RFQ_SAP_RCAT.pdf

Request for Quote (RFQ) Naval Oceanographic Office

RFQ # N6230617PR163NV

Project Title The Requisition and Contract Administration Tracking (RCAT)

PSC D308

NAICS 541511

Small Business Set-Aside Total Small Business Period of Performance 12 months

1. PERFORMANCE WORK STATEMENT (PWS)

1. This request for price is for the procurement The Requisition and Contract Administration Tracking (RCAT) Software

Sustainment Support per PWS titled “The Requisition and Contract Administration Tracking (RCAT)” dated September 15, 2017.

2. INVOICES/PAYMENT

2.1 Payment by Government commercial purchase card is the preferred method of payment. Please advise if this is acceptable.

2.2 If payment by credit card is not acceptable, invoice(s) must be submitted electronically, via Wide Area Work Flow (WAWF) in accordance with DFARS clause DFARS 252.232-7003 with payment by Electronic Funds Transfer (EFT).

3. PAYMENT INSTRUCTIONS:

3.1 PGI 252.204-0001 Line Item Specific: Single Funding (SEP 2009) applies to this procurement.

3.2 The payment office shall make payment using the ACRN funding of the line item being billed.

4. APPLICABLE CLAUSES:

4.1 FAR 52.212-4 ADDENDUM

The following shall apply to this contract in addition to those terms and conditions in FAR 52.212-4.

The specific paragraph of FAR 52.212-4 is tailored as below:

Paragraph (c): Changes in the terms and conditions of this contract may be made only by written agreement of the parties with the exceptions of administrative changes such as changes in paying office, appropriation date, typographical errors, etc. which may be changed unilaterally by the Government.

4.2 DFARS 252.232-7003 Electronic Submission of Payment Requests and Receiving Reports.

4.3 DFARS 252.232-7006 Wide Area WorkFlow Payment Instructions

4.4 All FAR, DFARS and NMCARS provisions and clauses for commercial supply items apply to this solicitation. It is the responsibility of the contractor to be familiar with the applicable clauses and provisions. The clauses may be accessed in full text at these addresses: FAR Site and DPAP DFARS Site.

5. ALL OR NONE

5.1 The Government reserves the right to make a single award on "all or none" basis to the quoter whose quote is considered in the best interest of the Government. Therefore, quoters proposing less than the entire effort specified herein may be determined to be unacceptable.

6. EVALUATION OF QUOTES

6.1 The Government intends to award a contract resulting from this solicitation to whose quote will be most advantageous to the

Government, price and technical capability considered and to whose quote, conforming to the solicitation, provides the lowest evaluated price for a product meeting the standards set forth in the PWS.

6.2 Price must include any applicable discounts.

7. SUBMISSION REQUIREMENTS

7.1 Provide a cover page with you legal business name, address, point of contact information, Contractor Unique Entity Identifier and

Cage Code Numbers and authorized POC to sign award

7.2 Provide completed Price Schedule attached.

7.3 Electronic submission of price shall be through email to NAVO_STNS_CONTRACTS@nmci-isf.com by 21 September 2017, 01:00 pm. (CST)

7.4 All documentation submittal due times are local time (CST: Gulfport, Mississippi).

7.5 Please indicate above referenced RFQ number in the subject line of emails and all correspondence.

8. QUESTIONS:

8.1 Questions shall be submitted via electronic mail (e-mail) to: NAVO_STNS_CONTRACTS@nmci-isf.com. Questions will be accepted up to 2 days prior to quote due date and time. All questions and answers will be published via amendment to the solicitation. Questions received after the above date will not be considered.

9. SYSTEM FOR AWARD MANAGEMENT (SAM) REGISTRATION/CONTRACTOR RESPONSIBILITY

9.1 All Contractors are required to be registered in SAM Website: www.sam.gov. Copy of SAM Registration must be provided with the quote and maintained current throughout the performance of the contract.

Price Schedule

CLIN # Brief Description of Service Unit Qty Price Total Price

0001 RCAT Software Sustainment Support Month 12 $ $

Total $

Please acknowledge the technical capability to provide the services meeting the standards set forth in the PWS by signing below.

Signature: ________________________________________________

Performance Work Statement For

The Requisition and Contract Administration Tracking (RCAT) September 15, 2017

1. BACKGROUND

1.1. RCAT is a requisition and contract tracking application that tracks requisitions and contracts from purchase request (PR) through contract closeout. RCAT supports the management, tracking, and reporting associated with the requisition and contract process. The RCAT system streamlines the process for submitting purchase requests and tracking requisitions and contracts. RCAT provides a Web-based access for NAVOCEANO customers to review contract status.

2. SCOPE

2.1. The contractor shall modify the RCAT software to build and run utilizing Java 1.9 as well as perform software engineering support for addressing information assurance (IA) requirements, defects and operational availability issues. The software support will include requirements analysis, software design, software coding, software testing, software integration, software security, and system management.

2.2. The contractor shall perform the work within the parameters of the effort referenced herein.

2.3. Tasks shall include the following:

2.3.1. Software Sustainment Support: The contractor shall perform software engineering services for the sustainment and maintenance of RCAT. This support will include software patching, defect correction, software upgrades, documentation, and other activities supporting compliance with emerging cybersecurity requirements and inspections for the RCAT application.

2.3.1.1. Upgrade RCAT to compile and run successfully with Java to v. 1.9.

2.3.1.2. Replace iText – The contractor shall perform an iText replacement analysis, evaluate and document impacts, and provide potential design options. The report will be presented to the government for review and the options evaluated. A plan will either be approved or required modifications to the plan will be provided. Once a plan is approved, the government will give the authority to proceed with the chosen modifications. All relevant documentation will be updated to include the chosen replacement option.

2.3.1.3. Perform Secure Code Scans and submit results to the government.

2.3.1.4. Perform the DISA Application Security and Development STIG.

2.3.1.5. Address software issues and modifications as prioritized by the government to sustain a cyber-secure and operational capability.

3. PERIOD OF PERFORMANCE AND WORKING HOURS

3.1. The Period of Performance is September 29, 2017 to September 28, 2018.

3.2. Working hours are between 7:00 a.m. and 6:00 p.m. Monday – Friday, all federal holidays, excluded. The

Federal Holiday List is available online at the OPM website; https://www.opm.gov.

4. PLACE OF PERFORMANCE

4.1. The contractor shall perform services at the Naval Oceanographic Office (NAVOCEANO) in the N64 Systems Integration Division workspaces. NAVOCEANO is located at Stennis Space Center, Mississippi.

5. SECURITY REQUIREMENTS

5.1. The scope of the contract will be limited up to SECRET. Performance of work will require access to classified data and computer resources within NAVOCEANO’s controlled workspaces.

5.2. All contractors shall have a fully adjudicated or interim SECRET CLEARANCE at a minimum prior to commencing work on this contract and will be required to maintain a SECRET clearance for the duration of the contract.

5.3. All contract personnel shall comply with the directives and policies established in DoD 5220.22-M “National Industrial Security Program, Operating Manual”, SECNAV M-5510.30 “Personnel Security Program”, and

SECNAV M-5510.36 “DoN Information Security Policy”. Additionally, contractors will meet the standards and qualifications outlined in SECNAV Manual 5239.20A “Department of the Navy Cyberspace Information Technology and Cybersecurity Workforce Management” and DoD Directive 8140.1 “Cyber Workforce Management”. All contractors require IT Level II (sensitive information access) as defined above.

5.4. All contract personnel shall complete applicable cybersecurity training, and complete System Authorization Access Request Navy (SAAR-N) forms before accessing any Navy Information Technology resources. Non-disclosure agreements (NDAs) and SAAR-N forms shall be forwarded to the Contract Officer Representative (COR) at least 30 days prior to the individual’s start date. If the contractor does not have a Common Access Card (CAC), they must obtain one prior to the start of the contract. Applicable cybersecurity training must be completed and completion forms must be forwarded to the COR when the training has been done. Failure to provide the required documentation may result in delaying the individual’s start date or result in individual’s removal from the task.

5.5. The contractor shall ensure the required security training, security application paperwork, and system access requests for all new employees are submitted to NAVOCEANO in sufficient time such that the required facility and system access credentials can be provided by NAVOCEANO prior to the contractor reporting to the facility.

5.6. All contract personnel shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

5.7. Per guidance in the current Application Security and Development STIG , ensure that all software designers, developers and testers performing work under this contract are provided training on secure design, coding, and testing principles/practices, known security flaw types and methods, newly-discovered vulnerability types and methods, and detection/correction methods on at least an annual basis.

5.8. All information, products delivered, or services performed may not be disclosed by any means without prior approval of the authorized COR. Dissemination or public disclosure includes, but is not limited to, permitting access to such information by foreign nationals or other person or entity; publication of technical or scientific papers; advertising and or other proposed public release.

5.9. The potential consequence for failing to meet any of the requirements listed above includes a determination of untrustworthiness and denial of access for the proposed contractor employee. Failure to obtain a favorable trustworthiness determination in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees for working in non-sensitive positions, with sensitive information, and/or on Government IT systems. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have physical access to a federally controlled facility and/or access to a federally-controlled information system/network and/or access to Government information.

6. IT System Access

6.1. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

6.2. When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

6.3. Contract personnel are responsible for keeping accounts active. Accounts are locked after 30 days of inactivity and are deleted after 60 days. If an account is deleted due to inactivity new account request forms must be submitted. Additionally, the contractor personnel may be disapproved to work on the contract or task order.

Any contract delays caused by disabled or deleted accounts due to inactivity is the responsibility of the contractor.

6.4. System information with NAVOCEANO-specific information cannot be removed from the system and taken offsite. Any items on government systems are considered the property of the government and cannot be removed via removable media. Items such as source code, etc. must be requested and officially transmitted from the government to the contractor.

7. PERSONNEL EDUCATION / EXPERIENCE REQUIREMENTS

Contract personnel associated with this effort shall have the following level of education and experience:

7.1. All contractor personnel conducting software maintenance support shall have, at a minimum, the combination of education and experience required to qualify for the Office of Personnel Management (OPM) General Schedule Qualifications Standard, Computer Science Series 1550; https://www.opm.gov/policy-data-oversight/classification-qualifications/general-schedule-qualification-standards/1500/computer-science-series- 1550/ These personnel shall also have current knowledge and experience: in the LINUX based operating systems, Java Web services, JBoss EAP 6, Oracle Java JRE/JDK, scripting languages such as: JavaScript and Python; testing tools such as: SOAP UI, JUNIT, Selenium, and JMeter; web technologies such as HTML5, CSS3, and JavaScript; Subversion, GIT, Maven , and PostGres. All contractor personnel must also have three to five years of experience in software code development.

7.2. Contract software engineering personnel must meet training and other cybersecurity provisions of SECNAV 5239.20A.

8. DELIVERABLES

8.1. Specific deliverables are required and shall be submitted to the COR.

8.1.1. Design documentation that captures system architecture, data flow, software components.

8.1.1.1. Iterative Design Document Updates will be submitted upon the completion of each major software release.

8.1.2. Completed current application security and development STIG checklist.

8.1.2.1. A Newly completed STIG will be submitted upon the completion of each major software release.

8.1.3. Software source code with defect fixes

8.1.4. Evidence of software code reviews

8.1.5. Configuration files and scripts

8.1.6. Software release notes

8.1.7. Software Installation Instructions

8.1.8. Software test cases

8.1.9. Software test reports

8.1.10. Transition Plan: Provide a transition period of not less than 45 business days before the end of the contract. Transition includes identifying remaining tasks, documentation to be completed, and completion of work in progress.

8.1.11. Meeting Minutes for all meetings between the government and contractor

8.1.12. NAVOCEANO will accept or reject the deliverables in writing or via email.

8.1.13. NAVOCEANO will have fifteen (15) business days to complete its review of the deliverables. If notification of acceptance is not provided to the contractor within fifteen (15) business days, the deliverables will be deemed accepted. All deliveries (day/time) must be coordinated with the COR. Any unplanned deliverables will be rejected until an acceptable day/time is agreed upon.

8.1.14. In the event of the rejection of any deliverable, the contractor shall be notified in writing by the COR, giving the specific reason(s) for rejection. The contractor will be allowed five (5) business days to correct the rejected deliverable and submit it to the COR. If corrections are not possible within (5) business days, a Plan of Actions & Milestones (POA&M) is due within (3) business days for government review and approval.

8.2. The contractor shall also submit a monthly status report by the 5th of each month. This report shall be in sufficient detail such that it allows NAVOCEANO to determine and assess the contractor’s technical progress.

The format of this report must be approved by the COR. Each report shall address information taking place during the previous month including tasks assigned / completed / pending, number of hours expended per task, accomplishments per individual for each task, number of tasks completed on schedule, number of tasks delayed and reasoning, and all problems or issues encountered.

8.3. The contractor shall submit weekly status emails by close of business on the last business day of each week. Each weekly report shall cover the previous workweek including an overall summary of project activity. The state of the project shall be reported. Any problems or issues encountered shall be reported to the COR as well.

8.4. All deliverables must comply with all current applicable DoD security configuration or implementation guides.

This includes, but is not limited to DISA STIGs.

8.5. Deployments:

8.5.1. Content of deployment packages shall follow the NAVOCEANO DoDIN Node Deployment and Transition

Process for Custom Software Applications and the DoDIN Node Policies.

8.5.2. The government will evaluate and approve/disapprove deployment packages.

9. GOVERNMENT FURNISHED RESOURCES

9.1. NAVOCEANO shall provide working space, office equipment, hardware, and software necessary for the completion of the assigned tasks.

9.1.1. All materials furnished to the contractor and any materials purchased with the Government funds in support of this effort will be returned to NAVOCEANO as directed, or upon completion of this project.

9.1.2. All data and software provided to the contractor shall only be used under the terms of fulfilling their contractual obligations. All data and software shall be transitioned back to NAVOCEANO upon project completion or contract performance period.

9.2. In addition to the equipment and property mentioned above, the following shall be provided by NAVOCEANO:

9.2.1. Project source code, sample data sets, and software documentation that will be required by the contractor in order to set up a development environment.

9.2.2. Computer accounts to unclassified and classified systems within the scope of the work and necessary for the completion of this effort including NAVOCEANO's classified and unclassified scientific network and Navy Marine Corps Intranet (NMCI) systems.

9.2.2.1. System access for scientific workstations will be provided by NAVOCEANO within 30 business days of the contractor completing all required security training, security application paperwork, and system access requests.

9.2.3. Access to the data holdings necessary for the completion of this effort.

9.2.3.1. Access to data holdings will be granted upon receipt of required scientific computer accounts.

9.2.4. Designated NAVOCEANO personnel to provide tasking familiarization and to coordinate / facilitate project efforts.

10. QUALITY CONTROL/ASSURANCE

10.1. The contractor shall perform inspections prior to requesting acceptance of the work by NAVOCEANO.

Contractor-performed inspections are independent of those performed by the Government.

10.2. The PM shall attend meetings with the COR and other NAVOCEANO personnel to resolve quality considerations and problems that may arise in the course of the work.

10.3. The contractor shall submit a Final Quality Control Plan to the COR for approval within 30 days after contract award. The Quality Control Plan will outline the contractor’s inspection system and method(s) of documentation.

11. INFORMATION ASSURANCE/INFORMATION SECURITY

11.1. The contractor shall protect DoD sensitive unclassified data regardless of the location or ownership of the transport media, including, but not limited to mobile computing devices and removable storage media, whether Government furnished or contractor owned/leased. Contractor shall comply with all current information assurance and information security policies, procedures, and statutes applicable to DoD information technology, including the July 3, 2007 DoD CIO Policy Memorandum on Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media.

12. IDENTIFICATION REQUIREMENTS

12.1. All contractor personnel performing under this statement of work shall identify themselves as a contractor employee to avoid creating any impression that they are Government officials. Such identification shall be made in all meetings attended, when answering Government telephones, on all e-mails, and when working in other situations where their contractor status is not obvious to third parties. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

13. DATA RIGHTS

13.1. The government has unlimited rights to all documents/material produced under this contract. All documents, materials, and software source code produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents, materials, and source code may not be used for any other purpose. This right does not abrogate any other Government rights. All contract deliverables shall become property of the US Government upon submission.

14. CONTRACTOR MANPOWER REPORTING

14.1. The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Naval Oceanographic Office via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/.

14.2. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2016. Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil/.

15. PERFORMANCE REQUIREMENT SUMMARY

15.1. Performance Requirements Table. This PWS not only discusses work to be performed, but also contains performance standards and acceptable performance levels (APL). Performance standards are "tools" the government uses to measure level of performance. A standard is an optimum performance level against which actual performance can be measured or evaluated. For example, in the statement "complete a service call in 24 hours" the standard is 24 hours. The number of days actually taken to finish this task is the performance indicator, which determines if the work performed was below, met, or exceeded the standard. Developing accurate performance standards is crucial to ensuring that the actual performance received, regardless of the service provider, meets the requirements of the Statement of Work. This PWS includes performance standards for each of the Functional Areas of the PWS. The performance standards provided with this PWS seek to state the characteristics of properly completed outputs. Each performance standard contains standards for both quality and timeliness

15.2. Quality Assurance. The COR will inspect for compliance with Contract terms throughout the Contract period. Evaluation will be based on the Contractor’s compliance with the requirements set forth in the Performance Requirements Summary (PRS). The Government will monitor the Contractor's performance under this Contract by performing surveillance using the PRS. The PRS is used primarily to determine if the Contractor is performing all required outputs. The PRS also indicates for contractors the importance of each required service.

15.3. Performance Requirements Summary Table:

Deliverable or Service Requirement

Measurement/Metric Surveillance Method Frequency of Surveillance

Acceptable Quality Level (AQL)

Incentives/Disincentives for Meeting or Not Meeting the

Acceptable Quality Level Quality of Service -

Software Services are performed on time without damage to the

Government

Government inspection and acceptance

Customer complaint

At each major release (a) All software tasking must adhere to standard software development practices of NAVO N64 as well as the policies of the target environment

(b) All software code produced by the contractor shall be 100% functional and compliant with relevant information assurance directives

(c) All work must be completed within the established schedule

(d) Any deficiencies identified by the COR/TPOC are resolved within 10 business days

(a) Satisfactory or above ratings on past performance

(b) Any contractor deficiency in software code must provide negotiated consideration for deficiency or delay

(c) Contract Discrepancy Report may be completed

Quality Control - Timeliness

Services are performed on time without damage to the

Government

Customer complaint

100% Inspection upon receipt of deliverables

(a) No more than 2 complaints (b) Verified damages are settled within 5 days deliverables must provide negotiated consideration for deficiency or delay Quality of Service -

Documentation Documentation deliverables meet schedule and quality standards

Customer complaint

100% Inspection upon receipt of deliverables

(a) No more than 2 complaints (b) Verified damages are settled within 5 days deliverable documentation must provide negotiated consideration for deficiency or delay

(c) Contract Discrepancy Report

Cybersecurity Protection of Government

Data and Compliance with Information

Assurance/Information

COR assessment, customer feedback, inspection

Perpetual inspection 100% compliance

(a) Government POC is notified within 24 hours of discovery of any cybersecurity issues

(b) Leaks, breaches, spillage for

Deliverable or Service Requirement

Measurement/Metric Surveillance Method Frequency of Surveillance

Acceptable Quality Level (AQL)

Incentives/Disincentives for Meeting or Not Meeting the

Acceptable Quality Level Security Policies (b) System accounts are in good standing, not locked or deleted due to inactivity which contractor is found to be at fault may result in contract termination

(b) Contract Discrepancy Report

(c) Failure to comply may be documented in CPARS and in future requests for Past Performance information

Key Personnel Retention

Key personnel on individual task orders remain on the effort for the first 180 days of task order performance

Monitoring of monthly contractor reports

Monthly 95% of Key Personnel are retained for the first

180 days of performance

(c) Failure to comply may be documented in CPARS and in future requests for Past Performance information

Report and Invoice Quality

Monthly activity reports and invoices are timely and accurate

Government inspection Monthly >95% compliance Reports and invoices delivered on time with little to no rework required

(c) Failure to comply may be documented in CPARS and in future requests for Past Performance information