Performance Work Statement (PWS) for SS - 3-28-24.docx

PERFORMANCE WORK STATEMENT

A procurement by the U.S. General Services Administration, Assisted Acquisition Services (AAS) Innovation on behalf of

CLIENT AGENCY:

Office of the Under Secretary of Defense (OUSD) for Research and Engineering (R&E)

CLIENT PROGRAM:

Defense Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) Program

PROJECT TITLE:

Cloud and Cybersecurity Architecture Support Services for the Defense SBIR/STTR Program

PROJECT NUMBER: 47QFLA24K0007

Original Version Dated:

25 March 2024

Post Award Document Revision History

Revision Number

PWS Non-SBIR Contract/Order v1.0

Contents

1 INTRODUCTION

1.1 Organization

The Office of the Under Secretary of Defense (OUSD) for Research and Engineering (R&E) Defense Small Business Innovation Research/Small Business Technology Transfer (SBIR/STTR) Program Office is responsible for implementation of the statutory authorities outlined in 15 USC § 638 and policy requirements outlined in the Small Business Administration’s (SBA) SBIR/STTR Policy Directive for the programs. The SBIR/STTR programs are major drivers of innovation and economic growth and are critical in the Department of Defense’s (DoD) effort to outpace the threat of our adversaries, to develop a culture of innovation, and to accelerate the advancement of our war fighting capability.

1.2 Objective

The objective of this contract is to provide subject matter expertise (SME) in the areas of cloud migration, cybersecurity architecture and engineering specific to the post-migration of the Defense SBIR/STTR Information Portal (DSIP) from its previous host at the Defense Technology Information Center (DTIC) to the current host United States Air Force’s (USAF) Cloud One. Support will be required to continually improve management efficiency, DSIP performance, and the user experience for internal DoD users and small businesses. In support of migration sustainment and sufficiency, a new service in the cloud will be implemented to modernize existing manual processes that support the critical due diligence investigations. This service will be the SBIR/STTR Counterintelligence Database (SCD).

1.3 Scope

The scope of this contract is limited to the level of effort required to deliver continued cybersecurity support and system authorization services in support DSIP within its cloud hosted environment, AF Cloud One, Amazon Web Services (AWS) Impact Level 4 (IL4). This includes support to the development, security, and operations (DevSecOps) Pipeline to continuously deliver secure DSIP Modules developed in AWS Impact Level 2 (IL2) by the DSIP applications development and delivery team, REI Systems, Inc., to AWS IL4. Support includes cybersecurity architecture and engineering design; continued new technology and application integration; policy documentation; and process improvements. Services required include:

· SME support to sustain the System Authorization and Cybersecurity of applications and services operated in support of the Defense SBIR/STTR Program.

· DSIP hosted in USAF Cloud One AWS

· SCD hosted on Naval LIFT Secret Internet Protocol Router Network (SIPRNet) Software as a Service (SaaS)

· USAF Office of Commercial & Economic Development (OCEA) commercial services

· Coordination of Defense SBIR/STTR Program efforts with USAF Cloud One; Naval LIFT, USAF OCEA.

· Design/development/delivery/management of Defensive Cyberspace Operations (in partnership with USAF managed services; Naval LIFT’s High Performance Computing Center).

· Continued delivery, management, and support for integrated HOCKEYPUK™ Cybersecurity Solutions which integrates National Information Assurance Partnership (NIAP) certified hardware virtual private network (VPN) solutions with zero clients and a zero-trust cloud native access point to force all application development and delivery to occur in the cloud, from the cloud.

· Continued implementation, technology refresh, and support for HOCKEYPUK™ Cybersecurity Solutions from end users/developers to AWS IL2 & IL4, DSIP’s hosting environment.

· Continuous Authority to Operation (ATO)/Risk Management Framework (RMF) documentation development, delivery and coordination (IATT) to ATO support) including creation and delivery of necessary artifacts to support all Defense SBIR/STTR Program System Authorizations in accordance with Department of Defense Instruction (DoDI) 8510.01 (DoD Risk Management Framework). This includes coordination and adoption of inherited security controls offered from the Program’s systems hosting environments (USAF Cloud One AWS, Naval LIFT’s SaaS, etc.)

· Alignment of DoD cloud cybersecurity architecture and engineering requirements.

· Collaborate with cross functional teams and stakeholders to understand their requirements, analyze workflows, and design efficient solutions using cloud hosted and on-prem unclassified and classified hosting environments and service offerings.

· Support secure and operational configuration of software used by Defense SBIR/STTR Program, such as Atlassian’s Confluence and JIRA (services supporting SCD).

· Continued support to the Defense SBIR/STTR Program’s Authorizing Official.

· Process and Procedure development, user training, and support to end users.

1.4 Reserved

1.5 Applicable Documents

The documents (i.e., certifications, specifications, standards, policies, and procedures), versions current at time of contract award, identified in the list below are incorporated with the same force and effect as if provided in full text. Succeeding revisions may be substituted or incorporated as required with full notice and disclosure to the contractor. The Government will provide access to available documents and technical information as required and upon contractor request, if not available via a hyperlink within this PWS.

· OUSD S&T DSIP System Authorization

· DoD Cybersecurity Reference Architecture

· DoDI 8510.01 (DoD Risk Management Framework)

· USAF Continuous ATO processes

· Defensive Cyberspace Operations (DoDI 8530)

· DoD CIO Digital & Software Modernization Strategies

1.6 Reserved

2 REQUIREMENTS AND TASKS

2.1 General Performance Requirements

2.1.1 Resources

Unless otherwise stipulated, the contractor shall furnish or provide all personnel, personnel management and supervision, all related internal supporting business functions (including background and “overhead” personnel), materials, supplies, equipment, and facilities to perform the full range of services required by this PWS.

2.1.2 General Communication

Regular and direct contractor interface with the Contracting Officer (CO); the Contracting Officer’s Representative (COR), and other identified Government representatives is mandatory. The contractor shall not contact nor take direction from unauthorized Government representatives, under any circumstances.

2.1.3 Identification

All contractor personnel shall be required to wear Government-approved or provided picture identification badges so as to distinguish themselves from Government employees when working at the Government site. Additionally, the contractor shall comply with all visitor identification requirements when visiting the Government site. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, contractors occupying collocated space with the Government should identify their workspace area with their name and company affiliation.

2.1.4 Business Relations

A primary element of project success is the business relationship between the contractor and Government representatives. Within this context the Government will monitor the contractor’s contribution to business relations and provide feedback when required. The contractor shall make every effort to establish and maintain clear and constant communication channels with the Government primaries (CO, COR, and other identified Government representatives) of the contract for the purpose of:

· Promptly identifying PWS and/or business relationship issues of controversy and the bilateral development and implementation of corrective action plans.

· Ensuring the professional and ethical behavior of contractor personnel.

· Maintaining effective and responsive subcontractor management (if applicable).

· Ensuring the contractor support team is fully aware and engaged in strengthening the interdependency that exists between the contractors and their government counterparts.

· Facilitating contractor–Government collaboration for continuous improvement in performing PWS tasks, reducing risks and costs, and meeting the mission needs.

2.1.5 Contractor Response

The contractor shall ensure prompt response to Government inquiries, requests for information or requests for contractual actions. The response shall be provided within the number of business days of the inquiry/request specified by the CO, COR, and other identified Government representatives.

2.1.6 Professional Appearance

Contractor personnel shall present a neat and professional appearance appropriate to the work being performed at all times when interacting with Government representatives, working in Government facilities, or representing the Government at meetings or before third parties.

2.1.7 Collaboration

The contractor shall utilize the Collaboration tool (to include all applicable collaboration types) within the GSA’s web-based procurement system (i.e., Assisted Services Shared Information System (ASSIST)) for submission of all documentation as required under the awarded contract. Data that requires Impact Level (IL4) shall not be submitted via ASSIST and submission shall be coordinated with the client Technical Point of Contact (TPOC), GSA COR and other identified Government representatives as applicable.

2.2 General Meeting Requirements

The contractor shall participate in the following meetings. Nothing discussed in any meetings or discussions between the Government and the contractor shall be construed as adding, deleting, or modifying the contractual agreement without written authorization from the CO.

2.2.1 Initial Business/Kickoff Meeting

Within 15 business days following the contract award (or other time mutually agreed between the parties), the contractor shall meet with the GSA CO, GSA COR, and other identified Government representatives to ensure a common understanding of the requirements, goals, expectations, end products, and objectives of the contract. The contractor shall discuss the overall understanding of the project and review the background information and materials provided by the Government. Discussions will also include the scope of work, deliverables to be produced, how the efforts will be organized, and project conducted; assumptions made/expected end results. A concerted effort shall be made to gain a thorough understanding of the Government expectations. However, nothing discussed in this or in any subsequent meetings or discussions between the Government and the contractor shall be construed as adding, deleting, or modifying any contract requirements, including deliverable specifications and due dates. The contractor shall also address the status of any issues that will affect contractor start- up/ramp-up toward achieving full service/support capability. The contractor will be responsible for taking minutes of this meeting.

2.2.2 Ad hoc Technical / Work Status

The contractor shall, if requested by the Government, participate in monthly status meetings or ad hoc technical meetings at a mutually agreeable time and place to discuss tasking, work progress, technical problems, performance issues, or other technical matters. During these meetings the contractor shall at least provide accomplishments, problems and issues, and planned actions. The contractor shall take minutes of these meetings and include them in the Monthly Status Report. These meetings will occur at a time and place mutually agreed upon by the parties.

2.2.3 Contract Administration Meetings

The CO may require the authorized contractor representative to meet or participate in a teleconference with authorized Government personnel as often as deemed necessary to discuss performance or administrative issues. The contractor may also request a meeting with the CO when deemed necessary. The content of meetings shall be documented in writing, as agreed between the parties. Minutes shall be approved by both parties and shall be included in the Government contract file.

2.3 Program/Project Management

2.3.1 General Program/Project Management Requirements

The contractor shall be solely responsible for managing the work performed in the execution of the contract. This includes the responsibility to:

· Assign appropriate resources to each task.

· Maintain clear organizational lines of authority.

· Ensure effective task management and administration, following the requirements set forth in the PWS.

· Maintain the personnel, organization, and administrative control necessary to ensure that the work delivered meets the specification requirements.

· Establish and use proven policies, processes, analyses, and best practices.

· The contractor shall be fully responsible for management, control, and performance of any subcontractor used in support of the contract. Use of a subcontractor on the contractor’s team shall not relieve the prime contractor of responsibility nor accountability in the execution of the contract.

Additionally, the contractor shall:

· Bring problems or potential problems affecting performance to the attention of the CO as soon as possible.

· Notify the COR, CO, and other identified Government representatives immediately of any projected, anticipated, or known delays that may impede contactor performance.

· When requested, deliver written reports to the CO to memorialize all verbal reports.

· Provide, in writing, the results of all meetings in which proposals are put forth that have the potential for affecting and/or changing contract agreements, requirements or conditions, and these shall be brought to the attention of the CO.

2.4 Required Tasks

The tasks required under this PWS include:

· Providing SME to the OUSD S&T Defense SBIR/STTR Program’s Authorizing Official

· Develop and deliver all required and necessary RMF Artifacts to include policies, processes, and procedures for Defense SBIR/STTR Program system activities, as required

· Deliver continued support to sustain DSIP Cybersecurity Posture and System Authorization

· Collaboration and coordination with the DSIP Application Development Team

· Coordination and compliance with USAF Cloud One’s requirements within AWS IL4

· Support to the DSIP Application DevSecOps Pipeline; ensuring proper security controls and services are in place; continuously monitor the security posture of the Pipeline

· Support operational and cybersecurity configuration of applications and services to support the Program’s Secret Counterintelligence Database (SCD)

· Support the implementation, management, and cybersecurity support to the SCD

· Establish consistent configuration, access controls, and report generation within Naval LIFT’s SaaS - Atlassian’s Confluence and JIRA.

· Maintain SCD to support classified report generation, upload, access, and searchability by supporting DoD Counterintelligence teams, SBIR/STTR program leadership, and DoD program managers in support of a comprehensive due diligence and risk determination process.

· Implement and manage all privileged and general user access to SCD

· Support continuous improvement of counterintelligence reporting within a sustained secure SIPRNet environment

· Collaborate and coordinate cybersecurity posture and requirements with DSIP, SCD, and other hosting environments used to support the Defense SBIR/STTR Program

· Continuous delivery, refresh, management, sustainment, and security of HOCKEYPUK™ Cybersecurity Solutions which provides a Zero Trust Cloud Native Access Point for Program developers, engineers, and security support for continuous access to perform all DSIP delivery in and from AWS IL2 and IL4

3 QUALITY

Both the contractor and the Government have responsibilities for providing and ensuring quality services, respectively.

3.1 Contractor Quality Management

The contractor shall identify and implement its approach for providing and ensuring quality throughout its solution to meet the requirements of the PWS via the contractor’s Quality Management Plan (QMP). The QMP shall describe the application of the appropriate methodology (i.e., quality control and/or quality assurance) for accomplishing performance requirements. The QMP shall describe how the appropriate methodology integrates with the Government’s requirements. The contractor shall make the QMP available to the Government for review upon request and shall obtain acceptance of the QMP by the CO if the CO asserts such requirement. The contractor shall make appropriate modifications to the QMP (at no additional cost to the Government). The Government has the right to require revisions of the QMP (at no cost to the Government) should the QMP fail to deliver the quality of the services required at any time during performance.

3.2 Performance Based Requirements - Performance Requirements Summary (PRS) Performance Standards, Acceptable Quality Levels (AQLs), and Incentives/Disincentives are defined in PWS Attachment A, collectively titled as the PRS. The PRS criteria will be used to determine if performance requirements are met.

3.3 Government Quality Assurance

The Government will perform periodic reviews of the contractor’s performance in accordance with the Government’s Quality Assurance Surveillance Plan (QASP), which will not be incorporated into the resultant contract. The Government reserves the right to review services to be provided, including those developed or performed at the contractor's facilities, to determine conformity with performance and technical requirements.

4 DELIVERABLES

4.1 Contractor Submission

Deliverables are to be submitted/transmitted with a cover letter, on the prime contractor’s letterhead, describing the contents, electronically through ASSIST and to any other destination(s) as required per the Government’s request. All deliverables shall be submitted via an ASSIST “Deliverable Collaboration”. As applicable and as requested, the Monthly Status Reports (MSRs) shall also be included as an attachment to the invoice. The contractor shall provide hard copy deliverables as required per the Government’s request. All deliverables shall be produced using software tools/versions as approved by the Government.

4.2 Government Review

Government personnel will have 10 business days to review deliverables (to include resubmissions) and provide written acceptance/rejection. Authorized Government representatives will notify the contractor of deliverable acceptance or provide comments in writing. The contractor shall incorporate Government comments or provide rationale for not doing so within 5 business days of receipt of comments. Government acceptance of the final deliverable will be based on resolution of Government comments or acceptance of rationale for non-inclusion. Additional changes volunteered by the contractor will be considered a resubmission of the deliverable.

4.2.1 Government Delays in Reviewing Deliverables or Furnishing Items If contractor performance or submission of deliverables is contingent upon receipt of Government furnished items (data, equipment, materials, facilities, and support) or input, or upon Government review and approval of interim items or draft documents (collectively referred to as Government Performance), the Government shall specify, if not already specified within this PWS, when it will provide such items or input, or the time it will need to perform reviews or give approvals. If the Government fails to meet item, input, review, or approval deadlines, contractor performance or submission of deliverables shall automatically be extended one business day for each day of government delay. The contractor shall promptly advise the Contracting Officer of any delays in receipt of Government furnished items, input, reviews, or approvals.

4.3 Deliverable Table

The contractor shall deliver the deliverables listed in the following table on the dates specified.

4.4 Monthly Invoice

The contractor shall provide a monthly invoice, no later than the 15th calendar day of the month following the monthly reporting period, to be submitted simultaneously with the MSR. As applicable, the invoice shall include but is not limited to:

· Clear identification of all costs.

· Travel costs.

· Supporting documentation for travel costs. Refer to PWS 5.3 for specific requirements.

· Other Direct Costs.

· Supporting documentation for other direct costs. Refer to PWS 9.6 for specific requirements.

· As required, the contractor shall comply with line item (i.e., per individual positions, different programs, program areas, etc.) invoicing requests.

4.5 Monthly Status Report

The contractor shall provide an MSR, no later than the 15th calendar day of the month following the monthly reporting period, to be submitted simultaneously with the monthly invoice. The MSR shall include, but is not limited to, the items identified below.

· Status of tasks, schedules, deliverables. Status of tasks shall include a summary description and schedule of all tasks completed during the reporting period, all tasks currently on-going during the reporting period and all known tasks assigned for future reporting periods.

· Current and cumulative task funding status (direct labor, travel, and other direct cost funding status to be reported separately, as required).

· Outstanding issues, and proposed resolution approaches and actions to resolve any outstanding issues.

· Staffing report identifying current staffing roster, all current vacancies, and a record of all staffing departures as well as identifying which staff members possess a security clearance.

4.6 Trip Report

For all long-distance travel, the contractor shall submit Trip Reports as attachments to the MSR for the monthly reporting period containing the travel dates. If the dates of travel span two or more monthly reporting periods, the contractor shall report in the monthly reporting period containing the ending travel date. The contractor shall reconcile the Trip Reports with each invoice such that they can be matched month by month. The Trip Report shall include the following information:

· Completed Itemized Expense Report (PWS Attachment B), or Government accepted alternate, for each trip and each employee who traveled. Expense report(s) shall include the contract number, contractor name, traveler’s name, dates of travel, destination, purpose of travel, travel authorization documentation (e.g., identification of approved ASSIST “Contractor Travel Request Collaboration”), and actual cost for each trip.

· Summary of trip events and accomplishments.

4.7 Reserved

4.8 Reserved

5 PERFORMANCE

5.1 Period of Performance

The period of performance will consist of a 1-year base period and one 1-year option period.

5.2 Place of Performance

The primary place of performance shall be at contractor site(s).

5.2.1 Applicability of Telework

All work performed at locations other than those identified as Government and/or contractor facilities shall be approved prior to performing the work. Federal contractors are not governed by Office of Personnel Management (OPM), GSA, or the individual agency policies; however, this does not prohibit contractor personnel from actually working at an alternate site, when/as appropriate and specifically authorized by the Government. The contractor shall develop telework policies to comply with the following requirements and address such requirements at a generic level within their QMP. Alternate work arrangements for contractors shall be negotiated with the contractor’s own employer and the appropriate agency official, to ensure policies and procedures are in close alignment and there is a clear and concise arrangement documenting the agreement. It remains the contractor’s responsibility to ensure the services are performed in accordance with the terms and conditions of the contract.

· The contractor shall address the pertinent facts impacting performance and ensure all affected contractor resumes and other related documentation reflects the applicable work site. The contractor shall provide justification to the Government when identifying and submitting an individual as a telecommuter and address implementation processes and procedures within the QMP. The contractor shall be responsible for ensuring the Government has the required access/details necessary for the Government to perform quality assurance responsibilities.

· The contractor shall comply with all agency security telework policies. The contractor shall ensure all services provided from an alternate site comply with the Federal Information Security Management Act of 2002 (FISMA) and address the following, as a minimum:

· Controlling access to agency information and information systems;

· Protecting agency information (including personally identifiable information) and information systems;

· Limiting the introduction of vulnerabilities;

· Protecting information systems not under the control of the agency that are used for teleworking;

· Safeguarding wireless and other telecommunications capabilities that are used for teleworking; and

· Preventing inappropriate use of official time or resources that violates subpart G of the Standards of Ethical Conduct for Employees of the Executive Branch by viewing, downloading, or exchanging pornography, including child pornography.

5.2.2 Performance at Contractor Facilities

Work performed at contractor facilities shall be performed according to the contractor’s standard commercial practice; however, the contractor representatives at these facilities must be available for interaction with Government employees during the core hours identified in the paragraph entitled “Normal Business Day”, with the exception of Government designated holidays or facility closures.

5.2.3 Unplanned Government Facility Closures

In the event of unplanned closure of the Government facility for any reason (e.g., natural disasters, Government shut-down, or severe weather) the Contractor shall make its best effort to mitigate loss of work time. If Contractor employees are working on the Government installation, this may be done by moving employees to an off-site location. If performance under this contract is not possible, the Contractor shall take steps to assign employees to other projects on a temporary basis or place them in leave status to minimize non-productive costs to the Government under this contract. Additional instructions may be provided by the Contracting Officer on a case-by-case basis.

Disagreements between the parties resulting from closures shall be settled through negotiations to the maximum extent possible or shall otherwise be settled pursuant to the provisions of the Disputes provisions of this contract.

All services to be performed under this contract have been determined to be non- essential for performance during a closure. Should the Government facility be closed, the Contractor shall be notified by either the Contracting Officer, COR, or a local television or radio station. The Contractor is responsible for notifying its employees about Government closures. Contractor employees are not to report to the Government facility if it is closed and will adhere to delays, unless otherwise specifically instructed otherwise by the CO or COR.

5.3 Travel

5.3.1 Contractor Travel Requests

Travel must be coordinated and authorized (via ASSIST “Contractor Travel Request Collaboration”) by the CO, the COR, and/or other identified Government representatives prior to incurring costs. The contractor shall:

· Submit the “Contractor Travel Request Collaboration” no less than 15 calendar days prior to the travel start date;

· Include an estimate for each traveler on Itemized Expense Report (PWS Attachment B) or similar document that has been determined to be acceptable by the Government; and

· Attach any required internal and/or Government client approvals received outside of ASSIST.

If the “Contractor Travel Request Collaboration” is submitted less than 15 calendar days prior to the travel start date and/or the requested amounts exceed per diem rates, the contractor shall submit justification with the travel request and, if requested by the CO or COR, submit three quotes for any identified expense.

5.3.2 Travel Reimbursement

Contractor costs for travel will be reimbursed in accordance with FAR 31.205-46, in arrears. The travel costs shall be reasonable and allowable as defined in FAR 31.201 and in accordance with the limitations of the JTR.

The contractor shall invoice monthly on the basis of cost incurred. The contractor must provide documentation in support of all travel expenses.

The contractor will not be reimbursed for local travel (within a 50-mile radius of the Government/contractor’s facility) or commuter travel (commute from home to work site).

Invoice submissions including travel costs shall include completed Itemized Expense Report (PWS Attachment B), or Government accepted alternate, for each trip and each employee who traveled. The Itemized Expense Report, receipts of $75 or more (with exceptions being lodging and transportation whereby receipts are required regardless of dollar value), and supporting documentation (e.g., approval email for exceeding per diem rates, cost comparisons, etc.) shall be submitted with the invoice.

All travel costs shall be compiled into the Government provided Travel Worksheet (PWS Attachment B) or similar document that has been determined to be acceptable by the Government. The entire submission shall be complete and organized to enable the Government to complete an efficient review. Submissions that are not complete and organized are subject to rejection.

5.4 Hours of Work

5.4.1 Standard Duty Hours Support

The contractor shall provide standard duty hours support as defined below.

5.4.1.1 Normal Business Day - (work hour category A)

A standard normal business day is defined as any 8 hours of productive labor which must include the Core Business hours of 0800 through 1630 PM local time, Monday through Friday, excluding Federal Holidays. Exceptions may be required and shall be coordinated with the COR and/or other identified Government representatives.

5.4.2 Non-Standard Duty Hours Support

The contractor shall provide for scheduled (planned work hours) and unscheduled (other than planned work hours), non-standard duty hours support as required. The contractor shall identify a primary and alternate point of contact for non-standard, unscheduled duty hours requirements. To ensure the applicable labor hours allocations are not exceeded (typically 40 hours per week), labor hours expended in support of non-standard duty hours requirements shall be offset by reducing the number of standard duty work hours by an equivalent number within an off-set time period that doesn’t impact the contractor’s ability to complete the contract requirements. The contractor shall not place restrictive limitations on the off-set time period.

5.4.2.1 Scheduled (work hour category B)

Scheduled non-standard duty hours support shall be coordinated with the authorized Government point of contact and the contractor’s designated point of contact. The Government may request non-standard duty hour support (fiscal year close-out periods, deployment/release periods, and peak operational periods). Scheduled non- standard duty hour support may also be required to support a short-term surge in requirements.

5.4.2.2 Unscheduled (work hour category C)

The Government may also request that the contractor provide un-scheduled (e.g., emergency technical support), non-standard duty hours support. The contractor shall respond within 15 minutes of notification. When off-site support can resolve the issue, the contractor’s personnel shall begin immediately upon notification. The contractor shall assess the cause, determine the scope of the problem, advise the appropriate Government organization, provide an estimated restoration time, and identify and implement action for problem resolution. When required, on-site support shall begin within one hour of notification to the contractor’s designated individual.

This unscheduled support may include:

· Remote telephone support with the Government staff and/or customers.

· Remote support on Government Furnished Equipment (GFE). Contractor personnel may be equipped with GFE that enables remote access/log-on. The Government will not incur any costs associated with home-based Wi-Fi or LAN access to the Internet.

· Onsite support.

5.5 Limitations on Contractor Performance

The contractor shall NOT perform the following functions in connection with the services provided under the contract.

· Approve, decide, or sign as a Contracting Officer;

· Negotiate with Government suppliers;

· Accept or reject supplies or services;

· Determine acquisition, disposition, or disposal of Government property;

· Direct other contractor or Government personnel;

· Determine cost reasonableness, allowability, or allocability;

· Vote on a source selection board;

· Supervise Government personnel;

· Approve Government requirements or plans;

· Determine Government policy.

6 PERSONNEL

6.1 General Requirements

All contractor personnel shall meet the minimum general requirements listed below.

· All personnel shall be capable of working independently.

· All personnel shall have training and experience that is appropriate for the tasks to which they will be assigned.

· The contractor shall provide personnel that are capable of conducting themselves in a professional manner and have proper telephone and e-mail etiquette, customer service techniques, and organizational skills.

· Contractor personnel performing in a leadership capacity shall be capable of directing contractor personnel and interfacing with the Government and customers.

· Ability to communicate applicable technical SME to management and others.

· Strong written and oral communication skills in the English language. All contractor personnel must be able to read, write, speak, and understand English.

· Exceptional customer service skills.

· Strong time-management and prioritization skills.

6.2 Specific Expertise and Experience

The contractor shall provide personnel with the appropriate skill levels. While each individual contractor employee may not possess expertise and experience in each area below, the Government requires that the overall contractor staff possess the aggregate skills, expertise, and experience in each of the areas identified to successfully complete all requirements.

· Subject matter expertise in the areas of Information Assurance and Cybersecurity.

· Expert knowledge of DoD’s RMF / DoDI 8510.0

· Expertise with HOCKEYPUK™ Cybersecurity zero client to cloud solutions.

· Ability to discern proper, complaint, and efficient cloud architectures.

· Experience in the technologies available within the new environment, such as open- source products and infrastructure as code.

· Migration planning and architecture development using the latest inherent and fully managed capabilities offered by a cloud service provider.

· Assess and mitigate the risks associated with a change in architecture and environment.

· Expertise with Defensive Cyber Operations in the Cloud.

· Expertise with USAF Continuous ATO processes.

· Expert knowledge of DoD cloud cybersecurity requirements.

· Familiarity with DoD CIO Digital Modernization Strategy.

· Subject matter expertise with Amazon Web Services (AWS).

6.3 Training

6.3.1 Contractor Staff Training

The contractor shall provide fully trained and experienced support staff. Contractor personnel are required to possess the skills necessary to support the minimum requirements of the labor category under which they are performing. Training of contractor personnel shall be performed at the contractor's expense, except when the Government changes the requirements during performance of an on-going task, and it is determined to be in the best interest of the Government. This will be negotiated on a case-by-case basis. Training at Government expense will not be authorized for replacement personnel nor for the purpose of keeping contractor personnel abreast of advances in the state-of-the-art, or for training contractor personnel on equipment, computer languages, and computer operating systems that are available in the commercial market.

6.3.2 Mandatory Government Training

Mandatory Government training shall be tracked and monitored by the contractor. All required courses must be completed by the required dates by all contractor personnel. Mandatory Government training classes may be completed during work hours. It is the intent of the Government to provide 30 calendar days written notice of annual training requirements to the designated contractor representative. The designated contractor representative will be responsible for notifying subordinate contractor personnel. In the event the contractor does not receive a 30-calendar day notice, the contractor is still required to complete the training by the specified required date(s).

6.4 Key Positions / Key Personnel

Key personnel are personnel proposed to perform in key positions. Key positions are those deemed essential for successful contractor accomplishment of the work to be performed. The following positions will be considered to be key positions, as identified by the Government, under the contract:

· Senior Cybersecurity Engineer,

· Junior Cybersecurity Engineer,

· Cloud Cybersecurity Architect,

· Information Systems Security Officer (ISSO)/Cloud Security Assessment SME, HOCKEYPUK™ Cybersecurity zero client to cloud SME Furthermore, the contractor is responsible for identifying key positions beyond those identified above, as applicable; within the contractor’s respective proposed staffing plan (i.e., contractor identified key positions above and beyond the Government’s identified requirements).

6.5 Personnel Retention and Recruitment

Government review and acceptance is required for all resumes of personnel proposed to support labor hour requirements and key personnel proposed to support all firm fixed priced requirements. The contractor shall make every effort to retain personnel in order to ensure continuity until contract completion. If it should become necessary to substitute or replace personnel, the contractor shall immediately notify the COR and/or other identified Government representatives in writing of any potential vacancies and shall submit the resume(s) of replacement personnel within 14 calendar days of the notification. Additionally, for all new positions identified by the Government, the contractor shall submit the resume(s) of proposed personnel within 14 business days of the Government’s initial request. The contractor shall submit the resume(s) of all potential personnel selected to perform under the contract to the COR and/or other identified Government representatives via an ASSIST “Resume Acceptance Collaboration”, or any other process means identified/required, for Government review and acceptance/rejection. Upon Government acceptance of a personnel resume(s), the candidate shall be available to begin performance within 14 business days. The contractor shall ensure continuity of operations during periods of personnel turnover and long-term absences. Long-term absences are considered those longer than one week in duration.

7 GOVERNMENT FURNISHED PROPERTY/INFORMATION/ACCESS

7.1 General

As applicable, the Government shall provide, without cost, the facilities, equipment, materials, and services listed below. The Government furnished property and services provided as part of the contract shall be used only by the contractor only to perform under the contract. No expectation of personal privacy or ownership using any Government electronic information or communication equipment shall be expected. All property at Government work sites, except for contractor personal items will be assumed to be Government property unless an inventory of contractor property is submitted and approved by the CO/COR. Contractor personal items do not include computers, external drives, software, printers, and/or other office equipment (e.g., chairs, desks, file cabinets).

If Government Property is furnished, the Government will provide a list of property on the Government Furnished Property (GFP) list (PWS Attachment C) or a detailed description of the information to be provided within the solicitation and/or any resulting modification. These lists shall be validated, maintained, and updated by the Contractor.

Notification of all changes shall be provided to the Government via an ASSIST “Deliverable Collaboration” within three business days of the change. NOTE: Validation shall consist of the contractor checking for physical completeness and accuracy. Physical completeness and accuracy shall be determined when all property defined as Government furnished are provided.

7.2 Property

7.2.1 Facilities

As applicable, the Government will provide facilities at the authorized primary work locations as specified in PWS paragraph 5.2. Use of the facilities by contractor personnel will include all utilities, telephone, janitorial services, and furniture for contractor personnel performing tasks. The Government will provide the contractor access to buildings as required, subject to the contractor personnel obtaining the required clearances and approvals.

7.2.2 Equipment at Authorized On-Site Government Work Locations As applicable, the Government will provide the following at authorized on-site Government work locations:

· A suitable work environment (i.e., telephone, office space and furniture). Office space may include a private or shared cubicle, hoteling space (space reserved for temporary use), or other such space suitable for the work required.

· A personal desktop computer or laptop and auxiliary hardware and software required in the performance of the contract.

· Network connectivity required to perform work assignments. Network and computer access rights commensurate with work assignments.

· The Government will replace items that are determined to be beyond economical.

repair by the COR and/or other identified Government representatives unless damage or loss is determined to be due to contractor negligence.

7.2.3 Materials

As applicable, the Government will furnish basic reference manuals, and any revisions, updates, and changes thereto for use by the contractor necessary to perform work assignments under the contract.

7.3 Use of Government Property

7.3.1 Desk Telephones

Government telephones are provided for use in conducting official business. Contractor personnel are permitted to make calls that are considered necessary and in the interest of the Government. The contractor shall follow the same policies as Government personnel for telephone usage.

7.3.2 Mobile/Wireless Telephones and Smart Devices

Government issued mobile/wireless telephone and smart devices may be assigned to contractor personnel when the Government determines it is in the Government’s best interest. Contractor personnel are prohibited from using any Government issued device for personal use.

7.3.3 Electronic Mail (E-mail)

All Government e-mail access and use by contractor personnel shall be in support of the individual’s official duties and contract responsibilities. All information that is created, transmitted, received, obtained, or accessed in any way or captured electronically using Government e-mail systems is the property of the Government. Contractor personnel are prohibited from forwarding e-mail generated from a Government provided e-mail account to personal devices.

7.3.4 Copiers and Fax Machines

Copiers are to be used to copy material for official Government business only in the performance of the contract. Contractor personnel shall not use fax machines for other than official Government business in the performance of the tasks in the contract.

7.3.5 Computer and Internet

All Internet and electronic media access accomplished by contractor personnel (utilizing Government furnished equipment) shall be for official Government business in the performance of the tasks in the contract.

7.3.6 Canvassing, Soliciting, or Selling

Contractor personnel shall not engage in private activities for personal gain or any other unauthorized purpose while on Government-owned or leased property, nor may Government time or equipment be utilized for these purposes.

7.3.7 Security Violations Using Government Equipment

Any contractor violating Government security policies, guidelines, procedures, or requirements while using Government equipment or while accessing the Government network may, without notice, have their computer and network access terminated, be escorted from their work location, and have their physical access to their work location removed at the discretion of the CO/COR. The CO/COR will notify the contractor of the security violation and request immediate removal of the contractor employee.

8 SECURITY

8.1 Non-Disclosure Agreements

Due to the potential sensitive nature of the data and information being worked with on a daily basis, all contractor personnel supporting the contract are required to complete the Government provided non-disclosure agreement/statement (PWS Attachment D) prior to assignment to the contract award to ensure information that is considered sensitive or proprietary is not compromised. Signed non-disclosure statements shall be provided to the COR and/or other identified Government representatives.

8.2 Security Clearance

At a minimum, a SECRET security clearance is required for all Contractor personnel performing under this contract. Some positions require a Top Secret/Sensitive Compartmented Information level clearance. Inability to receive or maintain a security clearance shall be considered a security violation and shall disqualify Contractor personnel from performing on this contract. The Government will issue a DD Form 254, “Contract Security Classification Specification”. The DD Form 254 will govern the security requirements and will provide specific instructions for security guidance.