PWS F35 JPO - DSaaS - 10 - 22 - 2026.docx

F-35 JOINT PROGRAM OFFICE (F-35 JPO) / Directorate Enterprise Services Acquisition Administration and Operations Performance Work Statement (PWS) Date

F-35 JOINT PROGRAM OFFICE

DIRECTORATE OF ENTERPRISE SERVICES ACQUISITION

F-35 JPO Enterprise Data Science and Analytics Support Performance Work Statement

1.0 INTRODUCTION

The F-35 Joint Program Office (JPO) is responsible for the acquisition, development, production, modernization, and sustainment of the F-35 Lightning II fifth-generation fighter aircraft for the United States and international partners. The program generates and consumes large volumes of structured, semi-structured, and unstructured data spanning aircraft health, logistics, supply chain, maintenance, training, flight test, operational performance, cost, schedule, and program management.

To convert these data into timely and defensible decisions, the JPO requires integrated contractor support for ad hoc projects in the realm of advanced analytics, data science, machine learning, and business intelligence (BI), and executive analytics.

This Performance Work Statement (PWS) is structured in accordance with Federal Acquisition Regulation (FAR) Subpart 37.6. It identifies required outcomes, performance standards, workload ranges, and surveillance methods rather than prescribing the Contractor’s internal organization or detailed methods. The Contractor shall apply technically sound, secure, maintainable, and cost-effective approaches compatible with JPO-authorized environments and standards.

Scope The Contractor shall provide a self-sufficient, cross-functional capability covering three mutually reinforcing service areas:

1. Analytics, Data Science, and Machine Learning solutions: Formulate, develop, validate, and deploy solutions leveraging analytics, data science, and machine learning tools. Once the solution has been deployed, the team will hand off the solution to F-35 enterprise members along with any supporting code, applications and documentation.

2. Business Intelligence, Analytics, and Executive Data Storytelling: Perform recurring and ad-hoc analysis; develop and sustain interactive dashboards; and communicate complex findings to technical, acquisition, operational, and senior executive audiences.

3. Align with existing Cloud Data Architecture, Modeling, and DataOps Governance guidelines developed by Data Operations and DevSecOp teams: Align developed solutions with existing policy guidelines as applicable to individual projects

The Contractor shall collaborate with the JPO DataOps Team and DevSecOps Team - Office of the Chief Information Officer (OCIO), program management offices (PMOs), functional stakeholders, and other Government-designated organizations.

Solutions shall be integrated through Government-approved application programming interfaces (APIs), microservices, data pipelines, and container platforms. Technologies may include AWS GovCloud, Microsoft Azure Government, Snowflake Government, Amazon Redshift, Azure Synapse Analytics, AWS S3, Azure Data Lake Storage, Docker, Kubernetes, OpenShift, and other Government-approved equivalents. Identification of a product or technology does not mandate its use when an approved equivalent better satisfies Government requirements.

2.0 OBJECTIVES

The objectives of this PWS are to:

1. Deliver production-ready analytics and data science solutions that measurably improve readiness, sustainment, cost, schedule, supply-chain, and operational outcomes.

2. Establish and sustain a secure, scalable, documented, and high-performing data architecture that supports the JPO Data Strategy and authorized self-service analytics.

3. Provide timely, accurate, reproducible, and decision-ready analytical products and BI capabilities.

4. Ensure solutions are explainable, robust, maintainable, auditable, accessible, and aligned with applicable DoD data governance and CUI requirements.

5. Maintain sufficient delivery capacity to execute multiple independent workstreams concurrently without degradation of quality, timeliness, or cybersecurity.

6. Transfer knowledge, code, documentation, and operational capability to Government personnel and authorized successor support organizations.

3.0 PERFORMANCE BASED APPROACH

The Contractor is responsible for determining the staffing mix, management approach, methods, and sequencing necessary to meet this PWS. Work shall be initiated and prioritized through Government-approved project plans, task backlogs, sprint plans, service requests, or other documented work-authorization mechanisms.

Before beginning substantive technical work on an initiative, the Contractor shall confirm the business problem, intended users, data sources, dependencies, success measures, security constraints, acceptance criteria, and delivery milestones with the Government Technical Point of Contact (GTPOC) or other authorized Government lead.

No requirement in this PWS authorizes the Contractor to perform inherently governmental functions, approve Government policy, commit Government funds, determine acquisition strategy, or make final Government decisions.

4.0 APPLICABLE DOCUMENTS

The following documents, in their latest contractually applicable revisions, apply to the extent incorporated into the contract or provided by the Government. If a conflict exists, the order of precedence established by the contract applies.

1. FAR Part 37, Service Contracting, including Subpart 37.6, Performance-Based Acquisition.

2. DoD Instruction (DoDI) 5000.82, Acquisition of Information Technology.

3. DoDI 8500.01, Cybersecurity.

4. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and Organizations.

5. NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, when applicable.

6. DoD Cloud Computing Security Requirements Guide (SRG).

7. Applicable Federal Risk and Authorization Management Program (FedRAMP) requirements.

8. Applicable Security Technical Implementation Guides (STIGs).

9. Applicable DoD DevSecOps reference designs and Government-approved Platform One and Iron Bank standards.

10. Applicable DoD Data Strategy, Zero Trust, records-management, Section 508, privacy, and CUI and higher classification policies.

11. JPO Data Strategy, data-governance policies, cybersecurity procedures, architecture standards, coding standards, and configuration-management procedures furnished by the Government.

The Contractor shall identify any apparent conflict, obsolete reference, or requirement that cannot be satisfied in the authorized environment and shall notify the Government Technical Point of Contact (GTPOC) and Contracting Officer’s Representative (COR) before proceeding with an affected approach.

5.0 OPERATIONAL CONCURRENCY AND WORKLOAD

5.1 General

Workload quantities are planning ranges and performance-capacity expectations; they are not guarantees of ordered volume. The Government will establish priorities and may adjust the mix of work within the overall scope. The Contractor shall maintain sufficient management and technical capacity to address urgent mission needs while sustaining approved work already in progress.

5.2 Data Science Workstreams

The Contractor shall be capable of sustaining 2 to 3 active, independent data science initiatives concurrently. Initiatives may include predictive maintenance, readiness forecasting, anomaly detection, supply-chain optimization, maintenance scheduling, flight-test analysis, acquisition cost forecasting, or other approved mission use cases.

The anticipated annual throughput is approximately 6 to 7 data science solutions, or comparably complex analytical capabilities, subject to initiative size, data readiness, security constraints, and Government priorities.

5.3 BI and Analytical Workstreams

The Contractor shall:

1. Sustain and enhance 3 to 4 high-visibility dashboard suites concurrently.

2. Maintain and develop approximately 5 to 6 production dashboards or reports annually.

3. Support a bi-weekly release cadence when compatible with Government change-control, testing, and approval processes.

5.4 Prioritization

When demand exceeds available capacity, the Contractor shall provide the COR and GTPOC with an impact assessment and recommended sequencing. The Government will make final priority decisions. The Contractor shall not reduce required testing, documentation, security, accessibility, or quality controls to meet workload targets without prior written Government direction.

6.0 TECHNICAL REQUIREMENTS

6.1 General Requirements

The Contractor shall furnish all personnel, management, supervision, tools, materials, and incidental services necessary to perform this PWS, except for Government-furnished property and information identified in Section 8. The Contractor shall:

1. Assign personnel with technical proficiency, communication skills, domain awareness, and security eligibility necessary for assigned work.

2. Collaborate using Government-approved platforms, which may include Jira, Confluence, Microsoft Teams, and Government-controlled Git repositories.

3. Maintain configuration management, version control, reproducibility, traceability, and auditability for models, source code, data transformations, infrastructure code, architecture artifacts, dashboards, analyses, and reports.

4. Use Government-authorized environments and approved software only.

5. Protect classified records, CUI, personal identifiable information, proprietary information, export-controlled information, and other sensitive data in accordance with contract requirements.

6. Maintain an internal quality-management process that identifies and corrects deficiencies before Government inspection.

7. Provide weekly status information and monthly performance reporting addressing accomplishments, schedule, workload, risks, issues, dependencies, decisions required, upcoming milestones, and performance against Section 5.

8. Promptly disclose data limitations, methodological uncertainty, bias risks, unsupported assumptions, and known system limitations.

9. Design for maintainability, modularity, portability, reuse, observability, accessibility, and cost efficiency.

6.2 Task Area 1 — Enterprise Data Science, Advanced Machine Learning, and Optimization

6.2.1 Problem Formulation and Technical Ownership

The Contractor shall take end-to-end technical ownership of assigned initiatives from problem formulation through deployment, monitoring, and hand off to F-35 ownership. For each initiative, the Contractor shall:

1. Translate operational or acquisition needs into a measurable analytical problem.

2. Document the decision to be supported, target users, expected value, success metrics, baseline method, constraints, assumptions, risks, and acceptance criteria.

3. Evaluate data availability, fitness, provenance, representativeness, quality, and authorized use.

4. Establish a delivery plan with milestones, dependencies, validation events, and stakeholder review points.

5. Maintain current status, risks, technical decisions, and supporting artifacts in Government-approved repositories.

6.2.2 Algorithm Engineering and Validation

The Contractor shall formulate, train, validate, benchmark, and document appropriate analytical methods. Methods may include supervised or unsupervised machine learning, deep learning, survival analysis, time-series forecasting, anomaly detection, simulation, operations research, and combinatorial optimization.

For each model or optimization capability, the Contractor shall:

1. Establish an approved baseline and objective performance measures before final model selection.

2. Use validation methods appropriate to the data and intended use, including holdout testing, cross-validation, back-testing, sensitivity analysis, or simulation as applicable.

3. Compare candidate approaches against the approved baseline and document whether observed improvement is operationally meaningful and statistically supportable.

4. Evaluate uncertainty, bias, data leakage, confounding, class imbalance, calibration, and error consequences.

5. Document intended use, prohibited or unsupported uses, limitations, dependencies, and human-oversight requirements.

6. Obtain Government acceptance before production promotion.

6.2.3 Interpretability, Robustness, and Monitoring

1. Each production model shall include an interpretability and validation package appropriate to its mission impact. The package shall include:

1. Global and local explanations using SHAP, LIME, counterfactual analysis, integrated gradients, or a Government-approved equivalent when technically applicable.

2. Plain-language explanation of principal drivers, limitations, uncertainty, and conditions under which results may be unreliable.

3. Stress testing, edge-case testing, failure-mode analysis, and adversarial or resilience testing commensurate with risk.

4. Baseline data and model-performance profiles.

5. Production monitoring for model performance, data quality, concept drift, and covariate shift.

6. Alert thresholds, escalation procedures, rollback criteria, and retraining or recalibration procedures.

Production model performance shall remain within 5 percent of the approved validation baseline, measured using the primary metric defined in the approved technical design document, unless the Government approves another tolerance. The Contractor shall notify the Government when the threshold is exceeded and provide a remediation plan.

6.2.4 MLOps, Containerization, and Integration

The Contractor shall engineer approved analytical capabilities for secure, scalable, and maintainable production use. The Contractor shall:

1. Integrate models through approved REST APIs, gRPC endpoints, batch services, event-driven interfaces, or other approved patterns.

2. Package code in security-hardened containers using Docker or an approved equivalent and deploy through Kubernetes, OpenShift, or another Government-approved orchestration platform when required.

3. Use approved base images and artifact repositories, including Iron Bank resources when directed.

4. Establish CI/CD and, when approved, continuous-training pipelines with automated linting, unit tests, integration tests, dependency checks, container scans, and controlled promotion gates.

5. Maintain versioned source code, model artifacts, feature definitions, environment specifications, test evidence, and release records.

6. Implement operational telemetry, logging, alerting, health checks, and rollback capability.

7. Meet initiative-specific latency and batch-completion requirements documented in the approved technical design document.

6.2.5 Documentation and Communication

For each production release, the Contractor shall deliver complete and current model cards, source code, technical design, data lineage, validation evidence, interpretability artifacts, interface documentation, deployment instructions, operations and maintenance guidance, security evidence, and user documentation.

The Contractor shall communicate methods, findings, uncertainty, tradeoffs, limitations, and recommended actions to technical and non-technical audiences through written products, demonstrations, and briefings. The Contractor shall not characterize an experimental capability as operationally validated without supporting evidence and Government acceptance.

6.3 Task Area 2 — Cloud Data Architecture, Modeling, and alignment with DataOps Governance

6.3.1 Secure Cloud Data Architecture

The Contractor shall design, implement, document, and sustain cloud data architecture in Government-authorized AWS GovCloud, Azure Government, or other approved environments at the impact level authorized for the applicable system and data. Work under this PWS may include both classified and unclassified environments.

The Contractor shall:

1. Develop architectures for scalable storage, processing, integration, analytics, resilience, backup, recovery, monitoring, and cost management.

2. Produce current logical, physical, deployment, security, interface, and data-flow diagrams.

3. Collaborate with DevSecOps and DataOps teams at OCIO on technology decisions, alternatives considered, dependencies, capacity assumptions, recovery objectives, and operating constraints.

4. Align designs with JPO architecture, Platform One, modular open systems, data-governance, and cybersecurity standards.

6.3.2 Pipeline Engineering and DataOps

The Contractor shall collaborate with the DataOps Team to design, develop, test, orchestrate, monitor, and optimize ETL/ELT pipelines for batch and streaming data. Technologies may include Apache Spark, PySpark, Airflow, dbt, and Government-approved equivalents.

Pipelines shall include, as applicable:

1. Source-to-target mappings and data contracts.

2. Automated schema, completeness, validity, referential-integrity, and reconciliation checks.

3. Error handling, quarantine, replay, restart, and recovery mechanisms.

4. Idempotent processing or equivalent controls that prevent unintended duplication.

5. End-to-end observability, alerting, operational runbooks, and ownership information.

6. Version-controlled code, automated tests, release records, and rollback procedures.

7. Performance and cost metrics sufficient to identify bottlenecks and abnormal consumption.

6.3.3 Data Quality, Metadata, Lineage, and Governance

The Contractor shall execute JPO data-governance procedures and collaborate with F-35 JPO Data Operations team at OCIO on metadata management, data discovery, cataloging, business glossaries, lineage, quality monitoring, and master-data management using Collibra, Alation, or another approved platform.

For critical datasets identified by the Government, the Contractor shall establish approved measurement rules and sustain at least 98 percent completeness, accuracy, and consistency, unless a different threshold is documented for a specific data product. Quality results shall identify the rule, population, exceptions, trend, owner, and remediation status.

Production tables and analytical views within the Contractor’s assigned scope shall include current ownership, description, source, lineage, security classification or handling designation, and key business definitions. Missing or inaccurate metadata identified through surveillance shall be corrected within the time established in Section 5.

6.3.4 Performance and Cost Optimization

The Contractor shall monitor and optimize storage design, partitioning, indexing, clustering, caching, query plans, warehouse sizing, lifecycle policies, and workload management to meet approved service levels and control cloud consumption. Optimization changes shall be tested, documented, and traceable. Cost recommendations shall identify expected benefits, performance tradeoffs, operational risks, and implementation effort.

6.3.5 Cybersecurity Coordination

The Contractor shall coordinate with the OCIO Cybersecurity Directorate to implement applicable Risk Management Framework controls, Zero Trust principles, STIGs, vulnerability-management requirements, continuous-monitoring evidence, and authorization-boundary controls. The Contractor shall support, but shall not perform, inherently governmental risk-acceptance or authorization decisions.

6.4 Task Area 3 — Business Intelligence, Analytics, and Executive Data Storytelling

6.4.1 Ad-Hoc and Recurring Analysis

The Contractor shall perform complex ad-hoc, exploratory, and recurring analysis using approved SQL, Python, R, statistical, and analytical tools. Work may include trend analysis, hypothesis testing, anomaly detection, regression, forecasting, root-cause analysis, and multivariate analysis.

Each final analytical product shall:

1. State the question, intended decision, scope, and due date.

2. Identify data sources, extraction date, transformations, and validation steps.

3. Document methods, assumptions, caveats, uncertainty, and limitations.

4. Present results accurately and distinguish evidence from interpretation.

5. Provide clear, actionable recommendations when requested and supported by the analysis.

6. Include reproducible scripts, queries, or notebooks in a Government-accessible repository, subject to security constraints.

7. Receive an independent quality review appropriate to the product’s mission impact and urgency.

6.4.2 Dashboard and Reporting Engineering

The Contractor shall design, build, deploy, document, and maintain enterprise dashboards and reports using Tableau, Microsoft Power BI, Looker, or a Government-approved equivalent. The Contractor shall:

1. Elicit and document user stories, measures, definitions, acceptance criteria, security requirements, and refresh needs.

2. Apply user-centered design, consistent visual standards, and Section 508 accessibility requirements.

3. Implement approved row-level, role-based, or attribute-based access restrictions.

4. Validate calculations, filters, drill paths, exports, refresh schedules, and source reconciliation.

5. Optimize standard views to load in less than 5 seconds under the agreed test conditions.

6. Monitor availability, refresh status, query performance, usage, failures, and data currency.

7. Maintain user guides, data definitions, release notes, ownership, and support procedures.

8. Manage defects and enhancement backlogs in Government-approved systems and participate in applicable agile ceremonies.

6.4.3 Executive Data Storytelling

The Contractor shall translate complex readiness, sustainment, logistics, cost, schedule, technical, and operational findings into executive summaries, briefings, decision memoranda, demonstrations, and briefing books tailored to the intended audience.

Products shall clearly present the decision context, evidence, uncertainty, operational implications, alternatives, and recommended action. Visualizations shall use accurate scales, accessible color choices, clear labels, and traceable sources. The Contractor shall be prepared to explain methods and limitations to Program Executive Officers, Service Acquisition Executives, PMO leaders, technical reviewers, and authorized international partner representatives.

7.0 PERFORMANCE REQUIREMENTS SUMMARY

7.1 Quality Assurance

The Government will evaluate performance using 100 percent inspection of selected deliverables, automated logs, random sampling, repository and backlog reviews, technical reviews, and stakeholder feedback. The Acceptable Quality Level (AQL) is the minimum satisfactory threshold and does not relieve the Contractor of the obligation to meet every contract requirement.

The Contractor shall maintain a quality-control plan and evidence of internal review. Following Government notice of an AQL failure, the Contractor shall submit a Corrective Action Plan (CAP) within five business days, unless a shorter response is required for cybersecurity or operational incidents. The CAP shall identify root cause, containment, corrective action, owner, due date, validation method, and recurrence-prevention measures.

7.2 Performance Requirements Summary Matrix

AQL calculations shall exclude delays or failures directly caused by documented Government dependencies, Government-directed priority changes, unavailable Government systems, or other excusable causes recognized by the contract, provided the Contractor gave timely notice and took reasonable mitigation action.

8.0 DELIVERABLES

Deliverables shall be submitted to the COR and GTPOC through Government-approved repositories, collaboration platforms, or other specified channels. Electronic products shall use open or Government-supported formats where practicable. Source files, supporting data, code, queries, tests, and configuration records shall accompany final products when applicable.

8.1 Deliverable Content and Acceptance

The Government will review deliverables against this PWS, the approved project plan or task-specific acceptance criteria, applicable standards, and completeness of supporting evidence. A deliverable is not accepted solely because it was submitted or placed in a repository.

The Contractor shall correct rejected or conditionally accepted deliverables within the timeframe established by the COR, consistent with contract terms. Unless otherwise approved, corrected deliverables shall retain revision history and identify the disposition of Government comments.

9.0 PERIOD AND PLACE OF PERFORMANCE

9.1 Period of Performance

The anticipated period of performance is one 12-month base period with four 12-month option periods, subject to contract award, availability of funds, and written exercise of each option by the COR. Actual dates will be established in the contract.

9.2 Place of Performance

Work may be performed at Contractor facilities, authorized Government or JPO locations primarily in the National Capital Region, or through an approved hybrid arrangement. On-site presence may be required for stakeholder workshops, integration events, access to restricted facilities, or other mission needs. The company should be US owned and headquartered in the US. The contractor team should have active Top secret clearances.

Remote work shall use Government-approved collaboration, development, analytics, and data environments. No Government data may be transferred to or processed in an unauthorized location, system, service, device, or account.

9.3 Hours and Responsiveness

Normal support hours are 0800–1700 Eastern Time, Monday through Friday, excluding Federal holidays. The Contractor shall provide coverage consistent with approved operational needs and shall support time-sensitive analysis or incident response when authorized. Requirements for support outside normal hours shall be coordinated in accordance with the contract.

9.4 Travel

Travel within the continental United States may be required. Travel must be authorized in advance and performed in accordance with the contract’s travel provisions and applicable Federal travel requirements. International travel is not authorized unless separately approved in writing.

10.0 GOVERNMENT-FURNISHED PROPERTY AND INFORMATION

Subject to availability, authorization, onboarding, and need-to-know, the Government may provide:

1. Access to JPO-authorized cloud environments, data warehouses, data lakes, development platforms, analytic tools, and BI platforms.

2. Relevant CUI datasets, data dictionaries, existing code, architecture documentation, interface specifications, and JPO Data Strategy artifacts.

3. Government workspace, network access, and collaboration tools for authorized on-site personnel.

4. Points of contact and coordination with the DataOps and DevSecOps Team, OCIO, PMOs, and other stakeholders.

5. Existing standards, templates, review procedures, technical baselines, security controls, and configuration-management requirements.

The Contractor shall inspect Government-furnished information for apparent completeness and promptly identify material gaps, access constraints, or quality issues that may affect performance. Government provision of data does not constitute certification that the data are complete, accurate, fit for a particular model, or authorized for every proposed use.

No Government-furnished property of significant value is anticipated. Any equipment issued will be documented and controlled in accordance with the contract and applicable property procedures.

11.0 SECURITY AND CYBERSECURITY REQUIREMENTS

11.1 Security Scope

This effort will consist of work in both classified and unclassified environments. Information and records will be accessed and processed only by authorized personnel in approved environments.

Personnel will be required to possess active TOP SECRET clearance when identified in the contract; such eligibility does not authorize classified performance under this PWS.

11.2 Personnel Security and Training

Before receiving access, Contractor personnel shall complete applicable background investigation, account provisioning, nondisclosure, privacy, operations security, insider-threat, cybersecurity awareness, and role-based training requirements. The Contractor shall promptly report changes affecting personnel eligibility or access need.

11.3 System and Data Protection

The Contractor shall:

1. Perform all development and processing in Government-authorized environments.

2. Comply with applicable DoD Cloud SRG, FedRAMP, RMF, NIST, STIG, Zero Trust, and JPO security requirements.

3. Use encryption, identity, access-control, key-management, audit, logging, segmentation, and monitoring controls appropriate to the system and data.

4. Use approved software, libraries, containers, services, and data-transfer methods only.

5. Maintain software bills of materials, dependency records, vulnerability results, and remediation evidence when required.

6. Prevent unauthorized disclosure, exfiltration, commingling, model leakage, or use of JPO data to train unauthorized external services.

7. Apply security and handling markings to outputs as directed.

8. Preserve logs and evidence needed for investigations, audits, and authorization activities.

11.4 Incident Reporting

The Contractor shall immediately report suspected or confirmed spillage, compromise, unauthorized access, malware, credential exposure, data loss, or other cybersecurity incident through the procedures and timeframes established by the contract and JPO incident-response process. The Contractor shall preserve evidence, support containment and recovery, and provide required incident documentation.

12.0 PERSONNEL AND MANAGEMENT REQUIREMENTS

12.1 Key Personnel

The Contractor shall designate key personnel for the following functions or equivalent senior labor categories:

1. Data Science / Machine Learning Lead.

2. Enterprise Data Architect.

3. Business Intelligence and Analytics Lead.

If identified as key personnel in the contract, substitutions require GTPOC approval. Proposed replacements shall possess qualifications equal to or exceeding those required by the contract and shall support an orderly transition without degradation of service.

12.2 Qualifications

The Contractor shall provide personnel with demonstrated proficiency appropriate to assigned duties. Collectively, the team shall possess expertise in data science, machine learning, statistics, operations research, cloud architecture, data engineering, database design, DataOps, MLOps, DevSecOps, BI engineering, visualization, cybersecurity, technical writing, and stakeholder engagement. Defense, aerospace, acquisition, sustainment, or F-35 domain experience is preferred when relevant to the task.

12.3 Program Management

The Contractor shall maintain a single accountable program-management structure that:

1. Coordinates work across all task areas.

2. Tracks scope, schedule, cost, workload, risks, dependencies, deliverables, quality, and staffing continuity.

3. Maintains issue, decision, risk, action, and deliverable logs.

4. Escalates impediments requiring Government action.

5. Ensures technical products receive appropriate peer review and security review.

6. Prevents organizational conflicts of interest and protects procurement-sensitive information.

7. Maintains continuity during leave, turnover, surge requirements, and transition.

12.4 Government Oversight

The COR and GTPOC may review status, priorities, deliverables, technical evidence, repositories, and performance data. Government review, comment, or surveillance does not relieve the Contractor of responsibility for quality, security, accuracy, or compliance.

The Government reserves the right, consistent with contract terms, to require removal or replacement of Contractor personnel whose conduct, security status, access, or performance is unacceptable.

13.0 DATA RIGHTS, RECORDS, AND TRANSITION

13.1 Rights in Data and Software

Rights in technical data, computer software, models, source code, documentation, dashboards, architecture artifacts, and other work products shall be governed by the contract and applicable FAR and Defense FAR Supplement clauses. The Contractor shall identify asserted restrictions and pre-existing materials in accordance with the contract. Nothing in this PWS independently expands or reduces the parties’ rights established by those clauses.

The Contractor shall not introduce proprietary dependencies that materially restrict Government operation, maintenance, competition, or transition without prior disclosure and Government approval.

13.2 Government Repositories and Records

The Contractor shall store current source code, models, notebooks, configuration, architecture artifacts, technical documentation, test evidence, and release records in Government-owned repositories designated for the effort. Official records shall be managed in accordance with applicable records-retention requirements.

13.3 Transition and Knowledge Transfer

The Contractor shall continuously prepare for transition rather than deferring documentation until contract completion. Upon Government direction or before the end of performance, the Contractor shall execute a structured transition plan that includes:

1. A complete inventory of models, pipelines, interfaces, data products, dashboards, repositories, environments, accounts, licenses, credentials under Government control, open risks, and known defects.

2. Current architecture, model, data-lineage, configuration, deployment, testing, monitoring, operations, and troubleshooting documentation.

3. Transfer of source code, editable files, release artifacts, backlogs, data dictionaries, and decision records.

4. Hands-on training, demonstrations, recorded walkthroughs when approved, and question-and-answer sessions.

5. Shadow and reverse-shadow activities for Government or successor personnel.

6. Resolution or documented disposition of open incidents, vulnerabilities, data-quality issues, and technical debt.

7. Confirmation that Government-authorized personnel can build, deploy, operate, monitor, troubleshoot, and extend delivered capabilities.

The Contractor shall not withhold documentation, access information, source materials, or transition support required by the contract.

14.0 ACRONYMS

ABAC — Attribute-Based Access Control AI — Artificial Intelligence API — Application Programming Interface AQL — Acceptable Quality Level ATO — Authority to Operate BI — Business Intelligence CAP — Corrective Action Plan CI/CD/CT — Continuous Integration / Continuous Delivery or Deployment / Continuous Training COR — Contracting Officer’s Representative CUI — Controlled Unclassified Information DataOps — Collaborative practices for integrating, automating, and governing data flows and data products DevSecOps — Development, Security, and Operations ETL/ELT — Extract, Transform, Load / Extract, Load, Transform FedRAMP — Federal Risk and Authorization Management Program GTPOC — Government Technical Point of Contact IL — Impact Level JPO — F-35 Joint Program Office KO — Contracting Officer ML — Machine Learning MLOps — Practices for deploying, monitoring, governing, and sustaining machine-learning systems MOSA — Modular Open Systems Approach NIST — National Institute of Standards and Technology NTP — Notice to Proceed OCIO — Office of the Chief Information Officer PMO — Program Management Office PRS — Performance Requirements Summary PWS — Performance Work Statement RBAC — Role-Based Access Control RMF — Risk Management Framework SLA — Service Level Agreement STIG — Security Technical Implementation Guide TDD — Technical Design Document UCD — User-Centered Design ZTA — Zero Trust Architecture image1.png