03_Compliance_Suite_Performance_Work_Statement_PWS.docx

DEFENSE CONTRACT MANAGEMENT AGENCY

Records Management System Replacement Performance Work Statement

1. General Description

OVERVIEW

The Defense Contract Management Agency (DCMA) provides direct program management support to the Department of Defense (DoD) in the development and sustainment of Government Contract Writing and Administration Systems (CWASs) such as Modification Delivery Order (MDO), Mechanization of Contract Administration Services (MOCAS), Standard Procurement System (SPS), and other DoD eCommerce tools. Further, DCMA works hand-in-hand with DoD Components to ensure electronic processing of contracting actions into Department and Federal data systems that support all aspects of the Procure to Pay Process (P2P). DCMA supports its user community with a vast data infrastructure and applications to efficiently and effectively execute the Agency's Contract Administration Services (CAS) mission and various administrative processes. DCMA is three years into a six year strategy to automate re-engineered CAS business processes into an Integrated Workload Management System (IWMS). IWMS uses the Blackpearl (K2) Business Process Management Suite (BPMS) and a SharePoint 2010 instantiation to provide Contract Administration Services to the DoD. IWMS is also integrated with HP Trim to provide DoD mandated 5015.2-STD compliant records management for the agency's electronic contract management records and administrative files.

Defense Contract Management Agency (DCMA) is seeking to replace its current records management system (HP Trim) with Compliance Suite Professional (CSPro) which is a JITC certified 5015.2-STD compliant records management system that will be installed on DCMA’s SharePoint architecture. A SharePoint “bolt on” 5015.2-STD compliant records management capability will save the government hundreds of thousands of dollars that can be redirected to DCMA’s core CAS mission and other support areas by eliminating HP Trim servers, consolidating documents and records into one central storage location, streamlining records management and require less integration with existing systems.

DCMA contemplates establishing a Blanket Purchase Agreement (BPA) that will include a base year and five, one-year option periods.

ABOUT DCMA

DCMA is the Department of Defense's component that works directly with defense suppliers to help ensure that DoD, Federal and allied government supplies and services are delivered on time, at projected cost, and meet performance requirements.

DCMA provides Contract Administration Services (CAS) to the DoD Acquisition Enterprise and its partners to ensure delivery of quality products and services to the warfighter; on time and on cost. DCMA is a recognized leader of and contributor to many of DoD's business reform initiatives. Those initiatives' goals are to improve the Nation's defense in the most economical and efficient ways possible. This involves managing 334,000 prime contracts valued at approximately $1.2 Trillion.

DCMA is headquartered in Ft Lee, Virginia and currently employs approximately 10,500 civilian and military professionals worldwide. DCMA consists of over 50 Contract Management Offices (CMOs) with over 800 employee duty stations worldwide, working with over 19,000 defense related firms.

IMPORTANT FACTS FOR CONSIDERATION IN RESPONDING TO THE RFP

The target Platform is SharePoint 2016 with users operating on Windows 10. DCMA is currently operating on SharePoint 2010 with users operating on Windows 7 or 8. DCMA intends to deploy Windows 10 in the 2nd Quarter FY17. DCMA currently stores documents inside SharePoint but is in the process of testing Remote Blob Storage (RBS) using Metalogix StoragePoint. DCMA intends to migrate to Remote Blob Storage (RBS) as part of the move to SharePoint 2016.

DCMA refers to its SharePoint Platform as DCMA 360. In DCMA, the term DCMA 360 is used interchangeably with SharePoint.

DCMA currently has SharePoint 2010 loaded in the following environments: Development, System Test (ST), Automated Test Center (ATC) and Production. When SharePoint 2016 becomes available, DCMA will provision parallel Development, ST, ATC and Production servers to install, integrate and test SharePoint 2016 prior to promotion into the Production environment.

DCMA records are managed in two groups: Mission Support records and Business Support records.

· Mission support records consist of records associated with contracts DCMA has been delegated to administer from the military services and facilities records where performance is occurring on delegated contracts. Mission Support records are currently stored in and managed by HP Trim. There are approximately 13 million mission support records stored in HP Trim. Each record is stored with key metadata, which includes DoDAAC (DCMA Office Code), CAGE (Contractor facility Code), contract number, and a record series code. The metadata is also used to determine the type of mission support document (contract or facility), the record retention period, the business functional area the record is associated with and generally which phase the record is used in the contract management life-cycle. Example: 2CAQ05 represents a record used during the 2nd phase of the contract management life-cycle. The “C” in the second position indicates it is a Contract related record verses a facility record that would be signified with a “F” in the 2nd positon. The AQ in the 3rd and 4th positon represents the contracting functional area. AQ is the Contracting Directorate office code. The last two positions serves as a unique number that represents the content of the record. In this case, 05 is the unique AQ number for ACO - Contract Receipt and Review records. There are approximately 350 established records series codes in HP Trim.

· Business Support records are non-mission support records that are administrative in nature. Business support records are generally associated with functional areas such as Human Resource, Financial, Information Technology, or Legal. Business support records originate from HQ and DCMA field offices. Business Support records are currently stored in SharePoint 2010 libraries or on a common shared drive being used to stage records for migration into SharePoint. Records stored in SharePoint have associated metadata that describes the records. For example, content category (HR, IT, Finance, Legal), Content Area (recruiting), and content type (interviews). DCMA estimates there are less than a one million records stored in SharePoint enterprise records libraries.

· DCMA has extensive experience managing the migration of records. DCMA successfully completed the migration / clean-up of 24 million mission support records from a Northrop Grumman records management system to HP Trim. Approximately 10 million of the 13 million documents currently in HP Trim came from this migration.

· The name of DCMA’s information management system is the Electronic Document and Records Management System (eDRMS). DCMA has acquired the Titus metadata security application to streamline SharePoint document access permissions and management. DCMA shall use Gimmal’s Compliance Suite Professional to provide 5015.2-STD compliant records management for DCMA mission and business support records. DCMA intends to leverage the capabilities of Titus and Compliance Suite Professional to reduce records and document infrastructure, operations and sustainment costs. While these capabilities can be implemented separately to manage documents and records, DCMA would like to achieve additional efficiencies by leveraging the best of each capability through integration, where feasible, to deliver the most efficient records and documents management system possible.

eDRMS HIGH LEVEL OBJECTIVES

Install, integrate, test, train and deploy the Compliance Suite Professional JITC certified 5015.2-STD solution into DCMA’s production environment no later than 1 June 2017 to achieve the following benefits. (NOTE: HP has informed users that it will stop supporting HP Trim in July 2017 and has advised customers to upgrade to HP Records Manager. To avoid the integration costs of upgrading to HP Records Manager 8.3, DCMA must transition to Compliance Suite Professional in production prior to the termination of HP’s support for HP Trim.)

Migrate mission and business support records from existing locations to SharePoint 2016 utilizing StoragePoint to implement RBS storage with no impact to current CAS mission execution.

Integrate Compliance Suite Professional with Microsoft Outlook to initiate email records management that complies with the National Records Management Agency (NARA) CAPSTONE and NARA/OMB 2019 Records management mandate.

Achieve cost savings from the de-activation of 16 HP Trim servers by leveraging DCMA’s SharePoint infrastructure to provide 5015.2-STD compliant records management with no additional servers.

Replace DCMA’s customer records basic search capability with Compliance Suite’s robust search feature.

Train the appropriate personnel to ensure DCMA can efficiently execute and sustain eDRMS using Compliance Suit Professional.

Leverage existing SharePoint APIs to integrate existing IWMS – HP Trim interfaces with IWMS – CSPro interfaces.

Leverage SharePoint’s active directory / SAML 2.0/ 3.0 claims security model to increase security and the efficiency and flexibility to grant access to records while reducing integration costs.

2 | Page

Compliance Suite Pro Project Milestones

2. Requirements

The contractor shall provide professional services technical support for the planning, configuration, installation, testing, training and deployment of Compliance Suite Professional into DCMA’s production environment. Specific technical support requirements are:

1.0. iLab Technical Support. Contractor shall provide technical support for iLab project risk reduction efforts.

1.1. Contractor shall become knowledgeable of 1) DCMA's "As Is" mission and business support Records Management architecture and supporting systems and 2) eDRMS High Level Objectives (HLO) for the "To Be" records management system

1.2. Conduct business process analysis and develop Records Management System Architecture Options for mission support and business support records. Assess risks for various technical approaches and recommend additional iLab risk mitigation proof of concept testing.

1.3. Conduct or support required proof of concept modeling and testing in the DCMA iLab environment to collect data supporting "To Be" architectural and system configuration recommendations and technical options for achieving eDRMS HLOs.

1.4. Recommend a strategy and technical options for achieving eDRMS HLOs.

2.0. Records Migration Support. Contractor shall provide recommendations and technical support to migrate DCMA records to Compliance Suite Pro.

2.1. Contract Administration File (Mission Support) Records Migration Technical Support. Contractor shall provide technical assistance and support to migrate approximately 13 million documents into StoragePoint and configure CSPro to provide 5015.2-STD records management.

2.2. DCMA 360 Enterprise Library (Business Support) Records Migration Technical Support. Contractor shall provide technical assistance and support the migration of approximately 1 million business support records into StoragePoint and configure CSPro to provide 5015.2-STD records management.

3.0 Installation and configuration Support. Contractor shall install and configure the most current version of Compliance Suite Pro software into the DCMA environments below IAW the milestone schedule.

3.1. Lab Cloud Test Environment

3.2. Development Environment

3.3. System Test Environment

3.4. Automated Test Center (Environmental Testing)

3.5. Production Environment

4.0. Outlook email Records Management. The contractor shall configure and test Compliance Suite Pro Outlook email Records Management 5015.2-STD functionality and compliance with National Records Management Agency (NARA) CAPSTONE and NARA/OMB 2019 Records management mandate.

5.0. Testing Support. Contractor shall support Compliance Suite Professional Testing in the following DCMAIT SDLC environments.

5.1. Development Environment – Contractor shall support testing of the initial premise installation of CSPro and support integration efforts and testing with IWMS, DCMA 360 Enterprise Libraries and Outlook. The contractor shall develop Functional test cases for testing in the System Test (ST) environment.

5.2. System Test Environment - Contractor shall deliver Compliance Suite Pro install procedures and support System functional testing to verify functionality and proper integration with IWMS. Contractor shall develop use cases to support performance testing in the ATC environment.

5.3. ATC Environment – Contractor shall support Environmental & Performance Testing in the ATC environment. Test script scenarios shall be executed to place the SharePoint platform under load by simulating a heavy load of document and records management activities. The contractor shall provide technical support to assess, troubleshoot or correct issues experienced with Compliance Suite Pro’s performance.

6.0. Compliance Suite Professional (CSPro) Training. The contractor shall provide Compliance Suite Pro user, train the trainer and Administrator training.

6.1 Electronic Document Records Management System (eDRMS) / and DCMAIT-Operations CSPro Administrator Training (four sessions - See project schedule).

6.2 Contract Management Office Information Resource Manager (IRM) Training the trainer (two sessions - See project schedule).)

7.0. Post Deployment Production Support. Contractor shall provide technical support to address any Compliance Suite issues experienced for a period of 90 days after Compliance Suite Professional is deployed into DCMA’s production environment.

8.0. Deliverables. The contractor shall provide the following deliverables in a PDF format to the eDRMS Program Manager as indicated on the project milestone schedule.

8.1. Paper recommending a strategy and technical options for achieving eDRMS HLOs

8.2. Compliance Suite Installation Procedures

8.3. Compliance Suite Pro configuration settings.

8.4. Compliance Suite Pro User Manuals

8.5. Compliance Suite Pro Administrator Manuals

8.6. Training materials

8.7. Compliance Suite Pro project lessons learned

9.0. Place of Performance. The contractor may be required to support installations from the DCMA facilities noted below. DCMA will determine if contractor on site support is required after contract award. All installations to sites outside of these facilities shall be performed over the DCMA network.

(Development Lab) DCMA Carson 18901 So. Wilmington Ave. Building# DH2 Carson, CA 90746

(Integration (ST) Environment) DCMA Skunkworks 6412 Beulah Street Alexandria, VA 22310

Automated Test Center (ATC) DCMA Columbus 3990 E. Broad Columbus, OH 43213

(Production Site) DCMA Carson 18901 So. Wilmington Ave. Building# DH2 Carson, CA 90746

(Production Site) DCMA Boston 295 Summer ST Boston, MA 22100

The contractor shall not perform any work on a government site without prior coordination from the contracting officer’s representative (COR).

10.0 General Specifications – Applies to all specifications above

Presentations and data containing contractor proprietary markings shall be deemed to be not in compliance with this PWS.

Instructions for the submission of invoices can be accessed through: http://www.dcma.mil/itcso/ebiz/itcso_wawf_guidance.cfm

11.0. Period of Performance. The period of performance is for a base year, plus four one-year option periods.

12.0. Hours of Operation. The contractor is responsible for conducting business, between the hours of 8am to 4pm Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The government shall not be liable for any schedule delays because of the contractor’s inability to meet work hour requirements. The contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential. All references to days within this PWS will be calculated as calendar days.

Recognized U.S. Federal Holidays

· New Year’s Day Labor Day

· Martin Luther King Jr.’s Birthday

· Independence Day

· Columbus Day President’s Day

· Veteran’s Day

· Memorial Day

· Thanksgiving Day

· Christmas Day

13.0. Security Requirements.

13.1 All contractor personnel must be US citizens.

13.2 Contractor personnel performing work under this contract must have a favorably adjudicated background investigation to occupy an ADP/IT-II position prior to commencing work on the contract and must maintain the level of security required for the life of the contract.

13.3 Assignment to an ADP/IT-II position requires favorable adjudication as stated in DoD 5200.2R and in accordance with the Revised Federal Investigative Standards. Listed below are the categories and associated required investigations:

Single Scope Background Investigation (SSBI) (ADP/IT-I) or Tier Five (T5) investigation equivalent National Agency Check and Law and Credit (NACLC) (ADP/IT-II) or Tier Three (T3) investigation equivalent National Agency Check with Inquiries (NACI) (ADP/IT-III) or Tier One investigation equivalent as appropriate.

13.4 The contractor will provide sufficient documentation through their Security Office to the DCMA Security Office to show existing favorable adjudication of required investigations. The security investigation (within scope) must have been completed or a current update investigation is in process.

13.5 DCMA security personnel will validate proof of existing investigations and adjudications. DCMA Security uses the Joint Personnel Adjudication System (JPAS) to verify investigations. DCMA Security will make every effort to confirm the clearance of vendors not in JPAS; however, timely results are not common and delays would not be considered a reason for a Government caused delay.

13.6 New investigative requirements will be processed by DCMA Security Office (Attn: Personnel Security) 3901 A Avenue, Building 10500, Fort Lee, VA 23801. The contractor will ensure contractor support personnel submit the appropriate security forms in a timely manner to meet performance requirements. Investigations and adjudication processes are time consuming and delays are common, delays in the investigative and adjudicative processes are not considered a reason for a Government caused delay.

13.7 To be granted unescorted access to general DCMA spaces and or access to DCMA IT systems the contractor must obtain a DoD issued Common Access Card (CAC). Requirements for proposed contractor recipients of a CAC must first be vetted through his or her employer using the DoD-approved process and the process outlined in the following documents:

Federal Information Processing Standards Publication 201- 1, "Personal Identity Verification (PIY) of Federal Employees and Contractors" DoD Regulation 5200.2-R, "Personnel Security Program" Directive-Type Memorandum (DTM) 08-003- "Next Generation Common Access Card (CAC) Implementation Guidance"

13.8 All CAC holders must minimally have an initiated National Agency Check with Inquiries (NACI) or Tier One (T1) equivalent and a favorable completion of a Federal Bureau of Investigation (FBI) fingerprint check, or a DoD-detem1ined equivalent investigation, or greater. However, Affiliated Volunteers requiring network access are only required to have an initiated National Agency Check with Inquiries (NACI), and a favorable completion of an automated FBI National Criminal History Check (fingerprint check).

13.9 When contractor personnel are no longer supporting this contract, the contractor is responsible for ensuring any issued a CAC are returned to the COR for proper disposition.

13.10 Access to U.S. Government spaces and computing assets is a privilege, not a right. Access to these spaces and systems may be monitored at any time. Any violation of established DoD/DCMA policies and procedures could involve the revocation of granted privileges.

13.11. Contractor personnel are required to comply with all security policies, procedures and training established in DCMA Security Instructions.

13.12. Contractor personnel are required to attend DCMA security training as specified in addition to his/her contractor requirements.

13.13. When in DCMA-owned or controlled buildings or other facilities, contractor personnel shall display DCMA-issued identification badges in accordance with DCMA policy.

13.14. Lost or misplaced keys, key cards, or badging credentials issued by DCMA must be reported to the local DCMA security representative on the first duty day after the loss is detected.

13.15. Data Access

13.15.1. Access To and Use of Government Information: If the Contractor, in the performance of this contract, obtains access to Government owned or controlled information such as plans, policies, reports, studies, financial plans, or data which has not been released or otherwise made available to the public, the contractor agrees that without prior written approval of the Contracting Officer, it shall not: (a) use such information for any private purpose unless the information has been released or otherwise made available to the public; (b) compete for work based on such information until such information is released or otherwise made available to the public; (c) submit an unsolicited proposal to the Government which is based on such information until such information is released or otherwise made available to the public; and (d) release such information unless such information has previously been released or otherwise made available to the public by the Government.

13.15.1.2. Access To and Protection of Proprietary Information: The Contractor agrees that, to the extent it receives or is given access to proprietary data, trade secrets, or other confidential or privileged technical, business, or financial information (hereinafter referred to as "proprietary data") under this contract, it shall not use or disclose such information for any purpose other than providing the contract support services, and will not use or disclose the information for any personal or other commercial purpose. The Contractor further agrees to enter into a written agreement for the protection of the proprietary data of others and to exercise diligent effort to protect such proprietary data from unauthorized use or disclosure. A copy of each such written agreement shall be furnished to the Contracting Officer. In addition, the Contractor shall obtain from each employee who has access to proprietary data under this contract, a written agreement (Non-Disclosure Agreement) which shall in substance provide that such employee shall not, during his/her employment by the Contractor or thereafter, disclose to others or use for their benefit, proprietary data received in connection with the work under this Contract.

13.15.1.3. Data Retention: At the end of the period of performance of this contract, all sensitive/controlled unclassified information (CUI) materials provided to the contractor in support of this contract must be returned to the COR.

13.16. Sharing or common use of DCMA user identifications and passwords is strictly prohibited.

13.17. Information Assurance:

(a) The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including-

(1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

(2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

(b) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(c) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

The contractor will provide Name, SSN, and security clearance information for all assigned personnel to show favorable adjudication of required investigations. Contractor personnel will be briefed in accordance with DCMA security policies, given a security awareness exam, and briefed on proper disposition of their passwords (if issued).

Contact Ms. Destinee Winslow Destinee.Winslow@dcma.mil

(804) 734-1629

14.0. Site Maintenance and Storage. The contractor shall keep the work site in a clean and orderly manner. All equipment, materials and supplies shall be stored so as to maintain a secure and safe work site. The contractor shall provide, and is responsible for, any security needs required to protect equipment, materials, and supplies required under this PWS.

15.0. DCMA Cybersecurity Requirements. The Defense contractor is responsible for ensuring employees perform under the terms of the contract and applicable directives, laws, and regulations and must maintain employee discipline in accordance with the contract. As per DoD regulations, DoD Components (DCMA) will hold individuals accountable for exercising proper upkeep of the Department of Defense Information Systems by ensuring they receive required training and certifications for their positions and understand their responsibilities in accordance with DoDD 8140.01, DoD 8570.01-m and DCMA training requirements.

15.1. Cybersecurity Training and IA/ Cyber Workforce Certification requirements:

Certified, Appointment and User Acknowledgement: As per, DoD 8570.01-M, “Information Assurance Workforce Improvement Program,” the Contract Program Manager (PM) and the DCMA Contractor Officer Representative (COR) are responsible for ensuring that all contract support persons have the required certification certificates, appointment orders, and specific user agreements completed prior to performing any IT or Cybersecurity function as defined in Section C of DoD 8570.01-M. The required Deliverables for this section are:

15.1.1. Deliverable – Prior to starting work in DCMA for Technical (System Admin, Developer, Engineer, PM, IA support, etc) the contract shall provide the COR and DCMA Cybersecurity with a spreadsheet of contract personnel and a tracking of completion of the items as defined in the DCMA Cyber Workforce Training Program.

Deliverable – Monthly, the Contract PM shall submit spreadsheet of contract personnel and their status as per the DCMA Cyber Workforce Training Program (see previous deliverable)

15.1.2. Proof of Certification: The certifications must be uploaded into both the DCMA specified repository (currently SharePoint) and the applicable certification must be released to the Defense Manpower Data Center (DMDC). As stated above, all contract employees shall be DOD 8570.1M certified with verification by DCMA Cybersecurity prior to starting hands on technical or IA work. All contract employees shall maintain applicable certifications as prescribed by the appropriate governing bodies for the certification and the applicable government directives and regulations.

15.1.3.The following certifications are required by contractor employees serving in the positions indicated below:

Deliverables for this section are:

Deliverable-Certifications loaded in Repository Deliverable--Certifications Released to DMDC

15.2. DCMA System Documentation: The Contractor shall submit to the PM for approval and upload Compliance Suite Professional system documentation into the DCMA Enterprise Architecture Repository as the authoritative source for documentation. The documentation shall identify specific DCMA IT system information as per the Department of Defense Architecture Framework (DoDAF), as well as the system owners, information owners, authorizing officials, program managers (PMs), IT project leads, information systems security managers (ISSMs), information systems security officers (ISSOs), network administrators, database administrators, and system administrators (SAs). Submission of documents for approval as defined in the PWS shall be submitted into DEAR and the link to the documents submitted to the defined parties would suffice to meet those deliverables and reduce email congestion in DCMA.

Documentation will include:

All relevant DoDAF Views as per the COR and Enterprise Architecture guidance

- System Interfaces

- Ports

- Protocols

- Services

- System and or/ network diagrams

- Summary of IT hardware (i.e., physical components or devices) or software (e.g., operating systems or applications) in use, as well as version information

15.2.1. Deliverables for this section. SOPS and Work Instructions shall be reviewed regularly and at a minimum validated every 6 months with change control and versioning that have signatures and dates of changes.

15.3. RMF Control Specifics: Compliance Suite Professional shall be developed, configured and deployed as per the NIST Special Publication 800-53 Revision 4 Risk Management Framework controls families: CM (Configuration Management), SI (System and Information Integrity) and System and SC (Communications Protection) controls families for the category of the specific system.

15.4. Baseline Development, Cyber Vulnerability Management: As a primary job function, the system administrators shall implement appropriate STIG(s) and vulnerability patches for applicable DCMAIT Systems. If no DoD IT-specific STIG exists, after consulting with the DCMAIT-K Information System Security Manager, will use the applicable SRG, TTP, and general topic STIG to determine compliance with DoD cybersecurity requirements. Contractor shall document deviations from STIG(s) in the system POA&M and mitigate them, as appropriate. They will test STIG(s) on noncritical DCMA IT systems, preferably in a controlled nonoperational environment. They will review the output of Secure Content Automation Protocol (SCAP)-validated tools to test systems for STIG compliance and DCMA’s secure configuration compliance. Ensure that Enterprise Management tools, Vulnerability scanners and host-based security systems (HBSSs) are installed and working on the systems under their purview. They will routinely validate STIG implementation for the systems under their purview when changes or updates are made. They will ensure DoD Component programed-managed DoD IT incorporates automated software vulnerability analysis tools throughout their life cycles and ensure remediation of software vulnerabilities. They will implement corrective actions as mandated in orders and directives on applicable owned and operated DoD IT using an automated patch management capability. Maintain capabilities that facilitate compliance monitoring of DoD IT, in accordance with USCYBERCOM orders and directives and DoD Component guidance. Draft and or provide input to POA&M’s to provide initial or current status of noncompliant DoD IT. Notifies DCMA NOSC and COR immediately of operational or technical issues precluding implementation of directed vulnerability actions for IT systems. Acknowledge receipt of a DCMA NOSC order or directive through DCMA directed reporting sites (e.g., the vulnerability management system), in accordance with DCMA guidance.

15.5. System/ Application Level Vulnerability Remediation Program: Contractor shall develop the vulnerability management remediation program for Compliance Suite Professional if not covered under the SharePoint plan. During installation and deployment, the contractor shall ensure all systems are patched and POA&Ms are approved prior to the USCYBERCOMMNAD/ DCMA directed dates. Contractor shall ensure that testing, release of patches, mitigation actions, and compliance status occurs to the DCMA standard during Compliance Suite Professional installation, testing and deployment. Contractor shall provide required IT security documentation and implementation procedures for each system as required. Contractor shall provide organizational POCs to answer questions on vulnerability management responsibilities, Compliance Suite Professional IT vulnerabilities or potential risk to the DCMA based on newly-identified IT vulnerabilities.

Configuration Management: Contractor shall abide by the DCMA IT Change Management Policy. All changes to configuration items (CI) will be tracked in the DCMA change management system. All CIs will have entries in the CMDB. All entries in the CMDB will have a designated owner and team owner. The CI owner is responsible for ensuring their CIs in the CMDB have accurate and up-to-date information. All changes will be linked to the CIs being changed. All IT Systems will have a CMDB entry and designated Service Owner (System Owner/Program Manager. The Service Owner will be accountable for ensuring emergency changes are applied to development and test environments. All contract IT staff will record time spent implementing changes in the change management system.

15.6. The contractor will designate change process POC to support the DCMA Change Manager. Change process POC will ensure to plan and coordinate all process activities, ensuring that all activities are carried out as required throughout the system lifecycle. They will attend Change Advisory Board (CAB) scheduling and managing meetings. They will working with system admins and other process managers to ensure smooth running of services. They will monitoring and reporting on process performance, identifying process improvement opportunities and work with the process owner to make improvements to the process. They will create and maintaining a change schedule and projected service outage. They will coordinate with asset, configuration management and deployment management process owners to ensure that DCMA creates and maintains a synergistic situational awareness on things that can affect system performance and user experience.

15.7. RMF Specifics: Compliance Suite Professional shall have established baselines and be protected from cyber vulnerabilities as per the NIST Special Publication 800-53 Revision 4 Risk Management Framework controls families: MA (Maintenance), SC (System and Communications Protection), SI (System and Information Integrity), PM (Program Management) , RA (Risk Assessment), CM (Configuration Management) and AU (Audit and Accountability)..

Back up/Restoration: The contractor shall document and provide to the program manager the Back-up/Restoration procedures.

16.0. Liability. The contractor shall be held responsible for any and all property damage that may occur in conjunction with performance of this PWS. This includes but is not limited to damage such as holes, scrapes, marks, stains, etc. to walls and/or ceilings, flooring (i.e., carpet, tile, wood, laminate, etc), furniture, equipment, etc. The U.S. Government or its representatives shall not be liable for any damages, either to the environment or property, as a result of the contractor’s work.

17.0. Compliance with Laws. The contractor is solely responsible for compliance with all federal, state and local laws, the Occupational, Safety and Health Act (OSHA) (Public Law 91-596) and the resulting standards, OSHA Standards 29 CFR 1910 and 1926, as applicable, and the protection of their employees. Additionally, the contractor is responsible for the safety and health of any and all subcontractor employees. The contractor shall ensure assigned personnel are adequately trained and qualified for the task being performed. All contractor and subcontractor personnel shall be briefed and training on the hazards involved with operations and applicable precautions to be taken. Should unidentified hazards arise, cease operations and immediately contact the COR. The contractor is fully responsible for performing routine and recurring surveillance of the work site and work being performed to ensure the safety of their employee’s and the safety of the work environment.

18.0. Mishap Notification. The contractor shall notify the COR within one (1) hour of all mishaps or incidents at or exceeding $500 (material + labor) in damage to DoD property entrusted by this contract. This notification requirement shall also include physiological mishaps and incidents. A written or email copy of the mishap/incident notification shall be submitted to the COR within three calendar days of the event. Mishap notifications shall contain, at a minimum, the following information:

• Contract, Contract number, name and title of the person(s) reporting

• Date, time and exact location of the accident/incident

• Brief narrative of accident/incident (events leading to accident/incident)

• Cause of accident/incident, if known

• Estimated cost of accident/incident (material and labor to repair/replace)

• Nomenclature of equipment and personnel involved in accident/incident

• Corrective actions (taken and proposed)

• Any alternate pertinent information.

The contractor shall cooperate with any and all government mishap investigations.

19.0. Post Award Conference/Periodic Progress Meetings. Progress meetings will be held by the eDRMS Project Manager and COR to apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

20.0. Contractor Travel. Contractor will be required to travel within the CONUS to the locations specified in the paragraph 6. Travel shall be approved by the contracting officer’s representative prior to commencement of travel and be in accordance with the Joint Travel Regulation, Volume 2, DoD Civilian Personnel, Appendix A, in effect at the time travel is performed. Clause 252.231-9000, Travel Authorization Requirements, applies.

21.0 Other Direct Costs. The contractor is not authorized to charge ODC related to this task without the prior written consent of the DCMA contracting officer.

22.0 Contractor Manpower Reporting. The contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for DCMA via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2013. Regardless of the actual award date, the reporting period covers performance during the FY. For example, if a contract is awarded in April of 2016, the contractor will report performance information related to direct labor hours and dollars for the period of performance from October 1, 2015 through September 30, 2016.

Attachment 1 LISTS OF ACRONYMS

image1.png image2.png