P1 ChatOps On-Call Support SOO - Draft.pdf

DRAFT - DSO & P1 ChatOps On-Call Support SOO 24 Mar 25

Statement of Objectives (SOO) for

Platform One DevSecOps Support and Chat Ops On-Call Support for AMC 618 AOC

1. Purpose:

1.1 The purpose of this Statement of Objectives (SOO) is to outline the requirements for Party Bus DevSecOps Support and Platform One (P1) Chat Ops on-call support for Party Bus P1 ChatOps customers to include Air Mobility Command (AMC) 618th Air Operations Center (618 AOC) Rapid Global Mobility C2 Digital Transformation (RGM C2 DT) family of applications. . This SOO outlines the requirements to provide DevSecOps capabilities to Party Bus customers including AMC RGM C2 DT family of applications both present and future, and to resolve and support Tier 2 and Tier 3 issues with our P1 ChatOps solution during normal working hours (0800-1700) and outside of normal working hours (1700- 0800) including all nights, weekends, and holidays, in support of Party Bus customers requiring global 24/7 operational support. .

2. Background:

2.1 Platform One (P1) is a Department of Defense (DoD) enterprise service organization aimed at making the DoD Enterprise Development Security and Operations Platform (DSOP) initiative a reality. This is achieved by leveraging industry best practices, utilizing open-source software like Cloud Native Computing Foundation (CNCF) software, Kubernetes, and containers, while integrating commercial solutions to enable and accelerate the adoption of Development, Security, and Operations (DevSecOps) throughout the DoD.

2.2 Party Bus (PB) is a continuous Authority to Operate (cATO)-enabled DevSecOps service for government software programs seeking rapid certification and deployment of software applications to the Department of Defense (DoD). Party Bus provides a secure, cloud-hosted, multi-tenant staging and production platform at Impact Levels (ILs) 2, 4, and 5. Party Bus also enables “Dev Low Prod High” use cases and enables production at IL-6 and above through a strategic partnership with DAF CLOUDworks. Party Bus is organized to provide the platform and accreditation support so our customers can focus on developing their application and delivering value to their end users. Utilizing our cATO system, our customers can rapidly and repeatedly push updates to their application and support their end users.

2.3 Party Bus also manages a suite of collaboration software tools for DoD-wide enterprise use. Party Bus manages the operations and maintenance of these tools in a secure, cloud- hosted environment. Collaboration tools are available to customers at ILs 2, 4, and 5. One crucial capability that Party Bus maintains is Chat Operations (“P1 Chat Ops”) software which is used for team communication and collaboration.

2.4 Platform One – Party Bus requires continuous support for its P1 Chat Ops (Currently MatterMost) Software as a Service (SaaS) tool to ensure uninterrupted communication and support for Party Bus customers.. This support is critical for both during normal working hours (0800-1700) Central Time as well as outside of normal working hours (1700-0800), including all nights, weekends and holidays. MatterMost is what is currently integrated into the Platform One Party Bus Enterprise Collaboration and DevSecOps tech stacks, which is utilized across numerous DoD organizations to enable secure and efficient software development and deployment. Party Bus customers like Air Mobility Command utilize this tool and the Rapid Global Mobility C2 Digital Transformation (RGM C2 DT) family of applications for mission critical needs and everyday operations as well. Maintaining this tool is important to Platform One, Party Bus users and AMC’s strategic airlift & air refueling missions and national security.

3. Objectives:

3.1. Perform work on Party Bus which provides a fully managed Platform as a Service (PaaS) so that DoD organizations (Party Bus customers) can quickly and iteratively develop, deploy, and deliver secure software using a secure software platform. Party Bus deploys hardened containers from Iron Bank using Big Bang configuration-as-code (CaC) to provide a secure managed DevSecOps PaaS for many different application developer teams to develop and operate cloud-hosted software. Software developed on the Party Bus platform (referred to as “mission applications” to differentiate them from the applications that comprise the platform itself) is deployed into the production environment in an automated manner via continuous integration and continuous delivery (CI/CD) pipelines that enable the rapid deployment of updates without needing to revisit the accreditation and approval process each time an update is pushed. Party Bus will maintain compliance with the DoD DevSecOps Reference Design: CNCF Kubernetes; Party Bus will also maintain the platform’s baseline Authority to Operate (ATO) for the platform itself, upon which mission applications are built and maintained.

3.2. Perform work on Party Bus PaaS leveraging Agile methodologies such as Kanban and Scrum to support and adapt the Party Bus DevSecOps tech stack across multiple security levels, ensuring backlog management, infrastructure automation, and cybersecurity enhancements to enable continuous, high-quality software deployment and efficient support for DoD product teams and Platform One objectives.

3.3. Provide on-call support for P1 Chat Ops tool in support of Party Bus’s P1 ChatOps users to include AMC RGM C2 DT family of applications regarding Tier 2 & 3 issues during normal working hours (0800-1700) Central Time and after normal working hours (1700-0800), including all nights, weekends and holidays.

3.3.1. For issues pertaining to the P1 Chat Ops software and associated plugins, including but not limited to the following: Assigning or modifying Keycloak account/group/attribute permissions for individual users, assisting the onboarding of personnel to the Chat Ops (ex MatterMost) server(s), monitoring the status and stability of the software and all software plugins, troubleshooting or restarting the software and/or plugins as necessary, and monitoring the customer’s teams/channels and ensuring smooth operation.

3.3.2. For issues pertaining to the stability and operation of the Kubernetes infrastructure pertaining to Impact Levels (IL) 2/4/5 Enterprise Collaboration and Party Bus P1 ChatOps users AMC RGM C2 DT family of applications software, including platform/AWS GovCloud/Kubernetes-layer monitoring and stability fixes.

3.4. Ensure response time to incidents does not exceed 30 minutes via a phone call confirmation.

3.5. Provide and maintain a reliable touch point via a dedicated cellular phone number for immediate incident reporting and confirmation.

3.6. Provide the customer regular updates (i.e. When root cause has been identified, time to fix issue has been determined or updated, when it has been restored, etc.) after helpdesk ticket has been received for Tier 2 or Tier 3 issues via phone call, Jira ticket entry and/or P1 ChatOps message until issue has been resolved. The contractor will update the customer for all event-based actions or current status update every hour after the initial incident received under SOO section 3.4.

3.7. Provide monthly feedback in the form of CDRL “Monthly Status Reports” (See Section 9 of

MSR).

4. Technical Requirements:

4.1. Contractors supporting Party Bus shall use Agile frameworks such as Kanban and Scrum, or others as agreed to by the Government, as needed, and shall ensure all product backlogs are properly defined and sized. The Government Value Stream Lead will provide product backlog prioritization and grooming as needed. The Contractor shall not use the Scaled Agile Framework (SAFe). The Contractor shall support an Agile environment where the level and type of work can and will change at any time as needed. Below are the requirements:

4.2. Maintain and support the Party Bus DevSecOps tech stack across multiple unclassified Impact Levels.

4.2.1. Leverage Platform One Infrastructure as Code (IaC) and Configuration as Code (CaC) (the Big Bang baseline and Party Bus-specific IaC/CaC) to operate and maintain the Party Bus environments in accordance with the DoD DevSecOps Reference Design, the Party Bus Authority to Operate (ATO) and continuous ATO (cATO), the Party Bus Concept of Operations, and further guidance as provided by Platform One as necessary.

4.2.2. Automate the deployment and operations of the Party Bus environment by leveraging technologies such as Terraform, Ansible, Helm and Kubernetes Operators and/or similar.

4.2.3. Enhance the cybersecurity and the code security process of the Platform One stack across all classified and unclassified environments.

4.2.4. Develop necessary IaC/CaC changes to allow for the automated deployment of Platform One and DSOP into Cloud One (Air Force Cloud with Azure Government and AWS GovCloud) and other commercial and Government cloud tech stacks. Where appropriate, these changes should be contributed back into Big Bang for use beyond Party Bus.

4.2.5. Utilize new and continuously hardened containers from Iron Bank.

4.2.6. Create any necessary documentation for DoD Programs’ and

Vendors’ onboarding.

4.2.7. Create and maintain accreditation documentation following DoD best practices such as the Risk Management Framework (RMF) process.

4.2.8. Create and continuously update the DoD Enterprise DevSecOps documents.

4.2.9. Continuously work with Cloud One and AF teams to improve their processes and timeliness for DoD Enterprise DevSecOps deployments.

4.2.10. Automate the creation of the above documentations as much as possible.

4.3. Onboard and support product teams across the DoD as they leverage the Party Bus DevSecOps tech stack to continuously develop and deploy code to multiple security environments.

4.3.1. Modify and develop new CI/CD pipelines to support a wide variety of software languages and software product teams.

4.3.2. Work with software development product teams to troubleshoot different aspects of Platform One’s CI/CD pipelines or other developer’s issues.

4.3.3. Continuously monitor and deploy Platform One software products into a multitude of classified and unclassified environments.

4.3.4. Support the IT operations of multiple Platform One unclassified and classified systems.

4.3.5. Create, develop, and modify documentation to support in person and virtual onboarding and support.

4.3.6. Automate the creation of the above documentations as much as possible.

4.3.7. Support the Party Bus Certificate to Field (CtF) process, including but not limited to assisting code quality scans, vulnerability assessments and other mandatory requirements preparing customer application teams to achieve their CtF.

4.3.8. Provide cybersecurity liaison assistance to 3d party assessors and internal Platform One cybersecurity team members (Shadow Collective, etc) as they monitor and test the Party Bus DevSecOps tech stack.

4.4. Develop and maintain in-house applications and enterprise collaboration tools to assist the internal Party Bus value stream and external customer experience features.

4.4.1. Develop web applications using modern software development processes, practices, and languages to deliver capability to internal Party Bus team members.

4.4.2. Develop static sites using modern web design processes, practices, and languages to support Party Bus customers.

4.4.3. Provide web development support to Platform One and other Department of the Air Force and Department of Defense customers.

4.4.4. Maintain enterprise collaboration tools, such as chatops tools (MatterMost, Slack, Microsoft Teams or other as approved by Government) and document sharing capabilities, as well as workflow management tools.

4.4.5. Develop add-ons and plug-ins, where appropriate, to enhance the enterprise collaboration tools provided to internal and external Platform One customers.

4.4.6. Support and be responsible for the administration, maintenance, upgrades, and enhancements to Atlassian JIRA, Confluence, and Jira Service Management (JSM).

4.5. Drive Platform One Agile Framework and Processes across the entire Party Bus Value Stream.

4.5.1. Integrate and provide leadership to all Party Bus sub-teams, acting as the principal and central liaison for all operational day-to-day tasks.

4.5.2. Identify, collect, and develop agile metrics to provide situational awareness and trending to government leadership

4.5.3. Create and manage epics, user stories and backlog items as they align to the Party Bus and Platform One agile sprint schedules.

4.5.4. Provide leadership to identified sub-teams on Party Bus, working with individuals as a mentor and coach identifying impediments and removing them as needed to enable greater velocity.

4.5.5. Balance workload across the assigned teams’ various multi-functional roles and ensure progress is tracked via the identified Party Bus information radiator, ultimately aligned to Party Bus Objectives and Key Results (OKRs).

5. Scope of Work:

5.1. Continuous Agile Maintenance and Enhancement of Party Bus DevSecOps Environment

5.1.1. The Contractor shall continuously maintain and enhance the Party Bus DevSecOps environment using Agile methodologies to support DoD product teams and optimize deployment, cybersecurity, and operational capabilities.

5.1.1.1. The Contractor shall leverage Platform One’s Infrastructure as Code (IaC) and Configuration as Code (CaC) to support automated deployments, maintenance, and operations of Party Bus across various unclassified environments, aligning with DoD DevSecOps standards and industry best practices.

5.1.1.2. The Contractor shall provide ongoing support to DoD product teams, including onboarding assistance, chat software technical support, and adherence to cybersecurity requirements, ensuring seamless deployment across multiple security levels.

5.1.1.3. The Contractor shall support software development efforts as, such as development of plug-ins for chat software and enhancements to Party Bus’s suite of software tools.

5.1.1.4. The Contractor shall facilitate Agile processes by managing backlogs, developing metrics for visibility, and mentoring sub-teams to enhance team velocity and alignment with Party Bus Objectives and Key Results (OKRs).

5.2. On-Call Support Coverage:

5.2.1. The contractor shall provide support for the P1 Chat Ops tool regarding Tier 2 & 3 issues during normal working hours (0800-1700) and after normal working hours (0800- 1700) Central time. Contractor will provide 24/7 support for all Tier 2 & Tier 3 support during the performance period.

5.2.2. The contractor shall implement a rotational schedule to ensure 24/7 continuous coverage that is balanced, feasible, and scalable to on-call support.

5.2.3. The contractor shall have a back-up FTE and phone number to the on-call FTE and phone number in the case that the on-call FTE does not respond within the required 30 mins response time.

5.3. Response Time and Incident Handling:

5.3.1. The contractor shall ensure that the initial response time for P1 ChatOps Tier 2 & Tier 3 incidents or support calls does not exceed 30 minutes and must be confirmed via phone call.

5.3.2. The contractor shall adhere to existing Party Bus procedures for logging and tracking incidents within our exiting Jira environments, including regular updates as new information becomes available, make incident reports viewable to end user to include response times, screen shots if necessary and any other pertinent information to the issue and provide this information in the monthly status report (CDRL A001).

5.3.3. The contractor shall coordinate with other relevant internal and external support teams if the issue extends beyond the contractor support capabilities. Examples include;

Other Platform One Value Streams, Cloud One, and 581 SWES.

5.4. Communication and Touch Point:

5.4.1. The contractor shall provide a dedicated phone number for P1 ChatOps incident reporting and initial engagement/confirmation if initial call is missed (within 30-minute window).

5.4.2. The contractor shall ensure that the phone line is staffed continuously during on-call hours.

5.4.3. The contractor shall establish protocols for call escalation and tracking, including voicemail handling and response verification.

5.5. Personnel Requirements:

5.5.1. The contractor shall hire qualified individuals based on the LCAT Descriptions in Attachment XX to support the on-call requirements.

5.5.2. The contractor shall ensure all personnel are trained and equipped to handle Platform One’s self hosted ChatOps Solution and software/SaaS support issues.

5.5.3. The contractor shall be given an Air Force email NIPR accounts and shall be used for official business and communication between end users and government.

5.5.4. The contractor shall ensure all personnel are trained and equipped to handle Kubernetes monitoring and quick-fix actions such as restarting pods.

5.5.5. The contractor shall ensure all personnel have baseline certifications meeting DoD 8570/8140.

5.5.6. The Contractor shall establish processes to provide personnel when requested by the Government within 7 calendar days, or as agreed upon by the Contracting Officer, and assign appropriate resources to effectively administer the requirement.

5.5.7. Key Performance Personnel (KPP) should be employed with the company within seven

(7) days of award and shall be retained, to the maximum extent possible, throughout this program.

5.5.8. The Contractor shall provide the Government Contracting Officer and Acquisition Manager notification no later than 14 calendar days prior to personnel leaving the effort.

5.5.9. The Contractor shall provide an overlap pairing period, of at least 14 calendar days. If 14 days is not feasible, then as agreed upon by the Contracting Officer between outbound and inbound personnel to ensure continuity and information transfer.

5.5.10. If a vacancy occurs, after the 7 calendar days have expired, no labor cost for the LCAT vacancy shall be charged to the Government until the vacancy is filled. IAW clauses 52.212-4(a) and 52.246-4, the Contractor will reduce their invoiced FFP by an equitable amount for the nonconforming vacancy; this reduction amount will be calculated utilizing the LCAT labor rate used at time of proposal submission multiplied over the length of the nonconforming vacancy.

5.5.11. The quantities listed in (Table 1: Team Composition) is the required team for this contract effort. The FTE quantities have been estimated by the U.S. Government, any significant increase in those quantities will result in a Task Order Modification.

5.5.12. Primary work will be completed remotely however the primary operating location is San Antonio, TX. Travel may be required to visit the primary location. A Travel/ODC CLIN has been incorporated into the BOA. All travel costs associated with the performance of specific orders will be reimbursed in accordance with the Joint Travel Regulations (JTR). As such, estimated allowable and allocable travel costs shall not be included in the proposed lump sum price. Costs incurred for transportation and per diem (lodging, meals and incidental expenses) will be billed in accordance with the regulatory implementation of Public Law 99-234, and FAR 31.205-46 Travel Costs.

5.5.13. The contractor shall seek approval from the Contracting Officer or his/her designee prior to traveling. The Government shall not be charged G&A fees for any travel. Costs for transportation, lodging, meals, and incidental expenses incurred by contractor personnel on official company business are allowable subject to the limitations contained in FAR 31.205-46 Travel Costs. ODCs must be purchased IAW the contractor's approved purchasing system, as applicable.

Table 1: Team Composition (Estimated)

Labor Category Level # of Total Key Performance Positions (KPP)

Required Starting

Clearance Location

Software Engineer Mid. 1 Yes Secret Eligible Continental U.S./Remote

Software Engineer Mid. 1 Yes Secret Eligible Continental U.S./Remote

Software Engineer Mid 1 Yes Secret Eligible Continental U.S./Remote

Kubernetes Engineer Mid 1 Yes Secret Eligible Continental

U.S./Remote

5.6. Surging Personnel

5.6.1. The Contractor shall have the ability to expand each team quickly to meet an increased demand for services in the event of an emergent requirement or other needs that directly aligns to a specific requirement under task order SOO. The Contractor shall have a surge capacity methodology that discusses the ability to meet an increased demand for services across security levels, not to exceed “Secret”.

5.6.2. The Government has the option to increase the of quantity of labor categories for services (IAW the pre-negotiated LCAT categories as defined in the SOO) not to exceed 50% of the labor mix per a performance period excluding any six-month extension of services pursuant to FAR 52.217-8.

5.6.3. The Contractor shall, within 7 days from the date of surge modification, furnish the Government the requested labor category personnel who meet the technical qualifications that ties directly to the addressed technical requirements called for within the SOO or in the event of an emergency operation that may include emergency 24/7 operations.

5.6.4. The Contracting Officer may modify this task order to add surge on individual LCATS or period of performance (limited/emergent). If an LCAT is required to surge past the current period of performance, the Government may request a bilateral modification to incorporate the surged LCAT into the base labor CLIN for whole task order’s period of performance.

5.6.5. When a surge is required, the Contracting Officer will provide a preliminary written notice to the Contractor stating the quantities to be added by a contract modification incorporating the requested LCATS. The notice and modification will not go above the awarded established not-to-exceed proposal price nor add any additional costs. Surge support will be provided at the same labor rates proposed and/or same pricing methodology proposed and found fair and reasonable at the time of contract/task order award. The pricing amount will utilize the same unit price found fair and reasonable at time of quote submission.

5.6.6. If the Government requires a LCAT experience level change, the Contractor will be provided a pricing template upon notification of the surge or modification request. The price template will request a cost breakdown of the LCAT change (decrease or increase) in order to determine price fair and reasonable IAW DFARS 252.217-7001.

5.6.7. The Contractor shall invoice against surge CLINs for the hours used in performance of the surge request. Contractor shall not invoice for unworked surged hours for LCATS. Only labor categories enumerated at time of contract award may be invoiced.

6. Data Rights

6.1. The Government asserts Unlimited Rights to all data produced by the Contractor in performance of this SOO. Unlimited Rights as used in this clause, means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, including by electronic means, and perform publicly and display publicly, in any manner, including by electronic means, and for any purpose whatsoever, and to have or permit others to do so. The Contractor agrees not to assert copyright in computer software produced in the performance of this contract without prior written permission of the DoD Patent Counsel assisting the contracting activity. When such permission is granted, the Patent Counsel shall specify appropriate terms, conditions, and submission requirements to assure utilization, dissemination, and commercialization of the data. The Contractor, when requested, shall promptly deliver to Patent Counsel a duly executed and approved instrument fully confirmatory of all rights to which the Government is entitled.

6.2. Unlimited Rights as used in this clause, means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, including by electronic means, and perform publicly and display publicly, in any manner, including by electronic means, and for any purpose whatsoever, and to have or permit others to do so.

6.3. The Contractor agrees not to assert copyright in computer software produced in the performance of this contract without prior written permission of the DoD Patent Counsel assisting the contracting activity. When such permission is granted, the Patent Counsel shall specify appropriate terms, conditions, and submission requirements to assure utilization, dissemination, and commercialization of the data. The Contractor, when requested, shall promptly deliver to Patent Counsel a duly executed and approved instrument fully confirmatory of all rights to which the Government is entitled.

7. Integration into Product Teams:

7.1. The contractor shall integrate P1 ChatOps on-call support staff into existing product teams to ensure familiarity with Party Bus Operations, Party bus Customers applications and AMC-specific configurations and requirements.

7.2. The contractor shall conduct regular monthly briefings and updates to keep support staff informed of any changes or new developments.

8. Metrics and Reporting:

8.1. The contractor shall track and report metrics on P1 ChatOps Tier 2 & 3 incidents to include

Mean Time to Respond (MTTR) and Mean Time to Resolve (MTTR). (CDRL A001)

8.2. The contractor shall provide monthly reports to Party Bus Leadership detailing response times, resolution times, and any incidents of non-compliance with SLAs. (CDRL A001)

8.3. The contractor shall develop and implement a process for compensating the government in case of failure to meet mission needs.

8.4. Contractor will be evaluated on their ability to fill LCAT positions and provide FTE levels under SOO section 5.5. If a vacancy occurs, no labor cost for the LCAT vacancy shall be charged to the Government until the vacancy is filled. IAW clauses 52.212-4(a) and 52.246-4, the Contractor will reduce their invoiced FFP by an equitable amount for the nonconforming vacancy; this reduction amount will be calculated utilizing the LCAT labor rate used at time of proposal submission multiplied over the length of the nonconforming vacancy. Additionally, these clauses also provide the Government the right to similarly equitably reduce the FFP for performance not conforming to the total FTE levels required for this contract.

9. Security Requirements:

9.1. Company Employee Roster (CER) Requirement:

9.1.1. The CER serves several critical functions, which align with P1 administrative, after-award security requirements. The CER is a security “required recordkeeping document” provided by the vendor Facility Security Officer (FSO) to the Contracting Officer Representative (COR) after award and during Period of Performance.

9.1.2. The CER is the vehicle HNCX/Platform One (P1) Security uses to verify and validate clearance information for all vendor contractors supporting the P1 Mission. How: The vendor contractor’s social security number is used to check Personnel Security status in the Defense Information System for Security (DISS)…which is the “standard” repository for all DoD and Industry. The CER further informs both P1 value stream leads and program managers:

9.1.2.1. The contractor is a U.S. citizen, which is required to gain access to classified information.

9.1.2.2. The level of information the contractor is cleared to access.

9.1.2.3. If the contractor has any actions against them as it relates to the 13-adjudicative Guidelines (e.g., Foreign Influence, Personal Conduct, Financial Considerations, Drug Involvement).

9.1.2.4. If the contractor has the proper security clearance and not out-of-scope.

9.1.2.4.1. If the contractor does not have the proper clearance, P1 Security can inform the COR, that the FSO must begin investigative actions (T3 or T5)…or T1 actions by the vendor and GCA; whichever is applicable

9.1.2.5. If contractor is performing on a Top Secret contract, has the Top Secret Attestation been annotated

9.1.2.6. Has the classified non-disclosure agreement been signed and date annotated in

DISS

9.1.2.7. Which contractors require SCI

9.1.2.8. Which contractors require access badges (green or red)

9.1.2.9. Which contracts are local or off-site (not in Texas)

9.1.2.10. That the vendor FSO’ are “owning” their personnel and “posting” access in DISS

9.1.2.11. Used as a source document for SCI indoctrinations

9.1.3. Deliverable: The CER is due as soon as all prime and sub-contractors supporting the effort are known. The CER is an iterative source document and is required to be updated anytime a supporting prime contractor or sub-contractor comes on or off the effort. The document must be signed by the FSO on company letterhead, sent to the COR, who will endorse, signifying concurrence.

9.2. Protection of Controlled Unclassified Information (CUI):

9.2.1. In accordance with DoD Instruction (DoDI) 5200.48, Controlled Unclassified Information, March 6, 2020, CUI is any information that law, regulation, or government wide policy requires to have safeguarding or disseminating controls.

9.2.2. Initial Training: Within 14 business days of contract start, and in-accordance-with DoDI 5200.48, paragraph 3.6.b., all contractor personnel supporting this effort will complete Initial and Annual DoD Mandatory Controlled Unclassified Information Training, at https://securityawareness.usalearning.gov/cui/index.html. Compliance is mandatory. The Contractor Facility Security Officer (CFSO) or Contractor Program Manager (CPM) will notify the COR via email or other notification as determined by the COR, when all contract personnel supporting this effort have completed the initial training requirement and provide certificates as additional proof the training has been completed. Moreover, the CFSO or CPM will ensure all new hires complete this training, and flow-down to sub-contractors.

9.2.3. Annual Training: The Contractor Facility Security Officer (CFSO) or Contractor Program Manager (CPM) will notify the COR via email or other notification as determined by the COR, when all contract personnel supporting this effort have completed the annual training requirement and provide certificates as additional proof the training has been completed to the COR. The CFSO or CPM will ensure all new hires complete this training, and flow-down to sub-contractors.

9.2.4. Before releasing any information, the contractor will submit unclassified Department of Defense (DoD) information [for public release] for review and approval to release, to their respective COR in accordance with Part 117 of Title 32, Code of Federal Regulations, and DFARS clause 252.204-7000.

9.2.5. The contractor will take steps to minimize the risk of access to CUI by unauthorized personnel, such as not reading, discussing, or leaving CUI unattended where unauthorized personnel are present.

9.2.6. The contractor shall protect CUI from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information, in-accordance-with DoDI 5200.48, para 4.1.e(1)(2).

9.2.7. At the discretion of the GCA COR or Acquisition Manager, the contractor may be required to sign/acknowledge a CUI Non-Disclosure Agreement, in-accordance-with the Information Security Oversight Office CUI Notice 2020-03.

9.2.8. The contractor will consult with the GCA, COR or Acquisition Manager before destroying CUI in paper form. The GCA, COR or AM will determine the appropriate destruction method.

9.2.9. Contractor will refer to the CUI Registry, which provides an official list of categories used to identify the various types of CUI. In addition, the Registry identifies the basis for controls and sets forth procedures for the use of CUI.

(https://www.archives.gov/cui/registry/category-list) https://securityawareness.usalearning.gov/cui/index.html https://www.archives.gov/cui/registry/category-list

9.2.10. Contractors will use the SF 901, Controlled Unclassified Information (CUI) Coversheet as a risk management strategy and shield to protect CUI from inadvertent disclosure and to alert observers that CUI is attached. (https://www.gsa.gov/reference/forms/controlled-unclassified-information-cui-coversheet-1).

9.2.11. Processing Unclassified Nonpublic DoD Information. Unless specific categories of CUI require more stringent controls, non-DoD Information Systems must be protected using the guidelines set forth in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.

9.3. Operational Security (OPSEC):

9.3.1. OPSEC is the process of denying adversaries information about friendly capabilities and intentions by identifying, controlling, and protecting indicators associated with planning and conducting military operations and other activities.

9.3.2. Contractor personnel will practice sound OPSEC to enhance protection of classified, Controlled Unclassified Information (CUI), and Critical Information (CI). The Contractor Program Manager (CPM) will be familiar with OPSEC as described in, DoD Directive 5205.02E, DoD Manual 5202.02, DoD Operations Security (OPSEC) Program Manual and AFI 10-701, Air Force Operations Security (OPSEC) Program.

9.3.3. Within 14 business days after award, the Platform One (P1) Contracting Officer Representative (COR) will provide the Contractor Program Manager (CPM) or the Company Facility Security Officer (CFSO) copies of the P1 OPSEC Obligations Memorandum (OOM), P1 OPSEC Plan and P1 Critical Information and Indicators List (CIIL), which includes critical Countermeasures that all P1 personnel, including vendor contractors and sub-contractors (if applicable) must adhere to. Within 14 business days after receipt of the OOM, OPSEC Plan and CIIL, the CPM or CFSO will ensure all contractor personnel supporting this effort have read the P1 OPSEC Plan and CIIL and will sign and return the OOM, acknowledging receipt and understanding to the COR. Should the Prime Contractor obtain/hire a sub-contractor, the prime must flow down all OPSEC requirements to their respective sub-contractor(s) and send an updated OOM acknowledging the sub-contractor(s) understanding and compliance of stated OPSEC requirements to the COR within 14 business-days.

9.3.4. All prime contractor personnel and sub-contractors (if applicable)) supporting this effort, are required to complete Initial OPSEC Training within 14 business days, post contract award. In addition, the CFSO will ensure all new hires receive/acknowledge the training and will flow-down to their respective sub-contractors (if appliable.) and return a signed completion certificate to the COR through the CFSO.

10. Deliverables:

10.1. Kick-off Meeting

10.1.1. Within one week of contract award, the contractor shall plan a kick-off meeting for the Government and team members at a location agreed upon by the Government including virtually.

https://www.gsa.gov/reference/forms/controlled-unclassified-information-cui-coversheet-1 https://www.gsa.gov/reference/forms/controlled-unclassified-information-cui-coversheet-1

10.1.2. The contractor shall introduce team members and staff, and shall present and discuss organizational structure, administrative operations pertinent to this task order, technical approaches, and preliminary plans for performing contract tasks, format of reports and quarterly reviews, and a general overview of the overall approach to execute this contract. Additionally, the contractor shall include a transition plan.

10.2. Monthly Status Report (MSR)

10.2.1. The contractor shall submit monthly status reports in accordance with CDRL A001

MONTHLY STATUS REPORT/COST SUMMARIES.

10.2.2. The MSR shall contain, but not limited to, the following and shall be in the CDRL A001 templated format:

Item

• Last Month

Planned Work Unplanned Work Incident Reports

Mean Time To Respond metrics Mean Time To Resolve metrics

• Open Issues and Resolution Status

• Help Requested with the Government

• Personnel Statusassociated expenditures o Present personnel and the specific position they are filling per Section “Team Composition” o Indicate vacancies including The date Contractor announced the incumbent personnel’s departure The date the incumbent vacated the position Any costs not charged to the government because of the vacancy Status of vacancy filling actions Current and projected rotational schedule of KPPs o Announce upcoming departures and incoming Personnel with expected dates

• CLIN Expenditure status for Travel and Other Direct Costs (ODCs) o Announce upcoming travel expectations with travel dates and number of personnel

10.3. The contractor shall provide a detailed on-call support plan, including rotational schedules and communication protocols.

10.4. The contractor shall submit monthly metrics reports on response and resolution times.

10.5. The contractor shall maintain and update the Company Employee Roster (CER) as required.

11. Travel

11.1. Travel may be required to visit primary location. A Travel/ODC CLIN has been incorporated into the BOA. All travel costs associated with the performance of specific orders will be reimbursed in accordance with the Joint Travel Regulations (JTR). As such, estimated allowable and allocable travel costs shall not be included in the proposed lump sum price. Costs incurred for transportation and per diem (lodging, meals and incidental expenses) will be billed in accordance with the regulatory implementation of Public Law 99-234, and FAR 31.205-46 Travel Costs.

11.2. The contractor shall seek approval from the Contracting Officer or his/her designee prior to traveling. The Government shall not be charged G&A fees for any travel. Costs for transportation, lodging, meals, and incidental expenses incurred by contractor personnel on official company business are allowable subject to the limitations contained in FAR 31.205-46 Travel Costs. ODCs must be purchased IAW the contractor's approved purchasing system, as applicable.

11.3. The contractor shall travel using the lowest cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the contractor shall use the economy class, or similar accommodations to the extent they are available and commensurate with the mission requirements.

12. Certifications and Agreements

12.1. Privileged User Certification: Certain Information Assurance (IA) Workforce personnel positions under this order may be designated as a Privileged User (PU) and must obtain the certifications required for their position category/specialty and level to fulfill the IA baseline certification requirement in accordance with DOD Instruction 8570. Each PU position identified on this contract will need to sign a Privileged User Agreement form, fulfill the security qualifications to get a CAC, and be IAT Level 2 certified with at least 3 years in IA technology or a related area. The Approved Baseline Certifications for Technical Level II positions are CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CND and SSCP.

12.2. Non-Disclosure Agreement (NDA): The contractor shall require all employees, prime and subcontractor, to sign a non-disclosure agreement (NDA) prior to starting work. The purpose of the NDA is to prevent disclosure of sensitive Government information the contractor may be exposed to throughout performance of this contract. Copies of signed NDAs shall be submitted to the PCO.

12.3. Associate Contractor Agreements (ACA)

12.3.1. Throughout the course of the contract, the Contractor may be required to work with, or within proximity to, other contractors within the Software Environment.

12.3.2. The Contractor shall enter into ACA with applicable third-party integrators and other stakeholder after contract award for any portion of the contract requiring joint participation in the accomplishment of the requirement. The agreements shall include the basis for sharing information, data, technical knowledge, expertise and/or resources essential to this effort, which shall ensure the greatest degree of cooperation to meet the terms of the contract. The Government will provide specific names of contractors to the Contractor.

12.3.3. ACAs shall include, but not limited to, the following general information: Party Bus – DevSecOps Support

12.3.3.1. Identify the associate contractors and their relationships.

12.3.3.2. Identify the program involved and the relevant Government contracts of the associate contractors.

12.3.3.3. Describe the associate contractor interfaces by general subject matter.

12.3.3.4. Specify the categories of information to be exchanged or support to be provided.

12.3.3.5. Include the expiration date (or event) of the ACA.

12.3.3.6. Identify potential conflicts between relevant Government contracts and the ACA;

including agreements on protection of proprietary data and restrictions on employees.

12.4. The Contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms because of a failure to resolve a disagreement with an associate contractor. Liability for the improper disclosure of any proprietary data contained in or referenced by any ACA shall rest with the parties to the ACA and not the Government. All costs associated with the ACAs are included in the negotiated cost of this contract. ACAs may be amended as required by the Government during the performance of this contract. The Contractor shall submit copies of all ACAs to the Contracting Officer.