NIAPS - SOW.pdf

STATEMENT OF WORK

NAVY INFORMATION/APPLICATION PRODUCT SUITE

1.0 INTRODUCTION

The Space and Naval Warfare Systems Center Pacific (SSC Pacific), Business Systems and Enterprise Information Systems (EIS) Competency (hereafter referred to as 5.4 Competency) has a requirement for engineering services to support the development and sustainment of Navy Information/Application Product Suite (NIAPS) and other selected application hosting, monitoring, modernization, and replication systems/frameworks.

1.1 BACKGROUND

Distance Support (DS) is a Navy Enterprise effort that combines people (e.g., subject matter experts (SMEs)), processes (e.g., remote equipment monitoring, tele-medicine, interactive detailing, etc.), and technology (e.g., data compression and replication) into a collaborative infrastructure without regard to geographic location. DS, at a minimum, includes the functional areas of logistics; maintenance and modernization; Manpower, Personnel, Training, and Education (MPT&E); and medical support. DS remotely projects reactive, proactive, and predictive support to sailors across these functional areas, in order to achieve the right readiness at the right time, at the right cost. Effective and reliable information transfer is a key prerequisite to enable DS capabilities and processes.DS is rapidly becoming the Fleet's principal web-based readiness enabler, facilitating timely technical assistance, knowledge and education tools, and logistic support. Further expansion of this capability is required as the Navy explores alternatives to operate at sea with fewer sailors (e.g., LCS, DDG 1000, CVN 21, VIRGINIA class SSN, JSF), improve business efficiency, shape a common infrastructure that supports both new and legacy platforms, and deliver Sea Warrior MPT&E capabilities. NIAPS is the current enabler of DS in the Navy. NIAPS is a major component of the Enterprise Systems and Services Program Office (PMW 250) portfolio, which is housed within the Navy’s Program Executive Office for Enterprise Information Systems (PEO-EIS). DS allows sailors to manage their careers, collaborate with SMEs, and access and receive authoritative information in near real-time wherever they are operating. DS furnishes the tools and creates business rules necessary to provide improved capability to the Warfighter.

1.2 SCOPE

NIAPS delivers maintenance, logistics, administrative, training, and management applications to users at sea. NIAPS is designed to maximize the use of limited bandwidth by providing afloat units with access to applications while disconnected from the internet. NIAPS ensures that data between ship and shore remains synchronized throughout the replication of data and applications hosted on NIAPS. NIAPS is a suite of applications and content, integrated together and hosted on a single shipboard server. It can be categorized as a shipboard intranet web-based information system used to support, collect, distribute, and display information in a shipboard environment. NIAPS hosts an intranet that maintains information such as:

training courses, maintenance documents, data collection, and morale and welfare information. NIAPS provides content and information to the user during times that network access external to the ship is unavailable. NIAPS will be phased out in the FY20-24 timeframe and will be replaced by other services providing hosting, monitoring, and replication for afloat applications. These services will have to be developed, tested and supported on several different Navy networks. In addition, current Navy applications require modernization to take advantage of these new services.

2.0 APPLICABLE DOCUMENTS

The following instructional documents, see Table 1, are mandatory for use. Unless otherwise specified, the document’s effective date of issue is the Request for Proposal (RFP) date. Additional applicable documents may be included in specific task orders.

TABLE 1. DS Required Documents

Document Type No./Version Title Date or most current version

NIAPS NIAPS2.0- IN-001 NIAPS 2.X CANES Installation Instructions 27-Aug-13

NIAPS EE610-J2- SAG-010

NIAPS Systems Administration Guide 2.4 NIPR Surface

31-Jan-15

NIAPS NIAPS 2.4 Systems Administrator Checklist 30-Jul-12

NIAPS 6 NIAPS Configuration Management Plan 21-Feb-13

NIAPS 2 NIAPS CM Process Guide and Appendices 21-Feb-13

NIAPS NIAPS System-Subsystem Specification 4-Feb-14

NIAPS EE689-P3- LP-111-

NIAPS User’s Logistic Support Summary 2-Oct-12

Life Cycle Sustainment Plan for Sea Warrior Navy Information Application Product Suite

(NIAPS)

30-Jun-10

NIAPS Systems Engineering Plan 2.4

Software Development Plan (SDP) for

NIAPS

4-Dec-13

NIAPS 3.0 Integrated Master Plan 27-Jan-14

Acquisition Support Office Guides

2 PMW 240 Configuration Management Plan 15-Dec-10

NIAPS2.0- IN-001 Installation Procedure for NIAPS 2.0 Server 27-Aug-13

Acquisition Information Assurance Strategy

NIAPS

27-Dec-13

Information Assurance (IA) Test Execution Plan for NIAPS 3.X

10-Jan-14

NIAPS WI-WXMP- NIAPS-

NIAPS Replication Process Current V iNIAPS NIAPS Production Server Request Lifecycle 23-Oct-12

NIAPS NIAPS Update Request Lifecycle 13-Jan-13

NIAPS NIAPS OST Request Lifecycle 30-Apr-13

NIAPS

CORE Lifecycle (Core “Framework”, IAVA’s, & Removal)

13-Jan-13

N6-NTSP- P80-0820 Naval Training Systems Plan Aug-11

Enterprise Shift Operations Management System (eSOMS)

Electronic Portable Maintenance Assistant (ePMA)

Integrated Condition Assessment System (ICAS) Brief

Navy Career Tools (NCT) Brief

NIAPS Overview

SKED Brief

System Administration and Collaboration

Technical Data Knowledge Management (TDKM) System

Total Ships Information Management System (TSIMS)

Training and Operational Readiness Information Service (TORIS) Afloat

Web Advanced Technical Information Support (WebATIS)

System Operational Verification Test (SOVT) 27-Nov-13 For Navy Information Application Product Suite (NIAPS) Framework Version 3.0

DoD 5205.02-M DoD Manual – Operations Security (OPSEC) Program Manual dtd 3 Nov 08

DoD 5220.22-M DoD Manual – National Industry Security Program Operating Manual (NISPOM)

DoD 5200.2-R DoD Regulation – Personnel Security P

DOD 5200.01-M

DOD 5200.01, Volumes 1 through 4 - DOD Security Program

24-Feb-12

DoDD 5205.02E DoD Directive – Operations Security (OPSEC) Program dtd 20 Jun 12

DoDD 5220.22 DoD Directive – National Industrial Security Program

DOD

DoDD 8500.1 DoD Directive – Information Assurance 24-Oct-02

Directive

DOD

DoDI 8500.2

DoD Instruction – Information Assurance (IA) Implementation

6-Feb-03 Directive

OPNAVINS T

F3300.53C Navy Antiterrorism Program

OPNAVINS T 3432.1 DON Operations Security 4-Nov-11

SECNAVIN ST

5510 30

DoN Regulation – Personnel Security P

SECNAV 5510.30-M

Department of Navy Personnel Security Program

Jun-06

SPAWARI NST 3432.1

SPAWAR Instruction – Operations Security (OPSEC) Policy dtd 2 Feb 05

SECNAV 5510.36-M

Department of Navy Information Security Program

Jun-06

NIST SP

National Institute of Standards and Technology Special Publications 800 Series

800-Series Computer Security Policies, Procedures, and Guidelines

COMUSFL

TFORCOM/

COMPACF LTINST

6320.3A

Commander US Fleet Forces Command/Commander US Pacific Fleet Instruction, Medical Screening For US Govt Civilian Employees, Contractor Personnel, and Guests prior to embarking Fleet Units, of 7 May 13

DoD Directive DoDI 8510.01 DoD Information Assurance Certification and Accreditation Process, 28 Nov 07

28-Nov-07

SECNAVIN ST

5239 3B

DoN Information Assurance Policy, 17 Jun

SPAWARI NST

5721.1B SPAWAR Section 508 Implementation Policy, 17 Nov 09

ISO/IEC 15288

International Organization for Standardization/ International Electrotechnical Commission: Systems and Software Engineering – System Life Cycle Processes

ISO/IEC 12207

International Organization for Standardization/ International Electrotechnical Commission: Systems and Software Engineering – Software Life Cycle Processes

DoD Directive DoDD 5000.01 The Defense Acquisition System

DoD Instruction DoDI 5000.02 Operation of the Defense Acquisition System

DoD Instruction DoDI 6205.4 Department of Defense Instruction, Immunization of Other Than U.S. Forces (OTUSF) for Biological Warfare Defense

The following documents, see Table 2, are to be used as guidance. Unless otherwise specified, the document’s effective date of issue is the RFP date.

TABLE 2. DS Guidance Documents

Document Type No./Version Title Date or most current version Joint Regulation JTR DoD Civilian Personnel Travel Current Version Military Performance Specification

MIL-PRF-29612B

Performance Specification Training Data Products

Current Version

MOA between Installation Program Manager, FRD, PM Sea Warrior

Ser. 62400/0040

Memorandum of agreement for coordination and government on site installation coordinator (OSIC) support for sea warrior program office afloat installations

6-May-13

PMW 250 Sea Warrior 4.2.1 Afloat SOP 8-Jul-13

NAVSEA Operations Manual

SL720-AA-MAN-

Fleet Modernization Program Management and Operations Manual

Current Version

NAVSEA Operations Manual

SL720-AA-MAN-

Surface Ships and Carriers Entitled Process for Modernization (SSCEPM) Operations and Management Manual

Current Version

OPNAVINST 4790.4E

Ships’ Maintenance and Material Management (3-M) System Policy

Current Version

COMFLTFORCOMI

NST

4790.3 Joint Fleet Maintenance Manual

(JFFM)

Current Version

SPAWARINST 4720.3C

SPAWAR Policy Procedures and Responsibilities for Planning and Installing Shipboard Command Control Communications Computers Intelligence Surveillance and Reconnaissance (C4ISR) Fleet Modernization

Current Version

SPAWARINST 4720.1

Policy and Procedures for Installations of Command , Control, Communications, Current Version

Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) and Other Electronic Systems

PEO EIS Policy Current Version Policy for Afloat Installation and Delivery

Current Version

NAVSEA Technical Specification

9090-310F Alterations to Ships Accomplished by Alteration Installation Teams

Current Version

MIL-STD-1916

DoD Test Method Standard – DoD Preferred Methods for Acceptance Of Product

HSPD-12

Homeland Security Presidential Directive – Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004

DTM-08-003

Directive-Type Memorandum 08- 003 – Next Generation Common Access Card (CAC) Implementation Guidance, D b 1 2008

FIPS PUB 201-1

Federal Information Processing Standards Publication 201-1 – Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006

Form I-9, OMB No.

115-0136

US Department of Justice, Immigration and Naturalization Services, Form I-9, OMB No.

115-0136 – Employment Eligibility Verification

IT IA Guidance Subchapter III of

Chapter 35 of Title 44, United States

C d M h 14 2014

Federal Information Security Management Act (FISMA)

Director of Central

Intelligence Directive

6/3 (DCID 6/3

Protecting Sensitive Compartmented Information Within Information Systems

24-May-00

IT IA Guidance DoDD 8500.1 DoD Directive – 14-Mar-14 Information Assurance

IT IA Guidance DoDI 8500.2 DoD Instruction – Information Assurance (IA) Implementation

6-Feb-03

IT IA Guidance DoD 8570.01M DoD Manual – Information Assurance Workforce Improvement Program

19-Dec-05

3.0 TECHNICAL REQUIREMENTS

3.1 Systems and Equipment Knowledge

The Contactor shall provide functional and technical expertise in support of NIAPS and future systems. Systems will range from client-server applications, employing interactive and batch processes, to customized web-based solutions. Such systems include, at a minimum:

NIAPS COTS – to include application/knowledge of Microsoft (MS) Operating System (OS), MS Windows Server 2016 (and future versions) and MS Office 2016 products, Linux, iOra, Axway Secure Transport, Axway Secure Client, Java, (Server/Client)-Side JavaScript, Websocket, JavaScript, Object Oriented .NET & .NET Core, SharePoint Technologies, Visual Basic, PowerShell Tools, HTML (including web-application support frameworks supporting HTML5, REST API, Websocket and Web 2.0 applications), JSON transactions, Structured Query Language (MS SQL Server & Reporting Services, Oracle, Crystal Enterprise (formerly known as Crystal Reports)), Remedy®, eEye Retina/Assured Compliance Assessment Solution (ACAS), Veritas System Recovery 18, and AWS Cloud SDK/Services. , C#, Powershell, and ITSM, Vcenter Serve and Vsphere, ACAS, Vulnerability Remediation Asset Manager (VRAM), BMC Remedy, NTIRA, SPIDER, and PKI Certificates, Veritas System Recovery 18, and AWS Cloud SDK/Services.

NIAPS GOTS – Dimensions CM, Rapid Integration and Test Environment (RITE), NIAPS DS_Update v4, NIAPS Administration Management tool (NAM), NIAPS Health and Monitoring Remote Suite (HAMRS), NIAPS HAMRS Business Report System, NIAPS Production Administration Transport (PAT), NIAPS 2.4.5 Installation Procedures, NIAPS 2.4.5 Legacy Backup Procedures, NIAPS 3.0.1 installation procedures, Department of Defense Architecture Framework (DoDAF), NIAPS Image/Installation Validation and Reporting Tool, NIAPS 3.0.1 agent and NIAPS Model-Based Systems Engineering (MBSE) architectural development standards and processes.

3.2 Program Management

3.2.1 Program Support

The contractor shall work with the Government project manager and support the needs of the program. The contractor shall assist the Government with coordinating meetings, responding to budget drills, developing agenda items, attending meetings, generating minutes, and tracking action items as required. The contractor shall support the Government in analyzing and recommending changes to policies, doctrine, tactics, and procedures at the Federal, State, and Local level given their past expert opinion or using analysis of actual outcomes. The contractor shall coordinate and interface with various Department of Defense (DoD) and non- DoD activities located in and out of the Continental United States (CONUS).

3.2.2 Project Support Documentation

The contractor shall assist the Government to develop the following Project Management documents:

Performance Work Statement (PWS) Cost Estimation Meeting Agenda and Minutes Plans of Action and Milestone (POAM) Work Breakdown Structure (WBS) Various Program Acquisition related documents: Functional Requirements

Document (FRD), Systems Engineering Plan (SEP), and documents specified in this Statement of Work (SOW)

Installation in-briefs Daily Status Reports (DSR) Information Technology Service Management ticketing reports Casualty Report (CASREP) Health and Monitoring System (HAMS) status report Configuration Management Plan (CMP)/Life Cycle Configuration Management

Manual VRAM report Platform System Operational Verification Test (SOVT)s System Administrator’s Guide (SAG) NIAPS Technical Manual Invoice reviews and QASP

3.2.3 Integrated Master Schedule

The contractor shall assist the Government in developing an Integrated Master Schedule (IMS) for each project to monitor progress. The contractor shall:

Identify breakdown of the tasks, critical path activities, milestones, linkages, and dependencies among multiple working groups

Liaison with functional groups to gather, identify, and communicate weekly status and issues impacting the IMS to the Government IMS lead

Provide inputs and updates to the IMS Update the Program Manager’s primary Project Task Lead and Program Integrated

Product Team Leads on a weekly basis. The following information shall be included in the inputs and updates:

o Activities of the past week; activities of the current week, and any open action items or administrative issues o Assessment of the cause of delays or missed milestones o Identification of the affected dependencies of missed milestones and the impact of delay o Outline the critical path and resources required to complete the activities

The contractor shall maintain the IMS in MS Project 2016 or higher.

3.3 Mobilization and Transition Requirements

3.3.1 Mobilization Phase Support

The services in this SOW are vital to the Government and must be continued without interruption, loss of service, and a minimal loss of knowledge. The contractor shall familiarize itself with program processes and be fully operational to meet the requirements of this SOW within forty-five (45) days from contract award. By the end of the mobilization phase (what is the tie for this phase), the contractor shall obtain and have in place all required personnel, certifications, materials, and equipment to execute the tasks of this contract.

3.3.2 Transition Phase Support

The contractor shall, in addition to their ongoing responsibilities in this SOW, provide customary support to include: transition of all documents, source code, engineering artifacts, hardware, software, licenses, or other relevant items identified via the Program Office in support of operating the program at SPAWAR Systems Center Pacific. The contractor shall provide this support during the first forty- five (45) days of the contract period of performance. This transition support shall be documented in accordance with the Contractor’s Progress, Status, IMS and Management Report/Monthly Status Report.

3.4 Production Services

The contractor shall provide the following services to sustain, maintain, and update NIAPS as fielded:

‐ NIAPS Fleet Help Desk and Installations ‐ Join Services for incorporation of new/updated applications supporting the current mission (MPT&E, Medical, Metrics) of NIAPS, application software sustainment updates, and core framework upgrades

‐ Production Services to include testing, integration, cybersecurity (CS), configuration management (CM), and replication

The contractor shall provide updates addressing CS issues and software patches, application software sustainment updates, and core framework upgrades for NIAPS versions 2.X, 3.X and 4.X and any follow-on tasking.

3.4.1 Configuration Management (CM)

The contractor shall utilize the established Government CM repository, currently Serena Dimensions, for all product deliveries and to maintain CM of NIAPS during all phases of production to include all phases of testing, core framework/network integration, CS compliance, and fielding. The contractor shall coordinate with PMW 250 CM Lead to ensure DS CM procedures are followed in accordance with PMW 250 CM processes and CM Plan.

The contractor shall also assist in the management, tracking, and reporting of changes to all baseline systems in accordance with NIAPS and PMW 250 CM Plans and Standard Operating Practices (SOPs).

3.4.2 Software Engineering Support

The contractor shall support delivery of a fully functioning and deployable DS CSS capability under the architectural direction of Government program engineering managers, including software packages that:

‐ Ensure changes to the legacy system minimize risk to the technical refresh effort.

‐ Ensure updated Technical Refresh versions are compatible/interoperable with earlier versions as designated by the Government.

‐ Ensure service continuity and data exchange with designated external systems, and coordination of concurrent changes with interface partners.

‐ Provide necessary deployment planning, installation verification, and testing to ensure each technical solution works within the system environment.

‐ Abide by Government standards, regulations, and policy.

‐ Provide software release package and supporting documentation comprehensive enough to facilitate package installation and data migration by the existing Government workforce or third-party designee (e.g., Combined Enterprise Data Center (CEDC) Government and contract personnel).

‐ Implement modularity and open systems architecture improvements that reduce life-cycle costs of the systems.

The contractor shall implement changes to the application components in the software engineering, test, and production environments after successfully testing across all platforms.

The contractor shall provide support for all application issues associated with the operation of software applications and associated Commercial Off-The-Shelf (COTS) software. The contractor shall assist the Government to solve any issues with all applications and configuration items currently available in the Fleet.

The contractor shall perform software changes, primarily in a maintenance capacity, in both a web environment and client environment, and produce required documentation. The Contractor shall have knowledge of the following technologies mentioned above in section

3.1. The contractor shall document the baseline configuration as well as changes approved via the ECP/Change Request (CR) process. The contractor shall track all software version changes and provide input to the Government CM repository at PMW 250, currently Dimensions, with supplemental management reporting via RITE at SSC Pacific.

3.4.3 Test and Integration

The contractor shall perform application testing and integration under government instruction to include: installation testing, regression testing, and load testing, providing test reports as required per the NIAPS CM process. The contractor shall provide testing services for both internal use and external use by hosted applications at the discretion of program needs developed with external network demands, e.g., Integrated Shipboard Network System (ISNS), Consolidated Afloat Networks and Enterprise Services (CANES), Total Ship Computing Environment (TSCE), Littoral Combat Ship (LCS). The contractor shall interface daily with government application developers to support troubleshooting.

3.4.4 Server and Network Support

The contractor shall perform the duties of Systems Architect and IT Systems Engineer for server hardware and software configuration, and Network integration management. The contractor shall ensure the server and network environment will meet Ashore Infrastructure

Operational Availability (OA) at 97% per month (Threshold) with the target of 99.9% (Objective) assuming reliable connectivity is available. OA is defined as Uptime divided by Total Time. Total Time is defined as Uptime plus Down Time. Uptime is defined as the time when the system is considered to be ready for use (e.g., when the system is operating, in standby, or turned off but available for use). Down Time is the sum of the total time lost for preventative maintenance as well as all unscheduled failures that impair performance of mission essential functions (these failures are defined as operational mission failures). Down Time does not include time lost due to the failure of shared infrastructures not under the cognizance of the DS owner Information Control (INFOCON) restrictions, Non-secure Internet Protocol Router/Secret Internet Protocol Router Network (NIPR/SIPRNET) Shutdown. All time spent performing repair of operational mission hardware failures and operational mission software failures is part of Down Time. Down Time also includes time for logistics delays and fault correction time for software and hardware maintenance. The contractor shall perform routine backups and other daily procedures without Down Time.

3.4.5 System Infrastructure

The contractor shall assist the Government to maintain the necessary infrastructure including but not limited to: backups (network and off-site), network monitoring, system monitoring, Security Technical Implementation Guides (STIG) and Operating System security compliance and ACAS security scans, and software patches.

3.4.6 Cybersecurity (CS) Support

The contractor shall provide CS/Cybersecurity support in accordance with applicable Navy Assessment & Authorization (A&A) (i.e., Risk Management Framework (RMF)) regulations and procedures, implement CS actions in the designated timeframes, and ensure reporting of CS actions are documented to the appropriate CS organizations in the prescribed timeframes, using approved CS software tools.

3.4.6.1 CS Policy Compliance

The contractor shall provide support to deliver and/or maintain an accredited system in accordance with DoD Instruction (DoDI) 8510.01 – RMF for DoD IT CS references cited in Paragraph 2.2 of this SOW.

The contractor shall implement all IA controls, not specified by the Government as inherited, and as defined within NIST SP 800-53in accordance with Federal Information Processing Standards (FIPS) Publication 199, which requires organizations to categorize information systems as low-impact, moderate-impact, or high-impact for the stated security objectives of confidentiality, integrity, and availability.

The contractor shall establish NIST SP 800-53 compliant administrative/operational, technical, and physical/environmental safeguards to protect any and all Government systems and data to ensure confidentiality, integrity, availability, authentication, and non-repudiation of Government information. At a minimum, safeguards shall include provisions for personnel security, electronic security, and physical security.

The contractor shall ensure that assets have been secured according to all Defense Information System Agency (DISA) prepared STIGs, Security Requirements Guides, and other DoD mandated secure configuration guides during the software sustainment update, test, deployment, and maintenance phases. At a minimum, the contractor shall ensure that the Application Security and Software Sustainment Update, Operating System, Database, and Web Server STIGs are met. If there is software that is outside the scope of these STIGs, additional DoD/DoN security guidance will be reviewed and implemented to ensure the program is compliant with current DoD/DoN guidance.

The contractor shall ensure that NIAPS is able to operate within a Government approved location that has been configured to meet all applicable STIGs, Communication Tasking Orders (CTOs), and Information Assurance Vulnerability Alerts (IAVAs). The Contractor shall integrate third party anti-virus and Host Based Security software as required by DoD and DoN.

The contractor shall demonstrate compliance with policy guidance for International Common Criteria (ICC) for Information Security Technology Evaluation Mutual Recognition Arrangement, the NIAP Evaluation and Validation Program, the FIPS validation program, use of Mobile Code Technologies in DoD Information Systems, and the Navy Ports, Protocols, and Services (NPPS) Manual.

The Contractor shall provide technical and project management support related to all aspects of the Clinger-Cohen Act of 1996, and specifically CS requirements.

This includes participation in technical reviews and analyses of capability, processes, and systems. The contractor shall provide results of analyses and recommendations to the Contracting Officer (KO) or Contracting Officer Representative (COR) within 20 calendar days of completing the analyses.

3.4.6.2 Assessment & Authorization (A&A)

The contractor shall provide support to maintain a valid A&A package and Authority to Operate (ATO) for all system components ashore and afloat. The Contractor shall comply with the A&A process for implementing information safeguards. The A&A process will be used to obtain ATOs, Interim Authorities to Operate, and Authorities to Test to support program requirements.

The contractor shall support the A&A process by providing the Government designee the required documentation necessary to receive an ATO. The Contractor shall make Information Systems (IS)/networks available for testing, and support A&A testing in advance of accessing DoD data or interconnecting with DoD IS/networks. The contractor shall participate in all phases of the A&A process, including, but not limited to:

o Attending and supporting A&A meetings with the Government o Supporting A&A package development/submission o Supporting/conducting the vulnerability mitigation process o Supporting the A&A Team during system security testing o Supporting maintaining, monitoring, and validating security posture

The contractor shall confirm that IS/networks are secured and baselined prior to initiating testing. The contractor shall confirm the system baseline is agreed upon during the definition of the A&A boundary and be signed and documented as part of the A&A Plan. Baselining the system means that there shall be no changes made to the configuration of the system (within the A&A boundary) during the A&A process.

The contractor shall assist the Government with any re-configuration or change in the system during the A&A testing process that will require a re-baselining of the system and documentation of system changes.

The contractor shall mitigate vulnerabilities identified by the Government as "must-fix" issues during the A&A process according to the timeline identified by the Information Assurance Manager (IAM), Information Assurance Officer (IAO), or Designated Approving Authority (DAA). DoD developed checklists, reference materials, and A&A tools may be obtained from DISA Information Assurance Support Environment (IASE) website at http://iase.disa.mil/index2.html. Utilities, reference material, and configuration guides are provided at this site.

3.4.6.3 PPL/SSIL Certification

The contractor shall provide support to attain and maintain the Preferred Product List/System Subsystem Interface List (PPL/SSIL) Certification for the shipboard NIAPS application (including all applications hosted on the NIAPS server).

3.4.6.4 Fleet Forces Certification

The contractor shall provide support to the Government A&A Point of Contact (POC) to attain and maintain certification for the shipboard NIAPS installation (including all applications hosted on the NIAPS server).

3.4.6.5 ISNS/CANES Interoperability Certification

The contractor shall provide support to the Government A&A POC to attain and maintain PMW 160 (ISNS/CANES) Interoperability.

3.4.6.6 LCS TSCE Interoperability Certification

The contractor shall provide support to the Government C&A POC to attain and maintain Interoperability for PMS 505 LCS and TSCE.

3.4.6.7 Information Assurance Vulnerability Management (IAVM)

The contractor shall implement an IAVM program to comply with the Navy IAVM process and report both IAVM and CTO compliance to the Navy’s Tier 2 Computer Network Defense Service Provider (CNDSP) and Navy Cyber Defense Operations Command (NCDOC) to provide CND and Network Operations (NetOps) visibility to Navy leadership.

The contractor shall inspect assets for vulnerabilities through manual checklist reviews and automated scanning tools using Government approved products.

Currently, the scanning product is ACAS.

The contractor shall apply vendor software patches in accordance with IA Control VIVM-1 on at least a monthly basis and with serious vulnerability issues dealt with as soon as possible (ASAP).

3.4.6.8 Data Protection

The contractor shall comply with the DON Privacy program per Secretary of Navy Instruction (SECNAVINST) 5211.5E. The contractor shall ensure all categories of sensitive information, including Personally Identifiable Information (PII), are secured and in compliance with all IA Controls from the DoDI 8500.2, specifically IA Controls DCFA-1 and DCSR-2. Compliance includes the encryption of “data in transit” and “data at rest” as required by the data owner.

The contractor shall comply with the E-Government Act of 2002, mandates that all PII be protected. In addition, systems processing PII must have completed a Privacy Impact Assessment (PIA) and register that PIA with DON CIO.

The contractor shall provide controlled access to prevent unauthorized access to DoD systems and information using identification and authentication as well as encryption.

3.4.7 RDT&E Lab Support

The contractor shall perform the duties of Systems Administrator and IT Systems Engineer for server hardware, software configuration, and Network integration management on the SPAWAR Systems Center Pacific (SSC PAC) Research Development Test and Evaluation (RDT&E) test network. Duties shall include, but are not limited to:

‐ IA and software patch installation and management ‐ Systems and network problem troubleshooting and resolution ‐ Day to day administrative tasks such as backup and restore of test systems ‐ Shipboard installation images are copied to media and shipped to an installation location ‐ VMWare specific support to maintain ongoing CS configuration maintenance for DELL 830 Blade Servers with VMWare 6 and beyond ‐ Automation of future software installations of NIAPS and developed DS products ‐ OpenShift management in AWS and Azure cloud environments to project containers to any IP-connected region worldwide ‐ AWS and Azure government cloud security for development, testing, and production services

3.4.8 Replication

The contractor shall manage and maintain the shore-based NIAPS replication infrastructure.

Duties shall include, but are not limited to:

‐ Monitoring systems for issues ‐ Verifying that automated processes are running as expected ‐ Server Management consisting of:

o Management of Test/Development (TEST/DEV) amendments to/from TEST/DEV servers for testing o Management of Production Publishers for Operational Systems Tests (OST's), new releases, fixing corrupt pubs o Management of Production Return Data (RD) Servers – to ensure application of new outbound data, Knowledge Management Center (KMC) update maintenance, data transport verification (i.e., gets to customer File Transfer Protocol (ftp) machine) o Management of DS-Scriptron machines - subscription files ‐ Systems Administration duties to include:

o Management of Customer FTP accounts/directory structure o Management of Ship FTP accounts/directory structure o Management of FTP (Axway Secure Transport) Software - patches, service packs, support calls o Certificate updates - importing into FTPs interface, creating for ships, creating for infrastructure machines, etc.

o Data translation management to new replication technologies for

NIAPS point and spot releases o Integration into automated monitor processes in a continuous integration (CI) process o Participation in an agile development, test, and production schedule

‐ Adding new automated processes as new applications join NIAPS ‐ Supporting testing/release of content and programs by ensuring data is only replicated to specific Fleet units ‐ Interface with programmers of hosted NIAPS applications to troubleshoot and resolve issues

3.4.9 NIAPS Fleet Support

3.4.9.1 NIAPS Fleet Support Help Desk

The contractor shall staff the NIAPS Fleet Support Help Desk from 0800-1600 EST (core business hours), Monday through Friday. The contractor shall support after hours on call services that may require immediate action at the NIAPS Fleet Support or remote user locations. The contractor shall provide end-user support via remote collaboration tools and ship visits. The contractor shall maintain trouble ticket information for metrics, including, but not limited to, trouble ticket turnaround time of two days, and exploration of areas of improvement with an anticipated rate of 150 trouble tickets per month. The contractor shall analyze how long each installation will take and track by issue, if applicable, and how many hours and overtime hours were required.

The types of typical NIAPS issues to be resolved are:

o Data Issues (Corrupted files /data, Import / Export issues) o Replication Issues o Application Issues o CS Issues o Configuration Issues

3.4.9.2 NIAPS Training Development

The contractor shall develop/revise training materials for shipboard and shore-based command training on the DS NIAPS modules for the following:

o NIAPS Overview o Enterprise Shift Operations Management System (eSOMS) o Electronic Tagout (eTAGOUT) o Integrated Condition Assessment System (ICAS) Brief o Enterprise Risk Management (eRM) Brief o Career Tools Afloat (CTA)Brief o Preventive Maintenance Scheduling (SKED) Brief o System Administration and Collaboration o Total Ships Information Management System (TSIMS) o Web Advanced Technical Information Support (WebATIS) o Afloat Integrated Learning Environment (AILE) o Electronic Training Jacket (ETJ) o Fleet Training and Management Planning System (FLTMPS) o Food Service Management (FSM3) o Navy Credentialing Opportunities Online (COOL) o Navy 311 Afloat Request o Navy Training Management Planning System (NTMPS) Afloat

Datamart (NAFL Datamart) o Retail Operations Manager (ROM3)

The contractor shall develop/revise NIAPS training modules in support of NIAPS upgrades for both the shore-based and shipboard versions. The Contractor shall develop training modules as Instructor- led Training (ILT) in accordance with MIL-PRF-29612B and Performance Specification Training Data Products using Adobe Acrobat file format.

The contractor shall provide training material for the Alteration Installation Team (AIT) on-site trainer to provide all students attending NIAPS Training. The Contractor shall provide a link to the training material on the Sailor website and updated CM sheet for the AIT on-site trainer to provide the Training Support Agent, every time NIAPS training materials are updated or a new version is issued.

3.4.9.3 Software/Firmware for AIT Support

The contractor shall create software and firmware delivery files (function currently takes place at SSC PAC facility), as listed below, to be installed on required Navy platforms and mail the image to the applicable AIT representative on the east or west coast:

o Software configuration files. Software configuration files shall include those files containing the state of any installed servers, clients, switches, virtual private network (VPN) devices, routers, firewalls, and intrusion detection systems. The server system state files shall include the registry, Com+ class registration database, and boot files.

The files containing the configuration data shall be burned onto approved encrypted storage device. The storage device shall be provided to the receiving activity and provided to the on-site Government representative or project engineer for the NIAPS Software Support Activity (SSA).

o Firmware configuration files. All bios and other similar settings embedded in Permanent or semi-permanent programmable (Proms) by the Contractor shall be documented with text files (.txt extension) showing the firmware version and settings in use. The files containing configuration data shall be burned onto an approved encrypted storage device. The storage device shall be provided to the receiving activity and provided to the on-site Government representative or project engineer for the NIAPS Software Support Activity (SSA).

3.4.10 Lifecycle Logistics Support

The contractor shall apply engineering and analytical disciplines required to implement life cycle (acquisition) logistics as a multi-functional technical management discipline associated with the test, production, fielding, sustainment, and improvement modifications of NIAPS achieving the Fleet’s peacetime and wartime readiness requirements. The Contractor shall ensure that support considerations are an integral part of the NIAPS system’s requirements, the system can be cost effectively supported through life cycle, and the facilities and infrastructure elements necessary to the initial fielding and operational support of the system are identified, developed, acquired, and supported.

3.5 AIT Fleet Support

The Software Support Activity (SSA) Fleet Support Lead is assigned to monitor, maintain, and support the SSA’s afloat fielding efforts. The contractor shall coordinate with the SSA and provide technical support to satisfy afloat requirements and processes. The Contractor shall also coordinate with SPAWAR PEO Command, Control, Communications, Computers and Intelligence (C4I) to include the CANES Program Office, Fleet Readiness Directorate (FRD), Naval Sea Systems Command (NAVSEA), Naval Network Warfare Command (NNWC), and Navy Information Dominance Force Type Commander (TYCOM) installation personnel as necessary to ensure fielding efforts are understood, installations are performed in accordance with Navy policy and guidance, and installations follow appropriate ship scheduling. The Contractor shall follow policies supporting installations that adhere to Fleet, Navy, Command, Control, Communications, Computers, Collaboration, and Intelligence Master Plan (C5IMP) processes and Navy Modernization Process (NMP), and all other policies referenced in SOW Table 2. These are enterprise-level processes for installing aboard naval vessels that ensure the correct maintenance and modernization is performed at the appropriate level.

The contractor shall comply with these PMW 250 Program Office installation requirements.

The contractor shall travel to various worldwide locations as required both CONUS and Outside CONUS (OCONUS) to perform SOW requirements to support Installation, Ship Rider, and Waterfront Support.

NIAPS is currently deployed on ~74 Submarine Forces (SUBFOR), ~156 Surface Forces (SURFOR), and 11 Air Force (AIRFOR) units with possible expansion to other platforms. The contractor shall adhere to required NMP policies, certifications, instructions, requirements, and will work in alignment with PMW 250 Government afloat representatives for purposes of planning and executing program installations.

Average installation timeframes (time to install) are listed below in Tables 3 and 4:

Table 3. Average Installation Times – SURFOR/AIRFOR

AVERAGE # OF WORK DAYS TO

INSTALL

( SURFOR/AIRFOR)

CONUS 10

OCONUS 10

Table 4. Average Installation Times – SUBFOR

AVERAGE # OF WORK DAYS TO

INSTALL (SUBFOR)

CONUS 10

OCONUS 10

3.5.1 DS AIT Fleet Support Tasks

3.5.1.1 Afloat Documentation

The contractor shall perform, document and deliver the following tasks and deliverables in accordance with a Technical Report-Study/Services.

The contractor shall repose copies of all approved certifications and applicable documents on the PEO-EIS portal. The contractor shall provide document approval status and timeline status on pending certifications in monthly reports:

PPL/SSIL Certification. The contractor shall provide support to attain and maintain the PPL/SSIL Certification for the shipboard application and deliver any required artifacts.

Fleet Forces Certification. The contractor shall provide support to the Government A&A POC to attain and maintain certification for the shipboard installation and document those efforts and any required artifacts.

ISNS/CANES and Submarine Local Area Network (SubLAN) Interoperability Certification. The Contractor shall provide support to the Government A&A POC to attain and maintain PMW 160 ISNS/CANES and SubLAN Interoperability and document those efforts and any required artifacts.

Daily Install SITREP to document production review meetings with the Onsite Installation Coordinator (OSIC). This shall be included in the Daily Install SITREP.

Alteration Installation Team (AIT) Trip Reports.

On-Job-Training (OJT) documentation at the completion of AIT installs. Training may include the IT 2790/2791 System Administrators and the system end users. The Contractor shall provide list of attendees to the Government after each ship training event.

Documentation for the following tasks are required if hardware is installed:

o Notification to the AIT Manager with information for preparation of Liaison Action Reports (LAR) when required.

o Change Order Request Notification (CORN) and submission, if work is delayed, pending LAR approval the OSIC and AIT Manager notification o Ship Installation Drawing (SID) updates noting removal of material and equipment marked as “Remove” or “Relocate”.

AIT book/folder containing all required documents for the Regional Maintenance and Modernization Coordination Office (RMMCO). The AIT book will be used to check in and out of RMMCO and will be turned over to the RMMCO agent upon installation completion and RMMCO check-out. The RMMCO agent will then turn the AIT book over to the ship. The AIT book/folder will include but is not limited to copies of the following documents:

o Work Authorization Form (WAF), o Letter of Authorization (LOA) or Approved Risk Form, o OSIC pre-installation briefings, o Blank Alteration Completion Report (ACR), o SOVT, o Ship Change Document (SCD), o Integrated Logistics Support (ILS) Certification, o Copy of the Common Operating Picture (COP) File from

Configuration Data Managers Database- Open Architecture

(CDMD-OA),

o DD Form 1149, o Completion Message draft, o POA&M, o Training Verification Statement, o PII Removal (depending on type of system) o Copy of Memorandum for the Record (MFR) (depending if ship is within five year Decommission window), o Occupational Safety Health Administration (OSHA) training cards (during the installation, the installer shall also keep a copy of their OSHA training card on them at all times), o Quality Assurance (QA) Plan, o Fire & Safety Plan.

List of training attendees to the Government.

Installation and travel schedules.

Current installation scheduling information in a tracking spreadsheet to be approved by PEO EIS Assistant PEO-Logistics (APEO-L), PMW 250 DS Assistant Program Manager (APM), and PMW 250

PSM.

Plan and coordinate ship visits and communicate through a naval message.

Documentation of sustainment training and version specific rollout training to IT 2790/2791 System Administrator (SYSAD) and System End Users.

3.5.1.2 Afloat Logistics

The contractor shall ensure systems engineering, testing, lifecycle logistics, training, and fleet support, (as required), are available to support afloat installations. This includes:

Review ship schedules to determine availability for installations.

Perform all work in accordance with the requirements of the

NAVSEA Standard Items (SI) or Naval Shipyard Uniform Industrial Process Instructions (UIPI) as applicable.

Provide data entry support into Navy Data Environment (NDE), CDMD-OA, and SPAWAR PEO Integrated Data Environment and Repository (SPIDER) as appropriate for ship scheduling and milestone tracking; NMP timelines will be adhered to when entering data into databases.

Develop installation documentation, including SCDs, ILS Certifications, Risk Assessment Forms, etc.; and develop in accordance with NMP timelines.

Supply, assemble, and transport all material that is not Headquarters Centrally Provided Material (HCPM) for the installation.

Perform upgrades and installations of software and hardware on Navy platforms. This may include upgrades in order to be hosted on a new platform like CANES.

Perform inspections, testing, and/or assembly to the maximum extent practicable, to facilitate the installation schedule.

Perform Pre-Installation Checkout (PICO) as required.

Perform installation in support of OST and provide assistance with test defect analysis and resolution.

3.5.1.3 Afloat Installation Management Coordination

The contractor shall assist the Government in coordinating all management efforts required to complete the systems installation. Efforts shall include:

Provide the workforce necessary to meet Target Completion Dates.

Provide sufficient technical expertise services and materials as necessary to effectively and efficiently install and verify operation in order to provide full functional systems listed in the SOW.

Ensure all installation personnel have accomplished the necessary training for shipboard installations and have required access to Navy advanced planning databases (includes: SPIDER, NDE, CDMD-OA, OSHA, RMMCO, etc.) and document in accordance with the Personnel Transition/ Turnover Plan.

Submit all visit/clearance information in a timely manner to ensure no impact on installation schedule. Additional visit clearance and training requirements may be required at certain shipyards.

Obtain all required passes and badging.

Obtain all required work authorizations and permits.

Submit Hazard Material (HAZMAT) handling requests.

Coordinate material handling with the shipyard/base facility.

Provide AIT Manager with documentation of all updated software versions in order to support entry into the CDMD-OA.

Ensure the installation data is loaded into the RMMCO database 30 days prior to start of installation.

Attend and document all required shipboard installations meetings (i.e., PEO EIS, NAVSEA, CVN, LCS, CANES, etc.) in meeting minutes.

Perform RMMCO physical check in/check-out, prior to going on-board to perform installation and after completion of the install.

Ensure installation team follow local Naval Support Activity (NSA) requirements (e.g., OSHA Safety Training).

Maintain compliance with the following NAVSEA Technical Specifications and develop documentation as required:

o General Requirements of Standard Item 009-01.

o Quality Management System requirements of Standard

Item 009-04.

o Maintain work area cleanliness in accordance with

Standard Item 009-06.

o Government Property Control requirements of Standard

Item 009-20.

o Work Authorization Control requirements of Standard

Item 009-24.

o OSHA requirements of Standard Item 009-74, and 29

CFR Part 1915.

Develop a QA Workbook in accordance with NAVSEA Tech

Spec 9090-310(F), and deliver in accordance with the Quality Management System (QMS) documentation.

The Contractor shall complete the SOVT in accordance with the SOVT Preparation and Execution Guidance (SPEG) and document all required efforts and artifacts in accordance with the SOVT Plan and Report. This includes:

o Develop and submit System and Platform SOVTs in SPIDER four months prior to ship availability.

o Provide installation support during SOVT.

o Provide troubleshooting services to assist the SME during the post-installation SOVT.

o Track installation discrepancies, correct deficiencies discovered during SOVT, manage repair of all corrections, and obtain all required completion signatures before the end of ship availability.

o Upload executed/signed SOVTs to SPIDER.

o Report major discrepancies/deficiencies immediately to the OSIC. If the discrepancy is related to errors in Engineering Change Request (ECR), Engineering Change (EC), Field Change (FC), Software Load Plan, System Configuration, or other technical Government Furnished Information (GFI) documents for which a resolution is not known, the assigned AIT Manager shall be notified so that a technical resolution can be provided. The Contractor shall redline technical GFI documents, as required, based on technical direction provided by the assigned AIT Manager.

o Coordinate SOVT efforts with the OSIC and AIT Manager.

o Perform system…