MPSEConversion Draft PWS.pdf

DRAFT PERFORMANCE WORK STATEMENT (PWS)

COMMAND FLEET READINESS CENTER (COMFRC)

NAVAL AIR SYSTEMS COMMAND (NAVAIR) DEPOT MAINTENANCE SYSTEM (NDMS)

MAINTENANCE PLANNING, SCHEDULING AND EXECUTION (MPS&E) SUPPORT

1 BACKGROUND / SCOPE

1.1 MPS&E is a suite of Government off-the-shelf (GOTS) application modules that provide an information technology

(IT) solution for several major business processes supporting all levels of aviation maintenance. The system is used both within the continental United States (CONUS) and outside the continental United States (OCONUS). Users are from Naval Aviation Enterprise (NAE) wide programs, including the Joint Strike Fighter program, COMFRC HQ, multiple Fleet Readiness Centers (FRCs), and an array of PMAs. The IT solution provides an opportunity to reduce the cost of maintenance by providing better Reliability Centered Maintenance (RCM) analysis, maintenance task analysis, planning, and scheduling of aircraft maintenance and repair. The system currently supports 2,275 active users and the customer base is growing daily.

1.2 Some modules are written in an antiquated ColdFusion Flex technology. The contractor needs to be very familiar with the system and have the technical understanding and ability to convert ColdFusion code over to Microsoft .NET in order for COMFRC to ensure continuity of operations (COOP). The technology needs to be rewritten and converted to Microsoft .NET by October 31, 2020. This COMFRC requirement is to have the ColdFusion modules converted, documented, government acceptance tested, test defects resolved during the test phase, and post production defects resolved. The Adobe vendor, and all browsers used to display the ColdFusion Framework will not support the existing technology after December 2020. All modules that are not converted by December 31, 2020 must be shut down and take off the NMCI network per SECNAVINST 5230.15. Although the conversions have been on-going with prior efforts, the fast approaching deadline has created a high priority compelling urgency to get the code converted as quickly as possible.

2 APPLICABLE DOCUMENTS

2.1 Department of Defense Specifications

2.1.1 SECNAV M-5510.36 B Information Security Program, 12 Jul 2019

2.1.2 DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4

(enclosure 3 pages 11-18) 24 Feb 2012

2.1.3 DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) 25 Jan 2017

2.1.4 SECNAV M-5510.30 Personnel Security Program Jun 2006

2.1.5 OPNAVINST 3440.17A Navy Installation Emergency Management Program, 1 Aug 2014

2.1.6 DoD 5000.02, Operation of the Defense Acquisition System, 10 Aug 2017

2.1.7 DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), 18 May 2016

2.1.8 DoDM 5200.01 Vol.3, DOD Information Security Program: Protection of Classified Information 19 March

2.1.9 DODI 5230.24, Distribution Statements on Technical Documents, 23 August 2012

2.1.10 DODI 1000.13 Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and

Other Eligible Individuals, Change 1, Effective 14 Dec 2017

2.1.11 SECNAVINST 5230.15, Information Management/Information Technology Policy for Fielding of

Commercial off the shelf Software, 10 April 2009

2.2 Department of Defense standards

2.2.1 Chairman of the Joint Chiefs of Staff Instruction CJCSI 3170.01I, Joint Capabilities Integration and

Development System, 23 January 2015

2.3 Other Government documents

2.3.1 COMFRC 3300.1A AntiTerrorism Plan, 29 Jan 2016

2.3.2 NAVAIR Depot Maintenance System (NDMS) Organization Standard Software Process (OSSP), 31 Jan

2.4 Industry documents

2.4.1 Institute of Electrical & Electronics Engineers (IEEE)/Electronics Industries Association (EIA) IEEE/EIA

Std 12207

3 REQUIREMENTS

3.1 General Requirements

3.1.1 Compatibility - The Contractor shall have and maintain a hardware and software environment with the capability to prepare documents and software packages compatible with the Government’s Test and Production IT environments through the security classification of Unclassified. The contractor’s environment must be capable to mirror the Government’s current operating environment, which includes but is not limited to:

Microsoft Windows 10 or higher

Microsoft Project 2010 or higher

Microsoft Office Professional Plus 2010 or higher

Microsoft Visio 2010 or higher

Adobe Acrobat XI Pro

Adobe Acrobat XI (Reader)

Internet access

Internet Explorer 11 or higher

Microsoft Edge 42 or higher

Firefox 60 or higher

Google Chrome 76 or higher

Change Request Ticket Tracking System

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and local area network (LAN) communications with COMFRC. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with COMFRC during working hours whether at Contractor work site or on travel.

The Government will not provide servers, hardware, or software under this contract. Therefore, the contractor shall have their own development and test environments, which need to contain the minimum specification requirements listed below:

Web Application Server Instance x2 (development, and test)

8 vCPU

16GB RAM

300GB Disk

Microsoft Windows Server 2008R2 or higher

Microsoft .NET Framework 4 or higher

Microsoft Internet Information Service 8.5 or higher

Adobe ColdFusion Server 2016

Oracle Java Development Kit 11

Apache Tomcat 7

Python 2.7

Database Server Instance x2 (development, and test)

32 vCPU

32GB RAM

3.5TB Disk

Windows Server 2016 or higher

Microsoft SQL Server 2014 or higher

3.1.2 Work Location and Facilities

Work location: 90 percent of the work will be performed at the Contractor site and 10 percent at the Government site.

Meeting support: In support of the tasking outlined in this PWS, the Contractor shall have the capability to host and conduct unclassified meetings. The hosted meeting venue shall have the capacity to support a minimum of 25 people and have contractor furnished telephone and VTC capability. The contractor meeting location shall have sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1.

This support shall be provided at the contractor’s facility.

3.1.3 Contract Status reporting. The contractor shall provide the following documentation.

Monthly Progress and Financial Status Report: The contractor shall provide a progress and financial status report in accordance with the Contract Data Requirement List (CDRL). The report shall include work accomplished since submittal of the last report.

CDRL A001 - DI-MGMT-80227 - Monthly Status Report

3.1.4 Work Schedule for this effort will be determined by the contractor with the below Government schedule consideration. Collaboration with the Government will be conducted within the Government normal working hours.

Government Work schedule: The Contractor shall provide the required services and staffing coverage at a minimum during normal flexible working hours. Normal flexible working hours are usually 8.5 hours (including a 30-minute lunch break), between 0600 – 1800 each Monday through Friday (except on the legal holidays specified in paragraph

3.1.4.1).

3.1.4.1 Holidays: The Government observes the following holidays:

New Year’s Day, January 1

Martin Luther King’s Birthday, the third Monday in January

President’s Birthday, the third Monday in February

Memorial Day, the last Monday in May

Independence Day, July 4

Labor Day, the first Monday in September

Columbus Day, the second Monday in October

Veteran’s Day, November 11

Thanksgiving Day, the fourth Thursday in November

Christmas Day, December 25

With the exception of the events in section 3.1.4.2 below, the contractor is permitted to observe the above Holidays in accordance with its corporate policy.

3.1.4.2 Installation closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the

Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies

3.1.4.3 Overtime: There will be no overtime authorized for this effort.

3.1.5 Other Direct Costs: There will be no material or ODC required for this effort.

Travel: There will be no travel required for this effort. Government facility visits shall be local to the contractor’s facility.

3.1.6 Subcontractors: Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this PWS shall flow down to subcontractors providing support under this contract.

3.1.7 Management of Contractor Personnel: The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.1.8 Transition-In

The Contractor shall have a 30-day effective and orderly transition-in period which will enable the new company to assume full responsibility for tasking on the contract with minimal impact. The transition in plan shall at a minimum include the elements listed below.

- Points of Contact. The contractor shall establish POC liaisons between the Government, the Prime Contractor, and other contracted industry partners to ensure a proper and orderly transition and transfer of services and assets between the parties cites.

- Work Turnover. To ensure minimum disruption to vital Government business, the contractor shall establish an overview of the transition efforts and activities to include a schedule with milestones by activity. The transition plan shall enable effective familiarization of the system and receive tasked work that is in process at award of the contract from the incumbent company to ensure there is no service degradation during or after transition. Establish and maintain effective communication with the outgoing contractor or Government personnel for the 30-day period of transition via weekly status meetings.

- Quality Assurance. The contractor shall receive and review the plan of action to ensure continuation of quality review processes during the transition period from the incumbent company.

- Risk Mitigation Strategies. The contractor shall obtain transition knowledge, and information regarding risks and problem areas from the incumbent or Government personnel and review the plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

- Data/Information Transfer. The contractor shall receive and review the plan of action for the efficient inventory and transfer of program data from the incumbent company.

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Personnel Security Requirements

a. At a minimum, at least (2) of the contractor personnel performing work under this contract shall meet the requirements for the IT-1 sensitivity level access at contract award.

b. Contract personnel working under this contract must sign and submit a non-disclosure agreement (NDA).

3.2.3 Investigative Requirements:

Unclassified: All Contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by

SECNAV M-5510.30. All Contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the Office of Personnel Management. The Contractor shall submit a request for personnel security investigation to the

Government Security Office. The Government Security Office shall initiate the Contractor’s Electronic Questionnaire for Investigations Processing (eQIP), shall do a preliminary screening of the Contractor’s eQIP for suitability and derogatory information. The Contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government Security Office may deny the Contractor access to Government facilities and information and may prohibit the Contractor from performance of sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the Contractor’s eQIP. In such cases, the Contractor employee may not perform on the Contract.

3.2.4 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request

(SAAR-N).

SAAR-N: All contractor personnel requiring access to Government Information Technology (IT) systems shall have an approved System Authorization Access Request (SAAR-N) Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work. Instructions for processing the SAAR-N forms are available at:

http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf.

SAAR-N forms shall be submitted to the COR, Government Technical Point of Contact (TPOC), or to the assigned government Trusted Associate Sponsorship System (TASS) Trusted Associate.

Command Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges will be issued by the Government to contractor personnel and shall be visible at all times while personnel are at the

Government site. The contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to the OPNAV 5239 SAAR-N process. All CACs and identification badges issued to

Contractor employees shall be returned to the Government sponsor in accordance with DoD Instruction 1000.13, “Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible

Individuals,” January 21, 2014, following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the contractor access to Government facilities, as required, for performance of tasks under this contract. Contractor personnel shall comply with the COMFRCINST

3300.1A Anti-Terrorism Plan, 29 JAN 2016.

Unclassified information shall be handled as “For Official Use Only”. Distribution is authorized to the Requiring

Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

3.2.5 Information Security. The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of controlled unclassified information (CUI) and to control distribution of CUI in accordance with DoD 5220.22-M (NISPOM), and SECNAV M-5510.36.

Marking: All information generated by the Contractor shall be properly marked. For Official Use Only information generated and/or provided under this contract shall be marked in accordance with DoDM 5200.01. Technical http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDI5230.24 and program Security Classification Guidance

Public Release: No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. government authority. Proposed public releases shall be submitted for approval prior to release through the COMFRC Public Affairs Office.

Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the

COR, TPOC, and Government Security Office within 24 hours of the incident occurring.

3.2.6 Operations Security (OPSEC): The contractor shall comply with activity OPSEC program instructions, guidance and contribute to organization-level OPSEC efforts. The contractor will include OPSEC as part of its ongoing security awareness program and take all COMFRC OPSEC training. The contractor will protect identified critical information, sensitive unclassified information and activities, which, if divulged, could further compromise classified or sensitive information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

While performing aboard NAVAIR sites, the contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis.

Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

3.2.7 Anti-Terrorism Force Protection and Emergency Management: The work performed on this contract is not

Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government

Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials’ direct curtailment of operations to “Mission Essential Only”. All

Contractor personnel assigned to a government facility shall complete annual Antiterrorism (Level One) and Active

Shooter training.

3.3 Detailed Support: The Government will have Government purpose rights to all source code, data, and documentation created under this contract. The list below consist of the modules that need to be converted along with a description of each. The conversion will require the contractor to provide documentation relative to the functional requirement of each module and documentation of the code.

A. Acquisition Contracting Tool (ACT). Provides logisticians and analysts with the ability to intuitively identify and document the contractual data requirements at any phase of the acquisition process. It provides an intuitive wizard-like capability to tailor the data attribute requirements to support development of the Logistic Product

Data (LPD). ACT generates a tailorable Statement of Work (SOW)/PWS, CDRL with applicable Data Item

Description (DID), and data attributes based on user-defined requirements for the Acquisition Phase or functional areas.

B. Action Item Tracker (AIT). Provides a means for assigning and tracking open action items that arise during various program introductions to service (ITS) meetings.

C. Dynamic Scheduler Event Based Maintenance (EBM). Dynamic Scheduling (Event Based Maintenance) is a maintenance scheduling optimization process used to sustain an acceptable Type Model Series (T/M/S) readiness level. Dynamic Scheduling is a significant shift from performing stringent packaged maintenance tasks that are calendar-based and inflexible across a given T/M/S to tasks tailored for each Bureau Number

(BuNo) based on aircraft, engine, and component utilization. It optimizes use of resources (i.e. material and manpower capacity) to maximize aircraft readiness.

D. Hardware Builder. Builds hardware hierarchies for use within other MPS&E modules like In Service

Maintenance Planning (ISMP), Integrated Reliability Centered Maintenance System (IRCMS), Dynamic

Scheduler, and Work Order. The hierarchies are hardware drilldowns and can be based on Work Unit Code

(WUC), Logistics Control Number (LCN), or other break down types.

E. Historical Log. A tool designed for tracking changes to any scheduled maintenance tasks over time. It was developed to enable platforms with legacy maintenance programs such as Scheduled Depot Level Maintenance

(SDLM) / Aircraft Service Period Adjustment (ASPA) or Material Condition Assessment Process (MCAP) /

Paint and Corrosion Evaluation (PACE) transition to and manage a Reliability Centered Maintenance (RCM) based program. It baselines a list of failure modes to be analyzed, allows the linking of each failure to a current

IRCMS record to reflect its current status Reports complicated solutions in Excel and allows for selective monitoring and prioritization of an RCM programs workload

F. In-Service Maintenance Planning (ISMP). An application used for performing maintenance task analysis

(MTA) and maintenance plan development for in-service systems. ISMP is integrated with Dynamic

Scheduling, IRCMS (RCM) task MTA, Work Order (ISR), and Hardware Builder.

G. Integrated Reliability Centered Maintenance System (IRCMS). Used to perform RCM analysis. The application documents the results of determining the preventive maintenance tasks (requirements) and other actions to mitigate the known failure modes and failure consequences of an asset.

H. In-Service Repair (ISR). The ISR module is a work order tracking tool that provides the global management of

ISR’s across the Naval Fleet.

I. Lightning II System Requirements Review (SRR) Enterprise Tool (LSET). Provides a means to track SRR and

Initial Operational Capability (IOC) issues and their possible solutions that may have an impact on Federal

Aviation Administration (FAA) or IOC throughout the enterprise.

J. Mod Scheduler. The Mod Scheduler module generates an optimized schedule of aircraft modification incorporation based on resources, aircraft availability, other scheduled maintenance and numerous other inputs.

Additionally, Technologies and experience required and expected in support of this contract include, but are not limited to:

Apache Tomcat

Enterprise Java Platform

F5 Framework

Flex / Flash Technology

HTML5 Technology

IETM Content Enhancement Software

J2EE Standards and Guidelines

Java Web Application Archive technology

Level of Repair Analysis (LORA) Modeler

Microsoft .NET Framework

Microsoft SQL Server

NAVAIR Standard IETM Viewer

NMCI Firewall Requirements

OpenText Content Server

Structured Query Language (SQL)

Procedural Language (PL) /SQL

Python

R for Statistical Computing

Relational Database Management Systems (RDMS)

Systecon OPUS Suite

Websphere Application Server Technology

3.3.1 Project Management

The contractor shall provide project management and oversight. The contractor shall provide a post contract award project plan and technical approach for how the conversion can be completed by the required October 31, 2020 date, and post production defects can be resolved by the December 31, 2020 vendor end of life date. The plan shall include a strategy and planned dates for code conversion, documentation, integration, testing, training, production implementation, and post production support.

CDRL A002 - DI-IPSC-81427B - Project Plan

3.3.2 Meetings

The contractor shall participate in bi-weekly and ad-hoc team meetings, system reviews, and demonstration meetings.

The demonstrations shall include plans for integration of the converted module and any impacts or changes required to existing modules. Documentation of the converted module design shall be provided prior to demonstrations.

CDRL A003 – DI-IPSC-80942 - Systems Design Documentation

3.3.3 Help Desk Support

The contractor shall provide help desk support in each phase of the project. Some components will be under construction for defect resolution and others may be in production pending user feedback from missed defects. The help desk support will provide guidance and understanding to the user community as well as generation and tracking of change and defect request tickets. User guides shall be provided for each module converted.

CDRL A004 - DI-IPSC-81756 - Applications Development Documentation

3.3.4 Conversion

The vendor end of life (EOL) support from Adobe for ColdFusion Flex is December 2020. When this software reaches EOL, the vendor will no longer provide security patches to resolve identified security vulnerabilities. In addition, the multiple browsers (I.E., chrome, Edge, and Firefox) used to run the web application and display screens have joined Adobe’s decision, and they will also terminate their support of the flash player flex technology.

Each of the specific modules listed below must be converted/upgraded, government acceptance tested, documented, and fielded no later than 31 October 2020. This will allow time for the government to identify defects, and the contractor to resolve post production defects prior to 31 December 2020. The period of performance will also include

30-days post production for the Government to identify additional defects, and the Contractor sufficient time to resolve the defects by 31 January 2021.

a. Acquisition Contracting Tool (ACT)

b. Action Item Tracker (AIT)

c. Dynamic Scheduler (EBM)

i. Level of Repair and Analysis (LORA)

d. Hardware Builder

e. Historical Log

f. Integrated Reliability Centered Maintenance System (IRCMS)

g. In-Service Maintenance Planning (ISMP)

h. Lightning II SRR Enterprise Tool (LSET)

i. Mod Scheduler

j. In-Service Repair (ISR)

The Government shall be provided with all test and final source code, all development documentation to include design, testing, database relationship diagrams, all test scripts and test results, and user training and guidance material.

CDRL A003 - DI-IPSC-80942 - System Design Documentation

CDRL A004 - DI-IPSC-81756 - Applications Development Documentation

CDRL A005 - DI-IPSC-81488 - Source Code

CDRL A006 - DI-IPSC-80942 - Functional Requirements Documentation

CDRL A007 - DI-IPSC-80942 - Software Code Change Documentation

CDRL A008 - DI-IPSC-81440A - Testing Documentation

CDRL A009 - DI-IPSC-81437A - Entity Relationship Diagrams

CDRL A010 - DI-IPSC-81443A - System User and Training Documentation