RFI PWS SMS 7.20.26.docx

Performance Work Statement (PWS) Project Title: Army Strategic Management System (SMS) Recompete

1.0 BACKGROUND

The Army Strategic Management System (SMS) serves as the U.S. Army’s authoritative System of Record for performance management and strategy execution. As a System of Record, SMS stores and manages sensitive but unclassified performance and strategic data across the enterprise.

SMS enables Army organizations at all echelons to define, measure, and assess performance against strategic objectives. The platform supports the development of Key Performance Indicators (KPIs), the creation of customized dashboards and reports, and the automation of data integration from authoritative Army systems.

Additionally, SMS facilitates the communication of organizational strategy throughout the chain of command, ensuring alignment, accountability, and visibility into execution at every level.

Data within SMS may include Personally Identifiable Information (PII) and information subject to the Health Insurance Portability and Accountability Act (HIPAA). As such, SMS is required to maintain strict data protection, privacy, and security controls in accordance with applicable DoD and federal regulations. Access to SMS must be role-based, controlled, and auditable to ensure that only authorized personnel can view or modify data.

The system operates across two environments: an unclassified version (SMS-U) on NIPRNet and a classified version (SMS-C) on SIPRNet.

This Performance Work Statement (PWS) defines the requirement for a fully managed Software-as-a-Service (SaaS) solution to deliver, operate, and sustain SMS capabilities across the Army enterprise.

2.0 SCOPE

The contractor shall provide a comprehensive, turn-key SaaS solution to serve as the Army's SMS System of Record for sensitive (including PII) information. This includes all personnel, software, hosting, security, support, and management necessary to deliver a single, integrated, and reliable performance management platform that meets the requirements detailed in this PWS. The solution must provide a deeply integrated platform that goes beyond simple data visualization to enable comprehensive strategy execution and management. The solution must operate within two distinct, government-approved cloud environments: one at Impact Level 4 (IL4) and another at Impact Level 5 (IL5), with a required capability to synchronize data between them. The contractor shall also provide the option for customer-hosted (on-premises) deployment. A key expectation is that software and application modifications will be both Low code / No code and timely.

3.0 PERFORMANCE REQUIREMENTS

The contractor shall perform the following tasks by providing a single, integrated platform sharing a common data layer, permission model, and user interface.

3.1 Task 1: System Capabilities

3.1.1 Strategy Execution and Performance Management: The platform must break high-level strategy into measurable objectives with goals and scores and roll those scores up an organizational hierarchy to show strategic health at every level. The system shall provide a dedicated Earned Value Management (EVM) Tool to track initiatives with schedule and budget forecasting and perform statistical analysis to determine whether initiatives are impacting KPI performance. It must support multiple methodologies (e.g., Balanced Scorecard, KPI management).

3.1.2 Data Collection and Governance: The platform shall serve as a system of records by collecting, validating, and managing sensitive data that no other system tracks. It must allow for data collection via configurable forms and surveys, which can be deployed with QR code capability. These forms must use validation rules to prevent bad data at entry and ensure data integrity. The system will manage key Army data sets, including a comprehensive Personnel Dataset, and provide a complete audit trail of all data access and changes.

3.1.3 Hierarchical Rollup and Aggregation: The platform must automatically aggregate data across organizational hierarchies and integrate with authoritative data sources to keep hierarchy structures current. The platform must also support multiple concurrent hierarchy types (e.g., unit/UIC, installation, geography, SHARP structure, Population/Personnel Strength, etc.).

3.1.4 User & Role Management: The platform must provide granular, role-based access control. Access and permissions will be intrinsically linked to the defined rollup trees and user roles. Permissions must be tied to hierarchy positions (e.g., UIC), so that assigning a user to a role at a specific UIC immediately grants access to that UIC and all its descendants, allowing permissions to scale automatically with organizational structure.

3.1.5 Conditional Access Control: In addition to role-based access, the platform must support a conditional access model. The system must be able to restrict access to specific data, reports, functionalities, or entire applications based on verification of a user's certifications, training qualifications, or other documented attributes. The platform shall provide a mechanism to manage these attributes or integrate with external authoritative systems to verify user qualifications before granting access to protected resources.

3.1.6 Business Intelligence and Visualization: The platform must provide interactive dashboards, a wide range of visualizations, and user-friendly data analysis tools (views) for ad-hoc exploration of operational datasets. The system must also deliver predictive analytics and forecasting based on historical data and support advanced reporting, including SQL-based Quality Control (QC) reports.

3.1.7 Automated Leadership Briefings: The platform must generate automated "Briefing Books" that recreate slide-for-slide briefings with live data. This capability must allow leaders to brief directly from the live data and change parameters, such as time periods, in real-time during a briefing. It must also allow leaders to drill down into data mid-briefing and export briefings to standard formats like PowerPoint on demand or on a schedule.

3.1.8 No-Code Application Development: The platform must allow non-technical personnel to assemble forms, dashboards, and reports into standalone, branded applications with dedicated URLs. These applications must inherit the platform's central permission model and be created or modified in minutes without developer resources. This capability should be sufficient to support specific needs such as case management functionalities for a Program of Record for ICRS.

3.1.9 AI and Automated Insights: The platform will provide conversational AI (to be known as the "Impact Assistant") for natural-language queries, forecast future performance using time-series analysis, proactively alert stakeholders to significant changes, and analyze initiative impact on KPI performance using statistical methods.

3.1.10 Integration and Data Import: The platform must be capable of integrating with and creating datasets from multiple external authoritative data sources such as SQL Server, Oracle, and SAP HANA. It must support data import from spreadsheets (Excel, CSV) via direct upload or a scheduled pull from an SFTP protocol. The platform must support the linking and joining of these various datasets to create unified views and provide data transformation and mapping during import.

3.1.11 Enterprise Search: The platform must provide a robust search capability that allows users to easily find information across the entire system. All data objects, records, reports, dashboards, user-generated content, and uploaded documents within the platform must be indexed and searchable, subject to user permissions.

3.1.12 Scalability: The solution must support the current user base of approximately 30,000 unclassified accounts and 5,000 classified accounts, with the ability to scale as user demand changes.

3.2 Task 2: Cloud Hosting Environments

3.2.1 Unclassified Environment (SMS-U): The contractor shall host and operate the unclassified instance of the platform within a FedRAMP-authorized cloud environment at Impact Level 4 (IL4), accessible from the NIPRnet.

3.2.2 Classified Environment (SMS-C): The contractor shall host and operate the classified instance of the platform within a FedRAMP-authorized cloud environment at Impact Level 5 (IL5), accessible from the SIPRnet. The contractor must maintain a facility clearance for managing servers on classified networks.

3.3 Task 3: Cross-Classification Data Synchronization

3.3.1 Outcome: The purpose of this capability is to eliminate redundant, manual data transfers and allow for the blending of unclassified and classified data on the classified network.

3.3.2 Performance Standard: The solution must replicate data transactionally from the unclassified to the classified environment.

3.3.3 Technical Approach: Offerors shall describe their technical approach for achieving this requirement in their proposal.

3.4 Task 4: Cybersecurity, Information Assurance, and Data Retention

3.4.1 Authority to Operate (ATO): The contractor is responsible for obtaining and maintaining a full ATO for the system on both NIPRnet and SIPRnet under the Risk Management Framework (RMF), including all required documentation. The solution must hold a current FedRAMP authorization and DoD Provisional Authorization for cloud hosting.

3.4.2 Continuous Monitoring: The contractor shall implement a continuous monitoring program in accordance with DoD policy.

3.4.3 Data Archiving and Retention: The contractor shall provide a solution to ensure all government data can be archived and maintained in a readable, non-proprietary format for a period of 50 years, in accordance with all applicable National Archives and Records Administration (NARA) statutes and Army regulations.

3.4.4 Personnel Security Clearance: All contractor personnel performing work under this contract shall possess a minimum of a Secret security clearance. The contractor is responsible for all costs associated with obtaining and maintaining these clearances.

3.5 Task 5: Program Management

The contractor shall provide a dedicated Program Manager to serve as the central point of contact. The contractor shall deliver a Monthly Status Report (MSR) detailing system status, performance metrics, help desk statistics, security status, and an outline of activities planned for the next reporting period.

3.6 Task 6: System and User Support

3.6.1 Help Desk: The contractor shall provide Tier II and Tier III help desk support during standard business hours (0800-1700 ET, M-F) to all SMS users, as well as users of the entire SHARP System of Record for Sexual Assault (SA) and Sexual Harassment (SH).

3.6.2 Training: The contractor shall develop and maintain a comprehensive training program, including user guides, online documentation, and the capability to provide virtual, instructor-led training sessions upon government request.

3.6.3 Program Analyst Support: The contractor shall provide dedicated Program Analysts who can interpret data and fully understand the system to provide ad-hoc and recurring reports to Army Senior Leaders. These analysts must be proficient in writing SQL code to query and aggregate data from multiple Systems of Record to generate these reports.

3.6.4 Data Engineer Support: The contractor shall provide a Data Engineer responsible for managing and preparing data for analysis and decision-making. This role will extract, clean, transform, and prepare data for analysis; integrate data from various sources to create comprehensive data sets; and ensure data accuracy, consistency, and completeness. The Data Engineer will work closely with data scientists, analysts, and other stakeholders to understand data requirements and deliver solutions, and will maintain thorough documentation of all data sources, processes, and methodologies.

3.7 Task 7: Transition

3.7.1 Transition-In: Upon contract award, the contractor shall provide a comprehensive Transition-In Plan to migrate all existing data, user accounts, and system configurations from the incumbent system to the proposed solution with minimal disruption to end-users.

3.7.2 Transition-Out: At the end of the contract, the contractor shall provide all government data in a non-proprietary, commercially standard format (e.g., CSV, JSON, SQL) and provide necessary support to facilitate a smooth transition.

3.8 Task 8: Compliance with DoD and Federal Regulations

The contractor shall ensure the solution and all related services are fully compliant with all applicable Department of Defense (DoD) and federal laws, regulations, and policies throughout the life of the contract. The contractor is responsible for identifying, tracking, and implementing all necessary changes to maintain compliance.

3.8.1 Foundational Frameworks: The solution shall adhere to the security controls and processes defined by the Risk Management Framework (RMF) as detailed in DoD Instruction 8510.01 and NIST SP 800-53. The cloud hosting environments must maintain their FedRAMP authorization and DoD Provisional Authorization (PA) at the specified Impact Levels (IL4 and IL5).

3.8.2 Data-Specific Regulations: The contractor shall implement and maintain specific controls to protect sensitive data in accordance with the following:

· Personally Identifiable Information (PII): Compliance with the Privacy Act of 1974 and DoD 5400.11-R, "Department of Defense Privacy Program."

· Protected Health Information (PHI): Compliance with the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules.

3.8.3 Records Management: All data archiving and retention practices must comply with all applicable National Archives and Records Administration (NARA) statutes and Army regulations (AR 25-400-2).

3.8.4 Continuous Compliance: The contractor shall maintain a posture of continuous compliance by regularly reviewing and updating the system in response to changes in DoD and federal policy. The contractor must report any changes in compliance status to the government within 24 hours of discovery.

4.0 DELIVERABLES

The contractor shall provide the following deliverables:

4.1 Scheduled, Recurring, and On-Demand Deliverables

4.1.1 Maintain and refine as directed a Common Operating Picture (COP) displaying select data from subordinate units from Brigade level units up through ACOM, DRU and ASCC.

4.1.2 Maintain and refine as directed harmful behavior dashboards and the consolidated harmful behavior dashboard.

4.1.3 Draft, publish and maintain an Enterprise Staffing COP displaying select metric data from subordinate units for Brigade level units up through ACOM, DRU and ASCC.

4.1.4 Maintain and refine QA/QC/Command Reports that use metric calculations to display current and historical status.

4.1.5 Update the Hierarchy for Chain of Command Force structure changes reported from FMS Web.

4.1.6 Maintain telephone and email help desk operations during established duty hours.

4.1.7 Draft and publish presentation materials, and as requested conduct presentations to Army leadership.

4.1.8 Maintain the SAFE Helpline (SHL) test tracking document that displays Army-wide data reflecting results of test calls to the SAFE Helpline.

4.1.9 As appropriate, maintain legacy dashboards as the Enterprise staff continues to transition to the Datasets format.

4.1.10 As appropriate, facilitate the integration and use of dashboards, scorecards, datasets, briefing books, and reports.

4.1.11 Conduct Configuration Control Board (CCB) and enhance Strategy.mil for Program Offices to provide user-requested capabilities.

4.1.12 Provide Support to update and maintain a Personnel dataset, reports and dashboards.

4.1.13 The contractor shall take the lead in preparing and delivering all required system data and analyses for the Army's Annual Report to Congress on Sexual Harassment (SH) and Sexual Assault (SA), ensuring all contributions are professionally written and accurate.

4.1.14 Monthly Status Report (MSR): To be delivered monthly, due by the 10th day of the following month.

4.1.15 RMF & ATO Documentation: To be delivered as required, per government direction.

4.1.16 Training Materials: To be updated as needed, with all materials kept current.

4.1.17 Transition-In Plan: A one-time deliverable, due 30 days after contract award.

4.1.18 Transition-Out Plan: A one-time deliverable, due 90 days prior to contract end.