PWS - PEO MS ITSS (11SEP2020).pdf

PEO MS IT Support Services

PROGRAM EXECUTIVE OFFICE (PEO) MISSILES AND SPACE (MS)

PERFORMANCE WORK STATEMENT (PWS)

PEO MS INFORMATION TECHNOLOGY SUPPORT SERVICES (ITSS)

TABLE OF CONTENTS

1.0 MISSION OBJECTIEVE…………………………………………………...2

2.0 SCOPE………………………………………………………………………..2

2.1 OBJECTIVE………………………………………………………………

3.0 PERFORMANCE REQUIREMENTS……………………………………..3

3.1 CONTRACT MANAGEMENT…………………………………………

3.2 CLOUD SERVICES………………………………………………………...6

3.3 NETWORK MANAGEMENT & TELECOMMUNICATIONS………...6

3.4 SYSTEM MANAGEMENT………………………………………………...8

3.5 CONFIGURATION MANAGEMENT…………………………………….9

3.6 HELPDESK/IT SUPPORT………………………………………………

3.7 BACKUP AND RECOVERY MANAGEMENT……………………

3.8 DATABASE AND SOFTWARE DEVELOPMENT………………..…...11

3.9 DISASTER RECOVERY……………………………………………….…13

3.10 ASSET MANAGEMENT……………………………………………

3.11 CYBERSECURITY………………………………………………………..15

4.0 WORK HOURS AND LOCATION………………………………………16

5.0 OTHER PERFORMANCE REQUIREMENTS………………………

5.1 DEFENSE BASE ACT (DBA) INSURANCE………………………….…18

5.2 MEETINGS, BRIEFINGS, AND PULICATIONS……………………

5.3 CONTRACTOR TRAINING AND CERTIFICATION………………...18

6.0 TEMPORARY DUTY (TDY) TRAVEL…………………………………19

7.0 GOVERNMENT FURNISHED EQUIPMENT OR MARERIALS…

8.0 KEY PERSONNEL………………………………………………………..20

9.0 ANTI-TERRORISM/OPERATIONS SECURITY (AT/OPSEC)………21

10.0 SECURITY………………………………………………………………

11.0 DELIVERABLES…………………………………………………………...25

12.0 DATA REQUIREMENTS………………………………………………...26

12.1 CONTRACTOR’S PROGRESS REPORT, REQUIRED FOR ALL…26

13.0 CONTRACTOR MANPOWER REPORTING………………………..26

13.1 ACCOUNTING FOR CONTRACTOR MAN-HOURS……………….26

14.0 POST-AWARD ADMINISTRATION………………………………….27

15.0 SURGE OPTION SUPPORT…………………………………………

16.0 HOURS OF OPERATION………………………………………………28

16.1 NORMAL BUSINESS HOURS…………………………………………28

16.2 OUTSIDE NORMAL HOURS………………………………………….28

16.3 OPERATIONAL BUSINESS HOURS…………………………………28

16.4 ON-CALL………………………………………………………………...28

16.5 BASE CLOSURE………………………………………………………...28

16.6 CRITICAL SYSTEM SUPPORT……………………………………….28

16.7 CONTINUITY OF OPERATIONS (COOP)/DISASTER RECOVERY…29

16.8 ESSENTIAL SUPPORT POSITIONS…………………………………..29

16.9 HOLIDAYS………………………………………………………………..29

17.0 SEPARATE TASK ORDERS…………………………………………..29

APPENDIX:

A: PERFORMANCE REQUIREMENTS SUMMARY MATRIX

EXHIBITS:

A: GOVERNMENT FURNISHED EQUIPMENT

1.0 MISSION OBJECTIVE.

The Office of the Chief Information Officer (OCIO) provides Information Technology (IT) support to PEO MS which is a Continental United States (CONUS) organization. The OCIO provides centralized life cycle management, direction, guidance, and support for the acquisition, sustainment, maintainability, supportability, and implementation of the PEO, Information Mission Area (IMA). PEO MS is an approved Data Center providing hosting to multiple organizations, Cloud Infrastructure as a Service (IaaS) and Cloud Platform as a Service (PaaS) throughout the US Army Acquisition community. The OCIO is responsible for providing IT support to PEO Head Quarters (HQ), 6 PM Offices, external Army, Navy, Air Force and Marine organizations, as well as, various foreign countries with cooperative agreements. Currently the OCIO supports approximately 2500 desktop users and 300 external users. The mission of the organization is to research, design, test, implement, and maintain automated information systems and technical architectures in compliance with Department of Defense (DoD), Department of Army and higher headquarters directives, which provide solutions for effectively meeting objectives to manage cross-functional life cycle acquisition, logistics, engineering, configuration management, business management, and financial management requirements to the PEO.

2.0 SCOPE.

The general scope of work falls under, but are not limited to, the 3.0 Performance Requirements specialized services listed below:

2.1 OBJECTIVE.

The goals and objectives required shall be automation, data/telecommunications, visual information and records management. The systems supported by this effort are all PEO information and related systems which include the following: Data input/output devices, surge/Uninterrupted Power System (UPS) devices, computers, servers, cloud services/virtualization, networks, communication devices and other peripheral entities that provide business IT services to the organization. Support will also include assistance with the organizations business operations, technical operations, asset management, and risk management.

Non-Personal Services: The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (KO) immediately.

3.0 PERFORMANCE REQUIREMENTS

The performance requirements are illustrated in sections 3.1 – 3.11 and Appendix A of this

PWS.

The total Period of Performance (PoP) for this contract will include a one-month transition period and an 11-month base period, with four 12-month Options to Extend the term of the Contract in accordance with FAR 52.217-9 and one 6-month Option to Extend Services in accordance with FAR 52.217-8.

All services provided hereunder shall comply with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d), and shall meet the applicable accessibility standards at 36 CFR Part 1194. In performance of this contract, the Contractor shall follow and comply with Government regulations, directives, and policies including Cyber Security (CS) and Information Assurance (IA) regulations and security policies. This includes: Federal Information Security Management Act (FISMA); AR 25-1, Army Information Technology;

DA PAM 25-1-1, Army Information Technology Implementation Instructions, AR 25-2, Army Cybersecurity; AR 380-5, Department of the Army Information Security Program;

AR 380-67, Personnel Security Program; DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT); DoDI 8500.01 Cybersecurity; Federal Information Processing Standards (FIPS) Publication 140-2, FIPS Security Requirements for Cryptographic Modules; National Institute of Standards and Technology (NIST) SP 800 series Special Publications (SP) and their associated references; Committee on National Security Systems (CNSSI) 4009; OMB Circular A-130, Managing Information as a Strategic Resource ; DoDI 8551.01, Ports, Protocols, and Services Management (PPSM);

DoD Directive 5230.25, Withholding of Unclassified Data from Public Disclosure; DoD Directive 8140.01, Cyberspace Workforce Management; DoD 8570.01-M, IA Workforce Improvement Program; DoDI 8580.1, IA in the Defense Acquisition System; Best Business Practice (BBP); and all applicable Security Technical Implementation Guides (STIGS) as designated by the Government.

This PWS reflects PEO MS IT Support Services current performance requirements;

however, the intent of the resulting contract is to meet all PEO MS IT Support Services requirements over the life of the contract including changes that may substantially increase or decrease requirements. These changes as long as limited to the organizations and activities supported at contract award will be considered in-scope changes. If these changes are substantial, any resulting increases or decreases in the Firm Fixed Price (FFP) will be renegotiated at that time to reflect a fair and reasonable price for the required services. Reaching a fair and reasonable price may require submission of certified cost and pricing data which the contractor agrees to provide.

3.1 Contract Management

3.2 Cloud services

3.3 Network Management & Telecommunications Maintenance

3.4 System Management

3.5 Configuration Management

3.6 Help Desk/IT Support

3.7 Backup and Recovery Management

3.8 Database Development and Management

3.9 Disaster Recovery & Critical Infrastructure Continuity and Contingency Planning

3.10 Asset Management

3.11 Cybersecurity

3.1 CONTRACT MANAGEMENT.

For Contractor’s management and administrative needs, the Contractor shall provide necessary labor, materials, supplies, services, facilities, and equipment to perform the specific work and services required to support contract performance. The Contractor shall provide staff support to include technical oversight and guidance for all Contractor tasks.

The Contractor shall provide only fully trained, experienced and technically proficient personnel.

The Contractor shall coordinate with customers in order to manage and control the resources necessary to ensure timely achievement of all contract requirements.

The Contractor shall support various Government offices requiring IT services as coordinated through the Government COR or as designated by the Contracting Officer.

Contractor staff shall be required to be co-located with various customers to support mission needs as required by the COR for the duration.

The Contractor shall employ a management system that emphasizes the DoD Management Philosophy of continuous process improvement in providing the information and products there under. of this contract.

The Contractor shall remain knowledgeable in the customer mission areas, application/ solution development, network properties, Government policy and standards, and emerging hardware/software products in compliance with the Army’s/DoD standards and policies throughout the duration of this contract; and as applicable data management, cyber security, information assurance areas, network properties, and security.

The Contractor shall be knowledgeable of the customers’ mission related acquisition, logistics and technology programs and life cycle support for aviation and missile systems.

The Contractor shall be knowledgeable of the functional, technical and business process environments of the customers supported and shall be responsible for responding and adapting to technology changes.

The contractor shall develop and follow a Contract Management Plan that includes technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout contract execution. This Work Plan is to be delivered in accordance with CDRL A004. The contractor shall provide a Project Manager with a minimum of 15 years of experience, IAT Level 3 and Project Management Professional (PMP) certified to serve as the contractor’s single contract manager and shall be the contractor’s authorized interface with the Government Contracting Officer (KO), Contracting Officers Representative (COR), government management personnel and customer agency representatives. Responsible for formulating and enforcing work standards, assigning contractor schedules, reviewing work discrepancies, supervising contractor personnel and communicating policies, purposes, and goals of the organization to subordinates. The Project Manager shall remain current and well versed in the latest IT technologies and provide oversight and guidance in the planning, design, implementation and integration of all current and future projects.

3.1.1 The contractor shall implement an Earned Value Management System (EVMS) as required by FAR Subpart 34.2 – Earned Value Management System and OMB Circular A- 11.

3.1.2 The contractor shall prepare and deliver a Quarterly Progress Report to include the following:

- Major project milestones, timelines and accomplishments

- Staffing status

- Major issues and challenges

- Funding

- Get well plan if any major issues arise (only if needed)

This is to be delivered in accordance with CDRL A001.

3.1.3 The contractor shall prepare and deliver a trip report as required for the duration of the contract in accordance with CDRL A012.

3.1.4 A contractor Phase-In period of 30 days is required.

3.1.5 Phase-Out: Prior to final completion of each TO under this PWS, the contractor shall provide transition information to and coordinate with the incoming contractor/government personnel as described below. This is to be delivered in accordance with CDRL A005. These requirements are in addition to standard procedures such as clearing of post. The contractor shall work in coordination with the incoming contractor/government personnel during the transition period not to exceed 30 days prior to the TO completion date. Additional workspace may be provided by the government during this period. The contractor shall provide the COR with detailed written descriptions and procedures for all ongoing and recurring activities no later than 30 days prior to the end of the TO. During the final 30 day period of each TO effort, the contractor shall promptly provide to the COR all documentation and work-in-progress applicable to the TO effort, return any government furnished property in its possession, and identify all required passwords utilized in connection with the TO. The contractor shall make no further changes to passwords without notification to the COR. The contractor shall handoff to the incoming contractor or Government personnel as specified copies of all software items worked on in both executable and source code, and all other draft documents and reports not yet delivered.

3.2 CLOUD SERVICES .

PEO Missiles and Space utilizes an on-premise VMware vCloud Director Infrastructure as a Service (IaaS). The contractor shall provide the skillset necessary to design, implement and support software-defined services for computing, storage, networking, security, and cloud management to run enterprise applications traditional or containerized in a hybrid cloud environment. The contractor shall provide the experience and skillset necessary to manage the following VMware technologies: VMware vSphere (computing), VMware vSAN (storage), VMware NSX (networking and security), and VMware vRealize Suite (cloud management). The current environment provides a native Kubernetes platform, enabled with VMware Enterprise PKS. The platform integrates with VMware NSX to provide platform as a service (PaaS). The contractor shall also include the planning, design, and implementation of a Virtual Desktop Environment (VDE) and Virtual Desktop Infrastructure (VDI). The contract shall provide Cloud Computing Services in accordance with DFAR Clause 252.239-7010.

PEO Missiles is a US Army Cloud service provider and has entered into a partnership agreement with VMware as a VMware Cloud Provider. PEO MS consumes VMware products on a pay-as-you-go, pay-as-you-grow, monthly subscription model. This partnership has required VCPP Cloud Provider training that the contractor must maintain in order for PEO Missiles to maintain this agreement. This program saves the PEO and the US Army a considerable amount of licenses fees annually.

3.3 NETWORK MANAGEMENT & TELECOMMUNICATIONS

MAINTENANCE.

The contractor shall provide voice, data and video services for all the PEO networks and systems to include the PEO Enterprise Network, PEO Classified network, PEO Classified Standalone systems and all relevant applications, interfaces and devices in approximately 32 individual facilities. The contractor shall diagnose and repair interconnectivity issues between other interconnected Local Area Networks (LANs)/Wide Area Networks (WANs) and communications networks, both Unclassified and Classified. The contractor shall provide network monitoring, testing, management and administration services required to maintain and re-engineer all existing and future PEO networks.

The contractor shall provide cutting edge mission network solutions utilizing voice, data and video networks comprised of both classified and unclassified networks, and Stand-alone systems. The contractor shall implement industry best practices and standards for mission network support, including Information Technology Infrastructure Library (ITIL), Lean Six Sigma (LSS), Alabama Quality Award (AQA), Malcolm Baldridge and Capability Maturity Model Integration (CMMI) compliant processes. The contractor shall provide network management for mission telecommunication networks (e.g. LAN), utilizing state-of-the-art techniques and protocols that adhere to best industry practices, security regulations, policies, and guidelines. The contractor shall utilize network management routines, procedures, and methodologies to monitor network traffic, detect and resolve network failures, enhance network performance, and perform network administration functions. The contractor shall provide mission network support that includes the standard duties expected of mission network support administrators to maintain highly secure and available systems (24/7 basis).

3.3.1 The contractor shall establish and maintain a mission network infrastructure in support of the PEO MS information systems requirements for new telecommunication networks and expansion of existing networks. The contractor shall design, develop, install, configure, and optimize network infrastructure components and devices to include firewalls, Intrusion Detection System (IDS)/Intrusion Prevention System (IPS), Active Directories, switches, routers, hubs, bridges, cabling, fiber optics, and network operating systems. The contractor shall provide network schematics based on customer requirements, security requirements, interoperability requirements, and data management requirements in accordance with CDRL A009

3.3.2 The contractor shall assist with mission network planning and policies. The contractor shall develop technical methodologies to insure the interoperability of networks to support enterprise technology solutions and support world-wide mission users. The contractor shall evaluate, recommend, and implement network bridging hardware and software; protocol conversion hardware and software; cross-network data sharing and exchange software; and methodologies for data protection. The contractor shall conduct analysis to determine the best approach for implementing Network Load Balancing (NLB) for virtual environments, and mission applications. The contractor shall submit a draft of the recommended approach and a recommended implementation strategy in accordance with CDRL A006.

3.3.3 The contractor shall maintain the security and authorization of the network, as it relates to mission network support and operations. The contractor shall control connections and access to the mission network. The contractor shall control user accounts and privileges. The contractor shall provide data and information regarding the overall system security, as it relates to mission network support. The contractor shall work with the security team to identify, fix, and provide information regarding resolving vulnerabilities, and computer incidents. Deliverables shall be delivered in accordance with CDRL A008.

3.3.4 The contractor shall resolve interconnectivity issues between other interconnected LANs/WANs and communications networks by performing troubleshooting, fixes, customizations, and upgrades to the mission network for approved releases; plan and execute the installation of upgrades; and coordinate with the Chief Information Officer (CIO), team leads and others, as designated by the government.

3.3.5 The contractor shall maintain currency of knowledge with respect to relevant, state-of-the-art hardware, software, and solution sets in order to provide innovative solutions and recommendations.

3.3.6 The contractor shall provide Configuration Management (CM) services for mission network support activities that utilize the automated CM Tools provided by the government. The contractor shall perform activities for configuration identification, configuration control, configuration status accounting, and configuration audits. The contractor shall utilize automated tools provided by the government to perform configuration management activities for network components, including network policies and configurations.

3.3.7 The contractor shall provide the data and information needed to maintain Mission Network SOPs and documentation in accordance with CDRL A006.

3.4 SYSTEM MANAGEMENT.

The contractor shall provide systems administration and maintenance on 4 separate networks consisting of approximately 95-100 ESXi Hosts, 200+VMs/appliances and over 450 vDI Windows 10 desktops. The contractor shall provide system level applications written and maintained by in-house developers, file systems and restricted shell access menus. The contractor shall provide hardware troubleshooting, maintenance, system backups, system updates and helpdesk support for the PEO’s Information Systems users, both wired and wireless, with Personal Computers (PCs) and Personal Electronic Devices (PEDs). The contractor shall provide user required system orientation on any or all systems specified herein; shall develop test data to ensure that software performs, as required; shall provide updated documentation, as required; and shall provide assistance to users (both hardware and software) on any standard Department of the Army (DA), Assistant Secretary of the Army (Acquisition, Logistics, and Technology) (ASA (ALT)), or locally developed programs/systems, which must be utilized by PEO MS for its mission performance. The contractor shall provide advice and assistance to higher headquarters in implementing new and/or updates to standard systems being installed within PEO locations. Deliverable shall be provided in accordance with CDRL A013. The contractor shall provide expertise in architecture, management, and performance tuning. The contractor shall provide hardware/software administration for server and network infrastructure. PEO MS is currently expanding Data Center capabilities to provide multi-level IT as a Service (ITaaS) capabilities to the US Army Acquisition Domain and community. The contractor shall continuously refine architecture, in order to sustain and scale current cloud infrastructure. The contractor shall provide SA support in order to maintain highly secure and available systems (24/7 basis) by adhering to Army Information Management &Technology (IM&T) standards, regulations, and implementing industry best practices.

3.4.1 The contractor shall perform system administration, monitoring, and reporting of system reliability, availability, maintainability, capacity, and performance across the enterprise. The contractor shall identify and resolve system interoperability issues. The contractor shall coordinate with the government prior to scheduling and implementing system administration maintenance activities.

3.4.2 The contractor shall perform hardware installations of new equipment, e.g., servers (e.g. Windows, Unix, Network Devices, and Virtual Machine Components), virtual file servers, and storage devices. The contractor shall provide System Administration Planning.

The contractor shall ensure system performance through diagnostics using appropriate parameters and protocols in coordination with DA, ASA(ALT), Defense Information Systems Agency (DISA), and others, as designated by the government.

3.4.3 The contractor shall perform system analysis, design, implementation, sustainment and retirement activities in compliance with the PEO MS existing software development standards, including the PEO MS automated CM tool. The contractor shall adhere to the PEO MS Policies and SOPs.

3.4.4 The contractor shall establish and sustain virtual infrastructure; migrate selected mission applications from legacy environments to the latest virtual hardware/software platforms; and establish new mission applications into virtual hardware/software platforms.

The contractor shall compile and execute ready object code for the software on government specified computers and operating systems. The contractor shall continue to configure Virtual Machine (VM) servers, create virtual desktops, and create VM views. The contractor shall configure and control the active directory. The contractor shall optimize VM components, and reduce lag time.

3.4.5 The contractor shall utilize automated tools provided by the government to provide a Ports, Protocols, and Services (PPS) list.

3.4.6 The contractor shall provide the data and information needed to assist with the maintenance of System Administration SOPs and documentation.

3.5 CONFIGURATION MANAGEMENT.

The contractor shall provide configuration management services for system and database administration activities that utilize the automated CM Tool implemented by the government. The contractor shall perform activities for configuration identification, configuration control, configuration status accounting, and configuration audits. The contractor shall utilize automated tools provided by the government to maintain hardware information that addresses the manufacturer, type, model, machine name, product description, version, Internet Protocol (IP) Address, Mission Assurance Category (MAC), location, operating system, and status. The contractor shall utilize automated tools provided by the government to maintain software information that addresses the software product name, version, type, and licensing status.

3.6 HELPDESK/IT SUPPORT.

The contractor shall provide state-of-the-art solutions in response to inquiries from PEO MS IT users. The contractor shall respond to inquiries from computer users and assist in resolving IT problems. The contractor shall also diagnose computer hardware and software issues. The helpdesk will remain embedded within the OCIO.

3.6.1 The contractor shall respond to telephone calls and utilize the automated service desk to assist customers with computer/software problems. The contractor shall diagnose the nature of the problem and walk the customer through the problem-solving steps.

3.6.2 The contractor shall provide technical guidance in the utilization of computer hardware and software, including installation, operation, and troubleshooting. The contractor shall be proficient in the software and hardware used by the government. The contractor shall be able to readily provide guidance and resolve issues.

3.6.3 The contractor shall provide technical assistance support services, including receiving, logging, routing, resolving trouble calls, and follow-up reporting.

3.6.4 The contractor shall operate and provide technical assistance on computer equipment, including desktops, laptops, portable computers, high-speed printers, scanners, plotters, printers, and other specialized computer equipment.

3.6.5 The contractor shall provide reporting that includes metrics, such as number of calls, types of calls, resolution times, trend analysis, and other data that will assist the government in managing the Service Desk and assisting customers and will submit in accordance with CDRL A014.

3.7 BACKUP AND RECOVERY MANAGEMENT.

The contractor shall develop and operate backup and recovery strategies for all PEO MS data. The contractor shall verify that storage, archiving, backup, and recovery procedures are tested and functioning correctly in accordance with government approved test plans.

The contractor shall coordinate work with the CIO and team leads, and others, as designated by the government. Data backup and recovery will performed in accordance with CDRL A015.

The contractor shall ensure the on-site backup and restore solution is compatible with Linux NFS and Windows CIFS/SMB Protocols ensuring that they support Fiber Channel, Internet Small Computer System Interface (iSCSI) interfaces, Network Data Management Protocol (NDMP) and VMware vStorage API for Data Protection (VADP) and are certified to operate on the current Enterprise SAN infrastructure. Contractor must continually be validating Recovery Point Objective (RPO) and acceptable Recovery Time Objective (RTO) within applicable SLAs.

The contractor shall ensure the cloud backup and restore solution is compatible with VMware onsite and VMC Virtual Private Clouds that are supported by VMware.

3.8 DATABASE AND SOFTWARE DEVELOPMENT AND MANAGEMENT.

The contractor shall provide the design, development, testing, deployment and maintenance of software applications to meet the proponent requirements of the PEO MS. Software applications include government off-the-shelf (GOTS), modified off-the-shelf (MOTS), and commercial off- the-shelf (COTS) that are used on both unclassified as well as classified PEO MS systems. Applications are used to support the acquisition functions of the PEO including but not limited too Financial Management, Logistics, Configuration Management, Program Management, Contracts Management and Systems Engineering.

The contractor shall provide a Technical Point of Contact (POC) for configuration, installation and support software and associated hardware.

The contractor shall provide software, design, and enterprise/platform application development in the form of writing, testing, executing, and maintaining the source code.

Software development may include research, new development, modification, reuse, re-engineering, maintenance, or any other activities that result in software products to meet the needs of specific client/business requirements of the PEO and its PMs. This requires the development process to be integrated with the development of the controlled physical product. The contractor shall be responsible for providing modifications and maintenance to all legacy systems, as well as any new software development.

The contractor shall provide administration and management for approximately 759 Enterprise and Standard Microsoft Structured Query Language (SQL) production databases and other various databases that may be implemented in the future, for classified and unclassified environments. The contractor shall provide database support in order to maintain highly secure and available systems (24/7 basis) by adhering to Army regulations and implementing industry BBPs. Software code is to be delivered without restrictive markings unless data rights assertions have been approved by the KO in accordance with CDRL A010. All restrictive markings shall be in accordance with all Government data rights clauses.

3.8.1 The contractor shall create, update, and maintain local and remote database environments to effectively utilize existing and shared resources to ensure availability and integrity of databases across development, staging, pre-production, production, and training environments. The contractor shall utilize automated tools, as specified by the government to identify database capacity and availability; optimize database performance and resource usage; predict impending database problems; ensure database reliability and maintainability; provide solutions to correct data base problems; and maximize database throughput. The contractor shall coordinate with the government prior to scheduling and implementing database maintenance activities.

3.8.2 The contractor shall perform database analysis, design, implementation, sustainment and retirement activities in compliance with the PEO MS existing software development standards. The contractor shall participate in work groups and meetings to address database administration activities. The contractor shall track and document database administration activities through technical service tickets utilizing automated tools provided by the government.

3.8.3 The contractor shall apply IAVA security and software patches, implement security regulations, and verify compliance with security policies in accordance with DoD, Army and organizational policies, regulations, and guidance, as designated by the government.

The contractor shall coordinate with the government prior to scheduling and implementing patches.

3.8.4 The contractor shall provide strategic database recommendations for implementation of future database releases, and reporting metrics across the database enterprise. The contractor shall adhere to and implement recommended methodologies to enforce standardization and flexibility across the database enterprise.

3.8.5 The contractor shall develop and maintain source code in compliance with secure coding standards, application STIGS, and all applicable government regulations, guidance, and directions. The contractor shall prepare and deliver all technical data and computer software to include source code in accordance with CDRL A008. The contractor shall participate in the development and execution of test plans, procedures, and reports for application unit, integration, and software acceptance testing. The contractor shall perform source code configuration management, environment management, and production code deployment utilizing the COTS/GOTS software provided by the government.

3.8.6 The contractor shall perform the activities necessary to maintain security and application authorization, as it relates to application support. The contractor shall control connections and access to the database, including user accounts and privileges, in accordance with PEO MS policies. The contractor shall provide data and information and make recommendations regarding the overall system security, as it relates to system administration. The contractor shall work with the security team to identify, fix, and provide information regarding resolving vulnerabilities, and computer incidents.

3.8.7 The contractor shall provide business application development to implement and promote Knowledge Management initiatives within PEO Missiles and Space. These include GOTS applications written in .NET, MOTS solutions such as TeamTrack and SharePoint, and COTS applications that require system administration support such as those that make up the PEO’s Digital Enterprise (DE). These DE applications include Microsoft Project Server, Active Risk Manager (ARM), MagicDraw Teamwork Cloud, and Windchill. The contractor shall ensure that applications are available and operational for end users. Tasks will include managing user licenses, user accounts, patching, and other associated maintenance activities.

3.9 DISASTER RECOVERY AND CRITICAL INFRASTRUCTURE

CONTINUITY AND CONTINGENCY PLANNING.

The contractor shall perform activities, make recommendations, and provide advice used for development of plans, processes and procedures to ensure a resilient infrastructure which minimizes impacts of events with the potential to disrupt mission-essential functions by identifying and mitigating threats, vulnerabilities, and risks. The contractor shall conduct risk management, contingency, and continuity planning activities and implement them in a comprehensive manner across all IT Enterprises. The contractor shall provide Business Impact Analysis (BIA) recommendations to determine the overall system security impact level based upon the security objectives, which include: confidentiality, integrity, and availability. The contractor shall recommend contingency strategies based on impact levels of the security levels. IT components identified by the government, as high impact shall be provided high-availability and redundancy options in the system design, such as load-balancing, data mirroring, and data replication. Lower-impact IT components are those able to tolerate longer downtimes for recovery or restoration of data and shall be provided less expensive contingency options. All IT Contingency Planning and Resilience activities shall be executed IAW AR 25-1, AR 25-2, National Institute of Standards and Technology (NIST) Special Publication 800-82, and all other applicable guidance and policy. The contractor shall develop, manage and maintain IT contingency plans, as prescribed by the Army Cyber Command (ARCYBER), to ensure the uninterrupted execution of essential missions and functions under all conditions in DA Pam 25-1-2. The contractor shall review, evaluate expected effectiveness, and make recommendations to improve current IT Contingency Plans for hardware/software platforms and mission applications utilizing BBPs and complying with new and current Army Regulations. All contractor actions, findings and recommendations shall be reported in the required documentation as directed by the government and in accordance with CDRL A011.

The contractor shall also provide advice and recommendations in the development, distribution, execution, testing, and maintenance of the Business Continuity Plans (BCPs) to ensure the uninterrupted execution of essential missions and functions as identified by the government. The BCP will identify and direct development of mission applications that meet DoD standards for disaster recovery in accordance with AR 500-3, and any other applicable regulations, guidance, and policies. The contractor shall provide advice and recommendations for the development of IT Disaster Recovery Plans. The contractor shall provide data and information regarding Disaster Recovery Plans that address backup security; backup and restoration software and procedures; backup media storage; backup schedules; backup audit records; and trusted recovery. The contractor shall report on issues and resolutions regarding backup failures; and shall test disaster restoration abilities. The contractor shall confirm Disaster Recovery Plans result in successful outcomes through troubleshooting; confirm the ability to recover systems, software, databases, and reload software; and confirm system integrity. The contractor shall make recommendations to improve Disaster Recovery Plans. All plans and other materials shall be delivered in accordance with CDRL A011.

In the event of a Continuity of Operations (COOP) situation the contractor will assist with the reconstitution of the current IT infrastructure.

3.10 ASSET MANAGEMENT.

The contractor shall provide on-site Asset Management for the PEO MS for IT-related equipment inventory of nonexpendable, expendable, and durable government equipment for 1 Hand Receipt Holder (HRH). The current HRH inventory covers at least 1,600 active items and 8,000 inactive/archived items with a value over $5 million. The contractor shall coordinate with the Installation Property Book Office for input into the Defense Property Accountability System (DPAS) for all equipment items valued over the $500 threshold and for other equipment if required by Army Regulations. The contractor shall manage all durable and expendable equipment over the $500 threshold, and ensure all IT equipment is input and tracked in the ASTS database maintained internally by PEO MS.

3.10.1 The contractor shall perform the following asset management functions in accordance with (IAW) applicable Army regulations and PEO MS policies/guidance by adhering to: AR 710-1, Centralized Inventory Management of the Army Supply System;

AR 710-2, Supply Policy Below the National Level; AR 710-3, Inventory Management Asset and Transaction Reporting System; DA PAM 735-5, Property Accountability:

Financial Liability Officer's Guide; AR 735-5, Property Accountability: Policies and Procedures for Property Accountability; AR 25-1, Information Management: Army Information Technology; and AR 71-32, Force Development and Documentation Consolidated Policies and the PEO MS Property SOP.

3.10.2 The contractor shall receive IT-related equipment, verify accuracy of delivery, and document/input information in the ASTS and DPAS databases. The contractor shall apply appropriate barcodes to equipment, store equipment in designated locations, and transport equipment to appropriate users. The contractor shall prepare required documents and paperwork for DA Forms 2062 and DA 3161 for HRH regarding newly purchased items, the transfer of items, the transport of property to another location, and turn-in/disposal of existing property. The contractor shall perform annual updates of all DA form 2062 for sub hand receipt holders.

3.10.3 The contractor shall maintain the DPAS database for all assigned HRHs; track barcodes, serial numbers and locations of assets; and maintain complete accountability of all PEO MS IT property.

3.10.4 The contractor shall conduct monthly 100% Sensitive Item Inventories and at other times as required by the government.

3.10.5 The contractor shall conduct 25% quarterly property inventories and a 100% inventory annually.

3.11 CYBERSECURITY.

The contractor shall provide program management, systems engineering, software engineering, product assurance, CS, Test, and development documentation to support the cybersecurity Assessment and Authorization (A&A) of PEO MS systems. The contractor shall deliver an operational system that satisfies the requirements to obtain an Authority To Operate (ATO) or Interim Approval to Test (IATT) as appropriate for the mission. The contractor shall perform and/or support the following requirement:

1. Complete an implementation of the System CS and CS-Enabled IT products IAW DoD CS requirements validated by the Security Control Assessor –Validator (SCA- V) and NETCOM.

Cyberspace is particularly difficult to secure due to a number of factors: the ability of malicious actors to operate from anywhere in the world, the linkages between cyberspace and physical systems, and the difficulty of reducing vulnerabilities and consequences in complex cyber networks. Of growing concern is the cyber threat to critical infrastructure, which is increasingly subject to sophisticated cyber intrusions that pose new risks. As information technology becomes increasingly integrated with physical infrastructure operations, there is increased risk for wide scale or high-consequence events that could cause harm or disrupt services upon which our economy and the daily lives of millions of Americans.

Effective cybersecurity management is essential to protecting our nation’s technology infrastructure. The professionals accountable for this protection constitute a critical workforce. As a nation, we must establish consistency in how the cybersecurity workforce is defined and classified.

3.11.1 The contractor shall provide Cybersecurity for critical infrastructure with personnel with the necessary skillsets listed below:

Systems Operations Professionals: Installs, configures, troubleshoots, and maintains server configurations (hardware and software) to ensure their confidentiality, integrity, and availability. Also manages accounts, firewalls, and patches. Responsible for access control, passwords, account creation and administration. Installs, configures, tests, operates, maintains, and manages networks and their firewalls, including hardware (e.g., hubs, bridges, switches, multiplexers, routers, cables, proxy servers, and protective distributor systems) and software that permit the sharing and transmission of all spectrum transmissions of information to support the security of information and information systems.

Data Administrator: Develops and administers databases and/or data management systems that allow for the storage, query, and utilization of data.

Software Developer: Develops and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs following software assurance best practices.

3.11.2 The contractor shall provide Information Systems Security to critical infrastructure with personnel with the necessary skillsets listed below:

Information Security Auditor/Information Systems Security Manager: Oversees, evaluates, and provides the documentation, validation, and authorization processes necessary to assure that new information technology (IT) systems meet the organization’s cybersecurity and security requirements. Ensures appropriate treatment of risk, compliance, and assurance from internal and external perspectives. Conducts assessments of threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations.

Information Security Architect: Develops system concepts and works on the capabilities phases of the system development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into system and security designs and processes. Works on the development phases of the systems development lifecycle.

Risk and Vulnerability Analyst: Conducts assessments of threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and nonoperational situations. Conducts the integration/testing, operations, and maintenance of systems security.

4.0 WORK HOURS AND LOCATION.

The principal place of performance for this contract shall be Redstone Arsenal, Alabama and the local area associated with Redstone. The contractor may be required to provide labor hours in excess of 40 hours per work week to include holiday and weekends, and/or during irregular times and shifts based upon OCIO operations and exercises.

Situational telework may be authorized in the performance of the contract. Situational telework will be approved by the COR and Contracting Officer prior to performance.

Telework shall be prohibited if it is determined by the Contracting Officer that the requirements of the agency, including security requirements, cannot be met if telework is permitted. Approval will be on a case-by-case basis.

5.0 OTHER PERFORMANCE REQUIREMENTS.

The contractor is responsible for performing the following additional performance requirements. Examples of additional performance requirements include:

• The helpdesk will be centrally located and embedded within the OCIO.

• The contractor shall provide all local transportation for personnel on this contract utilizing GSA vans. The Government will not acquire or at the end of the contract, take delivery of any vehicles that were supporting this contract. All vehicles costs, to include maintenance and repair, shall be clearly depicted in the price volume.

• The government requires the contractor to have a local presence in Huntsville, Al.

• The contractor shall address and ensure employee recruitment, attrition rates and employee retention are a major focus throughout the contract lifecycle and quarterly updates will be provided to the COR in accordance with CDRL A001.

• 24/7 after hours support requirement for Executive Management will be covered under ODC.

• The contractor shall use the same direction given to government personnel concerning federal holidays and base closures.

• The contractor shall participate and provide input in all required aspects of the RMF Assessment & Authorization (A&A) process required for the successful completion of this PWS in accordance with CDRL A008.

• Extensive knowledge of Cloud Computing and VMware Configuration and Management are a must.

• The contractor shall implement an EVMS as required by FAR Subpart 34.2 – Earned Value Management System and OMB Circular A-11.

• Provide system administration support to applications that make up the Digital Enterprise. These applications include Microsoft Project Server, Active Risk Manager (ARM), MagicDraw Teamwork Cloud, and Windchill. Support is primarily to ensure that applications are available and operational for end users.

Tasks will include managing user licenses, user accounts, patching, and other associated maintenance activities.

• Special Software list shall be supported:

- VMware

- VMware vCloud Platform

- vCloud Director

- VMware NSX

- vRealize

- vSphere

- Serena Business Manager

- .NET with C#

- SharePoint Administration

- Laserfiche

- IBM Rational products

- Project Server

- Winsight

- Visual Studio

- F5 Networking Technology

- Cisco Networking Infrastructure

- MoveIT DMZ

- SQL Reporting

- Fortify

- Telerik/Kendo UI

- Cohesity Backup Solution

- MagicDraw

- Active Risk Manager

- Windchill

- ATHOC

- ASTS

- AnyMap

- Aspose Total for .NET

- Metalogix Content Matrix

- Metalogix Control Point

- Idera SQL Toolbox

- Cisco Meeting Server (CMS)

- Cisco WebEx Meeting Server (CWMS)

- Cisco Unified Communications Manager (CUCM)

- Cisco Unified Presence (CUP)

- Cisco TelePresence Management Suite (TMS)

- Cisco Video Communication Server (VCS)

- Cisco Identity Services Engine (ISE)

- Cisco Web Security Appliance (WSA)

- Infoblox DNS, DHCP & IPAM (DDI)

- SolarWinds Network Performance Monitor (NPM)

- SolarWinds Network Configuration Manager (NCM)

* This list could change if additional requirements arise or change.

5.1 Defense Base Act (DBA) Insurance.

No personnel will be performing duties in hazardous areas OCONUS.

5.2 Meetings, Briefings, and Publications.

The contractor shall participate in technical interchange meetings, to be scheduled upon request of the responsible Contracting Officer or written designee, to discuss and to informally evaluate the contractor’s efforts and accomplishments in direct relation to specific contractor. During the meetings, the contractor shall present necessary data to enable a joint review of its various assigned tasks, attendant schedules, and resource expenditures. The contractor shall present and participate in technical discussions and shall inform, in a timely fashion, the COR of any problems with contract execution and any proposed solutions. The contractor shall attend and participate in other meetings, as scheduled by the responsible contracting officer or written designee.

A kick-off meeting is required within 14 days of contract award in which the contractor will provide the meeting minutes.

5.3 CONTRACTOR TRAINING AND CERTIFICATION

5.3.1 The contractor shall ensure that personnel accessing information systems have the proper and current cybersecurity certification to perform cybersecurity functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, AR 25-2, Army Cybersecurity, and DA PAM 25-2-6, Cybersecurity Training and Certification Program.