PWS - Army ICAM Delivery Contract Jun 2026.docx

Performance Work Statement (PWS) for Army Enterprise Identity, Credential and Access Management (E-ICAM) Delivery Contract

FOR

Army Capability Program Executive (CPE) Command and Control Information Network (C2IN)

DATE: 03 March 2026 VERISON: Army E-ICAM Delivery v1

Controlled by: Department of Army Controlled by: CPE C2INEO EIS CUI Category(ies): Procurement and Acquisition Distribution: FEDCON POC: David Thompson Section 1 – General

1. Description of services The Contractor shall provide all non-personal services, supervision, and resources necessary to perform the continuous delivery and modernization of the Army's enterprise Identity, Credential, and Access Management (ICAM) platform, as defined in this Performance Work Statement (PWS). These services encompass the continuous operation, maintenance, and Tier 3 helpdesk support for existing capabilities, including the Army Master Identity Directory (AMID), Army Enterprise Identity Provider (IdP), Identity Governance and Administration (IGA), Privileged Access Management (PAM), and auditing services across all classification levels. Concurrently, the contractor will incrementally develop, deliver, and integrate modernized ICAM capabilities using an agile methodology to incorporate Zero Trust principles, automate account provisioning and access controls, and improve identity governance. This effort requires a Site Reliability Engineering (SRE) model that utilizes a continuous delivery pipeline that ensures proactive security patching and automated capability enhancements without disrupting mission operations.

The contractor shall replace manual 'break-fix' routines with automated, self-healing infrastructure that comply with Zero Trust concepts and ensure Army Unified Network ICAM capabilities never stagnate; adaptations are deployed in hours, not months. The Army E-ICAM services must guarantee critical access capabilities remain highly available to the warfighter, while seamlessly integrating continuous security and feature updates. These comprehensive services are designed to improve the Army's cybersecurity posture, drive IT efficiencies by eliminating redundant systems, and ensure compliance with Federal, DoD, and Army mandates.

1.2. Background

The Department of the Army operates a suite of enterprise Identity, Credential, and Access Management (ICAM) capabilities that are foundational to securing the Army’s network and data. This existing infrastructure, while operational, requires significant flexible modernization to align with current Department of Defense (DoD) and Army cybersecurity strategies, including the transition to a Zero Trust Architecture. This initiative is driven by the urgent need to enhance security, improve IT efficiency by consolidating disparate systems, and ensure compliance with federal mandates and audit requirements.

This modernization effort is a critical enterprise-wide initiative that impacts and requires coordination across a broad spectrum of Army organizations. The contractor's performance will be integral to meeting the complex requirements of these varied stakeholders as the Army evolves its ICAM platform to provide a more robust, centralized, and automated solution for managing digital identities and access control.

1.3. Scope

Base Requirements: The scope of this Performance Work Statement (PWS) encompasses the full lifecycle of services required to sustain and modernize the Army's enterprise Identity, Credential, and Access Management (ICAM) platform. This includes continuing to deliver all current ICAM capabilities while simultaneously developing and integrating modernized solutions using an agile framework. A critical component of this scope is providing direct support for audit compliance, including the remediation of findings from financial and cybersecurity audits. The contractor shall provide all necessary program management, systems engineering, and technical support to enhance the platform in alignment with Zero Trust principles, automate controls to address audit requirements, and integrate Army applications into the enterprise and tactical operating environments to improve the Army's overall cybersecurity posture and IT efficiency.

Optional Surge Capability: The Government, at its sole discretion, may require the contractor to provide agile based surge support beyond the level of effort defined for the base requirements. This optional capability provides for increased support for any task area within this PWS in response to unforeseen requirements, new mandates, or changes in schedule. All surge support shall be ordered by the Contracting Officer in accordance with the terms of the contract."

1.4. Place of performance Comment by Belcher, Stacey Lynn CIV USARMY CPE C2IN (USA): Is this accurate with know that the current is at Secret and the TS may come later but at this time is it unknown.

The contractor can perform work at a remote location that can support the mission requirements in accordance with DoD and Army regulations, including access to NIPRNet, SIPRNet, Top Secret (if applicable) and Sensitive Compartmented Information (SCI) known as the Joint Worldwide Intelligence Communications System (JWICS) and commercial cloud services. The government will also provide on-site access at Fort Belvoir, VA.

1.5. Travel requirements will be dependent on the contractor's proposed solution. It is anticipated that travel outside of the National Capital Region will be required at least five times per year. The specific details regarding locations, dates, and the number of participants is to be determined and proposed by the contractor.

1.6. FEDERAL HOLIDAYS.

Non-Performance Days: The contractor is not required to perform services on the federal holidays listed below. The U.S. Government observes the following days as holidays:

· New Year's Day (January 1st)

· Martin Luther King, Jr.'s Birthday (Third Monday in January)

· Washington's Birthday / Presidents' Day (Third Monday in February)

· Memorial Day (Last Monday in May)

· Juneteenth National Independence Day (June 19th)

· Independence Day (July 4th)

· Labor Day (First Monday in September)

· Columbus Day (Second Monday in October)

· Veterans Day (November 11th)

· Thanksgiving Day (Fourth Thursday in November)

· Christmas Day (December 25th)

Holidays on Non-Workdays: When a holiday falls on a Saturday, it is observed on the preceding Friday. When a holiday falls on a Sunday, it is observed on the following Monday.

Other Declared Holidays: In addition to the days designated as holidays, the Government observes any other day designated by Federal Statute, Executive Order, or Presidential Proclamation. The Contracting Officer will notify the contractor of any such additional holiday observances.

1.7. Security Clearance Comment by Belcher, Stacey Lynn CIV USARMY CPE C2IN (USA): Verify this is okay.

The Contractor requires a Secret/Non-Possessing Facility Clearance. Currently, all labor categories, including the ICAM delivery, are set at the Secret level, consistent with the base contract. However, future requirements may necessitate an upgrade to a Top Secret clearance. All Personnel working directly on design, engineering, or installation activities shall have an ACTIVE (not interim) and CURRENT DoD Clearance at the appropriate level required to complete their assigned duties on their assigned systems. It is anticipated that personnel will require varying levels of clearances based on their assigned duties and systems. The Contractor shall manage their personnel as appropriate to properly protect classified information and to ensure a tailored performance. While current baseline labor categories are set at Secret, some Contractor personnel may require an Active/Current DoD JWICs/Top Secret clearance for advanced or future requirements. Specifically, a DoD JWICs Top Secret clearance is required for those personnel designated as admin users of classified network devices. IAW DD 254, DoD Contract Security Classification Specification, the Contractor shall ensure all personnel are cleared and compliant to complete implementation requirements. The Contractor shall be responsible for ensuring compliance with security requirements and that all personnel take the appropriate measures to protect classified information.

1.8. Building and Swipe Access

Contractor personnel requiring on-site access to government facilities at Fort Belvoir will be processed for and provided with appropriate building and swipe access. All personnel must comply with the physical security policies and procedures of the facility at all times.

1.9. Information Assurance and Cybersecurity Training

All contractor personnel performing information assurance (IA) or cybersecurity functions must comply with the requirements outlined in DoD Directive 8140.01 and DoD 8570.01-M. The contractor is responsible for ensuring all employees maintain the required certifications for their respective roles throughout the contract's period of performance.

1.10. Mandatory Government Training

The contractor is responsible for completing all required government-provided training courses. This includes, but is not limited to, Army Cybersecurity Awareness training and Operations Security (OPSEC) training. Proof of completion must be provided as required.

1.11. Contractor Personnel and Supervision

The Contractor shall provide a fully qualified and supervised workforce to accomplish all tasks set forth in this Performance Work Statement (PWS). The Contractor is solely responsible for ensuring all its personnel possess the necessary training, professional certifications, and security clearances required to perform their duties. As this is a non-personal services contract, the Government will not exercise supervision over contractor employees. The Contractor shall provide its own management and supervision for its personnel and ensure they are identified as contractors in all forms of communication.

1.12. Data Rights and Retention

(a) Government Rights in Data and Software: All technical data, computer software, computer software documentation, and other intellectual property developed, delivered, or generated in the performance of this contract shall be subject to the data rights clauses specified herein and, in the Defense, Federal Acquisition Regulation Supplement (DFARS). The Government shall receive, at a minimum, Government Purpose Rights (GPR) to all technical data and computer software developed under this contract. For all deliverables, reports, documentation, and data generated specifically to fulfill the requirements of this Performance Work Statement (PWS), the Government shall have Unlimited Rights, as defined in DFARs 252.227-7013 and 252.227-7014.

(b) Deliverables: All deliverables and work products produced in the execution of this contract shall become the sole property of the U.S. Government. The contractor shall deliver all source code, build scripts, configuration files, and technical documentation created or modified under this contract upon request by the Government or at the conclusion of the period of performance.

(c) Data Retention: The Contractor shall be responsible for the retention of all project data, records, and correspondence generated during the performance of this contract. Such records shall be maintained in a secure and accessible manner for the entire period of performance and for a period of three (3) years following the final payment of this contract, or as otherwise directed by the Contracting Officer, to support Government audit and record-keeping requirements.

1.13. Organizational Conflict of Interest (OCI)

Purpose: The purpose of this clause is to prevent conflicting roles that may bias the Contractor’s judgment and to preclude the Contractor from obtaining an unfair competitive advantage in subsequent acquisitions. The Contractor’s performance of this contract requires access to proprietary and sensitive Government and third-party information and involves providing advice and recommendations that will influence future Army acquisitions.

General: The Contractor shall not have any personal or organizational conflicts of interest, as defined in the Federal Acquisition Regulation (FAR) Subpart 9.5. The Contractor shall be ineligible for future Army contracts where the Contractor's involvement in the work under this contract would provide an unfair competitive advantage or result in biased ground rules.

Specific Prohibitions:

1. Impaired Objectivity: The Contractor is prohibited from providing any services, systems, components, or software in which it or a subsidiary/affiliate has a direct financial interest as part of the ICAM modernization effort. The Contractor shall provide impartial and objective advice and analysis. If the Contractor recommends a product in which it has a financial interest, it must be fully disclosed to the Contracting Officer, and the Government must approve its use in writing.

2. Unequal Access to Information: The Contractor shall not use any non-public information acquired during the performance of this contract to prepare proposals or bids for any other Government contracts. This includes, but is not limited to, information regarding operational requirements, system vulnerabilities, acquisition strategies, or evaluation criteria.

3. Biased Ground Rules: The Contractor, its affiliates, or its subcontractors are prohibited from participating as a prime contractor or major subcontractor in any future competitive acquisition for systems or services that are based on the work products, specifications, or recommendations generated under this contract.

Disclosure and Mitigation: The Contractor has a continuing obligation to identify and disclose any potential or actual OCIs to the Contracting Officer immediately upon discovery. The Contractor shall submit a comprehensive OCI Mitigation Plan for Government approval prior to contract award and shall update the plan as new potential conflicts arise. Failure to disclose an OCI or to comply with the approved Mitigation Plan may result in contract termination.

1.14. Contract Transition In/Out

1.14.1. General: The Contractor shall ensure a seamless and transparent transition of responsibilities during both the commencement (Transition-In) and completion (Transition-Out) of this contract to prevent any degradation of service or loss of operational continuity for the Army's ICAM platform.

1.14.2 Transition-In / Phase-In Period:

1. The first sixty (60) days of the Base Period of Performance are designated as the Transition-In period. During this time, the Contractor shall work closely with the incumbent contractor and Government personnel to conduct a comprehensive knowledge transfer.

2. The Contractor shall deliver a detailed Transition-In Plan to the Contracting Officer's Representative (COR) within ten (10) days after contract award. This plan shall outline the Contractor's approach, schedule, and milestones for assuming full responsibility for all tasks within this PWS.

3. Activities during this period shall include, but are not limited to: shadowing incumbent personnel; conducting a joint inventory of all Government Furnished Property (GFP); receiving all technical documentation, source code, and operational procedures; and obtaining all necessary security clearances, network accounts, and facility access for its personnel.

4. By the conclusion of the 60-day Transition-In period, the Contractor shall have assumed full performance responsibility for all requirements outlined in this PWS.

1.14.3. Transition-Out / Phase-Out Period:

1. The final sixty (60) days of the contract's period of performance (whether Base or final Option Period) shall serve as the Transition-Out period.

2. The Contractor shall provide a detailed Transition-Out Plan to the COR no later than ninety (90) days prior to the contract expiration date. This plan shall detail the procedures and timeline for the orderly transfer of all duties, responsibilities, and assets to the incoming contractor or Government personnel.

3. During this period, the Contractor shall provide maximum cooperation with the successor entity. Activities shall include, but are not limited to: transferring all project data, documentation, and intellectual property developed under this contract; participating in joint meetings; providing familiarization training; and conducting a final joint inventory of all GFP.

4. The Contractor shall ensure that its performance is not degraded during the Transition-Out period and that all operations continue without interruption until the final moment of contract completion.

1.15. Subcontracting

1.15.1. Prime Contractor Responsibility: The Prime Contractor shall be solely responsible for the performance of all work under this contract, regardless of whether the work is performed by the Prime Contractor or its subcontractors. The Government will only recognize the Prime Contractor as the single point of contact for all matters related to this contract. The Prime Contractor is responsible for the management of its subcontractors and for ensuring their compliance with all terms and conditions of this contract.

1.15.2. Consent to Subcontract: The Contractor shall not enter into any subcontract for the performance of work under this contract without the prior written consent of the Contracting Officer. For any proposed subcontractor, the Contractor shall provide the Contracting Officer with a written justification that includes, at a minimum, the name and address of the proposed subcontractor, the scope of work they will perform, their technical capability to perform the work, and a verification of their facility and personnel security clearance status.

1.15.3. Flow-Down of Contractual Requirements: The Contractor shall ensure that all applicable clauses, terms, and conditions of this prime contract are "flowed down" to all subcontracts. This shall include, but is not limited to, all requirements related to security, data rights, reporting, and Organizational Conflict of Interest (OCI).

(d) Subcontracting Plan: If the Contractor is a large business, it shall submit a Subcontracting Plan that complies with the requirements of Federal Acquisition Regulation (FAR) Subpart 19.7. The Contractor shall adhere to the goals and reporting requirements of the approved Subcontracting Plan throughout the period of performance.

Section 2 – ACRNs/Definitions

Section 3 – Government Furnished Property (GFP) & Contractor Furnished Property (CFP)

3.1. Government Furnished Property (GFP)

General: The Government will provide the Government Furnished Property (GFP) specified herein for the contractor's use in the performance of this contract. All GFP shall be managed, controlled, and accounted for in accordance with the Federal Acquisition Regulation (FAR) 52.245-1, Government Property.

Government Furnished Information (GFI): The Government will provide the contractor with access to the following information necessary for contract performance:

1. All available technical documentation for the existing Identity, Credential, and Access Management (ICAM) platform, including system architecture diagrams, design documents, source code, user manuals, and standard operating procedures (SOPs).

2. Access to relevant DoD and Army policies, regulations, and security guidance pertaining to ICAM and Zero Trust Architecture.

3. Results and findings from previous security assessments, audits (including FIAR/ICOFR), and system tests.

Government Furnished Equipment (GFE) and Facilities: The Government will provide the following equipment and facilities:

1. Access to the Government's development, testing, and production environments, including all necessary hardware, software, and virtualized infrastructure hosting the current ICAM platform.

2. Secure network connectivity to the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) as required for performance of tasks.

3. On-site workspace for contractor personnel at Fort Belvoir, VA, as deemed necessary by the Government.

4. Software and Tools: Any proprietary software, commercial-off-the-shelf (COTS) software licenses, development tools, or project management systems necessary for the Contractor's internal operations and for the development and delivery of modernized capabilities, unless such software is provided as GFE.

5. Laptops ?? Comment by Belcher, Stacey Lynn CIV USARMY CPE C2IN (USA): If they are to be on our systems the government in the past has provided the laptops that have already been imaged. Previous contracts I have had this was done. But if you want to handle differently let me know.

For my knowledge: What do they have now? Who provided those?

The Government will provide pre-imaged, Department of the Army-standard laptop computers to authorized Contractor personnel as Government Furnished Equipment (GFE) to support the execution of tasks under this contract. These laptops will be configured with the standard Army operating image, security patches, and required enterprise software necessary to access Army networks.

The Contractor shall utilize GFE laptops strictly for authorized work performed under this contract. The Contractor shall be responsible for safeguarding all provided GFE in accordance with Army security regulations and shall return all equipment to the Government upon individual personnel departure, contract expiration, or as otherwise directed by the Contracting Officer’s Representative (COR).

Contractor Responsibility: The contractor shall be responsible for all other equipment, software, and facilities required to perform the tasks outlined in this Performance Work Statement (PWS) that are not explicitly identified as Government Furnished Property.

3.2. Contractor Furnished Property (CFP)

General Provision: Unless otherwise specified herein as Government Furnished Property (GFP), the Contractor shall furnish all personnel, facilities, equipment, software, tools, and services necessary to fulfill the requirements of this Performance Work Statement (PWS) at no additional cost to the Government.

Contractor Responsibilities: The Contractor is responsible for providing, at a minimum, the following:

1. Personnel: All necessary managerial, technical, and administrative personnel with the requisite skills, qualifications, and security clearances to perform the tasks outlined in this PWS.

2. Facilities: All corporate and remote work facilities required for its employees to perform their duties under this contract. Comment by Belcher, Stacey Lynn CIV USARMY CPE C2IN (USA): Is this accurate?

3. Training and Certifications: The Contractor shall be responsible for all costs associated with obtaining and maintaining the professional and security-related certifications (e.g., DoD 8570.01-M / 8140.01) required for its personnel to perform their duties.

Section 4 – Requirement

4.1 Task 1: Continuously Deliver Army E-ICAM Services (CLIN 0001) The Army must continuously deliver the existing commercial enterprise ICAM capability to support daily operations for the Army Master Identity Directory (AMID), Integration with Army Enterprise Identity Provider (IdP), Identity Governance and Administration (IGA), and Privileged Access Management (PAM) capabilities. The contractor shall provide ongoing operation, maintenance, and support for the Army Enterprise ICAM Delivery contract in elastic agile delivery cycles, to ensure continuous, reliable service in accordance with defined Service Level Agreements (SLAs).

4.1.1 Deliver AMID in cArmy:

The AMID provides Identity as a Service for relying parties brokers authoritative PE and NPE ICAM data to govern logical access control. This data consists of identifiers and credentials to support authentication; authorization and environment attributes along with digital policy rules to support authorization; identity attributes to support contact data lookup; and access logs and provisioned entitlements to support attribution. The contractor shall continuously deliver:

· Normalized PE and NPE identity attributes based on DoD and Army standards within the span of use.

· Non-proprietary connections to receive, collect, and disseminate authoritative PE and NPE ICAM data from multiple repositories (including but not limited to databases, policy information points, data tags, etc.) to cloud, on-premises and tactical directories when connected.

· Non-proprietary connections, normalized data formats and synchronization processes with authoritative systems (i.e., internal/external) to receive PE and NPE identity attributes used for logical access control and auditing purposes.

· Connections to authorized relying party applications and local area network directories requesting PE and NPE ICAM data as required.

· Non-proprietary connections, data formats, and synchronization processes with the Army ICAM Portal for sponsor management of Army non-CAC eligible users and MFA registration of devices (i.e., YubiKeys, mobile devices).

· Application-specific views of distributed PE and NPE identity attributes used for authentication, authorization, auditing, and compliance.

· Required maintenance and operations (e.g., operating system (OS), software, patching and vulnerability remediation, etc.).

· Federation with other DoD Components/Services across all classification levels.

· Registration and credentialing of NPEs to include but not limited to AI, ML, and RPA technologies.

· Configurable sponsorship capability for PE and autonomous NPE capabilities that operate on the network (e.g., AI, ML, RPA technologies) that automatically deactivates in accordance with policy, unless re-sponsored.

· Pro Tier 3 Helpdesk support to coordinate with IT resource owners and Army Enterprise Service Desk (AESD) to resolve Helpdesk tickets.

4.1.2 Army Enterprise IdP Integration: Comment by Rothe, Duane A CIV USARMY CPE C2IN (USA): Suggest identifying this as Army Enterprise IdP first before transitioning it to UAA IdP integration UAA IdP is the Identity Federation Service (IFS). The contractor shall continuously deliver:

· Client-facing support for applications on-boarding to the EAMS-A platform.

· Tier 3 Helpdesk support to coordinate with IT resource owners, AESD, and DISA GCDS to resolve Helpdesk tickets.

4.1.3 Enterprise IGA in cArmy

The Army enterprise IGA as a Service capability manages user/group IT entitlements across cloud, on-premises, and supported tactical environments when connected and all security classifications. The contractor shall continuously deliver:

· Non-proprietary connections with the AMID, EAMS-A, and PAM capabilities that support IT resources hosted in cloud, on-premises, or tactical environments when connected.

· Multiple policy repositories, policy information points, and tagged data to form the basis of a tailored enforcement decision down to the lowest/smallest security boundary.

· Required maintenance and operations (e.g., operating system (OS), software, patching and vulnerability assessments/remediations, etc.).

· Infrastructure as code (IaC) and configuration as code (CaC) with repeatable and automated build processes for all artifacts to be deployed across cloud and on-premises environments maximizing the use of the Army-provided code repository, build servers, continuous integration/continuous delivery (CI/CD) pipelines, and automated deployment pipelines where feasible.

· Component lifecycle management by developing and maintaining a technology roadmaps, tracking vendor software versions and end-of-life (EOL) dates, and planning for and executing version upgrades to ensure the system remains in a vendor-supported state.

· Audit and compliance support for onboarded domains and systems by generating and providing detailed audit reports of privileged and non-privileged activities and access histories in support of SOC audit compliance.

· Tier 3 Helpdesk support to coordinate with IT resource owners and Army Enterprise Service Desk (AESD) to revolve Helpdesk tickets.

4.1.4 Deliver Enterprise PAM Capability

The Army enterprise PAM as a Service capability has a distributed architecture that provides secure management of privileged Person Entity (PE) and Non-Person Entity (NPE) credentials and elevated permissions across on-premises and multi-cloud environments for all security classifications. The contractor shall continuously deliver:

· Optimize integrations with UAA IdP and IGA capabilities to automate the user lifecycle, including the provisioning, de-provisioning, and periodic review of access rights to ensure adherence to the principles of least privilege and Just-in-Time (JIT) access.

· Analysis of usage trends and provide quarterly reports to the government detailing current consumption, identifying underutilized licenses for reclamation, and providing optimization recommendations to ensure cost-effectiveness of the existing license pool.

· Operations for PAM components across all deployed environments to ensure system integrity and availability, including but not limited to: applying operating system (OS) and software patches in accordance with Army timelines, conducting regular vulnerability assessments, remediating findings, and managing system backups and restoration procedures.

· Secure and resilient connectivity and functionality of all components of the PAM architecture, including but not limited to, primary and disaster recovery Vaults, Central Policy Managers (CPM), Privileged Vault Web Access (PVWA) and its associated REST API endpoints, Privileged Session Managers (PSM), Privileged Session Manager for SSH (PSMP), Privileged Threat Analytics (PTA), and HTML5 Gateways across all environments.

· Infrastructure as Code (IaC) and Configuration as Code (CaC) artifacts to be deployed across cArmy cloud environments, maximizing the use of the Army-provided code repository, build servers, continuous integration/continuous delivery (CI/CD) pipelines, and automated deployment pipelines where feasible.

· Credential and session policies by regularly reviewing and refining policies for credential rotation, privileged session recording, and threat analytics in coordination with system owners to ensure policies are effective and meet security requirements.

· Security configurations of the PAM solution by continuously monitoring and managing it in alignment with the best security practices, DISA STIGs, and Army cybersecurity policies, and remediate any identified configuration drift.

· Component lifecycle management by developing and maintaining a technology roadmap for the PAM capability, tracking vendor software versions and end-of-life (EOL) dates, and planning for and executing version upgrades to ensure the system remains in a vendor-supported state.

· Disaster recovery (DR) readiness by conducting, at a minimum, annual failover testing to validate system resiliency and document all test results and remediation actions.

· Audit and compliance support for onboarded domains and systems by generating and providing detailed audit reports of privileged session activities, access histories, and credential usage to assist with data calls and inquiries in a timely manner.

· Tier 3 Helpdesk support to coordinate with IT resource owners and Army Enterprise Service Desk (AESD) to resolve Helpdesk tickets and maintain a knowledge base of common issues and resolutions.

4.1.5 Deliver Audit Capability

The Army requires support for SOC1 audits for both the ICAM capability and the established ICOFR IT system owners. The contractor shall:

· Identify, refine, and streamline processes and internal controls to comply with Federal, DoD, and Army regulations for auditing requirements.

· Annually update and maintain ICAM SOC1 audit artifacts

· Prepare for and provide ICAM SOC1 walkthroughs

· Identify vulnerabilities that need to be corrected to achieve an unqualified (clean) finding.

· Monitor, assess, and remediate deficiencies to promote process improvements that support operational and audit requirements.

· Identify, refine, and streamline processes and internal controls to comply with Federal, DoD, and Army regulations for ICOFR and auditing requirements.

4.2 Task 2: Modernize Army ICAM Capabilities (CLIN 0002)

The Army ICAM capability must rapidly deliver ICAM services that provide fine-grain access controls for IT resources across cloud, on-premises, and tactical systems (when connected) to enable Zero Trust concepts across the Army Unified Network. The contractor shall develop and deliver modernization increments of the ICAM system in iterative, well-defined elastic agile delivery cycles.

4.2.1 Modernize AMID in cArmy

The Army Identity as a Services enterprise cloud directory must continually evolve to enable relying party IT resources in an elastic agile method, to govern logical access control for all DoD CAC holders and Army non-CAC eligible mission partners. The contractor shall:

· Deliver non-proprietary connections to receive, collect, and disseminate authoritative PE and NPE ICAM data from multiple repositories (including but not limited to databases, policy information points, data tags, etc.) to cloud, on-premises and tactical directories when connected.

· Deliver non-proprietary connections, normalized data formats and synchronization processes with authoritative systems (i.e., internal/external) to receive PE and NPE identity attributes used for logical access control and auditing purposes.

· Deliver connections to authorized relying party applications and local area network directories requesting ICAM data as required.

· Modernize non-proprietary connections, data formats, and synchronization processes with the Army ICAM Portal for Sponsor Management of Army non-CAC eligible users and MFA registration of devices (i.e., YubiKeys, mobile devices).

· Deliver application-specific views of distributed PE and NPE identity attributes for authentication, authorization, auditing, and compliance.

· Establish federation with other DoD Components/Services across all classification levels. Modernize registration and credentialing of PE and NPEs to include but not limited to AI, ML, and RPA technologies.

· Modernize sponsorship capability for PE and autonomous NPE capabilities that operate on the network (e.g., AI, ML, RPA technologies) that automatically deactivates in accordance with policy, unless re-sponsored.

· Implement New Vendor Capabilities: Assess, pilot, and deploy new features or modules from the vendor. This includes developing the business case, testing the capability, and creating the operational runbooks for its eventual transition to continuous delivery.

· Enhance Automation and Code Artifacts: Develop and refine Infrastructure as Code (IaC) and Configuration as Code (CaC) artifacts to automate the onboarding of new platform types and the management of AMID policies, reducing manual effort and ensuring consistency.

· Execute Major Version Upgrades: Plan, test, and execute major version upgrades of the core AMID software and its components to leverage new features, address architectural changes, and mitigate obsolescence.

· Develop an Annual License Growth Forecast: Based on planned modernization, evolution, and onboarding activities, the contractor shall develop and deliver an annual license forecast report. This report should provide detailed technical justification for the recommended type and quantity of new licenses required to support the capability's growth for the next option year.

4.2.2. Modernize Enterprise IGA

The Army enterprise IGA solution requires agile releases (e.g., enhancements, integrations, deployments, implementations, etc.) to govern access control using users/group IT entitlements across cloud, on-premises, and support tactical environments when connected and all security classifications. The contractor shall:

· Implement the enterprise IGA solution using non-proprietary connections with the AMID, Army Enterprise IdP, and PAM capabilities that support IT resources hosted in the cloud, on-premises, or tactical environments when connected.

· Modernize Infrastructure as code (IaC) and configuration as code (CaC) with repeatable and automated build processes for all artifacts to be deployed across cloud and on-premises environments maximizing the use of the Army-provided code repository, build servers, continuous integration/continuous delivery (CI/CD) pipelines, and automated deployment pipelines where feasible.

· Establish multiple policy repositories, policy information points, and tagged data to form the basis of a tailored enforcement decision down to the lowest/smallest security boundary.

· Modernize automated account provisioning solutions for Joiners (new identities), Movers (promotion, updated entitlement status, organization change/relocation, etc.), and Leavers (deactivated identities) for online requests, approvals and recertifications required to grant access to IT resources.

· Modernize automated access control solutions that support enterprise role-based access control (RBAC), attribute-based access control (ABAC), behavior-based access control (BBAC), and risk-adaptable access control (RAdAC) for PEs.

· Enhance existing or develop new access management solutions to govern NPEs to include, but not limited to AI, ML, and RPA technologies.

· Define, analyze, and implement automated solutions for IT systems owners addressing FIAR issues for Identity Governance and Administration (IGA).

· On-board IT resources to the Army enterprise IGA capability as directed by the Army for IT system owners to address FIAR issues.

· Establish modern automated policy-based governance and administration that enables IT system owners to enroll and manage PE and NPE permissions/entitlements to incorporate Zero Trust principles with least privileged concepts.

· Implement New Vendor Capabilities: Assess, pilot, and deploy new features or modules from the vendor. This includes developing the business case, testing the capability, and creating the operational runbooks for its eventual transition to continuous delivery.

· Enhance Automation and Code Artifacts: Develop and refine Infrastructure as Code (IaC) and Configuration as Code (CaC) artifacts to automate the onboarding of new platform types and the management of IGA policies, reducing manual effort and ensuring consistency.

· Execute Major Version Upgrades: Plan, test, and execute major version upgrades of the core IGA software and its components to leverage new features, address architectural changes, and mitigate obsolescence.

· Develop an Annual License Growth Forecast: Based on planned modernization, evolution, and onboarding activities, the contractor shall develop and deliver an annual license forecast report. This report should provide detailed technical justification for the recommended type and quantity of new licenses required to support the capability's growth for the next option year.

4.2.3. Modernize Enterprise PAM

To maintain a superior cybersecurity posture against an evolving threat landscape, the Army's enterprise PAM capability must continuously modernized. The proliferation of new technologies, expansion into multi-cloud and tactical environments, and the adoption of automated development practices require that the Army’s PAM capabilities evolve to protect its most critical assets. Modernization efforts will focus on expanding the capability's reach, integrating with other enterprise security services, automating manual processes, and leveraging new vendor-provided features to enhance security and operational efficiency. The contractor shall:

· Onboard New Systems and Environments: Plan, coordinate, and execute the onboarding of new Army domains, applications, platforms (e.g., databases, network devices, cloud services), and other IT resources into the PAM service. This includes discovery, requirements gathering, configuration of policies, and deployment of agents or connectors as required.

· Develop and Enhance Integrations: Develop, test, and implement new integrations or enhance existing ones with authoritative systems and enterprise services. This may include, but is not limited to, Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), IT Service Management (ITSM) platforms, and other cybersecurity tools to enable automated workflows and improve security posture.

· Expand Architectural Footprint: Design, build, and deploy PAM infrastructure components into new environments, such as additional cloud service providers, new on-premises data centers, or classified regions, to expand the reach of the enterprise service.

· Implement New Vendor Capabilities: Assess, pilot, and deploy new features or modules from the vendor (e.g., Endpoint Privilege Manager, Secrets Management for CI/CD pipelines, Cloud Entitlements Management). This includes developing the business case, testing the capability, and creating the operational runbooks for its eventual transition to continuous delivery.

· Enhance Automation and Code Artifacts: Develop and refine Infrastructure as Code (IaC) and Configuration as Code (CaC) artifacts to automate the onboarding of new platform types and the management of PAM policies, reducing manual effort and ensuring consistency.

· Execute Major Version Upgrades: Plan, test, and execute major version upgrades of the core PAM software and its components to leverage new features, address architectural changes, and mitigate obsolescence.

· Develop an Annual License Growth Forecast: Based on planned modernization, evolution, and onboarding activities, the contractor shall develop and deliver an annual license forecast report. This report should provide detailed technical justification for the recommended type and quantity of new licenses required to support the capability's growth for the next option year.

4.2.4 Surge Support

The Government may require surge support during the base period or any option period. surge support modifications shall be considered in-scope and shall be used to provide future capability to the Army ICAM Delivery contract in response to unforeseen or future requirements. The unforeseen or future requirements may be a result of, but not limited to, future technology changes, schedule changes, increased users/servers/applications and/or new Army, DoD or Federal Government guidance and requirements. Surge support is OPTIONAL and is not guaranteed. If the Government determines that an increased quantity of deliverables and/or support is required in the Army ICAM Delivery contract, the Government reserves the right to exercise the surge support option, and the Government reserves the right to exercise this option on multiple occasions within the base period or any option period.

Section 5 – Key Personnel Comment by Belcher, Stacey Lynn CIV USARMY CPE C2IN (USA): Review this section and change as needed by your team.

The Contractor shall provide a highly qualified workforce possessing the technical skills, management experience, and security clearances necessary to satisfy the requirements of this Performance Work Statement (PWS). The Government has designated specific positions as Key Personnel because their expertise and leadership are critical to successful mission execution, contract performance, and technical quality. The Contractor shall ensure these key positions are filled by qualified individuals who meet the defined standards, and the Contractor shall not substitute or relocate any designated Key Personnel without first coordinating with the Contracting Officer’s Representative (COR) and receiving the prior written approval of the Contracting Officer (KO) in accordance with the transition and substitution procedures outlined herein.

5.1 Program Manager:

The Program Manager serves as the primary point of contact for the KO and COR and is responsible for overall contract performance, cost, schedule, and the management of the contractor workforce. This position requires a minimum of ten (10) years of experience managing complex DoD or Army IT and systems engineering programs. The individual must hold an active Project Management Professional (PMP) certification and possess a current Secret security clearance.

5.2 Cyber Security Engineer III:

The Cyber Security Engineer III acts as the technical lead for all cybersecurity, compliance, and risk management efforts. This position requires a minimum of eight (8) years of experience in cybersecurity engineering, specifically in developing Risk Management Framework (RMF) packages and supporting Authority to Operate (ATO) requirements. The individual must possess an active DoD 8140.03 (formerly DoD 8570) Information Assurance System Architect and Engineer (IASAE) Level II or higher certification (such as a CISSP or equivalent) and hold a current JWICs/Top Secret security clearance.

5.3 System Engineer III:

The System Engineer III serves as the primary technical authority governing system architecture, engineering strategy, and technical integration across the operational networks. This position requires a minimum of eight (8) years of advanced systems engineering experience. The individual must hold a Master’s degree in a relevant engineering or computer science discipline (or possess equivalent specialized DoD experience) and maintain a current Secret security clearance.

Section 6 – Deliverables.

6.1 Deliverables and Contract Data Requirements List (CDRL)

The Contractor shall provide the deliverables listed in the table below to the Contracting Officer’s Representative (COR) and/or Contracting Officer (KO) in accordance with the specified schedule. All deliverables shall be submitted in electronic format (compatible with Microsoft Office or PDF via email or Government-designated repository) unless otherwise directed by the COR.

6.2 PERFORMANCE THRESHOLDS

The table below provides the performance objectives and the acceptable quality levels (AQL) for each task. The Government will monitor the Contractor’s performance under this contract in accordance with the Government’s Quality Assurance Surveillance Plan (QASP).

Failure to meet the critical Service Level Agreements (SLAs) or performance thresholds outlined below may result in negative Contractor Performance Assessment Reporting System (CPARS) evaluations and the application of contractual remedies as detailed in the QASP. Where applicable, tangible deliverables that fall below the outlined quality thresholds shall be re-performed at no cost to the Government.

· Automatically provision / deprovision all Army non-CAC users via Army Sponsorship business rules with standardized identity attributes

· Register DoD approved authenticators from the Army ICAM portal

· Establish connections with internal/external systems for identity attributes used for logical access control (including audit reporting)

· Provide authoritative ICAM data to relying parties for logical access control.

100% Demonstration

· Automatically provision / deprovision all Army non-CAC users via Army Sponsorship business rules with standardized identity attributes.

100% Demonstration

· Receive, collect, and disseminate (Push/Pull) authoritative NPE ICAM data with cloud and on-premises directories.

100% Demonstration