Ops_and_Maint_Technical Exhibit_I_PRS v20MAR25.pdf

Do Not Distribute

DRAFT

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Requirements Summary Standards, Acceptable Level of Performance (ALPs)

Disincentives: The SLA penalty for these support commitments will be 2% of the monthly revenue for that month's performance, meaning, not a per miss penalty, but if there are 2 or more misses in a month, there is one penalty for that month. This is to be applied to all task listed below.

Task Objective Outcome/ Standard ALP Disincentive

Surveillance Method/Measure

1.0 TRANSITION

1.1 TRANSITION IN

1.1.1 Transition of work.

The contractor shall successfully take control of the work contained within the PWS from the existing provider during the transition period by:

- identifying all activities of the transition and communicating those activities to the COR and existing provider in a clear, organized, and timely manner;

- timely communicating all material issues to the COR and existing provider;

A fully documented and executed schedule that identifies all tasks necessary for an efficient, effective, and orderly transfer of work between providers.

Within the transition period, the Contractor has control over all data necessary to perform the tasks under the PWS.

Fully transitioned the work from existing vendor within the transition period.

The quality assurance representatives (QARs) will review weekly status reports.

- creating a project management plan of all activities needed to complete a full transfer of the work from the existing provider, which includes a schedule that is resourced and has durations, and the names of Contractor personnel who will need CAC and security processing information; and

- providing weekly status updates on the schedule execution.

1.1.2 Transfer of documentation currently

being worked.

The contractor shall work with existing provider to identify all technical data, documentation that is created for currently on-going projects or open tasks and include such information in the Transition Plan.

List of documents will include name of document, name of project or task, current status and where document is stored.

The contractor shall notify the COR of the successful transfer of technical data and systems.

The contractor is in control of and maintaining all technical data, documentation of on-going projects within the transition in period.

The COR receives proper notification of the completion of these data transfers.

Successful transfer of data occurs within the transition-in period.

QARs will review and verify the completion of the documentation/data transfer.

1.2 TRANSITION OUT

1.2.1 Notification of Tools & Technical

data.

Contractor will identify all tools used in the performance of the contract to the COR 9 months prior to the expiration of the final option year on the T.O. or when requested for such information by the COR. Notice will include when tools were developed, whether the tools were developed under the T.O. and the contractor’s assessment of whether DRAS-M has rights (government purpose rights or other data rights) to each tool or technical data. All asserted rights to said items will be included in such notification.

Identify and report on all technical data being used in the performance of the T.O., location, and provide access to and back-up copies of said data to DRAS-M personnel identified by the COR.

Notification includes all tools and technical data/systems used to perform the task order (T.O.) and provided to Government within 60 days of being notified by the Contracting Officer/COR or 9 months prior to the expiration of the final option year.

Provides assistance to new vendor in transferring all identified items.

Transition notice of tools and Technical data provided within 60 days of request or within 9 months of expiration of the T.O.

Reasonable support and assistance provided during transfer of technical data and/or tools.

Correctly identifies Vendor asserted rights 90% of the time in notification.

QAR will review notification to ensure completeness.

1.2.2 Transition Plan.

Develop and provide Transition Out Plan and points of contact for the transition out period. Plan will detail how the contractor will coordinate & communicate with new vendor and Government personnel.

A comprehensive transition plan includes tasks, POCs and how knowledge transfer will occur to the vendor.

Transition plan includes tasks for when tools and technical data are to be transferred and all other tasks necessary to transfer performance to

Transition out occurred within the time allotted and work successfully transferred to new vendor.

QAR will review plan and weekly status reports.

Knowledge transfer is a central part of this activity. Transition out period is 90 days and plan shall be for same 90 days.

Provide status of plan on a weekly basis. Provide COR notice as technical data and systems are transferred to the new vendor.

another entity during a 90 day transition period.

Weekly status reports are timely submitted during transition out period.

Weekly Status reports provided 100% of the time to COR during rating period.

Transition plan is not returned more than once for corrections cause by contractor oversight or error.

1.2.3 Inventory of all work orders.

Contractor provides a report of all open work orders that includes the status of where each order is and the location of materials associated with performing that work order.

All open work orders are identified and reported with a brief description of status.

Report further identifies location of work materials and documents.

COR is provided a copy of Inventory.

99.5% of all open work orders are identified in inventory.

QAR will review inventory against known work orders.

Task Objective Outcome/ Standard ALP Disincentive

Surveillance Method/Measure

2.0 PROGRAM & PROJECT MANAGMENT

2.1 Project Management Plan

Develop a Project Management Plan (PMP) for all work and tasks that must be completed to provide the services identified in this T.O..

The contractor shall provide a PMP for approval by the Government as part of the transition in period.

Government must approve the

PMP.

PMP is accepted 100% of the time with no more than one rejection for corrections caused by

QAR will review and approved PMP. QAR will inspect contractor performance to ensure contractor is executing according to PMP.

The PMP documents all support requirements that need to be carried out to perform the services contained in this T.O.; describes and details the proposed management approach; provides standard operating procedures (SOPs) for all tasks; includes the milestones, tasks, and subtasks required in this T.O.;

and the PMP provides for an overall Work Breakdown Structure (WBS).

The PMP also includes the contractor’s Risk Management Plan, Capacity Management Plan, and Quality Control Plan, to include periodic updates and a methodology for Customer Satisfaction Surveys.

As changes are identified and made to the plan, an updated copy is provided to the COR.

When requested by DRAS-M for a particular project, create a viable

PMP.

The PMP shall be continuously updated and a current copy is always available to the COR.

As projects are identified by the Government to be performed under this T.O., Project Management Plans will be created for each to include a schedule with all tasks, resources and durations estimated. As the project is executed, updates to the schedule will be provided to the Government.

contractor oversight or error.

COR has a current version of the PMP 100% of the time during rating period.

2.2 Change Management Process

Establish and maintain standard virtual appliances and software configuration baselines.

Maintain a technical library with up-to-date documentation consisting of

A standard virtual appliances and software configuration is maintained, accessible by DRAS-M and has an established baseline. All changes are first coordinated with the DRAS-M PM.

Change control process identified 98% of CIs during rating period.

QAR will review CCB meeting notes.

operating manuals, application documentation, virtual appliances and software interface documentation, training manuals, and user guides.

Provide and implement methods for releasing changes to the baseline and archiving system releases.

Each configuration item (CI), must be identified and all necessary actions taken for the change control process to approve whether to implement the CI. Proper documentation is maintained of CIs and alterations from baseline are documented.

Status reporting is provided for each CI effort.

Coordinate the review and approval by DRAS-M approvers of all change management actions. Manage the RFC processing for Configuration Management.

Technical library is maintained in one hard copy version and in an electronic version that is accessible on-line.

Vendor provided and managed change management process is followed, includes archiving system and release management. Change management process identifies each new or altered configuration item.

2.3 Performance Management

Provide Performance Management reports to support all Acceptable Level of Performances (ALPs) and metrics identified in this document.

Conduct a monthly status report meeting with an agenda that reviews the monthly status report. Include all material events occurring in the prior month on report.

100% of metrics for all ALPs are included in the monthly status report.

Review briefings are conducted

QAR will review monthly agenda and status report.

Provide a Monthly status report and conduct a monthly review briefing.

RISK REGISTER

For currently executing projects, provide status reports and conduct review briefings.

Report on all ALPs within the monthly status meeting.

Develop and include automated performance reports to support all SLAs and identified metrics.

Monthly report shall include currently executing projects and their individual status.

Provide status when requested on executing projects. Conduct review briefings as needed.

when requested and convey required content.

2.4 In Progress Review and Weekly status

calls

The contractor shall perform in progress reviews and weekly status calls of projects on a recurring basis as directed by the COR.

For IPRs, the contractor shall provide (at least 1 business day prior to scheduled meeting) an agenda and slides detailing progress.

Meeting materials are provided prior to meeting. Meetings are conducted on time and as scheduled.

Meetings provide status of progress and problems encountered in effort.

DRAS-M is provided the information it needs to evaluate current status of tasks.

100% of the meetings are held on schedule, communicate status and resolve any questions.

Review of DRAS-M manager exception reports of meeting problems.

2.5 Progress review with Area Manager

Prepare agenda and collect status for work being conducted under each area manager’s responsibility.

Meetings provide status of progress and problems encountered in the different efforts.

DRAS-M is provided the information it needs to

100% of the meetings are held on schedule, communicate status and resolve any questions.

Review of area manager exception reports of meeting problems.

Keep notes of details of the meeting and provide a written copy following the meeting.

evaluate current status of tasks.

2.6 Project Management Support

Provide Project Management support for all new projects identified within scope during T.O. execution.

Develop schedules and project plans for each identified project. Maintain the schedule for those assigned projects.

Project management support is delivered to DRAS-M projects.

A schedule for each project is maintained and reviewed with

DRAS-M .

Ensure projects are success by staying within cost, schedule and achieving the project goals.

100% of individual projects are managed to ensure they meet project goals while staying within cost, schedule and scope.

Review of individual project schedules.

Task Objective Outcome/ Standard ALP Disincentive

Surveillance Method/Measure

3.0 Core Infrastructure Support

3.1 Review, analyze and take actions to

resolve DRAS-M TENANT Infrastructure priority Tier 3 support Information Technology Service Management (ITSM) tracker. A Tier 3 ticket is something that requires subject matter expertise to handle and resolve the DRAS-M TENANT Infrastructure issue. DRAS-M has 3 levels of ITSM ticketing. The first is help desk, second is infrastructure operations and the third is infrastructure Tier II and III for issues arising under the DFAS CPMO and DRAS-M Tenant

Tickets are processed according to priority and closed when complete. Conflicting priorities are brought to the attention of the COR and/or TPOC or designated Government POCs.

Analysis determines root cause of issue causing problem and a fix or plan to fix is identified.

Tickets are constantly updated on status and closed and resolved in system.

95% of all DFASNow tickets processed during rating period are worked according to priority and documented properly.

Review of DFASNow system.

Determine priority of ticket and process tickets focusing on highest priority first.

Update Information Technology Service Management tracker ticket with essential and material information. Close ticket when complete.

3.2 Core Infrastructure Tier II and III

Support

3.2.1 DRAS-M Tenant Infrastructure

Change Control Board (CCB) Requirements Support.

The contractor shall provide support that includes briefings, feasibility studies, project estimates, security posture impacts, cost benefit analysis of alternatives and other analytical support required by the CCB to formulate a decision.

All DevSecOps and Infrastructure as Code processes will be submitted to the CCB.

Review and getting approval to move forward of the project as a whole

CCB is provided with data and analysis sufficient to support the decisions presented to it.

Analysis has been coordinated with other impacted areas in both DRAS-M Tenant Infrastructure Tier II and DRAS- M ISSM (at a minimum) to ensure a sound solution is being presented which has taken all available aspects into consideration.

100% of DevSecOps and IaC used within the DRAS-M Tenant will have CCB approval prior to use.

CCB meetings have required inputs prior to meetings 95% of the time during rating period and are not returned more than once for revisions.

Review of CCB meeting notes.

3.2.2 The contractor shall provide detailed

design documentation for proposed engineering solutions for Critical Design Review (CDR).

This includes performing detailed planning of how production implementation should be carried out. Documentation includes a more detailed POAM with dates for tasks.

Coordination must be obtained across various areas and customers.

Critical design review documentation is created along with detailed POAM.

Planning is performed to identify how the implementation is to be carried out.

Coordination is obtained from all stakeholders prior to finalizing planning.

POAM details have been coordinated with other impacted areas in both DRAS- M ISSM and DRAS-M Core Infrastructure (at a minimum) to ensure a sound solution is being presented which has taken all available aspects into consideration.

95% of CDR documentation is created by required date and is not returned more than once for revisions.

Review of CDR documentations and

POAM.

3.2.3

Implementation of changes to the DRAS-M Infrastructure.

The contractor shall incorporate, deliver, document, test, and ensure the functionality of any infrastructure changes to include any new hardware/software, patches, break-fix, technology changes, network devices, software licenses, peripherals are successfully

For any change to the Infrastructure environment, contractor has document the change, tested and validated change in lab and piloted the change to ensure the impact to other systems and applications is minimized and known before moving to production environment.

99% of all changes to the Infrastructure follow proper protocol.

Review infrastructure changes documentation.

implemented into the DRAS-M IT environment.

All changes to IT infrastructure are required to be tested in the DRAS-M Test Environment prior to deployment in the Customer Acceptance.

Prior to executing, perform detailed planning of implementation to include documented test cases (success and failure) both in the Test Environment and Customer Acceptance Environment to validate the success of the implementation

All documentation is updated and maintained.

Any issues identified in production result in initial documentation modification to ensure problems are not encountered again.

3.2.4 Produce and maintain Lessons

Learned documentation.

For each implementation, capture lessons learned and develop a repository for capturing each project’s documentation.

Lessons learned is reviewed prior to engaging on new project of similar type and scope.

Lessons learned documentation is captured and reviewed for future projects of similar efforts.

100% of lessons learned documented with no more than one rejection for revisions.

Work returned for more than one revision shall be corrected at no cost to the Government

Document review.

3.2.5 Tuning

The DRAS-M DRAS-M TENANT infrastructure is maintained so that the environment is

Tuning plan activities are carried out on

Review and monitor tuning plan to ensure

The contractor shall take proactive steps to continuously be optimizing (tune) the various systems making up the DRAS-M Tenant infrastructure.

Take steps to identify inefficient conditions and take action to tune a system to increase overall efficiency of the solution.

operating at its highest level of efficiency at all possible times.

schedule 90% of the time during rating period.

proper activities are being carried out.

3.2.6. Network (Tier II and III) Operations

will maintain a DRAS-M Tenant current network architecture and configuration design for each implementation and validate with DFAS Cloud PMO network engineering.

Serves as technical consultant for network interfaces with DFAS Cloud PMO Network engineering for networking issues that involve, BCAP, CSP’s Landing Page, DoD DMZ and CSP provided network provided IP ranges.

Prior to deployments, Contractor shall provide architecture and configuration design updates that include the new solutions.

Support DRAS-M Incident Response in the areas of DRAS-M Firewalls, web proxy and filter, IPS/IDS, DNS.

New solutions are included into existing design documentation.

Existing design documentation and configurations are stored and maintained.

Break/fix actions are completed on schedule.

Ensure DFASNow tickets are utilized for all work items processed, determine severity of each ticket, track and use remedy as a tool to document solutions and effort expended (hours).

Security is maintained and threats are avoided and mitigated from security threats.

95% of is maintained up to date and accessible

95% of break/fix actions are completed on schedule.

97% of all projects are completed on-schedule.

DFAS security weaknesses not remediated within DOD mandated guidelines will be listed on the contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be

Review of design documentation.

Review of project documentation to validate completing on schedule.

Review DFASNow (ITSM) tickets from Help Desk, assess, triage and set priority for tickets received.

Develops, maintains, and modifies configuration control standards, and methods of operations for network devices required for DRAS-M operations. Documents and publishes these standards and guidelines.

Develops and manages highly complex network interfaces for software projects. Performs feasibility studies and business case analysis to provide technical solutions for the customer. Performs requirements analysis and documents product features and capabilities

Provides technical consulting support and collaboration with Government team members in new development projects and other major projects.

Provides recommendations on initiatives and projects being worked

Security analysis discovers potential avenues that could compromise security.

Network analysis using CSP’s SaaS tools or other resources, are performed to discover and eradicate errors in the traffic.

Project management skills are applied to new efforts.

In achieving the above results, work demonstrates an understanding of the background of security technical instructional guides (STIGs) issued by DISA, DFAS Information Assurance policy, , NIST and best administrative practices are applied and followed.

documented on the quarterly contract review.

3.3 SysAdmin of virtual infrastructure

3.3.1 Access Control must be authorized

and documented or removed.

Create accounts upon receipt of properly approved SAAR.

Only authorized individuals with a need to know have access.

100% of users have valid SAAR

Work returned for more than one revision shall be

Annual review 100% account Review of DRAS-M application.

Disable the accounts When user access is no longer needed, account will either be disabled or removed as follows:

1 - A departure workflow is submitted for Privileged Users, requesting removal of their account.

2 - Disable accounts (i.e., user access temporarily suspended or deactivated) when any of the following events occur:

• No account activity for more than 30 days.

• Long-term absences anticipated for more than 30 days upon supervisor notification.

• User’s security clearance revoked – Note: immediately disable user’s accounts.

• Account authorization discovered as missing or invalid – Note:

immediately disable user’s account.

• User fails to complete the Annual Cyber Awareness Challenge training.

WINDOWS/Oracle Database User Passwords is locked after 30 days of inactivity and deleted after 45 days of inactivity. Account passwords are required to be reset after 60 days. Non-interactive accounts that do not require human

On Core Infrastructure Lead on semi-annual basis, supervisors are required to validate that a privileged user account is still needed.

Undocumented access is either fixed or removed within 24 hours of identification.

corrected at no cost to the Government

Semi-Annual Privileged User review of both Tenant Appliances and System access.

Semi-Annual Authorized User review for Tenant Appliances.

intervention (machine to machine) will be allowed a password expiration of 365 days.

A daily automated script is utilized to suspend accounts that are 30 inactive and delete the accounts 45 days of activity respectively.

3.3.2 ZERO TRUST will be enforced on all

DRAS-M Infrastructure appliances

Presume Breach and enforce micro segmentation of Tenant in separate VNETS, and access to appliances within VNET must authenticate.

Appliances within VNET use RBAC with 2 factor authentication but then explicitly authorize to the least privilege using dynamic security policies.

NIST 800-53 Rev5 and all applicable Appliances STIG, examples include:

Default Deny No default passwords No unencrypted network protocols No clear text passwords 2 factor authentication using ICAM

Automate implementation of controls and monitor and review behavior compared to RBAC.

Continuously verifying user and device identities.

Role Based Access limited to explicit requirements of mission applying strict Access Control in virtualized appliances in IL-5

100% Default Deny on all appliances

100% traffic is encrypted.

100% of logging

DFAS security weaknesses not remediated within DOD mandated guidelines will be listed on the contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented

Monthly review and monitor logging to ensure proper activities are being carried out.

on the quarterly contract review

3.3.3 DevSecOps Practices are

implemented for Infrastructure deployment.

Coordinate with DFAS DevSecOPs program office, leveraging the Vulcan hosted CI/CD pipelines, to support the development of IaC for DRAS-M Infrastructure that includes but not limited network, IaaS servers, database and Containers appliances.

DRAS-M Core Infrastructure II and III shall provide support to the DRAS-M DevSecOps Specialist to formalize the DRAS-M DevSecOps process and provide to the DRAS-M for approval.

Reduce Testing of Virtual Appliances through implementation of automated tools within Vulcan Environment

Virtual appliances are only deployed to the Customer Acceptance Environment upon validation of compliant with Automated SAST and DAST tools.

DRAS-M Core Infrastructure II and III shall provide support to the DRAS-M

Ensure integrates security testing and analysis at every stage of the development process, enabling early detection and prevention of security vulnerabilities.

Automate repeated tasks with continuous integration and delivery (CI/CD), enabling rapid and frequent software releases that meet the highest security and quality standards.

Code will be hosted internally to the DRAS-M Tenant’s source control repository, tracked through container registries, and validated with continuous monitoring and testing.

100% of virtual appliance have documented DevSecOps process approved by the

CCB.

100% of the deployments have documentation of automated testing results and release approval.

DFAS security weaknesses not remediated within DOD mandated guidelines will be listed on the contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented on the quarterly contract review.

All deployments will be approved with DRAS-M CCB and ISSM will approve releases to

DevSecOps Specialist to formalize the DRAS-M DevSecOps process and provide to the DRAS-M for approval.

3.3.4 Infrastructure as Code (IaC) will be

implemented to avoid manual configuration of DRAS-M Tenant Infrastructure, including but not limited network, IaaS servers, database and Containers appliances.

The DRAS-M Core Infrastructure II and III shall leverage the DevSecOps process to formalize the IaC process and provide to the DRAS-M ISSM for approval.

Leverage the Continuous Integration / Continuous Deployment (or CI/CD) pipelines to automate your Infrastructure deployments.

Where feasible declarative tools for IaC is preferred, defining the required state of the solution to create an IaC process that can be executed multiple times with the same result.

Support IaC deployment IL-5 compliant appliances.

Store the IaC internally to the DRAS-M Tenant’s source control repository, within Code in a Version Control System

(VCS)

100% of virtual appliance are released as IaC deployments for upgrades, patches, and STIG updates.

95% reduction of human error for deployment of appliances into all the Subscriptions.

100% Auditable logging of all IaC deployments

DFAS security weaknesses not remediated within DOD mandated guidelines will be listed on the contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented on the quarterly contract review.

All deployments will be approved with DRAS-M CCB and ISSM will approve releases to

3.3.5 IaaS Server and Containers will be

managed by Tier II and Tier III SysAdmins within the all subscription and VNET within the DRAS-M Tenant.

CSP native automated disaster recovery and backup solutions.

Support audit requirements with robust logging to the DFAS-CSSP

Ensure access control alerts are routed to the Tier I Help Desk and

DRAS-M ISSM

Configure Zero Trust controls to support the Zero Trust Overlay and compliance with DoD Zero Trust compliance standards.

Support IaC deployment of containers and IaaS Linux appliance Administer secure server operating systems and virtualized environments in IL-5 Only Authorized Privileged user, via virtual desktop can directly access the servers.

ISSM has Access Control logs to review

Ensure OS on the IaaS and within Containers complies with the following DoD standards including Zero Trust

DFAS security weaknesses not remediated within DOD mandated guidelines will be listed on the contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented on the quarterly contract review.

Review of ACAS and CSP native vulnerability tools to evaluate compliance.

Annual DFAS-CSSP penetration test.

3.3.6 Database will be on an IaaS server

hosted on Oracle managed by Tier II and Tier III, within the all subscription and VNET within the DRAS-M Tenant.

Support IaC deployment Maintain the high-availability Oracle databases, ensuring optimal performance and

100% of the IaaS servers are deployed via IaC.

DFAS security not remediated within DOD

Review of ACAS and CSP native vulnerability tools to evaluate compliance.

Database Tier II and Tier III will work with the government DRAS-M Data Steward and DRAS-M database specialist.

Database Tier II and Tier III will manage a COOP Oracle database will be maintained at alternate CSP hosted location and ensure Replication of critical data from the DRAS-M production Oracle Database.

Support audit requirements with robust logging to the DFAS-CSSP

Ensure access control alerts are routed to the Tier I Help Desk and

DRAS-M ISSM

Configure Zero Trust controls to support the Zero Trust Overlay and compliance with DoD Zero Trust compliance standards.

compliance with DoD IL-5 standards.

Oracle structure complies with the following DoD standards including Zero Trust

a. Design Basics, Database Development Guide, Oracle Database Release 19, Oracle®, November 2023

b. Best Practices for Oracle Table Design with Tessell, Tessell, August 2024,

c. Oracle Database 12c STIG Ver 3 Rel 3, DoD Cyber Exchange, DISA, January 2025

ISSM has Access Control logs to review

95% Up time of the DRAS-M Database by the DRAS-M Java Application.

100% compliant DoD IL-5 standards.

100% Denial of access non-authorized access requests.

100% of Privileged user, via virtual desktop.

mandated guidelines will be listed on the contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented on the quarterly contract review.

Annual DFAS-CSSP penetration test.

3.3.7 Webservers will be managed by Tier

II and Tier III Web Admins within all subscription and VNETs within the DRAS-M Tenant.

CSP native automated disaster recovery and backup solutions.

CSP native automated disaster recovery and backup solutions.

Support IaC deployment of the Web Servers

Administer web server middleware(Apache, Tomcat, Java SE or IIS) and virtualized environments in IL-5.

Web Admins will STIG web server site and provide support

Ensure Web Servers are hardened to comply with DoD DMZ, IL5 standards including Zero Trust

DFAS security weaknesses not remediated within DOD mandated guidelines will be listed on the

Review of ACAS and CSP native vulnerability tools to evaluate compliance.

Annual DFAS-CSSP penetration test.

Support audit requirements with robust logging to the DFAS-CSSP

Configure Zero Trust controls to support the Zero Trust Overlay and compliance with DoD Zero Trust compliance standards.

to web server via tickets from

DFASNOW

contractors Risk Register.

Critical or High-risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented on the quarterly contract review.

3.3.8 Fail Over and COOP Support

Validate DRAS-M COOP Oracle Data base is a COOP location and plan from which CSP’s disaster recovery can operate if current location performance is no longer feasible.

Function as an integral part of the DRAS-M COOP plan and be able to support the DRAS-M COOP plan in emergency situations.

Support all DRAS-M COOP exercises.

Coop plan is ready and able to be executed. Plan ensures the continuous support of DRAS-M infrastructure environment is maintained at all times. It is acceptable to COR and COOP plan is capable of being performed from COOP site.

Able to support the DRAS-M COOP plan.

Participates in DRAS-M COOP exercises.

COOP plan exists and is capable of being utilized in emergency.

100% success comparison of COOP database and production database performed semi-annually.

100% success integration of

COOP

database with

QAR will review COOP Plan and verify ability to execute plan by contractor.

restored DRAS-M Java application during COOP.

3.4 Technical Support Specialist (Tier I)

Manage Tier 1 Help Desk, processing DFASNow tickets involving all DRAS- M applications, DRAS-M virtual desktop Solutions, or DRAS-M infrastructure outages, and document all actions taken within the ticket, track and close tickets accordingly.

Develop Ticket Triage priority process with ISSM and the Cloud Engineer.

Review tickets and determine priority and work highest priority tickets first.

Root cause of ticketed problems is diagnosed and solutions developed to resolve the problem condition.

Remedy tickets are fully documented with the description of actions take to resolve issue.

Tickets are routed to Tier II and III for resolution as required and tracked to resolution.

99% of Priority 1 remedy tickets are closed within 24 Hours.

95% of Priority 2 tickets are closed within 5 days.

Review of DFASNow ticket aging report to determine timeliness of tickets being processed.

3.5.0 Studies, analysis and evaluate

emerging technology.

3.5.1 IPV6 Processing

The contractor will ensure that all solutions will meet the DoD IPv6 standard. Validate IPV6 is working (supported) on all projects.

For every project IPv6 compatibility is reviewed and validated.

100% validation of IPv6 for each project during rating period.

Review of project

3.5.2

Emerging Technology and Process Improvement.

Research and analyze new emerging technologies that could provide savings to the Government, improve

Report on emerging technology and process improvements that could achieve the goals of reduced cost, improved service or add capabilities to DRAS-M TENANT infrastructure is

At least annually research is reported.

Review of reported research findings.

services and/or provide additional capability in operating the DRAS-M TENANT infrastructure. Report on such findings on a regular basis.

submitted and demonstrates through research and analysis.

3.5.3 Technology planning

The contractor shall review all DRAS- M IT infrastructure and provide an ITI five (5) year forward looking and an ITI detailed architecture 60 days after award and then annually thereafter.

Ensure maps are consistent with DoD Government, and Industry best practice directions.

Report identifies life cycle of the IT infrastructure and provides a viable roadmap for equipment replacement and technology refresh. Note this requires collaboration with Government personnel across many areas.

Report delivered within 60 days after T.O. award and annually thereafter.

Review of delivered report.

Task Objective Outcome/ Standard ALP Disincentive

Surveillance Method/Measure

4.0 Planning for implementation of new

requirements & execution of plans

Provide a project plan for implementing and incorporating new hardware/software for a full range of teleservices technology, including turn-key solutions, into the DRAS-M IT infrastructure.

Project plan includes all tasks required to be completed to implement new requirement, Detailed project plans are developed on schedule for implementing new technologies or requirements.

All material tasks are identified and estimated durations are within 25% +/- of actuals.

Project plan is executed as designed and requirement is implemented as designed and working as planned.

Successfully implement technology and all tasks successfully completed in the project plan.

Implementation project plan within approved schedule.

Review Project plan and test criteria to ensure installed items are working properly.

durations of tasks and task relationship with other task so as to provide timeframe for when each task should be worked.

If directed, execute plan to incorporate new requirements into the DRAS-M IT infrastructure and test to ensure change caused no other problems.

Status meetings are held to keep DRAS-M updated.

4.1 Business Analytical Services

Provide requirements documentation services to support projects.

Interview and facilitate the identification of new business needs and requirements and document requirements. Coordinate with other stakeholders to capture and document all necessary detail needed to adequately plan for implementing new capabilities.

Review current technology and identify functionality that could be used to save money or promote efficiencies in current processes.

Draft reports containing functionality and planning for how to implement new requirements or capabilities.

New requirements are completely identified and planned.

Customer requests are fully vetted and details identified to allow management review of proposed actions.

Identify new or more efficient implementation of current capabilities that will result in cost savings to DRAS-M .

Requirements are sufficiently detailed and all material items were identified.

Review reports, requirements documentation and proposals submitted.

Task Objective Outcome/ Standard ALP Disincentive

Surveillance Method/Measure

5.0 Cyber Security Infrastructure Support

5.1 Monitor and operate software tools

designed to protect the DRAS-M Tenant and systems from denial of service, unauthorized disclosure, malware, unauthorized software, supply chain risks, email threats and modification of data.

Monitor (and manage) software tools to protect against the destruction of DRAS-M networks, network components or the information processed on them. This includes developing and maintaining engineering documentation and validation of security related virtual appliances and software.

Works with DFAS DevSecOps teams to ensure that the provided automated CI/CD pipelines support the DRAS-M ability to develop, maintained and deploy secure code, Responsible for ensuring the DRAS-M developers integrate security into the software development lifecycle, to deploy secure applications across multiple virtual networks, and implementing Zero Trust methodologies.

Detect security weaknesses and vulnerabilities and identify needed actions to correct, prevent or mitigate intrusions into DRAS-M Tenant and systems.

Comply with all Cyber Command, JFHQ DODIN & DISA reporting requirements or DoD or DRAS-M reporting requirement contained in policies.

Meeting scheduled dates for installing new and configuring hardware/software within DRAS-M Tenant and systems.

Comply with all DoD Directives and STIGs timelines for security compliance.

For 100% of identified, corrective action plan (POA&M) is reported and completed.

DFAS CSSP

reports are 100% at all times.

DRAS-M

security weaknesses not remediated within DoD and DFAS

CSSP

mandated guidelines will be listed on the contractors Risk Register.

Critical or High risk vulnerabilities on security tools not remediated within 90 days of the

DOD

mandated compliance date will be documented on the quarterly

Review CAPs and remediation timelines to determine compliance and DRAS- M risk.

Review vulnerability scans and POA&MS for compliance reporting.

The Cyber Security toolset includes but is not limited to tools that facilitate – log collection and correlation, forensics, penetration testing, asset compliance reporting, penetration testing, vulnerability scanning and endpoint security.

contract review.

5.2 Audit & Lifecycle guidance

5.2.1 Implementation Services

Perform a security review of all new virtual appliances and software being implemented as part of the DRAS-M security infrastructure.

Adhere to the DRAS-M CCB process and change management boards and processes.

Ensure all virtual appliances and software are vendor supported and remain up to date on versions and patch levels.

Perform decommissioning of systems as required per DRAS-M processes.

All security equipment is identified and put into categories as to where it is in its lifecycle.

Older equipment (virtual appliances or software) that is “end of life” has a replacement plan of action and milestones (POAM) developed. Planning and replacement must be in place to avoid EOL virtual appliances and software on DRAS-M Tenant and systems.

100% of a DRAS- M security virtual appliances and software online will be supported by the vendor.

100% of DRAS-M security virtual appliances and software will be compliant with DISA STIGs and DoD requirements, deviations will be documented with a POA&M or AOR

Implemented

DRAS-M

security hardware/sof tware that is online and non-compliant will required a CAP and will be corrected at no cost to the Government

Review of DRAS-M security infrastructure inventory.

DRAS-M CCB

5.2.2

Emerging Technology and Process Improvement.

Report on emerging technology and process improvements that

At least quarterly

Reports not received

Review of reported research findings

Research and analyze new emerging technologies that could provide savings to the Government, improve services and/or provide additional capability in performing security for DRAS-M Tenant and systems. Report on such findings on a regular basis.

could achieve the goals of reduce cost, improve service or add capabilities to DRAS-M Tenant and systems security infrastructure is submitted and demonstrates through research and analysis.

research is reported.

quarterly will be noted in the quarterly contract review process.

related to security architecture, products or services

5.3 Cyber Security Logging:

Security Infrastructure will coordinate with the DRAS-M ISSM annually to ensure mandated logging and forwarding events to the DFAS CSSP is enabled.

Quarterly ensure all virtual DRAS-M appliances, including database and network appliances have the following Access Control events as required logging:

• Successful and unsuccessful attempts to access, modify, or delete privileges

• Successful and unsuccessful logon attempts, privileged activities or other system level access,

• All administrative or system actions of privileged users (e.g., system operators, administrators, security personnel)

• Concurrent logons from different workstations, Audit records and security audit logs are captured and reviewed as necessary to investigate, analyze, and resolve violations and suspicious activity by the CSSP.

DRAS-M ISSM and DRAS-M help desk get alert notifications Access Control events.

Identify needed actions to correct, prevent or mitigate intrusions into DRAS-M Tenant and systems.

100% of all access control events are reviewed.

100% of all suspicious activity investigated.

Initiate Incident Response for 100% of cyber events, in coordination with DFAS CSSP.

DRAS-M

security alerts are not reviewed within DoD and DFAS

CSSP

mandated guidelines will be listed on the contractors Risk Register.

An incident not addressed and remediated within 90 days of the

DOD

mandated compliance date will be

Review of security incident logs, service tickets and customer reviews/complaints to determine compliance and DRAS-M risk.

Weekly review of logs by the SysAdmin supervisor documented.

• All account creations, modifications, disabling, and terminations

• Unsuccessful password change attempts

Monthly ensure Endpoint Security Software (ESS) clients are forwarding traffic to the DFAS-CSSP documented on the quarterly contract review.

5.4 Vulnerability Management Program

(VMP):

Develop and maintain a VMP Standard Operating Procedure (SOP) that documents:

• Maintain list of DRAS-M

Hardware and Software

• Coordinates with the DFAS-CSSP for Vulnerability Scanning of all DRAS-M Tenant IaaS/Containers and applications, in their entirety per DoD mandatory timelines.

• Ensure IaaS appliances have a fully DoD compliant tagging and reporting.

• Process of remediation of vulnerabilities

• DFAS CSSP Process for creating and submission of VM POA&M

• Participation in DevSecOps to Works with developers to ensure security patches are integrated into system design.

ISSM receives weekly Vulnerability Scanning Reports for all IaaS assets and recommendation of risk mitigation strategies to address any vulnerabilities.

ISSM receives consolidated Hardware and Software list on a regular schedule to validate against scan results.

Meet DFAS-CSSP timelines for processing vulnerabilities as outlined in DRAS-M policy.

100 % of all networks, Tenant, sites, devices are scanned periodically per DoD mandatory timelines.

Inability to produce scan results will require a CAP and will be documented in the quarterly contract review.

Control Failure for ATO will result in a 5% task penalty until corrected.

Review scan files documenting results of periodic scans.

SSAE-18 and external audit.

DRAS-M ACAS magic number maintained per DoD standards

5.5 Incident Response Process (IRP)

Program:

Maintain the IRP Standard Operating Procedures (SOP).

Clear, applicable rubrics and IRP templates are maintained in a compliant manner state, especially for Access violations and Intrusion events.

All documentation and controls are valid and are being performed.

Ensure IRP points of contact are validated.

Documentation is created and proper to support DRAS-M ATO certification is maintained.

SSAE-18 rating is maintained in a compliance with standards, policy and regulations.

Annual Incident Response exercise is conducted with DFAS CSSP to ensure program compliance to include DRAS-M documentation and policy reviews/updates as necessary to maintain compliance and accuracy.

Obtaining and maintaining

SSAE-18

accreditation

ATO control for the IRP is successfully met.

Work to correct documents will be completed at no additional cost to the Government.

Control Failure for ATO will result in a 5% task penalty until corrected.

Review IRP documentation and artifacts.

Ad hoc inspection

5.6 Cyber Security Infrastructure

response

Serve as central security POC for DRAS-M Tenant and application security related issues.

Receive inquires (calls or emails), from DFAS-CSSP and DRAS-M internal customers, investigate and analyze issues, route to proper resolver and monitor until closed in the ticketing system or within the security incident log. Maintain and update the security incident log with new issues and updates to existing issues.

All inquiries are processed when received to prevent DRAS-M from being negatively impacted by the security issues.

Any and all reporting requirements are compiled to the ISSM and the DFAS-CSSP.

100% of all inquiries are processed in accordance with the DRAS-M Incident Response Plan.

Failure to maintain adequate staffing levels of 1 at least analyst per shift will result in a 5% task penalty monthly until resolved and is considered a contract failure level issue.

Review of security incident logs, service tickets and customer reviews/complaints.

Interacting directly with DFAS- CSSP in the resolution of security incidents and RFI’s (red/blue reports, SIGACTs, VDP’s etc.)

Perform system, web and network, etc. analysis of possible security incidents using multiple tools, this includes assisting with external information requests or security incidents from outside of DRAS-M .

Perform vulnerability analysis in support of security analysis.

Creation and publishing of the Monthly Security Interest Report with incident and response metrics.

Develop recommendation, for the ISSM, about demonstrated security issues on how to mitigate or eliminate. Develop reports (security or risk analysis) for identified security issues.

5.8 Manage the End Point Security

System (ESS) for all DRAS-M Tenant.

Ensure all virtual endpoints are implementing the CSP end point security software (ESS) product.

Primary SME to engage CSP for resolution of systems or application

Protect the DRAS-M Tenant and systems from all security intrusions and malicious security issues and action is taken according to policy and procedures.

Work with DFAS CSSP to ensure ESS version are

100% of identified threats are processed according to DoD and DRAS- M policy and procedures.

CMRS metrics below the DoD standard of 95% for a month’s reporting will required a

CAP.

Review alerts and reports generated by the CSP’s ESS dashboard.

Monitoring the Continuous Monitoring and Risk Scoring (CMRS) system issues with the CSP’s ESS product, as required work with CSP to implement a DoD compliant solution.

Ensure ESS logs are forwarded to

DFAS-CSSP.

Configure alerts of suspicious activity are sent in real time to the DRAS-M help desk and ISSM.

Develop a dashboard solution to allow the monitoring of ESS compliance with CCRI/CCORI standards.

Investigate alerts of suspicious activity and recommend course of action to eliminate threat. Notify ISSM of all malicious events as per DRAS-M policy and update DRAS-M security incident log.

Support ISSM directed reporting in support of security incidents.

compliant and ensure DRAS-M status for ESS compliance has metrics are at or above standard (95%) in CMRS.

Actively monitor the CSP’s ESS dashboard to identify security concerns.

Eliminate threats to DRAS-M according to policy and procedure.

Ensure DRAS-M ESS produced metrics are always at or above standard (95%) in CMRS.

CMRS metrics below the DoD standard of 95% for2 consecutive month’s reporting will be documented in the contractor’s quarterly review.

CMRS metrics below the DoD standard of 95% for 3 consecutive month’s reporting will result in a 5% task penalty.

Achieving a “Partially Successful" during an inspection will require a

CAP and will be documented in the quarterly contract review.

Achieving a failure or “non-compliant” rating during and inspection will result in a 5% task penalty.

5.9 Cyber Security Log Monitoring

Coordinate, ensure and maintain all log sources related to DRAS-M Tenant and systems. This includes but is not limited to security relevant logs on DRAS-M virtual servers, workstations, network equipment, web, web application firewall, firewall, IPS, ESS, DB, etc.)

At management request, perform requested research on logs. Maintain

Detect intrusions, attempted intrusion, probing, beaconing, insider threat or other malicious activity directed towards DRAS-M and its…