PEX_RFI_Revision_1.pdf

REQUEST FOR INFORMATION

For

Patriot Excalibur (PEX) Program

This Request for Information (RFI) is for planning purposes only and should not be construed as a solicitation for applications or an obligation on the part of the Government. Any information submitted by respondents to this request is strictly voluntary. The Government will not pay for the preparation of any information submitted or for the Government’s use of that information.

All costs associated with responding to this RFI will be solely at the interested party’s expense.

This request is solely for market research information purposes. This is not an Invitation for Bid (IFB), a Request for Proposal (RFP), a promise to issue an IFB/RFP in the future, nor does the issuance of this RFI obligate or restrict the U.S. Government to an eventual acquisition approach.

This RFI does not commit the Government to contract for any supply or service whatsoever.

Furthermore, the United States Air Force (AF) is not at this time seeking proposals and will not accept unsolicited proposals. Industry sources responding to this market research request are placed on notice that any information received by the Government does not ensure participation in any planned/anticipated future solicitations or contract awards. Not responding to this RFI does not preclude participation in any future IFB/RFP, if any is issued.

Any response submitted by respondents to this request constitutes consent for that submission to be reviewed by Government personnel, Federally Funded Research and Development Center employees and Advisory & Assistance Services contractor employees supporting AFLCMC/HBBD, unless the respondent clearly objects in writing to the release of this information to Federally Funded Research and Development Contractor employees and Advisory & Assistance Services Contractor employees supporting AFLCMC/HBBD, in a cover letter accompanying your response (this cover letter will not count against your 15 page maximum).

To the maximum extent possible, please submit non-proprietary information. Any proprietary information submitted should be identified as such and will be properly protected from disclosure. All information received in response to this request for information that is marked ‘Proprietary’ will be handled accordingly. The Government shall not be liable for damages related to proprietary information that is not properly identified. Proprietary information will be safeguarded in accordance with the applicable Government regulations.

Respondents are advised that the Government is under no obligation to provide feedback with respect to any information submitted. All submissions become Government property and will not be returned. All Government, DoD contractor, and MITRE personnel reviewing RFI responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information.

The purpose of this RFI is to gather information concerning the sustainment and modernization efforts required for the Patriot Excalibur (PEX). PEX is a software operations automation tool focused at the squadron level providing force readiness capability in the area of scheduling, Stan Eval, training, and equipment tracking to the tactical level of command through operational levels of command. It is not specific to mission, Mission Design Series, Major Command, or community. The current PEX contract is held by Jacobs Technology, Inc. In the event of an award the Government will provide the most current release of the PEX software baseline (includes PEX source code), applicable documentation and the necessary licenses. The PEX Program activities to be performed include all modernization, capabilities, processes, procedures, and functionalities needed to assume the sustainment and modernization responsibilities. These tasks include but are not limited to: help desk, software development, regularly scheduled releases, as-needed patch releases, integration & test, database engineering, security service pack creation, security engineering, system engineering, and configuration management.

AFLCMC/HBBD is requesting information from industry sources that have engineering experience in software sustainment, modernization, and integration of software updates.

The security clearance level required for this effort is Secret and may include foreign participation.

INSTRUCTIONS: Below is a description of PEX and a Contractor Capability Survey for use in preparing a response to this RFI. Responders should indicate which portions of their response are proprietary or competition sensitive and should mark them accordingly. Responses to this RFI shall be at the Unclassified level. Both small businesses and other than small businesses are encouraged to participate. Participants are required to provide information via electronic transmittal (i.e., email message with appropriate attachments). Responses to this RFI are requested to be limited to fifteen (15) pages, including all attachments and addendums, (searchable pdf, single sided, 1 inch borders, single line spacing and utilizing Times New Roman 12-point font; graphics and tables shall be no smaller than 10-point font) and received NLT 14:00 EST on 6 March 2015. Cover pages and table of contents will not be counted against in the 15-page maximum. All questions regarding this RFI (technical or programmatic) must be addressed to Ms. Heidi Bosingerwaldron and Ms. Jessica Nelson in email at:

heidi.bosingerwaldron@us.af.mil; jessica.nelson.6@us.af.mil. No other individuals are authorized to represent the Government in regards to this request.

PEX DESCRIPTION: PEX provides a unit-level software toolset that enables AF operations group personnel to conduct accurate and real-time operational tasks, connecting functional areas within a unit. PEX supports both flying and non-flying units and MAJCOMs. PEX is the scheduler of record for Unit Command and Control (UC2). It is neither aircraft Mission Design Series (MDS) nor unit type limited. PEX reduces scheduling workload through integration and automation; supports a spectrum of missions ranging from day-to-day training and proficiency flying, peacetime operational/exercise sorties to operations supporting conventional or unconventional armed conflicts; supports unit-level scheduling, training, Standardization and Evaluation (Stan Eval), and aircraft maintenance; schedules personnel and aircraft; tracks that personnel training is current and qualification; and manages the AF Stan Eval programs including testing, certifications, read files, and “No-Go” programs. PEX ties all of the functional areas of a squadron organization together, seamlessly sharing information and enhancing situational awareness across operations.

CONTRACTOR CAPABILITY SURVEY for the PEX Program: Please address the following Business Information (Part I) and Capability Survey (Part II) as part of your RFI response. If you do not currently possess a capability listed in the Capability Survey, please mailto:heidi.bosingerwaldron@us.af.mil mailto:jessica.nelson.6@us.af.mil address how you would acquire it. Additionally, please indicate your ability to perform these functions/activities from an eventual contract award for one base year with up to four one-year options. The North American Industrial Classification System (NAICS) code for this action is 541511, with a size standard $27.5M IAW the small business size standard. Capability of interested businesses will be determined through this RFI.

Part I: Business Information

1. Company/Institute Name:

2. Address:

3. Point of Contact:

4. CAGE Code:

5. Phone Number:

6. E-mail Address:

7. Web Page URL:

8. Please indicate if you are a small business under NAICS Code #541511, an other than small business, or a non-profit business. Additionally, please indicate if your business is any of the following: Small Disadvantaged Business, 8(a) Small Business, Woman-owned Small Business, Service Disabled Veteran-owned Small Business, Veteran-owned Small Business, or Historically Underutilized Business Zone Small Business. (If you believe this effort would fall under a different NAICS code please disclose that NAICS code)

9. Current Defense Security Service Level:

10. A statement as to whether your company is US or foreign owned (if foreign, please indicate the country of ownership, control or interest (FOCI))

11. A list of all contracts you have participated in that included agile software development, or currently participating in, along with your level of participation (i.e., Prime, Subcontractor, etc.)

Part II: Capability Survey

Address each of the following items and provide supporting examples as appropriate:

1. Describe your software and system engineering and integration experience with agile software development. Address the modernization, sustainment, and deployment of client-server and web-based systems that includes legacy, COTS, GOTS, and new development software. Describe how this experience would be applied to the modernization and sustainment of the PEX software.

2. Describe your experience with the software languages e.g. Classic ASP, HTML, CSS, JavaScript, Angular.js, SQL Server, Silverlight and any others with which you have experience to include COTS applications (Microsoft Office 2010, Internet Explorer 8/9);

3. Document your competence in implementing Information Assurance in relation to Web-based architectures for multiple security level domains from unclassified through Secret, including experience with DIACAP and Defense Information Assurance Risk Management Framework (DIARMF) processes.

4. Provide evidence of the ability to manage the configuration of the PEX Program software baseline.

5. Describe your capability to sustain and modernize fielded large scale (1M+ SLOC), software intensive (multiple computer languages) C2 systems without compromising schedule and warfighter needs including the use of Agile Engineering and software development methods involving frequent demonstration and delivery of capabilities in a DoD acquisition environment.

6. Describe what your company’s agile software development process entails, and provide examples of its implementation.

7. The Government may require PEX to be hosted in a cloud-computing environment. In this event, contractors will be required to be compliant with several regulations regarding cloud-computing services.

a. Do you have the ability to provide cloud-computing services; do you provide a cloud service, if not, how would you propose to meet a cloud service requirement?

b. If yes, how would you be able to meet the following requirements:

i. SUBPART 239.99 Cloud Computing (DEVIATION 2015-O0011) and DFARS 252.239-7999, Cloud Computing Services (DEVIATION 2015-O0011) (Attachment 1)

ii. Federal Information Security Management Act of 2002 (FISMA) and the associated NIST standards and special publications (e.g., FIPS 199, FIPS 200, SP 800-53)

c. If you do not have the ability to provide cloud-computing services, how would you propose to acquire the cloud computing services?

d. Describe your experience developing and hosting software in a cloud environment.

8. Describe your knowledge of and capability to support and maintain all fielded PEX locations, worldwide, including a Tier II 8-Hour Help Desk, urgent maintenance, fixes, documentation, onsite, offsite and remote training, and contingency support for PEX Program. Support includes:

a. Technical expertise and assistance on questions and issues related to PEX fielded systems, interfaces, system patches, service packs, two scheduled releases per year allowing for a 6 month development cycle parallel government testing, real-world contingencies, exercises, and testing.

b. Do you currently have a secret-level classified lab at your facility?

9. Describe your capability and experience on similar projects for assuming software maintenance responsibility for software not originally developed by your organization of similar complexity and scope to that of the PEX software.

a. Document your business unit’s compliance with any process improvement or quality management standards such as the Software Engineering Institute’s Capability Maturity Model Integration (CMMI) or ISO 9000/9001 and provide your CMMI certification level.

10. Discuss your experience and knowledge in dealing with squadron level operations to include, but not all inclusive, Standardization and Evaluation, scheduling of aircraft/aircrew, and maintaining records of training currencies.

11. Provide evidence of the availability of sufficient resources to sustain software intensive fielded systems, including but not limited to:

a. Qualified staff with Secret clearances for selected key personnel

b. Adequate facilities, including labs, for analyses and testing (which includes access to classified communication capabilities) to maintain system baselines;

12. Describe your capability to perform testing/regression testing and to resolve software issues resulting from baseline changes.

13. Discuss your familiarity with DoD Community of Interest (COI) processes, relevant COI schemas and specifications (e.g., the Air Operations COI (AO COI) schemas) as applicable to PEX.

14. Describe your use of virtualization and other relevant technologies for the server and client deployment, performance/capacity scaling, and system administration.

Part III: PEX Modernization Approach Survey

Please address each of the following items as appropriate:

1. Describe your approach for sustaining and modernizing PEX to address current system deficiencies and meet rapidly emerging user needs with technically modern and high performing capabilities. Technical capability improvements of possible interest to PEX Program include:

a. Mobile device capabilities;

b. Rapid creation and deployment of new and updated external interfaces;

c. Consistent, modern user interface across all capabilities and devices;

d. The potential use of the Ozone Widget Framework for user interface capabilities;

e. Replacement/modernization of existing capabilities with COTS or GOTS capabilities;

f. System performance engineering and improvements; and,

g. Developing cloud based software.

2. Describe your approach for sustaining and modernizing PEX while maintaining currently used end user capabilities.

CONTACT INFORMATION

Please e-mail technical and programmatic questions to the following points of contact. Verbal questions will not be answered.

Contracting: Ms. Heidi Bosingerwaldron Email: heidi.bosingerwaldron@us.af.mil

Contracting: Ms. Jessica Nelson Email: jessica.nelson.6@us.af.mil

ATTACHMENTS

(1) SUBPART 239.99 Cloud Computing (DEVIATION 2015-O0011) and DFARS 252.239- 7999, Cloud Computing Services (DEVIATION 2015-O0011) mailto:heidi.bosingerwaldron@us.af.mil

[SUBPART 239.99—CLOUD COMPUTING (DEVIATION 2015-O0011)

239.9900 Scope of subpart. (DEVIATION 2015-O0011)

Prescribes policies and procedures for the acquisition of cloud computing services.

239.9901 Definitions. (DEVIATION 2015-O0011)

“Access,” “cloud computing,” “Government data,” “Government-related data,” and “spillage,” as used in this subpart, are defined in the clause at 252.239- 7999, Cloud Computing Services. (DEVIATION 2015-O0011)

239.9902 Policy and responsibilities. (DEVIATION 2015-O0011)

239.9902-1 General. (DEVIATION 2015-O0011)

(a) To the maximum extent practicable, cloud computing services that are commercial items shall be acquired under the terms and conditions (e.g., license agreements, End User License Agreements (EULA), Terms of Service (TOS), or other similar legal instruments or agreements) customarily provided to the public, to the extent that such terms and conditions are consistent with Federal law and otherwise satisfy the Government’s needs, including those requirements specified in this section. Any applicable service provider terms and conditions shall be incorporated into the contract (e.g., by attachment or other appropriate mechanism).

(b) The contracting officer shall not award a contract to acquire cloud computing services from any cloud service provider (e.g., contractor or subcontractor, regardless of tier) that has not been granted provisional authorization to provide the relevant cloud computing services in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at time of contract award) found at http://iase.disa.mil/cloud_security/Pages/index.aspx. All necessary SRG requirements, including cloud access point connections and authorizations to operate, must be satisfied before the cloud computing service becomes operational.

(c) When contracting for cloud computing services, all purchase requests shall contain—

(1) A requirement to adopt and maintain administrative, technical, and physical safeguards and controls associated with the security level and services being provided, in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at time of award) found at http://iase.disa.mil/cloud_security/Pages/index.aspx http://iase.disa.mil/cloud_security/Pages/index.aspx. Although the new cyber incident reporting requirements being established at SRG section 6.4 are not enforceable by the Government until the effective date of the information collection governing the new reporting requirements (i.e., in conjunction with the effective date of the corresponding reporting requirements contained in DFARS Case 2013-D018, Network Penetration Reporting and Contracting for Cloud Services), this does not limit or otherwise affect in any way the availability or enforceability of any other approved reporting requirements that are otherwise applicable and appropriately incorporated into the contract (e.g., reporting related to unclassified controlled technical information, or personally identifiable information;

(2) Government data and Government-related data descriptions;

(3) Data ownership, licensing, delivery, and disposition instructions specific to the relevant types of Government data and Government-related data (e.g., CDRL, SOW task, line item);

(4) Applicable privacy impact assessments requirements;

(5) Any additional information assurance requirements specific to the relevant types of Government data and Government-related data;

(6) Appropriate limitations and requirements regarding contractor and third party access to, and use and disclosure of, Government data and Government-related data;

(7) Appropriate requirements to support applicable inspection, audit, investigation, or other similar authorized activities specific to the relevant types of Government data and Government-related data, or specific to the type of cloud computing service being acquired; and

(8) A requirement to coordinate with the responsible Government official designated by the contracting officer to respond to any spillage occurring in connection with the cloud services being provided.

239.9903 Contract clauses. (DEVIATION 2015-O0011)

(a) Use the clause at 252.239-7999, Cloud Computing Services, in solicitations and contracts for, or that may involve, cloud computing services.

PART 252—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

[252.239-7999 Cloud Computing Services. (DEVIATION 2015-O0011) As prescribed in 239.9903, use the following clause:

CLOUD COMPUTING SERVICES (DEVIATION 2015-O0011) (JAN 2015)

(a) Definitions. As used in this clause—

“Access” means the ability or opportunity to gain knowledge of Government or Government-related data or any other data collected or maintained on behalf of the United States Government under this contract.

“Cloud computing” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.

“Government data” means any information, document, media, or machine readable material, regardless of physical form or characteristics, that is created or obtained in the course of official Government business.

“Government-related data” means any information, document, media, or machine readable material, regardless of physical form or characteristics, that is created or obtained by a contractor through the storage, processing, or communication of Government data. This does not include a contractor’s business records, e.g., financial records, legal records, or data such as operating procedures, software coding or algorithms that are not uniquely applied to the Government data.

“Spillage” means an unauthorized transfer of classified data or controlled unclassified information to an information system that is not accredited for the applicable security level of the data or information.

(b) Cloud security requirements.

(1) The Contractor shall adopt and maintain administrative, technical, and physical safeguards and controls that are required for the security level and services being provided, in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at the time of contract award) found at http://iase.disa.mil/cloud_security/Pages/index.aspx (Note: the new cyber incident reporting requirements of SRG section 6.4 become enforceable by the Government upon the effective date of the information collection governing the new reporting requirements (see DFARS case 2013-D018).

However, this does not abrogate, limit, or otherwise affect the Contractor’s obligation to comply with any other cyber incident reporting or other reporting requirement that is contained in this contract);

(c) Limitations on access to, and use and disclosure of, government data and Government-related data.

(1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order issued hereunder.

(i) If authorized by the terms of this contract or a task order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order.

(ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibitions and obligations.

(iii) These access, use, and disclosure prohibitions and obligations shall survive the expiration or termination of this contract.

(2) The Contractor shall use Government-related data only to manage the operational environment that supports the government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

(d) Records management.

(1) The Contractor shall deliver to the Contracting Officer all Government data and Government-related data in the format specified in the schedule.

(2) The Contractor shall dispose of Government data and Government-related data in accordance with the terms of the contract and provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures.

(e) Notification of third party access to Government data. The Contractor shall notify the Government immediately of any requests from a third party for access to Government data or Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or Local agency, that could result in the disclosure of any Government data to a third party. The Contractor shall cooperate with the Government to take all measures to protect Government data from any loss or unauthorized disclosure that might reasonably result from the execution of any such request, warrant, seizure, subpoena, or similar legal process.

(f) Spillage.

(1) Upon written notification by the Government of a spillage, or the Contractor’s discovery of a spillage, the Contractor shall coordinate immediately with the responsible Government official to correct the spillage in compliance with agency-specific instructions.

(h) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (h), in all subcontracts, including subcontracts for commercial items.

(End of clause)