N0018921QR003.pdf

SEE ADDENDUM

(No Collect Calls)

N0018921QR003 13-Aug-2021

b. TELEPHONE NUMBER

717-605-5325

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 16 Aug 2021

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N001899. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

NICOLE C. IKENA-MILLER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

N1300123456

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVSUP FLC NORFOLK CONTRACTING

MECHANICSBURG OFFICE

ATTN: N IKENAMILLER

5450 CARLISLE PIKE BOX 2020

MECHANICSBURG PA 17050-2411

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: 717-605-5325 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$30,000,000

NAICS:

541512

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF87

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

N0018921QR003

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months Robotics Process Automation

FFP

Per PWS Requirement FOB: Destination

PURCHASE REQUEST NUMBER: N1300123456

PSC CD: R425

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1001 12 Months OPTION Robotics Process Automation

FFP

One year continued work on PWS FOB: Destination

PSC CD: R425

NET AMT

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) for

Robotic Process Automation (RPA) Program Management Support July 23, 2021

1.0 Introduction: NAVSUP Business Systems Center (BSC) is the Navy's premier

Information Technology provider of choice with responsibility to design, develop, and maintain information systems supporting numerous activities in the functional areas of logistics, supply chain management, transportation, finance, and accounting. In an effort to improve overall productivity, accuracy compliance and auditability, NAVSUP has stood up a Robotic Process Automation (RPA) Governance Team (RGT), responsible for development, oversight, and maintenance of RPA automations and governance.

2.0 Background: NAVSUP has a variety of business processes, technologies, applications, and often non-integrated systems that require manual input and processing of data.

NAVSUP has established a Program Office responsible for the adoption of Commercial-off-the-Shelf (COTS) tools, process, and people to implement industry solutions and best practices for software-based robotic automation. NAVSUP has established a governance model to achieve sustainable enterprise-wide RPA capabilities. RPA Contractor Support Services (CSS) will be responsible to maintain and expand efforts established during the pilot phase.

2.1 Requiring Organization:

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

NAVSUP Business Systems Center 5450 Carlisle Pike Suite 409 Mechanicsburg PA 17050-2411

2.2 Project Description:

The purpose of this PWS is to obtain contractor support services to maintain the existing RPA Governance model and to expand RPA capabilities throughout the enterprise. The project will be conducted over a one-year base period with one

(1) one-year option. The scope of the deliverables will change for each year and is broken out within this PWS. Tasks will be tracked by the Technical Assistant (TA)/Government Project Manager throughout the project. These deliverables are described below in section 5.0 Tasks and 6.0 Deliverables.

3.0 Scope: During the base year, the contractor shall transition the Platform Team and RPA

Governance Team from the pilot phase into maintenance mode, and ensure a complete knowledge transfer to government resources before the end of the base performance period. During the base period, the contractor shall create and maintain documentation, provide reports, support the RGT team in the development of Robotic Operation Centers, and deliver a minimum of nine (9) automations that can be run in attended or unattended modes. Automations built by the Robotic Operation Centers (ROCs) which require Contractor resources for Technical Architect, Process Architect and/or Development will be considered among the Contractor Targeted delivery goals. Before the end of the base period of performance, Change Management and Training responsibilities will be transferred to government personnel.

(Option Year 1) During the option period, the contractor should reduce staffing to the level necessary to maintain documentation, provide reporting, and provide support to the Robotic Operation Center(s) as needed. The contractor shall continue to provide support for the RPA Program and will deliver a minimum of seven (7) automations that can be run in attended or unattended modes. Automations built by the Robotic Operation Centers (ROCs) which require Contractor resources for Technical Architect, Process Architect and/or Development will be considered among the Contractor Targeted delivery goals. The RPA Project Team will continue to provide over-the-shoulder training to government RPA resources as necessary.

4.0 Directives:

The contractor shall comply with the following directives, and any updated/future versions as they are released:

Federal Information Security Modernization Act of 2014 (“FISMA”) Common Criteria for Information Technology Security Evaluation, Part 3: Security

Assurance Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003 DoD Instruction 5400.11, DoD Privacy and Civil Liberties Programs, 29 January 2019

(incorporating Change 1, 8 December 2020) DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016

(incorporating Change 1 July 2017) DoD Directive 8140.01, Cyberspace Workforce Management, 5 October 2020 DoD Instruction 4161.02, Accountability and Management of Government Contract

Property, 27 April 2012 (incorporating Change 2, 31 August 2018) DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and

Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017)

DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019 DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information

Technology, 12 March 2014 (incorporating Change 2, 28 July 2017) DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing

Unclassified Nonpublic DoD Information, 9 December 2019 SECNAVINST 5510.36B, DoN Information Security Program, 12 July 2019 DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19

December 2005 (incorporating Change 4, 10 November 2015) SECNAV Instruction 5211.5F, Department of the Navy Privacy Program, 20 May 2019 SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May 2016 SECNAV M-5239.2, DoN Information Assurance Manual, June 2016 OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July 2018 OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity Safety Program, 14

September 2018 SECNAV Manual M-5239.2, DON Cyberspace Information Technology and

Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

SECNAV Manual M-5510.30, Department of the Navy Personnel Security Program, 1 June 2006

CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities, 24 January 2012

DoD Public Key Infrastructure (https://cyber.mil/pki-pke) ISO/IEC/IEEE 12207:2017 Systems and Software Engineering – Software Life Cycle

Processes ANSI/EIA 649C-2019 – Configuration Management Standard ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability Federal Risk and Authorization Management Program (“FedRAMP”) Department of Defense Cloud Computing Security Requirements Guide, Version 1, Release 3, dated 6 March 2017 All applicable Security Requirements Guides, Security Technical Implementation

Guides, and National Security Agency security configuration guides when assessment and authorization is required

NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, December 2018

U.S. Navy Risk Management Framework Process Guide, Version 3.1, 3 February 2020 NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information

Systems and Organizations, April 2013, includes updates as of 22 January 2015 NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal

Information Systems and Organizations, December 2014, includes updates as of 18 December 2014

NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020

NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018

NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace Operations Policy, 25 March 2019

ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management Systems - Requirements

ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software Identification Tag

ISO/IEC 19770 Series - Information Technology – IT Asset Management A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Sixth

Edition Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment

Act of 1998, 7 August 1998) SECNAVINST 5720.44C - Department of the Navy Policy for Content of Publically

Accessible World Wide Web Sites, 21 February 2012 (incorporating Change 1, 14 October 2014)

SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January

Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004

DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017

DoD Manual 5200.08-R, Physical Security Program, 27 May 2009, 3 April 2017 NTTP 3-13.3, Operations Security (OPSEC), September 2017 DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 NSAMECHINST 5530.1C CH-1, Naval Support Activity Mechanicsburg Installation

Access Control, 23 August 2019

5.0 Requirements/Tasks: The contractor shall be obligated contractually to perform every requirement in this performance work statement. Not every performance requirement has a related standard expressed in this document. In such cases the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

The contractor RPA Process Team consists of the following roles: RPA Project Manager;

Change Management and Training Practitioner; RPA Senior Process Architect; RPA Process Architect; RPA Technician/Bot Controller; RPA Intelligent Automation Architect

The contractor RPA Development Team consists of the following roles: RPA Technical Architect; RPA Senior Developer; RPA Developer; RPA Developer/Tester

5.1 Governance: The RPA Process Team and RPA Development Team shall:

5.1.1 Maintain a structural framework for managing the growth and current status of RPA activities within NAVSUP; maintaining benefits for continuing activities and to serve as the central point of contact for NAVSUP robotic automation efforts.

5.1.2 Hold RPA discovery sessions where the RPA Process Architects will discuss RPA automation opportunities with government personnel and review government documentation, artifacts, and requirements to provide a recommendation if the process is a good candidate for RPA automation.

5.1.3 Selected candidates/opportunities from the Discovery process will be advanced to the “Deep-Dive” phase where Process Architects, Technical

Architects and Lead Developer work with the Process Owner, Subject Matter Experts and the Systems persons to identify the Potential Automations from the selected Processes.

5.1.4 Execute training for government resources identified to standup and/or to maintain subordinate Robotic Operation Centers (ROCs).

5.1.5 Administer and execute training for Citizen Developers in the development of RPA automations for NAVSUP.

5.1.6 Participate in Department of Navy (DoN) RPA Community of Practice

(CoP) meetings and provide a meeting minutes summary to the NAVSUP RPA Technical Assistant.

5.1.7 Ensure proper Cyber Security policies and regulations are adhered to for the RPA program and ROCs within the NAVSUP enterprise according to the Risk Management Framework (RMF) and Authority to Operate (ATO) accreditation.

Performance Standard: All work associated with the tasks described above shall be consistent with industry best practice and established RGT documentation, and training will be executed as scheduled. Greater than 95% of the time deliverables shall be submitted on time and without rework required.

Assessment Method: The Technical Assistant (TA) will review 100% of automation delivery spreadsheets. The TA will review Feedback and automation candidates captured in the discovery sessions. Feedback on training will be captured in a training survey that will be reviewed for satisfaction and recommendations for updates. The TA will review updates made to the training material to ensure completion. All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

5.2 Software and Hardware: RPA Development Team resources shall establish the necessary software and hardware infrastructure within NAVSUP to deploy UiPath in both attended and unattended modes.

5.2.1 Provide UiPath Orchestrator Administration services using industry best practices and in compliance with approved government Configuration Management process.

5.2.2 Perform analysis of all NAVSUP requested automations to discern appropriate development of unattended or attended automation.

5.2.3 Enable monitoring and logging of all BOT instances through UiPath Orchestrator software. The contractor RPA Platform Team shall periodically provide the UiPath Orchestrator log reports for NAVSUP automations for the Technical Assistant (TA) for review.

5.2.4 Manage UiPath licenses owned by NAVSUP and provide timely status when requested. Status will include number of licenses being used and unused. Active license information will include hosting environment, organization, users first and last name.

5.2.5 Request appropriate number of functional Non Person Entity (NPE) accounts to be used with unattended BOTs to the extent allowable by third party providers (NAVAIR/OSD). Accurate information and security credentials for the NPEs shall be maintained and updated as needed by NAVAIR/OSD with verification and testing to be executed by the RPA Development Team. The contractor RPA Team shall document which NPE is used by each automation, as well as logs documenting NPE usage.

shall be consistent with industry best practice including software development and version control and established RGT documentation. All software released shall follow the approved government Configuration Management process and management controls. The TA will review provided license report for appropriateness, timeliness, and accuracy to ensure compliance. Greater than 95% of the time all deliverables shall be submitted on time and without rework required.

Assessment Method: Assessment Method: The Technical Assistant (TA) will review all status reports for appropriateness, timeliness, and accuracy to ensure compliance. The NAVSUP BSC RPA Process Team and RPA Development Team will review all UiPath Orchestrator logs to ensure any cyber security requirements are met. All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

5.3 Automation Development: The RPA Development Team shall:

5.3.1 Deliver RPA project plans, schedules, requirements, use cases, etc. in accordance with agile methodology and the NAVSUP BSC Software Delivery Model (SDM).

5.3.2 Provide lifecycle robotic project management utilizing government provided change management and version control solutions.

5.3.3 Selected candidates/opportunities from the Discovery process will be advanced to the “Deep-Dive” phase where Process Architects, Technical Architects and Lead Developer work with the Process Owner, Subject Matter Experts and the Systems persons to identify the Potential Automations from the selected Processes.

5.3.4 Deliver a minimum of nine (9) government approved RPA automations within the base year of the contract.

5.3.5 Deliver a minimum of seven (7) government approved RPA automations within the option 1 year of the contract.

5.3.6 Maintain and enhance the NAVSUP RPA Automation portal (Oracle

Apex).

5.3.7 Actively socialize Robotic Operation Centers (ROC) in discussions with stakeholders across NAVSUP and actively provide support in the form of tips, best practices, code sharing and references to training.

shall be consistent with industry best practice and established RGT documentation. Greater than 95% of the time deliverables shall be submitted on time and without rework required.

Assessment Method: The TA will review all Azure DevOps RPA project backlog items for appropriateness, timeliness, and accuracy to ensure compliance.

All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

5.4 Mentoring and Knowledge Transfer Services: The contractor RPA Process

Team and RPA Development Team shall be responsible for:

5.4.1 Actively providing daily mentoring support for the Navy team while the contractor RPA Project Team and RPA Development Team accomplishes daily activities. The intent of this mentoring is to ensure government employees have the knowledge and familiarity with UiPath to ensure Navy team independent processing of future similar tasks. The contractor RPA Project Team and RPA Development Team shall ensure a thorough knowledge transfer is completed prior to the end of each period of performance. Skill areas to be mentored include:

a) All NAVSUP utilized UiPath software (Orchestrator, RPA

Developer, Attended and Unattended)

b) Code Reviews

c) RPA Development Lifecyle and all relevant documentation

d) Leading User Acceptance Testing for automations

e) Administering Citizen Developer 101 Training

f) Azure DevOps Backlog Management

g) RPA best practices

5.4.2 Develop and maintain training material that can be used to develop trainers.

Performance Standard: All work associated with the tasks described above will be consistent with industry best practice and established RGT documentation.

Knowledge transfer will be executed daily.

Assessment Method: The TA will periodically review knowledge transfer taking place during daily scrums as well as periodically review the knowledge transfer plan for appropriateness, timeliness, and accuracy to ensure compliance. All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

5.5 Project Management. The contractor RPA Process Team and RPA

Development Team shall be responsible for:

5.5.1 Performing weekly status meetings with metrics, risks, mitigation plans, and next steps with a meeting minutes summary to be provided to the TA.

5.5.2 Participating in all Team SCRUM, Product Backlog, Sprint Planning, Sprint Review, and Sprint Retrospective with a meeting minutes summary to be provided to the TA.

Performance Standard: Actively participating in weekly status with a meeting minutes summary provided to the project manager. Greater than 95% of the time deliverables shall be submitted on time and without rework required.

Assessment Method: The TA will review RPA Process Team and RPA Development Team provided meeting minutes for appropriateness, timeliness, and accuracy to ensure compliance. All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

5.6 Service Operations Management: The RPA Process Team and RPA Development Team shall execute the necessary processes and procedures to ensure the Day-to-day Operations of the Automations, Robots, and Infrastructure for the RPA Program and the process for raising and resolving incidents, which may arise, and the required change management for communications related to these issues. The integration of the various functions (e.g., development, testing and deployment) are critical to the smooth operation of the automations. The RPA Development Team supporting service operations consists includes the RPA Technical Architect, RPA Senior Developer, RPA Developer and RPA Developer/Tester.

5.6.1 Service Management Operations includes the following functions:

a) RPA Operations Management

b) Incident Management

c) Change Management

d) Platform Management

5.6.2 RPA Operations Management – Monitors automation execution and ensures all automations and robots are working as designed.

e) Managing the functions on both the OSD and NAVAIR systems.

f) Review execution logs, error logs, scheduling, and execution duration as part of monitoring

g) Scheduling changes for improved operational efficiencies or as requested from the Process Owner/TA

5.6.3 RPA Incident Management – Process of managing automation failures and/or disruptions. Incident management includes steps from incident reporting to restoring of services.

h) Includes steps from incident reporting to restoring of services.

i) Monitor and execute steps from issue identified in production through a ‘service desk’ team member resolving that issue

5.6.4 RPA Change Management – Change management process defines steps for requesting, evaluating, planning and implementing a change to an automation. A main objective is to coordinate efforts, inform all active parties and support the execution and traceability of all RPA changes.

5.6.5 RPA Platform Management – Platform support process include activities related to maintaining the Infrastructure, Operating System and RPA tools in a complaint state. Includes:

j) Patch management

k) Automation tool minor upgrades

l) License management

5.6.6 As part of the weekly update provide status of open/closed incidents.

Report on root cause, general trouble shooting analysis, and problem management.

5.6.7 Provide report of change activities, operations issues and Level of Effort.

Performance Standard: Actively participating in weekly status with a meeting minutes summary provided to the project manager. Greater than 95% of the time deliverables shall be submitted on time and without rework required.

Assessment Method: The TA will review contractor Service Operations Management Team provided meeting minutes for appropriateness, timeliness, and accuracy to ensure compliance. All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

6.0 Deliverables: All deliverables must meet the format requirements specified by the Contracting Officer’s Representative (COR) and/or TA. Documentation related to these services shall be made available electronically in a Microsoft Word format. The following list details the contract deliverables:

6.1 Deliverables table

Deliverable Section Delivery Timing NAVSUP automation inventory with status of each potential and current automation including the requestor name, contact information, organization and value to mission

5.1.1 As required

Provide feedback, status report and automation candidates derived from Discovery Sessions.

5.1.2, 5.1.3 Within first two (2) business days after session is complete.

Status report of training performed along with customer survey

5.1.4, 5.1.5 Within (2) business days of completed training.

Status report of assigned UiPath licenses provided to the RPA Project Manager

5.2.4 As required

DoN RPA CoP meeting minutes

5.1.6 Provided the next business

day following every DoN CoP meeting.

Cyber Security meeting minutes

5.1.7 Provided the next business

day following every Cyber Security meeting.

Status report of all deployments

5.2.1, 5.2.2 As required

UiPath Orchestrator log reports 5.2.3 As required NPE documentation, list of all NAVSUP used NPEs.

5.2.5 As required

Deliver RPA solutions, project plans, schedules, requirements, use cases

5.3.1 Documents to be delivered in

the format defined by the NAVSUP BSC Software Delivery Model (SDM).

Deliver, up to (16) Automations:

(9) Automations w/target of

(6) low complexity Automations in base year.

(7) Automations w/target of

5.3.2, 5.3.3, 5.3.4, 5.3.5

Azure DevOps RPA project backlog will be updated daily.

(4) low complexity Automations in Option Year 1 Deliver NAVSUP Automation Pipeline Portal maintenance and enhancements

5.3.6 Azure DevOps RPA project

backlog will be updated daily.

Communication plan for ROC stakeholders, survey of discussion participants

5.3.7 Within first two (2) business

days after session is complete.

Daily Scrums, Knowledge Transfer Plan

5.4.1 As required

Train the Trainer Training Plan 5.4.2 As required Weekly status meeting minutes with metrics, risks, mitigation plans, next steps

5.5.1 Provided the next business

day following every status meeting.

SCRUM meeting minutes for following SCRUM meetings (sprint planning, retrospective)

5.5.2 Azure DevOps RPA project

retrospective area and backlog updated after every meeting.

Provide status of open/closed incidents. Report on root cause, general trouble shooting analysis, and problem management.

5.6.6 During Project Status

Updates or as required

Provide report of change activities, operations issues and Level of Effort.

5.6.7 As Required

6.2 Monthly Status Report. Status reports shall be sent electronically to the Technical

Assistant (TA) and Contracting Officer’s Representative (COR) by the 10th of each month documenting the performance on the order. The monthly status report shall include the following elements:

o Resources by name o Date project/task received o Status of work with accomplishments documented o Percentage of project/task completed o Estimated date of project/task completion o Any issues/problems encountered or possible and recommended solutions o Changes to the Project Management Plan (PMP) to include roles and responsibilities and schedule changes o Identify any Government dependencies that are overdue which impact schedule or performance o Evaluate performance and determine adequacy of staffing.

6.3 Mentoring/Knowledge Transfer documentation, lesson plans, and mentoring reports. Status reports shall be sent electronically to the Technical Assistant (TA) and Contracting Officer’s Representative (COR) by the 10th of each month. The mentoring report shall include:

o Trainer Name o Trainee Name o Date Knowledge Transfer began o Date Knowledge Transfer completed o Description of skill/knowledge area

6.4 Monthly Payment Request. The contractor shall submit a monthly payment request (invoice) electronically using Wide Area Workflow (WAWF) by the 10th day of each month. WAWF is available on the internet at https://piee.eb.mil.

The Period of Performance (POP) for each invoice shall be for one calendar month.

Included with the invoice shall be support documentation such as, but not limited to, travel authorizations (if applicable) and a monthly status report. Invoices received without the support documentation (in the correct format) will be rejected.

The contractor shall submit a final invoice or zero cost invoice to properly close out the contract.

6.5 Mandatory Annual Training: The contractor shall participate in DoD/DoN mandatory annual training when announced by the Government.

Contractors are required to complete the following mandatory training and any updated/future training as released: 1) Personally Identifiable Information (PII); 2) DoN Records Management: Everyone's Responsibility; 3) Anti-Terrorism/Force Protection Awareness; 4) Combating Trafficking in Person; 5) Operations Security (OPSEC); 6) Training & Readiness – The Active Shooter. The contractor shall complete DoD Cyber Awareness Challenge v4 mandatory training two weeks after contract award. Cory Harvey 717-605-6872, or Antonio Arturet-Millan, 717-605-8192, are the POCs for the Cyber Awareness training. Training can be accessed at http://iase.disa.mil/eta/cyberchallenge/launchPage.htm.

6.6 Unless stated otherwise, the following instructions shall apply to all deliverables:

Deliverables will be in the appropriate format (e.g., Microsoft suite, Azure DevOps, Automation Portal, UiPath software/dashboard extracts, etc.)

All versions of the deliverables required by the TA shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

Deliverable due dates shall take into account the review periods described below.

Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days (unless otherwise specified).

Government reserves the right to request a formal review session with the contractor during these timeframes and may request that the contractor make changes to any version of a deliverable.

Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt (unless otherwise specified). All deliverables will be inspected for content, completeness, accuracy, legibility and conformance to contract requirements by the COR and/or TA. At the discretion of the Government, inspection may include validation of information or software through the use of automated tools and/or testing of the deliverables, as specified in the PWS. Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

If the Government finds that a draft or final deliverable contains spelling errors, grammatical errors, improper format, or otherwise does not conform to the requirements stated within the task order PWS, the document may be immediately rejected without further review and returned to the Contractor for correction and re-submission. If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR and/or TA. If more than the specified number of calendar days is required for Government review and approval, the COR and/or TA will inform the contractor of the need for an extension within the initial review period.

General quality measures, as set forth below, will be applied to each work product received from the contractor under the resultant task order. These performance measurements are defined as:

o Quality Accuracy – Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity – Work products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

Consistency to Requirements – All work products must satisfy the requirements of this Performance Work Statement.

Hard copy formats shall follow any specified Directives or Manuals.

All text and diagrammatic files shall be editable by the Government.

7.0 Period of Performance:

Work shall be performed from the period of performance start date for one year with a one (1) year option period. A 30 day start-up period is required as defined below. Some flexibility in daily hours is permitted with the TA’s approval. No contractor services shall be performed Saturdays, Sundays, Government Holidays or during base closures without prior approval from the TA. The contractor shall follow Naval Support Activity base policy for reporting to work during severe weather and base closure. The contractor is not authorized to begin work until both the Visit Authorization Request (VAR) and System Authorization Access Request - Navy (SAAR-N) forms have been successfully processed and base and system access have been granted.

ON-BOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. An employee is considered to be “productive” upon completion of the following items:

a. Visit Authorization Request (VAR)

b. Contractor Information Request Form (CIRF)

c. FD-258 fingerprint card

d. Completed EQIP (Electronic Investigation) within 20 days after contract award

e. All contractor resource(s) must have an active JPAS profile within 20 working days after contract award

f. Common Access Card (CAC)

g. System Authorization Access Request – Navy (SAAR-N)

h. Cyber Awareness Training Certification

i. Cyber Security certification (if applicable)

j. User Access Request (UAR) Only applies when contractor requires access to

ERP/SAP

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of ERP/SAP.

Contractor and subcontractor employees performing under this task order are required to sign a Non-disclosure Agreement (NDA) as part of their onboarding process. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

8.0 Place of Performance:

The contractor’s facility will be the primary site for performance.

Performance shall occur Monday through Friday between 6am and 6pm. No contractor services shall be performed Saturdays, Sundays, Government Holidays or during base closures without prior approval from the TA. If applicable, the contractor shall follow Naval Support Activity base policy for reporting to work during severe weather and base closure.

9.0 Travel:

There are no travel requirements for this PWS.

10.0 Security:

This clause does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The clause is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

SUPTXT204-9400(7-18) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

(JUN 2018)

Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, and Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the

Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this text will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. Visit Authorization Request (VAR)

b. Contractor Information Request Form (CIRF)

c. FD-258 fingerprint card

d. Completed EQIP (Electronic Investigation)

e. All contractor resource(s) must have an active JPAS profile

f. Common Access Card (CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services, and no reimbursement will be paid by the Government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information.

Sensitive information includes information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy Command's Security Manager and Information System Security Manager (ISSM)/Information Assurance Manager (IAM) upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the "supervisor".

The SAAR-N shall be forwarded to the Command's Security Manager at least 30 days prior to the individual's start date. Failure to provide the required documentation at least 30 days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness) training, and maintain a current requisite background investigation. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

TEMPORARY ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and temporary access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under temporary access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this text including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this text in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor's Security Representative.

Within three work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor's Security Representative. The Contractor's Security Representative shall be the primary point of contact on any security matter. The Contractor's Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR

PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

.SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product) .Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) .Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command's Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Employees requiring IT access shall also check-in and check-out with the Navy Command's Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM).

Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command's Security Manager at least 30 days prior to the individual's start date. Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command's Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command's Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

The contractor’s Security Representative shall…