Statement of Work.pdf

CUI

STATEMENT OF WORK

FOR

F/A-18 & EA-18G IPT

SOFTWARE MANAGEMENT INFORMATION SYSTEM SUITE

21 December 2022

DISTRIBUTION STATEMENT D: Distribution authorized to Department of Defense (DoD) and U.S.

DoD contractors only (Export Controlled Data), Critical Technology determined on 13 June 2022. Other requests for this document will be referred to Naval Air Warfare Center, Weapons Division, F/A-18 & EA-18G IPT, China Lake, CA 93555-6100.

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25."

DESTRUCTION NOTICE: For classified documents, DoD civilians or military personnel will follow procedures outlined in DoDM 5200.01, Volume 3, Enclosure 3; DoD Contractors will follow procedures outlined in DoDM 5220.22, Sections 11-19. For sensitive unclassified documents, destroy by any method that will prevent disclosure of contents or reconstruction of the document.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) - Access to and dissemination of CUI shall be allowed as necessary and permissible to any individual(s), organization(s), or grouping(s) of users, provided such access or dissemination is consistent with or in furtherance of a Lawful Government Purpose and in a manner consistent with applicable law, regulations, and Government-wide policies.

Controlled by: NAWCWD Controlled by: F/A-18 & EA18G IPT CUI Category(ies): OPSEC, CTI Distribution Statement D POC: Robert Tomlinson, 760-939-4481

1. BACKGROUND

Naval Air Warfare Center Weapons Division (NAWCWD) is an organization within Naval Air Systems Command (NAVAIR) dedicated to maintaining a center of excellence in weapons development for the Department of the Navy (DoN). NAWCWD operates multiple weapons integration and development laboratories in support of several aircraft Integrated Product Teams (IPTs) and Technical Program Offices (TPOs).

The F/A-18 & EA-18G IPT, as well as other IPTs and TPO s, have a requirement for the ongoing sustainment and enhancement of an existing management information system suite, as well as the development and modernization of new features, tools or web-based applications that are fully integrated with the existing systems. The existing software suite, herein collectively known as the F/A-18 & EA-18G Management Information System Suite (MISS), consists of multiple web-based software applications and tools that provide Business Intelligence (BI), Business Analytics (BA), and Risk Management (RM) functions.

MISS is hosted in a Navy Marine Corps Intranet (NMCI) Community of Interest (COI) located on premises at the NAWCWD, China Lake Data Center and administered by Department of Industry, Technology, and Commerce (DITAC) Server Branch DC32300. MISS includes the following: AWL Planning and Estimation (APEx) application, AWL Planning and Tracking (APAT) application, AWL Risk Management System (ARMS) application, and AWL Business Intelligence (BI) reporting tool.

2. SCOPE

The scope of this contract is for professional services in the creation, modification, security and sustainment of new and existing functionality within the MISS software, including the overall Software Development Life Cycle (SDLC). This also includes the design, implementation, training, deployment, troubleshooting, maintenance, cybersecurity and retirement of new or existing tools and/or techniques. MISS production software will be deployed on government owned and accredited servers within the NAWCWD, China Lake Data Center or other approved government-hosting facility. The overall goal of this contract is to provide a shared business intelligence and analysis tool suite to NAWCWD users in support of effective and efficient decision making with the capabilities to plan, project and manage schedule, financials and risk.

2.1 APPLICABLE DOCUMENTS

The following documents are applicable. The latest versions shall apply. The Government will provide all necessary obsolete reference documents and those not generally available to the contractor as requested.

Department of Defense (DoD) Specifications:

a. 32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM), 21 December 2020. - 32 CFR Part 117 NISPOM

b. Department of Defense Instructions (DoDI):

i. DoDI 5000.75, Business Systems Requirements and Acquisitions," 2

February, 2017, Incorporating Change 24 January 2020

ii. DoDI 5200.48, "Controlled Unclassified Information (CUI)," Effective

March 6, 2020

iii. DoDI 5230.24 Distribution Statement on Technical Documents, August

23, 2012, Incorporating Change 3 on October 15, 2018

iv. DoDI 8330.01, "Interoperability of Information Technology, Including

National Security Systems ," September 27, 2022

v. DoDI 8500.01 Cybersecurity, March 14, 2014, Incorporating Change 1 on October 7, 2019

vi. DoDI 8510.01, "Risk Management Framework for DoD Systems," July

19, 2022

vii. DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK)

Enabling , May 24, 2011

viii. DoDI 8580.1 Information Assurance (IA) In the Defense Acquisition

System, July 9, 2004

ix. DoDI 8582.01 "Security of Non-DoD Instruction Systems Processing

Unclassified Nonpublic DoD Information, December 9, 2019"

c. DoD 8570.01-M Information Assurance Workforce Improvement Program-

December 19, 2005, Incorporating Change 4 on November 10, 2015

d. Department of Defense Directives: (DoDD)

i. DoDD 8000.01, Management of the Department of Defense Information Enterprise- March 17, 2016; Incorporating Change 1 on July 27, 2017

e. DOD Cybersecurity Test and Evaluation Guidebook, February 10, 2020.

Version 2.0, Change 1.

f. DOD Enterprise DevSecOps Strategy Guide, March 2021, Version 2.0 g.

Categorization and Control Selec 27, 2014, as amended - CNSSI_No1253.pdf

h. Committee on National Security Systems Policy CNSSP No. 11, 10 June 2013.

i. DOTE&E Operational Test and Evaluation Memorandum, Cyber Economic Vulnerability Assessments (CEVA), 21 January 2015

j. National Institute of Standards and Technology (NIST) Special Publications

i. 800-37 Revision 2 Guide for Applying the Risk Management Framework to Federal Information Systems, December 2018

ii. 800-53 Revision 5; Security and Privacy Controls for Federal

Information Systems and Organizations, September 2020, with updates as of 10 December 2020

iii. 800-171 Revision 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020, with updates as of 28 January 2021

k. Federal Information Processing Standards Publication (FIPS 199, February 2004).

l. Office of the Chief of Naval Operations OPNAVINST 3440.17A Navy Installation Emergency Management Program, 1 August 2014

m. Chairman of the Joint Chiefs of Staff Instructions (CJCSI)

i. CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 09 Feb 2011, certified current 9 Jun 2015.

n. Secretary of the Navy Instructions: (SECNAVINST)

i. 5230.15, Information Management/Information Technology Policy for

Fielding of Commercial-off-the-Shelf Software, 10 April 2009

ii. 5510.36B, Department of the Navy Information Security Program, 12

July 2019

o. SECNAV M-5239.3, Department of the Navy Cybersecurity Manual 22 April

2022 - NAWCADINST 5239.2B.pdf

p. 5239.19A, Department of the Navy Computer Network Incident Response and

Reporting Requirements, 04 Sep. 2019.

2.1.1 F/A-18 & EA-18G UNIQUE DOCUMENTS

F/A-18 & EA-18G IPT MISS Software Applications Product Baseline Updates Technical Study Summary and Recommendations

F/A-18E/F & EA-18G ADVANCED WEAPONS SECURITY LABORATORY (AWL)

Security Practices & Procedures

2.2 INFORMATION TECHNOLOGY (IT)

2.2.1 Software Development / Server Hosting

All tools developed will be hosted by NMCI or run on NMCI workstations, and must be certified for and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current NAVAIR Server Consolidation effort.

2.2.2 Enterprise Architecture

a. Contractor Networks and Connections. Contractor-owned and operated networks are prohibited on any NAVAIR facility or site in support of this contract. The Contractor may access non-Government, external Internet Protocol (IP) space via the NAVAIR-provided Virtual Private Network (VPN) Outreach service or NAVAIR CIO approved IP service.

b. Contractor Connectivity. Contactor shall work directly with DITAC administrators responsible for operating NAWCWD China Lake Data Center, to interface with the MISS housed on China Lake NMCI servers to make changes to, update, or provide patches/fixes to software. To gain network access to government servers directly, the contractor shall provide at least one individual on staff to meet requirements to obtain and hold a T5 SSBI clearance as outlined in DoD 8570.01M, throughout the life of this contract. The contractor shall also provide to DITAC Cybersecurity Work Force PM a valid OPNAV 5239/14 System Authorization Access Request-Navy (SAAR-N) form prior to receiving NMCI access.

3. REQUIREMENTS

3.1 General Requirements

3.1.1 Compatibility

The Contractor shall prepare documents and software packages compatible with the Government IT environment through the security classification of confidential. The current operating environment required for this contract includes:

Microsoft Windows 10 Microsoft Project 2010 Microsoft Office Professional Plus 2010 Adobe Acrobat XI (reader) Internet access

The Contractor shall interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain anti-virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the F/A-18 & EA-18G IPT. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the F/A-18 & EA-18G IPT during business hours (7AM 5PM Pacific, Monday thru Friday, except Federal Holidays- (New Year Day, Birthday of Martin Luther

, Memorial Day, Juneteenth National

Thanksgiving Day, and Christmas Day)) whether at Contractor work site or on travel.

3.1.2 Meeting support

In support of the tasking outlined in this SOW, the Contractor shall host and conduct meetings at the classification levels up to CUI, and have contractor furnished telephone and VTC capability as well as sufficient equipment to conduct meetings with presentations including compatible software. This support shall be provided at contractor facility.

3.1.3 Travel

Temporary travel to other locations in support of program tasking is required. Travel will be quarterly, unless otherwise directed by the government. The Contractor shall be responsible for all transportation, billeting, and messing for the Contractor personnel except in those cases where Government transportation, billeting, and messing are the only services available. All travel costs shall be in accordance with the Joint Travel Regulations (JTR).

Temporary travel locations include Naval Air Weapons Station China Lake located in Ridgecrest, CA. This list is not all inclusive as locations may change over the life of the contract.

3.1.4 Subcontractors and Consultants

Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.5 Management of Contractor Personnel

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees.

The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services

3.1.6 Phase-Out Transition Plan

transition-out strategy shall be built around maintaining the mission of the F/A-18 & EA-18G IPT with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Upon termination or expiration of the contract, the contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition-Out Plan, to include the minimum elements listed below, in accordance with

CDRL A009.

- Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. The plan shall also address how the contractor plans to establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

- Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

- Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.7 Telework

The Contractor, upon notification to, and concurrence from, the Contracting Officer's Representative (COR) that the employees' work tasking is eligible for telework, may utilize alternate worksites/locations and telework to support continued performance of its contract in accordance with company policy. Contractor discretion is required when making alternate worksite and telework decisions based upon the nature of support provided by the employees. In the event telework is utilized, the Contractor remains responsible for performance and compliance with any applicable cost accounting standards and contract cost principles / procedures.

3.2 SECURITY

3.2.1 Citizenship Requirements

Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship;

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements;

c. A statement of the unusual expertise possessed by the applicant;

d. A statement that access will be limited to a specific Government contract (specify contract number); and

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Security Requirements

The F/A-18 & EA-18G IPT facilities are controlled access facility, and a Secret clearance is required for building access. Contractor personnel shall be able to obtain a Secret clearance at the time of award for building and continued base access over the life of the contract.

3.2.2.1 Investigative Requirements Personnel Security

The contractor shall provide personnel with the appropriate personnel security clearance levels for the work to be performed. Access to Confidential information is required in the performance of this contract and access shall be in accordance with the 32 CFR Part 117, Feb 2021, National Industrial Security Program Operating Manual (NISPOM), applicable DoD personnel security regulations, and DoD Contract Security Classification Specification (DD Form 254). The contractor shall maintain sufficiently cleared personnel to perform the tasks required by this SOW in accordance with the DD Form 254 and the contract. All contractor personnel shall possess the requisite security clearance, accesses, and need-to-know commensurate with the requirements of their positions.

All contractor personnel with access to unclassified information systems, including e-mail, shall have at a minimum a favorable Tier 1 (T1) investigation.

3.2.2.2 Information Security

Direct Support contractor personnel working under the purview of a DoN Commanding

Officer/Commander shall comply with the local security provisions and the requirements of SECNAVISNT 5510.36B. The contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of controlled unclassified information and to control distribution of controlled unclassified information in accordance with NISPOM 32 CFR Part 117, 24 Feb 2021, and

SECNAVISNT 5510.36B.

CUI information generated and/or provided under this contract shall be marked and safeguarded as specified in DoDI 5200.48, CUI Contractor shall not store or transmit CUI on personal information technology systems or via personal e-mail. Unclassified e-mail containing any DoD CUI shall be encrypted. Prior to sending CUI to any non- Navy Marine Corps Internet (NMCI) addressees, the sender must first positively verify all recipients are authorized access to CUI and have need-to-know. Non-NMCI recipients must have a DoD compliant Private Key Infrastructure (PKI) certificate that enables electronic transmission via unclassified networks while protecting the CUI with a digital signature and encryption.

3.2.2.3 Operations Security (OPSEC)

The contractor shall comply with the OPSEC requirements outlined within the DD Form

254. The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the contract.

The contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. The OPSEC program shall be in accordance with DoD and DON operations security (OPSEC) requirements, to include:

1) Assignment of responsibility for OPSEC direction and implementation

2) Planning guidance for the use of the OPSEC Process to identify vulnerabilities and apply applicable countermeasures (Contact NAWCWD Industrial Security Office for a current OPSEC Annex and CI Guide)

3) Establishment of OPSEC education and awareness training

4) Provisions for management, annual review, and evaluation of OPSEC programs

5) Oversight for accountability of OPSEC requirements to subcontractors

3.2.2.4 Public Release

Disclosure of information is covered by DFARS 252.204-7000 Disclosure of Information, incorporated in Section I of the contract. Concerning subsection (a)(2), public domain, i.e. via Distribution Statement A, and does not include information in the public domain that has not been officially released. For disclosure of unclassified information that has not been officially released, the contractor must seek specific approval from the Contracting Officer, with approval from the NAWCWD Public Affairs Office (PAO).

3.2.2.5 Loss, Compromise and/or Electronic Spillage of Classified or CUI Data

All instances of loss, compromise and electronic spillage of classified or CUI data shall be reported to the COR, TPOC and Government Security Office within 24 hours of the incident occurring.

3.2.2.6 Anti-Terrorism Force Protection and Emergency Management

The work performed on this contract is not Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government

Government facility shall complete annual antiterrorism (level one) and active shooter training.

3.3 SPECIFIC REQUIREMENTS

The Contractor shall design, develop, test, deliver, install, and integrate F/A-18 & EA-18G IPT software product baseline updates to existing MISS software applications and tools within the following areas: (1) Business Analysis and Development Integration, (2) Data Management and Securitization, (3) Maintenance Support, (4) On-going Development, (5) Cybersecurity, (6) Customer Support, and (7) Training.

3.3.1 Business Analysis and Development Integration

The Contractor shall have subject matter expertise (SME) of Government business statutes, fiduciary and acquisition law as it applies to the DoD, and work closely with Government stakeholders to properly understand business requirements. Contractor shall apply business analysis to identify and articulate the need for change and to facilitate that change.

The Contractor shall create and maintain a close working relationship with user community that facilitates frequent collaboration, communication, focus on problem-solving, transparency and built-in quality to ensure the flow of value is continuous. The Contractor shall capture user feature and enhancement requests that result from regular scheduled meetings meant to address backlog refinement, provide demos, facilitate ongoing planning and progress review. The Contractor shall use a systematic approach to gather the requirements for integration between current business systems to ensure that there is a smooth interaction between the MISS applications & tools and current business process flow to meet ongoing unique objectives and requirements specific to NAWCWD IPT & TPO programs. The Contractor shall analyze all user change requests for feasibility and to determine best implementation options and provide a report with the consolidated recommendations on a monthly basis (CDRL A002).

3.3.2 Data Management and Securitization

The Contactor shall work directly with DITAC System Administrators (SAs) to implement, deploy, install, patch, update or otherwise make changes to the MISS hosted in the NAWCWD China Lake Data Center. The Contractor shall follow any additional instructions provided by local server support staff. For each MISS application & tool production release, the Contractor shall provide detailed instructions for installing software updates and upgrades. (CDRL A004)

The Contractor shall ensure all content is preserved according to federal records retention requirements, and applications shall have the ability to protect personally identifiable information (PII).

The Contractor shall maintain current role or attribute based identity management, authorization, and authentication across all business applications.

3.3.3 Maintenance Support

The contactor shall use modern, iterative software development technologies, methodologies and techniques such as Agile and Development, Security and Operations (DevSecOps). Software development will be worked in active collaboration with identified stakeholders to ensure deliverables meet minimum requirements. Integration, delivery, testing, reporting and security auditing should be streamlined and automated to the maximum extent practicable.

The Contractor shall regularly evaluate commercial and Government software, freeware, shareware, tools, techniques, processes and standards. The Contractor shall keep third-party software up-to-date with current vendor-supported versions, including applying security patches and updates to address known vulnerabilities. The Contractor shall maintain documentation related to system/software engineering, integration activities, system security, program lifecycle, applications and databases. Any commercial-off-the-shelf (COTS) or Government-off-the-shelf (GOTS) software hosted or installed on government or NMCI systems must be registered and approved in the DON Application and Database Management System (DADMS). The current MISS utilizes several different commercial products with the tool suite. The Contractor shall provide SME for the Microsoft Internet Information Services (IIS), Microsoft .NET Framework, Microsoft SQL Server, and Microsoft Windows Server databases product suites including: C+, HTML, Structured Query Language (SQL), JavaScript, JQuery, AJAX, Entity Framework, JSON, and REST coding languages, Vue.js, CSS, Bootstrap, and Prime View, business intelligence and reporting platforms including Qlik Sense, and SQL Server Reporting Services PowerShell, Azure DevOps, and Microsoft Build Platform.

The Contractor shall maintain and repair current suite software in support of the user community. The maintenance tasks include maintaining system/software engineering, integration activities, system security, program lifecycle documentation, application documentation, and database documentation required for continued software support and requirements management.

The Contractor shall develop a Software Development Plan (SDP). The SDP shall serve during contract performance as the benchmark for the contractor's software development effort and shall be periodically evaluated and updated as specified in the CDRL, as part of continuous process improvement subject to Government review and approval. The SDP shall include a DevSecOps strategy, architectural diagrams of the software factory and DevSecOps pipelines and detailed data flow diagrams. (CDRL A007) The Contractor shall follow applicable DOD/DON/NAVAIR/NAWCWD DevSecOps polices and use the DOD Enterprise DevSecOps Strategy Guide as the guiding principles for the DevSecOps process.

The Contractor shall provide secure mechanisms to allow data exchange and interaction with external systems including on-going development to maintain and enhance, where applicable, current system integration with other Navy business systems such as: Navy Enterprise Resource Planning (NERP) and NAVAIR Common Spend Plan Tool (CSPT).

3.3.4 On-going Development

The Contractor shall develop and/or configure, test, stage, and release business applications by applying iterative and incremental processes and a frequent release cycle as described in SOW paragraph 3.3.3. The Contractor shall develop processes, data flow diagrams, models, or simulations as prototypes to illustrate application and tool functionality, and prototype user-facing functionality to provide the Government the opportunity to evaluate functional behavior and presentation prior to full software release. (CDRL A002)

The Contractor shall develop, maintain, and deliver a formal Government-defined User Acceptance Test Plan (CDRL A003). Test scripts shall permit the Government to validate all release functionality. The Contractor shall provide detailed test scripts that tie directly back to functional requirements identified in each release (CDRL A005). The Contractor shall utilize automated testing where applicable.

The Contractor shall ensure that the definition of how a story will be implemented is comprehensive and objective. Comprehensiveness includes defining what constitutes a finished product (e.g., packaged, documented, tested, and independently verified). For a story to be considered objective, it must be measurable or verifiable. The Contractor shall ensure industry best practices workflows are defined and used when considering solutions.

Solutions shall be aligned to commercial or Government best practices and will minimize the need for customization of commercial products to the maximum extent practicable.

Technical solutions shall be developed with logic, time and cost efficiencies in mind. The Contractor shall develop system configuration in such a manner as to leverage maximum re-use and sharing across the platform by other NAWCWD IPTs/TPOs.

The Contractor shall provide incremental documentation through sprint cycles that result in full technical and end-user documentation or configuration for all software development efforts and product releases. The documentation shall include all information necessary to document processes, procedures, code artifacts, and/or policies that were implemented in the creation of the development effort. (CDRL A006)

3.3.5 Cybersecurity

Cybersecurity requirements shall be addressed throughout the system lifecycle in accordance with applicable cybersecurity policies and issuances. This includes providing support, documentation, and artifact deliverables to the Government in their pursuit and eventual sustainment of Department of Defense (DoD) Risk Management Framework (RMF) accreditation and Authority to Operate (ATO).

The contractor shall comply with all applicable requirements and security controls outlined in NIST SP 800.171r2 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered Contractor information systems. Requirements and procedures for basic safeguarding of covered Contractor information systems shall include, at a minimum, the following security controls:

3.3.5.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

3.3.5.2 Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

3.3.5.3 Verify and control/limit connections to and use of external information systems.

3.3.5.4 Control information posted or processed on publicly accessible information systems.

3.3.5.5 Identify information system users, processes acting on behalf of users, or devices.

3.3.5.6 Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

3.3.5.7 Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

3.3.5.8 Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

3.3.5.9 Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

3.3.5.10 Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

3.3.5.11 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

3.3.5.12 Identify, report, and correct information and information system flaws in a timely manner.

3.3.5.13 Provide protection from malicious code at appropriate locations within organizational information systems.

3.3.5.14 Update malicious code protection mechanisms when new releases are available.

3.3.5.15 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Contractor-performed analysis shall include: criticality analysis, threat assessment and vulnerability assessments. The contractor will provide quarterly, to the Government, vulnerability assessment results, Application Security and Development (ASD) Security Technical Implementation Guide (STIG) Checklists in accordance with CDRL A00A, and supporting technical artifacts for the Government to achieve and/or maintain an ATO as part of the Government-owned RMF accreditation process. The Contractor shall maintain current role or attribute-based identity management, authorization, and authentication across all business applications. The Contractor must use Government-authorized, secure file transfer tools, services and/or methods to transmit and deliver large data files securely to the Government. Files that are too large to send via encrypted email may use the DoD Secure Access File Exchange (SAFE) tool or an encrypted optical media disc such as a CD/DVD or Blu-Ray. Physical Optical Media must be finalized, virus scanned and either hand delivered or sent via a Government-approved courier service.

3.3.6 Support

The Contractor shall provide on-call and help-desk support to the Government. Response time shall occur within four hours during normal business hours (Monday through Friday 7AM-5PM Pacific) and within 24 hours during non-business hours.

3.3.7 Training

The Contractor shall develop, document, and present training material for each application and tool production release. The training material shall focus on user roles, features, and functions available within the release. The Contractor shall provide in-person training to Government personnel for any system/application/tool changes, updates and modifications which require a level of effort that exceeds six weeks. When training is required, the Contractor shall conduct the training within two weeks of the implemented change. The Contractor shall deliver all training materials five working-days prior to the start of training courses. (CDRL A004)

3.3.8 Schedule

The Contractor shall produce either working software or a software demonstration at the end of each sprint/release cycle. The Contractor shall adhere to a 13-week sprint/release cycle accomplished in the sprint, taking into account . The Government will approve change requests for each iteration during a planning increment meeting, as well as overall plan revisions reflecting the experience from completed iterations. The Contractor shall be accountable for each iteration. The Government will development and test process. The Contractor shall determine the development processes within each cycle and propose, for Government approval, the way the cycle is to be run within the parameters set by the Government.

3.3.9 Metrics Collection, Analysis, and Reporting

The Contractor shall participate in Government-identified metrics collection, analysis, and reporting initiatives. The Contractor shall provide reporting on metrics that cover planning, inspecting, monthly progress status, sprint/release success rates, defect resolutions, time to execution and end user satisfaction metrics. Metrics information will assist in tracking elements such as cost variance, schedule variance, the number of features completed, bug defects, resolution times, and stability of deployed features over time. The Contractor shall utilize burn-up and burn-down charts, progress in completing requirements and any changes to the total number of requirements, progress towards release completion and projection of the remaining features that will be completed within a given release. The Contractor shall deliver a Monthly Progress/Financial Status Report including a summary of work performed for each task, problems encountered, problems solved, trips made, current schedules, and cost information. Cost information shall include monthly and cumulative funds in accordance with CDRL A001. Hours are to be detailed out by each labor category with associated costs. Material and travel costs are to be detailed out separately as a cost item.

Trend analysis graph depicting actual and planned expenditures shall also be included.

Contractor shall provide a monthly employee roster in accordance with CDRL A008.

4. DELIVERABLES

CDRL

Number

Title

A001 and Status Report

A002 Technical Report-Study/Services A003 Computer Software Product End Items A004 Training Materials A005 Revisions to Existing Government Documents A006 Software Version Description A007 Software Development Plan A008 Contractor Personnel Roster A009 Transition Out Plan A00A Security Technical Implementation Guides (STIG) Report

5. PERSONNEL QUALIFICATIONS

The Contractor shall be responsible for employing personnel having at least the minimum levels of education, and professional and technical experience, as stated under each labor category and specified herein. These individuals must have expertise in the iterative and incremental software development methodology, such as Agile, and experience using many of the tools included in the Development/Test Tool Suite identified previously. The management lead shall ensure that all work on this contract complies with contract terms and conditions and shall have access to be the primary interface with the COR and PCO and shall attend status meetings and ad hoc meetings with stakeholders as required, accompanied by the technical lead when necessary.

5.1 Definitions

As used in the minimum personnel qualification descriptions herein, the terms indicated shall be defined or their meaning qualified as follows:

academic year - a full or complete year of study at a post-secondary educational institution (i.e., junior college, college, university, technical trade, or professional school) toward which at least 30 semester hours or 45 quarter hours of undergraduate study, or 18 semester hours or 27 quarter hours of postgraduate study, were completed.

accredited institution - a post-secondary educational institution which was approved by an accrediting agency listed as nationally recognized by the U.S. Department of Education.

accredited program - an educational program or course of study offered by an accredited institution.

degree - an academic title conferred by an accredited institution upon completion of a unified course of study; if not otherwise qualified, the term shall mean a degree at the associates, degree majors all labor categories requiring degrees in the professional engineering functional area specified below shall have majors in the following subjects: aerospace, aeronautical, chemical, civil, computer, electrical, electronics, environmental, industrial, mechanical, or nuclear engineering.

key personnel those who will be performing in Key Labor categories as specified below.

experience and years of experience when used in relation to requirements for past

-time (on the basis of a standard forty hour work week) participation, at least one-half of which time was spent performing qualifying functions as practitioner or employee. When used in relation to full, productive years of participation. Productive years are work years of fifty-two weeks reduced by reasonable amounts of time for holiday, annual, and sick leave. If participation was part-time, or if less than one-half of the standard work week was spent performing qualifying functions, the actual time spent performing qualifying functions may be cumulated to arrive at full years (or years and months) of experience. For example, only the actual number of full days (or full-day equivalents) of duty or drills completed during a year of military reserve participation, or in other qualifying part-time employment or practice may be cumulated toward years of experience. Qualifying part-time experience performed in addition to other full-time qualifying employment during the same period of time may be cumulated on a full-time equivalent basis and added to the full-time experience to satisfy a total experience requirement.

5.2 Levels of Experience

Junior A junior level person within a labor category has less than BA/BS degree. A junior level person is responsible for assisting more senior positions and/or performing functional duties under the oversight of more senior positions.

Journeyman A journeyman within a labor category has 3 to 10 years of experience and a BA/BS degree. A journeyman level person typically performs all functional duties independently.

Senior A senior level person within a labor category has over 10 years of experience and a MA/MS degree. A senior level person typically works on high-visibility or mission critical aspects of a given program and performs all functional duties independently. A senior level person may oversee the efforts of less senior staff and/or be responsible for the efforts of all staff assigned to a specific job.

5.3 Substitution for Levels of Education and Experience

Degree

6 years of additional work experience may be substituted for a years of additional work may be substituted for a

Degree

4 years of additional work experience may be substituted for a

5.4 Labor Categories

The following lists the Bureau of Labor statistics (BLS) Labor Category, level, BLS Major Groups Code, and BLS SOC Code

*Key Personnel

5.5 Functional Descriptions

Computer and Information Systems Manager - Plan, direct, or coordinate activities in such fields as electronic data processing, information systems, systems analysis, and computer programming. Excludes "Computer Occupations" (15-1211 through 15-1299).

Project Management Specialist - Analyze and coordinate the schedule, timeline, procurement, staffing, and budget of a product or service on a per project basis. Lead and guide the work of technical staff. May serve as a point of contact for the client or customer. Excludes "Management Occupations" (11-0000), "Logisticians" (13-1081), "Meeting, Convention, and Event Planners" (13-1121), and "Production, Planning, and Expediting Clerks" (43-5061).

Database Architect - Design strategies for enterprise databases, data warehouse systems, and multidimensional networks. Set standards for database operations, programming, query processes, and security. Model, design, and construct large relational databases or data warehouses. Create and optimize data models for warehouse infrastructure and workflow.

Integrate new systems with existing warehouse structure and refine system performance and functionality. Excludes "Database Administrators" (15-1242).

Information Security Analysts - Plan, implement, upgrade, or monitor security measures for the protection of computer networks and information. May ensure appropriate security controls are in place that will safeguard digital files and vital electronic infrastructure. May respond to computer security breaches and viruses. Excludes "Computer Network Architects" (15-1241).

Computer Programmers - Create, modify, and test the code, forms, and script that allow computer applications to run. Work from specifications drawn up by software developers or other individuals. May develop and write computer programs to store, locate, and retrieve specific documents, data, and information.

Software Developers - Research, design, and develop, computer and network software or specialized utility programs. Analyze user needs and develop software solutions, applying principles and techniques of computer science, engineering, and mathematical analysis. Update software or enhance existing software capabilities. May work with computer hardware engineers to integrate hardware and software systems, and develop specifications and performance requirements. May maintain databases within an application area, working individually or coordinating database development as part of a team.

Software Quality Assurance Analyst and Tester - Develop and execute software tests to identify software problems and their causes. Test system modifications to prepare for implementation. Document software and application defects using a bug tracking system and report defects to software or web developers. Create and maintain databases of known defects.

May participate in software design reviews to provide input on functional requirements, operational characteristics, product designs, and schedules.