Performance Work Statement Microsoft Services FollowOn Rev3.docx

Attachment A Performance Work Statement US Department of State

Microsoft Services

SBU - CONTRACTING AND ACQUISITIONS

Table of Contents

12SBU - CONTRACTING AND ACQUISITIONS

Performance Work Statement – Microsoft Services Follow-On 5/10/2024

1.0 INTRODUCTION

The Department of State is the United States government’s lead institution for conducting American diplomacy. All facets of the Department’s organizational structure, operations, and responsibilities are documented in the Department of State’s Foreign Affairs Manual (FAM).

The Department uses a variety of Microsoft technologies in its information technology (IT) enterprise and expects to add additional Microsoft applications over the next several years. Major applications and current initiatives include Microsoft Windows Server and Workstation Operating Systems, Microsoft Exchange for e-mail services, Microsoft SharePoint as a collaboration tool, Microsoft SQL as a database, Microsoft BizTalk server as a critical component of SMART, Microsoft Teams for Instant Messaging, and Office 365 and Azure Cloud Services as fully integrated Cloud technologies. In addition, the Department’s system for official command and control communication, SMART, is fully dependent on a complex interaction of five disparate Microsoft technologies.

The Department leverages Microsoft Corporation’s services and trained, certified (as applicable), and cleared (if required) employees to support the Department’s Microsoft suite of products. The Department of State has determined that working directly with Microsoft to produce the required products and services provides the best value to the Government in terms of cost and quality of service.

2.0 SCOPE

The Government intends to issue an Indefinite Delivery – Indefinite Quantity (IDIQ) contract to support the work defined in this Performance Work Statement (PWS). Section 4.0, General Tasks, describes the scope of work for this contract. The Government will issue task orders for the services described in Section 4.0.

The scope of this Statement of Objectives enables the Department to meet its requirements for Microsoft Unified Support and Industry Solutions Delivery Services throughout the enterprise in a timely, efficient, and secure manner. It provides a single point of accountability and coordination for the Department in the delivery of these services. The Department of State requires Microsoft Industry Solutions Delivery Services to provide recommendations and assist with Microsoft product installation and configuration, high availability, disaster recovery, performance improvement, optimization, information technology (IT) security, architecture guidance, product upgrade and conversion, development and operational recommended practices, integration with and migration to Microsoft Cloud services, user assistance on the most efficient use of the technology, and assistance as needed with the integration of Microsoft technologies with other Commercial-off-the-Shelf (COTS) products or custom developed applications such as SMART. Microsoft Unified Support is required to provide rapid response problem resolution on a 24/7/365 basis for incidents occurring at any of the Department’s facilities around the world.

3.0 OBJECTIVES

The following are the objectives of the Microsoft Services IDIQ contract:

1) Provide Microsoft Unified Support to Department of State – The contractor shall provide Base Support to the entire Department and Additive Services to all Department organizations that have contracted for it. The contractor shall meet the performance objectives and achieve the metrics agreed upon in each Task Order.

4.0 GENERAL TASKS

The contractor shall provide sufficient staff with appropriate skills, certifications, and clearances to meet the needs of the Departments as defined in the task orders and assist with the tasks described below and in the appendixes of this PWS.

The Department will issue task orders for the following tasks:

· Microsoft Unified Support for the Enterprise

· Industry Solutions Delivery services

The sub sections that follow describe the scope of these tasks.

Microsoft Unified Support services are to be provided in an efficient structure that establishes a “Base Package” of services that are common and shared by subsequent, specific, task orders to eliminate the cost incurred by duplicating common services necessary across all possible task orders.

4.1 Task 1 – Unified Support for the Microsoft Enterprise

The Contractor shall provide Microsoft Unified Support provided by Microsoft Corporation and designated technical professionals to provide rapid problem resolution 24 hours a day, 7 days a week, 365 days a year. Unified Support allows the Department to receive a direct, priority route to Microsoft technical experts at any time during the life of the Unified Support agreement. These support resources include technology experts that are dedicated and knowledgeable about various business and governmental technology environments. Unified Support professionals are able to connect the knowledge and trends across customers’ organizations to identify any systemic technology issues proactively, and work with Microsoft product developers to gain the necessary product changes (i.e., Hotfixes) as needs dictate and situations warrant. In addition, the contractor shall provide either on-site or remote as mutually agreed to Enhanced Designated Engineers (EDE) as part of this Unified Support. The contractor shall troubleshoot Microsoft product issues and provide problem reporting, tracking, and appropriate communications to users and management. Groups within the Department shall issue task orders against the IDIQ contract to receive Microsoft Unified Support services. Microsoft Unified Support shall include Base Support and if procured, Additive/Enhanced Services.

Unified Base Support, a combination of proactive, reactive, and delivery management services that support Microsoft products and/or Online Services in use within the Department, shall include the following services:

Advisory Support: Provide phone-based support on short-term (limited to six hours or less) and unplanned issues for IT Professionals. This support shall include advice, guidance, and knowledge transfer, as necessary, to help the Department deploy and implement Microsoft technologies in ways that avoid common support issues and can decrease the likelihood of system outages. With the purchase of the US Citizen add-on, advisory support for supported on-premise technologies will be provided by US Citizens.

A. Problem Resolution Support: Provide assistance for problems with specific symptoms encountered while using Microsoft products. This includes troubleshooting a specific problem, error message, or functionality that is not working as intended for Microsoft products. The Department shall be able to initiate incidents by phone or via the web. The expected response time shall be based on the severity level of an incident as perceived by the Department and are defined as Severity 1 (15-min for Azure/1-hour for all other products), Severity A (1-hour), Severity B (2-hours), and Severity C (4-hours), where severity levels are defined as:

Please see Unified Services Description for Microsoft and State Department responsibilities.

B. Reactive Support Management: Provide oversight of support incidents to drive timely resolution and a high quality of support delivery.

C. Service Delivery Management: Provide support and oversee the services relationship between Microsoft and the Department. Additionally, Service Delivery Management shall include:

a. Customer Organization Enablement: Provide guidance and information to the named Support Service Administrator about how to manage utilization of the Unified Support services and prepare the Department to use Unified digital and reactive services.

b. Microsoft Product, Service, and Security Updates Guidance: Provide information to the Department about upcoming product and service features and changes, as well as security bulletins for Microsoft technologies.

c. Program Development & Management: Support activities designed to plan, propose, and manage the Department’s support program’s services to help the Department realize greater value from investments in Microsoft technology and services.

d. Unified Enterprise Support Onboarding: Provide support with the Department’s initiation into Unified Support, including the introduction and promotion of self-service capabilities in the online support portal, with the goal of ensuring timely utilization of the Department’s Unified Support services.

e. Cloud Solution Architect Developer Advocate: Provide a development focused Microsoft support resource to deliver strategic advice and guidance to accelerate innovation and drive efficiency throughout the software development lifecycle as required in a supporting task order.

f. Executive Relationship Management: Support activities to ensure the Microsoft Support team is aligned to the Department’s strategic priorities and engaged with key business and technology decision makers.

D. On-Demand Education and Webcasts: Provide access to Microsoft’s collection of online training materials and online labs from a workshop library digital platform. In addition, provide access to live, Microsoft-hosted educational sessions, which are delivered remotely, on a wide selection of support and Microsoft technology topics.

E. On-Demand Assessments: Provide access to a self-service, online automated assessment platform that uses log analyses to analyze and assess the Department’s Microsoft technology implementation. Provide assistance with the initial set up of the On-Demand Assessments service, as necessary. This is specifically for the initial set-up only and not for results interpretation.

F. Services Hub: Provide role-based access to the services hub portal, a portal developed specifically for the Department.

G. Flex Allowance: Provide a portion of the Department’s Base Support list price in the form of credits that can be applied towards additional Proactive Services, enhanced services and solutions, Proactive Credits, or Custom Proactive Services. See Unified Support Services Description for details.

Organizations within the Department that require Unified Support will issue task orders for these services against the IDIQ contract as the need arises.

Additive Services, services that can be purchased in addition to the Base Support package, shall include the following services, and others as defined in more detail in the Unified Services Description and supporting task orders:

A. Proof of Concept: Provide evidence that enables the Department to evaluate the feasibility of proposed technical solutions. The evidence shall be provided in the form of working prototypes, documents, and designs.

B. Onboarding Services: Provide direct engagement with a Microsoft resource to provide deployment, migration, upgrade, or feature development assistance. Support shall include, as necessary, assistance with planning and validation of a proof-of-concept or production workload using Microsoft products.

C. Assessment Program: Provide an assessment of the design, technical implementation, operations, or change management of the Department’s Microsoft technologies against Microsoft recommended practices. At the conclusion of the assessment, provide a Microsoft resource to work directly with the Department to remediate possible issues and provide a report containing the technical assessment of the Department’s environment and a remediation plan, as necessary.

D. Health Check: Provide an implementation assessment review of the Department’s Microsoft technology implementation against Microsoft recommended practices. Provide a resource to plan the health check engagement, perform the review, analyze the data, and deliver a report upon completion.

E. Offline Assessment: Provide an automated assessment of the Department’s Microsoft technology implementation. The data shall be collected remotely or by a Microsoft resource on-site. Provide an analysis of the data using on-premises tools and provide a report with findings and remediation recommendations.

F. Proactive Monitoring: Provide delivery of technical operations monitoring tools and recommendations for tuning the Department’s server incident management processes. Provide assistance to create incident matrices, conduct major incident review, and to create the design for a sustained engineering team.

G. Proactive Operations Programs: Provide a review with Department staff of Department’s planning, design, implementation or operational processes against Microsoft recommended practices. This review shall be done either onsite or remotely by a Microsoft resource.

H. Risk and Health Assessment Program as a Service: Provide an automated assessment of the Department’s Microsoft technology implementation, with data collected remotely. Review and analyze the data gathered to create a findings report containing remediation recommendations. This service shall be available for on-site or remote delivery.

I. Adoption Services: Provide a suite of services that help assess the Department’s ability to modify, monitor, and optimize changes linked to the Department’s Microsoft technology purchases. This service shall include support in the development and execution of the Department’s adoption strategy around the people's side of change. The support shall include access to resources with expertise, knowledge, and associated Microsoft recommended practices in support of the Department’s adoption program.

J. Development Focused Services: Provide assistance to Department staff with the building, deploying, and supporting applications built with Microsoft technologies.

a. Services Insights for Developers: This shall include an annual assessment of the Department’s application development practices and provide recommendations for developing applications and solutions on Microsoft platforms.

b. Development Support Assistance: This shall include providing recommendations that help with creating and developing applications that integrate Microsoft technologies on the Microsoft platform, specializing in Microsoft development tools and technologies.

K. IT Services Management: Provide a suite of services that help the Department evolve its legacy IT environment using modern service management approaches that enable innovation, flexibility, quality, and operational cost improvements. The services shall be delivered through remote channels, onsite advisory sessions, or workshops, as necessary. The sessions shall help the Department ensure its monitoring, incident management, and service desk process are optimized to manage the dynamics of cloud-based services when moving an application or service to the cloud.

L. Security Services: Provide security services with a focus around four areas: cloud security and identity, mobility, enhanced information protection, and secure infrastructure. Services shall provide the Department with an understanding of how to protect and innovate its IT infrastructure, applications, and data against internal and external threats.

M. Chalk Talks: Provide interactive sessions, typically one day in duration, to cover product and support topics in a lecture and demonstration format. These sessions shall be delivered in person or online, as necessary.

N. Workshops: Provide advanced level technical training sessions on a wide selection of support and Microsoft technology topics to help the Department prevent problems, increase system availability, and create solutions based on Microsoft technologies. These sessions shall be delivered in person or online, as necessary.

O. Custom Proactive Services: Provide a scoped engagement for maintenance, optimization, or education services that are not described elsewhere in this PWS. These services shall be delivered at the Department’s direction, by Microsoft resources, and in person or online.

P. Support Technology Advisor: Provide a technology assessment supporting the Department’s business goals, to include workload optimization, adoption or supportability. This service shall include, as necessary, a plan and technical guidance tailored to the Department’s environment and business goals.

Q. Proactive Accelerator: Provide a Microsoft resource-led service comprised of a scoped set of activities to help the Department accomplish a technical or business outcome based on goals to eliminate deployment risks, increase availability, or optimize solution performance. The service shall include, as necessary, a fit gap analysis, onboarding, optimization, knowledge transfer, design validation, and implementation plan.

R. Designated Engineering: Provide curated and outcome-driven solutions that are based on Microsoft recommended practices and principles. This service shall provide deep technical guidance that help with deployment and/or optimization of the Department’s Microsoft solutions. This shall include services that span from assessment and planning, to upskilling and design, to configuration and implementation.

S. Proactive Credits: Provide credits that the Department can exchange for additional additive services that are described in the Unified Services Description.

T. Root Cause Analysis: Provide, at the explicit request of the Department prior to incident close, a structured analysis of potential causes of a single incident, or a series of related problems.

U. Reactive Support Management Add-On: At the election of the Department to purchase additional hours, provide remote reactive support.

V. Cloud Success Program: Provide planning and delivery services to help the Department achieve specific cloud outcome, accelerating the implementation, adoption, and realized value of Microsoft cloud technologies.

W. Service Delivery Management Add-On: At the election of the Department to purchase additional Service Delivery Management resources, provide additional Service Delivery Management services as part of a pre-determined scope of work.

X. Onsite Service Delivery Management: Provide onsite visits from the customer success account manager, as necessary.

Y. Enhanced Designated Engineering: Provide custom service for deep and ongoing technical engagement for complex scenarios. Provide designated engineers who are able to build a deep knowledge of the Department’s environment and support the Department with business goals, including, but not limited to, workload optimization, adoption, or supportability. The support shall focus in the following areas:

a. Helping maintain a deep knowledge of the Department’s current and future business requirements and configuration of the Department’s information technology environment to optimize performance

b. Documenting and sharing recommendations of the use of support services–related deliverables (e.g. supportability reviews, health checks, workshops, and risk-assessment programs)

c. Helping make deployment and operation activities consistent with the Department’s planned and current implementations of Microsoft technologies

d. Enhancing the Department’s IT staff’s technical and operational skills

e. Developing and implementing strategies to help prevent future incidents and increase system availability of the Department’s covered Microsoft technologies

f. Helping determine the root cause of recurring incidents and to provide recommendations to prevent further disruptions in the designated Microsoft technologies

Z. Unified Enhanced Response: Provide accelerated reactive support for the Department’s products and cloud services with faster routing for all critical situation incidents. For Severity 1 and Severity A incidents, provide Enhanced Incident Management which is available 24x7x365 and support is provided by a designated pool of resources with knowledge of the Department’s business goals and environment. Resources shall be assigned in addition to the technical resolution resources and are responsible for oversight of all critical situation support incidents to drive timely resolution and a high quality support deliver. For Severity 1 incidents, provide a post-incident review to the Department with the goal of preventing future outages and issues. The post-incident review shall provide an overview of the incident response, including successes and areas for improvement, as well as recommendations for remediation, to proactively reduce future cases and strengthen the Department’s solutions.

AA. Developer Support: Provide deeper proactive support based on cloud and product knowledge across the application development lifecycle for the Department’s developers that are building, deploying, and supporting applications on Microsoft’s platform. Provide comprehensive support to the Department for cloud architecture, vulnerability assessments, ALM/DevOps solutions, security development lifecycle, code reviews, performance and monitoring, application modernization, internet of things (IoT) implementation and management, training, and testing.

AB. Microsoft Cybersecurity Incident Response: Provide investigation and guidance to help evaluate cyber-attack scope, contain the incident, and restore critical systems, with options for onsite and/or remote support. Help reduce the risk of targeted cyber-attacks and better mitigate the damage caused by a security crisis. Microsoft Incident Response will be purchased as a separate add-on to an existing Unified Support Agreement. The scope of the MSIR engagement will be defined at the time of the incident.

AC. U.S. Citizen Program: Provide enhanced Problem Resolution Support to the Department utilizing U.S. citizens.

AD. Secured Delivery Management: Provide Service Delivery Management and Reactive Support Management via cleared/pre-approved staff across the entire support base.

4.2 Task 2 – Industry Solutions Delivery Services for Microsoft Technologies The Contractor shall provide Microsoft Industry Solutions Delivery (ISD) resources that provide assistance & guidance to optimize the use, functionality, and integration of all Microsoft technologies when tasked by Department of State under the IDIQ contract - both current and future releases to include the following:

A. Recommend and assist in securing Microsoft technologies , platforms and services using Microsoft current recommended best practices like zero trust as well as identification of threat surfaces and vectors, and provide appropriate response as required by Department of State.

B. Written guidance, assistance with, and recommendations for architecting, installing, configuring, maintaining, and integrating and securing Microsoft technologies for production systems and systems associated with the continuity of operations at Department of State, based on Microsoft recommended Industry practices.

C. Evaluation of Microsoft-related development, test, and production practices, and shall make recommendations for improvement to solutions.

D. Recommendations for and assistance with deployment of updates to Microsoft technologies,—including desktop dependencies. These recommendations shall include capacity planning and system growth as defined by Department of State, identification of risks involved with implementing the new or existing Microsoft Products, and ways to mitigate the risks.

E. Assistance with security hardening to support continuity of operations of all Microsoft technologies while meeting the security requirements of the Department.

F. Guidance on enterprise-wide IT solutions strategies to aid the Department in making long term IT investment decisions. This strategic planning service shall focus on maximizing the use and gaining benefits of leveraging Microsoft technologies and how these technologies co-exist and interoperate with non-Microsoft technologies.

G. Assess and recommend options for enhancing performance and maintenance of Department of State applications that are based in or run on Microsoft technologies. All recommendations must comply with vendor product technical specifications to retain vendor support.

H. Knowledge transfer gained through their ability to reach back to Microsoft product groups and developers. This knowledge shall be transferred through informal over-the-shoulder training, workshops, and other information resources. Microsoft Industry Solutions Delivery shall provide knowledge transfer, guidance, and assistance to the Department in developing intranet/internet strategies, prototyping, implementation, and deployment of solutions spanning across infrastructure and application areas.

I. Provide the Industry Solutions Delivery assistance & guidance services via the labor categories defined in the U.S. Federal Published Price list - Industry Solutions Delivery (ISD).

Organizations within the Department that require Microsoft Industry Solutions Deliver Assistance & Guidance will issue task orders against the IDIQ contract that include appropriate documentation to fully describe the requirements for the work, period of performance, and type of task order (firm-fixed price, time and materials, etc.).

4.3 Other Tasks

The Department may also issue tasks order for the items listed below. Alternatively, they may be included with task orders for Industry Solutions Delivery Assistance & Guidance or Unified Support.

4.3.1 Corrective Actions

Upon the request of the COR and GTM, Microsoft shall take the actions recommended by them and approved by the Department to resolve issues.

4.3.2 Code Review

Using recommended practices, Microsoft Unified shall review custom code produced by other government contractors or third-party vendors to determine maintenance required by Department of State. The contractor shall provide recommendations for modifications to the code that provide the best value and usability in the enterprise environment.

4.3.3 Operational IT Security and Compliance

Microsoft shall identify production limitations that were introduced by modifications to IT security settings and make recommendations for how Department of State can operate Microsoft products in a secure manner following Federal IT security “best practices”.

4.3.4 Configuration of Microsoft Products

Upon the request of the COR and GTM, Microsoft ISD resources (not Unified engineers) shall make modifications to Department of State Microsoft products based on the recommendations that Microsoft has made.

4.3.5 Custom Solutions and 3rd Party Integrations

Using recommended practices, Microsoft Unified shall assist with review of custom solutions and integrations involving technologies produced by other government contractors or third-party vendors to determine maintenance required by DOS based on industry recommendations. Situations may arise where further support may only be provided with the assistance of external vendor support to ensure all components are addressed appropriately in a collaborative manner for the Department.

5.0 DELIVERABLES

The contractor shall provide the deliverables defined in the task orders and described below on time and with quality that is accepted by Department of State, as applicable to services offered by Unified and/or ISD.

A. Written Recommendations - A Microsoft Project Manager or a Microsoft resource approved by the COR shall provide written recommendations on architecture, design, and implementation/deployment, risk mitigation, and technology integration based upon information and requirements collected. These recommendations shall be provided as needed for each task order and may be revised during the course of the task order as requirements are added, changed, or removed. The format of these recommendations will depend on the required effort and will be agreed upon by Microsoft and the COR and GTM prior to start of task. These recommendations will be reviewed by the COR and GTM, and if accepted, the contractor shall deliver an implementation plan, which must include step-by-step directions for the implementation and schedule.

B. Problem Resolution - The Unified and ISD resources shall provide an assessment of the problem and a course of action to analyze and resolve the problem. The assessment and course of action must be approved by the government prior to beginning resolution as defined in the task orders. The Government understands that changes made to underlying cloud platform services may not have prior notice.

C. Reporting - The Contractor shall develop and provide a timely and accurate Monthly Status Report to the COR (for each task) no later than the third (10th.) business day of every month.

A report on EACH task order shall include:

A. Department of State Task Order COR B. Work Completed (with key milestones, decisions and accomplishments) C. Performance Summary (Resource, Activity Name, Actual Hours, Completed (Y/N), Estimated Hours, Comments [as appropriate]) D. Status Summary E. Total Hours for Current Report by CLIN F. Total Hours to POP Date by CLIN G. Total financial spend for current report by CLIN H. Total financial spend to POP date by CLIN I. Projected financial spend to end of POP (noting shortfall if any) J. Current staffing list with Position, Key (Y/N), CLIN, Office and any Status/notes K. Performance Metrics Status Reporting L. Changes to Contract Requirements M. Contract Risk/Issue Register N. COR Action Items

The Contractor shall provide project schedules, updates to project schedules, and resource requirements in a mutually agreeable format to the Department of State COR and GTM as requested. The dates of the project tasks will be coordinated with and agreed to by the Department of State COR and GTM.

Additional written reports may be required and negotiated.

5.1 Deliverable Standards

All deliverables shall be defined and delivered as defined in the task order and no later than the date specified in the Task Order, unless otherwise specified.

A. Deliverables are to be transmitted with a cover letter addressed to the COR and GTM, on the prime contractor’s letterhead, describing the contents and identifying task order number and title.

B. All documentation shall be submitted in latest release of MS-Office draft form for comment to the COR and GTM.

C. The Contractor shall incorporate into the final deliverable documentation any comments received on the draft documentation within 3 business days of receipt from the COR and GTM.

D. The COR and GTM shall review all draft documents submitted as part of contract deliverables for conformity to the standards referenced in the PWS. Any changes required after the first revision cycle shall be completed at no additional cost to the Government. The first revision cycle for a deliverable shall be acceptable to the Government when the Contractor submits a revised deliverable incorporating any comments and suggestions made by the COR and GTM on his review of the initial draft.

E. The government will provide written notification of acceptance or rejection within 30 days of receipt of deliverables. All notifications of rejection will be accompanied by specific justification or substantiation of the reasons for rejection.

6.0 PROVISIONS THAT APPLY TO ALL DELIVERABLES

6.1 Reporting Requirements

All reporting requirements shall be defined in the task order and delivered no later than the date specified in the Task Order, unless otherwise specified.

In addition to meeting the delivery schedule in the timely submission of any draft and final reports, summaries, data, and documents created in the performance of this contract, the contractor shall comply with the directions of Department of State regarding the contents of the report, summaries, data and related documents to include correcting, deleting, editing, revising, modify, formatting, and supplementing any of the information contained therein at no additional cost to the Department. Performance under the contract will not be deemed accepted or completed until the Department’s directions are complied with. The reports, summaries, data and related documents will be considered draft until approved by Department of State. The contractor agrees that the direction, determinations, and decisions on approval or disapproval of reports, summaries, data and related documents created under this contract remains solely within the discretion of Department of State.

6.2 Publication of Results

Prior to any dissemination, display, publication or release of articles, reports, summaries, data or related documents developed under the contract, the contractor shall submit for review and approval by the Department of State the proposed articles, reports, summaries, data and related documents that they intend to release, disseminate or publish to other persons, the public or any other entities. the contractor shall not release, disseminate, display or publish articles, reports, summaries, data, and related documents or the contents therein that have not been reviewed and approved by the Department of State for release, display, dissemination or publication. The contractor agrees to conspicuously place any disclaimers, markings or notices directed by the Department of State on any articles, reports, summaries, data and related documents that the contractor intends to release, display, disseminate or publish to other persons, the public or any other entities. the contractor agrees and grants a royalty free, nonexclusive, irrevocable world-wide license to the government to use, reproduce, modify, distribute, prepare derivative works, release, display or disclose the articles, reports, summaries, data and related documents developed under the contract, for any governmental purpose and to have or authorize others to do so.

6.3 Identification/Marking of Sensitive and Classified Information The Department will have exclusive authority to determine which information constitutes Sensitive or Classified information. The Department of State requires that all personnel with access to classified processing sites shall complete a Department of Defense Form 254 - Contract Security Classification Specification. In performing the contract, the contractor shall clearly mark the classification on any reports, documents, designs, data, materials and written information as directed by Department of State. The contractor will ensure that Sensitive and Classified information is handled appropriately, maintained and protected from unauthorized disclosure. Classified material received or generated in the performance of this contract shall be safeguarded and disposed of in accordance with the National Industrial Security Program Operating Manual (DOD 5220.22-M). Any unclassified information related to the national defense or foreign relations of the United States, to include bits and pieces that taken together would be even more revealing, that could be useful to an adversary, should be considered SBU information. The contractor shall follow commercial practices to protect its sensitive systems.

6.4 Additional Security Considerations

The Government reserves the right to add, delete and or modify the security requirements as necessary or as directed by the Bureau of Diplomatic Security (DS) or other U.S. Government security agencies.

All contractor personnel that require access to classified material or access to areas requiring security clearances shall possess a Top-Secret, Top-Secret with SCI, or Secret personnel security clearance in accordance with the requirements of task orders issued under the IDIQ contract, issued by the Defense Counterintelligence and Security Agency (DCSA) prior to contract performance. Individual clearances shall be maintained for the duration of employment under this contract, or until access requirements change. This clearance information shall be provided and approved prior to the start of the contract and annually thereafter and will be verified by the COR before each visit to a Post.

In addition, the contractor shall adhere to the following security provisions:

1. Country Clearance – Every visit to a foreign country by individuals acting on behalf of or under government contract shall abide by existing practices of obtaining official “Country Clearance.” All contractor personnel travelling abroad shall have a country clearance granted by the specific Chief of Mission of the embassy of the United States via a process initiated by IRM or the sponsoring with travel itinerary information provided by the contractor.

2. Privacy Act – Contractor personnel will view data that is subject to the Privacy Act of 1974; therefore, all contractor personnel assigned to this task shall be required to take appropriate action to prevent disclosure of this information.

3. General/Miscellaneous – Department of State will provide contractor personnel official Department of State badges as required. Badges are the property of the Government and shall be returned upon termination of employment or the end of the contract.

4. Facility Clearance – A facility clearance at the Top-Secret level is required for contract performance in accordance with the DD Form 254 - Contract Security Classification Specification.

5. Safeguarding Information – The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. They shall not communicate to any person any information known to them by reason of their performance of services under this contract which has not been made public, except in the necessary performance of their duties or upon written authorization of the Contracting Officer. All documents and records (including photographs) generated during the performance of work under this contract shall be for the sole use of and become the exclusive property of the U.S. Government. Furthermore, no article, book, pamphlet, recording, broadcast, speech, television appearance, film or photograph concerning any aspect of work performed under this contract shall be published or disseminated through any media without the prior written authorization of the Contracting Officer. These obligations do not cease upon the expiration or termination of this contract.

6.5 Remedies

In addition to any civil, criminal and contractual remedies available under the applicable laws and regulations, failure to comply with the above provisions and/or Department of State directions may result in suspension, withholding, or offsetting of any payments invoiced or claimed by the contractor.

6.6 Hours of Work

All hours of work requirements shall be defined in the task order, unless otherwise specified.

The Contractor shall support services coverage between the normal core hours of 7:30 AM – 4:15 PM, Eastern Standard Time, for the site Monday through Friday, except Federal holidays or when the Government facility is closed. Access to the Department of State facilities will be provided by the Department of State as required during non-business hours. The Department of State estimates that some work may be required during evenings, weekends, and holidays.

To the greatest extent possible, the contractor shall be notified 48 hours in advance of planned evening and weekend work and holidays; however, the critical nature of the work may require emergency overtime and/or extended work hours. The GTM and COR may authorize contractors to work offsite to support tasks or to resolve problems. Written notification of contractor planned evening, weekend or holiday hours must be made 48 hours in advance to the COR. During an emergency, hours must be recorded and reported the next business day for COR approval. The contractor shall only charge the Government for Productive Direct Labor Hours and are defined as those hours expended by the Contractor personnel in performing work under Task Orders. Furthermore, the contractor will seek prior approval from the GTM and COR for any work that would bill for more than 9 hours per workday or over 40 hours per work week.

6.7 Special Personnel Requirements

The contractor shall provide contact information (e.g., telephone numbers) for their Project Managers and Customer Success Account Managers (CSAM) in case they need to be contacted outside of normal duty hours. These personnel will be expected to respond to all inquiries, both during and outside of normal duty hours, within 12 hours.

6.8 Personnel Qualifications

The contractor shall provide resources with extensive experience and knowledge with configuration and performance issues on production systems appropriate to the tasks identified in this PWS. Personnel shall be Microsoft employees, not subcontractors. Personnel shall have an in-depth knowledge of the skills necessary to perform the tasks of the role assigned to them in the task order, which may include but not be limited to all supported versions of Windows Server and Client Operating Systems, Microsoft SharePoint, Microsoft Active Directory and ADFS, Internet Information Server (IIS), Microsoft BizTalk, Microsoft SQL Server, Microsoft Exchange Server, Azure Cloud Services, Office 365, and other Microsoft technologies as required. This shall include all current and future releases of the Microsoft based software. Microsoft resources shall possess Microsoft Certification(s) in their area of expertise as applicable.

6.9 Government Furnished Property/Information

The Government will furnish workspace and other appropriate furnishings, computer hardware and software, telephones and other material necessary to complete this contract. All computer resources in use at the U.S. Government facility will be Government furnished. Any Government furnished materials, data, or property shall remain the property of the Government and will be returned to the COR upon completion of the support services. Government furnished equipment shall be tracked through applicable procedures that will be provided by the Contracting Officer in accordance with the Federal Acquisition Regulation (FAR).

6.10 Government Provided Space

Logistics planning and provisioning of suitable facilities for the duration of the contract will be carried out by the Department of State. This includes the identification and scheduling of conference room(s) with sufficient space, connectivity, and audio-visual equipment and the provisioning of white-boarding facilities, as needed, as well as the provisioning of a suitable working space as permitted by the Department of State.

6.11 Travel

All travel shall be pre-approved, by the COR, prior to travel. The Government will not pay for mileage, parking, or public transportation cost in performance of this contract when the Contractor is traveling between Government facilities and vendor facilities. Such transportation cost will not be reimbursed in an amount greater than the cost of, and time required for, coach class scheduled air or ground travel by the most expeditious route, unless coach air or ground travel is not available. Travel costs subject to reimbursement are limited to travel occurring at the direction of the Government, performed in conjunction with a specific requirement for a trip authorized in performance of the order. All travel itineraries must be approved by GTM and COR. The contractor shall be reimbursed for non-local travel to provide support at a Government site or other site as may be specified and approved by the COR under this effort. Local travel is not subject to reimbursement. The contractor shall adhere to the Joint Travel Regulations when travelling on Government business.

6.12 Quality Assurance and Surveillance

Within 30 days of task order awards, the contractor shall provide a Quality Assurance Plan (QAP) that defines and describes the contractor’s methods and controls to assure meeting mandatory provisions of the contract, meet schedules, deliverables, and minimize errors, rework, and missed deadlines. The contractor must control the quality of the services and deliverables provided in support of this task and must maintain substantiating evidence that services conform to contract quality requirements and commonly accepted commercial practices and furnish such information to the government if requested. The government will develop a Quality Assurance Surveillance Plan (QASP) that will define how surveillance will be performed. Each task order QAP and QASP will define a set of methods and controls to assure meeting provisions both common and unique to the specific task order.

The QAP shall include the following details:

1. Acceptable quality levels

2. Delivery schedules

3. Adherence to schedules, work functions, and deliverables as detailed in plans provided to and approved by the government subsequent to award

4. Adherence to appropriate safety codes and procedures

5. Adherence to industry recognized levels of quality workmanship and craft practices

6. Equipment Trend Analysis

7. Resolution of high failure rates of equipment

8. Quality Control Matrix (see sample below)

QAP will become the basis of a Quality Assurance Surveillance Plan (QASP) and will be finalized between Gov’t and Contractor 60 days after contract award.

The Quality Assurance Surveillance Plan serves as the principal basis for assessing overall performance quality associated with the Task Orders. This document shall be designed to define the roles and responsibilities, identify the performance objectives, define the methodologies used to monitor and evaluate the contractor’s performance, describe quality assurance reporting, and describe the analysis of quality assurance monitoring results.

The Quality Assurance Surveillance Plan shall set forth the staffing and procedures for self-inspecting the performance requirements in the PWS. The plan will be developed and implemented as a performance management system with processes to assess and report their performance to the COR and GTM.

The COR and GTM will monitor performance and review performance to determine Microsoft is performing satisfactorily against communicated performance objectives. The government reserves the right to perform inspections on services provided to the extent deemed necessary to protect the government’s interests. Microsoft shall bring problems affecting performance to the attention of the COR and Contracting Officer as soon as possible. The COR and GTM will make decisions based on performance measures and notify the Microsoft Project Manager or CSAM of those decisions. Microsoft will be responsible for making required changes in process and practices to ensure performance is managed effectively.

Surveillance of the Contractor performance shall be in methods such as: Monthly Checks, Observations, Inspections, Complaints and Review of documents by the Government to determine whether the contractor is effectively and efficiently complying with all terms and conditions that are required to be maintained and delivered under this PWS.

The COR and GTM shall coordinate and communicate with the Microsoft Project Manager or CSAM to resolve issues and concerns of marginal or unacceptable performance. Microsoft shall adjust service accordingly to bring performance up to an acceptable level.

Sample Quality Control Matrix

Acceptance