EIAS_Base_IDIQ_-_Attachment_1_PWS.docx

12 May 2015 Performance Work Statement For Product Manager (PdM) Total Force Information Technology Systems (TFITS) Engineering and Information Assurance Support (EIAS)

Scope:

The scope of this effort is to deliver Engineering, Information Assurance, and administrative support for Projects within Product Manager (PdM) Total Force Information Technology Systems (TFITS).

TFITS supports 28 major Projects (Applications/Systems) organized into three Main Portfolios of systems or Tier 2s (See Appendix A – TFITS Organization Chart):

· Manpower Operation Systems (MOS)

· Warfighting, Planning, and Analysis (WPA)

· Headquarters Marine Corps (HQMC) Sustainment and Training (HST)

TFITS has categorized each Project requiring support into two defined segments: Managed and Supported. There are 23 Managed and five (5) Supported Projects (See Appendix B – TFITS Project Descriptions). The following definitions are provided for clarification:

1) Managed: TFITS has control of all funding required for end-to-end lifecycle acquisition sustainment. Full support of Program Management, Cost Analysis, Engineering, Information Assurance, and Logistics is required.

2) Supported: TFITS has limited programmatic authority of the Project. This includes Joint Projects that require United States Marine Corps (USMC) certification and accreditation, fair share funding, and Configuration Management support.

The number of projects managed by TFITS is expected to change on a year to year basis and the Contractor should be prepared to support the addition of two to three new programs/projects annually.

The requirements identified in this PWS will provide support to the following tiers of the TFITS organization:

1) Tier 1: PdM, Deputy Product Manager (DPdM), and functional area Competency Leads. These are the leadership roles within PdM TFITS, reporting to the higher PM-110 Tier 0 level.

2) Tier 2: Three (3) TFITS Portfolio Managers, overseeing TFITS Acquisition and Portfolio Management: MOS; WPA; and HST.

3) Tier 3: TFITS Project Managers (PjM), managing Project level Applications/Systems within the overarching Tier 2 structure.

The required Engineering support consists of Systems Engineering, Architecture, Requirements Management, Test and Evaluation, and Configuration Management across TFITS.

The Information Assurance requirements include Information Assurance, Independent Verification and Validation (IV&V), Certification and Accreditation (C&A), Marine Corps Certification and Accreditation Support Tool (MCCAST), Vulnerability Testing, Interoperability, Federal Information Security Management Act (FISMA), and Clinger-Cohen support.

Purpose:

TFITS develops and executes portfolio-wide technical and program strategies to obtain efficiencies and provide informed, strategic management, oversight, and execution of the individual projects contained therein. This effort will provide engineering and information assurance support to inform and enable these technical and program strategies. To this end, specific activities, bound by the requirements specified in sections 3 and 4 below, include employing best business practices and processes, preparing the program for successful milestone decisions, participating in Integrated Product Teams (IPTs), validating Systems Integrator (SI) deliverables, planning and participating in Government testing and evaluation activities, and ensuring delivered capabilities are fully supportable.

Task Orders (TOs) will be issued based on EIAS responses to a Government need. Each request for proposal for TOs will contain the following aspects and parameters that are specifically tailored to the system requirements:

1.1.1 Task Order Matrix

1.1.2 Task Order PWS, to include deliverables (and travel, if applicable)

1.1.3 Government Furnished Equipment and Information (if applicable)

General Requirements:

All deliverables shall be submitted to the Contracting Officer’s Representative (COR) who will be responsible for deliverable tracking and acceptance.

3.2 The Contractor shall organize and attend meetings within 10 miles driving distance of the Quantico Corporate Center located at 1000 Corporate Drive, Stafford, Virginia. Contractor personnel shall attend regular meetings with stakeholders in the general vicinity of Marine Corps Base Quantico and as far away as the Pentagon. The Contractor personnel are expected to be physically present at numerous meetings each week in support of PdM TFITS Integrated Product Teams at the Product, Portfolio and project levels.

3.3 Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, Contractor personnel shall appropriately identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

3.4 The Contractor shall report Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract for the United States Marine Corps via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

1) W, Lease/Rental of Equipment;

2) X, Lease/Rental of Facilities;

3) Y, Construction of Structures and Facilities;

4) S, Utilities ONLY;

5) V, Freight and Shipping ONLY.

3.5 The Contractor shall submit to the Contracting Officer's Representative quarterly reports showing the total amount of labor costs incurred under this task order, broken out for the Prime Contractor and each Subcontractor. The Government will use this information to ensure the Contractor's compliance with Federal Acquisition Regulation 52.219-14, Limitations on Subcontracting.

Deliverable G0001: COR Quarterly Report

1. During the performance of their duties, the Contractor will working closely with the Government project teams and be exposed to project level data. All Contractor personnel supporting this contract will be required to sign and submit a U.S. MARINE CORPS SUPPORT CONTRACTOR NON-DISCLOSURE AGREEMENT (INDIVIDUAL) and may be ineligible to compete in future associated project support contracts.

Specific Requirements:

Tier 1 Program Management Support:

Within five (5) working days of contract award, the Contractor shall organize and attend a kick off meeting.

Within 30 days of contract award, the Contractor shall develop and maintain a contract management plan.

Deliverable P0001: Contract Management Plan

4.1.3 Within 30 days of initial award, the Contractor shall develop and submit a diagram of the company organizational chart depicting the personnel directory with the positions and matrix of support. Once developed, the diagram shall be maintained on a quarterly basis.

Deliverable P0002: Organizational Diagram

2. The Contractor shall conduct quarterly In-process Reviews that address an overall assessment of contract status, project review, program risk, status of funds, status of vacancies, schedules, completed deliverables, and concerns.

The Contractor shall prepare and submit Monthly Status Report (MSR) by the fifth (5th) calendar day, for the preceding month of performance, throughout the contract period of performance. The MSR shall cover monthly accomplishments, status of deliverables, planned activities for the next month, status of invoicing and billing, updated risk list and any other items that need the Government’s attention.

The Contractor shall collect and report on the performance metrics associated with deliverable and schedule completion. The final format for the report shall be coordinated between the Government and Contractor. At a minimum the MSR shall include:

· Contract Number

· Invoicing Period (start and end dates)

· List of accomplishments during the period by task/deliverable

· Contract issues and risks ranked by severity

· Contract Line Item Number (CLIN) status

· Rationale for deviations from schedule with mitigation plan

· Any other significant issues (schedule, technical, resource, etc.) with proposed resolution

Deliverable P0003: Monthly Status Report

Contract Final Report - The Contractor shall deliver a contract final report summarizing the entire period of performance. The report shall include a summary of all MSRs delivered. The report shall include all contract accomplishments, deviations from plan with background information, and lessons learned from contract activities (what has been experienced and process improvement recommendations). The Contractor shall provide with the final report a complete set of indexed contract documentation, including the closed contract.

Deliverable P0004: Contract Final Report

The Contractor shall organize and attend TFITS Engineering IPT Meetings within 10 miles driving distance of the Quantico Corporate Center located at 1000 Corporate Drive, Stafford, Virginia. Network and power connections for each attendee are required. Presentation equipment must be available for use to include, but not limited to projectors, televisions, monitors, and conference capable telephones.

The Contractor shall develop, submit and deliver meeting minutes for Engineering IPT Meetings within two (2) working days following the meeting.

Deliverable P0005: Engineering Meeting Minutes

The Contractor shall attend and brief their program support status at the weekly TFITS Tier 1, highlighting the support being provided at the Tier 1, Tier 2, and Tier 3 levels in order to reallocate resources if necessary based on PdM priorities.

The Contractor shall develop and deliver reports capturing personnel utilization metrics on a monthly basis to ensure personnel resources are being assigned to PdM TFITS priorities.

Deliverable P0006: Personnel Utilization Metrics Reports

The Contractor shall coordinate, review and update Engineering and Information Assurance (IA) documentation for all managed projects TFITS Program Management Reviews (PMR) on a monthly basis.

The Contractor shall draft, update, coordinate, and review Engineering and IA requirements to support PdM TFITS milestones to be briefed at the Tier 1 on a weekly basis.

Engineering Support:

Systems Engineering:

The Contractor shall document, consolidate, and manage all requirements baseline capabilities for the TFITS Managed Projects on a monthly basis.

The Contractor shall coordinate, develop agendas, capture meeting minutes, submit recommendations to System Engineering issues and update resolutions in the TFITS Action Item Tracker for all Systems Engineering Technical Reviews (SETR) including System Requirements Reviews, System Functional Reviews, Preliminary Design Reviews, Critical Design Reviews, Test Readiness Reviews, Program Readiness Reviews and Post-Implementation Reviews.

Deliverable E0001: TFITS Action Item Tracker

The Contractor shall review, and update TFITS Engineering Management plans on an annual basis (Systems Engineering Plan (SEP), Configuration Management Plan (CMP), (Systems Test & Evaluation Strategy (ST&ES), Performance Measurement Plan (PMP), and Requirements Management Plan (RMP).

The Contractor shall review and provide comments on SI contract deliverables on a monthly basis.

The Contractor shall review and provide comments on SI deliverables in support of planned SETR events, as defined in the TFITS SEP.

The Contractor shall attend, provide input and recommendations on technical matters, develop agendas, and briefing information in all Engineering IPTs and Engineering Review Boards (ERB).

The Contractor shall represent the Engineering Competency at Tier 1, 2 and 3 meetings on a weekly basis.

The Contractor shall review and comment on the list of Engineering Change Proposals (Class I and Class II ECPs) in support of ERBs on a monthly basis.

The Contractor shall manage, review and coordinate response for Engineering Marine Corps Action Tracking System taskers.

The Contractor shall develop and maintain the Program Protection Plan (PPP), as applicable.

The Contractor shall develop and/or maintain the Programmatic Environment, Safety & Occupational Health Evaluation, as applicable.

The Contractor shall develop and maintain the Engineering input into the Life Cycle Sustainment Plan (LCSP).

The Contractor shall update the Independent Logistics Assessment (ILA) Checklist respective to the Engineering competency on an annual basis.

The Contractor shall maintain PMRs and Quad Charts for TFITS Managed Projects and Quad Charts for TFITS Supported Projects on a monthly basis.

The Contractor shall document, update, and track Project risks identified by the Tier 2 and Tier 3 Project Managers on a monthly basis, to be briefed at the TFITS Tier 1 meeting and maintained in the ISI Risk Tracker on SharePoint.

The Contractor shall review and update Memorandums of Understanding (MOU), Memorandums of Agreement (MOA) and Service Level Agreements (SLA).

The Contractor shall review and analyze data provided by the SI and required by the PMP, and provide recommended engineering process improvements for action at the project level.

Architecture:

The Contractor shall develop and maintain TFITS Architecture Development Standard Operating Procedures (SOPs) annually.

The Contractor shall update existing Department of Defense Architecture Framework (DoDAF) architectural artifacts based on approved ECPs.

Deliverable A0001: DODAF Architectural Documents

The Contractor shall develop, submit, and maintain interoperability certification, testing, waivers, and legacy documents on an annual basis.

Deliverable A0002: Interoperability Documents

The Contractor shall develop and/or maintain the:

Requirements Management:

The Contractor shall perform requirements and traceability analysis, Requirements Traceability Matrix updates, System Design Specification (SDS) updates, and provide assessment of derived requirements to verify consistency and testability on a quarterly basis.

The Contractor shall update and maintain the TFITS Requirements Management Plan annually.

The Contractor shall develop and maintain Requirements Analysis SOPs annually.

The Contractor shall conduct requirements analysis to support development of ECPs for ERB, Configuration Control Board (CCB), and SETR processes.

The Contractor shall develop and maintain performance requirements quarterly.

Test and Evaluation:

The Contractor shall develop agendas, briefing information, capture meeting minute, submit recommendations to Test and Evaluation (T&E) issues, and provide action item resolution in support of the T&E IPT on a monthly basis.

The Contractor shall update and maintain the TFITS T&E Strategy on an annual basis.

The Contractor shall review and provide recommendations for test plans and results in support of requirement and design reviews and testing on a quarterly basis.

The Contractor shall review and recommend changes to the T&E metrics within the TFITS Performance Measurement Plan and TFITS Requirements Management Plan on a quarterly basis.

The Contractor shall determine and document the test success criteria that will be used to decide whether the requirement has been met on a quarterly basis.

The Contractor shall perform analysis of Government Acceptance Test (GAT) results to validate delivery of requirements and to characterize system performance in accordance with the SDS on a quarterly basis.

The Contractor shall review the technical documentation in accordance with the TFITS SEP; providing and collecting comments; generating, performing, and managing technical action items and reporting for the TFITS SETR process on a quarterly basis.

The Contractor shall develop and submit plans and test cases to support GAT and/or regression testing associated with the enhancement and test cases to support regression testing on a quarterly basis.

The Contractor shall prepare memoranda, reports, meeting agendas, and meeting minutes in support of TFITS Project testing events on a quarterly basis.

Configuration Management:

The Contractor shall coordinate meetings, develop agendas, review ECPs, capture minutes and action items in support of CCBs, ERBs, and for each managed TFITS Project estimated on a monthly basis.

The Contractor shall maintain and control COR approved SI Deliverables, Configuration Item Technical Database (CITDB) and Configuration Management System for each Project in accordance with the TFITS CMP on a quarterly basis.

The Contractor shall manage, track, and coordinate with the SIs on TFITS Project baselines and conduct Physical Configuration Audits for Configuration Status Accounting for each Managed Project on a quarterly basis.

The Contractor shall manage, track, and coordinate with the SIs to conduct Functional Configuration Audits for each Managed Project on a quarterly basis.

The Contractor shall update and maintain the CITDB for each Managed Project via the Government provided tool on a monthly basis.

The Contractor shall participate in the ERB for each TFITS Project on a quarterly basis by generating a list of ECPs to be considered for Engineering assessment, manage the ECP Tracker to ensure all ECP evaluations are entered, assist in the Engineering assessment of the changes for impact to the system, and identify changes to the Computer Software Configuration Item and the CITDB necessary to implement the change.

Deliverable C0001: TFITS ECP Tracker

The Contractor shall track and review configuration items in support of the Configuration Management process in accordance with the TFITS Configuration Management Plan on a quarterly basis.

Information Assurance (IA):

All personnel assigned to the IA requirements shall have an active Secret level clearance, or be able to achieve one within 30 days of the beginning of the period of performance.

The Contractor shall continually monitor IA C&A processes for TFITS systems and applications for compliance with current and future Marine Corps System Command (MCSC), HQMC, DON, and DoD policies, directives, guidelines, and instructions.

The Contractor shall aid in the implementation of IA related policies and provide support to ensure they are applied and enforced.

The Contractor shall confirm that IA policies and procedures are being followed during SI system development, operation, and maintenance activities during each quarterly release cycle.

The Contractor shall review and update applicable information assurance controls on an annual basis, using the currently approved DoD policy mandate, i.e. DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP) or Defense Information Assurance Risk Management Framework.

The Contractor shall identify and integrate IA requirements into the TFITS SETR monthly.

The Contractor shall review and provide feedback regarding SI security architectures, network diagrams, ports, protocols, data flows, and accreditation boundaries for IA compliance as needed.

The Contractor shall provide input to the lead Information Assurance Manager (IAM) for weekly status updates for inclusion in the Tier 1 Weekly Meeting.

The Contractor shall develop White Papers in support of accreditation decisions for system changes. TFITS requires approximately 25 White Papers.

The Contractor shall review and update MOUs, MOAs, and SLAs to ensure IA compliance on an annual basis.

The Contractor shall update the ILA Checklist respective to the Information Assurance competency on an annual basis.

The Contractor shall prepare an Information Assurance Strategy per TFITS project in support of Clinger Cohen Act requirements.

The Contractor shall prepare PPPs for designated systems.

Independent Verification and Validation:

The Contractor shall prepare the TFITS Project for IV&V test events via IA documentation updates, pre-assessment support, self-assessment result evaluation, Plan of Action & Milestone (POA&M) review and maintenance, and verify vulnerability scans and Security Technical Implementation Guides (STIGs) are performed on system/applications in preparation for IV&V. On average, each TFITS Project conducts an IV&V once every three (3) years per system. Historically TFITS averages seven (7) IV&V events per year.

The Contractor shall ensure systems are compliant with the latest STIGs.

Certification and Accreditation:

The Contractor shall review project Privacy Impact Assessments annually and develop updated documentation as required.

The Contractor shall review and develop documentation for the C&A process such as System Boundary Diagrams, C&A Communication Diagrams (Network Diagram, Data Flow Diagram, Execution flow diagram, interface list), Hardware/Software lists, Continuity of Operation Plan i.e., Contingency Plan, Emergency Action Plan, Disaster Recovery), System Security Plan (security Concept of Operations/IA control mapping), Information Assurance Vulnerability Management (IAVM) Implementation Plan SOP, List of Privileged Users, Signed Security Rules of Behavior/Acceptable Use Policy for privileged users, Ports/Protocols/Services, and C&A Spreadsheet as needed.

The Contractor shall track annual IA training/DoD 8570 certificates for system privileged users/IA Work Force.

The Contractor shall track the progress of accreditation packages throughout the C&A process.

The Contractor shall maintain a comprehensive Information Assurance Vulnerability Alerts (IAVA) management plan that encompasses all aspect and software configuration items used in the development of the systems.

The Contractor shall monitor IAVA and Operational Directives weekly and report status to required officials.

The Contractor shall capture, consolidate, and report on TFITS Performance Measurement Plan compliancy metrics on a monthly basis.

MCCAST Management:

The Contractor shall submit and maintain complete C&A documentation within the MCCAST; the Government’s approved IA Tool.

Vulnerability Testing:

The Contractor shall conduct monthly vulnerability scans using the approved government tool (i.e. Assured Compliance Assessment Solution), review vulnerability assessments from monthly scans, and develop mitigation strategies for identified findings in conjunction with the system administrator, engineering personnel, and project manager.

The Contractor shall develop POA&M based on vulnerability scans findings. POA&M shall be reviewed and updated monthly and completion dates are on track according to schedule.

Interoperability Support:

The Contractor shall participate in weekly IPT meetings and provide input on interoperability documentation, to include architecture diagrams and Interoperability Support Plan (ISP).

FISMA Compliancy Support:

The Contractor shall participate in Annual Security Reviews, Annual Security Control testing, and Annual Contingency Plan testing in compliance with the FISMA.

The Contractor shall confirm FISMA required quarterly POA&Ms are posted to IA reporting tool.

Facilities, Other Direct Costs (ODCs), and Travel Requirements:

Work efforts in support of this task effort will be accomplished at the Contractor’s facilities. This task will require the Contractor to provide a suitable infrastructure to manage program requirements (document library, databases, web site) throughout the course of performance to support the scope of activities. Such facilities are not reimbursed as ODCs. Laptops, cellular equipment/services, and other items of convenience are not reimbursable as ODCs.

All Government printing requirements MUST be done by or through the local Document Automation and Production Service (DAPS, now called DLA Document Services) http://www.daps.dla.mil/dapsonline.html.

All work is expected to be completed by personnel residing within the local commuting area and any travel necessary to complete the work is expected to be included within the Task Order’s Fixed Firm Price. While travel may be required to support the requirements of this Task, (See table 1) travel is expected to be limited. Travel shall be handled in accordance with the Joint Federal Travel Regulations, at the direction and approval of the COR. Unauthorized travel, or travel not coordinated with the COR shall not be reimbursed. Additionally, travel costs in excess of the CLIN funded value shall not be reimbursed, unless changed by mutual agreement of the parties through a contract modification.

Table 1: Proposed Travel

Security Requirements:

This contract will require the Contractor to have a Secret Facility Clearance and will require certain Contractors to obtain and maintain classified access eligibility. The Contractor shall have a valid Secret Facility Clearance prior to classified performance. The prime Contractor and all Subcontractors (through the prime Contractor) shall adhere to all aspects of DoD Directive 5220.22-M. All personnel identified to perform on this contract shall maintain compliance with Department of Defense, Department of the Navy, and Marine Corps Information and Personnel Security Policy to include completed background investigations (as required) prior to classified performance. This contract shall include a DoD Contract Security Classification Specification (DD Form 254) (Attachment 4). The Contractor shall notify the Government (written notice) within twenty-four hours of any Contractor personnel added or removed from the contract that have been granted classified access, issued a Common Access Card and/or Marine Corps System Command Building access.

Common Access Card (CAC) Requirements:

7.1 The COR will identify and approve those Contractor employees performing on this contract that require CACs in order to perform their job function. In accordance with Headquarters, United States Marine Corps issued guidance relative to Homeland Security Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued a CAC. In order to meet the eligibility criteria, Contractor employees requiring a CAC, must obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI.) Prior to authorizing a CAC, the employee’s Joint Personnel Adjudication System (JPAS) record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened.) The minimum acceptable investigation is a National Agency Check with Written Inquiries. If a Contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked.

7.2 Facility Security Officers (FSOs) are responsible for notifying the MCSC Security Director if any Contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. The FSO must also notify the MCSC Security Director of any adverse/derogatory information associated with the 13 Adjudicative Guidelines/Factors concerning any Contractor issued a CAC, regardless of whether a JPAS Incident Report is submitted.

7.3 Each CAC is issued with a “ctr.usmc.mil” e-mail account that the individual Contractor is responsible to keep active by logging in on a regular basis (at least twice a month), sending an e-mail and clearing any unneeded e-mails. Contractors are prohibited from “auto-forwarding” their .mil e-mail account to their .com e-mail account. If the ctr.usmc.mil e-mail account is not kept active, the G-6 will deactivate the account and CAC will lose its functionality.

7.4 CACs will only be issued to those Contractors supporting this contract that have been authorized by the COR. The COR will only authorize CACs for those Contractors that meet current (HSPD-12) criteria and have a definitive requirement.

7.5 If a Contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they have also lost their eligibility to perform on MCSC contracts. Such individuals must be replaced on the contract as soon as possible, not to exceed 30 calendar days unless otherwise coordinated and approved by the COR. CACs are not issued for convenience.

7.6 All contract support requiring administrative access to IT systems shall have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. This does not apply to contract support working administrative tasks. The Contractor shall meet the applicable information assurance certification requirements, including-

1. DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; IAT level III or IAM Level II or higher preferred and

2. Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cyber security functions.

Applicable Documents/References:

The following documents provide essential programmatic information that shall be considered in the Contractor’s proposal and deliverables.

Contractor Management Documentation

Systems Engineering Documentation

Outline the entrance and exit criteria for each level of testing and each software release Identify the material and resources required for each test phase

Other Guidance & Standards

Deliverables List