DRAFT_PDSS_Performance_Work_Statement_161006.docx

Post Deployment Sustainment Support (PDSS) Draft Performance Work Statement (PWS) Version: 161006

Prepared For:

GLOBAL COMBAT SUPPORT SYSTEM-MARINE CORPS /LOGISTICS CHAIN MANAGEMENT INCREMENT 1

(GCSS-MC/LCM INCREMENT 1)

POST DEPLOYMENT SYSTEM SUPPORT (PDSS)

QUANTICO, VA

Table of contents

Overview Scope The scope of this Performance Work Statement (PWS) is to acquire full lifecycle services for Post Deployment Sustainment Support (PDSS) of the Global Combat Support System – Marine Corps/Logistics Chain Management (GCSS-MC/LCM) Increment 1. The Contractor’s efforts will focus on providing technical, operational, and sustainment services required to support, operate and maintain the current GCSS-MC/LCM Increment 1 system. The overarching objective is to implement effective PDSS solutions based on industry best practices that support continuous system improvements and achieve cost efficiencies. Critical PDSS activities associated with this effort include:

Table 1: Critical GCSS-MC PDSS Support Services Expectations The Contractor is expected to leverage industry best practices and apply proven methodologies executing comprehensive PDSS services. The Contractor must be capable of providing proactive operations support to sustain 24 hours a day, 7 days a week, 365 days a year worldwide end-user access to GCSS-MC Increment 1 services. The Contractor must provide effective strategies, innovative approaches and executable recommendations to enhance business processes and provide continual service improvement to reduce total ownership costs. The Contractor must effectively manage and sustain all GCSS-MC Increment 1 assets, including hardware, software, warranties and licenses. The Contractor must be knowledgeable with Oracle E-Business Suite and Marine Corps logistics functions and processes to manage and tailor the GCSS-MC Increment 1 implementation of Oracle E-Business Suite (EBS). Finally, the Contractor must be experienced with managing PDSS efforts similar in size and complexity to GCSS-MC Increment 1.

Program Background GCSS-MC is the technology centerpiece for logistics modernization in the Marine Corps. GCSS-MC provides accurate, near real time integrated logistics information and enterprise-wide visibility of logistics data, enabling Marines to make informed decisions about the logistics chain commensurate with the operational tempo.

GCSS-MC/LCM is a Family of Systems (FoS) designated as an Acquisition Category I (ACAT I) Major Automated Information System (MAIS) by Under Secretary of Defense, Acquisition Technology and Logistics (USD, AT&L). GCSS-MC/LCM FoS is comprised of Logistics Legacy Information Systems (LIS) and GCSS-MC Increment 1. In March 2015, GCSS-MC Increment 1 received a Full Deployment Decision (FDD) and entered into its sustainment phase. Future Capability Releases are anticipated to occur approximately every 24 months, further extending the capabilities of GCSS-MC Increment 1. As new capabilities are developed and fielded, they may be incorporated into the GCSS-MC/LCM Increment PDSS baseline. Additionally, annual enhancements in the form of Engineering Change Proposals (ECPs) will be incorporated into the Increment 1.

GCSS-MC increment 1 is the first system in the portfolio, serving as the starting point for addressing several key shortfalls impacting the logistics community, including: multiple entry points for submitting and managing requests, a lack of enterprise asset visibility, inefficient capacity management, enterprise-wide standard processes; and the inability to monitor asset availability and maintain situational awareness.

GCSS-MC Increment 1 provides the Marine Air-Ground Task Force (MAGTF) and Supporting establishment with integrated, distributed logistics capability to plan, manage, execute, and monitor logistics business processes and sub-processes as depicted in Figure 1 below. Specific functions include asset visibility, supply, maintenance, readiness, task organization, request tracking and financial information. GCSS-MC/LCM Increment 1 supports over 25,000 enterprise users worldwide in both garrison and deployed environments.

Figure 1: GCSS-MC/LCM Increment 1 Processes & Sub-Processes GCSS-MC/LCM Increment 1 has achieved the following capabilities:

GCSS-MC/LCM Increment 1 resulted in the retirement of five (5) legacy systems:

In 2015, GCSS-MC fielded Release 1.1.1 (R1.1.1), providing an interim deployable capability for GCSS-MC users preparing to operate or operating in forward deployed environments. R1.1.1 includes an Enterprise Asset Task Organization (EATO) capability, Mobile Field Service (MFS) technology, and integration of a Tactical Wide Area Network (WAN) optimization solution. EATO provides the ability to create task-organized units that can execute logistics chain management functions. MFS provides a GCSS-MC user the ability to perform limited supply and maintenance functions in the absence of a network connection. The Tactical WAN optimization solution is comprised of a suite of Commercial Off-The-Shelf (COTS) Riverbed Steelhead Appliances and Steelhead Mobile Controller hardware that is integrated into the GCSS-MC system architecture to optimize deployed GCSS-MC user sessions and reduce latency caused by poor tactical network connections. The High Level Time Line (HLTL) of PDSS efforts to include the Increment 1 timeline is depicted in Figure 2.

Figure 2: GCSS-MC/LCM Increment 1 High Level Timeline In addition to the R12 upgrade and new SDE previously mentioned, several additional changes and enhancements are envisioned for GCSS-MC Increment 1, to include:

System changes are driven by many factors, including Department of Defense (DoD), Department of the Navy (DoN), and U.S. Marine Corps policy, including logistics and cybersecurity policies; fiscal compliance requirements; user requirements; and technology changes. System updates are implemented using a combination of Change Requests (CRs) and Engineering Change Proposals (ECPs) managed through the GCSS-MC PMO Configuration Management process. CRs are used for routine changes required to sustain the system. Engineering Change Proposals (ECPs) are used to address proposed system design changes in context with program budget, schedule, and system performance. ECPs address software, hardware, firmware, interfaces, infrastructure, cyber security/information assurance, technical data, and necessary sustainment activities. System changes will be managed in accordance with the GCSS-MC Sustainment Engineering Plan (SEP), Configuration Management Plan (CMP), System Engineering Technical Review (SETR) process, and applicable PMO plans and processes. management plans and processes. Refer to Appendix (TBD) for further information on applicable plans and processes.

A backlog of ECPs and CRs exists and is currently managed by the GCSS-MC Configuration Control Board (CCB). GCSS-MC releases updates to the production system as fixes become available, with an average of four (4) bug fixes and two (2) enhancements (Change Requests) per release. The schedule also accounts for quarterly Critical Patch Updates (CPUs) from Oracle®. The Government intends to transition to quarterly releases. The high level GCSS-MC CM Process is illustrated in Figure 3.

Figure 3: GCSS-MC PDSS CCB Process The remaining steps of the GCSS-MC PMO hosting strategy include the upgrade of Oracle EBS to R12 in the DISA DECC hosting facility and migration of the GCSS-MC system to the Marine Corps Enterprise Information Technology Services (MCEITS). The GCSS-MC PMO envisions migrating GCSS-MC to a “Platform as a Service” model. The TRI site was the first step in executing the vision.

As-Is System Description Enterprise Production System (PROD) The current GCSS-MC Production system (PROD) is based on the Oracle E-Business Suite (EBS) (version R11) application operating on Oracle Engineered Hardware (OEH) Exadata Stack v5. The PROD resides at the MITSC-East facility at Camp Lejeune, North Carolina. GCSS-MC/LCM is web-accessible to over 22,000 worldwide users, serving between 5,000 and 6,000 distinct users per day, with a daily maximum concurrent usage of between 1,200 and 1,500 users. The next planned hosting facility for the Production system is at the Marine Corps Enterprise Information Technology System (MCEITS) Enterprise Information Technology Center (EITC) 2, also in Camp Lejeune. This migration is anticipated to take place in CY17. Also occurring in CY17 is an upgrade of EBS to version R12.

GCSS-MC/LCM Increment 1 Enterprise Resource Planning (ERP) Application The GCSS-MC software utilized is a Commercial off the Shelf (COTS) product, the Oracle E-Business suite (EBS). Increment 1 currently uses EBS Release 11i (R11i). However, an upgrade effort is underway to migrate to Release 12 (R12) with a scheduled implementation in September 2017. In addition to the out of-the-box functionality of Oracle® EBS, Increment 1 includes use of Marine Corps specific customizations. These customizations, referred to as RICECPW objects (Reports, Interfaces, Customizations, Extensions, Configurations, Personalizations, and Workflows) support Marine Corps unique business processes, as described below.

Reports - unique to the Marine Corps supply and maintenance capabilities

Currently there are more than 300 RICE objects have been developed and implemented into Increment 1.

GCSS-MC uses the Oracle® Application Implementation Methodology® (AIM)/Oracle Unified Method® (OUM) to manage application development. PMW-230 employs a combination of DoD and Information Technology Service Management (ITSM) processes, including use of Information Technology Infrastructure Library version 3 (ITILv3) framework to plan, execute and manage PDSS services.

Production Support System (PSS) The GCSS-MC Production Support System (PSS) is identical to the Production system and resides on the same hardware as Production at MITSC-East. Its upgrade and migration plans roughly match those of the Production system. The PSS system is used to conduct Government Acceptance Testing (GAT) of Contractor-developed solutions before applying these to the Production system.

Solutions Development Environments (SDE), Including Training, Cloning and Testing Environments The GCSS-MC Solutions Development Environment (SDE) currently resides in a Carpathia facility near Dulles, Virginia. It consists of several developmental environments in support of the Production system. The SDE provides for development, testing, and troubleshooting of the GCSS-MC application. The SDE consists of the Block 1 Development (B1Dev) and Block 1 Configuration Management (B1CM) environments. Applications are developed and unit tested using B1Dev before they are promoted to the B1CM for further integration level testing. While the B1CM environment is identical to Production at the application level, it is hosted on older commodity hardware (Itanium servers) and therefore not hardware engineered by the software vendor as with PROD and PSS. GCSS-MC/LCM is initiating a contract for a future SDE that will be hosted on Oracle Engineered Hardware and mirror the PROD and PSS. The new SDE is expected to be implemented in C17.

Mobile Training Suites (MTS) MTS provides GCSS-MC users with Mobile Training Suites (MTS) to learn GCSS-MC functions and processes. MTS consists of the equipment, software, database, documentation, and procedures used in the training of GCSS-MC/LCM user and key personnel in locations where network connectivity to the Enterprise Training environment is not available. The MTS is built and stored within portable enclosures so that it can be easily transported to any training environment. MTS cases consist of a server, storage array, 24 laptops, switches to connect the laptops to the server/array, and all ancillary equipment to have a complete computer-based classroom. As curriculum is developed or updated, it is sent to the Commands and uploaded to the MTS. MTSs are deployed to various locations worldwide. A more detailed description of the MTS and their locations are provided in Appendix (TBD) Transition The overarching objective of transition is to minimize any impacts to system operations and to prevent negative impacts to GCSS-MC Increment 1 services. During the transition period, the Contractor shall ensure they gain necessary knowledge and resources to perform all required PDSS tasks. Upon completion of the Transition-In period, the PDSSI shall possess a complete understanding of the system to be managed and shall assume responsibility for performing all support tasks defined in the TO.

To achieve this objective, the Government will require a transition period not to exceed 90 days where the current support contractors, PMO and the Contractor will transition knowledge, documentation, and support responsibility of PDSS services. For follow-on TOs the Government may require TO level transition periods, such as supporting integration of new capabilities from developers to the GCSS-MC/LCM system for PDSS. The initial Transition-In period will occur at the beginning of the first TO issued under this contract and the Transition-Out period will occur at end of the last TO issued under this contract. The Contractor shall accept turnover of all system documentation. During the transition period, the Contractor shall become familiar with all PDSS efforts and processes to commence full performance of services.

Transition Plan The Government will meet with the Contractor following contract award to discuss any proposed changes to the Plan and to coordinate transition activities. During this meeting the Government will discuss transition exit criteria the contractor must meet to satisfy transition requirements and fully assume task responsibilities. The Contractor shall submit a final Transition Plan within seven (7) business days of the meeting. The final Transition-In Plan shall be approved by the COR and will be used to manage and track transition activities and progress.

At a minimum, the Transition Plan shall address their approach towards the following topics:

· Transition organization

· Staffing, including use of transition personnel

· Transition management

· Transition communications

· Establishing knowledge of GCSS-MC system, applications, and operations, including help desk services

· Review of GCSS-MC documentation, including CRs and ECPs

· Assumption of support responsibilities, including operations, production and development environments, and support functions

· Transition schedule, including Plan of Action and Milestones (POAM)

· Managing transition risks, issues and problems

· Verification of Asset Management repository

· Verification of all GFE and GFI

· Verification of current system baselines Transition-In During transition, the Contractor shall communicate transition status, progress, and any issues requiring Government awareness or involvement. The Contractor shall report progress towards meeting Transition exit criteria and readiness to assume full support responsibilities. For proposed transitions of less than 90 days, the Contractor shall describe how they will reduce the schedule and mitigate potential risks. During transition, the Contractor shall gain access to the systems, databases, repositories and physical access to systems and facilities as required to execute support. Facilities operated by different organizations may follow different access procedures. The Contractor shall communicate requirements with program stakeholders, including the GCSS-MC PMO, hosting facilities, support vendors and GCSS-MC user community to execute transition.

Transition-Out The Contractor shall ensure a seamless transition at the end of the contract. At a minimum, the approach shall develop or provide:

· Transition Out POAM

· Project management processes

· Transfer of operational responsibility and support functions

· Technical and project management documentation

· Communications and coordination with Government and incoming Contractor Transition of responsibilities for full lifecycle system sustainment of Increment 1 shall be executed in a phased and controlled manner that progressively transfers responsibilities from the incumbent to the new Contractor upon contract award.

PDSS Tasks Service Strategy Proof of Concept/Pilot Projects The Contractor shall provide technical support of PMO initiatives and pilot projects that explore technical initiatives for enhancing the Increment 1 system or integrating future enhancements to the current system, such as migration to cloud services Technical Studies and Analysis The Contractor shall conduct Technical Studies and Analysis on topics of interest to the PMO. Examples of studies and analysis include Integration Support The Contractor shall perform a technical assessment of capabilities developed external to GCSS-MC PDSS. When tasked, the Contractor shall support the migration of new capabilities into the PDSS portfolio.

Audit Compliance The GCSS-MC Program Manager is responsible for improving program financial efficiency and accountability of system internal controls, business processes and supporting documentation of financial statements. To enable GCSS-MC to perform effective audit compliance, the Contractor shall describe their approach to implementing audit compliance, sustaining financial and audit compliance, including tools and processes used for audit compliance, perform audit readiness and reporting, and providing GCSS-MC with the ability to trace budgetary transactions financial statements (capture and retain transaction data).

Technology Refresh The Contractor shall analyze existing Increment 1 hardware and software and provide recommendations for technology refresh. When directed, the Contractor shall perform technology refresh of designated hardware and software.

Service Level Management Service Level Management (SLM) provides a framework by which services are defined, levels of service required to support business processes are agreed upon, and Service Level Agreements (SLAs) are developed to satisfy the agreements. SLM processes establish clear goals for service delivery so success factors can be established, measured, and reported.

For Increment 1 the GCSS-MC PMO has identified twelve (12) critical processes by which it measures end-user performance. These User Performance Assessments (UPAs) serve as the foundation for ensuring Increment 1 achieves agreed upon GCSS-MC service levels.

Service level management Execution The Contractor shall establish Service Level Management and provide a framework for defining services, establishing required levels of service and service delivery goals. The Contractor shall monitor, manage and report Quality of Service (QoS) for defined Key Performance Parameters (KPP) and Key Performance Indicators (KPI) to achieve desired levels of service. The Contractor shall describe its use of tools, processes and use of metrics, benchmarking and trend analysis to establish and enhance QoS and system performance. As new services are identified, the Contractor shall assist with defining the level of performance needed, the cost, and the expected demand to implement the service.

Service Level Agreements, Operational Level Agreements and Underpinning contracts The PMO has established several Service Level of Agreements (SLA) between GCSS-MC and Service Providers that define the required IT service, associated service level targets, and roles and responsibilities of the organizations.

The Contractor shall review existing SLAs and provide recommendations to enhance SLA alignment to performance and service level objectives. The Contractor shall monitor and report on existing SLAs with external providers and the Contractor to ensure service providers adhere to defined service level targets. Where interdependent or internal dependencies exist for SLAs, the Contractor shall provide recommendations on establishing Operational Level Agreements (OLA) to define the required service, level of services required and roles and responsibilities of the organizations involved. The Contractor shall identify any service level dependencies that exist in Underpinning Contracts to ensure a cohesive and integrated approach exists in executing SLM.

Continual Service Improvement Continual service improvement is concerned with the monitoring and reporting of service and performance metrics as well as the ongoing evaluation of the collected data to maximize the efficiency and effectiveness of the Increment 1 environment.

The Contractor shall provide Continuous Service Improvement (CSI) by identifying, monitoring and reporting metrics to improve Increment 1 services and processes. The Contractor shall provide recommendations to enhance Increment 1 performance reduce costs and achieve efficiencies. The Contractor shall describe their use of Cost-Benefit analysis in recommending service improvements to enable the Government to make informed business and investment decisions.

Capacity Management The Contractor shall assess current metrics used to assess QoS, performance and capacity and provide recommendations on additional metrics to monitor performance. The Contractor shall identify the tools, processes and approach towards managing capacity and their approach to managing capacity in response to changes in user demand. The Contractor shall assess capacity requirements for new services and provide recommendations on required changes to the infrastructure and other resources to sustain or meet service levels.

Program Management Support The Contractor shall provide program management and oversight of all activities performed by Contractor personnel, including subordinate project managers and subcontractors, to satisfy the requirements identified in the PWS. The Contractor shall identify a Program Manager (PM) by name that shall provide management, direction, administration, quality assurance, and leadership of the execution of TOs issued under this contract.

The PM shall serve as the Government’s primary point-of-contact and provide technical supervision and guidance for all Contractor personnel assigned to support the GCSS-MC Increment 1.

The PM is designated as key personnel and shall possess knowledge or experience in the following areas:

· Managing Post Deployment Sustainment Support IT Services

· Marine Corps Logistics/Supply Chain Management

· Excellent written and verbal communication skills, and have demonstrated ability to present material to senior DoD and non-DoD officials Project Kick-Off Meeting & post award conference The Contractor shall schedule and coordinate a Project Kick-Off Meeting to occur within seven (7) calendar days after Contract award at the Government’s primary site at 105 Tech Parkway, Stafford, VA. The meeting will provide an introduction between the contractor personnel and Government personnel who will be involved with this Contract. The meeting will provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures. At a minimum, the attendees will include key contractor personnel, representatives from the PMO, other relevant Government personnel, and the Contracting Officer’s Representative (COR). At a minimum, the Contractor shall provide the following at the Kick-Off meeting:

· Staffing Plan and Status

· Organization Chart

· Transition-In Plan (Draft)

· Project Management Plan (Draft)

· Quality Management Plan (Draft) Project Management Plan (PMP) The Contractor shall document all support requirements in a PMP. The PMP shall describe the Contractor’s approach towards:

· Managing and executing the IDIQ

· Identifying, monitoring, controlling, mitigating, and reporting risks

· Managing communications between the Contractor and the Government, its affiliates, and stakeholders

· Developing and maintaining Standard Operating Procedures (SOPs) for all tasks

· Developing and maintain an overall Work Breakdown Structure (WBS)

· Developing and maintaining an Integrated Master Schedule (IMS) that tracks all tasks

· Developing and maintaining project cost, schedule and performance metrics

· Developing assumptions and constraints

· Project deliverables

· Success criteria and conditions of satisfaction Quality Management Plan (QMP) The Contractor shall provide a QMP that addresses the Contractor’s approach to meet quality and performance standards outlined in the Quality Assurance Surveillance Plan (QASP) and the Performance Requirements Summary (PRS). The QMP shall include, at a minimum, the following components:

· Quality objectives

· Key project deliverables and processes to be reviewed for satisfactory quality level

· Quality standards

· Quality control and assurance activities, including process for reporting quality control and assurance problems

· Quality roles and responsibilities

· Quality tools Monthly Status Report (MSR) When directed, the Contractor Program Manager shall develop and provide a MSR using MS Office Suite applications, by the 10th of each month via electronic mail to the GCSS-MC COR. The MSR shall in accordance with the defined CDRL standard and shall include the following:

· Activities during reporting period, by task area, to include: On-going activities, new activities, activities completed; progress to date.

· Issues, problems and concerns and proposed or corrective actions taken. The Contractor shall clearly identify any issues or problems requiring Government involvement or resolution.

· Personnel gains, losses and status, such as access or security clearance

· Metrics Performance Evaluation/Technical Status Meeting When directed, the Contractor PM shall convene a monthly Contract Activity and Status meeting with the COR and other designated Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activity and MSR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. One day prior to the meeting, the Contractor shall provide the COR with an agenda of the meeting. Within three workdays following the meeting the Contractor PM shall provide written minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, to the COR. Any non-concurrence of the meeting notes content by the Government Contractor will be provided to the Contractor for revision within three calendar days following receipt of the minutes. The Contractor shall make the necessary changes and provide them to the Government within two workdays.

The Contractor shall prepare a Plan of Action Report at the end of each week for the GCSS-MC Increment 1 PDSS technical lead that presents major weekly Contract activities completed and events and milestones to be completed the following week.

Quarterly Reviews The Contractor shall prepare and deliver a Quarterly Review presentation to the GCSS-MC PMO. At a minimum, the Review shall include a synopsis of activities for the quarter, accomplishments (such as releases, incidents and problems resolved), risks, issues and recommendations. The Review shall also include a high level overview of activities for the upcoming quarter.

Meeting and Conference Minutes The Contractor shall draft and submit minutes for all meetings hosted by the Contractor in accordance with defined CDRL standards.

Trip Reports The Government will identify the need for a Trip Report when the Request for Travel is submitted. When required, The Contractor shall write and submit trip reports for all approved Contractor travel (excluding local travel) in accordance with defined CDRL standards.

System Engineering The complex nature of the GCSS-MC PDSS task requires for the prospective Contractor to possess knowledge of DoD, DON and Marine Corps engineering regulations, processes, and tools used by the PMO, including DoD Directive 5000.1 Defense Acquisition System and the System Engineering Technical Review (SETR) process. The PMO currently uses IBM® Rational® DOORS® for Requirements Management, Serena® Business Manager for Configuration and Asset Management, HP-ALM ® for Testing, and Serena Dimensions CM® for software development and MS SharePoint for technical data . The PMO also uses BMC REMEDY for Help Desk Ticketing but is in the process of migrating to ITSM. The Contractor shall describe how they will integrate use of Contractor tools with existing Government tools and processes.

The Contractor must also processes knowledge of the applications and tools used by GCSS-MC Enterprise system. They include: Oracle Commercial Off-The-Shelf (COTS) products Oracle Identity Management, Oracle Internet Directory, Oracle eBusiness Suite, SOA BPEL, B2B, OHS, Webcache and WebGate, Mobile Field Service (MFS), Oracle Business Intelligence Enterprise Edition (OBIEE), Oracle Enterprise Manager (OEM), Oracle Business Availability Manager (BAM), Oracle Advanced Supply Chain Planning (ASCP), and Oracle Database 11g, Life Cycle Supply Chain Management, Request Management, Order Management, Capacity Management, Production Management, and Fulfillment Execution. The Contractor shall describe their knowledge and experience in supporting these tools.

System Engineering Processes GCSS-MC uses the SETR process for managing Engineering Change Proposals (ECP) to provide program management with assessments of program technical health and maturity at key points in the development life cycle. ECPs include system enhancements or modifications, feasibility studies, engineering analysis and design changes. While the SETR is primarily used to manage ECPs, the process may also be used to manage system sustainment activities of a complex nature or where substantial risk is involved. The PMO uses a streamlined Sustaining Engineering Process for system maintenance activities, including defect corrections and Information Assurance Vulnerability Management (IAVM), manage and assess system changes. The Contractor shall describe how they will integrate their engineering processes to align to the SETR and In-Process Reviews processes. The Contractor shall also describe their approach in delivering functional and technical expertise to effectively evaluate, scope, and develop ECPs and system maintenance activities.

The Contractor shall describe their approach towards delivering a disciplined systems engineering capability that fully integrates all aspects of PDSS and complies with DoD System Acquisition and Engineering practices. The Contractor’s approach shall leverage industry standards such as Institute of Electrical and Electronics Engineers (IEEE) 12207, Systems and Software Engineering — Software life cycle processes, Engineering Institute of America (EIA 649). The Contractor shall prepare and deliver required artifacts to support SETR and Sustaining Engineering process events.

System Engineering Management Plan The Contractor shall provide a Systems Engineering Management Plan that describes the Contractor’s approach towards managing their engineering process. The Contractor shall describe how the SEMP is aligned to the GCSS-MC Sustainment Engineering Plan (SEP), The SEMP shall describe the Contractor's approach for planning, executing and sustaining systems engineering activities aligned to the SETR process. As part of the SEMP, the Contractor shall provide, implement, and adhere to a Portfolio Engineering Management strategy that outlines the Contractor's strategy for enabling the end-to-end engineering process across tasks to identify capabilities, system engineering techniques, redundancies, gaps, or shortfalls in the Increment 1 portfolio.

Application Development The Contractor shall provide a Software Development Plan that describes the Contractor’s approach towards application development. At a minimum, the Contractor shall perform disciplined application development activities consistent with Capability Maturity Model Integration (CMMI) Level III. The Contractor shall implement application development and infrastructure management solutions which sustain code and system configurations and associated design documentation to support enhancements and correction of defects.

Interface and Data Quality Management The GCSS-MC Increment 1 system relies on more than 100 system interfaces to perform its mission, including 65 Production and 45 PSS system interfaces. Each of these interfaces must be continually monitored and actively maintained to support the 12-15 million document records and 3 million transactions occurring each day. Interface and Data Management requires a detailed understanding of GCSS-MC business processes, application and data design. The Contractor shall deliver necessary expertise in GCSS-MC business processes, and technical skills in system interfaces, data flow, data analysis, data structure and database design. The Contractor shall deliver the necessary expertise in interface and data management to maintain data integrity and end-to-end data flow and processing necessary to executing GCSS-MC functions.

To minimize operational impacts, maintenance and implementation of system changes must often be accomplished during off-peak times, including evenings and weekends. The Contractor shall provide a flexible and responsive support approach executing interface and data management maintenance and implementation.

Interface Management GCSS-MC Interface Management describes the process for interface sustainment activities to include conversions, with the primary emphasis on RICECPW monitoring, issue resolution, and support in the execution and maintenance of the interface management process. The Contractor shall follow established procedures, processes, documents, including the Interface Control Document (ICD) template and System Interface Agreement (SIA) template to manage and develop ICDs and SIAs. The Contractor shall work closely and cooperatively with internal and external organizations and agencies, often involving extensive, global coordination, to manage ICDs and SIAs.

The Contractor shall assess the impact of changes upon system interfaces, including changes resulting from policy, cybersecurity, system, or user requirements. The Contractor shall provide technical assessments and recommended changes to system interfaces to support changes. When directed, the Contractor shall make necessary immediate, responsive configuration changes to system interfaces to support operational needs. The Contractor shall properly document immediate and formal, CM/CCB approved changes in appropriate ICDs, SIAs, and technical drawings. The Contractor shall work closely with the cybersecurity team to coordinate updates to the Ports, Protocols and Services Management (PPSM) and maintain system accreditation.

The Contractor shall sustain existing Increment 1 interfaces by inspecting, testing, analyzing, and repairing interfaces. When required, the Contractor shall design, develop, and implement new or revised Increment 1 interfaces in accordance with approved ECPs.

The Contractor shall provide technical assistance to the Tiered Help Desk, Incident and Problem Management, Configuration Management and Test functions to quickly identify, assess and resolve system outages resulting from interface issues. The Contractor shall provide a rapid analysis and response capability in analyzing interface issues and making changes to interface controls to support operational requirements.

The Contractor shall actively participate and work cooperatively and proactively with managers and contractors as a member of the System Integration Integrated Product Team (SI IPT). The Contractor shall provide technical assessments and recommendations, status and resource updates and a high level schedule of ongoing and planned events.

Data Management Increment 1 Data Management describes the end-to-end process for managing the design, development, and the collaboration points between the COTS software, system customizations, external systems, and third party software. The Contractor shall manage the design, development, implementation and sustainment of Increment 1 interfaces and data management tasks necessary for full lifecycle sustainment in accordance with established PMO plans and processes.

The Contractor shall describe their data management approach which includes inspecting, analyzing, and reporting issues and trends to make recommendations for corrections or enhancements.

The Contractor shall provide in-depth data analysis expertise performing incident and problem analysis and resolution. The Contractor shall provide end-to-end data flow, database and data structure analysis to identify issues and provide recommendations to resolve.

The Contractor shall evaluate changes in Enterprise Data Management and changes in Policies to assess data management impacts and provide recommendations.

The Contractor shall provide data analysis support to ECPs, Change Requests (CR), and formal taskers to assess impacts and provide recommendations The Contractor shall develop and sustain an Electronic Enterprise Data Dictionary defined and accepted by Program Office.

Information Security Management/CyberSecurity The objective of Information Security Management/Cybersecurity is to protect Marine Corps critical information from internal and external threats and attacks, while ensuring the confidentiality, integrity, and availability of information.

GCSS-MC is considered to be Mission Assurance Category (MAC) II augmented by select MAC I IA controls as described in the GCSS-MC IA Strategy, and with a Confidentiality Level of Sensitive, as described in Department of Defense Instructions (DoDI) 8500.1.

To achieve cybersecurity objectives, the Contractor shall adhere to the requirements of Marine Corps Order (MCO) 5239.2A and DODI 8510.01 Risk Management Framework (RMF) for DoD IT as appropriate GCSS-MC Increment 1. The Contractor shall have knowledge of, and support all certification and accreditation (C&A) activities throughout the system lifecycle in accordance with the latest releases or revisions of the cybersecurity policies.

System Accreditation Support The Contractor shall describe their approach to provide full sustainment and support of Increment 1 cybersecurity requirements per DoD, DoN and USMC instructions.

The Contractor shall describe their process to maintain the system’s Authority-to-Operate (ATO) or Marine Corps Certified Application (MCCA). This shall include the approach to review and update documentation and ensure all DoD information system cybersecurity-related documentation is current and accessible to properly authorized individuals. The Contractor shall demonstrate their knowledge and use of the DoD Information Assurance Certification and Accreditation Process (DIACAP) or Defense Information Assurance Risk Management Framework (DIARMF) processes, and how they will ensure they fulfill all annual cybersecurity requirements for each program.

The Contractor shall use the Government’s IA tool, MCCAST, to submit, maintain, and review C&A documentation and workflow. The Government will provide access to, and training material for, the tool.

The Contractor shall facilitate the protection of US Government sensitive unclassified and classified information by working closely with the government Information Systems Security Manager (ISSM), Information Systems Security Officer (ISSO) and staff.

The Contractor shall describe their approach to increase the security of the system and eliminate vulnerability threats and to providing awareness and prevention through assessment and implementation of cybersecurity best practices (code reviews, system scans, vulnerability alerts, vendor notifications, Security Technical Implementation Guides (STIGs)).

Vulnerability Management The Contractor shall implement a system for the assessment, remediation, tracking, and reporting of system vulnerabilities per Information Assurance Vulnerability Management (IAVMs) and Operational Directives (OPDIRs).

At the direction of the ISSM, the Contractor shall conduct an initial impact analysis for each vulnerability, finding, and security notification for impacts to system security compliance. The Contractor shall describe their process to identify and develop CRs and ECPs to address CY security issues.

The Contractor shall review vulnerability assessment scans and provide technical guidance on remediation (including use of STIGS) and develop a POA&M. The Contractor shall ensure all vulnerabilities identified by the hosting facility’s vulnerability scans are incorporated and mitigated.

The Contractor shall conduct software quality code reviews with Government provided automated tool(s).

The Contractor shall conduct cybersecurity risk analysis to include identification and mitigation of cyber security risks to Commercial Off-The-Shelf (COTS) software.

The Contractor shall facilitate and participate in and provide timely completion of Annual Security Reviews, Annual Security Control testing, Annual Contingency Plan testing, and quarterly update and submission of quarterly Plan of Action and Milestones (POA&M) updates in compliance with the Federal Information Security Management Act (FISMA).

The Contractor shall confirm compliance of annual IA awareness training status.

The Contractor shall provide a monthly identification of vulnerabilities and remediation in accordance with Communications Tasking Order (CTO) 08-005 Scanning and Remediation and DoDI 8510.01.

The Contractor shall fully support Command Cyber Readiness Inspection events. This includes the review of systems security documentation, performance of pre-assessment scans, review of vulnerability scan results, evaluation of test results, preparation and review of POA&Ms, and remediation of findings.

The Contractor shall ensure all security updates and patches are tested and applied to software and operating systems. The Contractor shall support Independent Verification and Validation (IV&V) events. This includes the review of systems security documentation, performance of pre-assessment scans, review of vulnerability scan results, evaluation of test results, preparation and review of POA&Ms, and remediation of findings.

Change/Configuration Management Configuration Management (CM) processes guide the collecting, archiving, and reporting of individual infrastructure component specifications. The Configuration Database is the single repository of configuration information for the enterprise. In addition to configuration information, the database contains information regarding the relationships and dependencies among infrastructure components.

CM processes closely integrate with Change Management processes because risk assessments shall take into consideration any relationships and dependencies that may be affected by requested changes to production operations. CM databases are also used by other management processes to accurately perform their work. The Contractor shall describe their approach in accomplishing CM of PDSS activities. The Contractor shall integrate their CM processes into the Government’s CM processes, including identification, use and tracking of Configuration Items (CI) and CM baselines.

It is the goal of GCSS-MC implement quarterly releases for maintenance and enhancements.

Change Management The Contractor shall participate in Change Assessment Boards and present their evaluation of ECPs and CRs, including a technical assessment of priority and severity, recommended technical approach to correct or implement, and the scope of effort (cost) to implement the change and associated documentation. The Contractor shall identify opportunities to implement block upgrades for related ECPs or CRs where implementing block upgrades can save time, money or enhance performance.

The Contractor shall establish and implement configuration control and approval processes required to change a CI’s attributes and re-baseline the CIs. The Contractor shall ensure changes are fully documented, including preparation of Release Notes and Version Description Documents.

The Contractor will identify any required training, updates to user and training documentation. The Contractor shall plan and support the successful deployment of software and hardware changes.

Configuration Management The Contractor shall provide, implement, and adhere to a Configuration Management Plan that outlines the Contractor's strategy for identifying, creating, recording, reporting, changing, controlling, and managing all Increment 1 Configuration Items (CIs). CI’s shall encompass all Increment 1 hardware, software, documentation, and their versions, statuses, relationships, configurations, and baselines.

The Contractor shall establish and implement configuration control and approval processes required to change a CI’s attributes and re-baseline the CIs.

The Contractor shall ensure all CRs and ECPs are properly documented in CIs and that the Configuration Management Database (CMDB) is updated accordingly. The Contractor shall ensure that releases are coordinated with Change Management and Release Management.

The Contractor shall describe their approach in maintaining the CMDB and all CIs in one authoritative repository, how changes to CIs will be recorded and how the repository will be used to maintain CIs throughout their lifecycle. The Contractor shall provide a Technical Data Package annually that includes all updated GCSS-MC CIs.

Code Management The Contractor shall describe its code management approach for developing, storing, maintaining, updating, and delivering code As new builds and releases are developed, the Contractor shall provide Installation and Release Notes in conjunction with the code builds.

Release Management Release Management is closely integrated with Change Management. Release Management manages changes to the environment such as installing vulnerability patches and software patches and changes and refreshing technology. The Contractor shall coordinate and plan releases with Change Management, ensuring only approved changes are implemented.

The Contractor shall update system and baseline documentation, configuration status accounting data, and identify any required training; updating user documentation, and training documentation. The Contractor shall prepare Release Notes and Version Description Documents detailing changes implemented in the release.

The Contractor shall document release plans in a Deployment Plan that at a minimum contains anticipated changes to be deployed (e.g., vulnerability patches, software upgrades, defect patches), POA&M leading up to monthly deployment, CIs that need to be updated (e.g., technical documentation, system maintenance and system administration manuals, CMDB, user manual, training material), and…