PWS PubWeb (DRAFT).docx

PERFORMANCE WORK STATEMENT (PWS)

as of 11 May 2021

1. Contracting Officer Representative (COR).

MANDATORY - ALL REQUESTED INFORMATION MUST BE COMPLETED

a. Primary COR. To be Determined

b. Alternate COR. To be Determined

2. Contract Title. Public Web Services

3. Background.

Defense Media Activity Public Web (DMA-PW) operational activities include providing professional labor service and associated commodity required to execute these services, including training, migration operations, infrastructure operations, software development and maintenance, creative services, program management, security, analysis, support to service desk operations, 24/7 technical support, and transition. Further, this effort covers a high- performance, world-wide content distribution network (CDN) as well as AWS/Azure commodity. This effort is required to continue support for the Public Web mission by provisioning these requirements in Subtasks 1-17 from 11 Dec 2021 through 30 September 2022 with transition projected from 1 October 2021 through 11 December 2021. This contract includes support for DMA and its customers. DMA has identified the need for twelve (12) labor and five (5) commodity tasks as follows.

4. Objectives.

Defense Media Activity Public Web (DMA-PW) objectives are to provide public web hosting and integrated services to all Department of Defense (DoD) components 1 Oct 2021 through 29 Sep 2022. This PWS will provide a core service of standard website hosting as well as a menu of optional services that federal and DoD units may require to optimize their public information communication objectives.

5. Scope.

The objective and the purpose of the effort are to provide a fully functioning best in class Public Web operations center and other support requirements as deemed necessary by DMA and other government entities. This includes all professional labor services required to execute this objective, including labor and commodity to provide and provision Azure Cloud software- as-a-service, Akamai labor and commodity, software subscriptions, collaborative communication platform, LMS and training, migration operations and program management, infrastructure operations and program management, provide security, threat log reporting, code scanning ,metrics reporting, accessibility reporting, software development and maintenance, customer relations management, program management, security, analysis, continual vulnerability assessments, support to service desk operations, 24/7 technical support, and transition. Additionally, the program will offer a menu of services website owners can opt into such as creative services, content creation, search engine optimization services, email subscription services, sentiment analysis services, news clipping services, customer satisfaction surveys and other services as necessary. Furthermore, this effort is to provide all services necessary to maintain and support the GCDN and the reasonable growth of the GCDN.

6. Performance Requirements.

Provide best in class public web and integrated services for the Department of Defense and other Federal Agencies as listed below.

Subtask 1 Ensure Legal and Regulatory Compliance

Subtask 1 Threat Log Reporting

Subtask 2 Code Scanning

Subtask 3 Continual Vulnerability Assessments

Subtask 1 Accessibility Reporting

Subtask 1 Custom Development Work

Subtask 2 Creative Services

Subtask 3 Search Engine Optimization Services

Subtask 4 Sentiment Analysis Services

Subtask 5 News Clips

Subtask 6 Website Customer Satisfaction Surveys

Subtask 7 Other

6.1 Task 1: Microsoft Azure Commodity, provide labor and program management

Contractor shall have one or more of the following credentials for Microsoft Azure to indicate expertise.

· Microsoft Azure Certified Cloud Partner

· Microsoft Azure authorized reseller

Contractor shall also provide that they have: 1) provisioned Microsoft Azure soft-ware, infrastructure, and platform to establish a Cloud architecture; 2) experience in performing professional labor in migrating existing Web sites into the Cloud and new Cloud site planning, host platform architecture setup, Cloud deployment, making changes to provisioned software, infrastructure, and platform, installing patches/updates, related development, security assessments, analysis of data, reporting, and any other activities required for daily loud operations; 3) experienced in an information technology contract with commodity and professional labor elements with the requirement for establishing a Cloud architecture.

The Contractor shall provide Cloud software, infrastructure, and platform deliverables as necessary for this contract. The Contractor shall provision software, infrastructure, and platform, and establish Government administrator accounts for these commodities.

The deliverables (Contractor provisioned Cloud software, infrastructure, and platform (i.e., rent infrastructure such as servers and drives maintained physically at Contractor data centers, but accessed by Government administrators) subscriptions and Government administrator accounts for them) shall be consistent with and further detail the approach contained in the Contractor’s proposal that resulted in the award of this contract and in compliance with the requirements stated in the clause mentioned under this task. The Contractor shall deliver these software, infrastructure, and platform administrator accounts to the COR within 15 calendar days of notification by the COR. The Contracting Officer and COR will provide an acceptance or feedback to the Contractor on submitted deliverables. If the Contractor receives corrective feedback, then the Contractor has seven calendar days to provide the Contracting Officer and COR the correct deliverables based on comments provided by the Government. The Contractor must provision deliverables that comply with Federal laws, regulations, and policies identified by the COR (e.g., DoD regulations, DoD Security Technical Implementation Guides (STIGs), TASKORD’s, Cybersecurity, and DMA and DISA policy requirements).

Cloud subscriptions must include Government administrator access to a 24 x 7 technical call center (i.e., response from customer agents on technical software, infrastructure, and platform issues and general customer support questions). The Contractor must provision software, infrastructure, and platform from Federal Risk and Authorization Management Program (FedRAMP) compliant data centers to provide a logical separation of tenants and other operational controls to provide security, high availability, and redundancy to satisfy the control requirements for the NIST 800-53 Moderate Baseline or the most current standards.

The Contractor shall provide software, infrastructure, and platform (which includes Microsoft Azure, vendor and partner products) and/or best industry products (which provide equal or greater capabilities as the products they are replacing) as approved by the COR for each contract award/task order. The Contractor shall provide provision software, infrastructure, and platform that provide the following capabilities:

· Automated or manual notification of vendor planned maintenance outages at least two days prior to the event or as directed by the COR

· Retrieval of performance metrics below or other metrics as directed by the COR

· System and application availability

· Overall application response times

· Network infrastructure performance

· Cloud and instance level utilization

· Security, risk, compliance, and data integrity measurement

· Includes, but is not limited to, Cloud Lock or best industry product(s) approved by the COR

· Secure, web-based tool for DMA to monitor bandwidth usage and analyze trends for all sites and site functionality in real time.

· Best industry standards or a minimum of 100 TB of content storage when required to meet customer requirements.

· Best industry standards or a minimum network capacity to upload content files one megabyte or smaller in seven seconds or less. The COR has the ability to waive this requirement if it's beyond the Contractor's control (e.g., insufficient NIPRNet connectivity).

· Best industry standards or a minimum page load time of 10 seconds for all content management system pages. The COR has the ability to waive this requirement if it is beyond the Contractor's control.

· Secure communication channel with multi-factor authentication of remote access that allows Government designated personnel to perform duties on the infrastructure (i.e., DoD PKI or FIPS 140-2 compliant solution).

· Best industry standards or a minimum steady-state VPN sustained bi-directional transfer rates of 50 mb/s between the Government’s existing infrastructure and the Cloud. The COR has the ability to waive this requirement if it's beyond the Contractor's control.

· Network storage, server and virtualization layer management to include performance of internal technology and refresh cycles applicable to the environment.

· Tools and processes for monitoring the availability and overall health of the proposed infrastructure and all of its components, responding to system outages with troubleshooting activities designed to identify and mitigate operational issues quickly.

· Aggregate and individualized load monitoring of all execution environments, including but not limited to processor load, number of processes, memory utilization, storage utilization, storage throughput, storage operations per seconds, storage seek time,

· network throughout, network packet loss, and network connections.

· Automated and user-scheduled backup of Cloud content on a monthly basis or on a more frequent basis. Cloud content must be backed up in geographically separated locations for disaster recovery/contingency purposes.

· Mechanism for the bulk retrieval of all data, scripts, software, virtual machine images, and so forth such as mirroring or copying.

· Content caching where appropriate.

· Customer technical support desk that provides 24/7 support with a response time of eight hours or less.

For the critical factors below, if the Contractor fails to perform work as necessary to meet the technical requirements, payment will be withheld and liquidated damages may be charged to the Contractor until the work is accomplished or accepted by the Government.

· Best industry standards or a minimum baseline bandwidth for websites served from the Cloud of 30 megabits per second (mb/s) for dynamic, non-streaming content at award with bursting capabilities of 10,000 – 15,000 mb/s

· Best industry standards or a minimum cloud availability threshold of 99.5%

· Best industry standards or a minimum scale storage and stream of 15 Petabytes of con-tent delivery per month.

· Best industry standards or a minimum ability to ingest from LTO 5 media and S3 Snowball portable drive

· Best industry standards or a minimum high speed data transfer capability of 1 TB/month

· Secure Hash Algorithm (SHA2) and file size capture for prevention of degradation

· Best industry standards or a minimum capability to increase available total bandwidth for streaming and non-streaming content to 100 gigabits per second (gb/s) to accommodate-date an unplanned event that places DMA content in high demand. In accordance with the requirements to provide commodities as requested by the Government above, the Contractor shall provision the following software services to support the delivery and security of the Public Web program’s websites.

· The contractor will provide appropriate program management plans including lifecycle plan, risk management plan, Monitoring and Quality Assurance Plan and others as requested.

Deliverable(s):

Program Management Plan Lifecycle Plan Risk Management Plan Monitoring and Quality Assurance Plan

6.2 Task 2: Maintain Akamai Service including Commodity, Labor and Program Management.

The Contractor shall furnish all the necessary commodity and labor, subscriptions, software and associated products as needed to perform the Performance Work Statement below. The DMA-PW requires high performance, world-wide content distribution network (CDN) that will accelerate content delivery of public DoD websites to hundreds of DoD, Air Force, Navy, Marine Corps, Coast Guard, and Army clients and thousands of customers while simultaneously protecting the integrity and availability of DMA-PWs origin infrastructure located inside the DoD Information Network (DoDIN). The CDN must support the existing configurations leveraged in the Public Web program including HTTPS delivery of all products utilizing industry standard certificate management, web application firewall to provide frontline security, caching services to reduce the load on origin servers, static content storage, enhanced domain name system (DNS) capabilities, reporting, and continual support of these services during the life of the contract.

The Contractor will only be reimbursed for commodities incurred directly and specifically in the performance of this contract, claimed by the Contractor and accepted by the Contracting Officer.

The contractor shall provide a high performance, global content distribution network that will accelerate content delivery to hundreds of DoD, Air Force, Navy, Marine Corps, Coast Guard, and Army web properties while simultaneously protecting the integrity and availability of the Defense Media Activity origin infrastructure located inside the DoDIN. The contractor shall ensure the GCDN service is available on a 24-hour per day, 7 days per week, 365 days per year basis with 100% uptime.

Provide a monthly CDN monthly service report that is cumulative and also broken into separate reporting groups for DoD, Air Force, Navy, Marines, Army Corps of Engineers, and other groups as requested by the COR. The report must include all meaningful measurable metrics including:

· Total monthly usage

· Total monthly file storage usage

· Percentage of origin requests offloaded

· Top user locations by country

· Professional service hours used

· Include email subscriber counts in monthly reports.

The Contractor shall provide recommendations on content data network and implement COR approved changes to enable redundant, secure, geographically load balanced points of presence and accelerate both static and dynamic data delivery to users worldwide. Activities include, but are not limited to, the following tasks:

· Develop, test, and deploy advanced failover/COOP rules for newly configured and existing DMA sites.

· Provide troubleshooting assistance/root cause analysis when DMA-PW websites are experiencing technical issues related to the content delivery network, including but not limited to, traffic spikes, malicious activity, site outages, misconfigurations, and slow delivery.

· Provide ongoing consultative support and best practice recommendations pertaining to DMA-PW’s use of the CDN. Make recommendations for website optimization, federally accredited CDN products, and technology.

· Integrate CDN with other tools as directed by COR.

· Provide dedicated CDN technical support to troubleshoot, configure, and provide custom solutions to ensure 24/7 availability.

· Monitor CDN infrastructure to detect and repel attacks such as:

· Web attacks – Examples include generic attacks such as SQL injection, remote file inclusion (RFI), or cross-site scripting (XSS).

· Denial-of-service attacks – Examples include tools such as low-orbit ion cannon (LOIC), high-orbit ion cannon (HOIC), MyDoom, and Slow-loris to launch denial of service attacks.

· Web scrapers – tools used to extract large amounts of data from web sites.

· Scanning Tools – tools used to scan web applications for vulnerabilities during the reconnaissance phase of a web-based attack.

· Monitor interface that allows DMA-PW access to controls, investigation and reporting to:

· Filter malicious clients based on their behavior and risk score by either alerting or denying access.

· Investigation: Access aggregated data to investigate the cause of an attack.

· Reports: Provide an overall view of attack data as well as risk scores of a particular IP address over a given period of time as well as the events that contributed to the risk score.

· Provide a monthly CDN monthly service report that is cumulative and also broken into separate reporting groups for DoD, Air Force, Navy, Marines, Army Corps of Engineers, and other groups as requested by the COR. The report must include all meaningful measurable metrics including:

· Total monthly usage

· Total monthly file storage usage

· Percentage of origin requests offloaded

· Top user locations by country

· Professional service hours used

· Include email subscriber counts in monthly reports.

6.2.1 Subtask Akamai 1: CONUS Based Acceleration of Web Content:

The Contractor shall provide points of presence in the continental U.S. (CONUS) and have the ability to accelerate data delivery to users worldwide. The GCDN must provide redundant, geographically load balanced points of presence in the United States and have the ability to significantly accelerate both static and dynamic data delivery to users worldwide. The GCDN must incorporate a robust and secure caching strategy to bring the right balance of acceleration, security, and privacy to dynamic elements.

6.2.2 Subtask Akamai 2: Direct Support and Administration of the GCDN

The Contractor shall provide troubleshooting, experienced technical development, and modifications that are unique to only the GCDN.

6.2.3 Subtask Akamai 3: Implement configuration enhancements/changes for DMA sites

· The Contractor shall provide troubleshooting assistance/root cause analysis when DMA web properties are experiencing technical issues related to the GCDN including, but not limited to, traffic spikes, malicious activity, site outages, misconfigurations, and slow delivery.

· The Contractor shall provide ongoing consultative support and best practice recommendations pertaining to DMA’s use of their GCDN. The Contractor shall make recommendations for website optimization, new GCDN products, and technology.

· The Contractor shall provide dedicated Tier 3 GCDN technical support to troubleshoot, configure, and provide custom solutions and support all pro-jects interacting with the GCDN.

6.2.4 Subtask Akamai 4: GCDN Platform Reporting and Oversight

· The Contractor shall provide an interface that allows DMA access to all GCDN controls for administration, investigation, and reporting.

· The Contractor shall ensure that the GCDN supports investigation through the access to all aggregated data in accordance with DoD policy on data and log retention.

· The Contractor shall provide reports on detected attacks and the GCDN’s overall response to the attacks to include any recommendations for improving the GCDN.

· The Contractor shall provide a monthly GCDN status report that is cumulative and also broken into separate reporting groups for DoD, Air Force, Navy, Marines, Army Corps of Engineers, other groups if requested by the COR. The report must include at minimum:

· Total monthly usage

· Total monthly file storage usage

· Percentage of origin requests offloaded

· Top user locations by country

· Professional service hours used

6.2.5 Subtask Akamai 5: Security of the GCDN, Origin, and Web Property Delivery

· The Contractor shall provide a tiered delivery system so that only intermediate servers shall ever connect to the DMA origin servers. These intermediate servers shall not be accessible to the general public.

· The Contractor shall provide and support attack mitigations through a Web Application Firewall (WAF). The WAF must support signature based detection for the current web threat landscape and anomaly based detection for ab-normal traffic and threat patterns. The WAF must support blacklist and whitelist blocking for threat sources. The WAF must support detection and automatic mitigation of volumetric attacks that could compromise the delivery capabilities of the GCDN platform.

· The Contractor shall monitor the WAF for attacks and alert the COR upon detection of an unmitigated threat or a large mitigated threat. The security logs of the WAF and GCDN as a system must be provided at the request of the COR to DMA and DMA's designated mission partners.

· The Contractor shall ensure HTTPS delivery of all sites hosted through the GCDN solution by provisioning and supporting HTTPS certificates for all sites. As governed by DoD policy, all .MIL and .GOV sites shall be secured with Domain Validation Certificates and any other sites using Top Level Domains other than .MIL and .GOV shall be secured with Organizational (or Extended) Validation Certificates.

6.2.6 Akamai 6: Static Content Storage

· The Contractor shall provide dedicated cloud storage for the sites hosted through the GCDN. This storage must be of sufficient capacity to host a static copy of all site content and be configured to be served as a tertiary delivery solution when DMA origin locations are unavailable.

· The Contractor shall ensure that the static storage solution is configured to retrieve all site content on a regular basis as determined by the COR.

· The Contractor shall support the use of the static storage solution to host static files and websites as needed by DMA and as approved by the COR.

6.2.7 Subtask Akamai 7: Secure DNS Platform for Sites Supported by the GCDN

· The Contractor shall provide a scalable authoritative DNS solution for the sites hosted through the GCDN. This DNS solution must support all DoD policies regarding the configuration of DNS to include DNSSEC requirements.

· For all subtasks, the administrative sections are as follows:

· Facilities, Equipment and Other Resources

· There are no additional Contractor responsibilities for meeting the government’s effort management requirements under this effort.

· Project Management

· Contractor shall provide project management for all subtasks as defined in the PWS (6.10.1) as required.

Deliverable(s):

Monthly CDN report Monthly GCDN report

6.3 Task 3: Maintain Subscriptions.

The Contractor shall provide appropriate Azure bandwidth, storage, virtual networks, key vaults, Azure App Services, Advanced Data Security, Advanced Threat Protection Storage, SQL databases, security centers, virtual machines, Azure DNS, VPN Gateways, Log Analytics, Azure Active Directory, Service Buses, and Functions as required by Government as directed by COR. The contractor will maintain a comprehensive listing of all technology subscriptions required to maintain operations and provide such a list with the offering.

Deliverable:

Comphensive listing

6.4 Task 4: Maintain Collaborative Communication Platform Subscription.

· Public Web requires a real-time communication and collaboration tool which allows government and contractor personnel to collaborate with each other and external customers and clients in a chat-room-like environment. PW has been using Collaborative Communication Platform for the past several years to fill this need, and wishes to extend the current license which is set to expire 26 February 2022 .The current contract uses Slack. Any migration to new system will require approval. In the event of migration to a new collaborative communication platform, the contractor will provide appropriate project management documents, including a migration plan, lifecycle plan, risk management plan, monitoring and Quality Assurance plan and others as requested.

In accordance with the requirements to provide commodity as requested by the Government above, the Contractor shall provision the following licenses for a minimum of one year.

Deliverable(s):

Migration plan Lifecycle plan Risk management plan Monitoring and Quality Assurance plan

6.5 Task 5: Maintain LMS Subscription and training support.

The contractor shall provide web hosting training to customers. This includes acquisition of Learning Management System (LMS) licenses as required to track and manage the training records of Public Web customers/users. This is a continuation of a prior PW requirement, since these licenses (3,000 Self-Hosted Annual License) were previously purchased under HQ051620F0006, 22 Feb 2020-21 Feb 2021. DMA PW requires the continuation of our LMS subscription at a minimum service level of 3,000 licenses beginning 22 February, 2022. The current contract uses Accord. Any migration to new system will require approval. In the event of migration to a new collaborative communication platform, the contractor will provide appropriate project management documents, including a migration plan, lifecycle plan, risk management plan, monitoring and Quality Assurance plan and others as requested.

In accordance with the requirements to provide commodity as requested by the Government above, the Contractor shall provision the following licenses for a minimum of one year.

The Contractor will only be reimbursed for commodity incurred directly and specifically in the performance of this contract, claimed by the Contractor and accepted by the Contracting Officer.

The DMA-PW requires training tasks to manage DMA-PW’s training program. This includes reference documents, FAQs, moderated forums, web-based and in-person courses (e.g., webinars and classroom presentations), videos, interactive courseware, content management system (CMS) inline tips, and a custom training website that includes a Learning Management System (LMS). Maintain historical training records, user certificates, regularly update training essentials, and run analytics on training feedback.

The Contractor shall provide Content Management System (CMS) training support for all DMA- PW websites, including all CMS types and associated products, for approximately 9,000 registered users based on guidance from DMA-PW Management. Training will include comprehensive guides, quick reference documents, FAQs, moderated forums, videos, and interactive courseware. Training will be available via one-on-one support, live distance learning, social media outlets, and an online training site that is accessible worldwide. Training will also be integrated with the CMS with inline tips, help, and links to the training site. Training must be synchronized with current production software versions, targeted for the different levels of access to the CMS, and have the ability to be certified and tracked via an online Learning Management System. Activities include, but are not limited to, the following tasks:

· Provide DMA-PW customers with best-in-class training to ensure DMA-PW staff and user base can work and train effectively, enabling them to meet and exceed their operational and organizational goals to accomplish their mission.

· Provide a training staff available from 7:00 A.M. to 6:00 P.M. Eastern Time (ET), Monday through Friday.

· Provide training to users and DMA-PW staff via one-on-one training, live distance learning, and an online training website.

· Provide Distance Learning via online video conference systems that are available to a worldwide audience.

· Maintain and update an online training website. The training website shall include specific course material for each of the different American Forces Public Information Management System (AFPIMS) instances and shall include training targeted to the different roles of access to the CMS.

· Populate, update, and maintain hints in all AFPIMS modules. Note: Hints are included in modules to provide guidance and links to detailed training material.

· Develop, maintain, and update a DMA-PW training plan.

· Develop, maintain, and update a DMA-PW training plan that follows the current DMA-PW training plan matrix provided by the COR.

· Develop, maintain, and update training plans and associated materials as required to keep the information current with the latest version of the DoD Public Web CMS, including associated modules and applications.

· Ensure training plan identifies key content areas, training audience, goals, learning objectives, and training evaluation for the latest DMA-PW versions for customers.

· Develop, provide, maintain, and update course curriculum to sup-port implementation of the training plan.

· Develop, update, and maintain the AFPIMS training guide, which includes quick reference materials from the AFPIMS training site for offline viewing.

· Update and maintain AFPIMS Learning Management Sys-tem (LMS)/equivalent software.

· DMA-PW will use the LMS/equivalent software to track and test user training and certification for DMA- PW’s CMS for the Department of Defense, Air Force, Navy, Marine Corps, Coast Guard, Army, and all other websites hosted by DMA-PW.

· Provide individual weekly reports to DMA-PW Government management and stakeholders on each major training project in progress.

· Provide a weekly training report that identifies, tracks, and provides the current status for active website training projects, updates, and functionality as well as details any discrepancies along with the suggested solutions. Reports are due the first business day of each week.

· Provide other related support as requested by the COR.

· The Contractor shall provide a training staff that are subject matter experts on the applications and tools that DMA-PW provides. The Contractor shall operate a training program to develop/maintain a training site, track training system users, create courseware, provide one-on-one/distance training, incorporate training content in CMS, and perform other support tasks as directed by the COR. The Contractor shall provide the DMA-PW Training Plan, AFPIMS Training Guide, Weekly Training Report, Monthly Status Report, and Weekly Activity Report utilizing COR guidance. The Contractor must provide deliverables that comply with Federal laws, regulations, and policies identified by the COR.

Deliverable(s):

Migration plan Lifecycle plan Risk management plan Monitoring and Quality Assurance plan Training Plan Weekly Training report AFPIMS Training Guide Monthly Status Report Weekly Activity Report

6.6 Task 6. Provide Migration and migration program management.

In accordance with the requirements to provide migration, migration planning, site structure and taxonomy solutions, execution, and follow up to ensure complete and effective website migrations as requested by the government below, the Contractor shall provide migration support for utilizing Government Task Manager Guidance and as directed by COR.

The Contractor shall provide support for the migration operations of websites to the DoD Public Web end-state. The Contractor shall have migration specialists with a high level of knowledge on the CMS and all associated applications. The Contractor shall initiate, plan, execute, manage, and monitor website migration projects, and perform other support tasks as directed by the COR. The Contractor shall provide the Website Migration Plan, Website Migration Guide, Migration Quality Control Program, Weekly Website Migration Report, Monthly Status Report, Weekly Activity Report, JIRA project for each migration project, and Website Migration SOP utilizing COR guidance. The Contractor must provide deliverables that comply with government laws, regulations, and policies identified by the COR.

The Contractor shall provide support for the migration operations of websites to the DoD Public Web end-state. The Contractor shall have migration specialists available from 7:00 A.M. to 6:00 P.M. Eastern Time (ET), Monday through Friday. The Contractor shall provide migration planning to initiate, plan, execute, manage, and monitor ongoing and future website migration projects. The Contractor shall also provide content and website migration counseling and one- on-one support for DoD Public Web-identified website managers to optimize content migration, website structure, and taxonomy solutions using the best practices identified by industry standards to ensure complete and effective website migrations into the DoD Public Web Program. The migration team members must have a high level of knowledge on the different versions of AFPIMS and all associated modules. Activities include, but are not limited to, the following tasks:

· Develop a migration plan that follows the DMA-PW Migration Standard Operating Procedure for each major migration project. A Major Migration Project shall be defined as 5 or more related websites totaling more than 100 web pages.

· Ensure the migration effort follows current DoD instructions, guidance, policies, and directives.

· Setup new website shells based on an approved website templates. This initial website setup will include the setup of permissions, modules, search, and site taxonomy.

· Update and maintain a website migration guide.

· Provide a website migration guide to all DMA-PW website managers.

· Assist website managers with the migration of content as outlined in the Government-approved Migration Plan which includes all associated documents and media. The level of content migration can vary from 0% to 100% based on individual customer needs.

· Provide one-on-one counseling to website managers during the migration process. Initially meet with the customer, in person, by phone, or via video teleconference, and be available to assist with the migration processes during approved business hours.

· Develop and implement a migration quality control (QC) program that will be approved by the Government task manager.

· Provide inputs to the DMA-PW weekly status reports detailing major migration projects in progress.

· Collect customer feedback to determine satisfaction.

· Provide a weekly migration report that identifies, tracks, and provides the current status for active website migrations as well as details any discrepancies along with the suggested solutions. Reports are due the first business day of each week.

· Develop, maintain, and update Migration Standard Operating Procedures (SOP) for setup, configuration, and migration of DMA- PW web-sites.

· Detail all the tasks that need to be completed from start to finish to fully migrate a website from initial contact with the customer to the final launch and quality assurance checks after launch.

· Contain technical details, configuration settings, quality assurance checks, and workflow checklists for all individuals involved in the migration process to include military service account representatives, system administrators, instance managers, search engine optimization managers, migration specialists, and individual website managers.

· Ensure all migration projects are tracked in DMA-PW’s project management system, currently Atlassian Jira and Confluence.

· The contractor will provide appropriate project management documents, including a migration plan, lifecycle plan, risk management plan, monitoring and Quality Assurance plan and others as requested.

· The contractor will provide Standard Operating Procedure plans for migration as well as checklists for pre and post website deployment. The current contract has such documents and legacy documents will be available as an input to new document creation.

· Provide other related support as requested by the COR.

Deliverable(s):

Website Migration Plan Website Migration Guide Weekly Website Migration Report Monthly Status Report Weekly Activity Report Weekly migration report Website Migration SOP Lifecycle plan Risk management plan Monitoring and Quality Assurance plan

6.7 Task 7: Provide Infrastructure Management.

In accordance with the requirements to provide infrastructure management as requested by the Government below, the Contractor shall provide infrastructure management support utilizing Government Task Manager Guidance and as directed by COR.

The Contractor shall manage, maintain, and improve the DMA Public Web IT infrastructure supporting all technologies employed to manage and deliver all DMA public websites. The Contractor shall provide experienced onsite technical personnel to manage and administer all DMA-PW related systems and resources to include mission hardware, software, operating systems, networks, database administration, database development, maintenance, application support, storage, IT security services, integration services, configuration management, acquisitions support, risk management, disaster recovery, and contingency operations using best industry and DoD best practices, and perform other support tasks as directed by the COR. The Contractor shall support the development and update of any and all documentation required for Certification & Accreditation (C&A) based on the approved Risk Management Framework (RMF). The Contractor shall provide the Test, Development & Acceptance Test Plan, Hardware Lifecycle Management Plan, COTS/GOTS Lifecycle Management Plan, Risk Management Plan, Monthly Status Report, Weekly Activity Report, Enterprise Backup SOP, Disaster Recovery Plan, COOP Plan, and After Action Report utilizing COR guidance. The Contractor must provide deliverables that comply with Federal laws, regulations, and policies identified by the COR.

The Contractor shall provide onsite technical personnel with skill sets related to all DMA Public Web assets to ensure complete functionality and continuous operations of DMA Public Web systems. This will include supporting DMA Public Web requirements at all determined locations. The scope of infrastructure management includes all systems relating to the DMA Public Web mission hardware, operating systems, networks, database administration, application sup-port, IT security services, integration services, configuration management, acquisitions sup-port, etc.

The Contractor shall provide high-quality information technology, engineering, administration, management, and IT acquisition services in support of the infrastructure. The Contractor shall provide the requisite number of technically qualified and technically accredited staff who have the depth and breadth of experience, expertise, and skills necessary to perform the tasks specified in this PWS. Activities include, but are not limited to, the following tasks:

· Manage the overall IT infrastructure to ensure all hosted websites are operational at all times. This does not include any downtime beyond the control of the Contractor.

· Provide management of operations employing industry and DoD best practices.

· Manage and administer the network systems and resources for DMA Public Web infrastructure.

· Manage enterprise and domain architectures with the objective to maximize performance and service levels to enterprise and domain- level users.

· Monitor networks, using existing domain-level specific tools, ensuring switch and router health, network performance, and security.

· Perform security related and other required operational and maintenance activities, for all enterprise systems, to ensure data availability, integrity, and applicable confidentiality.

· Evaluate enterprise system performance and make recommendations for improving performance.

· Provide service escalation support to the respective service desk/call centers for resolution of incidents.

· Create and standardize software and configuration images for all enterprise devices using industry standards and best practices.

· Operate, maintain, and improve the DMA Public Web enterprise using Microsoft Windows and Linux operating systems as deemed suitable by the Government. Exceptions must be approved by the Government.

· Configure Information System protective devices and software as required by DMA- PW for safeguarding of critical IT resources.

· Install and maintain software updates and vendor patches for all devices and operating systems connected to the DMA Public Web enclave.

· Implement approved security configuration baselines for Information Assurance Workforce in accordance with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs).

· Operate and maintain Host Based Security System (HBSS) and Assured Compliance Assessment Solution (ACAS) as required for all DMA-PW computing assets.

· Perform storage area network administration.

· Perform and test enterprise backup operations including disk configuration, tape library configuration, tape inventory rotation, and tape restore operations; as well as alternate methods of providing robust backup solutions such as commercial cloud solutions.

· Perform installation design including procuring and installing new equipment and associated hardware and software to extend and/or enhance existing services.

· Evaluate software updates and patches for impact on current baseline configurations, applications, and networks and mitigate all findings or develop a Plan of Action and Milestones (POA&M) for issue resolution, as directed by local authority.

· Perform database development, administration, and maintenance that fulfills the requirements of DMA Public Web mission areas.

· Ensure that adequate cross-training among application administrators is maintained to avoid single-threading of application knowledge and to ensure that qualified application administration services are always available.

· Assist DMA and domain-level IA managers in developing and maintaining the Incident Response Plan (IRP).

· Ensure all incidents are responded to per DMA domain's IRP.

· Plan and conduct system maintenance for DMA Public Web so as to minimize mission impacts.

· Provide immediate notification to the DMA-PW Chief, Enterprise Operations for any planned or unplanned system maintenance, downtime, or degradation.

· Perform system and networks maintenance operations during off-duty hours to minimize impact to users.

· Off-duty and non-drill weekends should be considered prime times for maintenance.

· Maintenance should be conducted not less than monthly or more often as required or directed. The Contractor shall evaluate software updates and patches for impact on current baseline configurations, applications, and networks and shall mitigate these, or develop a POA&M for related issue resolution, as directed by local authority.

· Ensure that all systems, services, software, configurations, and data within the DMA Public Web enterprise are consistently backed up using industry and DoD established best practices outlined in Standard Operating Procedure documentation.

· Develop, maintain, and update a Standard Operating Procedure for DMA-PW backup procedures using industry and DoD established best practices.

· Comply with the DoD 8750.01-M Information Assurance Workforce Improvement Program.

· Provide copies of IA Certifications to COR at least yearly and notify COR of certification loss or revocation.

· Develop test, development, and user acceptance test environments for testing purposes to support installation of application and hardware systems, subsystems, components, peripherals, and interfaces.

· Provide test, development, and acceptance test plan as directed by COR.

· Develop, implement, and manage a hardware lifecycle management program. The hardware lifecycle management plan shall outline how the Contractor plans to manage all aspects of DMA Public Web enterprise hardware such as tracking maintenance, warranties, locations, capabilities, health, mission readiness, and end-of-life processes.

· Develop a hardware lifecycle management plan. The plan should outline how the Contractor intends to manage the hardware lifecycle management program.

· Implement and manage a COTS/GOTS lifecycle management program. This program will manage all aspects of DMA Public Web enterprise COTS/GOTS such as tracking maintenance, warranties, locations, product keys, and end-of- life processes. This is completely separate from the software development lifecycle (SDLC).

· Submit a COTS/GOTS lifecycle management plan. The plan should outline how the Contractor intends to manage the lifecycle management program.

· The contractor will provide appropriate project management documents, including a lifecycle plan, risk management plan, monitoring and Quality Assurance plan and others as requested.

· Manage and administer all Public-Web-Specific DNS

· Provide other related support as requested by the COR.

The Contractor shall develop, implement and maintain a risk management program that provides a continuous cycle of discovery and mitigation. Activities include, but are not limited to, developing a risk management plan. The plan will: Identify vulnerabilities in the security posture of the infrastructure and categorize findings into a context of what risk they pose to the DMA enterprise.

· Provide risk management assessments and mitigating circumstances associated with operating information systems security in a networked computing environment.

· Advise DMA Public Web of findings and will present the most cost effective course of action to mitigate the risk.

· Outline how the Contractor intends to provide a Risk Management Program and ongoing reporting.

The Contractor shall support the development of any and all documentation required for Certification & Accreditation (C&A) based on the approved Risk Management Framework (RMF) in use for C&A as directed by the COR. Any changes in requirements based on DoD or Federal guidance will be supported by the Contractor. The Contractor will ensure all supporting documentation remains current. Activities including, but is not limited to, the following tasks:

· RMF must accurately depict the IT architecture of DMA domains.

· Utilize the Enterprise Mission Assurance Support Service (eMASS) for preparation of the RMF package.

· Assist in the implementation and validation of assigned IA controls including execution of the RMF implementation plan.

· Assist the government in developing the RMF implementation plan to document the assigned IA controls, including inherited IA controls. The plan may reference applicable supporting implementation material and artifacts.

· Assist in preparing the supporting documentation (i.e., POA&M, actual validation results, artifacts associated with implementation of IA controls, etc.) required for the RMF comprehensive package requirements. As DMA moves from the accreditation format to a Continuous Risk Assessment Framework model the Contractor will assist with tasks related to this transition.

· Ensure that all deadlines for security related efforts and other directives are met.

· Support remediation of vulnerabilities identified by all external sources with-in timelines identified in the vulnerability management plan.

· Investigate and recommend new technologies for the network infrastructure.

· Provide other related support as requested by the COR.

The Contractor shall create, update, and implement disaster recovery and continuity of operations plans for every enterprise function within DMA Public Web allowing every asset to continue full mission capability in the event the primary enterprise infrastructure is unavailable. Activities including, but is not limited to, the following tasks:

· Develop and/or update a complete Disaster Recovery (DR) Plan that incorporates industry standard best practices and include such topics as a personnel accountability, fly-away plan (i.e., plan to develop a list of critical items/records that cannot be pre- positioned at an alternate operating facility and procedures to move these), contingency funding, etc.

· Develop and/or update a complete Continuity of Operations Plan (CO-OP).Perform routine preparatory operations include ensuring daily backups and/or replication of all data are complete, verifying data integrity, routinely performing failover tests and data recovery, and ensuring all DMA/PW activities can be restored in the event of a disaster.

· Participate in regularly scheduled disaster recovery exercises as scheduled by the Government. Exercise tasks include but are not limited to restoring production data from backup site, restoring Active Directory from backup site, restoring data from local tape backups, and other critical functions related to DR.

· Troubleshoot and correct any failed backup and or replication, and investigate errors received from the backup/replication system. Participate in After Action Reviews (AAR) after each exercise to document lessons learned.

· Conduct a yearly re-evaluation of all DR and COOP plans, policies, procedures, personnel requirements, and expectations.

· All documentation will be stored in a Continuity of Operations space in DMA- PW’s Confluence knowledge management system for ease of access and tracking.

The Contractor shall provide recommendations on content data network and implement COR approved changes to enable redundant, secure, geographically…