AA_PWS_Draft_v6 1.pdf

Consolidated Performance Work Statement (PWS)

PROJECT TITLE: Application Arsenal (AA) Enterprise Engineering and Lifecycle Support

1.0 TASK ORDER PURPOSE

The purpose of this Task Order is to procure engineering, software development, technical services, and program management for the continued design, implementation, security, and sustainment of the Application Arsenal (AA) enterprise service. The primary objective is to deliver comprehensive lifecycle support to ensure the system operates securely and effectively, meeting the evolving needs of the warfighter and government personnel.

2.0 SCOPE

The scope of this effort includes the full lifecycle of systems engineering and software sustainment for the AA platform. The contractor shall provide all necessary personnel, materials, and services to perform the tasks outlined in this PWS. The primary technical environment for this effort is the Overmatch Software Armory (OSA); however, work may be directed to other government-mandated DevSecOps pipelines (e.g., ORION) as required.

This contract is intended to be the primary support vehicle for the Application Arsenal platform. The performance requirements described below may be initiated and funded by diverse DoD Components. The contractor shall support all tasks as directed by the Contracting Officer's Representative (COR), provided the work is within the scope of this

PWS.

3.0 BACKGROUND

The Naval Information Warfare Center Pacific (NIWC-PAC) established the Application Arsenal (AA) to provide critical software delivery capabilities to the fleet.

Application Arsenal (AA) is the enterprise distribution, update, and installation service for software at the tactical edge. It enables software developed in a software factory to be sent Over-The-Air (OTA) to the edge across many different environments. AA currently deploys software to Agile Core Services (ACS), the USMC Common Hosting Environment (CHE), the Overmatch Production Environment (OPE), Five Eyes (FVEY) partners, and autonomous vehicles, with more systems projected to come online.

This PWS defines the requirements for contractor-provided services essential to enable the design, implementation, and sustainment of the AA enterprise service for a diverse set of DoD-wide stakeholders, including the Rapid Capabilities Office (RCO), the Portfolio Acquisition Executive for Robotic and Autonomous Systems (PAE RAS), the Portfolio Acquisition Executive Mission Systems (PAE MS), the U.S. Marine Corps (USMC), and Naval Sea Systems Command (NAVSEA).

4.0 APPLICABLE DOCUMENTS

The contractor shall comply with all documents referenced in the performance requirements that the contractor will have to use or comply with in performance of this PWS tasking. This list is not exhaustive, and other documents may be specified in individual Task Orders.

• NIST SP 800-53, "Security and Privacy Controls for Information Systems and Organizations"

• Applicable Department of Defense (DoD) and Department of the Navy (DoN) regulations, directives, and instructions.

5.0 PERFORMANCE REQUIREMENTS

5.1 Engineering & Integration Requirements

• 5.1.1 AA Development: The contractor shall provide the planning, development, testing, and integration required for all new AA releases and enhancements.

o 5.1.1.1 Capability Development: Efforts shall include modernizing existing deployment architectures by leveraging and integrating with the Overmatch Software Armory (OSA) DevSecOps pipeline, deploying with Agile Core Services (ACS), and ensuring alignment with the Common Hosting Environment (CHE) and other shared government platforms. The contractor shall design and implement scalable, secure integration pathways for Navy programs of strategic importance, ensuring compliance with mandated DevSecOps tooling, security guardrails, and enterprise release practices, including interoperability with Five Eyes (FVEY) partners.

o 5.1.1.2 Cybersecurity Engineering: The contractor shall engineer and integrate required cybersecurity controls into new AA releases in alignment with Risk Management Framework (RMF) standards. Deliverables shall include Security Control Traceability Matrices (SCTMs), Plans of Action and Milestones (POAMs), and other documentation required for the Authority to Operate (ATO).

o 5.1.1.3 Fielding: The contractor shall perform the installation, configuration, and testing necessary to field new releases across all authorized operational environments for CONUS and OCONUS locations, ashore and afloat. This effort shall include robust system validation through Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), and System Operational Verification Testing (SOVT).

• 5.1.2 Software Delivery Pipeline Integration and Replication o 5.1.2.1 DevSecOps Engineering Services: The contractor shall provide engineering services to design, implement, and integrate secure DevSecOps pipeline capabilities within the Government-designated DevSecOps environment (e.g., OSA, ACS).

o 5.1.2.2 Secure Software Distribution: The contractor shall develop and validate secure methods for efficient transfer and replication of software artifacts to remote and distributed environments, including ashore, afloat, autonomous, and cloud-hosted domains.

• 5.1.3 Infrastructure, Command and Control (C2), Autonomous Systems, and Cross-Domain Solution (CDS) Integration o 5.1.3.1 CDS Engineering and Integration: The contractor shall integrate with existing infrastructure and established Cross-Domain Solutions (CDS) to provide the secure, bi-directional data transfer capabilities necessary to support distributed autonomous operations across disparate security domains.

o 5.1.3.2 Integration Support for Autonomous Systems: The contractor shall support the integration of edge servers, autonomous vehicle platforms, and related mission systems with currently fielded and emerging technologies.

This includes the integration of payloads and sensors common to unmanned and autonomous systems.

o 5.1.3.3 Support for Autonomous Operations and Data Exchange: The contractor shall leverage and enhance existing infrastructure to support Command and Control (C2) data exchange for real-time operational scenarios, exercises, and mission requirements. This includes data to and from autonomous systems, such as mission tasking, telemetry, and sensor data.

• 5.1.4 Rapid Agile Development & Integration Support (RADIS) (RDT&E): The contractor shall provide a rapid technical response to issues employing engineering techniques to solve problems using an agile software approach to develop, test, and integrate new C4I capabilities to meet identified Science & Technology (S&T) gaps for the warfighter.

5.2 Support Requirements

• 5.2.1 Application Arsenal (AA) Sustainment: The contractor shall provide comprehensive support to sustain the functionality, security, and operational availability of all fielded AA releases.

o 5.2.1.1 Operations & Maintenance (O&M): The contractor shall operate, maintain, and sustain all fielded releases, including proactive monitoring, repairs, and routine updates.

o 5.2.1.2 System Administration: CSWF-qualified personnel shall perform routine system administration on Linux and Windows servers.

o 5.2.1.3 Cyber & Information Assurance (IA): The contractor shall provide operational IA support, including managing security patches, conducting vulnerability scanning and remediation, and preparing all required artifacts for cybersecurity compliance. The contractor is not responsible for managing the eMASS ATO record.

o 5.2.1.4 Help Desk: The contractor shall provide help desk support, including remote and on-site assistance.

• 5.2.2 Sustainment of Fielded Capabilities: The contractor shall provide engineering and technical support for the sustainment of previously fielded software, infrastructure, and cross-domain capabilities, including support for exercises and operational events.

• 5.2.3 RADIS (O&M): The contractor shall provide a rapid technical response to enhance, upgrade, test, and integrate C4I capabilities to meet identified S&T gaps for the warfighter, developing user stories in OSA or other Government-mandated environments.

• 5.2.4 Training and Logistics Support:

o 5.2.4.1 Training Support: The contractor shall provide user and administrator training for sustained systems.

o 5.2.4.2 Logistics Support: The contractor shall provide logistics support to maintain operational readiness, including tracking software licenses and managing version releases.

• 5.2.5 Technical Data and Reporting: The contractor shall generate, update, and maintain a complete and accurate Technical Data Package (TDP) for all supported systems and report regularly to government stakeholders.

6.0 TRAVEL

No travel is anticipated on this Task Order. Should travel be required, it will be authorized separately by the Contracting Officer's Representative (COR). The following long distance travel is estimated:

The Contractor shall attend support meetings, conferences, workshops, and fieldings at CONUS and OCONUS locations in support of the SOW requirements. Travel to locations within United States Africa Command (USAFRICOM), United States Central Command (USCENTCOM), United States European Command (USEUCOM), United States Indo- Pacific Command (USINDOPACOM), United States Northern Command (USNORTHCOM), United States Southern Command (USSOUTHCOM) may be required. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the Government, and is on a strictly cost reimbursable basis. All travel is expected to originate from San Diego, CA.

Contractor personnel must adhere to all current DoD, SECNAV, OPNAV, and NIWC Pacific instructions related to foreign travel.

7.0 PROPERTY REQUIREMENTS

No Government Furnished Property (GFP) is anticipated for this Task Order.

8.0 SECURITY

The work performed under this effort is anticipated to be up to the SECRET level, with potential for personnel to provide services within laboratories and vessels classified up to TOP SECRET. The contractor personnel will require access to classified data, information, meetings, and spaces. The contractor shall adhere to all security requirements outlined in the DD Form 254, Contract Security Classification Specification.

9.0 DELIVERABLES

The contractor shall provide the data deliverables specified in the Contract Data Requirements List (CDRL), DD Form 1423, attached to the Task Order. This includes, but is not limited to, a Software Development Plan (SDP), Monthly Status Reports, and Technical Data Packages (TDP).

10.0 PERFORMANCE REQUIREMENTS SUMMARY

The following table summarizes the key performance requirements for this PWS.

Performance Objective

PWS

Paragraph

Performance Standard / Acceptable Quality Level

(AQL)

System Sustainment & Availability

5.2.1 The Application Arsenal platform shall maintain operational availability during standard business hours, excluding scheduled maintenance.

Rapid Agile Development & Support

5.1.4, 5.2.3

All new features and sustainment actions are managed via approved Agile processes and delivered in planned sprints. AQL: 95% of committed story points completed per sprint.

CDRL Delivery 9.0 All required reports and data deliverables are submitted on time and are accurate. AQL: 100% on-time delivery;

no more than one rejection per CDRL submission.

Cybersecurity & Information Assurance

5.2.1.3, 8.0

Maintain security posture with no incidents from contractor negligence. Remediate vulnerabilities per DoD directives (Critical: 14 days, High: 30 days, Medium: 90 days, Low: 180 days). AQL: 100% compliance.

Training & Logistics Support

5.2.4 All training events are conducted as scheduled, and all logistics deliverables are provided on time. AQL: 100% on-time delivery and execution.