Performance Work Statement.pdf

Source Selection Sensitive – see FAR 2.101 and 3.104

CUI//DL ONLY//F-35 Partners and FMS customers. Go to www.jsf.mil/aboutus for list of Partner and FMS customers.

F-35 JOINT PROGRAM OFFICE

DIRECTORATE OF ENTERPRISE SERVICES ACQUISITION

Foreign Liaison Office Information Technology and Cyber Security

Performance Work Statement

3 September August 2024

1.0 Introduction

The F-35 Lightning II Joint Program Office (JPO) leads the life-cycle program management of the F-35A, F-35B, and F-35C fifth-generation joint strike fighter air system of choice for the

U.S. Air Force, U.S. Navy, U.S. Marine Corps, International Partners, and Foreign Military Sales

(FMS) customers. The purpose of this effort is to obtain contractor-provided Information

Technology (IT) and Cyber Security (CS) Services for the F-35 JPO Foreign Liaison Offices

(FLO) IT network.

• The JPO ensures that the IT services shall enhance the effectiveness, efficiency, and productivity of the F-35 Program by providing the FLO representatives with a full range of IT and CS services

• The JPO ensures that the range of IT and CS services are maintained within U.S.

Department of Defense (DoD) and USCYBERCOM security standards, requirements, and mandates

1.1 Background

The F-35 JPO provides FMS FLO countries with an IT network for unclassified productivity, collaboration, and communication in support of each country’s F-35 acquisition and sustainment program. Individualized agreements with each FMS country are designed to ensure each country’s data is not disclosed to the others. Strict adherence to disclosure is mandated. The

FMS FLO IT network is configured to a standardized base network, providing routine information processing capabilities that include, but are not limited to, file creation, sharing, storage, and printing; email messaging and calendar functions; and video teleconferencing

(VTC) across secure Virtual Private Networks (VPN) connections, as well as on program-issued mobile devices. The classification of this network will be CUI, IAW the International Traffic in

Arms Regulations (ITAR).

Each FMS FLO is staffed by their respective representatives in Crystal City, VA. The network is extended to these office spaces and the remote sites at which their representatives reside.

http://www.jsf.mil/aboutus http://www.jsf.mil/aboutus https://hub.jsf.mil/sites/OCIO/win10

1.2 Scope

The scope of this contract primarily involves providing a comprehensive suite of Information

Technology (IT) and Cyber Security (CS) services and support daily office productivity, collaboration, and communication needs of up to fifty (50) FLOs. The range of IT and CS services should, at minimum, consist of program and performance management, documentation management, requirements implementation, life cycle management, IT operations and maintenance, network consolidation and cloud support, and cyber security oversight, security controls implementation and monitoring, and incident response.

2.0 Technical Objectives

The Contractor shall provide all services and support in accordance with NAVAIR and DoD standards, Contractor shall provide FLO IT and CS services to operate F-35 JPO FLO IT network.

2.1 Operations and Management (O&M) Services

O&M services will consist of properly managing the life cycle of hardware, software, and services for the F-35 JPO FMS owned and managed network and standalone workstations for day-to-day activities. Operations management is a combined effort of providing IT user support services, infrastructure management, infrastructure security management, access controls, and maintenance with the goal of providing stable and secure IT services.

The Contractor shall provide O&M on-site support for core enterprise sites at the following

CONUS locations:

CORE ENTERPRISE SITES:

Arlington, VA

Fort Worth, TX

FMS NETWORK LOCATIONS:

Arlington, VA Fort Worth, TX

The Contractor shall provide remote O&M services for all other remote sites to include CONUS and OCONUS locations.

The Contractor shall deliver Daily Systems Status Report in accordance with CDRL A001.

2.2 Connectivity and Network Services

The contractor shall provide Connectivity and Network Service Delivery Lifecycle support for the enterprise architecture at designated Government locations. Connectivity and Network services require a wide range of technical, functional, and program management services to support full engineering, design, cybersecurity, integration, installation operations, and maintenance activities of all FMS FLO IT wired, wireless, and tactical satellite communications network services and capabilities. These requirements include but are not limited to, architecture and engineering development and design, cable and fiber installation, testing, troubleshooting and management, full wide-area, metropolitan area, campus area, local area, and data center network administration, network operations, event monitoring and management, performance monitoring, capacity planning, and analysis, Internet Protocol Address Management (IPAM) and

Network Timing Protocol (NTP) systems and tools administration and maintenance, ITSM systems and tools administration and maintenance, incident response, tracking, and resolution, installation, management and support services. The contractor shall ensure compliance with current DoD standards, and security directives and guidelines.

2.3 Helpdesk Services

The Contractor shall staff and manage the FMS FLO Helpdesk, which shall be the foundation for all user services offered to FMS FLO staff. The Helpdesk shall serve as the single point of contact for all troubles, calls, technical problems, and information requests including accepting calls and coordinating ticket escalation with other service delivery teams.

The Helpdesk shall ensure that the FMS FLO users receive resolutions to their calls, emails and inquiries. The Contractor shall ensure users that have contacted the

Helpdesk are provided a response within 30 minutes either through phone call, remote management of the system, email, or through personal response.

The Contractor shall provide aggregated metrics of Helpdesk calls in accordance with the Quality Assurance Surveillance Plan (QASP). The Contractor shall ensure that any recommendations for a new, changed, or removed metric comply with the current

ITIL® best practices. The Contractor shall provide the following services:

• Incident Management – Identification, logging, categorization, prioritization, initial diagnosis, escalation, investigation and diagnosis, resolution and recovery, and incident closure

• Event Management – Instrumentation, notification, detection, filtering, significance determination, correlation, triggering, response selection, action review, and event closure

• Request Fulfillment – The channel for users to request and receive standard services for which a pre-defined approval exists. This includes selection, financial approval, F-35 JPO approval, contractor fulfillment, and request closure

• Problem Management – The reactive or proactive management, logging, categorization, prioritization, investigation and diagnosis, workaround, and resolution of problems. This includes a post-mortem review for all major problems. The Government shall determine what threshold bears the designation as a major problem

• Access Management – The process of requesting, verifying access and/or rights, monitoring identity status, logging and tracking access, and removing or restricting rights

The Contractor shall integrate service actions and status information for all contractor-supported disciplines such that the Helpdesk maintains an up-to-date status of all outstanding and pending actions for FMS FLO users. The Contractor shall provide the same level of service to all users regardless of location or travel status.

The Contractor shall automate helpdesk services to the best extent possible. The

Contractor shall provide the FMS FLO users with internal telephone extensions, in addition to a single, toll-free number.

Desktop services and associated helpdesk offerings are provided to each FMS FLO site and include service for remote workers and visitors. The Helpdesk shall be measured by Service Level Agreements (SLAs) and performance metrics, which shall provide FMS FLO networks with a common enterprise solution and be modified as required for location-specific business requirements. Helpdesk personnel shall employ well-defined and repeatable processes for problem resolution. The processes shall be published, to include timelines, in the CONOPS for Government review and acceptance. When required, Helpdesk personnel shall be able to service-disabled employees, per section 508 of the Americans with Disabilities Act.

All calls to the Helpdesk shall be logged in an automated system such as REMEDY as a service request ticket or an update to an existing ticket when the call is regarding a prior logged call. The Contractor shall use the helpdesk system to track and manage the life of each user service requirement. Access rights to trouble ticket system shall allow all F-35 IT contract services groups the ability to manage user service requirements and trouble tickets. All contractor staff assigned to a ticket shall keep the ticket updated. Users will have the ability to access and view trouble ticket within the automated system.

Helpdesk personnel shall provide total incident management service for FMS FLO end-users, from receipt to problem resolution. Helpdesk agents shall provide service for all FMS FLO hardware and software computing assets. The software supported included COTS, GOTS, and non-standard software.

The Contractor’s helpdesk staff shall execute call and service request management including telephone technical service, email and web service, service request logging and tracking, and dispatch of calls not immediately resolved. Helpdesk agents should attempt to diagnosis and resolution the problem over the telephone. The Contractor shall ensure users who call the Service Desk are provided a response within 30 minutes either through phone call, remote management of the system, email, or through personal response. Helpdesk agents will diagnose and resolve user issues within one hour. If resolution cannot be obtained, trouble tickets will be escalated to the next level of service and the user will be notified of the status.

The Contractor shall utilize tools to remotely administer and perform automated software distribution. The Contractor shall also provide remote management service.

The Contractor shall use remote management tools as an aid in increasing first call resolution at the helpdesk, reducing dispatches for desk-side service.

The Contractor shall resolve and document service tickets, to include customer notifications. The Contractor shall be responsible for providing trouble ticket status updates on all actions taken to resolve, customer status notification, and closing. The

Contractor shall establish escalation procedures between support groups to ensure smooth transition of trouble tickets.

With Government coordination, the Contractor shall provide surveys to FMS FLO users to gather and document user satisfaction levels on both qualitative and quantitative elements of their service delivery experience. The Contractor shall identify both helpdesk agent and process improvement opportunities and measure the qualitative aspects of providing helpdesk services. The Contractor shall bundle the customer survey data as part of the MSR and brief CDRL A004.

The Contractor shall provide trend reports on helpdesk call volume and performance levels as part of the MSR and brief (CDRL A004). To evaluate trends, the Contractor’s report shall show metrics for at least one year, or longer if requested by the

Government. All metrics shall be retained for the entire life of the program. The monthly submission shall include all measurable elements of the F-35 JPO standard processes. The Contractor shall provide BMC HELIX ad hoc status reports or updates on trouble tickets to support the TPOC(s) or COR within three (3) working days at the request of the government.

At a minimum, the report shall contain:

customers.

Page | 6

• Raw data for each service ticket category

• Trend data and analysis of the data for each service ticket category

• Root-cause analysis of escalated, out-of-SLA calls and abnormal spikes in metrics

• Remedies or changes recommended or executed, depending on the approving authority of the change.

The Helpdesk shall provide the FMS FLO with proactive services in the form of alerts, notices of problems, or outages affecting groups or locations upon request. The

Helpdesk shall proactively identify issues and potential problems and publish notifications and recommended solutions to such issues as they arise.

The Contractor shall monitor call activity to identify problems affecting all end-users on the network or a significant number of end-users at a single location and coordinate with the Government. When such problems are identified, the Service Desk, with

Government approval, shall proactively notify all end-users of the problem and status of the problem.

The Contractor shall ensure Common Access Card (CAC) authentication is enabled and tested on all end user equipment. All FMS FLO computers shall be CAC-enabled prior to deployment.

2.4 Touch Labor Support

The contractor shall provide customer touch labor (“desk-side”) support services for end-users and customer work center environments. Services include but are not limited to, providing in-person assistance to resolve customer issues and incidents, locally resolving system account and access management issues, and troubleshooting and resolving end-user hardware and software issues. The contractor shall tailor directory service entries, organizational mailboxes, distribution lists, etc., to meet customer requirements. The contractor shall install Government approved add-on applications to end-user devices, and support equipment installation, move, add, and change requests. The contractor shall configure, troubleshoot, and maintain end-user devices and peripherals. In support of the enterprise, contractor services may include initial troubleshooting analysis and resolution for server and storage, installing patches and performing system updates, recovering data, and installing and configuring server and storage devices.

2.5 Field Service Support

The contractor shall provide Field Service Support at designated Government locations within the Contiguous United States (CONUS) and Outside the Continental United States (OCONUS).

Services include providing general IT support across a wide range of technical services. Field service technical support includes but is not limited to, operating an entire site remotely, providing IT support services at remote field and garrison sites, performing basic cabling and server/desktop installation, performing systems administration of desktop and server systems connected to local and wide area networks, supporting VTC operations, maintaining and loading cryptographic keys, and performing troubleshooting on many types of hardware and software.

2.6 Enterprise Computing, Storage, and Cloud Services

customers.

Page | 7

The contractor shall provide Enterprise Computing, Storage, and Cloud Service Delivery

Lifecycle support for the enterprise architecture at designated Government locations. Enterprise

Computing, Storage, and Cloud services require a wide range of technical, functional, and program management services to support full engineering, the design, integration, installation operations, and maintenance activities of all FMS FLO IT, compute, storage, cloud, physical and virtual infrastructure components. Services include but are not limited to, creating, accrediting and maintaining server and workstation baselines for all supported operating systems on all networks, standardizing, deploying, and patching for all systems in operations, repairing and maintaining hardware and software, administering and managing server and storage, providing data services, data administration, and database management, providing infrastructure system services, administration, and management support for traditional systems and systems that use virtual and cloud services hosted by other agencies or external cloud service providers that provide Platform as a Service (PaaS), Software as a Service (SaaS), Infrastructure as a Service

(IaaS) capabilities; operating, maintaining, and sustaining enterprise shared applications and infrastructure services (e.g., email, SharePoint, Identity Management, Directory Services, Public

Key Infrastructure (PKI), Global Load balancing Traffic Management), providing event monitoring and management, performance monitoring, capacity planning, and analysis; and providing incident response, tracking, and resolution.

2.8 Unified Communications, Voice, Video, and Chat Services

The contractor shall provide Unified Communications, voice, video, and chat service delivery lifecycle support for the enterprise. These services require a wide range of technical, functional, and program management services to support full engineering, design, integration, installation operations, and maintenance activities of all FMS FLO IT capabilities. Services include but are not limited to, integrating real-time communications services with non-real time communication service, non-secure and secure voice installation, providing operations and maintenance services, configuring and managing automated call distribution systems, call managers, and other tools required for administration, providing incident response, tracking, and resolution, performing service operation activities such as troubleshooting, event monitoring and management, performance monitoring, capacity planning, and analysis, designing, installing and maintaining all ad-hoc and scheduling conferencing capabilities, installing, operating and maintaining all desktop video, and video teleconferencing services, and provide user Mobility Capability.

2.9 Desktop-Setup and Configuration Services

The contractor shall perform all tasks necessary to deliver a fully functioning and secure end-user client desktop computing device for each user. The contractor shall provide all IT support and security services to include the setup, installation, configuration, patching, scanning, hardening, and troubleshooting of each client device, as well as peripheral supporting devices, consisting of the following:

• Laptop (in some cases a Workstation or Thin Client)

• Video Monitor(s)

• Speakers

• Keyboard-Video-Mouse (KVM) Switchbox (as applicable)

• Network, Video, Sound, and Electrical cabling as required customers.

Page | 8

• Standing Desks (as applicable)

2.10 End-User Client Device Administration

The contractor shall manage and support day-to-day operations of the end-user client computing devices including, but not limited to, Microsoft Windows-based laptop and workstation computers, Apple mobile devices, mobile cellular hot-spot devices, networked printers, desktop and conference room VTC devices.

The Contractor shall build and maintain image of all hardware types based off the government-provided Standard Desktop Configuration (SDC), if applicable.

The contractor shall load specialized software for Microsoft Windows client computing devices, in addition to the standard installation, configuration, patching, scanning, hardening, backup and troubleshooting for all the systems connected to the network.

The contractor shall connect local peripherals, such as printers, fax machines, scanners etc., as required.

The contractor shall install drivers from a centrally managed repository.

The contractor shall provide FLO personnel appropriate user access to printers.

2.11 Asset Management

The Contractor shall follow applicable U.S., DoD, and F-35 regulations and policy for asset control and management across the FLO IT Network. All current assets and those procured shall be managed from the Total Onboard Allowance (TOA) until completion of the DoD DRMO process. Purchase Orders, shipping, and receiving documentation shall be maintained and linked to the Asset within the asset management system(s). All procured assets, to include items of lower value will be tracked within the asset and property management system.

2.12 Physical Inventory Report

The Contractor shall provide an asset and property management system generated Physical

Inventory Report every six (6) months in accordance with CDRL A002. The asset and property management system inventories should be compared and reconciled prior to reporting.

2.13 System Administration

The Contractor shall perform system administration functions on the FMS FLO IT servers, applications, and systems across all the network, as well as any standalone systems. System administration includes managing all updates to hardware and software as required for currency in the most current version of the ITIL® framework. The Contractor shall maintain an automated capability to satisfy this requirement in accordance with CS policy and Configuration

Management.

System administration shall consider all other activities required to keep enterprise services available to the user community to include, but not limited to:

• Access management customers.

Page | 9

• Configuration management

• Database management

• Patch and software update management

2.14 Software Management

The contractor shall maintain the existing database of all software and licenses inventory to include expiration dates as applicable. This database will be reviewed annually by the contractor and the government; the government can request additional reviews as deemed necessary. The contractor shall always provide a comprehensive list and provide to the government upon request.

The contractor shall update and audit the software inventory (total and assigned inventory) annually with the government; the government can request additional reviews as deemed necessary.

2.15 Information Assurance/Cybersecurity (CS) Services

The Contractor shall provide cybersecurity services to identify vulnerabilities, strengthen the cybersecurity management program, and maintain an acceptable level of risk to the F-35 JPO

FLO IT as follows:

• Continue to improve security practices and processes as DoD security guidance evolves.

• Implement and maintain approved DoD continuous monitoring and scanning capabilities.

Respond to cybersecurity tasking to protect the appropriate level of confidentiality, integrity, authenticity, non-repudiation, and availability of data and their delivery systems as outlined in DoD Instruction (DoDI) 8510.01 Risk Management Framework for DoD IT

(RMF) for the categorization of the systems. This includes properly securing and managing data that is received, displayed, processed, in transit, or stored.

2.15.1 Risk Management Framework (RMF) Management

The Contractor shall support the effort to ensure the F-35 JPO enterprise complies with the designated assigned security controls per the latest applicable DoD Assessment and

Authorization (A&A) requirement such as DoDI 8510.01 per DoD RMF Knowledge Service and

Chairman of the Joint Chiefs of Staff Instructions on Defense Information Systems Networks, NIST, Command Cyber Readiness Inspection (CCRI) 3.0 level standards, Committee on

National Security Systems (CNSS), and Support to Computer Network Defense.

The Contractor shall utilize DoD Instruction (DoDI) 8500.01 for cybersecurity for DoD policy establishment and assigned responsibilities to achieve DoD CS through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supporting the evaluation to network-centric warfare. The Contractor shall demonstrate a working knowledge of the latest NIST publications.

The Contractor shall conduct RMF per NIST Special Publication 800.37 and deliver Assessment and Authorization in accordance with CDRL A003 and A003A.

customers.

Page | 10

2.15.2 Continuous Monitoring and Scanning

The Contractor shall execute audits of all F-35 JPO FLO IT systems, subsystems, and standalones in accordance with applicable governance throughout the lifecycle of each system, subsystem, and standalone. Reports for these audits shall be submitted upon Government request. The Contractor shall accomplish the audits through the Security Technical

Implementation Guides (STIGs), Assured Compliance Assessment Solution (ACAS) vulnerability scanning, and Endpoint Security Services (ESS) monitoring. The Contractor shall track results of these audits in the Executive Dashboard and report to the Government at least monthly.

The Contractor shall ensure the following are monitored and met:

• ACAS scans shall be performed monthly; scanning will reach at minimum a 98% scan rate monthly.

• STIGs reviews shall be conducted quarterly.

• POAMs shall be developed and tracked through eMASS; updated POAMs shall be kept up-to-date weekly and uploaded to eMASS at least quarterly.

• ESS scores shall be above 95%, 90% of the time for all four (4) measured areas. In the event scores fall below those thresholds, The Contractor shall coordinate with the CSSP and JFHQ-DoDIN to improve their processes.

o CC1 Operating System STIGs Settings, both reporting and compliant o IAVM-A patches (software inventory), both reporting and compliant o IAVM-A Patches (patches benchmark), both reporting and compliant o ESS Implementation

The Contractor shall report security status of FLO IT in a dashboard that is updated weekly (75% of the time, measured monthly). The dashboard shall reflect the risk levels of the environment based on Command Cyber Readiness Inspection (CCRI) criteria and shall ensure that risks are reported across the two areas of :1) Orders, Directives, Policy; and 2) Technology Areas.

2.15.3 Incident Response and Recovery

The Contractor shall collect, monitor, and analyze Security Information and Event Management tool logs to provide threat detection and incident response following the Government’s incident response procedures.

The Contractor shall follow Government security recommendations for incident response and recovery as documented in the OCIO incident response plan.

2.15.4 Security Awareness and Training

The Contractor shall assign, collect, verify, and store proof of all user security awareness training, ensuring 95% of the F-35 JPO FLO population are always compliant with annual Cyber

Awareness Challenge training. The Contractor shall ensure current certificates are on file and retrievable 100% of the time.

2.15.5 Documentation and Reporting

The Contractor shall:

• Provide input to IT security report documentation.

customers.

Page | 11

• Continue to review and recommend updates to F-35 JPO FLO IT security policies as needed and at a minimum on an annual basis.

• Perform and document risk using approved tools (Security Impact Analysis, Risk

Assessments).

2.15.6 Compliance and Reporting

The Contractor shall, with Government approval and coordination, facilitate the authorization process, and prepare the required A&A artifacts (e.g., System Security Plan, Security

Assessment Report, Security Control Traceability Matrix [SCTM], POAM, etc.) for an authorization decision by the Authorizing Official as follows:

• Analyze the results of security scans.

• Develop a POAM.

• Make recommendations to the appropriate Authorizing Official(s).

The Contractor shall ensure the complete A&A body of evidence is centrally maintained at the

Information System Security Manager (ISSM)-approved location and updated as required.

The Contractor shall ensure each system is tracked in an automated A&A tracking system that meets the F-35 JPO A&A tracking requirements and has been approved by the CIO or designee.

Currently, DoD uses the eMASS product.

The Contractor shall assist the Government by providing all services needed to maintain 100% compliance with the DoD Information Assurance Vulnerability Management (IAVM) process listed below including:

• Establish positive control and compliance to the action required, per published vulnerability messages category level from the U.S. Cyber Command IAVM, of resolving the DoD Information Assurance Vulnerability Alerts (IAVAs), Information

Assurance Vulnerability Bulletins (IAVBs), or any vulnerabilities that may result in non-compliance with DoD requirements.

• Support with required response of acknowledgment of action messages from IAVM to start and complete resolution or mitigation of potentially critical software vulnerabilities.

• Support POAMs to track any open vulnerabilities to help identify, assess, prioritize, and monitor the progress of corrective efforts for security weaknesses found in programs and systems.

• Provide IAVA/B proven compliance process map with roles and responsibilities and required actions within the organization for IAVM process support.

2.15.7 Evidentiary Services

The Contractor shall provide services for any evidentiary requirements that arise. Services to evidentiary requirements include gathering results on any computing assets, including mobile devices, to support any investigations, inquiries, litigation, or classified material incidents. The

Contractor shall ensure all items associated with investigations are maintained with a positive chain of custody and stored in a secured area.

customers.

Page | 12

2.16 Service Summary

The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement and will be assessed on an

“Acceptable” or “Unacceptable” basis. These thresholds are critical to mission success.

2.17 Program Management

At time of contract kickoff, identify a Program Manager (PM) who shall be the primary representative responsible for all work awarded under this contract. The PM will be required to collaborate with Office of Chief Information Officer (OCIO) and other appointed Government and/or Contractors.

2.17.1 Kick-Off Meeting

The Contractor shall schedule and coordinate a Project Kick-Off Meeting that will provide an introduction between the Contractor personnel and Government personnel who shall be involved with the contract. The meeting shall provide the opportunity to discuss technical, management, and security issues, as well as travel authorization and reporting procedures. At a minimum, the individuals who shall attend include key Contractor personnel, representatives from the F-35

JPO, other key Government personnel, the PCO, CO, and COR. The Contractor shall provide a

Kick-Off Meeting Agenda and Kick-Off Meeting Presentation in accordance with CDRL A005.

2.17.2 Monthly Status Report

The Contract shall summarize deliver a Monthly Status Report (MSR) in accordance with CDRL

A004. The Contractor shall summarize, by task area, the management and technical work conducted during the month (both scheduled and unscheduled), and the current accounting information.

2.17.3 Monthly Expenditure Report

The Contractor shall provide the Monthly Expenditure Report data in spreadsheet format in accordance with CDRL A006.

2.17.4 In-Progress Review

The Contractor shall conduct an IPR in accordance with CDRL A007 to be held at the F-35 JPO in Arlington, VA. IPRs shall include the COR, TPOC, other key Government personnel, and any additional Government and Contractor representatives deemed necessary by the COR. The IPR shall provide a forum for Government review of progress, planning, and issues related to the task to include Quality, Best Practices, and Process Improvements.

2.17.5 Contract Management Plan

The Contractor shall develop and manage a project management plan to include elements such as scope, requirements, schedule, cost, quality, resources, risk, status of all projects, etc. In addition, the Contractor will consolidate projects into an overarching integrated master schedule and ensure that documents are placed under project management control in accordance with Contract

Management Plan CDRL A008.

2.17.6 Transition-In Plan

The Contractor shall submit a transition-in plan in accordance with CDRL A009 detailing how customers.

Page | 13 to transition into work. The schedule shall capture (at a minimum) the following tasks:

Timeline for onboarding of personnel (to include subcontractor personnel if applicable.)

2.17.7 Transition-Out Plan

The Contractor shall submit a Transition-Out Plan in accordance with CDRL A010 detailing transition out of contract work. The Contractor’s overall transition out strategy shall be built around maintaining the mission of the F-35 JPO with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs.

Upon termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a

Transition Out Plan, to include the minimum elements listed below:

• Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

• Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

• Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

• Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

• Operations Security Plan – The Contractor shall provide an unclassified Operations

Security Plan. The plan shall summarize (at a minimum) how the Contractor will control critical program information and sensitive data.

2.18 IT Training

The Contractor shall provide, maintain, and deliver hands-on, computer- based training to end-users on FMS FLO mission portfolio of systems, applications, and other items unique to the

FMS FLO culture in unclassified operations. This includes email, document management, timekeeping, and other relevant FMS FLO systems and shall include all standard FMS FLO applications. The training is a part of the initial on-boarding process for new FMS FLO country members, to include users at remote sites. Planning should assume training will be provided to the FMS FLO at Crystal City. The Contractor shall coordinate with the OCIO and individual

FMS FLO countries for accurate times and locations. Accommodations to provide remote initial and follow-on training will be made to ensure the entire workforce is engaged. The Contractor will be notified by the Government 10 working days prior to travel.

3.0 PERFORMANCE THRESHOLDS

Performance will be evaluated based on the following metrics:

• System uptime of 99.5% for all IT services that the contractor manages/maintains FLO.

• Response times of 1 hour for critical issues during normal working hours and 24 hours for non-critical issues or after hours for critical issues.

customers.

Page | 14

• Completion of hardware replacement or repair within 5 business days of failure detection.

• Conduct quarterly surveys with FMS FLOs to gather and document user satisfaction levels on both qualitative and quantitative elements of their service delivery experience.

• The contractor and FLOs pass all security compliance audits with no significant findings.

Should any audits have significant findings, contractor will remedy and notify the JPO appropriate parties ASAP.

4.0 DELIVERABLES/ACCEPTABLE CRITERIA

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. The following deliverables are not expected to change. Due Date intervals are not expected to change but actual dates may need to be revised depending on actual contract start date. Deliverables and performance are not considered acceptable until the Government provides written notice of acceptance. This can be in the Monthly Status Report (bi-lateral signatures from the Contractor and COR) and/or written acceptance via email.

DELIVERABLE -

Acceptance

Criteria

DUE DATE Paragraph DELIVERY METHOD

Daily Systems Status

Report 30 Days after Contract Award, Daily

2.1 By email to TPOC/COR in

PowerPoint/Contractor format

Physical Inventory

Report

Every 6mo, NLT 30 days prior to the end of contract 2.12

By email to TPOC/COR in mutually agreed upon format

RMF Assessment and

Authorization

Due 30 days after contract award, Final due 30 days after receipt of USG comments

2.15.1 By email to TPOC/COR in

PowerPoint/PDF briefing format

Project Kick-Off

Meeting & Slides

Slides: NLT 5 days after award, Meeting: 5 days after award

2.17.2 By email to TPOC/COR in

PowerPoint/PDF briefing format

Monthly Status Report NLT 30 days after award. 15th of the month 2.3

By email to TPOC/COR in mutually agreed upon format

Monthly Expenditure

Report

NLT 30 days after award, 15th of the month 2.17.3

By email to TPOC/COR in mutually agreed upon format

In-Progress Review

(IPR) Semi-annually 2.17.5

By email to TPOC/COR in

PowerPoint/PDF briefing format

Contract Management

Plan Due 30 days after contract award, Annually 2.17.5

By email to TPOC/COR in mutually agreed upon format

Transition-In Plan NLT 5 calendar days after award 2.17.6

By email to TPOC/COR in mutually agreed upon format

Transition-Out Plan NLT 90 days before end of

PoP 2.17.7

By email to TPOC/COR in mutually agreed upon format

5.0 GENERAL INFORMATION

5.1 Place of Performance

Place of performance will include on-site and remote supported locations. The primary place of performance is Arlington, VA.

Page | 15

5.2 Period of Performance

The Period of Performance (PoP) consists of 12-month base period plus (4) 12-month option periods.

5.3 Hours of Operations

The Contractor shall provide support services with the F-35 JPO’s core duty hours timeframe of

0800 and 1700. Additional hours may be necessary and will be determined on a case-by-case basis. The Contractor shall conform to the normal 40-hour work schedule. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the work force are essential.

5.4 Installation Closure

When Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents

Federal personnel from working at the Government facility, Contractor personnel assigned to work at that facility performing non-mission essential work in support of such Federal employees shall follow their parent company’s policies.

5.5 Non-Personal Services

The services and performance required under this contract are determined to be not inherently governmental. The Contractor shall not perform or give the appearance of performing inherently governmental functions as described in Federal Acquisition Regulation (FAR) Part 2 and Subpart

7.5, and all applicable DoD policy. The Government shall neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. All contract personnel shall identify themselves as contracted support personnel in all forms of communication with all entities with whom the F-35 JPO has business dealings. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (CO) immediately.

Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract by the Prime Contractor.

5.6 Business Relations

The Contractor shall successfully integrate and coordinate all activity needed to execute the requirements specified herein. The Contractor shall manage the timeliness, completeness, and quality of the contract deliverables. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of all contractor personnel (including subcontractors). The Contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contract personnel.

5.7 Contract Management

The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to this requirement. The Contractor must maintain continuity between the support operations and the Contractor's corporate offices.

Page | 16

The Contractor shall establish processes and assign appropriate resources to effectively administer this contract. The Contractor shall respond to Government requests for contractual actions in a timely fashion. The Contractor shall have a single point of contact between the

Government and Contract personnel assigned to support this contract. The Contractor shall assign work effort and shall maintain proper and accurate time keeping records of personnel assigned to work on this requirement including non-disclosure agreements.

Procurement Approvals:

Any purchased item in any quantity up to $3,500 does not require prior COR approval. Material purchases that exceed $3,500 but less than $150,000 shall require COR approval. Material purchases that exceed $150,000 per item shall have prior COR and Contracting Officer approval.

5.8 Subcontract Management

The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime Contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the CO and/or Contracting Officer’s

Representative (COR).

5.9 Contract Personnel and Continuity

An integral part of successful performance under this contract is not only the production of quality products described in Section 4.0, but also the responsiveness of contract personnel in the day-to-day output of work products. While the end-product or deliverable is vital to successful performance, day-to-day oversight also includes client interaction and responsiveness.

Accordingly, the Contractor is required to proactively maintain assigned tasks and be responsive to all entities with professional business dealings related to the assigned tasks.

The Contractor must always maintain an adequate work force for the uninterrupted performance of all tasks. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

5.10 Public Release/Non-Disclosure Agreement (NDA)

The release of all information and material related to this contract is not authorized without the review and approval of the Government. All contractor personnel are required to sign an NDA – see attached NDA form. The NDA will be due to the CO with a courtesy copy to the COR at time of post award conference and immediately upon replacement of any personnel under this contract.

5.11 Public Disclosure

The Contractor shall not disclose or provide to the public information about events and attendees of events or sessions. The Contractor shall use its own company identity for any site or posting of the event(s), if required by the government task manager, the CO, or the COR. At no time during the performance on the contract will any information be released or posted to the public customers.

Page | 17 that identifies the DoD or any of the attendees by name and or their position(s); all this information will be confidential. Note that information provided under this contract will normally be subject to the conditions of this paragraph.

5.12 Organizational Conflict of Interest

Contractor and subcontractor personnel performing work under this contract may inadvertently or intentionally receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5.

The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the

CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

5.13 Post Award Conference/Periodic Progress Meetings

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart

42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the CO will apprise the Contractor of how the Government views the Contractor's performance and the

Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

5.14 Section 508 Compliance

All Electronic and Information Technology (EIT) products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, 29

United States Code (U.S.C.) 794d, and 36 Code of Federal Regulations (CFR) 1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed, and state the degree of compliance with the applicable standards. Additionally, the contractor must clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., vendor’s website or other exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at TOA and shall inform the COR and TPOC/ATPOC of the information location.

6.0 SECURITY REQUIREMENTS

6.1 Citizenship Requirements

Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S.

citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office and COR. The waiver request should include:

• The individual's name, date and place of birth, position title, and current citizenship.

• A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the customers.

Page | 18 contractual requirements.

• A statement of the unusual expertise possessed by the applicant.

• A statement that access will be limited to a specific government contract (specify contract number).

6.2 Security Requirements DD-254, “Contract Security Classification Specification”

Attachment 1.

The Contractor shall comply with security requirements specified in the DD-254 attached to this contract a n d a n y respective TOs. Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as

Controlled Unclassified Information (CUI) (or updated un-classification designation).

Distribution is authorized to the Requiring Office’s Organization and supported Activity only.

6.3 Basic Personnel Clearance Requirements

The Contractor shall conform to the provisions of the DoD-I-5220.22, ‘National Industrial

Security Program Operations Manual (NISPOM) and shall obtain and maintain security clearances for Contractor employees requiring access to IT systems or controlled areas. The

Contractor shall comply with SECNAVINST 5510.30B and SECNAV M-5510.30 to assure that the proper investigation is conducted for Contractor personnel. Contractor personnel shall have and maintain a [SECRET] clearance based on an SSBI or SSBI-PR completed within [five (5) years] at Time of Performance (TOP) or time of hiring unless otherwise captured or as allowed via an interim clearance as stated below. The contractor shall insert this clause in all subcontracts when a subcontractor is required to have physical access to a federally controlled facility or access to a Federal information system.

• The security policies, procedures and requirements stipulated in the NISPOM and supplements thereto are applicable, to include the following security requirements and/or guidance whenever contract performance will occur on a DoD installation or within a DoD controlled facility or activity. The contractor shall possess or acquire a facility clearance equal to the highest classification.

• Full clearance levels must be acquired as soon as possible and maintained throughout the performance of the contract. Interim clearances for Contractors will be accepted for no greater than a period of up to 180 days from time of performance unless approved by the JPO ISSM and Security Manager.

6.4 Common Access Cards (CAC) / Local Badges

Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall always be visible while personnel are at the Government site. The contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to.