI shall:

Manage and provide system performance in support of SLAs, Interface Control Documents (ICDs), and System Interface Agreements (SIAs).

Manage and provide performance of system interfaces including web services.

Perform the TCSI role and responsibilities per approved SLAs and participating in the update of SLAs.

Measure performance, report results and adjust per TO.

Continuity Management.

IT Service Continuity Management (ITSCM) provides a framework for developing IT infrastructure recovery plans in support of business continuity management.

At a minimum, the TCSI shall:

Conduct risk assessment of IT services to identify the assets, threats, vulnerabilities and countermeasures for each service.

Evaluate the options for recovery.

Test, review, and revise the continuity section within the System Maintenance and System Administration Manual as needed.

Capacity Management.

Capacity Management is responsible for ensuring that IT infrastructure resources are in place or available to satisfy planned needs and that those infrastructure assets are effectively used. Capacity Management is responsible for identifying anticipated growth demands. Activities in this area are proactive rather than reactive, finding application and infrastructure bottlenecks at current and future demands so that corrective actions can occur before TFITS users experience service issues.

At a minimum, the TCSI shall:

Monitor the performance and throughput of the system.

Provide performance analysis of measurement data, including analysis of the impact of new releases on capacity and system performance.

Provide performance tuning of activities to ensure the most efficient use of existing infrastructure.

Manage the demands on the Service and future plans for growth (or shrinkage).

Respond when performance falls below acceptable performance.

Provide influences on demand for computing resources.

Conduct risk assessment of infrastructure and planned capacity needs to be integrated into the TCSI's overall risk management process.

Availability Management.

Availability Management is responsible for ensuring application systems are up and available. The process ensures Government system availability requirements are being achieved and ensures the most cost-effective contingency plans are put in place and tested on a regular basis to ensure Government availability needs are met. Availability Management also provides a lead role in the Failure Modes and Effects Analysis (FMEA) and Failure Reporting and Corrective Action System (FRACAS).

At a minimum, the TCSI shall:

Ensure service (system) availability meets System User’s expectations.

Provide FMEA: a proactive process to determine the potential impact on service delivery in the event that a particular component (or CI) should fail.

Identify potential service availability issues.

Provide FRACAS: the examination of past outages to identify related CIs, the CI’s impact on availability and future corrective action(s).

Provide Obsolescence Management.

Conduct system maintenance in accordance with the System Maintenance and System Administration Manual.

Sustainment Logistics.

Sustainment logistics focuses on lifecycle supportability. At a minimum, the TCSI shall:

Provide Asset Management to include support of the Item Unique Identification (IUID) plan and preparing hardware for disposal.

Provide End User Training and maintenance of Web-Based Training (WBT). Sustainment training is required to maintain the minimum acceptable level of proficiency or capability required for the System User to accomplish the mission objectives.

Develop and maintain a comprehensive hardware and software refresh plan. The plan shall cover a 5 year period and shall be updated with each PDSS TO.

Software Development All Software Development initiatives impact the system baseline, and are therefore governed by the ECP process as defined in the Software Development Plan (SDP) and TFITS Management Plans. The SDP lays out the process required to develop, modify or upgrade Government software and describes the details of each step along with any considerations that need to be addressed. The SEP defines the 4-octet ECP classification system that is used to assign ECPs as either a capability change, major change, minor change, or maintenance change, and details how SETR process, as defined in the Marine Corps Technical Review Handbook, is tailored based on this classification level. The ECP classification is TO specific and will be determined and specified in advance of the TO release so that the TCSI’s proposal can accurately reflect the level of effort required as a result of the tailored SETR process.

At a minimum, System Enhancements (classified as either an second octet or major or third octet minor change) and New Capability Requirements (classified as a first octet capability change) shall ensure and provide the following:

The TCSI shall develop a comprehensive SDP for conducting a software development effort and methods. At a minimum, the SDP shall provide the TCSI’s approach to:

Provide derived requirements.

Design software.

Develop software.

Test software.

Deploy software.

How the SDP can produce supporting artifacts that are based on the recommended methodology in the Supplement to Guidebook for Acquisition of Naval Software Intensive Systems: Software Criteria and Guidance for Systems Engineering Technical Reviews; TFITS Management Plans; and the Marine Corps Systems Command Technical Review Handbook, v1.4 dated April 2009.

The TCSI shall describe in their SDP specific Software Development areas where cost savings will be realized through reusability, reliability, and maintainability.

Strategy for integrating CM, Human Systems Integration, Logistics, and Cybersecurity into each stage (4.1.1 – 4.1.5) of the software development process.

Data driven Department of Defense Architecture Framework (DoDAF) compliant views (as necessary per TO).

An annex to the overarching SDP shall be developed in response to each software development related TO. At a minimum, the annex for each System Enhancement (classified as either an second octet or major or third octet minor change) and New Capability Requirements (classified as a first octet capability change) TO shall ensure and provide the following in accordance with the specified level of SETR tailoring based on the ECP classification level:

Requirements Analysis Phase.

The key Objective of the Requirements Analysis Phase is to transform the Government’s needs into a technical view of a required product that could deliver those needs. Efforts involve defining User needs and requirements in the context of planned User use, environments, and identified system characteristics to determine requirements for system functions. At a minimum, the TCSI shall:

Elicit derived requirements.

Perform an iterative process of decomposing requirements into system functional requirements and establishing traceability.

Maintain traceability between the derived and Government-provided requirements.

Align requirements analysis efforts with Marine Corps Systems Command (MCSC) acquisition requirements (TFITS Management Plans, and SETR process).

Provide documentation needed to support the MCSC SETR process for System Requirements Reviews (SRR) and System Functional Reviews (SFR) (as required per tailoring).

Document the functional baseline.

System Design Phase.

The overarching objective for the System Design Phase is the on-time delivery of Government-approved documentation that provides the detailed design of each configuration item in the approved product baseline. The System Design phase produces a design that is based on the functional descriptions and products developed during the Requirements Analysis phase. The design is reflected in the products developed and delivered by the TCSI.

At a minimum the TCSI shall:

Provide the TCSI’s design process including the use of design and modeling tools, analyses, and tradeoffs.

Align the TCSI’s process with the TFITS Management Plans and the MCSC SETR process for Preliminary and Critical Design Reviews (PDRs/CDRs) (as required per tailoring).

Provide documentation needed to support the PDRs/CDRs (as required per tailoring).

Document the Allocated and Product baselines.

Development Phase.

The prime objective for the Development Phase is the on-time delivery of a Government tested and accepted capability solution.

At a minimum the TCSI shall:

Develop, integrate, assemble and test capability.

Provide in-process reviews.

Align the TCSI’s process with the TFITS Management Plans and MCSC SETR process for Test Readiness Review (TRR), System Verification Review (SVR), Production Readiness Review (PRR) and Physical Configuration Review (PCR) (as required per tailoring).

Provide documentation needed to support the TRR, SVR, PRR, and PCR (as required per tailoring).

Support Government Acceptance Testing, IV&V, code review and/or cyber-penetration testing.

Deployment Phase.

The prime objective for the Deployment Phase is the deployment of the Government-accepted capability into the production environment in accordance with the established performance standards.

At a minimum the TCSI shall:

Document the TCSI’s deployment process.

Validate that all certifications and accreditations are in place prior to deployment.

Prepare the system user community to receive and use capability.

Warranty the software for three (3) months from any defects.

Coordinate and deliver the deployment package within the PDSS Release Management process.

Project Management Project Management Plan.

The TCSI shall prepare a Project Management Plan (PMP). The Government approved PMP serves as the common understanding between the Government and the TCSI on how the Indefinite Delivery/Indefinite Quantity (IDIQ) Contract and the range and depth of TOs will be effectively and efficiently managed. The Government fully realizes that the TCSI shall need to periodically revisit and update the PMP to ensure that it accurately reflects the dynamics of managing a contract of this magnitude. At a minimum, the PMP shall be updated annually and resubmitted to the Government for approval. Other than this annual submission, the TCSI has the latitude to build upon the document content to ensure all aspects of the TCSI’s collaborative project management process are addressed. All additional updates will require approval from the Government.

At a minimum, the PMP shall define and describe the TCSI’s:

Processes.

Planning: Contract planning, coordination, and schedule as well as methods, tools, and techniques used to estimate TO schedule and resource requirements.

Staffing: Identify the types of skill sets and skill levels that will be needed and provided and the strategies that will be used to ensure the right amount of the right skills will be available when needed. Explain the process to recruit and retain qualified staff. Explain how TCSI will identify and acquire qualified incumbent staff. Note: The Government expects the TCSI staff to be located within a reasonable commuting distance from MCB Quantico. The Government will not pay travel costs for TCSI staff to commute to work. Any reimbursable travel incurred during the performance of the contract and its associated TOs shall not include travel for day-to-day work activities.

Resource Acquisition: Specify the plan for acquiring the resources (other than staffing) needed to successfully execute the contract and operate and support the systems projected to be consolidated into this contract.

Staff Training: Specify the training that will be provided to employees working on the consolidated contract and associated TOs. Discuss any unique or specific training that will be provided.

Process Improvement: Describe the plan for periodically assessing the contract, determining areas for improvement, gaining Government approval and implementing improvement plans.

Risk Management.

The TCSI shall provide a risk management plan that identifies the methods and procedures to be employed to identify, assess, monitor and control risk during performance of this contract. The TCSI Risk management plan shall align with the TFITS Risk Management Plan.

Structure.

At a minimum, Structure shall include:

External Interface.

Describe the organizational boundaries between the TCSI and external entities. “External” is defined as anyone not on the TCSI Team (e.g. PMO, system users, hosting facilities).

Internal Structure Interface, Communication and Coordination.

Describe the internal structure of the TCSI team to include subcontractors, development and TCSI test hosting environment and any other entities involved in the performance of this contract. (“Internal” is defined as within the TCSI team) Roles and Responsibilities to include scope.

Scope of Authority.

Internal Responsibilities.

External Responsibilities.

Reporting.

The TCSI shall describe the metrics, reporting mechanisms, and control procedures it will use to measure, report, and control TO’s including requirements, the schedule, resources, and quality assurances.

Quality Assurance.

Within the PMP, the TCSI shall prepare a Quality Assurance Program Plan (QAPP). The QAPP shall describe the TCSI’s approach to ensuring quality performance for all aspects of the TCSI Consolidated contract. The QAPP shall include:

Project Quality Management.

Quality Assurance.

Quality Control.

How quality assurance will flow down to Subcontractors.

Security.

The TCSI shall have, and provide evidence of, an appropriate Facility Clearance as provided in the DD254.

All personnel supporting this contract shall maintain compliance with Department of Defense, Department of the Navy and Marine Corps Information and Personnel Security Policy to include completed background investigations (as required) prior to classified performance. This contract shall include a DoD Contract Security Classification Specification (DD Form 254) as an attachment. Requests for contractor SIPRNet accounts will be handled on a case-by-case basis and approved individually by the Contracting Officer’s Representative (COR) in accordance with MCSC procedures and regulations.

Common Access Cards (CACs) will only be issued to those contractors supporting this contract that have been authorized by the COR. The COR will only authorize CACs for those contractors that meet current Homeland Security Presidential Directive - 12 (HSPD-12) criteria and have a definitive requirement. CACs are not issued for convenience.

The TCSI shall notify the Government (in writing) within twenty-four hours of any contractor personnel added or removed from the contract that have been granted classified access, issued a CAC and/or MCSC Building access.

If a contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately revoked, retrieved and provided to the COR. Facility Security Officers are responsible for notifying the MCSC Security Director if any contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. Contractor CACs are issued with a “ctr.usmc.mil” e-mail account that the individual contractor is responsible to keep active by logging in on a regular basis (at least twice a month), sending an e-mail and clearing any unneeded e-mails. Contractors are prohibited from “auto-forwarding” their .mil e-mail account to any other account, including but not limited to a contractor or home account.

Task Management.

A Task Management Plan (TMP) shall be developed in response to each TO specific to each Task PWS. In addition to any changes within paragraph 5.1, the TCSI shall also provide additional Task Management items. At a minimum, the TCSI task management efforts shall provide the following Task Management requirements:[footnoteRef:4] [4: System specific needs will be described in the TO.]

Task Initiation.

Resource coordination and management, to include:

TO Roles and responsibilities.

Individual Security Clearances.

The TCSI shall have, and provide evidence of, individual clearances of team members as appropriate to the work required to perform the TO.

The TCSI shall have, and provide evidence of, current Secret Clearances for all individuals performing on classified aspects of this contract who will be required to access Secret information. Secret access is required in order to attend meetings and perform daily work inside approved areas. Access to Secret data requires unescorted access into Secret spaces and access to Secret information and/or systems (e.g., SECRET Internet Protocol Router Network (SIPRNET)).

The TCSI shall have, and provide evidence of Cybersecurity certification as appropriate to perform a specific TO.

Task Execution.

At a minimum, the TCSI for Task Execution shall:

Perform quality assurance in accordance with the QAPP.

Identify and manage risks and update the Risk Management Plan, as necessary.

Host and/or Aattend, provide agenda, provide meeting minutes, and participate in any ad hoc Working Groups, Integrated Product Teams (IPT), Technical reviews, Technical Interchange meeting, In Process Reviews (IPR), and/or any other system specific meetings to support the requirements of Task Orders.

Tools, techniques, and methodologies.

Performance Management.

Provide a Weekly Status Report, as directed per TO Provide a Monthly Status Report (MSR) to include, at a minimum: All Priority 1 metrics from the TFITS Performance Measurement Plan, previous month’s activities, updated risk register, upcoming activities, all incidents, summary of service issues, problem trends, progress towards the Performance Standard and Acceptable Quality Levels (AQLs) and anticipated travel (with a justification for the travel). The metrics submitted for the MSR shall be in accordance with the TFITS Program Measurement Plan. TOs that provide for more than one system shall provide one MSR for those systems, but with separate sections for each system.

Task Closeout.

Provide orderly closeout of the task order closeout including final delivery of any remaining Government products, hardware, software and preparation of a final report to include lessons learned and analysis of the task.

CM

The TCSI shall prepare a CMP. The CMP shall align with the TFITS CMP forming the seamless CM process required to successfully manage the systems being consolidated into this contract.

At a minimum, the TCSI’s CMP shall follow MIL-HDBK-61A, EIA 649, and IEEE 12207.

Integrated Master Schedule The TCSI shall use MS Project (2007 compatible) to develop and maintain a single SI Consolidated Contract IMS derived from reportable events from each TO IMS. Within 30 days after award of the SI Consolidated Contract, the SI Consolidated Contract IMS shall be submitted to the Government, and thereafter it shall be updated on a monthly basis . In addition, the SI Consolidated Contract IMS shall also include interdependencies between the various TO IMSs.

System IMS.

Each System will be issued TOs for Transition, PDSS, and potentially SDP(s) . A System IMS shall be submitted in response to the initial transition TO. The TCSI shall develop the PDSS portion of the IMS and incorporate it with the Transition portion of the IMS (once complete) to compile a System IMS. The TCSI shall maintain the System IMS throughout the period of performance of the PDSS TO. In addition, any SDP TO performed during the period of performance of the PDSS TO shall also be integrated into the appropriate System IMS. For each Government-approved update to the System IMS, reportable events shall also be incorporated into the single SI Consolidated Contract IMS. At a minimum, each System IMS shall provide the Government information sufficient to demonstrate how the TCSI intends to manage the proposed effort including:

Tasks.

Activities.

Schedule.

Deliverables.

All System TOs.

Contractor Work Breakdown Structures (CWBSs) extended off the Government Work Breakdown Structure (GWBS) (if provided).

Post Award Orientation and Planning The SI Consolidated Contract is an Indefinite Delivery/Indefinite Quantity Firm-Fixed Price contract. TOs will be awarded to transition the systems from the incumbents to the TCSI. To ensure a smooth transition, during each Transition TO, both the incumbent and the TCSI will work with the Government. The incumbent retains system performance (including Helpdesk) responsibility during the transition period. Prior to completed transition for a particular system, the Government will issue a Post Deployment Software Support (PDSS) TO RFP and, once awarded, the TCSI will be the sole PDSS provider for that system’s PDSS.

Post Award Orientation Meeting.

One week after award of the SI Consolidated Contract a Government-TCSI combined post-award orientation meeting will be conducted at the TCSI’s facility. The Government anticipates the meeting to five days.

Topics on the Government’s agenda for discussion include (but are not limited to):

Contract terms and conditions.

Contract requirements.

Government team organization.

Government-TCSI communications.

System consolidation timeline.

TO RFPs (Four TO RFPs will be issued at Post Award Orientation).

Steps necessary to execute TOs.

Contract data deliverables.

TFITS SharePoint site.

SI personnel authorization access request process.

Topics to be included on the TCSI’s agenda include (but are not limited to):

Organization (e.g., contract management, TO management) structure.

TCSI Team and status Facility plan and status.

Risks and mitigation strategies that align with and implement the TFITS Risk Management Plan.

Planning Meeting After award of the consolidated contract and throughout the life of the contract, the Government may request a Government-TCSI combined planning meeting to be conducted at the TCSI’s facility. The Government anticipates any such meeting to potentially last up to 5 days (length will be TO specific). Topics to be addressed include (but are not limited to):

Proposals TCSI submitted in response to TO RFP with topics to include:

Task project management, technical and logistics requirements.

TO PWS.

TO QASP.

TO Annexes.

TO Key milestones and IMS.

TO Negotiations (if necessary).

Facility readiness.

TCSI team readiness status.

Risks and mitigation strategies that align with and implement the TFITS Risk Management Plan.

Appendix A. Acronyms

A-1

Appendix B. Program Support Requirements Summary

B-1

Appendix C. References

1. Marine Corps Order 5239.2A, http://community.marines.mil/news/publications/Documents/MCO%205239_2A.pdf

5. MIL-STD 1472G, DoD Design Criteria Standard; Human Engineering

6. MIL-STD 882E, Standard Practice for Systems Safety

7. MIL-HDBK-46855A, DoD Handbook; Human Engineering Guidelines for Military Systems, Equipment, and Facilities

C-1

Appendix D. Notional Deliverables

Integrated Master Schedule (IMS)