PWS - DCPDS Sustainment DRAFT.docx

PERFORMANCE WORK STATEMENT

For Defense Manpower Data Center (DMDC) Defense Civilian Personnel Data System (DCPDS) Sustainment

PERFORMANCE WORK STATEMENT

For Defense Manpower Data Center (DMDC) Defense Civilian Personnel Data System (DCPDS) Sustainment

1.0 INTRODUCTION

The Defense Civilian Personnel Data System (DCPDS) is the DoD human resources (HR) information system designed to support civilian personnel operations. DCPDS is a multifunction, web-based civilian HR information management and transaction processing system. The system supports over 900,000 civilian employee records (appropriated fund, non-appropriated fund, National Guard, and local nationals), and 1.5 million position records. It is a global system supporting users in Asia, the Pacific, Europe and North America on a 24-hour, 7-day-a-week basis. DCPDS uses a Commercial Off-The- Shelf (COTS) product (Oracle HR), customized for the Federal and Defense environments, to provide personnel transaction processing using Oracle Federal HR.

2.0 BACKGROUND

2.1 The Defense Civilian Personnel Data System (DCPDS) supports human resource (HR) system operations and improved business processes, with continuous implementation of new information technologies, consistently meeting cost, schedule, and performance goals. Network and system operations span worldwide, with 24/7 operations supporting six Department of Defense (DoD) and two non-DOD databases. The six DOD databases are the Air Force, Army, Navy, Defense Finance and Accounting Service (DFAS), Defense Logistics Agency (DLA), and National Guard (NG). The two non-DOD agencies are the Executive Office of the President (EOP) and the United States Agency for Global Media (USAGM).

2.2 DCPDS is a multifunction, web-based civilian HR information management and transaction processing system designed to improve and simplify personnel transaction processing, the delivery of personnel services, and retrieval of timely civilian workforce information. DCPDS supports over 900,000 civilian employees records and 1.5M position records. The core DCPDS COTS product (Oracle HR), customized for the Defense environments, provides personnel transaction processing using Oracle Federal HR. In support of customizations and usability, enhancements were made to the COTS product to support the DoD’s diverse work force, including appropriated fund, non-appropriated fund, local national and National Guard employees. Included in the appropriated fund category are General Schedule, 11 demonstration projects and alternate personnel systems. DCPDS supports numerous legislative Titles including Title 5, 10, 20, 28, 29, 32, 33, and 38. There are 11 modules customized to support 18 foreign countries that are multi-lingual and have multiple currencies. With over 500,000 process rules and 1.75M pay and benefit algorithm combinations, DCPDS sustains a complex set of personnel data that interfaces with the DoD payroll system. DCPDS also maintains over 40 interfaces to external systems and databases. DCPDS provides personnel transaction and employee information capability that supports strategic decision-making to management and leadership. DCPDS provides civilian personnel management information down to the desktop of managers and supervisors, and offers self-service capability related to the performance appraisal process and other data that can be accessed and updated by all DoD civilian employees.

2.3 DMDC is responsible for the program management of DCPDS and the Defense Civilian Personnel Advisory Service (DCPAS) is responsible for DoD business activities (policy and functional support) of DCPDS. DMDC/DCPAS will provide required coordination with DCPDS Components that utilize DCPDS. The Government is responsible for GFE hardware, software warranties, and software licenses and maintenance costs. Based on changing program requirements, vendor options, and evolving technologies, the DCPDS hardware and software architectures may change over the life of this contract and the Contractor shall provide technology refresh support. The Contractor shall be responsible for maintaining the GFE asset inventory and working with the Government to ensure the accuracy of this inventory.

2.4 The Defense Civilian Personnel Advisory Service under the authority, direction, and control of the Under Secretary of Defense for Personnel and Readiness provides civilian personnel policy support, functional information management, and civilian personnel administrative services to DOD components and their activities.

2.5 Information Technology & Network Environment.

The DCPDS Production and System Qualification Test (SQT)/User Acceptance Test (UAT) environments resides in the Oracle Cloud Infrastructure (OCI) Infrastructure as a Service (IaaS) and the DCPDS Development, Development/Test, and Production-Level Training environments reside in San Antonio, Texas. The Contractor shall provide hosting support for the DCPDS development, test, and training environments. The DCPDS development, test, and training environments currently reside in San Antonio, TX. There will be no government provided office or computer space. A representation of the DCPDS enterprise production architecture in the Oracle Cloud Infrastructure (OCI) and servers at Appendix A and A1. DMDC is in the process of migrating DCPDS to the Oracle Software as a Service (SaaS) Cloud environment. DCPDS should reach Final Operating Capability (FOC) in the SaaS Cloud within the next two years. DCPDS OCI currently consist of enterprise applications:

· Reduced Sign-On (RSO) – Production and SQT

· DCPDS - 8 Production, 1 SQT

· Production (see paragraph 2.1 for list)

· DoD Component Specific (6)

· Non-DoD Component Component Specific (2)

· SQT – Single Combined DCPDS

· MyBiz+

· MyPerformance

· Corporate Management Information System (CMIS)

· Current Record Mart (CRM)/Non-DoD CRM (NDCRM)

· SAP Business Intelligence/Business Objects (BOBJ)

· External Interface Transfer System (EXITS) The core DCPDS COTS product (Oracle HR), customized for the Defense environments, provides personnel transaction processing using a federalized version of Oracle E-Business Suite. Significant customizations and usability enhancements were made to the COTS product to support NSPS, DCIPS, and NG performance appraisal applications. There are 11 modules customized to support 18 foreign countries that are multi-lingual and have multiple currencies. With over 500,000 process rules and 1.75M pay and benefit algorithm combinations, DCPDS sustains a complex set of personnel data that interfaces with the DoD payroll system. DCPDS also maintains over 40 other interfaces to external systems and databases.

DCPDS provides personnel transaction and employee information capability for DoD and corporate information that supports strategic decision-making to DoD management and leadership. The Corporate Management Information System (CMIS) provides consolidated information covering all DoD employee records on a single server. CMIS provides accessibility for DoD managers, with high accuracy of DCPDS corporate data enhanced through the use of a data warehouse, data marts, and information presented in readily understandable “dashboard” format. DCPDS interacts with other information systems via interfaces or direct data feeds most importantly as the HR data interface with the Defense Civilian Pay System (DCPS). Over forty interfaces are in use with others are under development. DCPDS provides civilian personnel management information down to the desktop of managers and supervisors, and offers self-service capability related to the performance appraisal process and other data that can be accessed and updated by all DoD civilian employees.

3.0 OBJECTIVE/SCOPE

The objective of this contract is to manage and support the operation, maintenance, versioning and upgrade of the Defense Civilian Personnel Data System (DCPDS) throughout its entire lifecycle. The contractor shall include best practices, techniques and procedures essential to the applications operation, performance and efficiency. The scope includes the operations, sustainment, and maintenance of the following DoD and non-DoD Components: DoD – Air Force, Army, Navy, Defense Finance and Accounting Service (DFAS), Defense Logistics Agency (DLA), and National Guard (NG) and Non-DoD – agencies are the Executive Office of the President (EOP) and the United States Agency for Global Media (USAGM). Also included in the scope are the applications/systems listed below:

· Reduced Sign-On (RSO) – Production and SQT

· DCPDS - 8 Production, 1 SQT

· Production (see paragraph 2.1 for list)

· DoD Component Specific (6)

· Non-DoD Component Component Specific (2)

· SQT – Single Combined DCPDS

· MyBiz+

· MyPerformance

· Corporate Management Information System (CMIS)

· Current Record Mart (CRM)/Non-DoD CRM (NDCRM)

· SAP Business Intelligence/Business Objects (BOBJ)

· External Interface Transfer System (EXITS)

4.0 SPECIFIC TASKS

The Contractor shall provide support for the tasks described below:

4.1 TASK 1 – PROJECT MANAGEMENT (FFP)

The contractor shall provide management expertise, oversight, control, and direction in team building, communications, time management, quality assurance and quality control, procedure development, risk management, configuration management, and software integration. An Agile-based, holistic approach to project management is critical to DMDC’s mission as it provides enhanced visibility throughout the lifecycle of a project. Project Manager shall have subject matter expertise for DevSecOps practices and tooling.

4.1.1 Provide a Project Management Plan (PMP) that establishes the framework for project planning, scheduling, communications, and reporting following DMDC’s Project Management Business Process (Appendix B). The PMP shall identify and assign tasks, major milestones, estimated dates, dependencies and indications of critical path and the integrated Master Schedule (IMS) that outlines planned spring schedules. The PMP shall include the: status; statistics; risk and mitigation review; critical path; milestone progress checks and updates; and be reviewed during regularly scheduled meetings; (i.e., Monthly Status Reports, Plan Review, Schedule Review, and stakeholder reporting). The PMP is a living document that evolves as the project progresses. The Contractor shall update the PMP with the latest, relevant information as soon as practicable. The Draft PMP will be submitted with 45 days of award to the contract Program Manager and COR. Final submitted with (10) days after receipt of government review.

4.1.2 Create and maintain an integrated master schedule (IMS) in DMDC’s Project Center. The schedule shall identify tasks, major milestones, estimated dates, and dependencies. A schedule shall be developed, reviewed, and revised for each build and sprint with schedule updates on a weekly basis in DMDC’s Project Center. The Contractor shall submit each project schedule and change to the Government for approval and shall only proceed once the Government has explicitly approved. The schedules shall have a minimum of five Work Breakdown Structure levels for their activities. The Draft IMS will be submitted within 45 days of award to the contract Program Manager and COR.

4.1.3 Maintain DMDC’s SharePoint collaboration site. The Contractor shall create and/or maintain a collaboration site within DMDC’s SharePoint environment including at least the following information:

· A project documentation library that preserves the history of each document

· Product release notes and information sheets

· Links to necessary schedules, dashboards, and test plans

· Up-to-date assignment and contact lists for each product and project

· Agenda and summaries for all meetings or conferences attended, as well as meeting minutes for all DMDC IPRs, MSRs, or other events.

The contractor will update the SharePoint site 10 days after award and the SharePoint site will be updated within 2 days of subsequent changes.

4.1.4 Coordinate with DMDC directorates and governance bodies as outlined in DMDC Business Process Re-Engineering (BPR)(Appendix K) and standard processes in order to optimize the workflow, automation, manual processes (where necessary), and feedback loops across the DMDC environment. Adhere to all current DMDC Business Process Re-Engineering (BPR) workflows, requirements, and tool usage. Current BPR tools and processes include SPARX Enterprise Architect, Microsoft Project Server, Service Now, and Incident Management.

4.1.5 Develop, maintain, enhance, and revise all required program and project documentation. The contractor shall prepare agenda and summaries for all meetings or conferences attended, as well as meeting minutes for all DMDC IPRs, MSRs, or other events. The documentation will be submitted within 30 days of contract award to the contract Program Manager and COR. Updates to the documents will be provided 10 days after document changes have been identified.

4.1.6 Maintain the DCPDS SharePoint site that provides authorized DCPDS Component users with a complete and current set of DCPDS-related files. The site shall include, at a minimum, files that relate to DCPDS patches and upgrades. The DCPDS SharePoint site will be updated 10 days after award and updated within 2 days for subsequent changes. Changes to this website shall be coordinated with the Program Manager prior to release.

4.2 TASK 2 – OPERATIONS & MAINTENANCE (O&M) (FFP)

4.2.1 Provide all phases of software maintenance as defined in ISO/IEC 14764 and DMDC Software Delivery Lifecycle Handbook (Software Management) (Appendix C) and DMDC Coding Standards (Appendix D). DCPDS applications require Operations and Maintenance (O&M) solutions, processes, and procedures to sustain the suite of software applications at the highest levels in terms of security, service and availability, schedule, and performance objectives. For purposes of this PWS, sustainment is defined as those tasks required to maintain a baseline of reliability, availability, and relevance in relation to the environment in which it is deployed. Software sustainment encompasses all aspects of supporting, maintaining, and operating the software aspect of a system to include corrective, adaptive, preventive, and perfective modifications. Software sustainment also addresses other issues included in maintenance such as operations, documentation, deployment, security (e.g., scans, patching known vulnerabilities, etc.), configuration management, user and operator/administrator training, analysis, and user support. The contractor shall support the following activities:

· Login with Reduced Sign-On (RSO)

· Self-service applications of MyBiz+ and MyBiz+ for HR Professionals

· Performance management with Defense Civilian Intelligence Personnel System (DCIPS) and DPMAP (MyPerformance)

· Warehouse processing and Business Objects (BOBJ)/Structured Query Language (SQL) reporting for CMIS, Current Record Mart (CRM), and Non-DoD CRM (NDCRM)

· Reduction in Force (RIF) Tool that supports Code of Federal Regulations, Part 351.Title 5 and Adjustment in Force (AIF) Title 10

· HR transactional processing on a customized version of the Federal Oracle Enterprise Business Suite (EBS) using complex federal and DoD custom business processing rules and pay/benefit algorithms, including APPR/LN/NAF/AGR/EXT/MIL position types, demonstration projects, and DoD Enterprise Program Areas (DEPA) processing

· External user interfaces with interface monitoring to exchange data with over 40 external systems and databases

4.2.2 Develop and maintain a Software Maintenance Plan (SMP) that provides insight and a tool for monitoring the processes and defines the steps by which the development and maintenance of software is accomplished. The SMP shall address software processes, methods, organizational responsibilities, tools, configuration management, software quality, and metrics. Sustainment includes addressing issues driven by routine software upgrades, configurations, correcting defects reported by users, applying new functionality and/or remediation mandated by policy and security guidelines, and associated testing. The Draft SMP will be submitted within 45 days of award to the contract Program Manager and COR. The final SMP submitted within ten (10) days after receipt of government comments. The SMP shall:

· detail methods and an approach to be followed for each activity

· document all processes applicable to the system at a level of detail sufficient to allow the use of the plan as the full guidance for the developers

· describe how sustainment metrics will be achieved and sustained throughout the lifecycle

· describe the sustainment risk areas and develop the mitigation plan

· document the product support implementation status

4.2.3 Maintenance shall include analysis of problems and resulting impact to records across regions, preparation of resource estimates and schedules to effect necessary changes, design and code changes, conduct unit testing of all changes, DoD and legislative changes, update of all documentation and coordination of change implementation through appropriate approvals and user notifications.

4.2.4 Create and update product technical documentation with every release. Technical documents shall include but not limited to a list of schema changes, functional and technical specifications, user stories, and requirements traceability matrix.

4.2.5 Maintain a master list of current versions and location of all artifacts. Maintain designs and specifications on the document repository (SharePoint). The contractor shall document all changes or enhancements in the DMDC issue-tracking tool. Review audit readiness documentation annually.

4.2.6 Utilize agile development methodologies to include sprint planning, application design, development and testing, deployment, sprint review, and sprint retrospective. Software development lifecycle shall focus on the repetition of abbreviated work cycles and functional requirements. Using this methodology, the Contractor shall manage all required activities including, but not limited to:

· Create acceptance criteria

· Develop automated test scripts

· Create design

· Write code components

· Create/update/run unit tests

· Create/update/run functional qualification tests

· Create/update/run regression tests

· Conduct code review

4.2.7 Implement software metrics that provide management visibility into the software development process and progress. The contractor shall apply core software metrics as defined in the Software Maintenance Plan (see paragraph 4.2.2), as a minimum and selected metrics shall clearly portray variances between actual and planned performance. Provide early detection or prediction of situations that require management attention and shall support the assessment of the impact of proposed changes on the program.

4.2.8 Improve software maintainability, such as software re-structuring, re-engineering, reverse engineering, and forward and backward compatibility.

4.2.9 Support periodic major upgrades/releases to application software, operating systems and firmware.

4.2.10 Testing

4.2.10.1 Conduct application and vendor testing of changes applied to the DCPDS Enterprise System. The test process shall include development of test plans, defect management and resolution leveraging existing test plans. Support and participate in DMDC’s test readiness reviews.

4.2.10.2 Execute test cases using a test data population to address scaling and conduct regression testing for functional areas directly relating to code changes within each release.

4.2.10.3 Conduct performance testing to measure the impact of system changes that impact performance prior to release. Test artifacts are in Micro Focus Application Lifecycle Management (ALM – Quality Center edition) to facilitate defect management.

4.2.10.4 Analyze changes to identify risks, determine test conditions, and create test cases. Outputs shall include test cases linked to the ticket; test sets, data setup, and configured environments.

4.2.10.5 Improve test cases and scenarios once code migrates to applicable test environments. Outputs shall include finalized test cases and scenarios, executed test runs for applicable environments, test reports, additional/modified regression tests, and reported test defects.

4.2.11 Defect Management

4.2.11.1 Analyze, prioritize, document, and disposition test defects. Outputs shall include routing documented issues to stakeholders for analysis review, closing defects after repair or determination that it is no longer an issue, validating defect resolution, or triaging defects for repair later.

4.2.11.2 Support FIAR requests. FIAR support shall require prioritization and delays in other on-going work. During FIAR Audits, support priority shall shift to FIAR activities. The Contractor shall support the following items based on the prioritization by the Product Manager:

· Provide data and reports to the Product Manager to prepare a Compliance Audit Support Plan and support external auditing efforts relative to determining the system’s compliance with federal laws, regulations and policies.

· Provide data and reports to the Product Manager to support Financial Improvement and Audit Readiness (FIAR) efforts to include preparation of Statement for Standards Attestation Engagements (SSAE), financial audits, to meet the congressionally mandated deadlines to achieve fully auditable financial statements.

· Provide support and successfully complete initiatives; analyze current business processes and identify best practices for developing and maintaining compliant and auditable financial information. Support and assist with OMB-123, Federal Information Systems Control Audit Manual (FISCAM) and Risk Management Framework audits. Develop and execute detailed audit readiness methodology, policy, and guidance; perform audit readiness assessments and provide recommendations on the effectiveness of Internal Controls (IC) and the status of the program.

· Support data calls from the Product Manager and provide documentation and demonstration of audit controls required to support DMDC application and systems control objectives. Evaluate and provide recommendations for the adjudication of Notification of Findings (NOF) and the development of Corrective Action Plans (CAP), which includes plans, method to manage resulting, identifying, tracking and verification of actions taken.

· Assist in preparation of Assertion Packages to achieve audit readiness in accordance with DoD FIAR methodology and requirements.

· Provide recommendations to Government to improve client internal controls, accounting procedures, and financial statements. Perform analysis of business processes and internal controls to identify risks. Identify and devise new or revised policies and procedures as well as business process improvements that address significant impediments to auditability.

· Coordinate with Product Manager to provide information and demonstrate compliance with controls mandated for system compliance. The contractor shall provide information as needed in real-time or near real-time about system areas, which may have potential vulnerabilities/violations.

· During periods of examination, contractor shall provide material and personnel support to produce necessary digital artifacts as deliverables to the DMDC/IPA according to expected General Audit Criteria (see below) as agreed upon with DMDC to support IPA engagement and IPA deliverable timelines.

· General Audit Criteria as described by the IPA: AICPA Statement on Standards for Attestation Engagements (SSAE) 18 (includes AT-C Section 320), GAO Federal Information System Controls Audit Manual (FISCAM), GAO Generally Accepted Government Auditing Standards (GAGAS), and GAO Financial Audit Manual (FAM)

4.2.12 Web Services

Maintain the DCPDS SharePoint website that provides authorized DCPDS Component users with a complete and current set of DCPDS-related files. Changes to this website shall be coordinated with the Government Product Owner prior to release.

4.2.13 Business and Systems Analysis

4.2.13.1 Collaborate with stakeholders to formulate and communicate requirements; prepare a business requirements document (BRD) that details the solution documenting customer needs and expectations. Conduct requirements and design walkthroughs, including demonstrations or training for new functionalities or program changes, for both internal and external customers. Sessions are virtual but may occasionally entail face-to-face meetings.

4.2.13.2 Translate requirements to design modifications maintaining the integrity of the product’s design, develop user scenarios and interfaces.

4.2.13.3 Create data flow diagrams, perform data standardization and perform enterprise modeling, functional economic analysis, simulation/modeling, activity based costing and activity based management support.

4.2.13.4 Perform functional analysis to ensure requirements compliance, identify problems, correctly attribute them to automated processes and/or submission data, and develop solutions.

4.2.13.5 Provide on-going transaction analysis of external interfaces in terms of quantity and quality (error rates and types). This shall be included in the Monthly Status Report (MSR)

4.2.13.6 Respond to ad hoc research requests to include, performing special studies, conducting data research, and responding to inquiries (internal and external) about DCPDS applications.

4.2.14 Configuration Management (CM)

DCPDS Configuration Management utilizes several Configuration Management Databases (CMDB) to identify configuration items, manage baselines and perform status accounting.

4.2.14.1 Maintain and identify configuration and change control of DCPDS versions including hardware, software applications, contract deliverables, and enterprise services. Ensure activities resulting in baseline changes to the system or documentation are coordinated with and approved by DMDC prior to execution.

4.2.14.2 Support technical information baselines in accordance with change management processes, which shall ensure full control and accounting of DCPDS artifacts and information.

4.2.14.3 Identify configuration items for hardware, network, COTS software, and developed application software.

4.2.14.4 Manage changes to the enterprise baseline utilizing an approved version control system for application development and asset management spreadsheets for all Government-owned assets. Conduct status accounting to ensure accuracy of changes through audits and provide reports to DMDC as needed.

4.2.14.5 Evaluate changes by assessing risks/impacts to the enterprise system, and executing deployment of changes across the enterprise.

4.2.14.6 Update the existing Configuration Management (CM) Plan or create the CM Plan if it does not exist. The CM plan will be submitted within 45 days of award to the contractor Program Manager and COR. Final CM plan submitted with ten (10) days after receipt of government comments. The plan shall address the following:

· Configuration management

· Change management

· Release and Deployment management

· Problem tracking

· CM tools

4.2.15 Mass Pay

4.2.15.1 Support Mass Pay processing according to prioritization from the Government. As a high priority requirement, other non-mass pay related efforts with conflicting timelines within the configuration management area maybe shifted until the associated mass pay events have completed.

4.2.15.2 Participate in the Mass Pay events and Mass Pay Integrated Project Teams (IPTs).

4.2.15.3 Provide input to the Mass Pay communication plan and final executive summary plan.

4.2.15.4 Perform sample testing on custom pay tables.

4.2.16 Retroactive Mass Pay

Support Retroactive Mass Pay processing according to prioritization of tasks from the Government. As a high priority item, other non-retroactive mass pay related efforts with conflicting timelines within the configuration management area may shift. Support sample testing on custom pay tables.

4.2.17 Baseline Management

4.2.17.1 Create baseline reports monthly aligned to the quarterly release schedule. The baseline reports will be submitted to the contract Program Manager and COR.

4.2.17.2 Prepare ReadMe documentation for both U-Patches and code releases at the beginning of SQT and the final provided two (2)-weeks prior to production. The ReadMe documentation will be submitted to the contract Program Manager and COR.

4.2.17.3 Conduct impact assessments for Change Request additions/deletions to planned releases or out of cycle .dot patches on an ‘as request’ basis. As a high priority item, other non-related efforts with conflicting timelines within the configuration management area shift.

4.2.18 Release Planning and Deployment Management

The Government provides a DCPDS Patch Release Procedures and Approval Process (Appendix E) to assist in understanding the workload associated with patch release.

4.2.18.1 Develop a Release Management Plan and coordinate builds with technical stakeholders, facilitate mock builds and provide support during Production Readiness Reviews based on prioritization of tasks by the Government. The Release Management Plan will be submitted with 30 of award to the contract Program Manager and COR. The plan shall at minimum include:

· Timelines

· Delivery dates

· Requirements

· The overall scope of the project

4.2.18.2 Deploy releases on a quarterly basis and create a deployment checklist to manage application of releases to production.

4.2.18.3 Deliver SQT code promotions biweekly on every other Monday; U-patches bi-weekly with pay-tables following the release schedule at for submittal. Dev/Test (DT) promotions for U-patches shall be Tuesdays and Thursdays and SQT would occur on Thursdays.

4.2.18.4 Release dot patches for Severity 1 and 2 tickets. Dot patches shall be evaluated, coordinated and prioritized during the Release Planning and Prioritization forum.

4.2.18.5 Deliver release notes that detail the functional changes for each software release and cross-reference changes to the requirements management tool (i.e., JIRA) using the requirements identification numbers. Provide a draft of the release notes to Government Program Manager for review at the start of testing and finalize prior to running the release in production.

4.2.18.6 Install and test patched changes of customized Oracle code

4.2.18.7 Conduct releases of time-sensitive system changes within 15 days. The government historically conducts one (1) time-sensitive change monthly.

4.2.18.8 Conduct releases for List of Values (LOV) and Pay Table updates weekly but occasionally the update is required within 48 hours of receipt.

4.2.18.9 Provide a Software Upgrade Plan for components monthly. Component operations require 120 days’ advance notice for software upgrades. The Software Upgrade Plan will be submitted to the contract Program Manager and COR monthly, the last duty day of the month.

4.2.19 Systems Engineering

4.2.19.1 Conduct software engineering studies and analyses. Objectives of improvements may be in the areas of maintainability, performance, reliability, extensibility, scalability, functionality, usability, or quality of developed code.

4.2.19.2 Provide all required design and development documents and supporting architectural documentation in compliance with the latest Department of Defense Architectural Framework (DoDAF) Enterprise Architecture guidance, described at: http://dodcio.defense.gov/Portals/0/Documents/DODAF/DoDAF_v2-02_web.pdf. The contractor will provide the draft design and development documents 45 days of contract award to the contract Program Manager and COR. Updates will be submitted within 30 days of changes.

4.2.19.3 Maintain the DCPDS Systems Architecture baseline and any changes, environments include the OCI IaaS (Production and SQT), and the Development, Test, and Training at their hosting site... This includes maintaining architecture diagrams, rack elevations, and hardware and software lists. The initial Architecture Diagrams will be submitted within 45 days of contract award to the contract Program Manager and COR. Updates will be submitted within 30 days of changes.

4.2.19.4 Develop and maintain Technical Implementation Plans (TIPs) for significant architecture changes, managing the internal and external network configurations, conducting life cycle replacement planning, and performing project management for technical projects that change the DCPDS architecture. The TIPs will be submitted as needed by the government to the contract Program Manager and COR.

4.2.19.5 Participate in the DCPDS Engineering Review Board (ERB), conduct hardware and software technical refresh analysis, review, and recommendations.

4.2.19.6 Participate in the DMDC Architecture Review Board (ARB), as needed, to support approval requests for DCPDS system or tools architecture improvement or changes.

4.2.20 Cybersecurity/Information Assurance (CYBER/IA)

DOD RMF describes and delineates distinct roles and responsibilities within the RMF process. There is a clear distinction of the responsibilities for the Information System Security Officer/ Information System Security Manager (ISSO/ISSM), Independent Verification and Validation (IV&V) and the Product Owner. The Service Delivery (SD) Directorate manages the requirements and deliverables in this section.

4.2.20.1 Provide diverse Cybersecurity and Information Assurance (IA) services that enforce, comply with, and support the DoD, DISA and DHRA cybersecurity and IA security directives and DoD Instruction 8510.01 Risk Management Framework (RMF) assessment and authorization processes to be able to obtain an Authority to Operate (ATO). The contractor shall ensure that all personnel performing IA activities obtain and remain current with required technical and management certifications.

4.2.20.2 Support Cyber Security within the software development process and ensure all development practices follow the rules, regulations and best practices identified in DoD 8500.1, NIST SP800-53r4, DISA STIGs & SRGs and DMDC Information Management Operating Procedures.

4.2.20.3 Develop and maintain a security plan for assigned information systems (IS) and platform Information Technology (PIT) systems. The initial Security Plan will be submitted within 45 days of contract award to the contract Program Manager and COR. Updates to the documents will be provided 10 days after document changes have been identified.

4.2.20.4 Perform code remediation activities to ensure compliance. Upon mitigation create and update the necessary supporting documentation.

4.2.20.5 Support the maintenance of the system's baseline configuration, performing regular IA assessments, installation of patches, ensuring IAVA compliance, performing system hardening in accordance with Security Technical Implementation Guides (STIGs), and maintenance of the system’s security posture and documenting within Vulnerability Management System (VMS) and/or other vulnerability tracking mechanisms in coordination with the Government. Assessments shall utilize a variety of validation tools including, but not limited to, STIGs and associated RMF documentation to include test reports, Plan of Action and Milestones (POA&M), IA Controls, Scorecard and System Security Plans (SSP) as required for IA Maintenance for each Cyber Security program/project applicable.

4.2.20.6 Provide documentation and confirm that application code changes comply with the DoD system security policy and are properly certified and accredited in accordance with DODI 8510.01 Risk Management Framework (RMF). Provide engineering, cyber security and IA services consistent with established disciplines and best practices for effective systems engineering, systems security engineering, and program protection planning outlined in DoDI 5000.02.

4.2.20.7 8510.01 Risk Management Framework (RMF). Provide engineering, cyber security and IA services consistent with established disciplines and best practices for effective systems engineering, systems security engineering, and program protection planning outlined in DoDI 5000.02.

4.2.20.8 Support the RMF Certification and Accreditation process. Final approval for all IA tasks under this call belongs to the Information Assurance Officer, Cybersecurity Branch. The contractor shall obtain final approval from Cybersecurity. All IA-related design decisions, including cryptography, authentication, access control, data transfer and storage, Need-to-Know (NTK), or other IA technologies, must be coordinated with and approved by the cognizant representative of the Cybersecurity Branch.

4.2.20.9 Monitor Application Authorization to Operate / Authorization to Connect (ATO/ATC) status through eMASS and maintain a schedule of actions and timelines needed to obtain and sustain system/application authorization.

4.2.20.10 Communicate with product owners and development teams on what is required to obtain an ATO (e.g. System Descriptions, System Security Plan, local and inherited security controls, current scans, eMASS entries, etc.) identify gaps in eMass instances.

4.2.20.11 Create and maintain entries within established eMASS instances for applications with required artifacts and evidence of compliance associated to the relevant Common Control Identifier (CCI) security controls.

4.2.20.12 Load ACAS associated to necessary controls; provide compliance with DoD Hardening efforts, load SCAP, Sonatype, Fortify Code and HBSS Scans, and connect to necessary controls in eMASS.

4.2.20.13 Develop STIG/Control crosswalk documentation to application functionalities to determine how those controls affect the application; upon mitigation take supporting documentation and screenshots and update the associated controls and Plan of Action and Milestones (POA&M) in eMASS.

4.2.20.14 Maintain currency of POA&M entries in eMASS and report on POA&M statuses. Create justification for non-compliant controls and define resolution.

4.2.20.15 Identify efficiencies and employ available and approved procedures or templates for repeatable methods for any shared requirements across applications.

4.2.20.16 Support the utilization of the automated validation capabilities of the eMASS for preparation of the RMF Package. Assist in developing or updating the “Security Package” for each system prior to major system releases.

4.2.20.17 Provide technical input in responding to POA&M items by identifying the system changes that may be required to correct and address security weaknesses.

4.2.20.18 Identify potential program, system, and engineering risks that pertain to cybersecurity; and participate in and support the development of risk mitigation plans and monitoring of risk mitigation activities.

4.2.21 Cybersecurity Workforce Certification

DFARS clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty. C.8.7.2.1. The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date.

Contractors will obtain all required Computing Environment (CE) certificates within 6 months of award.

The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and renewed prior to expiration.

4.2.22 Application Security Plan (ASP)

4.2.22.1 Develop, document, and periodically update an Application Security Plan (ASP) and any associated plans of action developed to satisfy the adequate security requirements of DFARS 252.204-7012, and in accordance with NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. The ASP shall describe the Contractor’s unclassified information system(s)/network(s) where covered defense information associated with the execution and performance of this contract is processed, is stored, or transmits.

4.2.22.2 Provide a monthly report that includes the status of the ATO for cloud environment, the ATD for the ATO, current control numbers, status of documentation submitted in eMASS, status of PPS and whitelist requirements by application. The Service Delivery POC will identify any additional requirements for this report. (See Appendix F)

4.2.23 Problem Report (PR), System Change Request (SCR), and Change Request Transmittal (CRT) Tracking Capability

4.2.23.1 Maintain a PR/CRT/SCR tracking system(s) to meet the following requirements:

· all production PRs, CRTs, and SCRs, including those against the systems qualification test (SQT) environment

· unique tracking numbers for each PR, CRT and SCR

· access to the tracking system for view and update

· Generate notification of actions to be taken

· Generate standard and ad hoc reports

· attachments (documents, screenshot images, links) to specific PRs/CRTs/SCRs

· audit trail of actions taken or pending

4.2.23.2 Include adequate security (access control, user accounts and passwords) and provide the following to support application sustainment and maintenance:

· Periodic major upgrades/releases to application software, operating systems and firmware;

· Software patches/repairs as appropriate;

· Releases of customized Oracle code (the Contractor will test and install patched changes);

· Release of time-sensitive system changes within 15 days (for planning purposes, there is an average of only one time-sensitive change per month); and List of Values (LOV) updates and pay table updates released weekly. The Government may require updates

4.2.24 Problem Reports (PR)

Problem reports (PRs) are currently rated from Severity Level one (Sev1) to Severity Level 4 (SEV4). Provide immediate notification for all Sev1 PRs and resolve within two days. Severity Level 2 (Sev2) PRs require immediate notification if they occur during the workday; if reported outside duty hours notify the DMDC Product Owner by 0800 CT the next business day. Sev2 PRs are to be repaired by the next regularly scheduled patch. Severity Level three (Sev3) PRs require no special notification, must include a workaround, and be repaired by the next regularly scheduled patch. Sev4 PRs require no special notification and must be resolved within 90 days. The Contractor shall maintain the PR level so that there are no more than 50 open PRs at the end of each quarter.

The Contractor shall research and correct functional application problems for severe problems (Sev1 and Sev2 PRs). The Contractor shall perform analysis and correction of application performance degradation. The Contractor shall identify records adversely impacted by problems related to code defects, provide record listing for customers, and apply fixes to the records. The Contractor shall update code where the application behaves inconsistently with the requirements provided and is causing a severe issue (Sev1/Sev2). The Contractor shall update data per data updates when the application has created erroneous data when it is causing severe problems (Sev1/Sev2). Analyze and correct Sev3 PRs based on prioritization from the Government Product Manager once Sev1/2 PRs have been resolved. Correct Sev4 PRs when all other severity level PRs have been resolved.

4.2.25 Change Request Transmittals (CRT)

Change Request Transmittals (CRTs) are required by DMDC or a DoD Component resulting from modified business practices or DoD Component regulatory, legislative, or cybersecurity changes. CRTs are regulatory or legislative changes required by Public Law, OPM, DoD policy or other directed authority. CRTs include data corrections, table updates, and code changes and have required delivery dates. Track CRTs in the contractor’s automated tracking system. The Government historically averages 58 CRT’s per month. The Contractor shall provide the following for system changes:

· Document all code, configuration, and version changes in the production environment

· Maintain software versions and releases on all server application environments

· Modify Oracle HR Federal functionality, including DoD unique and Federal requirements that are not met by the Oracle HR Federal product. Coordinate with Oracle Federal to ensure changes do not conflict with other customizations.

· Distribute, install, and test software upgrades and changes to each DCPDS environment

· Integrate all system changes into the production baseline

· Load software

4.2.26 Specific Operations & Maintenance Requirements/System Change Request (SCR) An SCR is new functionality requested by the components or DoD that is not resulting from a change to a Federal regulation and is typically requested to improve the operation of DCPDS either at the component level or as an enterprise solution.

Reference DHRA signed Memorandum dated 31 May 2018, subject: Defense Civilian Personnel Data System Cloud Migration. A moratorium is currently in place for all SCR submissions.

4.2.26.1 Corporate Management Information System (CMIS)/Current Record Mart (CRM) and Non-DoD CRM (NDCRM) CMIS/CRM/NDCRM are data warehouse systems, including data marts that use SAP Business Objects Web Intelligence as the standard query tool, and various direct SQL connections to the database. CMIS/CRM/NDCRM will eventually support up to 300 concurrent users. The CMIS/CRM/NDCRM database servers run a suite of data management tools and uses database to database transfers to receive transactions on individual records from the active Production DCPDS servers on a continuous basis. The feed is not required to be real-time, but will not extend longer than 48 hours behind the transactional system. CMIS/CRM/NDCRM receives data from DCPDS Production servers at all times. Should CMIS/CRM/NDCRM be taken off-line, or be saturated with transactions (exceeding current bandwidth), transactions will be queued for transmission and replayed after CMIS/CRM is brought back online. The Contractor shall be responsible for the following:

· Maintaining schema in sync with changes to DCPDS;

· Provide listing of schema changes for impact to CMIS user/outbound extracts;

· system operations and administration;

· User IDs for CMIS/CRM/NDCRM and CMIS/CRM/NDCRM Dashboards;

· data warehouse performance and query/database tuning;

· database administration;

· Business Objects Universe development and administration Database Schema will be submitted within 45 days of award to the contract Program Manager and COR. Updates scheme changes will be submitted as new schema changes are applied.

4.2.26.2 Contractor Assistance for Data Acquisition and Analysis Respond to data queries for both DCPDS and CMIS/CRM/NDCRM data to support complex queries requiring table joins and multiple algorithms.

4.2.26.3 Interfaces

DCPDS provides data through more than 40 interfaces to other Departmental and external systems. There are also inbound interfaces providing information that is loaded into DCPDS. A list of current interfaces can be found at Appendix G. The number of interfaces may increase/decrease over the life of the contract. The contractor shall:

· Sustain/develop interfaces and ensure interfaces meet DoD Cyber controls

· schedule, facilitate, monitor and verify and correct any issues related to the data transfer

4.2.26.4 Support the following items based on prioritization of the Government Product Owner:

· After Action Production Build Reports

· Functional and Physical Configuration Audits

· Performance Testing and Trend Analysis

· Assistance with DMDC SOPs The After Action production Build report will be submitted within 10 days after production releases and submitted to the contract Program Manager and COR.

4.2.26.5 Incorporate changes to tables in support of the maintenance of seeded tables, lists of values, and pay tables through the submittal of CRTs. Process pay table updates, and record script fixes within two (2) weeks following the U Patch schedule. Pay table updates, along with other table updates (e.g., Lookup Types) shall follow the release schedule for implementation planning. The Government estimates 15 to 20 CRTs per U Patch depending on the complexity and number of records affected. The government requires up to 40 record script fixes must be processed per month in addition to the 15/20 CRTs.

4.2.26.6 Implement legislatively mandated system changes. Coordinate with the Government to decompose, implement the changes and prioritize the schedule. Document legislative changes in vendor CRTs. The Government estimates ten (10) CRTs per release for legislative changes depending on the complexity of the code changes required.

4.2.26.7 Update application login screen with messages to the users to accommodate news announcements and notices. Process CRTs to upload documents to SharePoint. The Government estimates one (1) CRT per release for news announcements and one (1) CRT per quarter for SharePoint.

4.2.26.8 Maintain the Component DCPDS POC Help Desk Information available at the Component Help Desk Information “Contact List” link on the application login screen. The Government estimates two (2) per year at government’s request.

4.2.26.9 Support Retroactive Mass Pay processing according to prioritization of tasks by the Government. In the event that the Retroactive Mass Pay tasks are a priority that require a specific short timeline, the contractor shall provide an impact analysis to the Government to allow the Government to reschedule previously scheduled deliverables.

4.2.26.10 Support M2M processing according to prioritization of tasks from the Government. In the event that the M2M tasks (to include mocks, detailed analysis, and data fixes) are a…