POLC PWS Final RFI draft.docx

JETS RFQ# XXXXX

DLA Engineering Support for Enterprise Log Management (ELM) and Security Information Event Management (SIEM)

JETS RFQ# SP4709-XXX-XXX

DLA Police Center (POLC) Application(s) Support

Section 2: PERFORMANCE WORK STATEMENT

2.1 BACKGROUND

The Defense Logistics Agency (DLA) requires Information Technology (IT) support services for a suite of applications that support police, fire, emergency services dispatching, and notifications. DLA requires the Contractor to provide full IT life cycle support for current and future Commercial Off the Shelf (COTS) software in multiple DLA hosted environments, Staging and Production. The suite of applications is termed “DLA Police Center (POLC)”.

Installation Management (DM) is the functional proponent for POLC and is responsible for police, fire, emergency services dispatching, and notifications across five (5) sites which each have some unique requirements (see Table 1). DLA J6, Information Operations is responsible for providing the solution that meets the functional proponents requirements and providing direction and guidance related to this requirement.

The POLC is a bundle of stand-alone separate applications including

1. Law Enforcement (LE) Records Management System (RMS) which includes:

a. Automation and standardization of police operations

b. Property management

c. Incident reporting,

d. Blotters

e. Qualifications

2. Computer Aided Dispatch (CAD)

a. Real time incident response

b. Dispatching

c. Emergency resource management interfaces.

3. Emergency Reporting (ER) Fire Emergency Services (FES)

a. Electronic Patient Care Reporting (ePCR)

b. Incident management

c. Response data

d. Inventory records including tracking and maintenance

e. Training records

f. Inspection records,

g. Hot work permits

h. Key infrastructure data such as fire hydrants data

4. Enhanced 911 (E911) / Next Generation 911 (NG911) which includes:

a. Voice Over Internet Protocol (VOIP)

b. Automated Location Information (ALI)

c. Automatic Number Identification (ANI).

The POLC suite leverages Geographic Information System (GIS), and Crime Information System (CIS) capabilities. The RMS application interfaces with both E911 and CAD.

The Government requires support services for the POLC suite to the Information Operations (J6) Installation Support Program Management Office (PMO). Support services include program/project management and operations and sustainment support.

The Government provides software licensing, via a separate contract, and on-premises application hosting in Microsoft Azure and/or locally hosted infrastructure. The Contractor shall provide support services to assist the PMO to manage licensing usage and the need for additional licenses, hosting, and the Contractor is solely responsible for POLC suite of applications including monitoring and reporting (triage, break/fix, etc.), cybersecurity, configuration management, database support, privileged application administration support, and sustainment of the current COTS POLC suite of applications. The Contractor will ensure that the POLC suite of applications operate in accordance with DoD, DLA and National consensus standards maintaining the Agency’s accreditation status with the Center for Public Safety Excellence (CPSE). The Contractor will ensure that the application(s) securely documents the Health Insurance Portability and Accountability Act (HIPAA) and other law enforcement information requirements and criminal investigative sensitive data including, but not limited to Criminal Justice Information System (CJIS).

Table 1 – POLICE CENTER SUITE APPLICATIONS

Associated Interfaces

Defense Supply Center Richmond, VA (DSCR)

Defense Supply Center Columbus, OH (DSCC)

DLA Distribution Depot San Joaquin, CA (DDJC)

DLA Distribution Depot Susquehanna, PA (DDSP)

1. Caliber Public Safety Computer Aided Dispatching

(CAD)

2. Micro Automation Omni911

3. Caliber Public Safety Law Enforcement (LE) and Investigative Records Management System (RMS)

4. Emergency Reporting (ER), Fire Emergency Services (FES) Client-Server Based Solution

1. Geographic Information System (GIS)

2. Crime Justice Information System (CJIS)

3. Communications Solutions Configuration Accounting Information Retrieval System (CAIRS)

DLA Headquarters Complex (HQC), Fort Belvoir, VA

1. Caliber Public Safety Computer Aided Dispatching (CAD)

2. Caliber Public Safety Law Enforcement (LE) and Investigative Records Management System (RMS)

1. GIS

2. CJIS

3. CAIRS

2.2 SCOPE

This PWS outlines requirements for the POLC suite. The Contractor shall provide project management support and life cycle management support. Life cycle management support includes acquisition, sustainment, maintenance, and technical support.

Project management support includes managing resources, processes, and documentation related to J62BK mission, functions, and key lines of effort which include Capability Support, Technical Services, Cybersecurity, Data Solutions, Audit Readiness, and if required transition support. The Contractor’s support ensures adherence to DLA’s operational standards, regulatory compliance, and effective communication between stakeholders. No software development or creation is within the scope of this contract.

POLC Technology Services includes systems administration, database administration, telecommunications technology support, mobile device support, and manage Government provided licensing.

POLC life cycle management support include providing the full range of life cycle support as described in DoD/DLA policy for defense business systems. Life cycle management entails support of acquisition, sustainment, maintenance, and technical support services required for daily 24/7/365 operations support. Technical services also include administration of the application hardware, software, and related infrastructure ensuring the Government remains on supported hardware and software versions. The Government expects the Contractor to complete multiple major and/or minor upgrades during this effort. Nominally, the Government would like to remain only one version behind the COTS application latest release and would like all Operating System levels at the current latest version. Technical services include configuration management support, systems engineering support, information system architectural support, testing, cybersecurity, documentation support, and those services required for police, fire, and emergency services authorization. The following table (Table 2) outlines the tasks detailed in this PWS.

This requirement is primarily aligned with JETS IDIQ Task Areas 2, 4 and 10. A JETS Contractor must be able to compete in IDIQ Task Area 4 to submit an offer.

This task order is:

Sole sourced directly to an 8(a) small business Group C Contractor in accordance with FAR 19.803(b)(4)(i)

This task order will be evaluated in accordance with Technically Acceptable at a Fair and Reasonable Price source selection procedures.

The criteria used to select the Contractor for award of this task order will be based on an evaluation of the Contractor’s proposed technical approach, and labor mix and allocation along with its proposed price as compared to the Government’s estimate of the work to be performed.

Price: The proposed task order pricing will be evaluated to determine it is in accordance with the IDIQ. Pricing will be evaluated to ensure completeness and reasonableness.

Current Incumbent Information:

Nationwide IT Services 4025 Fair Ridge Dr.

STE 300

Fairfax VA 22033-2865

SP4709-17-D-0041/ SP4709-24-F-0052

April 16, 2024 – April 15, 2025 Firm Fixed Price

2.3 TASK REQUIREMENTS

The Contractor will be required to perform tasks such as the following:

2.3.1 TASK 1 –Task Order Project Management Support (Reference IDIQ RFP SP4701-15-R-0030 Task Area 10)

The Contractor shall provide project management support for the POLC suite of applications. Project management includes managing resources, processes, and documentation related to POLC mission, functions, and key lines of effort which include multiple technical items such as, but not limited to, the architecture, infrastructure, systems engineering, information assurance, cybersecurity, coordinating multiple simultaneous projects, configuration management, documentation support, operations support, and sustainment activities. Management of these tasks shall include integrating a common system landscape with internal controls and processes that optimize and streamline services.

The Contractor shall provide project management services necessary to establish project governance, develop and implement project plans, establish communication and escalation procedures; support change control processes; monitor, control and report project status, schedule, and report performance; conduct regular project reviews; and ensure quality of deliverables. The Contractor’s Project Manager shall coordinate with the Contracting Officer’s Representative (COR) and Contracting Officer (KO) on all contractual and business issues.

The Contractor shall schedule and complete a kick-off meeting with the Government within five business days of TO award. The Contractor shall prepare and present an executive overview at the kickoff. The executive overview will demonstrate the Contractor’s plans to manage scope, schedule, and resources for the contract. Contractor shall introduce key personnel and describe plans for sustaining existing POLC suite of applicationss. Contractor shall introduce any innovations or recommendations for modernizing, upgrading, migrating, or enhancing POLC suite of applicationss.

The Contractor shall present and deliver the kick-off meeting briefing presentation material and be prepared to discuss the content, to include the staffing plan, schedule, and proposed metrics. The Contractor shall produce and distribute kick-off meeting minutes identifying all the discussion points, agreements, and action items within two (2) business days following the meeting.

Non-Disclosure Agreements (NDA) shall be submitted for all Contractor personnel within 5 business days of starting on the Task Order. If turnover occurs after kick-off, then NDA shall be submitted within 5 business days of start date(s) for any new personnel.

The COR has the responsibility to monitor the progress of the work of the Contractor personnel assigned to the task. Additionally, in the absence of other agreements negotiated with respect to time provided for Government review, standards and actions shall be inspected and the Contractor notified of the COR’s findings within 5 workdays of normally scheduled review.

2.3.1.2 Monthly Status Report:

The Contractor shall monitor activities and deliverables under this Task Order and provide a Monthly Status Report (MSR). The Contractor shall submit the monthly status report in electronic format (Microsoft© (MS©) Excel or MS© Word) that describes project(s) progress, costs, issues, problems, and status to the COR.

The period covered by the MSR shall include the previous calendar month’s activities; any issues, actions, lessons learned or other MSR reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings, or other commitments. If applicable, travel costs shall be broken down by destination, duration, purpose, and costs for both monthly and cumulative to date. The Contractor shall provide a monthly status report by the 5th of each month.

The Monthly Status Report shall include:

1. Contract number

2. Brief task description; summary of activities by task

3. A summary of work accomplished during the reporting period and/or significant events.

4. Updated copies of each project plan should be included with the Monthly Status Report.

5. Deliverables progress; activities and progress (Integrated Master Schedule)

6. Summary of risks, issues, opportunities

7. Significant meetings

8. Software engineering metrics and technical measures such as CPU, memory, license(s) availability

9. Description of any travel or unique services provided and presentation of trip reports if travel occurred

10. Renewal summary including any application certificates, username password expirations, service account password expiration dates, staff Common Access Cards (CAC), mandatory trainings, Authority to Connect (ATC)/Authority to Operate (ATO) and other items with expiration dates

11. Number of Monthly Service Now Incidents completed, and tickets submitted, received, and completed with a compiled metrics identifying common outages and INFOSPOTS to include root cause and resolutions.

12. Funds/labor (hours) expended and remaining funds/labor hours.

13. Anticipated activity for the next reporting period

2.3.1.3 Project Plan / Schedules Development:

The Contractor shall develop project plans to accomplish the requirements of this PWS. The Contractor shall prepare project plans that describe the technical approach, organizational resources, and management controls to accomplish all work contained in this PWS. The Contractor shall document the approach and plan and define the activities in a project schedule if required including but not limited to upgrades, migrations, and enhancements. The preferred format for project schedules in Microsoft Project (.mpp). The project plan shall at a minimum be updated monthly and include tasks, milestones, key milestones, durations, baseline and actual dates, predecessors/successors, and resources. For both project plans and schedules the intent is sound project management principals, tools, and techniques to ensure high-quality products that are defect free and that are delivered in accordance with the timelines. Project plans and schedules for upgrades, migrations, enhancements, and projects assigned by the Government within the scope of this PWS shall be created within 5 business days of notification of the project. Project plans/updated project plans/scheduled shall be submitted as part of the MSR.

Project plans/updated project plans/scheduled shall be submitted as part of the MSR.

The Project Plan shall include:

1. Resources (personnel on the contract and their title/role/responsibility)

2. Plan of action

3. Schedule including milestones and key milestones dates

4. Summary Status e.g., upgrades, migrations, enhancements, and projects

5. Deliverables/documentation status

2.3.1.4 In Process Reviews (IPRs) Briefing:

The Contractor shall conduct IPRs and provide information regarding project and contract status. Project plans and schedules shall be briefed at a minimum quarterly to the COR, PMO, and DLA Installation Management. IPRs shall provide for an interchange between the Government and Contractor during the execution of the task order (e.g., update of project status, review of the system design, reviewing the results of troubleshooting, testing, etc.).

Quarterly IPR report shall include:

1. Brief task description; summary of activities by task

2. A summary of work accomplished and/or significant events

3. Deliverables progress including any outstanding documents needed to complete any tasks

4. Summary of problem areas and updated Risk Register

5. Risks to police, fire, or emergency service applications performance

6. Planned task to be accomplished in the next IPR period

7. Description of any travel or unique services provided and presentation of trip reports if travel occurred

8. Number of SNOW tickets submitted, received, and completed. This should include root cause.

2.3.1.5 Integrated Master Schedule (IMS):

The Contractor shall produce and maintain an IMS using Microsoft Project that shows the activities required for the completion of tasks and deliverables for this Task Order. The IMS is a time-based schedule containing the networked, detailed tasks necessary to ensure successful project/task order execution. The IMS consolidates high-level information from each future planned or in process project plan. The IMS is used to verify attainability of task order objectives, to evaluate progress toward meeting project objectives, and to integrate the project schedule activities with all related components.

2.3.1.6 General Support:

The contractor shall provide general IA engineering capabilities and services per individual task orders. General support includes:

1. Participating in Integrated Product Teams (IPTs), working group meetings, design reviews, specific project meetings, other meetings

a. For any scheduled meetings, briefings, or conference calls, read-ahead materials and presentations must be submitted to the COR and the KO at least two business days in advance. The Contractor is responsible for documenting key points of these gatherings, including action items, their status, and a summary of discussions. These meeting minutes must be provided to the COR and the KO no later than two business days following the meeting.

b. Additionally, the Contractor may be asked to assist in preparing briefing materials and participate in certain briefings, meetings, and conference calls with relevant organizations, stakeholders, and external and internal systems. Their representation should adequately reflect the functional and technical aspects of the J62BK PMO mission and capabilities. All documentation should be produced in the latest version of Government-supplied Microsoft Office formats unless the J62BK PMO, COR, and the Contractor specify and agree upon another format.

2. Providing minutes of meetings

3. Providing recommendations

4. Responding to action items

5. Reviewing documents and providing comments

6. Providing informal consultation

7. Providing briefings at meetings or to specific audiences

8. Supporting other regular program activities

2.3.1.7 Risk Management Plan:

The Contractor shall adhere to DOD instruction 8510.01 Risk Management Framework for DOD systems and apply the DoD risk management approach and plan in the Task Order to develop and maintain a risk register/tracker that documents and tracks Contractor and Government identified risks. For each risk, the register shall include a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur and a mitigation strategy. The initial risk management plan should be provided during the Kick-off meeting and then as part of the Monthly Status Report each month. The Contractor shall provide the Risk Management Plan in a Contractor-proposed, Government-approved format which is available upon request.

2.3.1.8 Configuration Control Governance Meetings:

The Contractor shall provide Configuration Control Governance for the POLC suite. These include but are not limited to supporting and participating in, a stakeholder requirement gathering sessions, Configuration Control Working Group (CCWG), traceability meetings, System Engineering Plan (SEP) review, Test Evaluation and Master Plan (TEMP), or special project/initiative meetings dependent on the governance structure in place. The Contractor may be required to attend governance meetings, IPRs, privacy office and other meetings with integration/interface representatives of external and internal systems, and special working group sessions, as requested by the PMO/COR.

2.3.1.9 Monthly 8570 / 8140 Report:

The Contractor shall provide a monthly 8570/8140 deliverable report to the COR that includes a list of all applicable 8570 / 8140 personnel. The following information shall be provided in the report, due by the 5th business day of each month:

1. Name

2. IA Category

3. IA Level

4. Company

5. Contract Name/Description

6. COR

7. Contract #

8. Primary/Baseline IA Certification Held

9. Date of Primary/Baseline IA Certification

10. Date Primary/Baseline IA Certification Expires

11. Primary CE Certification Held

12. Date Primary CE Certification Received

13. Primary IA Certification Status (Current or Past Due)

14. Primary CE Certification Status (Current or Past Due)

8570 / 8140 Contractor personnel identified on this contract shall have their required DoD 8570 / 8140 security and industry competency certifications prior to starting work and maintain their certifications throughout the life of this task order. Baseline and Computing Environment (CE) certifications must meet DoD/DLA approved lists. The 8570 / 8140 Deliverable Report template and/or approved lists are available upon request. If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification prior to the IT product’s end of life.

2.3.1.10 Contract Project Manager

The Contractor shall provide a Contract Project Manager (CPM) who shall be responsible for the performance of the work, miscellaneous reporting, meetings, briefings, conference call presentation material, meeting minutes, program status, and analysis reports as required and requested. The CPM shall schedule a kickoff meeting within five business days of award to review the scope, tasks, and deliverables of the task order. The CPM shall be responsible for ensuring all contract staff sign and adhere to all Non-Disclosure Agreements (NDA) five business days of award of contract/task order.

The CPM shall provide project management support for all contract personnel and all items detailed in this PWS. This support includes providing planning, direction, coordination, and the control necessary for effective and efficient accomplishment of all contract requirements. The CPM shall be the senior subject matter expert, and monitor, control and report status on cost, schedule, and performance. The CPM will coordinate with the Contracting Officer (KO), the Contracting Officer Representative (COR), POLC Program Manager (PM), and the J6 Technical Points of Contact (TPOCs).

The CPM shall attend meetings and provide support on task requirements as needed to meet the requirements of this contract. The CPM or alternate shall have full authority to act for the Contractor on all contract matters relating to the operations of this contract. The CPM or alternate shall normally be available as required Monday through Friday, normally excluding Federal holidays, between the hours of 0600 and 1800 hours Eastern Standard Time (EST).

The CPM shall support and manage the transition-in and transition-out phases of the contract to ensure seamless continuity of operations. This includes developing and executing a detailed Transition Plan that outlines roles, responsibilities, timelines, and milestones for all transition activities. Key tasks include knowledge transfer, coordination with incumbent contractors or personnel, inventory and documentation review, and system access management. The Contractor shall identify and mitigate risks to ensure minimal disruption to services, establish clear communication protocols with all stakeholders, and provide regular updates on the progress of the transition. Upon completion, a formal report shall be submitted to document lessons learned and ensure a smooth handover.

Task 1 Deliverables:

Deliverable 1: Monthly Status Report Due Date: 5th of the month

Deliverable 2: Project Plans Due Date: Monthly or within 5 business days of notification of a new project

Deliverable 3: In-Process Reviews (IPRs) Due Date: Quarterly

Deliverable 4: Integrated Master Schedules Due Date: Initial IMS within 30 calendar days after TO Award and biweekly thereafter

Deliverable 5: Meetings, Minutes, Briefings, Conference Call Presentation Materials Due Date: Two business days prior to any meetings, briefings or conference calls and two business days after meetings for minutes and two business days after meetings for meeting minutes

Deliverable 6: Risk Management Plan Due Date: At Kick-off and then updated on the 5th business day of the month with Monthly Status Report

Deliverable 7: Configuration Control Governance Meeting Support Due Date: Two business days prior to any meeting

Deliverable 8: Monthly 8570/8140 Report Due Date: By the 5th calendar day of each Month

Deliverable 9: Kick-Off Meeting Due Date: Within five business days of TO award

Deliverable 10: Non-Disclosure Agreement Due Date: Within five business days after award of the Contract/Task Order

2.3.2 TASK 2 – POLC Suite Technology Services

2.3.2.1 System administration support

The Contractor shall be responsible for all application administration, system support, and technical documentation. The Contractor shall be responsible administration system support and documentation of all Windows and non-Windows (Unix) virtual, client, and stand-alone operating systems, monitoring, and performance measurement software, Linux, zOS and Commercial Off the Shelf (COTS) applications. Provide tracking and managing support for licenses. The Contractor shall:

1. Perform system deployment and adherence to DLA lifecycle management policies and procedures.

2. Install GFE, apply patches, manage file systems, monitor performance and troubleshoot alerts from monitoring tools.

3. Perform system failure analysis and recovery, ensuring the consistency and integrity of file systems.

4. Perform system security patching, upgrades, and configuration/policy changes in compliance with all relevant and required Information Assurance (IA) and security implementation, compliance requirements, including completing and adhering to DISA Security Technical Information Guides (STIGs) checklist.

5. Administer accounts user access control to the systems that the contractor administers.

6. Monitor the system logs for growth patterns, trends, and intrusion detection.

7. Provide test support to include supporting integration testing, analyzing test results and assisting in acceptance testing of software components.

8. Conduct research and investigation into technological developments in such areas as operating systems, and software systems for installing, monitoring and maintaining operating systems and executive software.

9. Install, configure and maintain COTS software products that provide operating system support such as NetBackup, McAfee and other products per J6 direction.

10. Configure and maintain system backups to conform to IA controls requirements.

11. Assist with the research and supporting analysis, and design of virtual and standalone server and workstation specifications and configurations that will feed into a Government decision. Also, provide research and analysis to deliver supporting analysis/recommendations for Government use in determining features such as encryption solutions.

a. Assist Government administrators remotely to provide systems management and technical troubleshooting support to DLA for UNIX systems at one or more of the DLA operating locations as needed to include Red Hat Linux (version 5 or higher), HP-UX (version 11.31 or higher) and Solaris (version 10.0 or higher).

b. Resolve UNIX system installation problems and independently work with the other contractors and/or COTS providers until problem resolution.

c. Maintain the integrity of system baselines and provide audit checks of all systems and backups as required.

d. Perform system/application diagnostics using Government-provided maintenance tools to ensure availability and to provide a notification vehicle of problems to administrators.

2.3.2.2 Database administration support

The Contractor shall provide POLC suite application-level database administration support of any Oracle – Schema Administration, SQL – Database Schema Configuration and Maintenance, SQL Server Deployment Planning (software), Application Specific Coding including, but not limited to Stored Procedures, Views, SQL Server Integration Services (SSIS), SQL Server Reporting Services (SSRS) Reports, User-defined functions (UDF), etc. including providing J64 DBA scripts via ServiceNow, and Database Back-Up Policy Exclusions.

Though primarily supported by J64, the Contractor shall consult on the OS, media, server, mail scheduling, and other database items and shall submit tickets e.g., ServiceNow and provide documentation, e.g., ECR, SAAR, etc. as required.

Though primarily supported by J64, the Contractor shall consult on the following items and shall submit tickets e.g., ServiceNow and provide documentation, e.g., ECR, SAAR, etc. as required for:

1) Operating System (OS) Architecture

2) OS Audit

3) OS Authentication

4) OS data collection (system health)

5) OS file systems

6) OS hot fixes / cyber updates

7) OS instance administration

8) OS licensing

9) OS migrations

10) OS patching

11) OS reporting

12) OS services

13) OS set-up/installations

14) OS software installations

15) OS troubleshooting

16) OS tuning

17) OS upgrades

18) Server media

19) Tool configurations

20) Agents

21) Mail/mail notifications

22) Startup/shut down procedures

23) Scheduling database backups

24) Creating databases

25) Starting/stopping databases

26) Database availability

2.3.2.3 Telecommunications and mobile device support

The Contractor shall provide telecommunications and mobile device support to the DLA Emergency Operations Center (EOC) in support of POLC suite.

Task 2 Deliverables:

Deliverable 11: Technical Documentation (Landscape Documents, System Views, Port Protocols, and Service Management (PPSM), ECRs, ETC) Due Date:As required

Deliverable 12: STIG Checklists Due Date: Annual and as required by DoD/DLA Policy and RMF and Continuous Monitoring Guidance

2.3.3 TASK 3 – POLC Life Cycle Management (Reference IDIQ RFP SP4701-15-R-0030 Task Area 4)

The Contractor shall provide life cycle management support including day-to-day operations, application administration support and maintenance, application database support, life cycle documentation, troubleshooting, and sustainment of Police Center applications for e911/NG911, CAD, LE RMS, and ER FES client-server-based solution. The Contractor shall ensure all applicable personnel are available during core support hours of 0600 hours through 1800 hours Eastern Time, Monday through Friday. Contractor shall provide on call support for days and times not covered by core hours to facilitate repairs of unplanned outages in accordance with deliverable timelines in task 2.3.3.5. Applications must be operational 24 hours a day, 7 days a week unless otherwise coordinated i.e., scheduled downtime.

2.3.3.1 Application operations and sustainment support

The Contractor shall provide subject matter experts (SME) to support the application operations and sustainment of the current POLC suite capability. The Contractor shall provide direct support in the availability of all POLC suite of applications, ensuring the Stagging and Production environments, application and service are correctly sized and tuned in accordance with the mission needs of the Program Management Offices (PMO) and the customers.

The Contractor shall provide E911and Next Gen 911 applications support as well as voice logging and call back up support at the following Government sites:

1. Defense Supply Center Richmond, VA (DSCR)

2. Defense Supply Center Columbus, OH (DSCC)

3. DLA Distribution Depot San Joaquin, CA (DDJC)

4. DLA Distribution Depot Susquehanna, PA (DDSP).

The Contractor shall perform application updates, maintenance, and performance tuning of all POLC suite of applications. The Contractor will act as the subject matter expert (SME) on all technical items related to POLC. Any application update requires a Software Version Description (SVD) defining all the changes included in the software update, within 30 business days of contract/task order award and as requested by COR.

The Contractor shall provide support for the migration from e911 to Next Gen 911.

The Contractor shall support DLA in providing a continuous monitoring capability consistent with RMF guidelines that ensures the DLA Police Center Application Support program sustains a viable ATO (authority to operate) throughout its lifecycle.

The Contractor shall complete any required documentation necessary for the operation/support of all POLC suite of applicationss. This can include Enterprise Change Requests (ECRs), Ports, Protocols and Services (PPSM), Service Now Tickets or other required/requested documents to ensure the system is functioning properly and as intended. All documentation should be submitted to the COR and the KO in the most recent version approved by DLA within 5 business days of being notified of the required documents.

Troubleshoot and resolve application related outages, degradations of services, and functionality issues.

The Contractor shall document and implement only approved changes to the system, component, or service and the potential security impacts of such changes. The Contractor shall work with, DLA Installation, DLA J62BK PMO and other DLA organizations to develop the most appropriate course of action to implement any approved changes or security related mitigations. This effort shall include traceability, personnel, and equipment necessary to complete the agreed upon method to be implemented at the site.

The Contractor shall be responsible for resetting the service password for each server every 60 days, per DLA Policy Account Management Implementation Guide Version 3.5 or latest version. The Contractor shall provide a list of service accounts and password expiration dates every 30 days with the monthly status report (see paragraph 2.3.1.2).

The contractor shall be responsible for managing and maintaining the core data infrastructure and configuration settings essential for seamless daily operations including but not limited to the following software functions and standards:

1. Use analytics to assess response times and staffing levels

2. Follow National Fire Protection Association (NFPA 1710) standards of cover

3. Follow NFPA 1500 standards for safety analytics

4. Display an overview of department activities

5. Export fire and EMS data in real time or at the end of a response

6. Use a dispatching interface to transmit, configure, and upload data directly

7. Assign and track personnel and apparatuses during a shift

8. Match employee preferences and unique job responsibilities

9. Feed data to reports, incidents, and analytics about the coverage area

10. Track agency’s contributions to the community outside of pure emergency services

11. Track hydrant locations, manufacturer and replacement information, maintenance records and flow test data

12. Allow for the storage and creation of patient care reports

13. Create emergency patient care reports with 100% National Emergency Management System (EMS) Information System (NEMSIS) compliance

14. Automatically submit records to local, state, and federal data collection agencies

15. Create fire response reports with 100% National Fire Incident Reporting Systems (NFIRS) compliance

16. Automatically submit records to local, state, and federal data collection agencies

17. Map incidents, hydrants, and occupancies by type

18. Track equipment item usage

19. Send notices via email to responsible personnel, reminding them to reorder supplies

20. Develop the minimal number of custom components or modules required to augment the capabilities provided by the Emergency Records Management and Reporting Software meet the requirements in this PWS Store files for personnel to view, such as PDF or video files

21. Track status, location and service life of all agency apparatus including self-contained breathing apparatus (SCBA), bunker gear, hoses, emergency medical equipment and other fire related equipment

22. Manage valuable data for buildings and other structures in the agency’s coverage area (e.g., prefire plans, fire extinguishers, fire protection and prevention systems)

23. Run real-time (incident, station activity, personnel) reports

24. Schedule personnel to populate the Daily Roster

25. Automatically populate incident reports

26. Create and store all records, documents and other information related to fire and EMS personnel training

27. Calculate response times and plan resource deployment

28. Record the location and potential impact of hazardous materials

29. Determine the required fire flow needed to stop a fire at origin

30. Evaluate potential medical emergencies involving mass casualties

31. Develop the required documentation to support the Center for Public Safety Excellence (CPSE) accreditation process. The Accreditation model includes a comprehensive research and information collection guide with checklists, exhibits, benchmarks, references, and activities broken down by category. Several appendices address additional topics including defining the elements of response time, creating standards of response coverage, and developing master or strategic plans. The Commission on Fire Accreditation International (CFAI) accreditation model includes these performance evaluation categories:

a. Assessment and Planning

b. Essential Resources

c. External Systems Relations

d. Financial Resources

e. Goals and Objectives

f. Governance and Administration

g. Human Resources

h. Physical Resources

i. Programs

j. Training and Competency

32. Provide maximum output from the data collection to produce multi-level data analysis and report building

33. Collect and report comprehensive information related to fire and emergency service operations support including:

a. Incident response documentation and reporting for all hazard’s emergency incidents

b. Emergency medical patient care recordkeeping and reporting

34. Comply with National Fire Incident Reporting Systems (NFRIS) 5.1 including:

a. Collect and report the NFRIS data elements

b. Vendors must comply with NFIRS 5.1 Active Vendor by time of award

35. Comply with Health Insurance Portability and Accountability Act (HIPAA)/Personally Identifiable Information (PII)

36. Comply with National Emergency Management System (EMS) Information System (NEMSIS) Gold.

37. An EMS data system is defined as any software associated with Emergency Medical Services that provides a mechanism to collect, document, analyze, or otherwise store and use data associated with an EMS event. This includes but is not limited to:

a. EMS dispatch data systems

b. EMS medical device data systems

c. EMS patient care documentation systems

d. EMS billing systems

e. EMS quality management or reporting systems

f. An EMS data system is Gold compliant with the National Highway Traffic Safety Administration (NHTSA) or any updated version. Dataset when the following conditions have been met:

i. Contains full EMS Dataset and Demographic Dataset; every data element contained in the NHTSA EMS Dataset must be available for use in the EMS data system. Not every NHTSA EMS and Demographic data element has to be used by an EMS system, but if the data element is selected for use, it must be available as defined for use.

ii. No translation of the NHTSA Version 1 EMS Dataset into the NHTSA EMS Dataset is permitted since definitions, variables, and codes are often inconsistent between the two versions.

iii. Additional data elements outside of the NHTSA EMS Dataset may be collected either by using the E23_09 Research Survey Fields (along with E23_11 Research Survey Field Title) or by creating unique data elements outside the NHTSA or current version Dataset 2.

iv. An EMS data system may extend the variables associated with any NHTSA EMS Data Element by using the existing definitions, variables, and codes in such a way so that any change in a data element variable and code can be collapsed back to a defined, acceptable code for data storage and transmission within the XML standard.

v. An EMS data system must have the capability to export data using the NHTSA XML Standard. This standard is defined by the ability to export any EMS event and/or demographic record from the EMS data system using XML with validation using the NHTSA XSDs.

vi. All State EMS Data Systems must have the capability of importing data using the NHTSA XML Standard.

vii. It is recommended, but not required, that local EMS data systems have the capability of importing data into the system using the NHTSA XML standard.

g. Provide the capability for heat mapping incident response locations with Connection and interconnection of information systems (e.g., applications, enclaves, or outsourced processes).

h. Unified capabilities (UC) products (including data, voice, and video).

i. Access to information services (including data, voice, video, and cross domain (CD)) transmitted over the DODIN transport.

2.3.3.2 Training

The Contractor shall conduct initial/refresher training annually as well as when changes to the system occur or upon request of the COR. The Contractor shall prepare training materials based on requirement changes to better support the customer and maintain with any changes to the customer. All training materials shall be completed within 30 calendar days of the training date and as training material is updated. Contractor shall conduct a training survey and provide results to the COR upon request.

2.3.3.3 InfoSpot Support

An Information Special Outage Report (InfoSpot) requires timely technical support. InfoSpots will be supported 24 hours a day, 7 days a week to include weekends and holidays. The DLA ITOC/PMO will initiate support with a systemic alert, email, and/or a phone call to a designated on-call point of contact. The Contractor shall provide an on-call contact that can be directly reached by the ITOC/PMO after normal duty hours. The Contractor shall coordinate directly with the ITOC after normal duty hours to address issues and follow the entire break/fix triage and InfoSpot processes. That includes providing updates and final resolution as required on the InfoSpot. Additionally, the Contractor shall keep the COR/PMO informed of troubleshooting and resolution through phone, email, and/or text.

The Contractor shall acknowledge and engage the InfoSpot within 2 hours of notification from the ITOC/PMO. Time will be measured from the initial contact (telephone conversation, voice mail, email, and/or text message). The Contractor shall provide the necessary technical support until the InfoSpot is resolved or support is no longer needed as determined by the ITOC/PMO.

The Contractor shall add detailed notes to the InfoSpot and/or ITSM SNOW service ticket as soon as possible but no later than 0630 the morning of the next business day.

It is expected on average to have approximately one (1) InfoSpots a month. Average hours for this should be approximately 3 hours per month.

2.3.3.4 Troubleshooting

The Contractor shall capture performance issues; recommend, plan, and coordinate solutions to any problems and recommend changes to enhance POLC suite of applications performance with the COR, J62BK PMO and DLA Installation Management Emergency personnel.

1. The Contractor shall correct faults, improve performance, and adapt the applications to changing organizational and technical environments. This may include but is not limited to documentation to correct the issue and may have to contact or work with other areas of DLA to ensure a problem is resolved in the Service Now ticket.

2. Contract Personnel shall be required, if stood up, to participate in a war line call when an incident/outage is extensive or lasts longer than 30 minutes.

3. The Contractor ensures all detected problems are promptly reported and acknowledged within one (1) hour to the COR and PMO. The Contractor shall keep the PMO and COR updated regularly on the status/resolution of any reported problems. The COR shall capture contact times attempted by phone, text or email and report for metrics.

4. The Contractor shall support the resolution of problems discovered through the testing or operations. Defects identified in a new project will be tested prior to production deployment unless otherwise agreed to by the PMO. The results of testing shall be provided to the COR and J62BK PMO prior to deployment to the production environment.

2.3.3.5 ServiceNow Ticket Support

The Contractor shall be responsible for creating, updating, and closing ServiceNow and/or other tickets. Service tickets are used for all work including break/fix production issues, project support and development, research, planning, onboarding, and technical efforts such as upgrades, migrations and/or technical refreshes. Service tickets are initiated by the Government and/or initiated as requested by the Contractor’s Project Manager and are assigned a ticket priority (listed below) using inputs from the customer, the COR, PMO and other technical staff. The Contractor shall be responsible for submitting tickets to all customer organizations when assistance with application issues is required. All Service Now ticket numbers shall be sent to the COR and J62BK PMO for tracking purposes.

NOTE: When closing out Service Now tickets the Contractor shall ensure the ticket is resolved to the satisfaction of the ticket submitter/customer/requestor.

Expected performance times by activity for each priority provided below for Service Now Tickets:

1. Critical: Within two (2) hours of notification (ITOC call, email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide triage support/diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through, but not limited to troubleshooting, analysis, development, administration work that will be supported to resolution.

The objective for resolving a Critical ticket is as soon as possible for all tasks. A Critical service ticket shall be worked 24 hours a day, 7 days a week (24/7) until the problem has been resolved.

Historically, the applications have only experienced limited instances of Critical work. Possibly, 7 or 8 total a year is expected.

2. High: Within four (4) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide triage support/diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through, but not limited to troubleshooting, analysis, development, administration work which will be supported to resolution.

Contractor typically receives a range of 25-30 High priority tickets per year.

3. Moderate: Within eight (8) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through, but not limited to troubleshooting, analysis, development, administration work that will be supported to resolution.

Contractor typically receives 40-45 moderate tickets per year.

4. Low: Within sixteen (16) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through, but not limited to troubleshooting, analysis, development, administration work that will be supported to resolution.

Contractor typically receives 100-150 low tickets per year.

2.3.2.6 Cybersecurity and Risk Management Framework (RMF) Support

The Contractor shall design, develop, and integrate cybersecurity solutions supporting the Department of Defense and all other applicable Government agencies. The Contractors shall support DLA in providing a continuous monitoring capability consistent with RMF guidelines that ensures the program sustains a viable ATO throughout its lifecycle. This monitoring will entail providing inputs and updates to the Enterprise Mission Assurance Support Service (eMASS) system in coordination with the DLA Systems Security Manager. The objective will be to research, prepare and provide accurate data to the eMASS to comply with RMF and system security protocols. This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), or Assessment and Incorporate (A&I), as well as obtaining an Authority to Operate (ATO). The Contractor shall mitigate risks identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official (AO).

The Contractor shall maintain/update all system documentation in accordance with the Risk Management Framework (RMF) and DoD Architecture Framework (DoDAF). The Contractor shall provide the following documentation/evidence to the Government within Initial details within 30 calendar days of contract/task order award and the 5th day of every month:

1. Security CONOP

2. Hardware and Software list,

3. Network Diagrams to include data flow, authorization boundary and perdue level

4. Ports, Protocols and Service Management (PPSM),

5. FIPS-199

6. PII Confidentiality Impact Level (PCIL) Categorization Worksheet,

7. Privacy Impact Assessment

8. Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)

9. Configuration Management Plan

10. Vulnerability Management Documentation

11. Access Control Policy

12. Audit Logs

13. Incident Response Policy

14. Plan of Action and Milestones (POAM)

15. Software Lifecycle Support Documentation to include any developed/updated software, software version description (SVD) and data dictionaries

In addition to the above list, the Government may request assistance from the Contractor in creating or updating the following documents:

1. Support Agreements

2. Policy Memos

3. Risk Analysis Reports

4. Residual Risk Statements

5. Rules of Behavior

6. Business Impact Analysis

7. User Guides

8. Training Materials,

9. Landscape Documents

10. Test Plans

11. Appointment Letters

2.3.3.7 Configuration Management Support.

The Contractor shall support change/configuration management. The Contractor shall maintain a Configuration Management (CM) plan that addresses product management and version control of hardware…