RFI PWS 81225.pdf

HAZARDOUS MATERIAL

MANGEMENT SYSTEM

(HMMS) PERFORMANCE

WORK STATEMENT (PWS)

HMMS Software and Sustainment Support Indefinite Delivery Indefinite Quantity (IDIQ)

1 Table of Contents

1 PERFORMANCE WORK STATEMENT (PWS)

1.1 BACKGROUND

1.2 SCOPE OF WORK

1.3 TASK REQUIREMENTS

1.3.1 Task 1 – PROJECT MANAGEMENT SUPPORT

1.3.1.1 SUBTASK A Contract Kick-Off

1.3.1.2 SUBATASK B Project Management / Project Plan

1.3.1.3 SUBTASK C Performance/Progress/Status Report

1.3.1.4 SUBTASK D Risk/Issue Register

1.3.1.5 SUBTASK E Meetings, Briefing, Presentation Material and Support

1.3.1.6 SUBTASK F Monthly Plan of Action and Milestones (POA&M) Report

1.3.1.7 SUBTASK G Monthly Service Ticket Report

1.3.1.8 Task 1 Deliverables:

1.3.2 Task 2 – CONFIGURATION MANAGEMENT

1.3.2.1 SUBTASK A Change Management and CM Plan

1.3.2.2 SUBTASK B Objectives of Configuration Management

1.3.2.3 SUBTASK C Specific Vendor Responsibilities:

1.3.2.4 SUBTASK D Configuration Control Governance Meetings

2.3.2.5 Task 2 Deliverables:

1.3.3 Task 3 - INFORMATION ASSURANCE

1.3.3.1 SUBTASK A Cybersecurity, Risk Management Framework (RMF) & Artifact Support 19

1.3.3.2 SUBTASK B Standards, Protocols, and Compliance

1.3.3.3 SUBTASK C Security Analysis and Recommendations

1.3.3.4 SUBTASK D Technical Compliance and Vulnerability Management

1.3.3.5 SUBTASK E Information Assurance and ATO Support

1.3.3.6 SUBTASK F Vulnerability Remediation Timelines

1.3.3.7 SUBTASK G Department of Defense Architectural Framework (DoDAF) ... 20

1.3.3.8 Task 3 Deliverables:

1.3.4 Task 4 - REQUIREMENTS FOR AI-DRIVEN AUTOMATION AND SOFTWARE

DEVELOPMENT

1.3.4.1 SUBTASK A Automated Software Testing and Development

1.3.4.2 SUBTASK B AI-Driven System Monitoring and Anomaly Detection

1.3.4.3 SUBTASK C Predictive Maintenance

1.3.4.4 SUBTASK D Process Automation for Repetitive Tasks

1.3.4.5 SUBTASK E AI-Powered Data Analysis and Reporting

1.3.4.6 Task 4 Deliverables:

1.3.5 Task 5 - DATA MANAGEMENT

1.3.5.1 SUBTASK A Electronic Data Interchanges and/or Data Exchange Support:

1.3.5.2 Task 5 Deliverables:

1.3.6 Task 6 - SYSTEM MONITORING / REPORTING

1.3.6.1 SUBTASK A Application Administration Support

1.3.6.2 SUBTASK B Operations and Maintenance Responsibilities

1.3.6.3 SUBTASK C Collaboration and Non-Core Hours Support

1.3.6.4 Task 6 Deliverables:

1.3.7 Task 7 - SECURITY AND COMPLIANCE

1.3.7.1 SUBTASK A Access to Sensitive Information

1.3.7.2 SUBTASK B IT Level Investigation Requirements

1.3.7.3 SUBTASK C DOD 8570.01-M, Information Assurance Workforce Improvement Program

1.3.7.4 SUBTASK E Software

1.3.7.5 SUBTASK F Data Use, Disclosure of Information and Handling of Sensitive Information (including Personally Identifiable Information)

1.3.7.6 Task 7 Deliverables:

1.3.8 Task 8 - SOFTWARE RELEASE, MAINTENANCE AND ENHANCEMENTS

1.3.8.1 SUBTASK A New Project Acceptance Criteria and Process

1.3.8.2 SUBTASK B New Projects: Rough Order of Magnitude (ROM) and Level of Effort (LOE)

1.3.8.3 SUBTASK C Release Management

1.3.8.4 Task 8 Deliverables:

1.3.9 Task 9 - TESTING AND QUALITY ASSURANCE (QA) REQUIREMENTS

1.3.9.1 SUBTASK A Test and Evaluation Support

1.3.9.2 SUBTASK B WCAG (508) Compliance

1.3.9.3 SUBTASK C Testing Scope and Environments

1.3.9.4 SUBTASK D Defect Resolution and Reporting

1.3.9.5 Task 9 Deliverables:

1.3.10 Task 10 - TRANSITION AND CLOSEOUT SUPPORT

1.3.10.1 Task 10 Deliverables:

1.3.11 TASK 11 - SUSTAINMENT SUPPORT, DELIVERABLES AND SCHEDULE

1.3.11.1 SUBTASK A Sustainment Support

1.3.11.2 SUBTASK B Task Order Quality Assurance Surveillance Plan (QASP)

1.3.11.3 SUBTASK C PLACE OF PERFORMANCE

1.3.11.4 SUBTASK D PERIOD OF PERFORMANCE

1.3.11.5 SUBTASK E INVOICING AND PAYMENT SCHEDULE:

1.3.11.6 Task 11 Deliverables:

1.3.12 TASK 12 - SHARED SERVICES

1.3.12.1 SUBTASK A Customer Care

1.3.12.2 SUBTASK B Afterhours Support

1.3.12.3 SUBTASK C Vendor Initial Acknowledgement Time

1.3.12.4 SUBTASK D Response Level

1.3.12.5 Task 12 Deliverables:

1.3.13 Task 13 - DOCUMENTATION

1.3.13.1 Task 13 Deliverables

1.3.14 Task 14 - ONSITE AND VIRTUAL SUPPORT

1.3.14.1 SUBTASK A Onsite and Virtual Resource Support

1.3.14.2 SUBTASK B Onsite and Virtual Application Training

1.3.14.3 SUBTASK C New Site Implementation and Onboarding

1.3.14.4 TASK 14 Deliverables

1.3.15 TASK 15 Travel and Performance

1.3.15.1 SUBTASK A Travel

1.3.15.2 SUBTASK B Preparing Trip Reports

1.3.15.3 Task 13 Deliverables

1.4 PERFORMANCE STANDARDS AND METRICS

1.4.1 Performance Requirements Summary

1.4.2 Method of Surveillance

1.4.3 Inspection and Acceptance Criteria

1.4.4 General Acceptance Criteria

1.4.5 Fixed Price Performance Based Service Contract Payments

1.4.6 Performance Review and Payments

1.4.7 Deliverables

1.4.8 Vendor Quality Control Plan (QCP)

1.5 GOVERNMENT FURNISHED ITEMS

1.5.1 Government Furnished Equipment/Government Furnished Information

1.6 PERSONNEL

1.6.1 Identification Badges & CAC Requirements

1.6.2 Non-CAC Personnel & Visitors

1.6.3 Return of Government Property

1.6.4 Security & Conduct

1.6.5 Personnel Removal & Replacement

1.6.6 Meeting Attendance

1.6.7 Personnel Requirements

1.6.8 LOE Specific Personnel Minimum Requirements

1.6.9 Key Personnel

1.6.10 Non-Key Personnel

1.7 POINTS OF CONTACT

1.7.1 VENDOR ALTERNATE WORKSITE AUTHORIZATION

1.7.2 VENDOR CONTINUITY OF OPERATIONS PLAN (COOP) ALTERNATE WORKSITE

AUTHORIZATION

1.7.3 VENDOR ALTERNATE WORKSITE REMOTE ACCESS REQUIREMENTS

1.7.4 NON-PERSONAL SERVICES

1.8 ACRONYMS AND DEFINITIONS:

1 PERFORMANCE WORK STATEMENT (PWS)

Hazardous Material Management System (HMMS) Software and Sustainment Support Performance Work Statement (PWS)

1.1 BACKGROUND

The Defense Logistics Agency (DLA) has been tasked by the Department of Defense (DoD) to deliver enterprise-wide hazardous material and hazardous waste regulatory capabilities to DoD and other federal agencies. These capabilities include:

• Inventory Management: Tracking from acquisition through ultimate disposal, including manifest control.

• Hazard Communication (HAZCOM): OSHA-compliant handling procedures and Globally Harmonized System (GHS) classification and labeling.

• Safety Data Sheet (SDS) Repository: The DoD SDS repository of record, aligned with Fed Standard 313 (current version).

DoD sites requiring HMMS software and sustainment services must comply with international, federal, state, and local regulations. Each of the roughly 100–150 sites differ by:

• Mission: from small repair shops to full teardown and rebuilding facilities; fighter versus tank maintenance.

• Scale: from sites managing hundreds of line items to sprawling industrial bases tracking millions.

• Capability: from robust IT and chemical-SME support to locations with no dedicated HM/HW expertise.

Key HMMS Components

1. Hazardous Material Management System (HMMS) A unified, web-based solution that centralizes HM/HW inventory, tracking, and reporting across DoD and federal sites. HMMS ingests data from HMIRS, POP, and HWD to deliver real-time visibility into material location, quantities, and lifecycle status—from acquisition through disposal. Its configurable workflows automate issue-point scanning, manifest generation, and compliance checks (OSHA, GHS, DOT), while built-in BI dashboards surface key metrics on usage, expiration, and environmental risk. With role-based access controls and an open API framework, HMMS enables seamless integration with ERP, EDI, and external logistics systems— empowering sites of any size or mission to maintain audit-ready records and meet evolving regulatory mandates.

2. Hazardous Material Information Resource System (HMIRS) A secure, web-based application for managing products and SDS records. A specialized team of engineers, chemists, and scientists enriches manufacturer data with GHS labels, HAZCOM warnings, transportation details, contract and logistics information—ensuring all federal personnel have 24/7 access to critical hazard-communication data. HMIRS is the authoritative source for SDS/MSDS across all U.S. military services and civilian agencies, per DODI 6050.05.

3. Performance-Oriented Packaging (POP) Provides DoD-tested packaging configurations that meet Department of Transportation (DoT) and UN specifications for non-bulk hazardous materials. It guides DoD employees on applicable modal regulations for shipment.

4. Hazardous Waste Disposition (HWD) A cloud-based portal enabling environmental and contracting personnel worldwide to develop, solicit, award, and administer high-quality hazardous waste disposal contracts. Users can access a global network of disposal vendors, submit documentation electronically, and generate on-demand compliance reports. This system is a Finical Feeder system and complies with Internal Control Over Reporting- Financial Reporting (ICOR-FR) policies and requirements.

5. Hazardous Materials Data Warehouse (HMDW) A strategic platform hosting the Chemical Information Program (CIP) and related applications, with EDI integrations for seamless data exchange between upstream and downstream systems.

Support Approach

Because sites are not identical in mission, structure or requirements, the Performance Work Statement (PWS) offers both a comprehensive support package and à la carte services:

• Core Support Package:

o Technical expertise and tier II/III user support o Integrated business-intelligence tools o Regular site visits and software-release forums o Report writing and web-portal assistance o Security-accreditation support under RMF in Microsoft Azure

• Optional Services:

o Data input and retrieval o On-site or virtual functional assistance o Full hazardous material program support o Custom report-writer and data-export training

1.2 SCOPE OF WORK

This task order encompasses the delivery, deployment, sustainment, and enhancement of an Internet-based Hazardous Materials Management System (HMMS) software suite, for multiple DoD and other federal agencies. Specifically, the contractor shall provide:

• Software Delivery & Sustainment o Install, configure, and maintain HMMS and all associated commercial off-the-shelf (COTS) packages.

o Deliver the HMMS source code unencrypted to DLA for Information Assurance activities and troubleshooting.

o Provide regular upgrades, patches, and system‐integration services.

• Project & Configuration Management o Perform full project management (planning, scheduling, risk management, reporting).

o Manage configuration control, versioning, and release processes in accordance with DOD acquisition regulations.

• User Support & Training o Deliver Tier I–III helpdesk services (global support desk).

o Develop and deliver user training materials and courses covering HMMS, HMIRS, POP, and HWD applications.

o Host user training forums and site-visit support.

• Documentation & Reporting o Produce and maintain System Architecture Documents, user manuals, supporting

IA artifacts, and all other required deliverables.

o Provide on-demand (ad hoc) compliance and performance reporting tools.

Personnel Qualifications

All proposed staff should demonstrate relevant environmental and/or systems expertise, that may include:

• Domain & Technical Expertise o Hands-on experience with Hazardous Materials Management Systems and sustainment, and/or a degree or practical experience in environmental sciences (e.g., geology, environmental science).

o In-depth knowledge of HMMS, HMIRS, POP, and HWD OR equivalent experience.

o Familiarity with 29 CFR, 40 CFR, and 49 CFR requirements; MSDS/SDS repository management and reporting OR equivalent experience.

• DoD IT & Acquisition Experience o Participation in DoD ACAT II IT programs: program management, systems engineering, cost analysis, configuration management or equivalent experience.

o Proven track record of DOD IT lifecycle compliance audits against DoD acquisition policies.

• Security & Connectivity o Experience supporting cybersecurity validations and control testing (.

o Expertise in DoD security policy, implementation, and remote-site connectivity.

• Sector Familiarity o Understanding of environmental and logistics operations at NASA, U.S. Coast

Guard, Army, Navy, Marine Corps, and DLA facilities.

• Communications Skills o Excellent written and oral communication, with the ability to present technical material to senior military and civilian stakeholders.

This combination of software, data-exchange, project management, and subject-matter expertise ensures that HMMS will meet evolving business requirements and regulatory mandates across all user sites. Equivalent experience is always considered in lieu of preferred qualifications.

1.3 TASK REQUIREMENTS

The Contractor (referred to as the Vendor) will be required to perform tasks such as the following:

1.3.1 Task 1 – PROJECT MANAGEMENT SUPPORT

1.3.1.1 SUBTASK A Contract Kick-Off

The Vendor shall schedule a kick-off meeting with the Government within 7 business days of the award or as agreed upon between the Government and Vendor. The Vendor shall prepare and present an executive overview. The executive overview will demonstrate the Vendor’s plans to manage scope, schedule, and resources for the contract including how the Vendor plans to integrate/transition in with sustainment (monitoring, existing break/fix, triage, and reporting), and existing project support/upgrades, training. The Vendor shall provide DLA Information Operations (J6) management with a key personnel listing and plans for sustaining/replacing (if required) these personnel. The Vendor shall also meet with J6 stakeholders to discuss expectations and details of contract execution within 30 days of the award.

The Vendor shall present and deliver the Kick-off Meeting Briefing Presentation Material and be prepared to discuss the content of the Project Management Plan (see below), to include the staffing plan, schedule, and how they propose to meet performance metrics identified in this PWS. The Vendor shall produce and distribute Kick-off Meeting Minutes, identifying all the discussion points, agreements, and action items within 2 business days following the meeting.

The Vendor shall include an update from the proposal, related to an updated integration plan, i.e., what, and how does the Vendor integrate into existing operations, sustainment, and current priority list (functional and technical) development/migration/upgrade efforts, and updated staffing plan with “who, when where and why” information.

1.3.1.2 SUBATASK B Project Management / Project Plan

The Vendor shall develop a project plan/schedule to accomplish the requirements of this PWS to include, but not limited to set-up, configuration, and fielding of each environment. Project plans will also be developed for major/minor sustainment activities and specific tasks assigned by the Government within the scope of this PWS. A high-level Project Plan shall be provided during the Kick-off meeting; it shall then be broken into lower details and provided as part of the Monthly Status Report only when changes to the plan occur.

The Vendor shall prepare a Project Management Plan describing the following:

1) Proposed Management Approach

2) Vendor Organization Structure

3) Staffing Plan by Task and by Role

4) Responsibility Matrix

5) Process Management and Control

6) Standard Operating Procedures (SOPs) for the following:

a. 24/7 Helpdesk with Critical Bug call back support within 2 hours through resolution

b. Problem Notification Reports

c. Software Change Requests

7) Agile Software Release Plans and proposed schedules

8) Weekly Scrum Calls

9) EPIC Plan

10) Sprint Plan

11) Acceptance Tests

12) Delivery Process

13) Cybersecurity Plan to support release scans

14) Training Plan

15) Release Documentation

16) Data Dictionary

17) Entity Relationship Diagram

18) Quality Control Plan (QCP)

19) Risk Management Plan as outlined in the DoDI 5000.02

The Vendor shall provide project management services necessary to:

• Establish project governance

• Develop and implement project plans

• Establish communication and escalation procedures

• Support change control processes

• Monitor, control and report project status, schedule, and report performance

• Conduct regular project reviews

• Ensure quality of deliverables.

• Developing, maintaining, and meeting schedule milestones

• Managing risks

• Identifying, and resolving problems

• Keeping the cognizant HMMS Program Management Office (PMO) informed of status and issues

• Managing the Vendor staff.

Note: project plans, communications, monitoring, status updates and other reports do NOT require service ticket(s). Project Management oversight applies to all tasks and sub-tasks assigned to contract staff in accordance with this PWS. The Vendor’s Task Order Project Manager shall have demonstrated leadership experience in a work environment of similar size and complexity as outlined in this IDIQ. The Vendor’s Project Manager shall serve as a senior contract official and as such is responsible for all contract staff and their deliverables employed in concert with this task order.

The COR has the responsibility to monitor the progress of the work of the Vendor personnel assigned to the task. Additionally, in the absence of other agreements negotiated with respect to the time provided for Government review, standards and actions shall be provided to the COR who will submit to the PM, Deputy PM for inspection.

The Vendor’s project management effort shall continue for the entire term of the contract. The Vendor shall be required to update the contract staffing plan monthly. All documentation shall be compatible with the current DLA Microsoft (MS) Office products unless another format is required and agreed to by the Government and the Vendor.

1.3.1.3 SUBTASK C Performance/Progress/Status Report

The Vendor shall monitor activities and deliverables under this requirement and provide a Status Report (SR) that describes project progress, costs, issues, problems, and status. The SR shall be the Vendor’s method of reporting progress against the Project Management Plan (PMP). The period covered by the SR shall include the activities listed below and other SR reported information not satisfied or closed in previous reporting periods, and any required interfaces, meetings, or other commitments. The Vendor shall provide a status report monitoring quality assurance.

If the bi-weekly Status Reports falls on a Holiday, it will be rescheduled as agreed by the government. The report shall include but not limited to:

1) Program metrics

a. Roadmap

b. Project Updates

i. Activities during reporting period, by task (including on-going activities, new activities, activities completed, and/or other funded tasks, progress to date on all above-mentioned activities.

2) System Releases

a. Status of current and planned HMMS, HMIRS, HWD, POP and HMDW releases

3) Engineering Updates

a. Operating System (OS) EOL/Upgrades

b. Database Upgrades

c. Software EOL/Upgrades

d. Cybersecurity

4) Sustainment support

a. System Availability

i. If the system does not meet the weekly 98% minimum threshold, a report is due to issue and root cause no later than the following bi-weekly meeting.

5) Defects / Production Support Tickets

6) Upcoming Program Related Travel

7) Bi-Weekly Planned Meeting Schedule

8) Risk Register and Identified Issues

9) Personnel changes

10) Government actions required

1.3.1.4 SUBTASK D Risk/Issue Register

The Vendor shall apply the risk management approach and plan in the Task Order to develop and maintain a risk register that documents and tracks Vendor and Government identified project risks and issues. For each risk, the register shall include a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur, and a mitigation strategy. The initial register shall be provided during the Kick-off meeting and then as part of the bi-weekly Status Report each month. The Vendor shall provide the Risk Register in a Vendor- proposed, Government-approved format to the COR who will submit it to the PM, Deputy PM and/or COTR for review/approval.

1.3.1.5 SUBTASK E Meetings, Brie�ing, Presentation Material and Support The Vendor shall prepare briefing materials and represent the HMMS PMO at briefings, meetings, and conference calls with organizations of interest, stakeholders, external and internal systems. This representation shall be at a level that functionally and technically represents the HMMS PMO mission and capabilities.

All Vendor-led briefings and meetings shall be conducted in a professional manner. An authorized Government representative will be present at all briefings, meetings, and conference calls. Read ahead and presentation materials should be delivered to the meeting attendees one business day prior to any meetings, briefings or conference calls as required. If meetings, briefings, or conference calls are scheduled less than one business day in advance, the Vendor shall provide read-ahead and presentation material as soon as practical.

1.3.1.6 SUBTASK F Monthly Plan of Action and Milestones (POA&M) Report The Vendor shall monitor activities and deliverables under this contract and provide a Monthly POA&M report that lists all POA&M progress, issues, problems, and statuses. This report shall be the Vendor’s method of reporting progress against the ticketing timeline of the NTE table within this contract. The period covered by the POA&M report shall include the previous calendar month’s POA&M activities for all active during the reporting period; any issues, actions or other reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings or other commitments required for POA&M activities.

The Vendor shall provide a Monthly POA&M Report by the 5th business day of the month to the COR who will submit it to the PM, Deputy PM and/or COTR for review/approval. The Monthly POA&M Report shall include, but not be limited to:

1) Service ticket which has surpassed the NTE table and awaiting POA&M creation.

2) Service ticket tracking number POA&M associated with.

3) POA&M accepted date and Government POC who accepted.

4) POA&M due date.

5) Anticipated activity for the next reporting period.

6) Significant meetings.

1.3.1.7 SUBTASK G Monthly Service Ticket Report

A service ticket is defined as a work unit which may be a single Ticket (TKT), Change (CHG) (normal or break fix or enhancement) or project (PROJ). The Vendor shall use the DLA ticketing system and monitor activities and deliverables under this Task Order and provide a Monthly Service Ticket Report that lists all Service Tickets in progress, issues, problems, and statuses.

This report shall be the Vendor’s method of reporting progress for service tickets. The period covered by the Monthly Service Ticket Report shall include the previous calendar month’s service ticket activities for all active and closed service tickets during the reporting period; any issues, actions or other reported information not satisfied or closed in previous reporting periods;

and any required interfaces, meetings or other commitments required for service ticket activities.

The Vendor shall provide a Monthly Service Ticket Report for each application (HMMS, HMIRS, POP, HWD, HWDW) 24 hours before the scheduled In Process Review (IPR) held by the PMO team. The Monthly Service Ticket Report shall include, but not be limited to:

1) The total number of service tickets submitted and completed during the month.

a. Completed means that customer acceptance occurred.

2) Service ticket assigned date.

3) Service ticket due date according to the NTE table within this contract.

4) Service ticket progress and status.

5) Service ticket completion date if approved.

6) Service ticket POA&M issuance status (if applicable).

7) Required interfaces, action items or escalations.

The Government shall ensure the Vendors' designated personnel have the required system access to the DLA ticketing system. This includes but is not limited to:

1) Training provided to Vendor by DLA ticketing SME.

2) Grant designated Vendor personnel appropriate access to create, pickup, triage, access, and document any tickets, change requests, incidents or projects within the DLA ticketing system.

3) The Government will work with the Vendor to establish APIs as needed to connect the DLA ticketing system to the Vendors ticketing system for reduction in manual reentry efforts required.

1.3.1.8 Task 1 Deliverables:

• Deliverable 01-01: Contract Start/Award Integration Plan.

Estimated Time: Initial Kick-off, updated as changes occur.

• Deliverable 01-02: Executive Overview.

Estimated Time: 10 business days after award.

• Deliverable 01-03: Kick-off Meeting.

Estimated Time: Within 7 business days after Task Order (TO) award, Kick-off meeting minutes due within 2 business days following meeting.

• Deliverable 01-04: Non-Disclosure Agreements (NDAs).

Estimated Time: Within 5 business days of Vendor personnel starting on the Task Order.

• Deliverable 01-05: Project Management/Project Plan/Schedules/WBS.

Estimated Time: Initial High-Level plan overview and proposed schedule at Kick-off, with final draft plan and schedule submitted for approval within 10 business days following the kick-off, then updated within Monthly Status Report only when changes to the plan or schedule occur.

• Deliverable 01-06: Risk Register with Risk Matrix.

Estimated Time: Draft submitted for approval at Kick-off, then updated monthly within the Monthly Status Report.

• Deliverable 01-07: Integrated Master Schedule (IMS).

Estimated Time: Initial IMS 30 days and based on 75 days after Task Order Award and then update in the Monthly Status Report on a quarterly basis.

• Deliverable 01-08: Weekly Touchpoints.

Estimated Time: Meeting summary minutes provided no later than 48 hours after the meeting.

• Deliverable 01-09: Monthly Status Report (MSR).

Estimated Time: 5th business day of every month.

• Deliverable 01-10: Meeting, Briefing, Conference Call Presentation Material.

Estimated Time: Two (2) business days prior to any meetings, briefings, or conference calls.

• Deliverable 01-11: Daily/Weekly Production Support Call Participation (Including Updates and Inputs).

Estimated Time: As requested by the COR.

• Deliverable 01-12: Staffing Plan.

Estimated Time: Follow Deliverable 01-05 as part of the management plan.

Initial at Kick-off, then staff changes occur.

• Deliverable 01-13: Analysis/Performance/Progress/Status Reports.

Estimated Time: As changes occur and delivered, and/or as requested by the COR, no less than annually and yearly (at end of task order performance).

• Deliverable 01-14: Monthly Plan of Action and Milestones (POA&M) Report.

• Deliverable 01-15: Monthly Service Ticket Report.

1.3.2 Task 2 – CONFIGURATION MANAGEMENT

Configuration Management (CM) and the efficient delivery of software and supporting documentation are essential for maintaining uninterrupted operation and security of all applications and services. These activities shall be performed throughout the life of the contract, with deliveries as specified herein. The Vendor shall be prepared to utilize any Configuration Management tool designated by DLA Information Operations during the contract period.

1.3.2.1 SUBTASK A Change Management and CM Plan

The Vendor shall support and execute robust change management processes. The Vendor shall develop and maintain a Configuration Management (CM) plan that addresses product management and version control for all hardware and software components in accordance with DLA guidance and policies. The CM plan shall ensure the ability to recreate all baseline deliveries from any point in time and must address configuration identification, configuration control, administration, application software, and documentation management.

Tracking and Documentation in alignment with current DLA INFO OPS Configuration Management guidance, the Vendor shall establish procedures for tracking service tickets and software changes. The current guidance will be provided by the Government upon request.

1.3.2.2 SUBTASK B Objectives of Con�iguration Management

The Configuration Management process shall achieve the following objectives:

1) Identify, define, and control all relevant configuration items.

2) Establish a process for addressing unauthorized changes.

3) Control modifications of all configuration items.

4) Record and report the status of configuration items and modification requests.

5) Ensure the completeness of the configuration items.

6) Control the storage, handling, release, and delivery of the configuration items.

1.3.2.3 SUBTASK C Speci�ic Vendor Responsibilities:

• Establish and control product attributes and the technical baseline throughout the system lifecycle.

• Identify, document, audit, and control the functional and physical characteristics of the system design; track changes; and provide an audit trail of design decisions and modifications.

• Provide review and support of Configuration Control Working Group (CCWG) activities and processes.

• Ensure Configuration Management efforts are aligned with the Government CM plan.

1.3.2.4 SUBTASK D Con�iguration Control Governance Meetings

The Vendor shall assist the Government in preparing for and participating in routine and special Configuration Control governance meetings, including those of the Configuration Control Working Group (CCWG), as required by the governance structure. The Vendor may also be required to attend In Process Reviews (IPRs), meetings with integration/interface representatives from internal and external systems, and special working group sessions as requested by the COR.

2.3.2.5 Task 2 Deliverables:

• Deliverable 02-01: Configuration Management (CM) Plan.

Estimated Time: At the beginning of the period of performance, then midway through the period of performance, and then updated as changes occur.

1.3.3 Task 3 - INFORMATION ASSURANCE

1.3.3.1 SUBTASK A Cybersecurity, Risk Management Framework (RMF) & Artifact Support The Vendor shall provide qualified personnel and maintain ongoing collaboration with the cognizant Program Office and DLA Cybersecurity teams to ensure full compliance with DLA Cybersecurity, RMF, and Artifact requirements in support of obtaining and maintaining Authority to Operate (ATO).

1.3.3.2 SUBTASK B Standards, Protocols, and Compliance

The Vendor shall review, coordinate, and recommend cybersecurity standards and protocols for cost-effective application in alignment with the Department of Defense’s (DoD) Defense in Depth (DID) strategies. The Vendor shall ensure adherence to all applicable Federal, DoD, and DLA information technology and security requirements, policies, procedures, and standards.

1.3.3.3 SUBTASK C Security Analysis and Recommendations

The Vendor shall perform analysis to validate established security requirements and recommend additional measures as needed. For any detected vulnerabilities, the Vendor shall recommend and implement management, operational, or technical controls—including human procedures, software configuration parameters, and system changes—to mitigate associated risks and support accreditation.

1.3.3.4 SUBTASK D Technical Compliance and Vulnerability Management The Vendor shall comply with all relevant Security Technical Implementation Guides (STIGs) and support ongoing cybersecurity vulnerability scans, testing, and evaluation. The Vendor shall analyze the results of vulnerability scans, assess STIG compliance, and address any deficiencies identified during internal or external cybersecurity reviews.

1.3.3.5 SUBTASK E Information Assurance and ATO Support

The Vendor shall support Information Assurance (IA) and ATO implementation planning and validation activities. This includes attending all relevant cybersecurity meetings and providing expert recommendations and guidance for mitigation and remediation efforts.

1.3.3.6 SUBTASK F Vulnerability Remediation Timelines

The Vendor shall remediate vulnerabilities identified through system scans according to the following timelines, unless a variance is approved by the Government:

Vulnerability with exploits available and exploitable from the internet Less than 1 day Critical vulnerability with no known exploits Within 7 days High vulnerability with no known exploits Within 21 days Moderate vulnerability with no known exploits Within 45 days Low vulnerability with no known exploits Within 60 days

a. Items declared Cyber related shall be completed as directed by DoD or DLA J62, these may be out of cycle deliveries with timeframes that DoD mandates. Please reference the Control Correlation Identifier (CCI) Definitions and Implementation Guidance DoDI 8580.1.

1.3.3.7 SUBTASK G Department of Defense Architectural Framework (DoDAF) The Vendor shall provide services that assist DLA in complying with the Department of Defense Architectural Framework (DODAF). The Vendor shall provide support to assess/validate DoDAF artifacts. The Vendor shall provide support for DoDAF implementation planning and validation.

The Vendor shall support conformance with the current DoDAF Architecture Framework version and ensure all documentation is DoDAF compliant.

1.3.3.8 Task 3 Deliverables:

• Deliverable 03-01: System Scan Remediation Plan

Estimated Time: As requested by the Program Office

• Deliverable 03-02: Cyber Security Artifacts Estimated Time: As changes occur and/or as requested by the Program Office

• Deliverable 06-03: DoDAF Artifacts.

1.3.4 Task 4 - REQUIREMENTS FOR AI-DRIVEN AUTOMATION AND

SOFTWARE DEVELOPMENT

The scope and effectiveness of all AI-driven solutions described herein are contingent upon the Vendor’s ability to deploy, integrate, and operate AI tools and resources with the Government-controlled environments. Any limitations in access, compatibility, or authorization for AI technologies within these environments may impact the extent and functionality of the solutions provided.

1.3.4.1 SUBTASK A Automated Software Testing and Development

The Vendor shall implement automated software testing and development methodologies. This includes utilizing AI-driven tools for continuous integration, automated code analysis, and quality assurance to enhance software quality and reduce development time.

1.3.4.2 SUBTASK B AI-Driven System Monitoring and Anomaly Detection The Vendor shall deploy AI-driven system monitoring capable of real-time performance tracking, automated detection of abnormal system behavior, and predictive maintenance. These capabilities shall be used to anticipate and prevent system failures.

1.3.4.3 SUBTASK C Predictive Maintenance

The Vendor shall apply AI algorithms to analyze system data in order to predict maintenance requirements. This approach will optimize maintenance schedules and minimize system downtime.

1.3.4.4 SUBTASK D Process Automation for Repetitive Tasks

The Vendor shall identify repetitive manual tasks and implement process automation solutions.

Areas of focus include, but are not limited to, data entry and report generation.

1.3.4.5 SUBTASK E AI-Powered Data Analysis and Reporting

The Vendor shall utilize AI-powered data analysis and reporting tools to extract actionable insights from operational data. Comprehensive reports and visualizations shall be provided in a Government-specified format, in compliance with all applicable data security and privacy regulations. These reports will support data-driven decision-making and performance optimization.

1.3.4.6 Task 4 Deliverables:

• Deliverable 04-01: AI tool integration plan

• Estimated Time: As tools and solutions are developed and then updated as changes occur.

• Deliverable 04-02: AI software development and testing methodologies

Estimated Time: As tools and solutions are developed and utilized, prior to delivering AI-assisted solutions, and then updated as changes occur.

1.3.5 Task 5 - DATA MANAGEMENT

1.3.5.1 SUBTASK A Electronic Data Interchanges and/or Data Exchange Support:

The Vendor providing HMMS Software and sustainment support at the time of award, shall have the existing capability to move data electronically, bi-directionally, through eXtensible Markup Language (XML), Defense Logistics management Standards (DLMS) Electronic Data Interchanges (EDI) via Defense Automated Addressing System, Secure File Gateway (SFG), SSH File Transfer Protocol, IBM MQ and other means of data exchange.

The Vendor will design modernization EDI Transactions according to new customer needs, DoD and Industry Standards, and changing DLMS Policy. Refer to section 1.3.8.1 New Project Acceptance Criteria; to determine the process the vendor will follow for new EDI projects and requirements.

Current Electronic Data Interchanges that shall continue to receive sustainment and maintenance are located in the vendor’s HMMS Program Master Interface Reference and referenced below:

1) HMMS Interfaces

• EDI 1.1 - WMS/E2 (Formally DSS) HMMS HM Inventory Interface

• EDI 1.2 - 856S Turn-In Transaction

• EDI 1.3 - 841W Waste Profile Transaction

• EDI 1.4 - 824R Reject/Accept Transaction

• EDI 1.5 - 527R Receipt Acknowledgement Transaction

• EDI 1.6 - HMIRS Interface with Distribution (DLANC)

• EDI 1.7 - FLIS HMMS NSN Information SFG Connection

• EDI 1.8 - GECO – GSA Enhanced Checkout Interface

• EDI 1.9 - Hazardous Materials Usage Interface to HMDW

2) HMIRS Interfaces

• EDI 4.1 - FLIS Item (NSN) Verification Interface

• EDI 4.2 - FLIS CAGE Verification Interface

• EDI 4.3 - LMIA FLIS Interface

• EDI 4.4 - SAIC Delivery Order Interface

• EDI 4.5 - NIIN Subscription Interface

• EDI 4.6 - HMMS SDS Integration and Import Interface

• EDI 4.7 - SDS Outbound Connector Interface

• EDI 4.8 - CHEM/ISP Integration API

3) HWD Interfaces

• EDI 2.1 - 856S Turn-In Transaction

• EDI 2.2 - 841W Waste Profile Transaction

• EDI 2.3 - 824R Accept/Reject Transaction

• EDI 2.4 - 527R Receipt Acknowledgement Transaction

• EDI 2.5 - 14725 HIN Price from eProc Transaction

• EDI 2.6 - 14355 Contract Details from eProc Transaction

• EDI 2.7 - 14724 Task Order Request to eProc Transaction

• EDI 2.8 - 14726 Task Order Award from eProc Transaction

• EDI 2.9 - 14728 Task Order Modification to eProc Transaction

• EDI 2.10 - 861 Payment Authorization Request to eProc Transaction

• EDI 2.11 - 820 Payment Confirmation from eProc Transaction

• EDI 2.12 - 14729 Task Order Closeout to eProc Transaction

4) HMDW Interfaces

• EDI 5.1 - SDS Outbound Connector Interface

• EDI 5.2 - Hazardous Materials Usage Interface

• EDI 5.3 - FLIS Item (NSN) Interface

• EDI 5.4 - FLIS CAGE Interface

1.3.5.2 Task 5 Deliverables:

• Deliverable 05-01: HMMS Program Master Interface Reference

1.3.6 Task 6 - SYSTEM MONITORING / REPORTING

1.3.6.1 SUBTASK A Application Administration Support

The Vendor shall demonstrate proficiency in application administration, application security, and web administration to effectively operate, maintain, and administer the HMMS, HWD, HMIRS, POP and HMDW applications and services covered under this contract. The Vendor shall support all aspects of installation, implementation, administration, and maintenance for hosting environments, including Continuity of Operations (COOP) as applicable.

1.3.6.2 SUBTASK B Operations and Maintenance Responsibilities The Vendor shall:

• Monitor and capture performance issues, providing recommendations and plans for Government-approved application upgrades, updates, and enhancements.

• Execute deployment tasks across all environments, including Staging (STAGE), and Production (PROD).

• Troubleshoot and resolve application-related problems, coordinating with system administrators and other stakeholders as necessary.

• Implement Government-approved systems at specified locations, including COOP and backup sites.

• Ensure all mission hardware, software operating systems, and applications remain current by installing required security, upgrade, and functional patches in accordance with the configuration management plan and DoD security policies.

• The Government will perform routine backups and configuration management for all HMMS Portfolio solutions, ensuring that all equipment and software are maintained to keep performance within acceptable tolerances.

1.3.6.3 SUBTASK C Collaboration and Non-Core Hours Support

The Vendor shall anticipate that approximately 5% of work hours may be required during non-core hours. When necessary, the Vendor shall coordinate with external DoD agencies (such as Microsoft) to resolve issues and ensure uninterrupted system operations.

1.3.6.4 Task 6 Deliverables:

• Deliverable 06-01: Monitoring tool deployment documentation

Estimated Time: As requested by the Government

• Deliverable 06-02: Operations & Maintenance Plan

Estimated Time: As requested by the Government and then updated as changes

• Deliverable 06-03: Non-Core Support Procedures Estimated Time: As requested by the Government and then updated as changes

1.3.7 Task 7 - SECURITY AND COMPLIANCE

1.3.7.1 SUBTASK A Access to Sensitive Information

The provisions listed below apply to the Prime Vendor and any sub-Vendors the Prime Vendor may employ during this contract.

This Project is categorized as unclassified.

Vendors are required to comply with the DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) in the handling, protection, and safeguarding of classified information in their possession. Security requirements outside the scope of the NISPOM, if required, will be defined in the accompanying DD Form 254.

Personnel security investigations conducted for access to classified information will be conducted by the appropriate DLA Security Team.

1.3.7.2 SUBTASK B IT Level Investigation Requirements

Vendor personnel, who perform work on sensitive IT systems or applications will be required to obtain and maintain the appropriate investigation and adjudication or suitability determination commensurate with the information contained within the application or system. Vendor personnel will be assigned to positions which are designated at one of three levels (IT-I, IT-II, IT- III) based on the actions or tasks to be performed. The Vendor shall assure that individuals assigned to the positions of this task order, as determined by the Government, have obtained the proper eligibility as required by DODI 5200.2. The table below defines the labor categories within the contract and the IT-Level position category assigned to each employee. Note that IT- Level position category designation does not imply or convey access to classified information.

Instructions for access to classified information, if necessary, will be included on the DD Form 254 attached to this contract.

Labor Category IT-Level Investigation Requirement Refer to PWS Section 2.6.2 IT-I Tier 5 Refer to PWS Section 2.6.2 IT-II Tier 3 Refer to PWS Section 2.6.2 IT-III Tier 1

DLA requires that all Vendor personnel, assigned to this project shall have attained a favorable outcome to the designated IT investigative requirement assigned to each labor classification and be available to initiate work immediately upon delivery order award. IT-Level position categories are designated based on access to government networks and IT systems and may exceed classified access requirements for Hazardous Material Management System (HMMS) Software and Sustainment.

For IT-I, IT–II, and IT-III positions, the required investigation shall be completed, or interim access granted for individuals assigned sensitive duties. The provisions outlined above apply to the prime Vendor and any sub-Vendors the prime Vendor may employ during the course of this contract. In lieu of the correct investigations being completed when contract employees start, a waiver may be submitted if no issues exist within the OPM e-QIP Questionnaire for Public Trust Positions. The Vendor shall have the OPM e-QIP forms filled out, with any other requirements (fingerprints taken and, if required, an OF306), and reviewed by DLA Intelligence before officially hiring any Vendor employee into IT positions. Foreign Nationals are only eligible to perform non-sensitive duties and will not be investigated by the US Government.

DLA retains the right to request the removal of Vendor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. The reason for the removal shall be documented in writing by the Contracting Officer. When and if such removal occurs, the Vendor shall, within a two to four-week timeframe, assign qualified personnel to vacancy(s) thus created regardless of whether the individual was in a key- or non-key personnel position. Current personnel security investigations conducted for access to classified information may satisfy investigation requirements for IT- Level position investigations. All other IT- Level position investigations will be performed by the DLA Personnel Security Office.

1.3.7.3 SUBTASK C DOD 8570.01-M, Information Assurance Workforce Improvement Program

The DOD 8570.01-M, Information Assurance Workforce Improvement Program, requires training and certification for IA duties performed. All contract employees performing IA functions shall meet the requirements in accordance with DOD/DLA guidance. Additionally, all contract employees shall be certified in operating systems on any system on which System Administration duties are performed. Proof of certification shall be provided before Privileged access is granted, at time of proposal/resume submission; this includes, but is not limited to, system administration access, network administration access, router/switch access, firewall access, and Intrusion Detection System access. All documentation required for security certification will be maintained by both the Vendor and the Government. All contract employees will have acquired the necessary certification requirements, per DOD 8570.01, throughout the entire period of performance of the contract requirements. These certification requirements are not based on position title; they are based on duties. Refer to Attachment Y: 8570.01-M Certification Matrix; 8570.01-M Approved Baseline Certifications; and Computing Environment Certification List.

The Vendor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Vendor shall meet the applicable information assurance certification requirements, including:

DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

Upon request by the Government, the Vendor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

Vendor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

Reference: http://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm.

1.3.7.4 SUBTASK E Software

The Vendor shall observe all copyright agreements and shall be held liable for any infringement of copyrighted software licensing agreements and shall compensate the appropriate Vendor for each instance of copyright violation. In the interest of protecting Government systems from computer viruses, the Vendor shall not use public domain software, nor shall Vendor personnel download software from public bulletin boards. The Vendor shall use only COTS, Vendor-developed, or Government-furnished software in the performance of this statement of work. The Vendor shall use the Microsoft Office suite of software for the preparation of all documentation required in the delivery order. Should the introduction of a computer virus or malicious destruction of computer software, stored information, or hardware result from the use of public domain software or from software taken from a public bulletin board, the Vendor shall be required to repair the damage at no expense to the Government and without impact on delivery schedules or daily operation.

1.3.7.5 SUBTASK F Data Use, Disclosure of Information and Handling of Sensitive Information (including Personally Identi�iable Information)

The Vendor will maintain, transmit, and retain strictest confidence, and prevent unauthorized duplication, use, and disclosure of information. The Vendor will provide information only to employees, Vendors, and sub-Vendors having a need to know such information in the performance of their duties for this project.

Information made available to the Vendor by the Government regarding the performance or administration of this effort shall be used only for those purposes and shall not be used in any http://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm other way without the written agreement of the Contracting Officer. Vendor personnel will be required to sign a non-disclosure statement.

If proprietary information is provided to the Vendor for use in performance or administration of this effort, the Vendor may not use such information for any other purpose except with the written permission of the Contracting Officer. If the Vendor is uncertain about the availability or proposed use

1.3.7.6 Task 7 Deliverables:

• Deliverable 07-01: Confirmation of compliance and completion of 8570 trainings

Estimated Time: As requested by the Government.

1.3.8 Task 8 - SOFTWARE RELEASE, MAINTENANCE AND ENHANCEMENTS

1.3.8.1 SUBTASK A New Project Acceptance Criteria and Process When the Government or an entity acting on behalf of the government wishes to introduce a new project for construction, they will inform the vendor via the Business Requirements process described below. Projects subject this this process are those of a large nature and are not considered regular customer enhancements. Large enhancements are either major changes to the existing application or new functionality, to include Electronic Data Interchanges (EDI).

1. The government will complete a preliminary business requirements document (BRD) that describes the problem statement that needs to be solved. Other supporting information is included in the BRD. The Vendor will work with the Government to provide the BRD template.