IMPS SOW .pdf

Statement of Work (SOW)

Cyber Operations Division Business Application Support

1.0 INTRODUCTION

The Cyber Operations Division (COD) at the Naval Research Laboratory (NRL) in Washington, D.C. requires support in the ongoing sustainment, migration and ultimate archiving/decommissioning of legacy, custom coded business applications and databases. These applications were designed and developed specifically for use by NRL over the past 20+ years and are now slated to be replaced by new cloud-based Commercial Off-The-Shelf (COTS) applications and services.

The purpose of this contract will be to maintain legacy business-related applications such as the Integrated Management Processing System (IMPS), the NRL Asset Management System (AMS), the NRL Personnel Security System and other business-related applications until their functionality can be phased out or moved to new applications. The contractor will also be involved in the development of processes in COTS products and other web-based platforms to replace these legacy functions.

The main thrust of this requirement is the ongoing sustainment, analysis, review and documentation of the legacy applications and the development of new requirements documents outlining a migration path to new platforms. These applications were developed over an extensive period of time using various versions of Oracle PL/SQL, Oracle Forms, Java/JavaScript, Oracle stored procedures and other Oracle based tools and processes. This effort will require the reverse engineering of custom written code with little to no existing documentation to develop requirements documents and the analysis of large intertwined databases supporting multiple legacy applications.

2.0 SCOPE

The Contractor will provide comprehensive software analysis tasks in support of developing new software to aid in decommissioning legacy applications while maintaining the legacy software applications until migration is completed. This includes tasks such as documentation of current processes and workflow, current database structure and the export of data from legacy systems, workflow development, analysis, design and translation of data from existing legacy applications to new frameworks. The Contractor effort will include, but not be limited to:

Ongoing maintenance and sustainment of current custom-coded legacy web applications to include, but not limited to, the Integrated Management Processing System (IMPS) and its ancillary modules, NRL’s Personnel Security System, and NRL’s Asset Management System

Systems analysis and documentation of legacy custom code to capture current workflows, proposed modifications and accreditation posture.

Analysis and documentation of legacy databases to capture schema descriptions, data relationships, impact of data sharing across multiple applications and the development of data migration plans

Translation and export of legacy data to new or existing applications

Migration of legacy functionality to ServiceNow and other COD managed IT resources

Development of new functionality in ServiceNow and other COD managed IT resources

Migration of legacy functionality to SharePoint, Power Automate and PowerApps under the Navy

Office 365 platform

Database administration and support for current legacy databases to include updates, patches, performance monitoring and tuning, security and backup/restoration.

Documentation of system design, layout, interface requirements, administrative Standard Operating Procedures (SOPs) and user guides for legacy applications and any new applications developed to migrate legacy functions.

The Contractor will be required to support on site tasking for all personnel. The contractor must ensure security clearances are processed and maintained for all personnel based on their assigned tasks and/or work locations in accordance with DoD/Navy/NRL policy. All personnel must be able to obtain and maintain a DoD Common Access Card. Failure to meet the requirements for the issuance of a DoD CAC will result in removal from the contract.

The Contractor will provide all training necessary for personnel to achieve and maintain required IT certifications as specified by the Navy’s Cyber Security Workforce Program (DON SECNAV M-5239.2).

Certifications are determined by tasking and all personnel will remain compliant with certifications. It is the Contractor’s responsibility to ensure that personnel certifications remain up-to-date. Failure to achieve and/or maintain required certifications will result in removal from the contract.

Contractor performance will mainly occur onsite at NRL in Washington, DC. Telework during DoD/Navy/NRL mandated periods will follow DoD/Navy/NRL guidelines at all times. Onsite work may be required during times of mandated telework in order to continue mission support and will be at NRL’s discretion. Contractor will be required to provide personnel for onsite rotational schedule of work and ad hoc onsite work when needed to complete time sensitive tasking.

Work performed in support of this effort will involve access to Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), as well as other command sensitive data. Personnel will protect all data according to DoD/Navy/NRL rules and regulations and are subject to the rules regarding access to this type of data.

Work performed in support of this effort must utilize Government Furnished Equipment (GFE) such as desktops, laptops, tablets or mobile devices. All equipment will utilize an NRL image and be subject to NRL vulnerability scans. All systems must be patched and scanned regularly to ensure a secure baseline at all times. All NRL data will remain on GFE and NRL owned and/or managed environments. No system or application development will occur on any contractor owned systems. No NRL data will be housed or managed on contractor owned systems. All equipment provided to the contractor will connect regularly to the NRL network for the purposes of receiving updated software and policies and being scanned for compliance. Equipment that does not regularly connect will be returned to the Laboratory. All GFE equipment will be returned to NRL upon departure of any contractor personnel.

All technical work will adhere to Navy and DoD cybersecurity requirements for contractors as specified in DoD 8500.2 to include, but not limited to, compliance with DoD Standard Technical Implementation Guides (STIGs) and Information Assurance Vulnerability Alert/Information Assurance Vulnerability Bulleting (IAVA/B) compliance standards. Demonstrated experience in providing technical support in a DoD STIG compliant environment is required for execution of this effort.

3.0 TASK DESCRIPTIONS

3.1 Ongoing maintenance and sustainment of current legacy applications

3.1.1 The contractor will provide support to sustain legacy, custom-coded web applications used for NRL’s business processing. This effort will include the maintenance of the Integrated Management Processing System (IMPS), the Personnel Security System (PSS), the Asset Management System (AMS) and other legacy business-related applications. This effort requires in-depth knowledge of these systems in order to maintain them at their present functional state. This effort will require the awardee to fully document the current legacy systems based on knowledge of the current system and how it was developed and maintained over the lifetime of the application.

This effort requires in-depth knowledge of Oracle application development tools such as PL/SQL, Oracle Forms, Oracle stored procedures and Oracle database structures. Contractor will be required to make changes to custom coded applications as needed to ensure continued use of the applications until their functionality is phased out or migrated to a new platform or resource.

3.1.2 Contractor will be required to make modifications as needed to Application Programming Interfaces (APIs) used to share or transfer data from these legacy applications to other data sources such as Lightweight Directory Access Protocol (LDAP) servers, particularly OpenLDAP, to maintain required business processing functionality.

3.2 Systems analysis and documentation of legacy custom code

3.2.1 The contractor will perform system analysis and documentation of legacy application code in order to document system processing, workflow, data manipulation and computations, data translation among various interconnected processes and relationships of data across various data sources. The code is custom written code and some modules have very little current documentation available for reference.

The contractor will provide detailed documentation of current application functionality and work with end users to determine what functionality is still needed, what can be phased out and any new requirements that need to be included for follow-on application development.

3.3 Analysis, Reporting and Documentation of Legacy Databases

3.3.1 The contractor will provide support for the analysis and documentation of current legacy databases to capture schema descriptions, data relationships, stored procedures, data sharing between multiple applications and other aspects of the database design needed to understand current functionality. This analysis will then be used to determine modifications necessary to capture updated process requirements and to outline new workflows for development in new application frameworks.

3.3.2 The contractor will provide support for the development of data migration plans to outline the translation and migration of data from these current legacy applications to new applications or new data sources. This task will require an in-depth knowledge of Oracle database structures and stored procedures and the ability to analyze databases that have limited documentation as to current design and implementation.

3.3.3 The contractor will provide support for the analysis and reporting of data contained in legacy applications as well as new applications developed to take over the legacy functionality. The contractor will develop and run reports and queries against data as needed to support data calls or the migration of data to other systems and IT services.

3.3.4 The contractor will provide analysis and documentation of database schemas, tables, data and security settings in support of migrating application data from one database to another. The contractor will have experience with multiple database products and documented success in migration of database components between products.

3.4 Translation and Export of Legacy Data to New or Existing Applications

3.4.1 The contractor will provide exports of legacy data as needed for analysis and import into new or existing applications. This task will involve the translation of data from one database structure to another to ensure data consistency across applications and platforms. ensure that all software products supporting COD web applications are maintained at approved version levels and update software products as needed to remain compliant with DoD/Navy policy and/or vendor best practices.

The contractor will ensure that all updates are thoroughly tested prior to implementation to minimize application downtime.

3.4.2 The contractor will provide reports of database exports and imports to identify import failures, data translation errors and schema incompatibilities. The contractor will then remediate errors and resolve any inconsistencies to ensure that data is successfully transferred between applications.

3.5 Migration of Legacy Application Functionality to ServiceNow, Microsoft 365 and other COD Managed

Systems

3.5.1 The contractor will participate in an ongoing effort to develop ServiceNow applications to replace functionality provided currently through legacy applications. Based on analysis of the current applications, the contractor will assist with the development of similar or enhanced functionality in ServiceNow to allow for the legacy application to be phased out and retired.

3.5.2 The contractor will participate in an ongoing effort to develop replacement functionality for legacy applications in Microsoft 365 using PowerApps, Power Automate and SharePoint. Based on analysis of the current applications, the contractor will assist with the development of similar or enhanced functionality in Microsoft 365. This task will require familiarity with DoD Impact Level 5 Microsoft 365 applications provided by the Navy and the restrictions within the environment for Zero Trust compliance.

3.5.3 The contractor will participate in an ongoing effort to develop replacement functionality for legacy applications and business processes in new COTS products that are identified as possible solutions to custom NRL specific requirements. This effort will require the research and identification of solutions to address unique application requirements based on the NRL mission and/or Navy/DoD mandated requirements.

3.6 Development of new functionality in ServiceNow and other COD managed IT resources

3.6.1 As part of the migration of legacy applications, new business requirement gaps that are identified will need to be addressed in the new applications. The contractor will provide support to develop and/or modify application features in ServiceNow, SharePoint, PowerApps and other COTS products to enhance the new application development efforts to address new requirements.

3.6.2 The contractor will be required to develop integration documents outlining the additional features and level of effort involved to incorporate the new features into existing processes or applications. This effort will require a clear understanding of the applications and impact to current business processes to ensure continued availability.

3.7 Database Administration and Support for Legacy Applications

3.7.1 The contractor will ensure that all database product updates and patches are applied in a timely manner and in response to any DoD/Navy or vendor notices. The contractor will monitor vendor patch cycles and propose updates as part of the COD configuration management procedures.

3.7.2 The contractor will coordinate and schedule backups with backup/restoration engineers of all databases and application instances. This effort will include the documentation of all backup procedures, instructions for the restoration of database tables, schema, security settings and data.

The contractor will periodically perform table top exercises to evaluate and prove the procedures as part of a consolidated disaster recovery plan.

3.7.3 The contractor will monitor database performance and suggest appropriate tuning actions to ensure optimal application functionality.

3.7.4 All modifications to any databases will be vetted and approved by COD personnel in accordance with COD configuration management policies and procedures prior to implementation. All modifications will be fully documented and tested prior to implementation.

3.7.5 Any modifications or adjustments to existing applications or data structures requested by NRL customers of the legacy systems will be vetted and approved by COD personnel based on the level of effort required and the progress made towards re-platofrming.

3.8 Documentation of system design, layout, interface requirements, administrative Standard Operating

Procedures (SOPs) and user guides.

3.8.1 The contractor will participate with creating and populating requirements documents for all aspects of user interface. The contractor will then document the operation and functionality of the resulting interface.

3.8.2 The contractor will provide detailed documentation of server-level or back-end functionality written by or configured by the contractor.

3.8.3 The contractor will collaborate with COD Staff and application owners to create user guides for any migrated systems.

4.0 CERTIFICATIONS AND TRAINING:

4.1 The contractor will ensure that all personnel are certified based on their assigned tasks within the contract as outlined in DoD Directive 8570.01M (Information Assurance Workforce Improvement Program). The contractor will ensure that all personnel assigned to this task are fully certified within 90 days of onboarding, are provided necessary ongoing training to retain certifications and are re-certified as specified by the certificate granting organization.

4.2 The contractor will arrange for and ensure that all personnel are trained as necessary on new hardware or software products as they are introduced into the environment. Where required by vendors and DoD/Navy regulations, contractor will obtain certifications to ensure support contracts and compliance posture remain valid.

6.0 SECURITY AND PRIVACY ACT REQUIREMENTS:

6.1 All contractors assigned to this contract must be U.S. Citizens. Access to unclassified information and/or systems at NRL requires, at a minimum, a favorably adjudicated DoD Tier 3 investigation. Contractor personnel performing any function designated as a component of the Cyber Security Work Force (CSWF), and/or having privileged user access to NRL information systems will require background investigations and security clearances commensurate with the access level and security classification of the system being accessed as specified in DON 5239.2M (2009).

6.2 Work performed in support of this effort may be done offsite while teleworking, utilizing Government Furnished Equipment (GFE), at the discretion of NRL and in coordination with the Contractor. Contractor personnel working offsite must be available for on-site technical meetings and work groups as required. All NRL data must remain on NRL owned and operated systems and servers.

No NRL data, computer code or details about either will be stored on contractor or public servers.

6.3 Compliance with Privacy Act requirements

As part of the execution of this contract, vendor personnel may have access to data covered under the Privacy Act. Vendor must abide by the following directives and guidance regarding the display, handling and safeguarding of Privacy Act data.

- 52.224-1, Privacy Act Notification https://www.acquisition.gov/far/part-52#FAR_52_224_1

- 52.224-2, Privacy Act https://www.acquisition.gov/far/part-52#FAR_52_224_2

- 52.224-3, Privacy Training https://www.acquisition.gov/far/part-52#FAR_52_224_3

- 52.239-1, Privacy and Security Safeguards. https://www.acquisition.gov/far/part-52#FAR_52_239_1 5211.5F, Department of the Navy Privacy Program https://www.secnav.navy.mil/doni/Directives/05000 General Management Security and Safety Services/05-200 Management Program and Techniques Services/5211.5F.pdf

DON CIO MSG DTG 171952Z APR 07, Safeguarding Personally Identifiable Information (PII) https://www.doncio.navy.mil/ContentView.aspx?id=360

OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information https://www.whitehouse.gov/omb/information-for-agencies/memoranda/

7.0 DELIVERABLES

1) Monthly Detailed Progress Reports showing projects, personnel assigned and hours worked on each

2) Monthly Contractor On-Site Labor and Financial Reports

3) Hardware/Software Products & Documentation

4) Written Documentation such as User Guides and Standard Operating Procedures

5) Certification Documentation & Reports

6) Personnel Training Plan

7) Technical Reports (Interim & Final)

8.0 PERIOD OF PERFORMANCE

01 April 2024 through 30 March 2027