PCS SOW.pdf

UNCLASSIFIED

(U) STATEMENT OF WORK (SOW)

FOR

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY (NGA)

PERMANENT CHANGE OF STATION (PCS)

SOFTWARE APPLICATION AND SUPPORT

Table of Contents

1 BACKGROUND

2 SCOPE

3 SPECIFIC REQUIREMENTS

3.1 PCS Software Application

3.2 PCS Software Application Initial Operating Capability

3.3 Maintenance and Operational Support of PCS Software Application

3.4 PCS Software Application Training

3.5 Travel

3.6 Security

3.7 Deliverables

4 Period of Performance

5 Place of Performance

1 BACKGROUND

The National Geospatial-Intelligence Agency (NGA) provides geospatial intelligence (imagery, imagery intelligence, geospatial data and information) for planning, decision-making, and action in support of national security. It represents a unified community of geospatial intelligence producers and users, leveraging expert tradecraft, regional expertise, and strength in numbers, in the delivery of multi-source, multi-intelligence data and knowledge. NGA provides timely, relevant, and accurate geospatial intelligence (GEOINT), and services to policymakers, military decision-makers, warfighters, and tailored support to civilian federal agencies and international organizations.

The Financial Management (FM) mission is to perform corporate level resource management by providing full spectrum of planning, programming, budgeting, and execution services that support the overall NGA mission. Each FM Office has specific roles and responsibilities that support the FM Mission and aligns to the goals and objectives for FM Senior Leadership.

Within FM, Financial Management Data - Systems and Business Process Solutions office

(FMDZ) supports NGA leadership in making strategic and tactical resource allocation decisions based on budget and execution data. Our mission is to deliver relevant, reliable and usable data while providing continuous financial system transformation. FMDZ is committed to providing financial business system solutions that further innovate, modernize, and automate the current business environment by expanding the use of existing Enterprise Resource Planning (ERP) systems and if necessary, new capabilities to advance the FM mission. FM duties include the agency’s Permanent Change Station (PCS) activities for employees geographically relocated to an assignment.

2 SCOPE

The NGA FMDZ requires an automated capability that will support all relocation expenses which include travel entitlement payment calculations and applicable taxes for PCS transactions in accordance with guidelines outlined in the Joint Travel Regulation (JTR). The Contractor shall deliver a comprehensive, compliant, and fully functional PCS relocation system to NGA along with data for analysis and spend transparency. At minimum, the application shall be compliant with the Federal Travel Regulation (FTR), JTR, General Service Administration

(GSA) travel rates, State Department travel rates, Internal Revenue Service (IRS) tax laws, rates and associated withholdings. The application shall create relocation authorizations by using employee questionnaire, voucher reimbursement documents, accounting expenditure data, and all associated disbursement files to ensure accuracy of the payments as well as create audit supporting documentation. The application will be installed and tested by the Government on the classified NGA network and will interface with Momentum financials. The Contractor shall maintain the application, including monthly updates of applicable rates, provide helpdesk support, and provide training as requested.

3 SPECIFIC REQUIREMENTS

The Contractor shall furnish the necessary licensing, personnel, materials, facilities and other services as may be required to perform the work set forth herein.

3.1 PCS Software Application

3.1.1 The Contractor shall provide a perpetual software license for the PCS software application to automate the computation and processing of all transactions associated with employee relocation.

The PCS software application shall provide the following capabilities:

3.1.1.1 The PCS software application shall comply with the FTR, JTR, GSA travel rates, US

State Department travel rates, IRS, and individual State tax laws, rates and associated withholdings.

3.1.1.2 The PCS software application shall be web-based with an open Application Provider

Interface (API) enabling the ability to interface with NGA accounting and finance applications.

3.1.1.3 The PCS software application shall be capable of being hosted on an internal NGA network (Classified and Unclassified).

3.1.1.4 The PCS software application shall compute PCS entitlements to include all those available on the form DD1614.

3.1.1.5 The PCS software application shall create debt vouchers, debt history, and debt collection on entitlement overpayments.

3.1.1.6 The PCS software application shall include all data fields required by IRS and other reporting entities and outputs (i.e. W2s).

3.1.1.7 The PCS software application shall compute multi-year Withholding Tax Allowance

(WTA) and expected Relocation Income Tax Allowance (RITA) associated with a PCS authorization.

3.1.1.8 The PCS software application shall track individual tax payments and provide payment history to IRS, Social Security Administration (SSA), Medicare and Federal

Insurance Contributions Act (FICA) as well as to traveler.

3.1.1.9 The PCS software application shall generate federal tax reporting information and associated documentation. The application should provide additional reporting capabilities for reconciliations of customer needs, and other data requirements.

3.1.1.10 The application shall have employee portal function where PCS candidates can review the status of their authorizations and payment on demand.

3.1.1.11 The PCS software application shall be capable of processing NGA's Line of

Accounting structure as provided in figure 1.1 below:

Fiscal Station

Number

Agency

ID

Main

ACCT

(funding code)

Treasury

Index Beginning Budgeted

Fiscal

Year

Ending Budget Fiscal Year

Budget

Line item

Budget Object

Code

Work Activity Group Account

Code (WAG)

Figure 1.1 – NGA’s Line of Accounting Structure

3.1.1.12 The PCS software application shall have the ability to generate authorizations with proper fields and incorporate profile information into the new payment order with vendor and associated entitlement information.

3.1.1.13 The PCS software application shall provide end users an option to generate DD form

1614 based on the latest form version.

3.1.1.14 The PCS software shall allow end users the option to save and/or print a PDF version of the DD 1614 form upon creation.

3.1.1.15 The PCS software application shall have the capability to process PCS vouchers that are submitted (DD1351-2) against authorizations to include modifications, edits, and changes.

3.1.1.16 The PCS software application shall export data in the database in pdf, CSV and xml formats for integration with other systems and NGA mission needs.

3.1.1.17 The PCS software application shall have the ability to generate out of the box reports on relocation data along with ability to generate custom reports based on mission needs.

3.1.1.18 The PCS software application shall be compliant with the Federal Information

Security Management Act (FISMA) and Federal Information Systems Control Audit Manual

(FISCAM).

3.1.1.19 The PCS software application shall adhere to the Privacy Act of 1974. Reports, pages, tables, and file extractions shall be accredited to Intelligence Community Directive

(ICD) 503 and meet all federal encryption and data protection standards.

3.1.1.20 The PCS software application tables, relationships, and overall model (schema) shall be open (non-proprietary) for the government to control configuration changes and access to data.

3.1.1.21 The PCS software application tables and user profiles shall be capable of being locked and unlocked by a system administrator.

3.1.1.22 The PCS software application shall be configurable to comply with Segregation of

Duties (SOD), system security and access control regulations. In addition, the application shall have the ability to detect and present erroneous conditions in a clear manner to the users. Errors in the application shall be configurable to manage different severity levels and handled through overridable or non-overridable permissions.

3.1.1.23 The PCS software application shall include an audit log that captures all the activity level details and provide output in readable format.

3.1.2 The Contractor shall provide version updates and/or configuration updates to the PCS software application.

3.1.3 The Contractor shall provide the PCS software license capable of supporting unlimited processing of new orders as well as vouchers.

3.2 PCS Software Application Initial Operating Capability

3.2.1 The Contractor shall provide the software license (electronic soft copy and 1 CD copy) with installation instructions for the initial operation of PCS software application (CDRL 0001).

3.2.2 The Contractor shall provide technical support to the Government assigned integrator to assist in successful installation of the PCS software application on the NGA network to include but not limited to:

• Accreditation Support

• System Functionality Guides and Support

• System Utilization

• Integration with required NGA Enterprise Services

3.3 Maintenance and Operational Support of PCS Software Application

3.3.1 The Contractor shall provide all hosting and Operations and Maintenance (O&M) services for the PCS software application. O&M services include, but are not limited to:

3.3.1.1 Provide software updates to the Government for installation into the application, as needed based on changes to the oversight rules and regulations.

3.3.1.2 Perform testing and provide test results, release notes for all system changes and upgrades

(CDRL 0002).

3.3.1.3 Provide monthly rate updates for JTR and FTR compliant processing of PCS transactions (CDRL 0003).

3.3.1.4 Provide rule changes and system improvements to the PCS software application, based on Government requirements or changes in law or regulations.

3.3.1.5 Provide software application manuals and documentation for end user and system administrator use (CDRL 0004).

3.3.1.6 Provide helpdesk technical support via telephone or virtual to designated technical/functional staff during business hours (8 AM to 5 PM, Monday – Friday, Eastern

Standard Time).

3.3.1.7 Generate incident tickets to track progress and completion of incidents. The

Contractor shall provide an incident report that includes the incident number, resolution timeline and applicable workarounds to avoid work stoppage (CDRL 0005).

3.3.1.8 Provide status updates on defects and other mandatory compliance changes that occur as part of sustaining the software.

3.3.1.9 Provide assistance with financial audit requests and timely respond to Prepared by

Client (PBCs), if requested.

3.3.1.10 Provide updates to the code for the DD form 1614 based on version, structure, or requirement changes of the form. The Contractor shall monitor changes on the DD1614 to ensure timely delivery and compliance. The DD1614 mapping from system to form will be documented and delivered as a design functional document as part of the monthly updates and releases.

3.4 PCS Software Application Training

3.4.1 The Contractor shall provide at least two (2) training events for the PCS software application within a period of performance (PoP) in accordance with the Government approved training plan. The training will be at an NGA facility and/or virtual in a classroom-like environment.

3.4.2 The Contractor shall provide a training plan within 30 days of contract award and the beginning of each PoP. The training plan will include a schedule and training tailored for the type of users i.e. users and system administrators, a training agenda and training materials.

(CDRL 0006).

3.5 Travel

3.5.1 All costs for travel shall be approved by the Contracting Officer Representative (COR), prior to incurring costs. Travel reimbursement will be in accordance with the FAR 31.205-46 and the JTR.

3.6 Security

3.6.1 Unclassified Work Performance Security Requirements

3.6.1.1 Uncleared Contractor personnel are authorized to work on this contract at the

Unclassified level, with access up to DoD Controlled Unclassified Information (CUI) at the

Contractor site without the requirement of a security clearance.

3.6.2 Uncleared Personnel Security Requirements

3.6.2.1 Any Contractor personnel working with CUI information must receive a favorable

HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information.

Contractor personnel who require access to CUI for 60 days or less must receive a favorable

HSPD-12 adjudication. Contractor personnel who require CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and

HSPD-12 Tier 1 background investigation for Contractor personnel as needed.

3.6.2.2 Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR.

Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.

3.6.2.3 Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

3.6.3 Physical Security Requirements

3.6.3.1 Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA

Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

3.6.4 Information Security Requirements

3.6.4.1 NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. The

Contractor shall not access, download, print, or further disseminate any unclassified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.

3.6.4.2 When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies for the proper marking, handling, processing, storing, and safeguarding of unclassified and CUI material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.

3.6.4.3 Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

3.6.4.4 NGA will assess and authorize Contractors to process unclassified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause

52.204-21 and other information system security control policies, standards, and procedures.

Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

3.6.4.5 In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.

3.6.5 Cybersecurity Requirements

3.6.5.1 The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP)

800-171, “Protecting Controlled Unclassified Information in Nonfederal Information

Systems and Organizations” requirements.

3.6.5.2 If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization

Management Program (FedRAMP) Moderate baseline

(https://www.fedramp.gov/resources/documents/)

3.6.5.3 In the event that the Contractor discovers a cyber incident that affects a covered

Contractor information system or covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

• Notify the DoD Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery

• Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support.

3.6.5.4 In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.

3.7 Deliverables

3.7.1 Deliverables shall be submitted in a format approved by the Government. Contractor defined format may be used if there is no government standard format that applies.

3.7.2 All written deliverables shall be phrased in terms and language that are easily understood by non-technical personnel (e.g., laypersons without subject matter expertise).

3.7.3 Deliverables shall be provided by the dates specified by the Government. Any changes to the delivery date shall have prior approval (in writing) by the Government.

3.7.4 If the deliverable cannot be provided within the scheduled time frame, the Contractor shall contact the Government’s COR to request a revised schedule. The request shall include a reason for the delay, the proposed revised schedule and the impact (cost and schedule) on related tasks.

3.7.5 A request for a revised schedule shall be reviewed and approved by the Government before the schedule is placed in effect.

CDRL

# Title

SOW

Reference Description Distribution Delivery Instructions

0001 Software license and a copy of the software installation

3.2 Provide software license

and instructions required for software installation

COR/TM Electronic and (1) CD, within 7 days of contract award.

0002 Test results for all

System changes and upgrades

3.3.1.2 Perform testing and provide

test results, release notes for all system changes and upgrades.

COR/TM Electronic; prior to delivery to NGA.

Frequency: As required.

0003 Monthly software updates or releases

3.3.1.3 Provide monthly updates

based of changes to JTR, FTR, GSA rates and IRS

Tax tables. Including any changes to form DD1614.

COR/TM Electronic; within 5 business days of changes or at least 15 business days prior to changes are effective.

0004 User manuals and documentation for end user and system administrator

3.3.1.5 Provide user manuals and

documentation for end user and system administrator.

COR/TM Electronic; within 30 days of contract award.

Frequency: As required – provide updates as the technical or functional configurations change.

0005 Incident reports 3.3.1.7 Contractor will provide an incident number and resolution timeline along with applicable workarounds to avoid work stoppage.

COR/TM Electronic, as required – within 12 hours of incident.

0006 Training Plan 3.4 Provide a training plan outlining training objective, agenda, activities, timelines, and learning resources tailored for the specific type of users (i.e. end users and system administrators) to be implemented for onsite or virtual training.

COR/TM Electronic, within 30 days of contract award and the beginning of each PoP.

Frequency: As required

4 Period of Performance

The period of performance for this effort is composed of a 12-month base period plus four (4)

12-month option periods.

5 Place of Performance

The work to be performed under this contract shall primarily be at the Contractor’s facility.

Onsite training may be required at the NGA Washington and NGA St. Louis. The Contractor shall coordinate with the Government Program Manager on a consistent basis regarding visitor access to the NGA Facilities.