PWS_DDSB_IT_Support_2025_May12 (1).docx

Department of Defense Defense Health Agency Performance Work Statement

Operations and Sustainment Information Technology (IT) Services

CIO & Program Executive Office – Medical Systems

(CIO & PEO MS)

Infrastructure and Operations Division (IOD) Domain and Directory Services Branch (DDSB)

Solicitation Number:

Version: 2.1 Date: 12 MAY 2025

Table of Contents

PART 1

GENERAL INFORMATION

Overview

This is a non-personal services contract to provide operations and sustainment Information Technology (IT) services. The Government shall not exercise supervision or control over the Contractor’s employees performing the services herein. The Contractor’s employees shall be accountable solely to the Contractor, who, in turn, is responsible to the Government.

Description of Services/Introduction

The contractor shall provide non-personal services necessary to perform IT operations, engineering, architecture, and sustainment support services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished equipment (GFE) and services. The contractor shall perform to the standards in this performance work statement.

Background

The Defense Health Agency (DHA) was created as a joint, integrated Combat Support Agency (CSA) that supports the delivery of integrated, affordable, and quality health services to Military Health System (MHS) beneficiaries. It is responsible for driving integration of clinical and business processes across the MHS through a shared-service strategy.

The Department of Defense (DoD) began a multi-year transition of military Medical Treatment Facilities (MTFs) from the military service departments to DHA for purposes of implementing an integrated system of readiness and health as required by Section 702 of the National Defense Authorization Act (NDAA) for fiscal year (FY) 2017 and updated in the FY 2019 NDAA. At the end of the transition, all DoD MTFs will be subject to authority, direction, and control (ADC) of DHA through DHA’s market-based management model. This ADC will include all Information Technology (IT) services and support capabilities, as well as the transition to DHA of existing and proposed operations support staff currently delivering those IT service and support capabilities under MTF control. The intention is to sustainably control and reduce operational costs by establishing rigorous control, accountability, traceability, and transparency with operational efficiencies gained through a large Enterprise shared-services model.

One of the directives given to the MHS was to deliver a single Electronic Health Record (EHR). The Defense Healthcare Management System Modernization (DHMSM) Program Management Office has the explicit mission to field this modernized EHR system, supporting an estimate 9.4 million beneficiaries and replacing MHS legacy systems to result in an intricate system of systems framework wholly dependent upon the underpinning and supporting data communications network and Enterprise services infrastructure, including data center(s), server hosting, and end-user platform capabilities.

The DHA IT Enterprise supports 1,212 physical buildings (CONUS and OCONUS) of which nearly half are inpatient and smaller clinics and ancillary treatment facilities, with the remainder being administrative or educational research installations. These inpatient and smaller clinics, and ancillary treatment facilities are broken down as: 55 Military Medical Centers and Inpatient Hospitals, 373 Health Clinics, 245 Dental Clinics, and 5 Theater Hospitals.

The DHA, CIO & PEO MS, Infrastructure and Operations Division (IOD), Domain and Directory Services Branch (DDSB) is chartered to operate and sustain the IT footprint and environments for the medical activities, Lines of Business (OLB) that are either associated with an MTF or provide additional supporting activities to the DHA mission, and mission partners such as the Department of Veteran Affairs. The stakeholder customer base supported by DDSB extends to DHA mission that operates worldwide 24x7x365.

DDSB IT Service Provider The Domain & Directory Services Branch seeks to create a unified DDSB IT Service Provider (IT-SP) that manages three IT Risk Management Framework (RMF) Authority to Operate (ATO)s: Multi-Purpose Kiosk | Desktop As A Service (DHAMPK-DaaS); Medical 365 (MED365); and Medical Joint Active Directory (mJAD) IT Systems.

The DDSB IT-SP is defined as a Service Provider that delivers an enterprise focus (i.e., the MHS enterprise) with clearly identified services defined within the DHA service catalog, with Service Level Agreements (SLA), Key Performance Indicators (KPI)s, and enterprise reporting capabilities. The DDSB IT-SP must work with other enterprise and local site IT systems which have their own ATOs. The DDSB IT-SP will include a DDSB multiple contractor entities that must work together to deliver DDSB services and enabling technologies for the three ATOs. The Contractor as part of the DDSB IT-SP will be focused on Engineering, Operations, and Sustainment of the DHA Component Identity and Credential Management (ICAM), DHA Zero Trust, Mobile Device Management (Apple including iOS and iPadOS), and maintaining both the Medical Joint Active Directory (mJAD)/Co-Managed Microsoft Endpoint Configuration Manager (MECM) and Software as a Service (SaaS) Microsoft Entra ID/Intune environments, along with management of the entire lifecycle for Microsoft servers and desktops. DDSB maintains approximately 3,000 physical and virtual servers at 250 sites located around the world; manages 250,000 end user devices; and supports 200,000 users.

Design elements, product lines, nomenclature, and tools are subject to modernization and change.

The Contractor will provide enterprise-level services to the Government, acting as part of the DDSB IT-SP which will operate with other enterprise and local IT ATOs. In that capacity, the Contractor will integrate the DDSB IT-SP within IOD’s larger IT portfolio, following direction for OLAs, SLAs, service catalog, and other service management functions. It is crucial for the Contractor to work alongside and collaborate with fellow DDSB contractors, which constitute the DDSB IT-SP, and with other core functions provided by the enterprise (e.g. service desk, project and program management, network management). This collaboration and joint delivery will be grounded within the ITIL4 framework and align with the core functions provided by various mission areas within the enterprise.

Operational components of the enterprise and IOD services portfolio, like those being established as part of the DDSB IT-SP, align with the processes defined in the IOD common IT process library. This includes processes such as issue resolution, service level management, change management, risk management, and reporting. The Government expects that all IT Service Providers will collaborate with Government to establish and improve the governance processes, particularly at the operational layer. This framework will continue to evolve as the parties identify opportunities to enhance enterprise IT Services.

DDSB Supported Programs, Projects, and Initiatives Like other IOD Branches DDSB is required to operate as an Operations & Sustainment entity while also supporting Program Management Offices within the branch. DDSB is home to the MED365 Program which is an Acquisition Category (ACAT) 1 Program and is projected to heavily support projects within the Zero Trust and ICAM Project Management Offices (PMOs). This means the branch must support a variety of programs, projects, and initiatives in various states. The Contractor will support Engineering or Operations & Sustainment tasks to support these activities. Below is a list of some of these programs, projects, and initiatives, but not limited to:

DDSB Support of DHA Zero Trust PMO CIO & PEO MS is consolidating infrastructure and standardizing solutions to enhance and simplify health care information technology for users across the Military Health System. The operating environment involves a complex network of healthcare providers, facilities, and personnel dispersed across various geographical locations, emphasizing the imperative of secure, appropriate, and seamless information exchange.

DHA is currently engaged in a strategic transformation from 4 independent military healthcare networks (Army, Navy, Air Force, Health Affairs) to a singular DHA network that is focused on a trust aligned framework. This comprehensive approach involves integrating not only the Military medical service networks, but also, federal partnerships, medical education training partners, private sector partnerships, and cutting edge medical and research and development teams. The objective is to enhance trust and alignment at all levels, ensuring a cohesive and effective healthcare ecosystem that caters to the unique needs of military personnel and veterans. This multi-pronged strategy encompasses seamless information sharing, streamlined processes, and improved interoperability to ultimately elevate the quality and accessibility of healthcare services for those served by the Agency through prioritization of the following approaches:

(1) Addressing Zero Trust in our technical refresh cadence; currently underway.

(2) Quickly shifting to capabilities available within Microsoft Office 365 Government E5/G5 licensing in the Impact Level 5 (IL5) Software as a Service (SaaS) cloud for advanced security and compliance capabilities (i.e., Microsoft Defender for Endpoint (MDE), InTune, Sentinel, etc.). New features and capabilities and modernization within Microsoft Office 365 will also require support as they become available and evolve in the IL5 cloud.

(3) Retooling of our Cyber Security Service Provider (CSSP) security monitoring and reporting capabilities.

(4) Migrate current investments in the identity platform to the Medical Community of Interest (Med-COI) where it will become the primary identity provider for DHA.

Currently, DHA is leveraging the Med-COI, a network comprising medical professionals, support staff, and partners, to ensure the efficient flow of information while prioritizing confidentiality and security. Providing the foundational network architecture and cybersecurity backbone, the Med-COI plays a critical role in cybersecurity protections for the MHS by harnessing a Zero Trust target level implementation by FY2027 aligns seamlessly with these mission needs and operating dynamics by enforcing stringent access controls, continuously monitoring user activities, and fortifying data protection across the extensive healthcare network.

In 2022, the Department of Defense (DoD) published the DoD Zero Trust (ZT) Strategy outlines seven pillars of this “never trust, always verify” mindset that for the security of devices, applications, assets, and services which only allows users access to data that they need, when they need it. DDSB implements ZT measures for DHA in the User, Data, and Device pillars.

· User - Continually authenticate, access, and monitor user activity patterns to govern users’ access and privileges while protecting and securing all interactions.

· DDSB supports the DoD ICAM Strategy through continuous monitoring and consistent controls over identity, credentialing, and access management.

· Data - Data transparency and visibility enabled and secured by enterprise infrastructure, applications, standards, robust end-to-end encryption, and data tagging.

· DDSB maintains the MED365 and mJAD environments.

· Devices - Understanding the health and status of devices informs risk decisions. Real time inspection, assessment, and patching informs every access request.

· DDSB manages endpoint security through use of tools like Microsoft Defender.

Contractor will work with fellow DDSB IT-SP contractors to realize and then operate & sustain the DHA Zero Trust Infrastructure. At this current time DHA is projecting implementation timelines in adherence to the DHA-Implementation Plan. Tables and Appendences Tab B on worksheet F. DHA Implementation. This timeline is subject to change as the Implementation Plan continues to mature.

DDSB Support of DHA Component ICAM ICAM encompasses the full range of activities related to the creation of digital Identities and maintenance of associated attributes, credential issuance for person/non-person entities, authentication, and making access management control decisions based on authenticated identities and associated attributes. This strategy provides a set of goals focused on establishing measurable and achievable transformation of core ICAM elements to achieve ICAM activities. These core elements enable ICAM to be fast, reliable, secure, and auditable across the DoD enterprise in a manner enhancing user experience and supports the DoD Chief Information Officer’s (CIO) ICAM vision.

DoD Services and Agencies have implemented ICAM principles to protect access to resources they manage. However, decision makers for individual information systems have deployed ICAM capabilities according to their own risk assessments rather than making risk decisions supporting the needs of the DoD enterprise. The lack of deployed capabilities using common standards and enterprise ICAM shared services adds complexity to processes for obtaining access to needed resources and increases risk to the Department. This bottom-up approach for authentication and authorization relies on system owners to make risk-based decisions for managing access to resources, resulting in system owners choosing implementation approaches meeting local needs which may not support enterprise objectives.

This strategy provides goals to achieve the ICAM vision of a secure and trusted environment where people and non-person entities can securely access all authorized resources based on mission need, and where we know who is on our networks at any time. This strategy provides a centralized approach to develop, acquire, test, implement, and sustain enterprise ICAM shared services enhancing strategic and tactical missions, and requires adoption of their use in DoD systems. The Department must also integrate widely recognized and adopted commercial standards, architectures, and related, compliant products to minimize modernization costs and facilitate interoperability. This approach balances the DoD requirement to share and protect information at an enterprise level and system owner needs to make supporting risk-based decisions. Finally, DoD must collaborate with its mission partners in other Federal Departments and Agencies, the Defense Industrial Base, and allied and coalition foreign governments to maximize interoperability with their ICAM technologies.

The seven goals of this strategy and their accompanying objectives are designed to focus Department resources towards building and deploying solutions enabling automated provisioning and dynamic access. These capabilities will help share information across the Department, and with our mission partners, while managing risks and protecting information against unauthorized access.

· Goal 1: Implement a data centric approach to collect, verify, maintain, and share identity and other attributes.

· Goal 2: Improve and enable authentication to DoD networks and resources through common standards, shared services, and federation.

· Goal 3: Deploy shared services promoting the implementation of enterprise ICAM.

· Goal 4: Enable consistent monitoring and logging to support identity analytics for detecting insider threats and external attacks.

· Goal 5: Enhance the governance structure promoting the development and adoption of enterprise ICAM solutions.

· Goal 6: Create DoD policies and standards clearly defining requirements for identification, credentialing, authentication, and authorization lifecycle management.

· Goal 7: Sustain the execution and evolution of ICAM activities to support the needs of DoD components to carry out their mission objectives and the needs of the DoD enterprise to secure DoD resources.

Contractor will work with fellow DDSB IT-SP contractors to realize and then operate & sustain the DHA Component ICAM. At this current time DHA is projecting to have implemented the Identity Provider (IdP), Master User Record (MUR) by Q3 FY25. Other ICAM components will come online and DDSB must support application onboarding to the ICAM solution which includes thousands of applications throughout the MHS.

DoD DMUC and Transition to MED365 DHA Mobile Device Management - Apple DoD Mobility Unclassified Capability (DMUC) enterprise service offering enables government-owned Mobile Devices access to the Unclassified Department of Defense Information Network (DODIN) and commercial information services. DMUC leverages the latest commercial technology and products to the greatest extent possible while allowing broad access to enterprise services (e.g., Email, Teams). DISA has stated that they will discontinue DMUC but has not yet provided a date of retirement. DHA must establish an equivalent capability, or better, for the MHS.

Contractor will work with fellow DDSB IT-SP contractors to realize and then operate & sustain the Mobile Device Management (MDM) – Apple project. The DHA CIO has directed that DDSB must deliver infrastructure capabilities for initial go-live by 2Q FY25.

MED365 Microsoft Defender for Endpoint In alignment to Zero Trust strategy for quickly shifting to capabilities available within Microsoft Office 365 Government G5 licensing for advanced security and compliance capabilities (i.e., Microsoft Defender for Endpoint (MDE), InTune, Sentinel, etc.). The DHA Authorization Official (AO) has directed DDSB to implement Microsoft Defender for Endpoint (MDM) by the end of FY25. Contractor will work with fellow DDSB IT-SP contractors to realize and then operate & sustain MDE.

MED365 Microsoft Defender for Endpoint for Servers In alignment to Zero Trust strategy for quickly shifting to capabilities available within Microsoft Office 365 Government G5 licensing for advanced security and compliance capabilities (i.e., Microsoft Defender for Endpoint (MDE), InTune, Sentinel, etc.). The DHA Authorization Official (AO) has directed DDSB to pilot MDE for Servers not to exceed 1000 servers by the end of FY25. Most of these servers need to be reflected in enterprise mJAD and MECM servers managed by DDSB. Contractor will work with fellow DDSB IT-SP contractors to realize and then operate & sustain MDE for Servers.

MED365 Teams The onboarding of Microsoft Office 365 capabilities like Purview, Defenders, Teams Town Hall, Teams Audio will be required for modernization.

Physical MECM Transition to Data Center Operations (DCOPS) Virtualized Infrastructure

Objectives

Provide IT Architectural, Engineering, and expert technical operations and sustainment support for IT systems and services.

Provide services required by the Government for 24-hour operational support. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. The Contractor shall provide services in accordance with its proposed approach/solution, including the staffing matrix and labor category qualifications, as awarded. If a Contractor employee is found unqualified for any reason or the employees submits their resignation, the employee shall be replaced with a qualified individual within 5 business days.

Maintain high-availability, reliable and secure IT infrastructures environments. Ensure systems under DDSB’s areas of responsibility maintain compliance with DoD cybersecurity requirements and meet Risk Management Framework (RMF) requirements. DDSB Section Chiefs and their team leads serve as Task Managers ensuring appropriate priorities are assigned to tasks within their areas of responsibilities.

Scope

Provide IT Architectural, Engineering, and expert technical services to all DHA environments. The required services include:

Providing security compliant, engineered solutions for standard application integration, application security, application delivery, desktop engineering, mobile device engineering, end user experience, and service monitoring functions;

Architectural and technical designs for IT infrastructure systems;

Providing broad support of DoD Zero Trust Strategy, DoD ICAM Strategy, DoD Digital Modernization Strategy and DoD Cybersecurity Reference Architecture Automation and scripting;

Engineering full disk encryption and Data-at-Rest (DAR) protection capabilities;

Standardized designs and solutions for directory services, Public Key Infrastructure (PKI), identity management, access management, and Public Key Enabling (PKE) activities;

The establishment, management, and maintenance of enterprise user data/profile management and their associated resources;

The preparation and deployment of policies, applications, and operating systems, to include applicable upgrades;

Providing a common system and monitoring framework for centrally deploying, supporting, and monitoring applications and systems;

Configuration Management to include Change Enablement, Knowledge Management, and technical documentation development for all technical and presentation requirements;

Management, sustainment, and security of all enterprise servers, End User Devices (EUDs), applications, and resources;

Accreditation of the operational environment and execution of governance processes maintaining security requirements

Support shall consist of those activities required to maintain existing and future applications, functions, and services:

Change Enablement, Knowledge Management to include technical writing, IT architectural documentation;

Identity and access management and sustainment;

Mobile Device management and sustainment;

IT Service Monitoring and optimization;

Desktop/Endpoint management and sustainment;

Endpoint and identity Security;

Application integration;

Administration of Microsoft (MS) and non-MS operating systems;

Policy implementation and management;

Enterprise Management (EM), currently consisting of Microsoft Endpoint Configuration Management formerly known as MS System Center Configuration Manager (SCCM), and emerging cloud technologies such as Azure Cloud and Intune or other Enterprise Management Tools;

Monitoring and restoral tools (like MS System Center Operations Manager (SCOM));

Information Assurance Vulnerability Management (IAVM);

Accreditation support and documentation;

Manage information and system security in accordance with (IAW) the Risk Management Framework (RMF), Risk Assessments, Security Technical Implementation Guides (STIG) management, and Information Assurance Vulnerability Alert (IAVA) reporting;

Scanning and compliance such as Assured Compliance Assessment Solution (ACAS); Enterprise Mission Assurance Support Service (eMASS);

Operational security; and Data encryption services/DAR.

In accordance with their technical specialties, applicable contractor personnel shall be fully knowledgeable in the following:

Designing, planning, and implementing Unified Endpoint Management (UEM) solutions, at enterprise scale;

Utilizing UEM technologies to administer and manage endpoint clients for a large enterprise;

Developing, planning, and implementing disaster recovery and high availability for UEM infrastructures to mitigate and prevent the loss of UEM;

Designing, planning, and implementing modern Endpoint Detection and Response (EDR) and eXtended Detection and Response (XDR) strategies that integrate seamlessly with deployed UEM solutions;

Scripting and coding using PowerShell, VBScript, JavaScript, Python, or other languages, to automate and develop operational solutions related to enterprise services, solutions, and processes;

Engineering, deploying, and administering productivity tools at scale, such as Microsoft 365 for Enterprise;

Researching, analyzing, and implementing operational solutions across various technologies and operating systems to include but not limited to, Windows, Linux, iOS (iPhone/iPad) MacOS, ChromeOS and Android endpoints. Using on-premise Group Policy, cloud enabled policies, and Kiosk configurations;

Multiple patch management tools (e.g., Microsoft technologies, Batch Patch, IBM Big Fix, WSUS, InTune, etc.);

Designing and performing regular system management tasks such as policy configuration and setup, device enrollment prep and assistance, monitoring system status and performance, and other related system maintenance tasks;

Integration of on-premise and Microsoft 365 MHS tenant ecosystems as it relates to managing and delivering services to enterprise users and devices;

Design and use of Identity Assertion, Authentication, and Authorization Protocols, e.g., SAML, oAuth, Kerberos, OpenID;

Engineering, architecting, and delivering PKI/PKE, enablement thereof, and integration;

Adherence and participation in infrastructure Configuration Management procedures and processes (Change Enablement and Knowledge Management to include technical writing, DevSecOps, and Agile);

Authoring, proofing, and contributing to IT architectural, engineering, and support documentation to include drawings and other visual representations of data flows and designs;

Engineering, deployment, integration, and sustainment of identity and access management products to include on-premise, cloud, and SaaS offerings;

Engineering, deployment, and sustainment of mobile device management solutions to include PKE, Authentication, Authorization, and device management;

Desktop/Endpoint and End User Experience Engineering, deployment, and sustainment enhancing and supporting standardization and uniformity across device platforms;

Versed and knowledgeable with regard to DoDI 8520.02, DoD Zero Trust Strategy, DoD ICAM Strategy, DoD Digital Modernization Strategy and DoD Cybersecurity Reference Architecture;

DoD network security policies, and regulation execution;

IT Service Monitoring;

Engineering, research, deployment, and sustainment of Microsoft Active Directory Domain Services, Active Directory Certificate Services, Active Directory Lightweight Directory Services, Entra ID Connect, Entra ID (Azure Active Directory), Active Directory Federation Services and Microsoft Identity Manager;

Commercial-off-the-shelf (COTS) and Government-off-the-shelf (GOTS)Application and software packaging, patching, management, configuration packages and deployment;

Engineer, design, integrate, and troubleshoot for coexistence COTS, GOTS, Third-Party, and First-Party applications;

Engineer, design, integrate, and troubleshoot device drivers, firmware, and middleware for packaging, deployment, management, and configuration control;

Engineer, design, troubleshoot and develop deployment strategies for endpoint management and Microsoft Endpoint Configuration Manager (MECM) Operating System Deployment (OSD);

Engineer, design, research, and deploy strategies within GCCH (Government Cloud Computing High) IL5 (Impact Level Five) environment using InTune for enrollment, policy distribution, device configuration, and device management;

Provide, build, analyze, design, maintain reports, and analytics using PowerBI, Dataverse and other tools;

Proficient in foundational concepts related to networking fundamentals Dynamic Host Configuration Protocol (DHCP), Windows Internet Naming Standard (WINS), Domain Name Service (DNS), IP Addressing, Transmission Control Protocol/Internet Protocol (TCP/IP);

Lightweight Directory Access Protocol (LDAP) synchronization and authentication;

Engineer, architect, troubleshoot, support, and configure endpoint security tools (like Trellix / Microsoft Defender Endpoint (MDE);

Engineer, design, architect, deploy, sustain, and troubleshoot cybersecurity tools to include Sentinel, Microsoft Defender (XDR) Suite (MDI, MDO, MDCA, MDE, DLP, Entra ID Protect;

Information assurance and security scanning and reporting (like ACAS);

Diagnose, troubleshoot, repair, sustain and configure advanced endpoint configurations and misconfigurations via tools like Fiddler, Postman, Wireshark, Microsoft SysInternals that addresses performance and end user experience.

Technical Proficiency. The contractor shall be responsible to ensure their employees obtain and maintain proficiency, expertise, and appropriate certifications in current and approved new technologies to be incorporated into the DDSB IT managed environments. Once a new and/or updated technology is approved for incorporation, the Government will be responsible to provide any required initial qualification training and appropriate certifications to current Contractor technicians. Contractor(s) shall be responsible to provide appropriate training and certification to new and/or replacement Engineers and technicians.

Increased workload requirements. Increases in workloads are expected when new customers are incorporated into the DHA environments, as well as when major operational and/or maintenance changes in the DHA environments, to include the Infrastructure Test Center (ITC), occur. Depending on the nature of the effort, increased workload requirements are likely to involve the need for additional support of any and all specialties listed in this PWS and may require days to months of increased support.

Period of Performance (PoP)

Performance period be a Base Year of 12 months, inclusive of Transition, with four (4) 12-month option years and an optional six-month extension.

Transition:

Phase in period. The Phase-in Period is 30 days starting at the beginning of the Base Year, Full performance start date is 30 days after the start of the Base Year and the Contractor is responsible for all activities under this PWS. The Government will make applicable government facilities, equipment, and materials accessible to the contractor.

1.6.1.1.1 Subject to the contract award date, not less than 60 days prior to the full performance date, the contractor shall work with the COR and other appropriate government personnel to prepare a Transition-in plan that details how the contractor expects to meet all contract performance requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date. If the award is made less than 60 days before the full performance date, the contractor shall provide a Transition-in Plan as soon as reasonably possible.

1.6.1.1.2 Until fully staffed and operational, on a weekly basis, the contractor shall provide a report on the following:

· Accomplishment of Transition tasks and milestones

· Feedback on meetings and communications with Customers and Mission Partners

· Accomplishments in transitioning knowledge

· Variances and progress in the progress toward full staff readiness

· Progress in accomplishing knowledge transfer

· Activities for addressing risks and issues in Contractor Staffing.

· Status of offers (e.g., accepted, on-boarded) and the source of staffing (e.g., new hire or otherwise).

· Status of on-boarding, including information on received CAC, verified user account, completed training, facility access, and received GFE.

1.6.1.1.3 The contractor shall comply with on-boarding requirements listed in paragraph 1.11.

Phase-out period. The Phase out period is defined as 30 days prior to the end of the contract’s final period of performance (PoP). This 30 day period will run concurrently with the final days of the contract’s PoP.

1.6.1.2.1 During the Phase Out period, the contractor shall work with the COR and other appropriate government personnel to develop a Transition-out plan detailing how the contractor will facilitate/assist in a seamless transition to an incoming contractor at the expiration of the contract.

1.6.1.2.2 The Transition Plan will be completed and provided to the COR no later than one week prior to the contract’s PoP.

Administrative Specifications

Place of performance: The work to be performed under this contract may be performed at any of the following locations: Army Public Health Center (APHC) San Antonio, 4270 Gorgas Circle, Bldg. 1070, Joint Base San Antonio (JBSA)-Fort Sam Houston, TX 78234, DHA North Breach Pavilion, 2720 Howitzer Street, Bldg. 2372, JBSA-Fort Sam Houston, TX 78234, or other Government owned/leased location(s) approved by Government Leadership and COR. Contractor owned facilities may be utilized, at no additional expense to the Government, providing such facilities meet operational and Personal Health Information, Personal Identifiable Information, and Controlled Unclassified Information security requirements. Travel to other locations may be required by the mission.

Recognized Federal holidays. Contractors providing Tier 2 Continuous Operations support services and Enterprise Management (EM) administration support will be required to perform services on the holidays listed below. For all other support services, the Contractor will not be required to perform services on the holidays listed:

Independence Day Presidentially Declared Federal Holidays As declared.

Hours of operation: The contractor is responsible for conducting business between the hours of 0600 and 1800 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings.

Contractor employees shall not perform more than 40 hours of work per week per employee and the Government may not be billed for more than 40 hours of work per week per employee without prior written Contract Officer’s Representative (COR) authorization.

Contractor employees providing Tier 2 support services (paragraph 5.3) shall be required to perform their duties on a rotating shift basis to supplement in-place government and contractor workforce execution of a 24 hours a day, 365 days a year operational requirement. Contractors’ EM administration support services (paragraph 5.2) may be required to perform their duties on a rotating shift basis to supplement in-place government and contractor workforce execution of a 24 hours a day, 365 days a year operational requirement.

Operational events may require support to perform work listed in Section 5 outside normal duty hours. The contractor may adjust schedules as necessary, with COR approval, to provide optimal support.

On-Call Support. With exception of Change Enablement, Knowledge Management, and IT architectural documentation support, the contractor shall provide after duty hours and weekend on-call support for services listed in Section 5. The actual hours of support provided shall be deducted from the number of hours the contractor employee works the following day. If an employee has already reached 40 hours of work for the week, then the actual hours of support provided will be deducted from the hours of the following week. On-Call support shall be in accordance with DDSB, DSS On-Call Policy, Document Number 2-18-006.

Extended Work Week: Certain operational requirements may require contractor employees to provide services listed in Section 5 beyond their normal duty hours, including holidays and weekends. Under these conditions, the Contractor may be asked to provide an estimated cost to perform the required services. The Government will only pay for approved actual hours worked beyond the contractor’s normal work week and must be authorized in advance by the COR.

Telework: Contractor employees may be authorized to telework upon COR approval and must meet requirements listed in paragraph 4.6. Contractor employees will be required to be on-site to complete in-processing, government required training, identification, and equipment issue at the start of employment. At the discretion of Government leadership, contractor employees will be required to attend meetings or conduct work on-site. The Contractor shall be responsible for all costs related to performing telework under this contract.

Remote Work: For certain specialties that are difficult to fill with local labor, Remote Work may be authorized upon COR, CO, and Section Chief approval and must meet requirements listed in paragraph 4.6. The Contractor shall be responsible for all costs related to performing Remote Work under this contract. Travel to perform required duties will be in accordance with paragraph 1.8.

Contractor Travel

Contractor employees may be required to travel to continental United States (CONUS) and outside the continental United States (OCONUS) locations in the performance of this contract. Contractors traveling to OCONUS locations must follow any Status of Forces Agreement (SOFA) requirements applicable to that location. The Contractor may be required to travel to off-site training locations and to ship training aids to these locations. Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. Travel costs shall be incurred and billed in accordance with FAR Part 31. All travel requires Government approval/authorization, by the COR, at least 30 calendar days prior to travel. The Contract shall submit a detailed cost estimate to the Government before any required/requested travel is approved. However, for travel to OCONUS locations the contractor must seek COR approval with sufficient time to allow processing any required clearances. The contractor shall comply with requirements in the DoD Electronic Foreign Clearance Guide for all travel outside the United States. The contractor shall adhere to any specialized training requirements and country/theater clearance lead times as specified in the DoD Electronic Foreign Clearance Guide. In addition to the requirements in the DoD Electronic Foreign Clearance Guide, the Contractor shall comply with the requirements below. The contractor shall incorporate the substance of this requirement in all subcontracts awarded under this contract.

DHA Foreign Travel Requirements: Historically, less than three overseas travel ventures per year have been required; however, contractor employees who will be employed, assigned, on temporary duty, or on Personal Time Off to locations outside of the United States shall complete a DHA Form 18 (Attachment 6), and provide the completed Form to the DHA Mission Assurance Branch no later than ten working days prior to travel. All prerequisites (vaccinations, passports, Visa, etc.) for foreign travel shall be done at the contractor’s expense. The DHA Form 18 is available through the DHA web page https://info.health.mil/SitePages/Home.aspx (CAC login required). Upon return from foreign travel, debriefings may be required based on the traveler’s encounter with any reportable situations. If the traveler has a situation to report, they must contact DHA security (dha.ftv@mail.mil) with the following information (notifications shall not contain any classified information):

· Date/time of incident

· Location of incident

· Level of information involved (if involved and/or known)

Performance in Germany: The contractor shall follow the German “fax-back” process for employees who will travel to Germany in performance of this contract. This process may only be used for employees who will remain in Germany for 90 days or less in a 12-month period. The fax-back process must be completed before the employee arrives or begins work in Germany (before the employees leaves the CONUS or other location for Germany). The contractor shall refer to Army in Europe Regulation 715-9, Contractor Personnel in Germany – Technical Expert, Troop Care, and Analytical Support Personnel, for additional guidance. As requirements are subject to change, the contractor shall refer to the DoD Electronic Foreign Clearance Guide and the DOCPER website (currently at http://www.eur.army.mil/g1/content/CPD/docper/docper_germanyLinks.html?tab=5&framepage=germanfaxback.html#top) for the latest information.

Performance in Japan: See Technical Exhibit 2.

Performance in Korea: See Technical Exhibit 4. Not later than 60 calendar days prior to any Contractor employee travelling to Korea, the Contractor shall provide the COR with a completed USFK Form 700-19A-R-E (Technical Exhibit 5), Applicant Questionnaire Memo (Technical Exhibit 6), and a copy of the first page, and all stamped pages, of their current passport (and any passport that may have expired within the last year). The COR will notify the Contractor when SOFA designation has been obtained for their employees. Contractor employees shall not travel to Korea prior to confirmation from the COR that the employee has been approved for SOFA designation. Additional information is available in USFK Regulation 700-19, The Invited Contractor and Technical Representative Program. The United States Forces Korea (USFK) Acquisition Management website (currently located at http://www.usfk.mil/Organization/AcquisitionManagement,FKAQ.aspx) also contains additional information and links to required forms.

Performance in Spain: All Contractor employees, regardless of their length of stay in Spain, supporting a DoD contract must obtain a Certificate of Civil Liability Insurance, in accordance with the requirements of the US-Spain Agreement on Defense Cooperation, issued in Spain. This insurance must be issued by a company authorized to conduct this type of business in Spain and may not contain any deductible or similar limitation. To obtain the certificate, Contractors must contact their insurance provider and instruct them to contact their affiliate in Spain, who in turn will issue the certificate and forward it to the Contractor, who will obtain a corporate signature. The signed certificate must be e-mailed along with a completed Country Clearance Request form, the Employee Certification, and a statement from the DoD contract administrator validating the visit to the point of contact at the unit being visited (for visits to Naval Station Rota, or Moron Air Base), who in turn will endorse the visit and forward the documents to the U.S. Embassy Office of Defense Cooperation (ODC) for processing through Spanish authorities. Contractors visiting any other location in Spain in support of a DoD contract must follow instructions identified above; however, the Certificate of Civil Liability Insurance, the Country Clearance Request form, the Employee Certification, and the statement from the DoD contract administrator validating the visit will be e-mailed directly to the ODC for processing through Spanish authorities. Additional information is available at the CNIC Naval Station Rota website (currently at http://www.cnic.navy.mil/regions/cnreurafswa/installations/ns_rota/about/gs-and-civilian-sponsorship.html). The current minimum required coverage insurance coverage for personal liability, property damage, and security deposit (Judiciary Bond to cover court expenses) must be met.

Other Direct Costs (ODC)

ODCs must be defined and approved by the COR and funded by the Contracting Officer prior to any expense being incurred.

Quality

Quality Control Program (QCP): The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with the standards listed in this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. After acceptance of the QCP the Contractor shall receive the contracting officer’s (CO) acceptance in writing of any proposed change to its quality control system. See Part 7, 7.3 Quality Control Program (QCP) (CDRL) A001.

The contractor is responsible for the quality of all work performed. The contractor measures that quality through the contractor’s own quality control (QC) program. QC is work output, not workers, and therefore includes all work performed under this contract regardless of whether the work is performed by contractor employees or by subcontractors. The contractor’s QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. The contractor will develop and implement a performance management system with processes to assess and report its performance to the designated government representative. The contractor’s QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. This QASP enables the government to take advantage of the contractor’s QC program.

Reserved.

Weekly Activity Reports (WARs): The contractor shall provide WARs as outlined in Section 5. WARs will be provided to and reviewed by the Section Chiefs and/or their Team Leads for concur or non-concurrence; non-concurrence must be explained. WARs will provide one method of performance surveillance and may be used by the COR for the COR’s Monthly Report in PIEE’s Surveillance and Performance Monitoring (SPM) Module.

Monthly Reports (MARs): On a monthly basis, the contractor will provide the COR with a monthly evaluation of each element of the contractor’s performance in accordance with the contractor Quality Control Plan.

Quality Control meetings. At a minimum, the contractor shall meet with the COR and other Government stakeholders quarterly to discuss contractor’s performance and any issues that may have been found.

Contractor Personnel

Common Access Card (CAC) requirements (see Part 7, 7.1.1): Contractor personnel performing work must have and maintain the appropriate security and designation (Type of investigation, Clearance Level, and IT Level designation) required. All work under this contract is unclassified. The Contractor employees must be able to obtain and maintain favorable suitability adjudication prior to commencement of duties; one major legal issue within 36 months of the suitability adjudication date is automatically disqualifying. The Contractor will pre-screen employees for major issues relating to; intoxicants, drug use, financial responsibility, sexual misconduct, honesty, disruptive or violent behavior, employment misconduct or negligence, illegal possession of firearms and weapons, acts of terrorism, security denials or revocations, serious mental health issues, associates and relatives with issues that directly relate to the Contractor, and misuse of information technology systems. The final suitability determination will be made by DHA leadership. The contractor will be removed from the network and may be removed from the facility at any time if they are found unsuitable through the continuing evaluation process. The contractor shall return all CACs to the COR upon the departure of the contractor(s).

Physical Security: The Contractor personnel or any representative of the Contractor entering the Fort Sam Houston installation, or other DHA and government installations, shall abide by all security regulations and shall be subject to security checks. Contractor personnel shall be lawfully employable in the United States. The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.