M67854-16-R-4806_Att_1_DRRS-MC_PWS_IDIQ.docx

Marine Corps Systems Command Program Manager Information Systems & Infrastructure

Total Force Information Technology Systems (TFITS) Defense Readiness Reporting System – Marine Corps (DRRS-MC), Indefinite Delivery Indefinite Quantity (IDIQ) Performance Work Statement

April 2016

Table of Contents

List of Tables

List of Figures

Defense Readiness Reporting System – Marine Corps Performance Work Statement ii Introduction Purpose and Scope The Total Force Information Technology Systems (TFITS) product office provides acquisition oversight for the portfolio of United States Marine Corps (USMC) systems. DRRS-MC falls under the Warfighting, Planning and Analysis Tier. The purpose of this Performance Work Statement (PWS) is to obtain Systems Integrator (SI) services for the Defense Readiness Reporting System – Marine Corps (DRRS-MC). The contractor shall provide Post Deployment Software Support (PDSS), system maintenance and performance upgrade services, and logistics support for the DRRS-MC as defined in this PWS.

The scope of this PWS covers the full range of PDSS, system maintenance and performance upgrade services. Services include program management; engineering and analysis; software development; configuration management; quality assurance; risk management; help desk; system and database administration; Information Assurance (IA); testing and evaluation; and logistics support.

Background The DRRS-MC is a Mission Assurance Category (MAC)-1 classified system and a Secure Internet Protocol Router (SIPR) only program. The DRRS-MC is the authoritative system for readiness reporting that supports the Service’s U.S. Code Title 10 responsibilities to measure and report the readiness of USMC forces and the supporting infrastructure to meet Service and Department of Defense (DoD) requirements. The DRRS-MC provides capabilities-based, adaptive, near-real-time readiness information used in making Service readiness assessments, and to aid crisis planning, operational decisions, and resource management. DRRS-MC feeds the DRRS Enterprise (DRRS-E) via the DRRS- Strategic (DRRS-S) which is used to satisfy Joint Staff, Office of the Secretary of Defense (OSD), and Combatant Command (COCOM) readiness data requirements. The DRRS-MC reports readiness of forces from lowest capability entity to high-level aggregations culminating at the Marine Forces (MARFOR) level. The DRRS-MC configuration consists of a network of tools, applications, and data working in a net-centric environment. The DRRS-MC is a collection of authoritative databases that provide users access to current data. This data feeds a collection of applications that allow commanders to report resource levels, provide mission assessments, conduct sustainability and risk analyses, and carry out adaptive planning. The DRRS-MC is an existing evolutionary abbreviated acquisition program with initial operational capability delivered in 2010 and the deployed version 2.0 delivered in May 2012. The DRRS-MC Training Environment, Production and Pre-Production systems are hosted by the Marine Air Ground Task Force (MAGTF) Information Technology Support Center (MITSC) located in the Basement Consolidated Server Room in the Pentagon. A DRRS-MC Disaster Recovery/Continuity of Operations site exists to ensure high availability for the MAC -1 classified system. Figure 1 is the DRRS-MC Operational View.

Figure 1: DRRS-MC Operational View Table 4 identifies the TFITS management plans that provide overarching guidance for TFITS managed projects. These documents form the foundation for the baseline for TFITS common business practices.

The DRRS-MC system consists of a collection of cross platform Java applications, residing in Oracle WebLogic, IBM Cognos, or loosely integrated as Windows Services. Network-enabled Unit Status Report – Marine Corps (NetUSR-MC) and Marine Corps Readiness Analysis Tool (MCRATS) are separate applications that are integrated into a Single Sign-On (SSO) Enterprise Archive (EAR) file within Oracle WebLogic to allow for SSO of the users. Applications reside in WebLogic 11g and pull in the database connections using WebLogic’s Data Sources so that the connections are secure and passwords are not stored within the applications. MCRAT is built using Cognos 10.2. This application has a custom built user information handler to allow users single sign-on from the Splash application to MCRAT. Figure 2 is a Physical Representation of the System Production Architecture.

Figure 2: Physical Representation of the System Production Architecture Government Approach to Contract Management The overall Contract shall be managed through the ID/IQ Performance Work Statement (PWS), Quality Assurance Surveillance Plan (QASP), and Contractor Management Plans (with task order specific annexes). The Contractor’s management plans shall establish the overarching strategy and plan to manage all aspects of the consolidated contract.

During the performance of the Contractor activities, the Contractor may be required to coordinate certain efforts with contracted Program Management Office (PMO) support.

Task Order (TO) TOs will be issued based on contractor responses to a government need. The Contractor’s response shall include a Task Management Plan (annex to the Project Management Plan), Integrated Master Schedule (IMS), and an appropriate annexes to other related management plans. Each TO may contain the following aspects and parameters that are specifically tailored to the system requirements:

Key Task Milestones.

Performance Standards.

Applicable Documents/References.

Deliverables and Schedule.

Government Furnished Property (GFP) and Information (GFI).

Period of Performance.

Place of Performance.

Travel and Other Direct Costs (ODCs).

Contractor Performance The Contract shall be performed in accordance with this PWS and the Government’s Quality Assurance Surveillance Plan (QASP). Additionally the contractor shall perform in accordance with the processes and standards in the Contractor’s PDSS Plan, Software Development Plan (SDP), Project Management Plan (PMP), and Quality Assurance Program Plan (QAPP).

During the performance of the DRRS-MC activities, the Contractor may be required to work cooperatively with program office personnel, functional advocates, and contracted support.

Objectives The PDSS, and system maintenance and performance upgrades shall be performed, managed, and monitored to the Government’s price, schedule, and performance objectives through an integrated and defined set of project processes tailored from Capability Maturity Model Integration (CMMI) Level III equivalent or higher set of standard processes.

The DRRS-MC system shall be available on a 24-hour basis, seven days a week.

Accurate and complete system documentation (configuration baselines, technical documentation, information assurance documentation, user documentation, web-based training, and other system documents) updates and any required certifications/accreditations shall precede the deployment of any capabilities.

Transition To minimize any decrease in system operational availability and to prevent possible negative impacts on PDSS services, the Government will require a transition period where the incumbent and new contractor shall transition knowledge and understanding of the DRRS-MC PDSS efforts and processes. The transition-in period will occur at the beginning of the first task order and the transition-out period will occur at end of the last performance period. The new contractor shall accept turnover of all system documentation. During the transition period, the Contractor shall become familiar with all PDSS efforts and processes in order to commence full performance of services.

Objectives of the Transition The objectives of the Transition period are to ensure the Contractor is equipped with the knowledge and resources necessary to perform PDSS. This means the Contractor has a complete understanding of the system to be managed. The Contractor has instantiated the necessary system environments to facilitate the development and testing of required patches and changes. Finally, the Contractor is ready to perform the critical PDSS activities.

System Knowledge Transfer The Contractor shall have a complete and comprehensive understanding of the system.

At a minimum, the Contractor shall demonstrate an understanding of the following at the Transition Readiness Review:

Existing engineering and technical documentation Existing user documentation Contractor System Instantiation The Contractor shall have the capability to conduct defect management which includes the ability to replicate system failures, test software patches prior to production release, and test system development efforts. At a minimum, Contractor System Instantiation includes:

Production System Software A current copy of the production system software, including source code, will be provided as part of the transition process to support PDSS activities and instantiation of a production representative system in the Contractor’s environment.

Development and Contractor Test Hosting Environment The Contractor shall provide the development and contractor test hosting environment for the production representative system instantiation to include hardware installation and configuration, software installation, and application configuration. The Contractor’s hosting environment shall be representative of the constraints and limitations of the production environment.

Test & Evaluation The Contractor shall have complete understanding (activities, notional timeline) of what is required to be tested and validated and will have a complete functioning replication of the production system as close to a SIPR system as possible.

Critical PDSS Activities The Contractor shall provide a detailed and executable plan to transfer on-going service support and service delivery activities from the incumbent contractor.

At a minimum, this includes:

Database administration;

System administration;

Cybersecurity;

System interfaces;

Help desk; and Web-based training (WBT) modules, training, and training materials Transition-In Period Transition Activity with the Government and Contractor Incumbent The Contractor shall, at the start of the period of performance, engage in the following activities throughout the transition period defined in the applicable TO:

Obtain administrative access, from the current contractor, to the system as well as system interfaces.

Obtain points of contact (POC)s, from the current contractor, to include telephone numbers and email addresses for the system, Functional Advocates, programmatic and technical POCs for interfacing systems, and POCs for current hardware and software maintenance agreements.

Schedule and attend no less than three and no more than five days of observing the current contractor during the conduct of system maintenance and administration during regular business hours. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Schedule and attend no less than three and no more than five days of conducting system maintenance and administration while the current contractor observes during regular business hours. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Schedule, plan, provide agenda and minutes, and participate in no less than one day-long and no more than three day-long working group sessions and meetings to facilitate knowledge transfer on system functionality. Days can be, but are not required to be, consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Conduct a Transition Readiness Review to formally establish the Contractor’s readiness to fully transition the subject system.

Transition-out Period Transition Activity with the Government and the Incoming Contractor The contractor shall engage in the following transition activities with the incoming contractor throughout the transition period defined in the applicable TO:

The incumbent contractor shall baseline the system and system documentation.

Baseline activities shall, at a minimum, consist of the following:

Physical Configuration Audit (PCA) or Validation of the PCA deltas.

The incumbent contractor shall support the Government PCA in accordance with Marine Corps System Command (MCSC) Technical Review (TR) Handbook v1.04, and all TFITS Management Plans.

Closure of all critical Action Items or critical Requests for Action Baseline documentation shall, at a minimum, consist of the following:

Configuration Item Technical Database (CITDB).

All deliverables as identified in the system(s) CITDB, system(s) contract, and PWS.

Software Source Code or Software Source Code location for future delivery Regression test driver codes and test scripts, test data and benchmark results matched to software release version number.

Government data in contractor licensed tools.

The incumbent contractor shall transfer to the Government ownership of all hardware and software items that were purchased by the incumbent contractor on behalf of the Government. The transfer process shall include re-registering all hardware and software components as MCSC/PMM (Information Systems and Infrastructure (IS&I)/(Product Manager (PdM) TFITS.

The incumbent contractor shall implement all applicable Information Assurance Vulnerability Alert (IAVA) patches, as well as Government funded Engineering Change Proposal- (ECP)s. Open IAVA patches and ECPs designated in the Transition Readiness Review will be the responsibility of the incoming contractor.

Assist incoming contractor with getting required access to support DRRS-MC; for example, administrator user Identification (ID)s and passwords, database user IDs and passwords, and all system(s) interfaces.

Provide incoming contractor with all established and current points of contact (POC)s and stakeholders, to include phone number and email address for the DRRS-MC Functional Advocate(s), programmatic and technical POCs for interfacing system(s), and POCs for current hardware and software maintenance agreements.

Provide no less than three and no more than five days of allowing incoming contractor to observe the incumbent contractor during the conduct of system maintenance and administration during regular business hours, i.e. 0800 - 1700. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Provide no less than three and no more than five days of incumbent contractor observing the incoming contractor during the conduct of system maintenance and administration during regular business operations, i.e. 0800 - 1700. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Attend no less than three and no more than five days of working sessions, meeting or both with the incoming contractor to facilitate knowledge transfer on system functionality, to include existing automated and manual interfaces. Days can be, but are not required to be consecutive. One day is equivalent to a minimum of eight hours, not including lunch.

Once approved by the Government, allow incoming contractor access to all system hardware and software within the Authority to Operate (ATO) boundary for inspection and audit. The incumbent contractor shall clarify any discrepancies in hardware and software assets.

Participate in Transition Readiness Review.

PDSS

The Contractor shall provide a PDSS Plan that describes the Contractor’s approach towards providing PDSS support in the areas of Service Support, Service Delivery, and Sustainment Logistics. At a minimum, the Plan shall address the support approach to accomplishing the tasks outlined in Section 3 of the PWS.

The Contractor shall provide a PDSS Support Schedule that shows the anticipated activities the Contractor plans to perform in executing PDSS.

Service Support Development and Contractor Test Hosting Environment The Contractor shall provide and maintain a development and Contractor test hosting environment that functionally reflects the production environment.

The Contractor provided environment shall include all hardware and software necessary for the development and integration testing necessary to support DRRS-MC. The Government will provide as GFP the HP Fortify Tool, or Government provided alternative, for system code reviews. The Government Acceptance Testing (GAT) will be conducted on a replica of the DRRS-MC pre-production system hosted on the classified MITSC network located within the Pentagon.

Help Desk The Government-furnished tool is BMC Remedy. The Contractor shall use BMC Remedy to provide help desk support.

The help desk is the single user point of focus for support and the reporting of incidents. The help desk processes include tracking and escalation procedures. In addition, the help desk is responsible for disseminating information regarding planned outages and implementation of changes impacting production services.

The Contractor’s help desk shall provide technical support and application assistance to users. It shall be operated from the location defined in each TO requiring help desk support. The operating hours of the help desk shall be as defined in each TO requiring help desk support. The Contractor shall observe industry “best practices,” with the objective to receive, track, communicate (status to the user), and resolve user calls.

At a minimum, the help desk shall provide and consist of the following:

Respond to, complete, and close help desk requests.

Capture, track, investigate, escalate, resolve, close, and report user help requests.

The Contractor shall use the existing government provided tool. Data includes: the caller’s name; work location; time of receipt of the call; the nature of the call; the time of resolution; and a brief statement of how the problem was resolved to record each user help request/trouble call. The Contractor has the ability to add data it feels is needed to improve its ability to manage help requests.

Elevate and resolve help requests that cannot be resolved in the time specified by the TO.

Help desk hours will be as defined by the TO.

The Contractor shall provide a help desk phone number, voicemail, and email address as defined by the TO.

Resolve system access issues and assist system users in basic system functions.

Escalate requests beyond the capability of the help desk to resolve to more advanced support personnel.

Incident Management The primary focus of Incident Management (IM) is the restoration of services following an incident. The IM is primarily a reactive process; its processes provide guidance on diagnostic and escalation procedures required to quickly restore services. The IM processes are closely integrated with help desk, problem management, and change management processes.

At a minimum, the Contractor shall:

Detect and record incident details.

Perform incident management including performance monitoring, incident identification, diagnosis, isolating, containment, eradication, recovery, and lessons learned.

Track incidents reported from the system users, the host site, and external interfacing systems.

Identify and report functions and files affected.

All availability issues shall be communicated to Government and non-Government stakeholders within one hour of discovery or notification.

Resolve incidents to support system operational availability.

Restore existing system and data.

Restore system to full operational capability.

Prioritize incidents in terms of impact and urgency with the objective to minimize user impact.

Assess type and severity (e.g., number of users effected) of incident.

Assess impact to data integrity.

Reduce unplanned downtime hours.

Identify incident impact to the Government.

Recommend ratings for the priority and the urgency of each incident.

Inform the Government of the restoration of services and effects of the incident to the user community.

Immediately escalate incidents that require expertise not available in the currently assigned Tier.

Provide help desk verification that the incident is closed and the system user is satisfied with the solution.

Problem Management The primary focus of Problem Management is to identify the causes of service issues and conduct corrective work to prevent recurrences. Problem Management processes are reactive in responding to events or problems and proactive in identifying and preventing future incidents. The Contractor’s processes are closely integrated with Incident Management, Change Management, and Availability Management. Although Availability Management performs the lead role in component failure and system outage analyses, Problem Management performs an important role in obtaining data and analyzing data in support of the analyses.

At a minimum, the Contractor shall:

Analyze historical data to support predictive analysis to eliminate potential incidents before they occur and to identify work-arounds.

Maintain historical data for all service problems.

Use a trouble ticket log to develop an analysis of trends to identify potential problems.

Provide the Government the results of problem trends in the Monthly Status Report (MSR).

Diagnose root cause and eliminate recurrences.

Provide the Government the potential causes of problems in its historical data.

Using historical data, provide the Government the Contractor’s approach for preventing problems from recurring.

Prioritize problems, in terms of impact and urgency, to minimize system user impact.

At a minimum, the Contractor shall:

Assess and provide type and severity (e.g., number of users affected) of problem.

Assess and provide impact to data integrity.

Reduce unplanned downtime hours.

Identify problem impacts to the Government.

Recommend the priority and the urgency to be assigned to each problem.

Inform the Government of the restoration of services and effects of the incident to the user community.

Develop workarounds or other solutions to incidents.

At a minimum, the Contractor shall:

Identify potential problems from the analysis of historical data.

Develop innovative workarounds and solutions to problems.

Present workarounds to the government for consideration and approval for implementing an Engineering Change Proposal (ECP).

Identify, develop and submit ECPs to Change Management to eliminate known problems.

Configuration Management Configuration Management (CM) processes guide the collecting, archiving and reporting of individual infrastructure component specifications. The Configuration Item Technical Database (CITDB) is the single repository of configuration information for the enterprise. In addition to configuration information, the database contains information regarding the relationships and dependencies among infrastructure components. The CM databases are also used by Capacity Management, Availability Management and Information Technology (IT) Service Continuity Management processes to accurately perform their work.

The Government seeks a CM environment that will ensure the baselines are maintained and that only controlled changes are implemented. The Contractor shall implement a CM program that will ensure the implementation of changes is documented and has no adverse effect on current system functionality. The Contractor shall provide a Configuration Management Plan (CMP) that provides the basis for performing and managing CM activities for the DRRS-MC and aligns with the TFITS CMP.

At a minimum, the Contractor shall:

Maintain the CITDB utilizing the approved TFITS CITDB format.

Identify new Configuration Item (CI)s and enter them into the CITDB.

Collect, record and maintain accurate information about CIs.

Establish and implement configuration control and approval processes required to change a CI’s attributes and re-baseline the CIs.

Change Management Change Management manages changes being introduced into the system. Change Management assesses risks of individual changes, uses configuration information to identify dependencies and other impacted applications and systems, and after analyzing the information, authorizes or denies change requests. The goal of Change Management is to identify application code, functional, and performance defects and intercept them before users are impacted.

The production, pre-production, and training systems are hosted by MITSC. A DRRS-MC Disaster Recovery/Continuity of Operations site exists to ensure high availability for the MAC -1 classified system. Assessment of changes to the infrastructure requires coordination between the host sites, the user community, Marine Corps System Command (MCSC), and the Contractor.

The Contractor shall prepare, as required, written system change approaches, estimated costs, and schedules for the Configuration Control Board (CCB). The authoritative source of all system ECPs is the Government’s ECP Tracker System. The Contractor may propose changes, but must receive approval from the CCB to execute ECPs.

The Contractor shall demonstrate how its processes align with TFITS management plans.

Contribute and record decisions and updates to any relevant products in tailored Systems Engineering Technical Review (SETR) events, Functional Review Boards (FRBs), Engineering Review Boards (ERBs), and CCBs.

Perform ECP assessments for risk, complexity, and potential user benefits prior to CCB meetings so they can be categorized and prioritized for submission into the next major release.

Maintain and update system integrator specific data elements of the Government’s ECP Tracker System. A Common Access Cards (CAC) will be required for access.

Provide a Level of Effort (LOE) to include the lifecycle hours for ECPs at the ERB. Provide a Rough Order of Magnitude (ROM) detailed lifecycle estimate for those ECPs approved by the CCB.

Identify application code defects, as well as, functional and performance defects and submit ECPs as appropriate.

Release Management Release Management is closely integrated with Change Management. Release Management manages changes to the environment such as installing vulnerability patches and software changes, and refreshing technology.

At a minimum, the Contractor shall:

Perform all technical and non-technical aspects of a release, including the update and maintenance of system baselines, system documentation, user documentation, and training documentation.

Plan and support the successful roll-out of software and related hardware including the required test, evaluation, and GAT processes.

Design, implement, and support efficient procedures for the distribution, installation and verification of changes to IT systems.

Coordinate and prepare the system user community for new release capabilities.

Ensure implementations are traceable and secure, and only correct, authorized and tested versions are installed.

Coordinate and plan releases with Change Management.

Provide master copies of all software and update the CITDB.

Document release plans in a Deployment Plan that, at a minimum, contains anticipated changes to be deployed (e.g., vulnerability patches, software upgrades, defect patches), Plan of Action and Milestones (POA&M) leading up to monthly deployment, configuration items that need to be updated (e.g., technical documentation, System Maintenance and System Administration Manual, CITDB, User Manual, Training Material), and a contingency plan.

Support the Government Post Implementation Review (PIR) in accordance with TFITS Management Plans.

Cybersecurity Management Marine Corps Order (MCO) 5239.2B establishes an information systems lifecycle management approach to protect critical Marine Corps information and intelligence. The Contractor shall support the requirements of MCO 5239.2B by establishing and implementing proactive protection, detection, reaction, disaster recovery and restoration capabilities to include the detection and reporting of unauthorized activities. The Contractor shall support the transition to the Risk Management Framework (RMF), as described in DoD Instruction (DoDI) 8510.01. The level of protection will be aligned with a MAC -1 Classified.

The Contractor shall have knowledge of and support all certification and accreditation (C&A) activities throughout the system lifecycle in accordance with the latest releases or revisions of the following policies located at:

http://www.dtic.mil/whs/directives/index.html and http://csrc.nist.gov/publications/PubsSPs.html At a minimum, the Contractor shall:

Maintain the DRRS-MC Authority-to-Operate (ATO), review and update documentation (to include but not limited to the Systems Information Profile (SIP), Department of Defense (DoD) Information Assurance Certification and Accreditation Process (DIACAP) Implementation Plan (DIP), Cyber Engineering Plan, and fulfill all annual Cybersecurity requirements for a MAC -1 classified program.

Ensure all DoD information system Cybersecurity-related documentation is current and accessible to properly authorized individuals.

Provide awareness and prevention through assessment and implementation of best practices (i.e. code reviews, system scans, vulnerability alerts, vendor notifications, Security Technical Implementation Guides (STIG)s).

Facilitate and participate in and ensure timely completion of Annual Security Reviews, Annual Security Control testing, and Contingency Plan testing. Update and submit the quarterly POA&M updates in compliance with the Federal Information Security Modernization Act (FISMA).

Use the Government’s IA tool, Marine Corps Certification and Accreditation Support Tool (MCCAST), to submit, maintain, and review Certification and Accreditation (C&A) documentation and workflow. The Government will assist in gaining access to the tool, as well as training for the tool.

Work with the Government engineering team to register any production software and versions implemented on the systems and approved for Marine Corps use in the Department of the Navy Application and Database Management System (DADMS) prior to any system upgrade. The Contractor shall complete and submit DADMS questionnaires for any software application required for DRRS-MC that is not already approved in DADMS for Marine Corps use.

Facilitate the protection of United States Government sensitive unclassified and classified information by working closely with the Government Information Systems Security Manager (ISSM), Information Systems Security Officer (ISSO) and staff.

Review, implement and report applicable Information Assurance Vulnerability Management (IAVM) and Operational Directives (OPDIRs). Monitor and comply with all DRRS-MC applicable notifications and advisories, including but not limited to Information Assurance Vulnerability Alerts (IAVA), Information Assurance Vulnerability Bulletins (IAVB), Information Assurance Vulnerability Technical Advisories (IAVT), Marine Administrative Message (MARADMIN)s, OPDIRs (released on SIPRNet, Marine Corps Directives (MCD)), and Defense Information System Agency (DISA) STIGs through the TFITS SETR process.

Submit certification of annual IA awareness training status to the PMO.

Review vulnerability assessment scans and provide technical guidance on remediation (including use of STIGS) and develop POA&Ms.

Review documentation, support pre-assessment, review vulnerability scans, test result evaluation, and review POA&M for Independent Verification and Validation (IV&V) test events.

Review documentation, support pre-assessment, review vulnerability scans, evaluate test results, and review POA&M for Command Cyber Readiness Inspection (CCRI) events.

Marine Corps Enterprise Development and Test Hosting Environment (EDTE) The Marine Corps intends to offer a government owned and operated private cloud environment providing IT system and application hosting services to support developmental and test activities. This capability will mitigate the requirement for the Government to contract external agencies and contractors to provide a hosting environment to conduct development and test functions. In support of the transition to the USMC EDTE:

The Contractor shall support the instantiation of a production representative system, to include migration planning meetings, software installation, and application configuration, in order to conduct future development and test activities in the EDTE cloud environment.

The Contractor shall be responsible for maintaining source code; application software and server configurations; and software updates to ensure total system functionality reflects the production environment. Remote access to the EDTE to manage and sustain the system development and test instances will be provided by the Government.

The Contractor shall be responsible for coordinating system patches and maintenance activities with the EDTE service provider when such activities impact Contractor developmental and test efforts.

Service Delivery Service Delivery processes assist in the identification of delivered or provided services, tailoring of services, the timely provision of services, resources, capabilities and capacities to meet the DRRS-MC’s needs.

Service Level Management Service Level Management (SLM) processes provide a framework by which services are defined, levels of service required to support business processes agreed upon and Service Level Agreement (SLA)s developed to satisfy the agreements. SLM processes will clearly define IT and business roles and responsibilities and establish clear goals for service delivery so success factors can be established, measured and reported.

At a minimum, the Contractor shall:

Manage and provide system performance in support of SLAs, Interface Control Document (ICD)s, and System Interface Agreement (SIA)s.

Develop and maintain an SLA, ICD and SIA for new interfaces.

Plan for changes to SLAs, ICDs and SIAs when there is a change to the system or external interfacing systems.

Manage and provide performance of system interfaces including web services.

Measure performance, report results.

Perform the Contractor role and responsibilities per approved SLAs and participate in the update of SLAs.

Continuity Management The IT Service Continuity Management (ITSCM) provides a framework for developing IT infrastructure recovery plans in support of business continuity management. The DRRS-MC shall maintain Continuity of Operations and Confidentiality in accordance with DoDI 8500.1 for a MAC -1 classified system. This DoDI outlines the roles, responsibilities and processes to be enacted in the case of circumstances preventing the continuity of the system. The MAC -1 Classified systems have a requirement of maintaining a redundant secondary system, not co-located with the primary system, which can be activated without loss of data or disruption to the operation. Information regarding system recovery plans is found in the Concept of Operations for the DRRS-MC.

The Contractor shall implement a system recovery plan that meets the requirements of the Concept of Operations for DRRS-MC.

Conduct risk assessment of IT services to identify the assets, threats, vulnerabilities and countermeasures for each service.

Evaluate options for recovery.

Test, review, and revise the continuity section within the System Maintenance and System Administration Manual as needed.

Capacity Management Capacity Management is responsible for ensuring that IT infrastructure resources are in place or available to satisfy planned needs and that those infrastructure assets are effectively used. Capacity Management is responsible for identifying anticipated growth demands. Activities in this area are proactive rather than reactive, and focus on finding application and infrastructure bottlenecks at current and future demands so that corrective actions can occur before DRRS-MC users experience service issues.

At a minimum, the Contractor shall:

Monitor the performance and throughput of the system.

Perform analysis of measurement data, including analysis of the impact of new releases on capacity and system performance.

Manage the demands on the System and future plans for growth and shrinkage.

Respond when performance falls below acceptable performance.

Influence demand for computing resources.

Conduct risk assessment of infrastructure and planned capacity needs to be integrated into risk management processes.

Availability Management Availability Management is responsible for ensuring application systems are up and available. The process ensures Government system availability requirements are being achieved and ensures the most cost-effective contingency plans are put in place and tested on a regular basis to ensure Government availability needs are met.

The Contractor shall ensure that the Pre-production and Training Environments are operational and properly configured when needed to support a particular event.

At a minimum, the Contractor shall:

Ensure service (system) availability meets the System users’ expectations.

Maintain system operational availability as defined in the applicable TO.

Prepare and provide for planned outages within the systems maintenance plan and administration manual.

Identify potential service availability issues.

Provide input to the Failure Reporting and Corrective Action System (FRACAS): the examination of past outages to identify related configuration items (CI), the CI’s impact on availability and future corrective action(s).

Provide Obsolescence Management.

Comprehensive obsolescence management should integrate processes, methods, and procedures to ensure that products can be supported over their complete life time.

Conduct system maintenance in accordance with the System Maintenance and System Administration Manual.

Support the maintenance of all software and hardware required for the system. This task includes all technology refreshes, software upgrades, patch releases, and maintenance releases as defined in the TFITS CMP for 3rd and 4th octet changes. The Contractor is to provide a list of existing ECPs from the ECP tracker that will be incorporated into PDSS Task Orders.

Maintain the DRRS-MC Production, Pre-production, Training and Disaster Recovery (DR)/Continuity of Operations (COOP) sites in accordance with System Maintenance and System Administration Manual.

Conduct failover tests to the DR/COOP site as required by DoDI 8500.01 The DRRS-MC hosting facility provides critical services required for the DRRS-MC system to achieve its high availability.

Sustainment Logistics Sustainment logistics focuses on lifecycle supportability.

At a minimum, the Contractor shall:

Provide Asset Management to include support of the Item Unique Identification (IUID) plan and preparing hardware for disposal.

Provide hardware and software sustainment and prepare hardware for disposal.

Identify expiring Government-Furnished Software licenses and warranties a year in advance for the Government to replace or renew the license or warranty to prevent loss of service.

Provide End User Training and maintenance of WBT.

Keep system user training materials up-to-date.

Maintain and update all WBT tools so the modules accurately reflect the deployed production system and current policies. The DRRS-MC currently has two WBT courses; the Network-enabled Unit Status Report – Marine Corps (NetUSR – MC) New User Training WBT is loaded to the DRRS-MC website and the Marine Corps Readiness Policy Training WBT is loaded to both the DRRS-MC website and MarineNet (Course number DRRSPOL01A).

Demonstrate user proficiency post conduct of training.

Sustainment Training Sustainment training is required to maintain the minimum acceptable level of proficiency or capability required for the System User to accomplish the mission objectives. The TCSI shall provide and support any or all of the following training methods and products as designated for each system.

Instructor Led Training Instructor led training is training provided in person by subject matter experts using approved curriculum; includes a post training survey.

Webinars Webinars are web based seminars that augment primary training materials and used to provide sustainment or differences training.

Web-Based Training Web-based training is any training curriculum that is provided via the Internet through the use of a learning management system.

Computer-Based Training Computer-based training is any training provided via the Internet without the use of a learning management system.

Differences Training Differences training is training designed to teach new system features.

Job Performance Aids Job performance aids are anything added to the work situation that improves job performance by guiding, facilitating, or reminding the performers in their execution of job tasks.

User and System Manuals User and system manuals are documentation related to the installation, use, operation, and maintenance of the system.

Training Materials Training materials are any materials used to document or convey training concepts.

New Equipment Training New equipment training provides for the initial training and transfer of knowledge from the program office or contractor to the tester and user. It represents the knowledge that is needed for operation, maintenance, and logistic support during testing and initial introduction of new materiel in the USMC inventory.

Newsletters Newsletters aid to communicate training updates and system enhancements to a dispersed user community.

Frequently Asked Questions Frequently asked questions are listed questions and answers, all supposed to be commonly asked in some context, and pertaining to a particular topic.

Develop and maintain a comprehensive hardware and software refresh plan that covers a five year period.

Software Development All development objectives should be developed and fielded in accordance with the Supplement to Guidebook for Acquisition of Naval Software Intensive Systems: Software Criteria and Guidance for Systems Engineering Technical Reviews and MCSC Technical Review Handbook v1.04 and Program Manager, Total Force Information Technology Systems Interim Policy Letter 1-11, Implementation of Tailored System Engineering Technical Reviews.

Additionally, all Software Development initiatives impact the system baseline and are therefore governed by the CM process as defined in the SDP and TFITS Management Plans. The SDP lays out the process required to develop, modify, or upgrade Government software and describes the details of each step along with any considerations that need to be addressed.

Software Development Plan The Contractor shall develop an SDP and execute a project-level system engineering process that addresses and coordinates with the processes, products, functions, and objectives described in the TFITS SEP. The Contractor shall provide an initial SDP and deliver an updated version as required. The Contractor shall continue to update the SDP to maintain alignment with this SEP. This SDP is considered a living document that will be updated as necessary to support evolving requirements and maturing products and processes. The SDP shall be updated with each system maintenance and performance upgrade. At a minimum, an update to the SDP will be reflected for each system maintenance and performance upgrade (classified as either an second octet/major or third octet/minor change) and new capability requirements (classified as a first octet capability change) shall ensure and provide the following in accordance with the specified level of SETR tailoring based in the ECP classification level.

Describe how the SDP can produce supporting artifacts that are based on the recommended methodology in the Supplement to Guidebook for Acquisition of Naval Software Intensive Systems: Software Criteria and Guidance for Systems Engineering Technical Reviews; TFITS Management Plans; and the Marine Corps Systems Command Technical Review Handbook, v1.04 dated April 2009.

Describe in the SDP specific Software Development areas where cost savings will be realized through reusability, reliability, and maintainability.

Provide a strategy for integrating CM, Human Systems Integration, Logistics, and Cybersecurity into each stage (4.1.1 – 4.1.5) of the software development process.

At a minimum, the SDP shall provide the Contractor’s approach to:

Provide derived requirements.

Design software.

Develop software.

Test software.

Deploy software.

Data driven Department of Defense Architecture Framework (DoDAF) compliant views (as necessary per TO) SDP Annexes An annex to the overarching SDP shall be developed in response to each software development related TO. At a minimum, the annex for each System Enhancement (classified as either a second octet or major or third octet minor change) and New Capability Requirements (classified as a first octet capability change) TO shall ensure and provide the following in accordance with the specified level of SETR tailoring based on the ECP classification level:

Requirements Analysis Phase The key objective of the Requirements Analysis Phase is to transform the Government’s needs into a technical view of a required product that could deliver those needs. Efforts involve defining user needs and requirements in the context of planned user environments and identified system characteristics to determine requirements for system functions.

At a minimum, the Contractor shall:

Elicit derived requirements.

Perform an iterative process of decomposing requirements into system functional requirements and establishing traceability.

Maintain traceability between the derived and Government-provided requirements.

Align requirements analysis efforts with MCSC acquisition requirements (TFITS Management Plans and SETR process).

Provide documentation needed to support the MCSC SETR process for System Requirements Reviews (SRR) and System Functional Reviews (SFR).

Document the functional baseline.

System Design Phase The objective for the System Design Phase is the on-time delivery of Government-approved documentation that provides the detailed design of each configuration item in the approved product baseline. The System Design phase produces a design that is based on the functional descriptions and products developed during the Requirements Analysis phase. The design is reflected in the products developed and delivered by the Contractor.

At a minimum the Contractor shall:

Provide the Contractor’s design process including the use of design and modeling tools, analyses, and tradeoffs.

Align the Contractor’s process with the TFITS Management Plans and the MCSC SETR process for Preliminary Design Review (PDR)s and Critical Design Review (CDR)s.

Provide documentation needed to support the PDRs/CDRs.

Document the Allocated and Product baselines.

Development Phase The prime objective for the Development Phase is the on-time delivery of a Government-tested and -accepted capability solution.

At a minimum the Contractor shall:

Develop, integrate, assemble, and test capability.

Provide in-process reviews.

Align the Contractor’s process with the TFITS Management Plans and MCSC SETR process for Test Readiness Review (TRR).

Provide documentation needed to support the DRRS-MC TRR and Production Readiness Review (PRR).

Support GAT, IV&V, code review, and cyber-penetration testing.

Deployment Phase The prime objective for the Deployment Phase is the deployment of the Government-accepted capability into the production environment in accordance with the established performance standards.

At a minimum the Contractor shall:

Document the Contractor’s deployment process.

Validate that all certifications and accreditations are in place prior to deployment.

Prepare the system user community to receive and use capability.

Warranty the software for three months from any defects.

Coordinate and deliver the deployment package within the PDSS Release Management process.

Project Management Project Management The Contractor shall prepare a Project Management Plan (PMP). The Government-approved PMP serves as the common understanding between the Government and the Contractor on how the Contract will be managed. The Government fully realizes that the Contractor shall need to periodically revisit and update the PMP to ensure that it accurately reflects the dynamics of managing a Contract of this magnitude. At a minimum, the PMP shall be updated annually and resubmitted to the Government for approval. Other than this annual submission, the Contractor has the latitude to build upon the document content to ensure all aspects of the Contractor’s collaborative project management process are addressed. All additional updates will require approval from the Government.

At a minimum, the PMP shall define and describe the Contractor’s:

Processes Planning: Contract planning, coordination, and schedule as well as methods, tools, and techniques used to estimate TO schedule and resource…