Exhibit_2b__TRAP_PDSS_PWS_Final_.docx

Total Force Information Technology Systems

TRAP Post Deployment Software Support Performance Work Statement

February 2014 Table of Contents

List of Figures

List of Tables

TRAP PDSS Performance Work Statement

Introduction Purpose and Scope This Performance Work Statement (PWS) identifies the requirements and performance standards for the TFITS Request for Proposal (RFP) Assessment Program (TRAP) Post Deployment Software Support (PDSS) requirements and performance Standards for the TFITS Consolidated Systems Integrator (TCSI).

*** PLEASE NOTE, TRAP IS A FICTICIOUS SYTEM***

Background TRAP provides daily accountability of all Marines, other Service members, and affiliated personnel under administrative and operational control of the Marine Corps. TRAP has 5,000 users across the Marine Corps, reached Full Operational Capability in 2012 and is currently in the Operations and Support (O&S) phase. The system is assigned a Mission Assurance Category (MAC) II, Sensitive. TRAP is an acquisition category (ACAT) IVT. TRAP operates in a Non-classified Internet Protocol (IP) Router (NIPR) and Secret Internet Protocol Router (SIPR) web-based environment, with its production system hosted at Marine Corps Base Quantico.

TRAP includes custom application software and tailored Commercial-Off-The-Shelf (COTS) software. The TRAP application software was developed using C Sharp (C#) on an ASP.Net framework. The database is built in Oracle 11g. The TRAP development and TCSI development environment is TCSI provided. TRAP help desk services are TCSI provided.

An overview of the system including interfaces is provided in Figure 1.

Figure 1. TRAP System Operational View Figure 2 provides the TRAP architecture layout.

Figure 2. Physical Representation of the TRAP Production Architecture

PDSS

Service Support Development and TCSI test hosting environment.

The TCSI shall maintain a TRAP development and TCSI test hosting environment that functionally reflects the TRAP production environment.

Help Desk The help desk is the single user point of focus for support and for the reporting of incidents. The help desk processes include tracking and escalation procedures. In addition, the help desk is responsible for disseminating information regarding planned outages and/or implementation of changes impacting production services.

The TCSI’s help desk will provide technical support and application assistance to users. Specific help desk coverage hours shall be addressed by each TO requesting help desk support. The TCSI shall observe industry “best practices,” such as Information Technology Infrastructure Library (ITIL) v3 with the objective to receive, track, communicate (status to the user) and resolve user calls.

At a minimum, the TRAP Help Desk shall provide and consist of the following:

Respond to, complete and close help desk requests.

Capture, track, investigate, escalate, resolve, close and report user help requests.

The TCSI shall use the existing government provided tool developed in .Net. Data includes: the caller’s name; work location; time of receipt of the call; the nature of the call; the time of resolution; and a brief statement of how the problem was resolved to record each user help request/trouble call. The TCSI has the ability to add data it feels is needed to improve its ability to manage help request.

Elevate and resolve help requests that cannot be resolved within 4 hours.

Resolve system access issues and assist system users in basic system functions.

Provide the number of calls made to the help desk that are resolved during the first call meets the threshold TRAP requirement (85%). Note: Calls made to the help desk where a message is left by the user, such as after help desk hours, are included in the total number of calls made to the help desk.

Escalate help requests beyond the capability of the help desk to resolve to more advanced support personnel.

Ensure calls made to the help desk where a user left a message are responded to no later than the next business day.

Escalate help requests to Incident Management to resolve system failures.

Resolve system access issues and restore basic system functions; route tickets; determine a solution or the need to submit an ECP; provide resolution to the end user and enter ECP into the TRAP ECP List located in the TFITS SharePoint site.

Incident Management.

The primary focus of Incident Management is the restoration of services following an incident. Incident Management is primarily a reactive process; its processes provide guidance on diagnostic and escalation procedures required to quickly restore services. Incident Management processes are closely integrated with help desk, problem management and change management processes.

The Government seeks an Incident Management Model with predefined steps that will provide diagnostic and escalation procedures to ensure quick restoration of services.

At a minimum, Incident Management shall consist of, or provide, the following:

Detect and record incident details.

At a minimum, the TCSI shall:

Perform incident management including performance monitoring, incident identification, diagnosis/isolating, containment, eradication, recovery and lessons learned.

Track incidents reported from the system users, the host site, and external interfacing systems.

Communicate the incident to stakeholders.

Identify and report functions and files affected.

Resolve incidents to support TRAP’s operational availability.

At a minimum, the TCSI shall:

Resolve incidents including performing diagnostics, fault isolation, containment, eradication, recovery and lessons learned.

Escalate unresolved incidents after 4 hours and define the relationship between the escalation process and the TCSI’s ECP development process.

Restore existing system and data.

Restore TRAP to full operational capability.

Prioritize incidents in terms of impact and urgency with the objective to minimize user impact.

At a minimum, the TCSI shall:

Assess type and severity (e.g., number of users effected) of incident.

Assess impact to data integrity.

Reduce unplanned downtime hours.

Identify incident impact to the Government.

Recommend ratings for the priority and the urgency of each incident.

Inform the Government of the restoration of services and effects of the incident to the user community.

Escalate incidents.

At a minimum, the TCSI shall:

Provide IM capability that contains a tiered structure of increasing system knowledge and IT expertise.

Resolve system access issues and restore basic system functions; route tickets; determine a solution; provide resolution to the end user or recommend an ECP to the Program Office, if appropriate.

Prioritize incidents for resolution at a Tier III or higher level.

Provide all incidents are tracked for historical purposes.

Provide the government with all documentation concerning incidents in the Monthly Status Report (MSR).

Escalate those incidents that require Problem Management resolution.

Provide Help desk verification that the incident is closed and the system user is satisfied with solution.

Problem Management.

The primary focus of Problem Management is to identify the causes of service issues and conduct corrective work to prevent recurrences. Problem Management processes are reactive in responding to incidents and proactive in identifying and preventing future incidents. The TCSI’s processes are closely integrated with Incident Management, Change Management and Availability Management. Although Availability Management performs the lead role in component failure and system outage analyses, Problem Management performs an important role in obtaining data and analyzing data in support of the analyses.

Tier II issues require complex and in-depth analysis and knowledge of the application software, database, and architecture. In the case where help desk personnel are unable to resolve an issue, the issue will be escalated to Tier II (no later than 4 hours after initial review by Tier I). The TCSI shall develop their procedures for resolution of the issue. At a minimum, the TCSI shall:

Record, manage and escalate service problems as appropriate.

At a minimum, the TCSI shall:

Record the escalation, progress status and final resolution in the Government’s .NET trouble ticketing system. A Common Access Card (CAC) will be required to access the ticketing system.

Resolve the service issue at the Tier II level.

Escalate the service problem to the Tier III level for resolution if it cannot be resolved at Tier II within 8 hours.

Report a summary of service issues in the MSR. Summary information to include how the issue was initially identified, what system service(s) were affected, how long it took to restore service(s), and lessons learned.

Analyze historical data to support predictive analysis to eliminate potential incidents before they occur and to identify work-arounds.

At a minimum, the TCSI shall:

Maintain historical data in a Government-approved format for all service problems reported to the Tier II level.

Use a trouble ticket log to develop an analysis of trends to identify potential problems.

Provide the Government the results of problem trends in the MSR.

Diagnose root cause and eliminate recurrences.

At a minimum, the TCSI shall:

Provide the Government the potential causes of problems in its historical data.

Maintain historical data.

Utilizing historical data, provide the Government the TCSI’s approach for preventing problems from recurring.

Prioritize problems, in terms of impact and urgency, to minimize system user impact.

At a minimum, the TCSI shall:

Assess and provide type and severity (e.g., number of users affected) of problem.

Assess and provide impact to data integrity.

Reduce unplanned downtime hours.

Identify problem impacts to the Government.

Recommend the priority and the urgency to be assigned to each problem.

Inform the Government of the restoration of services and effects of the incident to the user community.

Develop workarounds or other solutions to incidents.

At a minimum, the TCSI shall:

Identify potential problems from the analysis of historical data.

Develop innovative workarounds and solutions to problems.

Present workarounds to the government for approval and/or consideration for implementing an Engineering Change Proposals (ECP).

Identify, develop and submit ECPs to Change Management to eliminate known problems.

CM.

CM processes guide the collecting, archiving and reporting of individual infrastructure component specifications. The Configuration Database is the single repository of configuration information for the enterprise. In addition to configuration information, the database contains information regarding the relationships and dependencies among infrastructure components.

CM processes closely integrate with Change Management processes because risk assessments shall take into consideration any relationships and dependencies that may be affected by requested changes to production operations. CM databases are also used by Capacity Management, Availability Management and IT Service Continuity Management processes to accurately perform their work.

The Government seeks a CM environment that will ensure the baselines are maintained and that only controlled changes are implemented. The TCSI shall implement a CM program that will ensure the implementation of changes is documented and has no adverse effect on current system functionality. The TCSI’s CM Plan and processes shall align with the TFITS Configuration Management Plan.

At a minimum, the TCSI shall:

Maintain the Configuration Item Technical Data Base (CITDB).

At a minimum, the TCSI shall:

Utilize the approved TFITS CITDB format and maintain the current data base containing the details of each system component. A Common Access Card (CAC) will be required.

Provide a method for controlling changes to the CITDB.

Identify new Configuration Items (CI) and enter them into the CITDB.

At a minimum, the TCSI shall:

Provide identification, collection, tracking and maintenance of each unique CI comprising the system and sub-systems.

Perform change control processes that enable definition of the functional and physical characteristics of CIs in sufficient detail that they may be categorized.

Enable and implement the identification of the system items, components and related work products that will be placed under CM.

Track and maintain Government submitted CIs in the CITDB.

Propose CIs which the TCSI deems necessary or offer significant benefit to the Government.

Collect, record and maintain accurate information about CIs.

At a minimum, the TCSI shall:

Track and record the status of CIs.

Respond to government questions about system change approaches, estimated costs and schedules, as well as technical questions related to the program.

Establish and implement configuration control and approval processes required to change a CI’s attributes and re-baseline the CIs.

Change Management.

Change Management manages changes being introduced into the system. Change Management assesses risks of individual changes, uses configuration information to identify dependencies and other impacted applications and systems, and after analyzing the information, authorizes or denies change requests. The goal of Change Management is to identify application code, functional and performance defects and intercept them before Users are impacted.

The TRAP infrastructure is hosted on Marine Corps Base, Quantico. Assessment of changes to the TRAP infrastructure requires coordination between the host site, the user community, Marine Corps Systems Command (MCSC), and the TCSI. The TCSI may propose changes but must receive approval from the Government, as funded Task Orders, to execute ECPs. The TCSI shall ensure and provide that its change management processes align with the TFITS Management Plans. At a minimum, the TCSI shall:

Contribute and record decisions and updates to any relevant products in tailored SETR events, Functional Review Boards (FRBs), Engineering Review Boards (ERBs) and CCBs.

Maintain and update system integrator specific data elements of the Government’s ECP Tracker System. Appendix C lists all of the ECP Tracker data elements. A Common Access Card (CAC) will be required.

Provide a Rough Order of Magnitude (ROM) for ECPs at the ERB. Provide a detailed estimate for those ECPs approved by the CCB.

At a minimum, the TCSI shall:

Identify, research, develop and classify ECPs.

Provide an estimate for hours and effort required to complete ECPs.

Provide level of effort documentation to support the CCB’s evaluation for each ECP presented.

Identify application code defects as well as functional and performance defects, and submit ECPs as appropriate.

At a minimum, the TCSI shall:

Identify and resolve the defect and ensuring the system is working as designed.

Use quality assurance processes to reduce software defects.

Utilize software development processes to reduce software defects.

Release Management.

Release Management is closely integrated with Change Management. Release Management manages changes to the environment such as installing vulnerability patches and software changes and/or refreshing technology.

At a minimum, the TCSI shall:

Provide all technical and non-technical aspects of a release, including the update and maintenance of system baselines, system documentation, user documentation, training documentation, and supply support material.

At a minimum, the TCSI shall:

Provide technical aspects such as: regression testing; testing documentation; remediation of identified defects; the update of system documentation, configuration status accounting data; information assurance scanning.

Provide non-technical aspects such as: coordinating system changes with the host facility; identifying the needed training; updating user documentation including training documentation; and preparing release notes and version description document.

Plan and support the successful roll-out of software and related hardware including the required test, evaluation and Government acceptance processes.

At a minimum, the TCSI shall:

Provide a repeatable training, test and deployment strategy and schedule for planned enhancements and upgrades.

Create and deliver Test Plans and Test Scripts that are traceable to requirements.

Monitor GAT and collect Test Incident Reports (TIRs).

Submit GAT Scorecards reflecting all completed test scripts, remaining test scripts, number passed, number failed, and status of failed tests.

Resolve all Severity 1 (Showstopper) and 2 (High) TIRs and other critical issues and update system documentation prior to test completion.

Manage, integrate and deploy upgrades upon Government acceptance (including production environment regression testing).

Releases will be scheduled during the optional 3 hour window on Saturdays from 1600 to 1900 EST.

Design, implement and support efficient procedures for the distribution, installation and verification of changes including the TRAP client application.

Coordinate and prepare the Advocate and system user community for new release capabilities.

At a minimum, the TCSI shall:

Provide user training documentation, technical documentation and other user support material within sufficient time prior to deploying a software upgrade.

Provide a system notification to all system users prior to implementing any release.

Ensure implementations are traceable, secure, and that only correct, authorized and tested versions are installed.

Coordinate and plan releases with Change Management.

Provide master copies of all software are secure and that the CITDB is updated.

Provide that all hardware either being rolled out, or changed, is secure and traceable using the service of configuration management.

Document release plans in a Deployment Plan that at a minimum contains anticipated changes to be deployed (e.g., vulnerability patches, software upgrades, defect patches), plan of action and milestones leading up to monthly deployment, configuration items that need to be updated (e.g., technical documentation, System Maintenance and System Administration Manual, CITDB, User Manual, Training Material), and a contingency plan.

Cybersecurity Management.

Marine Corps Order 5239.2A establishes an information systems lifecycle management approach to protect critical Marine Corps information and intelligence. The TCSI shall support the requirements of MCO 5239.2A[footnoteRef:1] by establishing and implementing proactive protection, detection, reaction, disaster recovery and restoration capabilities to include the detection and reporting of unauthorized activities. The level of protection will be aligned with the Mission Assurance Category (MAC) code assigned to each system. [1: Or latest version.]

At a minimum, the TCSI shall:

Maintain TRAP’s Authority To Operate (ATO), review and update documentation (including but not limited to the Systems Information Profile (SIP), DIACAP Implementation Plan (DIP), and CyberEngineering Plan), and fulfill all annual cybersecurity requirements for a MAC II Sensitive program.

Provide all DoD information system Cybersecurity-related documentation is current and accessible to properly authorized individuals.

Provide awareness and prevention through assessment and implementation of best practices (code reviews, system scans, vulnerability alerts, vendor notifications, Security Technical Implementation Guides (STIGs)).

At a minimum, the TCSI shall:

Implement cybersecurity best practices to increase the security of TRAP and eliminate vulnerability threats to include code reviews, system scans, vulnerability alerts, vendor notifications and STIGs.

Provide all security updates and patches are tested and applied to software and operating systems.

Provide all vulnerabilities identified by the Hosting Facility’s vulnerability scans are incorporated and mitigated.

Conduct code software quality, software code assurance and code reviews with automated tool(s).

Provide Cybersecurity risk analysis to include identification and mitigation of cyber security risks to COTS software.

Facilitate and participate in and provide timely completion of Annual Security Reviews, Annual Security Control testing, Annual Contingency Plan testing, and quarterly update and submission of quarterly POA&M updates in compliance with the Federal Information Security Management Act (FISMA).

Utilize the Government’s IA tool to submit, maintain, and review C&A documentation and workflow. The Government will assist in gaining access to the tool, as well as training for the tool.

Work with the Government engineering team to register any software implemented on the systems for Marine Corps use in Department of the Navy Application and Database Management System (DADMS) prior to any system upgrade. The TCSI shall complete and submit DADMS questionnaire as required.

Facilitate the protection of US Government sensitive unclassified and classified information by working closely with the government Information Systems Security Manager (ISSM), Information Systems Security Officer (ISSO) and staff.

Implement vulnerability assessment remediation and tracking per Information Assurance Vulnerability Management (IAVMs) and Operational Directives (OPDIRs).

Confirm compliance of annual Information Assurance (IA) awareness training status.

Review vulnerability assessment scans provided and provide technical guidance on remediation and (including use of STIGS), and develop Program of Action and Milestones (POA&M).

At a minimum, the TCSI shall:

Provide a monthly identification of vulnerabilities and remediations in accordance with Communications Tasking Order (CTO) 08-005 Scanning and Remediation and DoDI 8510.01.

Request and maintain a MCCAST account and ensuring all documentation is uploaded and up to date.

Review documentation, support pre-assessment, review vulnerability scans, test result evaluation, and review POA&M for Independent Verification and Validation (IV&V) test events as necessary.

Review documentation, support pre-assessment, review vulnerability scans, evaluate test results, and review POA&M for Command Cyber Readiness Inspection (CCRI) events.

Service Delivery Service Level Management Service Level Management (SLM) processes provide a framework by which services are defined, levels of service required to support business processes agreed upon and Service Level Agreements (SLAs) developed to satisfy the agreements. SLM processes can clearly define IT and business roles and responsibilities and establish clear goals for service delivery so success factors can be established, measured and reported.

At a minimum, the TCSI shall:

Manage and provide system performance in support of SLAs, Interface Control Documents (ICDs), and System Interface Agreements (SIAs).

At a minimum, the TCSI shall:

Develop and maintain an SLA, ICD and SIA for new interfaces.

Plan for changes to SLA, ICDs and SIAs when there is a change to TRAP or on the external systems TRAP interfaces with.

Provide data transfers are executed according to existing SLA, ICDs and SIAs in a timely manner with accurate data.

Manage and provide performance of system interfaces including web services.

Perform the TCSI role and responsibilities per approved SLAs and participating in the update of SLAs.

Measure performance, report results and adjust as necessary.

At a minimum, the TCSI shall:

Report results of performance metrics to the Government as defined in the TFITS Management Plans and QASP.

Link performance metrics to risk assessments.

Provide mitigation strategies for risks and issues affecting performance.

Continuity Management.

IT Service Continuity Management (ITSCM) provides a framework for developing IT infrastructure recovery plans in support of business continuity management. The TRAP Contingency Plan outlines the roles, responsibilities and processes to be enacted in the case of circumstances preventing the continuity of the TRAP system. MAC II Sensitive systems have an expectation of being available to its users within a certain period of time following a downing event. In addition, the TRAP has a Recovery Point Objective (RPO) of 1 hour and a Recover Time Objective (RTO) of 24 hours. Information regarding TRAP recovery plans is found in MCCAST. The TCSI shall gain access to the plan and implement a plan that meets with government approval. Appropriate security clearances in accordance with DoD Directive 5230.25 for all personnel having access to the TRAP MCCAST documents must be adhered to.

At a minimum, the TCSI shall:

Conduct risk assessment of IT services to identify the assets, threats, vulnerabilities and countermeasures for each service.

At a minimum, the TCSI shall:

Conduct risk assessments in conjunction with Cybersecurity Management on a scheduled basis.

Identify and provide threats and vulnerabilities upon completion of the risk assessments.

Provide the Government with risk mitigation strategies for identified program risks as well as the monitoring process to evaluate the impact of mitigation efforts.

Evaluate options for recovery.

At a minimum, the TCSI shall:

Securely maintain TRAP data for recovery.

Control electronic and physical access to TRAP data.

NIPR are delivered to the PMO IA POC and SIPR backup tapes are delivered to MCSC Security Test, review, and revise the continuity section within the System Maintenance and System Administration Manual as needed.

At a minimum, the TCSI shall:

Utilize the results of the government approved test in Cybersecurity as required by the DoDI 8500.2 and provide corrective actions for analysis to the government.

Capacity Management.

Capacity Management is responsible for ensuring that IT infrastructure resources are in place or available to satisfy planned needs and that those infrastructure assets are effectively used. Capacity Management is responsible for identifying anticipated growth demands. Activities in this area are proactive rather than reactive, finding application and infrastructure bottlenecks at current and future demands so that corrective actions can occur before service issues are experienced by TFITS users.

At a minimum, the TCSI shall provide:

Monitor the performance and throughput of the system.

At a minimum, the TCSI shall:

Monitor and collect system infrastructure metrics identified by the Government.

Provide Metric reporting to the Government in the MSR.

Perform analysis of measurement data, including analysis of the impact of new releases on capacity and system performance.

At a minimum, the TCSI shall:

Conduct data analyses.

Integrate risk management into its assessment process.

Project future capacity needs and how those projections are incorporated into its capacity management process.

Implement performance tuning of activities to ensure the most efficient use of existing infrastructure.

At a minimum, the TCSI shall:

Monitor, collect and analyze metric data identified by the Government.

Provide Metric reporting to the Government in the MSR.

Manage the demands on the Service and future plans for growth (or shrinkage).

Respond when performance falls below acceptable performance levels.

At a minimum, the TCSI shall:

Prevent system performance from dropping below acceptable performance levels.

Provide appropriately skilled personnel with the technical expertise to analyze system performance and remediate.

Influence demand for computing resources.

At a minimum, the TCSI shall:

Identify changes in system and user needs for changes in TRAP computing resources.

Prevent the demand for computing resources to exceed deployed system capacities and capabilities.

Conduct risk assessment of infrastructure and planned capacity needs to be integrated into the TCSI's overall risk management process.

At a minimum, the TCSI shall:

Integrate Capacity Management information within the TCSI risk processes.

Provide the Government with results of risk assessments in the MSR.

Availability Management.

Availability Management is responsible for ensuring application systems are up and available. The process ensures Government system availability requirements are being achieved and ensures the most cost-effective contingency plans are put in place and tested on a regular basis to ensure Government availability needs are met. Availability Management also provides a lead role in the Failure Modes and Effects Analysis (FMEA) and Failure Reporting and Corrective Action System (FRACAS).

TRAP has a Production NIPR and SIPR requirement for 98% Operational Availability (Ao) based on an operational time of 24/7/365. In addition and based on its MAC II Level designation, TRAP must be available within 24 hours after a downing event.

Pre-production and Training Environments operational when needed to support a particular event.

At a minimum, the TCSI shall:

Provide service (system) availability meets System User’s expectations.

At a minimum, the TCSI shall:

Maintain TRAP operational availability at 98%.

After award, within the Systems Maintenance Plan and Administration Manual, prepare and provide for planned outages and restoration after an unplanned outage.

Provide FMEA: a proactive process to determine the potential impact on service delivery in the event that a particular component (or CI) should fail.

At a minimum, the TCSI shall:

Provide appropriately skilled personnel with the technical expertise to conduct a FMEA.

Evaluate the impact a component failure will have on its related function within TRAP to identify areas of system weakness and potential remediation strategies.

Provide the results of the FMEA in a Government approved format.

Identify potential service availability issues.

At a minimum, the TCSI shall:

Integrate information from other areas of the PWS effort to create a higher-level of understanding of potential availability issues.

Provide recommended resolutions to the Government.

Provide FRACAS: the examination of past outages to identify related CIs, the CI’s impact on availability and future corrective action(s).

At a minimum, the TCSI shall:

Utilize personnel with the required technical expertise to collect outage data, rank the outages, determine causes and provide resolutions to either eliminate or reduce outage frequency.

Escalate problematic CIs and recommended resolutions to the Government.

Provide Obsolescence Management.

Conduct system maintenance in accordance with the System Maintenance and System Administration Manual.

At a minimum, the TCSI shall:

Maintain the TRAP System Maintenance Plan.

Support the technical requirements of the System Maintenance Plan during the lifecycle of the system.

Support the maintenance of all software and hardware required for the system. This includes all technology refreshes, software upgrades, patch releases, and maintenance releases as defined in the TFITS CMP 3rd and 4th octet changes. The Government will require a technical refresh in September 2014 (see Key Milestones). The Government has already acquired the hardware and software for the planned technical refresh in September.

Sustainment Logistics.

Sustainment logistics focus on lifecycle supportability.

At a minimum, the TCSI shall:

Provide Asset Management to include support of the Item Unique Identification (IUID) plan and preparing hardware for disposal.

At a minimum, the TCSI shall:

Update the Item Unique Identification Plan.

Provide hardware and software sustainment and prepare hardware for disposal.

Identify expiring Government-Furnished Software licenses and warranties a year in advance for the Government to replace or renew the license or warranty to prevent loss of service.

Provide End User Training and maintenance of Web-Based Training (WBT). Sustainment training is required to maintain the minimum acceptable level of proficiency or capability required for the System User to accomplish the mission objectives.

At a minimum, the TCSI shall:

Keep system user training materials up to date.

Provide Web-Based Training (WBT) in compliance with USMC Training and Education Command (TECOM) Courseware Development Standards policy.

One WBT module provides refresher training to the Basic User community.

Two WBT modules provides refresher training to the Super User community.

Demonstrate user proficiency post conduct of training.

Develop and maintain a comprehensive hardware and software refresh plan. The plan shall cover a 5 year period.

Task Management At a minimum, the TCSI task management efforts shall provide the following TRAP Task Management requirements:

TRAP PDSS Task Initiation.

TRAP PDSS Resource Coordination and management.

TRAP PDSS Roles and Responsibilities.

Individual TRAP PDSS Security Clearances.

Evidence of Top Secret Individual Clearance for any TRAP system administrator and/or individual with root access for the TRAP SIPRNET enclave.

The TCSI shall demonstrate that all individuals performing on classified aspects of TRAP have a current Secret Clearance and will maintain access to Secret Information. Secret access is required in order to attend meetings and perform daily work inside approved areas. Access to Secret data requires unescorted access into Secret spaces and access to Secret information and/or systems [SECRET Internet Protocol Router Network (SIPRNET)].

The TCSI shall have, and provide evidence of, necessary Cybersecurity certifications as appropriate for individuals supporting the TRAP system.

PDSS Task Execution.

At a minimum, for PDSS Task Execution the TCSI shall:

Perform quality assurance in accordance with the QAPP.

Identify and manage risks and update the Risk Management Plan, as necessary.

Attend, provide agenda, provide meeting minutes, and participate in any ad hoc Working Groups, Integrated Product Teams (IPT), Technical reviews, Technical Interchange meeting, In Process Reviews (IPR), and/or any other system specific meetings to support the requirements of the Task.

The TCSI shall attend the following meetings as provided in Table 1.

Table 1: Meetings PDSS Task Performance Management.

All metric Priority 1 from the TFITS Performance Measurement Plan, previous month’s activities, updated risk register, upcoming activities, all incidents, summary of service issues, problem trends, and anticipated Travel. The metrics submitted for the MSR shall be in accordance with the TFITS Program Measurement Plan.

Software Development Task Closeout.

Provide orderly closeout of the contract including final delivery of any remaining Government products, and preparation of a final report to include lessons learned and analysis of task.

Integrated Master Schedule System IMS.

At a minimum, the TCSI shall incorporate the TRAP PDSS into the System IMS and shall provide the ability to understand how it intends to manage the TRAP PDSS with visibility of:

Tasks;

Activities;

Schedule;

Deliverables; and Other TRAP TOs.

Key Task Milestones.

The key milestone dates in the below table are based on an anticipated award of the PDSS Task Order on March 15, 2014.

Table 2: Key Task Milestones 4.

Performance Standards.

The TCSI shall be monitored against the following performance standards and Acceptable Quality Levels.

· Satisfaction Surveys

· MSR

· = Standard

· Satisfaction Surveys

· MSR

· =Standard

· MSR

· Greater than 80% and less than 92%.

· MSR

· 4 hours after discovery

· Failure Reporting and Corrective Action System (FRACAS)

· MSR

· =Standard

· Help desk ticket logs.

· Failure Reporting and Corrective Action System (FRACAS)

· MSR

· =Standard

Table 3: Performance Standards

Applicable Documents and References.

The following documents provide essential programmatic information that needs to be considered in the TCSI’s proposed Annex and Deliverable package.

Program Documentation

Table 4: TRAP Program Documentation

* Note: The documents that are noted with an asterisk are notional. No copies will be provided.

System Documentation.

Table 5: TRAP System Documentation

* Note: The documents that are noted with an asterisk are notional. No copies will be provided.

TFITS Management Plans.

TFITS Performance Management Plan

Table 6: TFITS Management Plans

Other Guidance & Standards – Most current version of the following:

Federal Acquisition Regulation (FAR)

Table 7: Other Guidance & Standards Security Related Documentation.

Table 8: Security Related Documentation

Deliverables and Schedule.

The below Deliverables are notional and are not considered to be all inclusive. The TCSI shall propose the most comprehensive and cost effective Deliverables as tailored to the proposed solution. All Deliverables shall be delivered to the Government’s electronic repository (SharePoint) with a notification to the Contracting Officer, Contracting Officer’s Representative and the TRAP Project Manager.

Table 9: Notional Deliverables ASREQ = As it is difficult to predicate when the need to create/update the artifact will occur As Required is used.

ATOA = After Task Order Award

Government Furnished Equipment (GFE) and Information.

There is no GFE provided to the TCSI in performance of this contract. Available GFI is identified in Section 7.

Period of Performance.

The expected period of performance for this task is a 12 month period.

Place of Performance.

The primary place of performance will be the contractor’s facility. In addition, work will be performed at, Marine Corps Base, Quantico (TRAP hosting environment).

Travel and Other Direct Costs.

All work is expected to be completed by personnel residing within the local commuting area to MCB Quantico and any travel necessary to complete the work is expected to be included within the TO’s FFP. While travel may be required to support the requirements of this Task, travel is expected to be limited. Travel shall be handled in accordance with the Joint Federal Travel Regulations (JFTR), at the direction and approval of the Contracting Officer’s Representative (COR). Unauthorized travel, or travel not coordinated with the COR shall not be reimbursed. Additionally, travel or other direct costs in excess of the Contract Line Item Number (CLIN) funded value shall not be reimbursed, unless changed by mutual agreement of the parties through a contract modification.

Appendix A.