RFP - Final.pdf

SEE ADDENDUM

(No Collect Calls)

HC104725R0002 19-Nov-2024

b. TELEPHONE NUMBER

301-225-6981

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 06 Dec 2024

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

HC10479. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

COREY J. WOLLARD

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

DUMMYSAFE

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

DISA/DITCO-NCR

P.O. BOX 549

FT. MEADE MD 20755-0549

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$34,000,000

NAICS:

541512

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF125

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

HC104725R0002

Section SF 1449 - CONTINUATION SHEET

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Contract Number: TBD Contractor Name TBD Tracking Number: 622469571 Follow-on to Previous Contract and Task Order Number:

HC104719D5001/HC104720F0020

1. Contracting Officer’s Representative (COR)

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

2. Contract Title. Department of Defense (DoD) Secure Access File Exchange (SAFE) System

3. Background. Defense Information Systems Agency (DISA) provides DoD SAFE. DoD SAFE is a large (< 8GB) file transfer service available to DoD and Mission Partners, to include 3rd parties that do not have Common Access Card (CAC). This capability was mandated to DISA by the DoD Chief Information Office as a replacement capability for the Army Aviation and Missile Research, Development and Engineering Center service.

4. Objectives. The objective of this contract is to provide engineering and sustainment support to DoD SAFE to maintain and improve this Enterprise Service. The DoD SAFE support contract includes managing and maintaining the cybersecurity artifacts, applications, servers and supporting infrastructure on both the DISA Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet). The contractor personnel on the DoD SAFE contract shall have requisite knowledge of DoD enterprise architectures, networks, frameworks, systems, process, and data requirements. Additionally, the contractor personnel shall have expert knowledge of web services, open-source components and trends, DoD integration and networks, Unified Communication, and DoD engineering and sustainment procedures and processes to deliver and maintain a real time enterprise large file transfer service to a large customer base.

5. Scope. The scope of this contract includes engineering, development, optimization, operations, and sustainment of DoD SAFE capabilities. This contract consists of the following task areas:

Task 1 – DoD SAFE Requirements Management: This task requires the contractor to perform the management of generated requirements from DISA, DoD, DoD customers, and the DoD SAFE Program Management Office (PMO).

Task 2 – DoD Tiered Support: This task calls for the formation of Tier three (3) support that shall perform high level troubleshooting, fault isolation, and incident mitigation for all parts of the service as well as the engineering support to facilitate incident mitigation.

Task 3 - Engineering and Development Support: This task provides development and integration engineering support that includes the creation, deployment, and integration of the DoD SAFE current and future capabilities in its current and future environments.

Task 4 – Cybersecurity (Information Assurance) Support: This task requires the contractor to perform information assurance tasks including delivering reports and providing services in line with the risk management framework.

Task 5 – Contract Management: This task provides project management and documentation support for DoD SAFE applications and operating environments in addition to supporting DoD SAFE PMO and team members.

Task 6 – Service Analysis and Service Situational Awareness (Network Operations (NetOps)) Tool Development Support: This task requires the contractor to develop, deploy, and sustain event management, logging, and reporting tools.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8, Option to Extend Services.

6. Performance Requirements.

6.1 Task 1 – DoD SAFE Requirements Management

The PMO is responsible for shepherding DoD SAFE customer requirements and requests for changes into a fielded product. For the purposes of this section, customer requirements refer to all requests internal and external customers formally submit to change, alter, enhance, and improve DoD SAFE. These requests may potentially include expansion of the maximum file size, adding automation steps into the file transfer process to allow more Mission Partners to use DoD SAFE, and other miscellaneous requests that regularly (every week on average) get communicated to the PMO.

This task area is intended to provide integration support for DoD SAFE customer requirements and customer requests. The contractor shall capture, track, trace requirements (functional, non-functional, business, user interface etc), analyze, and present information (white papers, briefings etc.) and courses of action to the Government in order to fully inform and receive a decision from the PMO leadership relative to a way forward.

The contractor shall:

a. Develop and maintain processes for integration of DoD SAFE customer requests and requirements.

b. Perform system requirements analysis on existing requirements, requested enhancements, and provide functional and engineering requirements. This analysis shall include the generation of technical performance measures and the outlining of test and evaluation objectives.

c. Analyze current customer support requirements and capabilities and make recommendations for improvements, based on available technologies and industry trends.

d. Develop strategies for the migration of support from its current base to an integrated functional and technical structure that meets guidelines.

e. Use DISA Requirements Management System (RMS) to perform requirements management to capture, track, analyze, and manage user requirements.

f. Develop an unclassified requirements baseline and update requirements per DoD guidance, architectural/infrastructural changes, and stakeholder discussions concerning needs.

g. Develop a repeatable process (i.e. requirements management plan & process) to properly document requirements and ensure traceability to properly generate test cases/use cases.

h. Ensure adherence to DoD/DISA policies, directives, guidance, and mandates relative to analyzing customer requirements and requested enhancements.

i. Create and document a Formal Software Development Process.

j. Implement a requirement traceability tool and establish a requirements baseline.

k. Trace capability with requirements and maintain and update the requirement database when changes occur.

l. Maintain and update the requirements management process to ensure the integrity of approved baseline requirements, while collecting, vetting, and documenting new requirements within the process.

m. Perform system requirements analysis consisting of a structured approach to translate users’ needs into a technical system and product definitions as well as functional and engineering requirements.

n. Conduct analysis of existing processes, formulate value-add recommendations for PMO consideration, and implement approved solution(s).

o. Submit Change Management Change Requests (CMCR) and associated documentation to be determined by the Government; Participate in change request and technical review meetings to include briefing to the PMO (Technical Review Board) group and answering any questions that may arise in support of the

CMCR.

p. Submit source code and application modules in Red Hat Enterprise Linux Package Manager (RPM) format.

q. Use PMO ascribed tracking system such as GitLab or Microsoft Teams (to be defined by the Government) to formally submit and track CMCRs.

r. Develop data collection methods and tools to monitor status and provide updates when changes occur.

s. Conduct surveys, interviews and research to develop solution strategies for alternative opportunities.

Address the feasibility of developing standards or offer an alternative approach for capabilities that cannot be delivered through a common, industry-based standard.

t. Develop business cases or feasibility studies to justify Information Technology (IT) investment initiatives.

These analyses shall include a case for action, analysis of business requirements, analysis-of-alternatives, functional analysis, technical solutions, risk analysis, and economic analysis including a rough order of magnitude and costs for comparing various options.

u. Develop and create technical documentation (white papers, DoD Architecture Framework (DODAF) diagrams etc.), and weekly status reports that will include all pertinent system and program information relevant to the PMO.

Deliverables for 6.1:

Task# Deliverable Title Format Due Date Distribution/

Copies Frequency and Remarks

6.1 Technical

documentation to include white papers, presentations, DODAF standard architecture drawings (i.e. Systems View (SV-1), Operational View (OV- 1), All View, etc.), and topological/flow schematics

Contractor Determined Format

Draft –

NLT 10

business days after completion of an assessment;

Final – Five

(5) business days after completion of an assessment.

Standard Distribution*

As directed by the Government with a minimum of four per month

6.1 Bi-Weekly Status

Reports

Contractor Determined Format

Every Other Friday

Standard Distribution*

Update Bi- Weekly (All Bi- Weekly references occur every other week)

6.1 Formal Software

Development Processes documentation

Contractor Determined Format

Draft –

NLT 10

business days after completion of an assessment;

Final – Five

(5) business days after completion of an assessment.

Standard Distribution*

As directed by the Government or at least annually

6.1 Baseline Requirements

Management processes documentation

Contractor Determined Format

Draft –

NLT 10

business days after completion of an assessment;

Final – Five

(5) business days after completion of an assessment.

Standard Distribution*

As directed by the Government or at least annually

6.1 RMS New Requirements

Documentation

Contractor Determined Format

Draft –

NLT 10

business days after completion of an assessment;

Final – Five

(5) business days after completion of an assessment.

Standard Distribution

As directed by the Government with a minimum of two per month

6.1 Updated SAFE Platform

Architectural Documentation

Contractor Determined Format

Draft –

NLT 10

business days after completion of an assessment;

Final – Five

(5) business days after completion of an assessment.

Standard Distribution

As directed by the Government with a minimum of two per month

6.1 SAFE Integrated

Software modules (in rpm format)

Contractor Determined Format

Draft – NLT 10 business days after completion of an assessment;

Final – Five

(5) business days after completion of an assessment.

Standard Distribution

As directed by the Government with a minimum of four per month

6.1 CMCRs tracking log Development

and Operations (DevOps) lifecycle tool (e.g. GitLab)

Weekly N/A Update weekly

6.1 CMCR Status Briefing Contractor

Determined Format

Weekly Standard Distribution*

Update weekly

6.1 Survey, interview, and

research results

Contractor Determined Format

NLT 5

business days after Government submits request.

Standard Distribution

Not to exceed 10 per quarter

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer (KO); 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2 – DoD Tiered Support

This task area is to provide Tier 3 support for SAFE which involves receiving and addressing SAFE Tier one (1) and two (2) incidents and problems that have been escalated. Total interactions/month approximately

25. The contractor shall interface with the supporting Tiers (1 and 2) to assess the infrastructure and resolve the respective incident or problem tickets. The contractor shall attain and maintain IT-1 qualifications. The contractor shall utilize the DISA Global Ticket Management System (GTMS) and ServiceNow on the NIPRNet. The contractor shall be responsible for accessing, reviewing, updating, and annotating all Tier 3 Incident Tickets and Problem Tickets within the defined IT Service Management (ITSM)/GTMS Service Level Agreements (SLA’s) for incident priority. The contractor shall ensure Tier 3 tickets are either closed, resolved, or de-escalated to lower Tiers.

The contractor shall:

a. Provide Tier 3 help desk support during normal business hours (Monday – Friday; 8AM -5PM EST) with a two-hour on-call response time outside of normal hours.

b. Receive, record, resolve, and report on incident and problems escalated from the Global Service Desk via the official ticketing systems.

c. Monitor hardware, CPU, RAM, storage, data replication, and software for SAFE to ensure correct system operation and bring to the PMO’s attention any potential or actual issue within 1 hour of discovery.

d. Develop and maintain disaster recovery procedures for the servers and applications, and related network communications equipment to include spillage plans and procedures.

e. Coordinate post installation operations and maintenance support.

f. Audit the hardware/software inventory to ensure integrity as well as licensing compliance.

g. Manage and update the Secure Access File Exchange (SAFE) Users Guide.

h. Update documents and artifacts necessary for Change Requests (CRs) and Authority to Operate (ATOs), such as spillage plans, Negligent Disclosure of Classified Information (NDCI), Service Operations Annex (SOX), SLA with service provider, Concept of Operations (CONOPS), and Information System Contingency Plan (ISCP) etc.

i. Serve as primary liaison to customers and external partners and work closely with Government Service Managers to reach-out to customers for assistance in understanding and resolving SAFE user issues.

j. Tier 3 support will answer SAFE questions, interact with Mission Partners, address concerns and be actively engaged in troubleshooting issues between the customer and the PMO.

k. Develop and maintain metrics that support analysis of SAFE system such as usage (e.g. Drop-Offs, Pick-Ups, Drop-off Requests, Total Files, Total File Size) and Storage

Deliverables for 6.2:

PWS

Task#

Deliverable Title

Format Due Date Distribution/ Copies

Frequency and Remarks

6.2 Weekly Tier 3

Ticket Report

Contractor- Determined Format

Every Friday

Standard Distribution*

Update Weekly

6.2 Weekly Service

Operational Report

Contractor- Determined Format

Every Friday

Standard Distribution*

Update Weekly

6.2 Training

document and training video

Electronic files Initial - Within 60 calendar days after contract period of performa nce begins.

Updates – Within 5 business days after changes occur.

Standard Distribution*

Within 5 business days after changes occur.

6.2 Disaster

recovery procedures document

Contractor- Determined Format

Within 60 calendar days after contract period of performance begins.

Standard Distribution*

Within 5 business days after changes occur.

Updates – Within 5 business days after changes occur.

6.2 Documentation

for spillage plans, NDCI, SOX, CONOPS, and ISCP etc.

Contractor- Determined Format

Within 60 calendar days after contract period of performa nce begins.

Updates – Within 5 business days after changes occur.

Standard Distribution*

Within 5 business days after changes occur.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3 Task 3 – Engineering and Development Support

DoD SAFE enables secure and effective file transfers for DoD enterprise users and their Mission Partners.

The contractor shall plan, engineer, develop, integrate, test, and implement the file transfer capability utilizing open-source software solution. The contractor shall review open-source software source code, perform static code analysis, integrate DoD and security requirements, stand up all associated infrastructure, servers, and application in the software development life cycle environments, test the system and application, develop and maintain accreditation documentation, deploy the service, and develop sustainment processes. The contractor shall provide Cyber Security Information System Security Engineer subject matter expertise to execute CRs, Plans of action and milestones (POA&M’s), and ATO.

The Contractor shall:

a. Design, develop, evaluate, modify, and integrate fixes, features, and enhancements through all phases of the System Development Life Cycle

(SDLC).

b. Create technical specifications from functional specifications for complex development projects.

c. Analyze the impacts of vendor provided updates and upgrades to the system and programming solution.

d. Create and interpret representations of systems in all DODAF views.

e. Develop requirements baseline and update requirements per DoD guidance.

f. Provide clearly defined metrics to monitor the development, application, and deployment of advanced technology programs.

g. Develop input, review content, and revise existing documentation on Strategic Integration, Data Strategy and Architecture, and Tactics. Conduct testing of DoD/DISA unclassified and classified solutions relative to these areas.

h. Collect, integrate, generate, and analyze operational systems, technical architectures, organizational structures, workflows, governance, and applicable tools for the development, maintenance, and evolution of SAFE within a DoD/DISA environment.

i. Develop system engineering processes and procedures for solutions to satisfy user requirements. The contractor shall include identification and quantification of system goals, creation of alternative system design concepts, performance of design trades, selection and implementation of the best design, verification that the design is properly built and integrated, post implementation assessment of how well the system meets (or met) the goals and validate metrics.

j. Maintain and update all artifacts using the DISA tool of choice. Ensure artifacts are linked and leverage object reuse where possible to ensure accurate system models for DoD/DISA programs.

k. Identify discrete units prior to unit testing and test each unit thoroughly before delivery to the Government.

l. Design and execute unit test scripts to test all system modules and interfaces that correlate to all in-scope requirements, gaps, enhancements, and design modifications.

m. Perform unit testing to identify issues and defects and ensure all necessary activities and fixes have been executed and recorded before delivery of applications for Government Functional Testing.

n. Provide test results that demonstrate that each requirement and business rule has been addressed in the design and tested.

o. Provide a Test Report, organized by module, identifying each test scenario/function and include Pass/Fail test results. Open issues shall be identified with description of the issues, an impact assessment and planned resolution or workaround.

p. Deliver builds, software code and application release updates, playbooks, patches, application release notes, URLs, test data, user IDs and passwords, to accompany the system being delivered as these items are all parts of Information Systems.

q. Test the interoperability and compliance of the system and interconnections, to include both internal and external integrations. Resulting test reports shall outline the capabilities to ensure all interface standards have been met for feasibility of re-use and are interoperable.

r. Conduct validation and verification testing to include Unit Test, Internal Integration, and Regression testing.

s. Execute Independent Verification and Validation events. Perform administrative logistic support, test failure analyses, and lead requirements for system modifications and resolution of any instrumentation issues.

t. Conduct user acceptance tests (UAT) to validate that fixes, patches, upgrades, or new developments meet functional and system requirements and are ready for production deployment.

u. Plan, prepare, and conduct UATs for each fix, patch, upgrade, or new development prior to deployment in the live environment.

v. Create UAT test cases based on the operational, functional, and system requirements. Develop UAT documentation and manage the resolution of issues/defects identified as a result of UAT.

w. Coordinate with internal (DISA) and external organizations to support Government Acceptance Testing and Operational Test activities.

x. Update system engineering documentation (e.g. SV-1, OV-1, etc.) as designated by the DoD SAFE PMO.

y. Provide technical cyber support for CRs related to Ports, Protocols and Services Management (PPSM), Assured Compliance Assessment Solution (ACAS) findings, Operating System (OS) and Application checklists, whitelist requests, Internet Access Point (IAP) exceptions, Vulnerability Disclosure Program (VDP), or any other security findings that need to be addressed with a CR, completing necessary review processes for getting any Ports Protocols and Services (PPS) entries that are not aligned with the DISA Category Assurance List (CAL) (such as exceptions, Further Actions, and Component Local Service Assessment forms) for CRs.

z. Provide technical Cyber support for POA&M’s related to ACAS findings, OS and Application checklists, whitelist requests, IAP exceptions, VDPs, or any other security findings that need to be addressed with a POA&M, completing necessary review processes for getting any PPS entries that are not aligned with the DISA CAL (such as exceptions, Further Actions, and Component Local Service Assessment forms) for POA&M's.

aa. Provide technical cyber support for ATO and ATO extensions related to ACAS findings, OS and Application checklists, whitelist requests, IAP exceptions, VDPs, or any other security findings that need to be addressed with ATOs, completing necessary review processes for getting any PPS entries that are not aligned with the DISA CAL (such as exceptions, Further Actions, and Component Local Service Assessment forms) for ATOs.

Deliverables for 6.3:

PWS

Task#

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.3 Test Plans and Test

Results

Contractor- Determined/ Government Approved Format

NLT

seven (7) business days after the beginning of development sprint

Standard Distribution*

Twice per month.

6.3 Engineering Design

Documentation

Contractor- Determined/ Government Approved Format

NLT seven (7) business days after the beginning of development sprint

Standard Distribution*

Twice per month.

6.3 Software code and

playbooks

Contractor- Determined/ Government Approved Format

NLT two (2) business days after the end of development sprint

Standard Distribution*

Twice per month.

6.3 System engineering

documentation (e.g.

SV-1, OV-1, etc.)

Contractor- Determined/ Government Approved Format

No more than 5 business days after the end of development sprint

Standard Distribution*

Twice per month.

6.3 Software

documentation (e.g.

UAT scripts, use cases, test plans etc.)

Contractor- Determined/ Government Approved Format

No more than 7 business days after the beginning of development sprint

Standard Distribution*

Twice per month.

6.3 Software and coding

report for updates submitted, tracked or updated in PMO designated DevOps lifecycle tool (e.g.

GitLab)

Software Artifacts, Software Code, Executables, Playbooks via a DoD

SAFE PMO

designated DevOps lifecycle tool (e.g. GitLab)

10 business days after development sprint

DoD SAFE

PMO

designated DevOps lifecycle tool (e.g. GitLab)

Once per month.

6.3 Static Code

Analysis Reports

Contractor- Determined Format

10 business days after development sprint

Standard Distribution*

Once per month

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.4 Task 4 – Cybersecurity (Information Assurance)

The purpose of this task is to provide support to the SAFE PMO to ensure all Cybersecurity requirements are met and required security controls are selected and implemented to maintain compliance with the DoD RMF. The contractor shall:

a. Ensure all contractors are DoDD 8140-IAM Level 2 Certified Professionals.

b. Research and validate compliance with applicable DoD/DISA Cybersecurity requirements, directives, regulations, and US Laws.

c. Function on both the classified and unclassified networks. Secret, SIPRNet, and NIPRNet accesses are required to support: The contract includes managing and maintaining cybersecurity and Information Assurance (IA) documents that are managed and stored on both the DISA NIPRNet and SIPRNet. Some of the standards being worked on in this task are classified Secret. Access to SIPR Required.

d. Maintain and update the automated validation capabilities of the Enterprise Mission Assurance Support Service (eMASS) for preparation of the RMF Package.

e. Develop and maintain the RMF package quarterly which includes:

Maintaining the DoD SAFE system artifacts.

Assigning security controls based on the SAFE system categorization as required by DoDI 8500.01, DoDI 8510.01, CNSS 1253, and NIST SP 800-60, Volume II.

Ensuring the SAFE system is properly registered in eMASS.

Initiating and maintaining the RMF System Security Plan (SSP).

f. Implement and validate assigned security controls which include:

Execution of the RMF SSP.

Conducting RMF validation activities.

Compiling the status of the validation results in the RMF Scorecard.

g. Develop and maintain the supporting Assessment and Authorization (A&A) which include:

Risk Assessments.

Contingency Plan.

POA&M.

CR forms to document changes to a Program/Enclave.

PPSM and Whitelist management and updates.

Other artifacts associated with implementing security controls, etc. as required for the RMF.

h. Draft a POA&M for any authorization decision that requires corrective action.

i. Develop and maintain the SSP annually. The SSP shall provide a systematic approach and technique for protecting the application environment from being used by unauthorized users, guards against worms and viruses as well as any other incident/event/process that can jeopardize the underlying system’s security.

j. Provide security engineering to the Government and perform A&A activities related to the SAFE System.

k. Update Cybersecurity databases as required or directed by DoD/DISA policies.

l. Submit and update information assurance related artifacts and cybersecurity findings into SAFE PMO designated DevOps Lifecycle (e.g. GitLab) Tool.

m. Manage and maintain the SAFE A&A process monthly. This is required to sustain DoD/DISA compliance standards IAW the DoD RMF and in compliance with DoD 8500 series publications.

n. Manage the SAFE IAVM (Information Assurance Vulnerability Alert (IAVAs)/ Information Assurance Vulnerability Bulletin (IAVBs)) management process as determined by the Government.

o. Apply agile development methodologies in concurrence with a DevOps / Development, Security, and Operations (DevSecOps) environment to all cybersecurity activities where applicable.

p. Prepare and document Cybersecurity assessments of the SAFE system and assets for all security and/or certification visits during a Command Cyber Readiness Inspection. Assessment tasks include:

Auditing and reporting of the SAFE system.

Documentation.

Security control compliance.

DoD 8570.1-M compliance requirements.

IAVM which include IAVAs/IAVBs), and Security Technical Implementation Guide (STIG)/Security Recommendation Guide compliance.

q. Coordinate and provide Cybersecurity input on matters related to STIG compliance.

IAVA Testing and compliance.

ACAS and Fortify Scans, and Penetration Test results.

Deliverable(s) for 6.4:

PWS

Task#

Deliverable Title

Format Distribution/ Copies

Submission Due Date

Frequency / Remarks

6.4 SAFE RMF

Package

Contractor- Determined Format

Standard Distribution*

Draft – No Later Than (NLT) 30 business days after contract period of performance begins.

Final – NLT 90 business days after contract period of performance begins.

Updates – NLT 10 business days after initiated change.

Updated Quarterly

6.4 SAFE

System Security Plan Annual Updates

Contractor- Determined Format

Standard Distribution*

Initial – NLT 30 business days after contract period of performance begins.

Updates – NLT 30 business days from exercise of each option period

Updated Annually

6.4 A&A Process

documentation Monthly Updates

Contractor- Determined Format

Standard Distribution*

Initial - NLT 30 business days after contract period of performance begins.

Updates – 1st business day of each month

Updated Monthly

6.4 Weekly

IAVM

report

Contractor- Determined Format

Standard Distribution*

Initial – NLT 7 calendar days after contract period of performance begins.

Updates – 1st business day of each week

Weekly

6.4 SAFE

Change Request

(CR)

Contractor- Determined Format

Standard Distribution*

7 business days, after change has been requested

Approximately 1 per week, can vary.

On average about 50 per year.

6.5 Task 5 – Contract Management

This task provides project management expertise to manage SAFE service.

The contractor shall:

a. Provide a Bi-weekly status report for the tasks and subtasks by monitoring for quality assurance, progress/status reporting and program reviews applied to the contract. The report shall include:

Software Development & Delivery Status Open Risks & Issues Completed Activities by Task # Government Meeting Participation Upcoming Activities GFE Accounting Deliverable Submitted

b. The contractor shall create and update the Contract Management Plan to include the management of this contract and describing the technical approach, organizational resources, and management controls to be employed to meet performance and schedule requirements of this task.

c. The contractor shall update the Requirements Management process to include the management of this task and describing the technical approach, organizational resources, and management controls to be employed to meet performance and schedule requirements of this task.

d. Deliver an Integrated Master Schedule (IMS) to define the ongoing and planned work projections throughout contract execution which shall be updated weekly.

The IMS shall include:

Task name(s) Duration Projected Start Projected Finish Actual Start Actual Finish Predecessors % Complete Resources Assigned

e. Develop and deliver briefs, plans, and other documentation supporting the SAFE Program Office.

f. Apply DevOps / DevSecOps methodologies to all efforts where applicable.

g. Establish and document formal software development, code control and build processes for major and minor (patches) releases and fully integrate with SAFE PMO designated DevOps Lifecycle (e.g. GitLab) Tool, designated Cloud environment, DISA Data Center, and Data Center infrastructure environments.

Deliverables for 6.5:

PWS

Task#

Deliverable Title

Format Distribution/ Copies Submission Due Date

Frequency and Remarks

6.5 Bi-Weekly

Status Report

MS Project or as specified by Governme nt

Standard Distribution*

15 days after contract period of performance begins, and every other Friday thereafter.

Bi-Weekly and when there are significant accomplishments, issues, and activities

6.5 Contract

Management Plan

Contractor- Determine d Format

Standard Distribution*

Initial – NLT 30 business days after contract period of performance begins.

Final – NLT 60 business days after contract period of performance begins.

Annual Updates – Due by 1 October

Update annually

6.5 IMS MS Project Standard

Distribution*

Initial – NLT 15 business days after contract period of

Bi-Weekly and when there are significant changes to the schedule performance begins.

6.5 Briefs, plans, and other documentation supporting the

SAFE

Program Office.

MS Office Suite Product, or other comparable format

Standard Distribution*

Within 5 business days after Government submits request

Not to exceed 5 submissions per week

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.6 Task 6 – Service Analysis and Service Situational Awareness (NetOps) Tool Development

This task is to develop, deliver, and sustain Service Analysis and Situational Awareness (NetOps) tools that will be used by operational support elements and DoD SAFE Engineering to assess the health and stability of all capabilities managed by the DoD SAFE PMO, the support infrastructure for those capabilities, and to provide near real-time Situational Awareness of capabilities under the purview of the DoD SAFE PMO.

The contractor shall develop, modify, and deliver tools (e.g. Elastic Stack) to monitor and provide analysis of DoD SAFE PMO managed capabilities and enterprise capabilities (Shared Services) that are leveraged by DoD SAFE capabilities where applicable. The DoD SAFE PMO uses the following tools and applications to manage the development portion of the Service Analysis and Situational Awareness Development effort:

Elasticsearch, Logstash, & Kibana (Elastic Stack) Simple Network Management Protocol (SNMP) Rsyslog GitLab Ansible

In addition to the enterprise capabilities (Shared Services) managed by the DoD SAFE PMO, the following elements are considered to be key components:

Cloud Environment Internet Protocol (IP) networks (IPV4 and IPV6) Firewalls, Routers, and Switches Virtual Infrastructures (VMWare) Network Attached Storage Storage Area Networks Active Directory / Domain Controllers Virtual Private Networks F5 Load Balancers

The contractor shall:

Provide level-of effort (LOE) assessments on development & integration for all elements covered by this task.

Develop, integrate, and deliver NetOps tools that monitor all DoD SAFE capabilities.

Update DoD SAFE PMO designated DevOps Lifecycle (e.g. GitLab) Tool artifacts, submit software code, and deliverables via DoD SAFE PMO designated DevOps lifecycle platform (e.g. GitLab) tool.

Create, modify, track and manage CMCR as they work their way through the process of engineering, development, test and deployment.

Apply SDLC processes and Agile development methodologies in a DevOps / DevSecOps environment.

Develop required engineering, development, and operational documentation in support of this task. These include developing and/or updating of the following:

o SV-1 and OV-1 architecture diagrams to illustrate how each solution will interface with the existing infrastructure.

o Test plans, testing, and test results with purpose of validation.

Maintain & configure DoD SAFE Service Situational Awareness/NetOps tools per direction of DoD SAFE NetOps Development.

Maintain close communication with DoD SAFE Tier 2, Tier 2.5, and Tier 3.

Provide direct support to DoD SAFE Tier 2, DoD SAFE Tier 2.5, DoD SAFE Tier 3, and the DISA Command Center.

Deliverable(s) for 6.6:

PWS

Task#

Deliverable Title Format Distribution/ Copies Submission Due Date

Frequency / Remarks

6.6 Developmental

Tasks LOE Assessment

Contractor- Determined Format

Standard Distribution*

Draft – NLT 15 Business days after each requirement decision

Final – NLT 30 Business days after each upgrade requirement decision

Updated at least quarterly

6.6 System OV-1 and SV-1

Architectural diagram

MS Visio and

PDF

Standard Distribution*

Draft – NLT 15 Business days after each requirement decision

Final – NLT 30 Business days after each upgrade requirement decision

Updated at least quarterly

6.6 Test Plans and

results

Contractor- Determined Format

Standard Distribution*

Draft – NLT 10 Business days after each deliverable

Final – NLT 20 Business days after each deliverable

Updated at least quarterly

6.6 Integrated Software Software Code

(where applicable), Executables (rpms), and Ansible Playbooks

DoD SAFE PMO Designated DevOps Lifecycle (e.g.

GitLab) tool

Draft – NLT 15 business days after release

Weekly

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

Performance Standards Acceptable Quality Levels Surveillance Results/Ratings

Task/Deliverable Content and Accuracy (All PWS Tasks):

Task/Deliverables are kept current and contain the most recent information.

Deliverables include accurate data and pertinent content; including the appropriate inclusion of analysis, recommendations, alternative solutions, and impact analysis, as required by the deliverable itself.

Minimum Acceptable: 95% of information contained in the respective task/deliverables are accurate, complete and include the required content, as required by each respective deliverable.

The Government requires a period not to exceed 30 calendar days after receipt of the final deliverable items for inspection and acceptance or rejection, unless otherwise specified. If the deliverable does not meet the specified criteria, it shall be returned. After notification that the deliverable did not meet the acceptance criteria, the Contractor shall re-submit the deliverable within 10 calendar days. Upon re-submission by the Contractor, the Government shall apply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, the Government will consider the contractor as having deficient performance with respect to the subject task. The contractor shall permit the Contracting Officer or designated representative access at any reasonable time to all records, data, and facilities used in the performance of services.

Measurement Interval: The measurement interval is monthly.

Measurement Period: The Measurement Period begins at 00:01 on the first day of the month and ends at 24:00 on the last day of the month.

Method of Surveillance: 100% Inspection

Timing of Measurement:

Measurements are taken within ten (10) days of the end of the Measurement Period.

Reporting Frequency:

Reporting to commence upon the beginning of the contract Period of Performance, and continue through the life of the entire contract

A rollup of assessment of the Surveillance Inspection Results will aid in the development of an overall rating for this objective.

Potential Overall Ratings:

Exceptional Very Good Satisfactory Marginal Unsatisfactory

Task/Deliverable Quality and Timeliness (All PWS Tasks):

Timely submission of Tasks/Deliverables

Minimum Acceptable:

Acceptable "quality" performance delivered by specified delivery date at least 95% of time.

“Quality” for a task/deliverable is defined as meeting the task requirements in the PWS, applicable directives, required formats, and PWS “deliverables” requirements, which are identified after each task area.

“On-time” for a task/deliverable is defined as being delivered on the due dates specified in the above deliverable tables.

Measurement Interval: The measurement interval is monthly.

Measurement Period: The Measurement Period begins at 00:01 on the first day of the month and ends at 24:00 on the last day of the month.

Method of Surveillance: 100% Inspection

Timing of Measurement:

Measurements are taken within 10 days of the end of the Measurement Period.

Reporting to commence upon the beginning of the contract Period of Performance, and continue through the life of the entire contract

A rollup of assessment of the Surveillance Inspection Results will aid in the development of an overall rating for this objective.

Potential Overall Ratings:

Exceptional Very Good Satisfactory Marginal Unsatisfactory

Contract is staffed adequately to meet mission requirements:

Positions are not vacant in excess of 45 consecutive days.

Overall FTE vacancy rates not to exceed 20% in any given month.

Exceptions:

Government Clearance process delay.

Minimum Acceptable:

Positions:

Exceptional: 100% Very Good: >=85% Satisfactory: >=80% Marginal: >=71% Unsatisfactory: <70%

Measurement Interval: The measurement interval is monthly.

Measurement Period: The Measurement Period begins at 00:01 on the first day of the month and ends at 24:00 on the last day of the month.

Method of Surveillance 100% Inspection

Timing of Measurement

A rollup of assessment of the Surveillance Inspection Results will aid in the development of an overall rating for this objective.

Potential Overall Ratings:

Exceptional Very Good Satisfactory Marginal Unsatisfactory

Measurements are taken within 10 days of the end of the Measurement Period.

Reporting to commence upon the beginning of the contract Period of Performance, and continue through the life of the entire contract

Tier 3 Help Desk Response times – PWS Task 6.2

Minimum Acceptable:

If the application is not available for use or has greatly reduced functionality, the Service Manager shall be notified within 1 hour with a plan to fix or mitigate the issue.

Requests to the Tier 3 help desk shall be resolved or escalated to Tier 4 within:

Critical <= 30 Minutes High <= 4 Hours Medium <= 8 Hours Low <= 3 Business Days

Measurement Interval: The measurement interval is monthly.

Measurement Period: The Measurement Period begins at 00:01 on the first day of the month and ends at 24:00 on the last day of the month.

Method of Surveillance:

Periodic Inspections

Timing of Measurement:

Measurements are taken within 10 days of the end of the Measurement Period

Reporting Frequency:

Reporting to commence upon Contract Award and continue throughout the Period of Performance

A rollup of assessment of the Surveillance Inspection Results will aid in the development of an overall rating for this objective.

Potential Overall Ratings:

Exceptional Very Good Satisfactory Marginal Unsatisfactory

8. Incentives.

The Government will positively and/or negatively review the contractor's performance based on the success or failure in meeting Quality Assurance Surveillance Plan objectives. The Government will make determinations for option period awards based on contract performance, as measured by the surveillance plan. The contractor is incentivized to earn favorable Government reviews to support continuation of DISA work and to support contract awards with other Government agencies seeking DISA's input on the contractor's past performance and the Contract Performance Assessment Reporting System (CPARS). Failure to meet the acceptable quality levels may result in an unsatisfactory past performance report by the Government.

9. Place of Performance and Hours of Operation.

Mission Location: DISA Headquarters (HQ) located at Fort Meade, MD

Place of Performance: contract performance shall be a combination of Contractor- provided facilities performing unclassified work and all classified work being performed at DISA facilities at DISA HQ, 6910 Cooper Ave, Ft.

Meade, MD 20755-7088.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the Contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the Government.

Travel in and around the primary place of performance may be required throughout the period of performance.

Additional travel within CONUS may be required to support the requirements of this PWS.

Local Travel. Local travel within the National Capital Region (NCR), to other than DISA HQ, is very limited. Local Travel will not be reimbursed. The Government does not intend to reimburse for local travel between the contractor facility and the DISA facility at Ft. Meade, MD.

Temporary duty (known as TDY) Travel. Any Government-approved long-distance travel or TDY travel will be a cost-reimbursable direct cost to the resultant contract and will require pre-approval by the COR prior to the Contractor incurring the cost in support of this contract. All TDY must be approved by the COR prior to its execution.

Secondary Place of Performance – Contingency Only. As determined by the COR, contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the KO or the Contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

Contractor personnel shall provide coverage for all associated contract services for eight hours a day, between 0630 to 1700 local time Monday – Friday (except holidays). Exceptions to this requirement may be granted via written request from the contract program manager to the KO and/or COR. Until written authorization is received from the KO and/or COR, no changes to the work schedule is permitted.

The contractor is responsible to obtain and pay for any regulatory approvals. This includes initial fee and annual fees for technical assistance agreements, personnel certifications, and any other contractor certifications.

10. Period of Performance.

The period of performance for this effort is a one-year base period, plus four, one-year option periods to be exercised at the discretion of the Government. In addition, FAR clause 52.217-8 will be included which allows the Government to authorize performance for an additional six months if deemed necessary.

Below are the estimated periods of performance:

Base Year: 30 June 2025 – 29 June 2026 Option Year 1: 30 June 2026 – 29 June 2027 Option Year 2: 30 June 2027 – 29 June 2028 Option Year 3: 30 June 2028 – 29 June 2029 Option Year 4: 30 June 2029 – 29 June 2030 One six-month extension, if exercised per FAR 52.217-8 dates: from 30 June 2030 to 29 December 2030

In the event of a Government shutdown, as directed by the KO, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.