SOW Draft dated 25NOV2020.pdf

DRAFT - ACES Operations and Maintenance SOW – DRAFT For Official Use Only (FOUO)

Arms Control Enterprise System (ACES) Support Services

Statement of Work - DRAFT

25 Nov 2020

1.0 Introduction/Background/Scope

This effort is for Arms Control Enterprise System (ACES) Support Services activities required for ACES Conventional and Strategic program use by the Department of Defense (DoD), Department of State (DOS), and all ACES users throughout the United States (U.S.) arms control community to meet Conventional and Strategic treaty requirements.

ACES is a DTRA owned customized arms control treaty automation software providing equipment transaction processing, notification generation/workflow and report generation. It is an automated information system for tracking and reporting conventional and strategic arms control information and notifications as required by the following treaties and agreements:

New Strategic Arms Reduction Treaty (START), NST Conventional Armed Forces in Europe (CFE) Treaty Vienna Document 2011 Treaty on Open Skies Global Exchange of Military Information (GEMI) United Nations Transparency in Armaments (UN/TIA) Agreement Wassenaar Arrangement

The integrated solution provides timely and efficient worldwide access to users throughout the arms control community using a web interface and SECRET Internet Protocol Router Network (SIPRNet) connectivity.

The ACES application is implemented in Java and uses a range of mature components from Sun's Java 2 Enterprise Edition (J2EE). ACES utilizes a suite of proven and mature industry standard frameworks and technologies including Struts MVC framework, Enterprise Java Bean (EJB), XML, and Web Services.

The ACES application is hosted on a two-node cluster of JBoss application server. The data storage solution in ACES utilizes the latest Oracle technologies including Oracle Cluster, Data Guard, and multiple dimensions of data backup solutions. The contingency ACES system is operational at an alternate site and the data is replicated in real time utilizing Oracle Data Guard technology.

The virtual servers that host the ACES application and ACES database are Red Hat Linux (RHL) servers. ACES interfaces via XML and Web Services with third party solutions hosted on Windows platforms to provide additional capabilities such as printing treaty reports.

ACES is currently hosted on a Defense Threat Reduction Agency (DTRA) managed virtual environment located within the DTRA IT Directorate managed Server Operations Center (SOC) at DTRA Fort Belvoir, Virginia. The virtual servers that host the ACES application and ACES database are Linux servers. The ACES software is owned by the U.S. Government/DoD/DTRA. The application source code is a deliverable on the contract with updated source code to be provide after every software release.

1.1 Objectives

The objectives of this effort are to:

Provide support services in the areas of data management, configuration management, system engineering, systems/network administration, information assurance/cybersecurity, testing and other related areas in accordance with IEEE/EIA 12207.0 and 12207.1 or similar industry recognized standards.

Perform Operations & Management (O&M) activities and support for the

ACES program including, but not limited to:

24/7 end-user technical/application support Systems, network, and cybersecurity (Information Assurance tasks) administration of the system System Change Request (SCR) and System Problem Report (SPR) tracking, investigation, correction and management Software modifications, quality assurance reviews, and updated documentation as guided by the ACES Configuration Control Board (CCB) to include external program interface upgrades required to meet interface change requirements and security classification guidance and access requirement updates as directed by the U.S. Government

Non-disruptive deployment of enhancements and modifications to ACES User training and reference material on software use Planning for and executing the migration of ACES to a DoD Core Data Center

(CDC) and integration into the Joint Information Environment (JIE) Framework or migration into a similar commercially or United States Government (USG) managed cloud environment.

Treaty data exchange support: support for the creation and reproduction of draft and final versions of USG Treaty reports/documentation (both electronic and hard-copy formats) for presentation to Treaty/Agreement signatories.

2.0 Applicable Documents

DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management

DTRA/SCC-WMD Instruction 8500.4 Information Assurance Implementation

National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Overview:

http://csrc.nist.gov/groups/SMA/fisma/framework.html

DISA Security Technical Implementation Guides (STIGs) -http://iase.disa.mil/stigs/Pages/index.aspx

DISA Enterprise Mission Assurance Support Service (eMASS) -http://www.disa.mil/Cybersecurity/Certification-Accreditation/EMASS

Data Center Optimization Initiative (DCOI) -https://www.gsa.gov/portal/content/139770

DTRA INSTRUCTION 8570.1 - Defense Threat Reduction Agency (DTRA) AND U.S. Strategic Command Center for Combating Weapons of Mass Destruction (SCC-WMD) Information Assurance (IA) Workforce Training and Management Improvement Program Instruction. Originating Component: CIO;

Effective: April 14, 2011; Change 1 Effective: May 23, 2018

Department of Defense DIRECTIVE NUMBER 8140.01. Cyberspace Workforce Management. August 11, 2015 Incorporating Change 1, July 31, 2017

H1540CR.HSE - National Defense Authorization Act for Fiscal Year 2012 OMB Memorandum M-19-19, “Update to Data Center Optimization Initiative

(DCOI)

Documents listed as CDRLS in section 3.5 of this Statement of Work are all

Applicable this effort.

3.0 Tasks

The contractor shall perform the following tasks and activities:

3.1 Process and Program Management

Provide, manage and execute tailored and documented processes in accordance with IEEE/EIA 12207.0 and 12207.1. Processes will include data management, configuration management, systems engineering, risk management, verification and validation, testing, information assurance, software problem resolution, etc. Provide program management for the O&M activities of the ACES program required to support the DoD, DOS, and ACES users throughout the U.S. arms control community. Program management areas will include Systems Engineering, Test & Evaluation (T&E), Deployment & Fielding (D&F), Training, etc. Plan, manage, execute and measure activities to ensure effective performance on the program throughout the period of performance.

Support Independent Verification and Validation (IV&V) and Field Testing activities and schedules.

Provide support for ACES related applications, such as the Inspection Planning Module (IPM), Integrated Notification Application (INA) and the Automated Data System (ADS) in the areas interface testing, interoperability, and related activities.

As requested, provide analysis and recommendations regarding the impact of treaty changes, such as potential Vienna Document changes, New START Treaty changes, or modifications to the Conventional Armed Forces in Europe (CFE) treaty, on ACES processes and implementation.

Manage, maintain, execute and keep current Assessment and Authorization (A&A) status and DoD Information Technology (IT) security update requirements activities and tasks.

The Contractor shall not propose any solutions approach or course of action that will result in government ownership of any data center assets as defined in H1540CR.HSE - National Defense Authorization Act for Fiscal Year 2012 or in establishing a government data center as defined in OMB Memorandum M-16-19, “Data Center Optimization Initiative (DCOI)”. This includes any effort resulting in the procurement of a server(s), whether in a production, test, staging, development, or any other environment.

Software development efforts must identify source code as a contract deliverable and require the performer to employ standard coding best practices, including the avoidance of proprietary techniques, algorithms, or code. Performer must provide developers with security clearances commensurate with the security environment / network the work is to be done on. Installation of software deliverables within a DTRA pre-production or software lab environment is contingent upon Senior Information Security Officer (SISO) review and approval of the controls used to isolate the test or evaluation instance from DTRA's operational networks and, dependent upon the controls proposed, may require software code analysis. SISO review and acceptance of the documented source code analysis findings will however, be required prior to installation of any software deliverable on and DTRA operational network, integration with any operational system, or to support a Certificate of Networthiness issued by DTRA.

3.2 O&M Activities and Support

Provide O&M activities and support for the ACES operational environment to allow for 24/7 usage. O&M activities include, but are not limited to:

3.2.1 Network, systems administration and help desk support on an on-call 24x7/365 basis.

The help desk will gather appropriate metrics on questions and defects as well as solution turn-around time With users on across the United States and in multiple locations across

Europe and other location outside of the United States, it is imperative that on-call assistance be available for our users who may have treaty mandated deadlines to meet and require assistance.

3.2.2 System administration and management responsibilities for production, contingency of operations planning (COOP) site, and unclassified/training systems at the DTRA Fort Belvoir site and other, potentially remote, locations. System administration duties will include but not be limited to:

Creating/deleting/modifying user accounts; Resetting/Changing passwords Producing user reports to include contact information and e-mail lists Modifying user Node access/permissions Backing up the data to external media on a regular basis Backing up the complete system on a periodic basis Performing data restores as required Resolving notifications and performing back-end data modifications as required Installing Security, Operating System and various software application patches on a regular basis (often monthly and periodically to solve an urgent cybersecurity concern)

Documenting all changes to the system to keep the extensive volumes of ACES documentation current and accurate.

Communicating with users prior to any system changes that will affect system availability

General system administration support to/coordination with COOP site personnel in support of DTRA back-up site planning, testing, and execution.

Planning, management and execution of a migration of the ACES application to any future DTRA network/Cloud environments or external hosting sites [DoD Component Enterprise Data Center (CEDC)/JIE configuration or similar cloud environment].

Analysis of operational impacts and risk analysis of migrations to any alternate mission network enclaves and then to the JIE.

Assisting the DTRA ACES Program Manager (PM) with input to the development of and periodic/annual updates to the ACES plan for transition to a CEDC, alternative/different DTRA Cloud environment and/or integration into the JIE.

Provide input to the DTRA PM for quarterly updates to data center asset inventories.

Coordinating with DTRA IT Directorate DITEC (DTRA Integration, Test and Engineering Center) personnel to ensure development and testing configurations are in place to support a wide-range of local and remote ACES development tasks and ACES testing.

3.2.3 ACES Application Configuration Management responsibilities:

SCR and SPR tracking, investigation, correction and management User documentation, system documentation, and help files maintained to be consistent with current software as per section 3.5.

Analyze and produce ACES SCRs and SPRs documenting enhancements/fixes required due to interface changes in components and applications such as the Organization for Security and Cooperation in Europe’s (OSCE) ADS and INA, and DTRA's IPM. Submit the SCRs and SPRs to the ACES CCB.

Data, security, and configuration management and control of the ACES system software and components.

Anticipate system and database growth and make appropriate recommendations for configuration changes.

The ACES programming team shall introduce selected Agile methodology techniques into their processes for planning, developing, integrating and deploying new ACES code/releases.

3.2.4 Software development and deployment of enhancements/maintenance releases and patches as coordinated with the ACES CCB and directed by the ACES PM to include external program interface upgrades directed by the OSCE

CCB.

The Government estimates that two (2) maintenance releases shall be installed per contract year as the result of SCRs and SPRs which may or may not include framework enhancement changes.

The Government estimates that two (2) or more system patches shall be installed per contract year to resolve time sensitive concerns with the system.

The Government estimates one (1) major database upgrade will be required.

Due to frequent changing cybersecurity concerns and associated risk mitigation strategies, various operating system, database or other patches may be required on a monthly basis.

Testing and installing required software upgrades to systems and system components to include major operating system, database management, web server, firewall upgrades, minor patches, etc.

3.2.5 Assessment and Authorization (A&A)/Cybersecurity duties and responsibilities for production, contingency of operations planning (COOP) site, and any other instances of the ACES application at the DTRA Fort Belvoir site and other, potentially remote, locations. Information Assurance/Cybersecurity duties will include but not be limited to:

The Contractor shall identify qualified individuals to be officially appointed by the COR/ACES PM to serve as the ACES Information System Security Officer (ISSO) and the Information System Security Manager (ISSM) per DTRA/SCC-WMD Instruction 8500.4 Information Assurance Implementation or any future DoD/DISA guidance. The Contractor shall ensure that the ISSO, ISSM, and all privileged users have the appropriate technical training and certifications in accordance with DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management (and any future/similar DoD Directives)

Security and software upgrades and modifications as directed by the U.S.

Government to maintain A&A status / Authority to Operate (ATO) within the Risk Management Framework (RMF) or other DoD and/or Defense Information Systems Agency (DISA) mandated methodology/tool.

Maintain system security data in the Continuous Monitoring and Risk Scoring (CMRS) system, the Enterprise Mission Assurance Support Service (eMASS), and/or other DoD/DISA mandated information assurance applications. Complete monthly DoD information security Scorecard reports via the Enterprise Reporting System or via any similar/new reporting system/tool.

The Contractor shall ensure compliance with the DoD Security Technical Implementation Guides (STIGs) and Information Assurance Vulnerability Alerts (IAVAs) in support of achieving and maintaining ACES Authorization to Operate (ATO) at the DTRA primary and back-up sites.

The contractor shall coordinate with DTRA IT Directorate personnel to ensure all Assured Compliance Assessment Solution tool (ACAS) are completed on time and also coordinate to resolve any identified vulnerabilities. The Contractor shall ensure scan results are posted to appropriate location.

Conduct security assessment, monitoring and mitigation tasks to ensure data integrity, availability, and assurance for the system in accordance with DTRA IT infrastructure guidelines, logistics and security requirements.

The contractor shall monitor the IT Directorate managed Cybersecurity Continuous Monitoring Dashboard and provide required artifacts, information, etc. to achieve a Green status in all areas. The contractor shall work with IT personnel and the ACES COR/PM in preparing for successful reviews or audits on all Command Cyber Readiness Inspections (CCRI) or similar reviews/inspections.

The contractor shall review and provide/coordinate solutions for all applicable IA Directives (official cyber defense orders aimed at protecting DoD’s networks and information technology systems).

All IA reports, such as Plan of Action and Milestone (POA&M) reports, shall be completed as scheduled by the COR/ACES PM to allow for review. Method of surveillance will be program manager monitoring.

The Contractor shall respond as required to all DTRA IA/Cybersecurity taskers.

3.2.6 User/Data Management Support:

Formal and informal user training and telephone support on ACES software in the context of arms control treaties and agreements (training at customer sites, DTRA, or contractor site).

ACES treaty related support to DTRA Treaty Data Manager and DTRA ACES PM Team with general questions/concerns and as related to recurring treaty reporting requirements and notifications.

Treaty data exchange reporting support, quality assurance review, and final version production support (to include reproduction of final treaty documentation for CFE/VDOC in December and GEMI in April.)

3.2.7 As requested, plan for and execute the migration of ACES to a DoD CEDC and integration into the Joint Information Environment (JIE) Framework or migration into a similar commercially or United States Government (USG) managed cloud or cloud-like environment.

As requested, development and coordination of an all-encompassing

Service Level Agreement (SLA) with the Cloud provider regarding division of responsibilities for all aspects of systems/network administration, information assurance controls, after-hours support, outage planning, system access, etc.

Addressing all A&A concerns to include a new ACES ATO if necessary.

3.2.8 Transition Period Support Upon End of Contract

The Contractor shall support a 60-day transition period with the incoming contractor personnel so they can become familiar with the ACES application, servers, users, etc. As part of the transition the contractor shall develop a comprehensive Support Transition Plan (STP) covering all aspects of the ACES O&M support as it relates to all treaties and agreements supported.

The STP shall outline the location of key documentation, providing an overview of the design of ACES, describing the operational and development environments and process for migrating application releases from development to production.

In addition to covering all areas such as software code structure, software development processes, database configuration, cybersecurity concerns, systems A&A status (to include in in-depth review of the RMF controls), etc. it will also clearly identify the more complex/intricate aspects of the support. For example with several of the conventional treaties and agreements there are complex interrelationships in regards to reporting thresholds and categorization/sub-categorization of equipment. The intent is for the incumbent to clearly articulate the potential areas of confusion that a new team could experience.

3.3 Application Infrastructure Enhancements

Full integration of Data Exchange Server (DES), formerly known as the Automated Data System (ADS) functions into ACES. The migration will rewrite all DES functions into native ACES technologies, so DES becomes an integrated component of ACES.

Note: This effort is to be completed within the base year.

Move ACES Test environment to Microsoft Azure, DITEC 2.0 environment or any viable DTRA directed Cloud Service Provider (CSP).

Note: This effort is to be aligned with DTRA IT Directorate guidance.

Implementation of New Confidence and Security-Building Measures (CSBM)/Vienna Document 2011 Notification Formats (TBD, Pending DTRA/Arms Control Community guidance).

Full integration of the IPM functionality into ACES. Rewrite of all IPM functionalities into the native ACES technology (see IPM system description below):

IPM is a unique web-based automated tool designed solely for DTRA to provide the critical capabilities necessary to comply with congressionally mandated international arms control treaties/agreements and to support United States Government (USG) policies and practices. IPM was developed to compile and manage operational team information, initiate and support mission planning, and execute required treaty notifications to enable the USG to execute its full on-site inspection and escort treaty rights and obligations. Current treaties supported by IPM include:

Conventional Armed Forces in Europe (CFE) Treaty New Strategic Arms Reduction Treaty (NST) Open Skies (OS) Treaty

IPM provides authorized users with the appropriate permissions the ability to:

Manage data regarding personnel assets Manage training course attendance; track training requirements Manage data regarding passports and visas, including the status of applications Draft treaty notifications for import into the Arms Control Enterprise System

(ACES)

Plan treaty-related inspection and escort requirements

IPM contains Privacy Act Information and is a registered system of record under the Privacy Act of 1974

3.4 Other Requirements

3.4.1 Contractor Acquired Property

As approved by the PM, the Contractor shall purchase materials to satisfy operations and maintenance requirements. Such material may include license and maintenance agreements or support activities by other vendors. All materials purchased by the Contractor for the use or ownership of the Federal Government will become the property of the Federal Government. In the monthly progress report, the Contractor shall document expenses and the transfer of materials or any licenses or agreements. The Contractor must furnish evidence of having obtained three competitive quotes for like items prior to any purchases. In some instances, materials may be available from Government supply sources, including General Services Administration (GSA) schedules. When applicable, the Government will provide the Contractor authorization to use Government supply sources in accordance with FAR 51.101. Any hardware or software purchases will follow the provisions of the FY 2012 National Defense Authorization Act (NDAA 2012). The NDAA 2012 prohibits programs from obligating funds for a data center, or any information systems hardware and software used therein or specifically for the operation and administration of a data center, without explicit approval from the DoD Chief Information Officer (CIO). The contractor shall assist the PM in developing the requisite documentation to obtain both DTRA and DoD CIO approval.

3.4.2 Process Execution

The government desires that the performing business unit be certified at Capability Maturity Model Integrated (CMMI) level 3, as a minimum.

3.4.3 Fielding Activities

Support IV&V, deployment and training activities and schedules.

3.4.3 Required Training

In addition to training required per DoD and DTRA Directive(s)/Instructions by certain personnel in various cybersecurity/A&S positions, all contract personnel with access to any DTRA/DISA networks will be required to complete various initial and refresher training courses as directed by DTRA and outlined below. The contactors will use the Learning Management System (LMS) to register, track and enroll/complete the courses.

Some courses may be offered in-person only but will local at DTRA/Fort Belvoir.

The five courses/topics below will be assigned to contractors in LMS.

1. Antiterrorism Level I (Initial and Refresher) - Initial Classroom requirement due 90 days from assignment and the online refresher due every year thereafter (365 days after initial classroom completion, and then 365 days after each completion of the refresher)

2. Information Security (INFOSEC) (Initial and Refresher) - Initial Classroom requirement due 90 days from assignment and the online refresher due every year thereafter

(365 days after initial classroom completion, and then 365 days after each completion of the refresher)

3. Operations Security (OPSEC) (Initial and Refresher) - Initial Classroom requirement due 90 days from assignment and the online refresher due every year thereafter (365 days after initial classroom completion, and then 365 days after each completion of the refresher)

4. Cyber Awareness Challenge - Online training due 90 days from assignment and every year thereafter (365 days after completion)

5. SCI Annual Refresher - Online training due 60 days from assignment and every year thereafter (365 days after completion) for TS/SCI personnel (Level 6 Badge holders)

In all cases the initial due date only applies for those who have not yet met the initial training requirement. If the initial requirement has already been met, the due date is set to 365 days from their last completion.

3.5 Deliverables

The contractor shall provide the deliverables outlined below.

3.5.1 ACES O&M Monthly Performance and Cost Report (A018)

Performance Data:

The Contractor shall provide a summary of activities accomplished during the reporting period, status of ongoing actions, and projected activities for the next reporting period (meetings, travel, etc.).

Planning Data:

The Contractor shall provide a summary of planned activities within a twelve-month window to include such activities as:

H/W & S/W updates / patches / releases (description and expected dates) Planned Outages Purchases – Planned Training, Planned Documentation updates, other planned activities e.g., meetings, CCBs, working groups, etc.

Cost Data:

The Contractor shall provide a monthly cost report in the following format:

1. Incurred costs, cumulative costs, status of funds, purchase of materials, etc.

2. Number of hours worked, hourly rate, and overall cost for each individual performing work on the contract

3. Number of hours for individuals should be further broken down by activity – o Requirements Analysis o Development o Testing/Verification and Validation o Work on specific Contract Data Requirements List (CDRLs) o Other categories as appropriate

Risk Data:

The Contractor shall provide a listing of all program risks for all areas of the program to in include technical, mechanical, security, resources, etc. Each risk shall contain a recommended mitigation strategy and timeline.

3.5.2 Monthly Usage Report (A019)

The Contractor shall provide a monthly report of the following user information:

The total number of requests for assistance (help desk support) categorized by manner in which received (phone to DTRA provided cell phone, call to contractor team, E-mail, customer on-line submission (via a program portal), other means (in-person), etc.) The information for each request shall include the name of the person who submitted the request, their organization, the category of their issue – training need, network concern, security concern, the application/component involved (CFE, VDOC, OS, GEMI, START, Sys Admin, etc.), time of day received (business hours 0600 – 1800, or after hours), version/mode of application (live/test/training & production system or unclass system), approximate time until initial response to the requestor, status (resolved/unresolved), and approximate time taken to resolve or estimated time to resolve as applicable.

The total number of SPRs and SCRs received during the period, the number closed, and the number remaining open with their severity and expected resolution date or the release/patch recommended to be included in. All SCRs/SPRs shall include the office who submitted, the system mode, and the application/treaty area.

3.5.3 Technical and User Documentation Deliverables

The intent of the O&M technical and user documentation effort (specific deliverables detailed in the table below) is to update as necessary and maintain the documentation to be consistent with the current level of the released software. Note, several of the documents are very technically detailed and lengthy, the requirement is to keep all documentation current as various software releases that may impact the documentation.

The contractor shall provide electronic versions of each CDRL specified in the following table, using the appropriate format as approved by the Program Manager.

As documents are posted to the portal, an e-mail shall be sent to the program manager notifying him of that posting and including a copy of the document.

CDRL Product Title Delivery A001 ACES System Requirements Specification

(SyRS) /Software Requirements Specification

(SRS)

Document reviewed and updated to be consistent with the current software version

The SyRS must document the overall system structure, list the requirements for system capabilities, conditions, and constraints, and describe the system interfaces and the system interface requirements for ACES The SRS must document the baseline software requirements and their allocation to developmental software configuration items for use in the design, development, deployment, operations and maintenance, and support of ACES.

Posted to the portal within 30 days of each interim release

A002 ACES Operational Concept Description Document reviewed and updated to be consistent with the current software version

The ACES Operational Concept Description must document the ACES operational scenarios at a high level.

Posted to the portal within 30 days of each interim release

A003 ACES System Architecture Requirements Allocation Description (SARAD)

Document reviewed and updated to be consistent with the current software version

The SARAD must document must describe the system architecture of ACES and allocate system requirements to architectural components.

Posted to the portal within 30 days of each interim release

A004 ACES Database Design Description (DDD) Document reviewed and updated to be consistent with the current software version

The DDD must document the design of the database component of ACES.

Posted to the portal within 30 days of each interim release

A005 ACES Interface Design Description (IDD) Document reviewed and updated to be consistent with the current software version

The IDD must describe the external interface characteristics of ACES to include but not be limited to the Inspection Planning Module, Navy SPARTANS, and OSCE INA.

Posted to the portal within 30 days of each interim release

A006 ACES Software Design Description (SDD) Document reviewed and updated to be consistent with the current software version

Posted to the portal within 30 days of contract award and

The SDD must define and describe the software design for ACES.

within 30 days of each interim release

A007 ACES System/Software Test Plan The System/Software Test Plan must document the testing approach to be used to assure the quality of ACES. It should describe approach to assure complete coverage, defect tracking, and regular reporting

Posted to the portal 30 days prior to the interim release delivery

A008 ACES System/Software Test Procedures The System/Software test procedures must document the tools and processes used during each phase of ACES testing.

Posted to the portal 30 days prior to interim release delivery

A009 ACES System/Software Test Report The System/Software Test Report must document, on a regular basis, the testing to be performed and the test results, to include tests to be executed, successful tests, failures, and opened and closed defects

Posted to the portal within 5 days of each interim release

A010 ACES Version Description Document (VDD) Document reviewed and updated to be consistent with the current software version

The VDD must document the content of the associated release to include system enhancements as well as defect corrections.

Posted to the portal 30 days prior to the delivery

A011 ACES System Administrator Manual Document reviewed and updated to be consistent with the current software version

The System Administrators Manual must document the procedures for administering ACES application, to include system hardware and software configuration and operation, security, high availability, database maintenance, and user account management.

Posted to the portal within 30 days of each interim release

A012 ACES Integrated Management Plan (IMP) Document reviewed and updated to reflect current development activities.

The IMP must define the project management activities that will be accomplished in the operations and maintenance of ACES to include both project and technical management approaches.

Posted to the portal within 60 days of contract award.

A013 ACES Quality Assurance Plan (QAP) Document reviewed and updated to be consistent with the current software version Conduct process and product audits throughout the program in accordance with the plan.

The QAP must define the quality assurance activities that will be accomplished in conjunction with the ACES O&M Program to include testing, problem reporting, and analysis.

Posted to the portal within 30 days of contract award.

A014 ACES Configuration Management Plan (CMP) Document reviewed and updated. Manage configuration items throughout the program in accordance with the plan.

The CMP must define configuration management standards and responsibilities for ACES including the technical and administrative methods employed in the project for implementing, tracking, and controlling work products.

Posted to the portal within 30 days of contract award.

A015 ACES Systems Engineering Management Plan

(SEMP)

Document reviewed and updated to be consistent with the current software version.

The SEMP must define the system engineering plans and methods for developing and maintaining the ACES Program’s engineering products.

Posted to the portal within 30 days of contract award.

A016 ACES Operations & Maintenance (O&M) Plan Document reviewed and updated to be consistent with the current software version.

The O&M Plan must document the activities and entities involved in operations and maintenance of ACES to include administration and account management, change management, and maintenance.

Posted to the portal within 30 days of contract award.

A017 ACES System Security Plan (SSP) Document reviewed and updated for the prior System Security Authorization Agreement (SSAA) Document format. Support the implementation and test of security features in accordance with the security requirements established in the SyRS.

The SSAA must document DoD Risk Management Framework (RMF) Process supporting security Assessment and Authorization (A&A) of ACES.

Posted to the portal within 30 days of contract award and updated, if necessary, within 30 days of each interim release.

A018 ACES O&M Monthly Performance and Cost Report

Document the activities accomplished during the reporting period, status of ongoing actions, projected activities for the next reporting period, incurred costs, cumulative costs, status of funds, purchase of materials, transfer of materials to the Government, cost and technical status including earned value reporting, planning information, status of on-going concerns and any other issues/concerns for ACES, as well as any other pertinent information at a level designated by DTRA as described in SOW section 5.1.1.

Delivered to PM monthly by the tenth business day of the next month.

A019 ACES User Report Prepare and deliver a report of the user information as described in SOW section 5.1.2.

Delivered to PM monthly by the tenth business day of the next month.

A020 ACES Source Code Provide Source Code after each interim release.

Delivered to PM within 30 days of each interim release

A021 ACES Help Content and User Manual Material reviewed and updated to be consistent with the current software version.

The Help Content must provide user guidance, available within the ACES application, on the use of the system. The User Manual must provide written documentation in the use of the ACES system.

Help updated in system and user manual posted to the portal at the time of each interim release

A022 ACES Continuity of Operations Plan (COOP) Document reviewed and updated.

The COOP must document the overall ACES availability and recovery strategy, discuss COOP policies and procedures, and provide instructions for system failover and restoration of service.

Posted to the portal within 30 days of contract award.

A023 ACES Bi-Weekly Open System Change Request (SCR)/System Problem Report (SPR)

Lists new SCRs/SPRs.

Emailed to the PM and designated PM Team Members by COB every other Monday for the previous two week period.

A024 ACES Quarterly Updates to Data Center Asset Inventories and Annual Data Center Consolidation Plan Update/POA&M (for all DTRA Data Centers with ACES hardware/software – includes contractor sites

Emailed to the PM by the 7th of January, May, August, and November of each calendar year.

Plan due by 7 Aug.

A025 ACES Monthly Government Property List

(MPGL)

Emailed to the PM monthly by the tenth business day of the next month

A026 ACES Annual Inventory Conducted annually with the Government PM 30 days after option execution/modification

A027 Support Transition Plan (to complement a 60 day transition plan to a potential new performer)

Emailed to the PM 180 days prior to contract end date.

The contractor shall deliver all products for review and acceptance by the Government;

the government will have ten (10) business days to conduct its review of completed products. On receipt of comments, the contractor shall have ten (10) business days to prepare revisions and to submit and post final versions of the products.

3.6 Key Personnel

The following position is considered key personnel.

Program Manager – Experience managing mid-size software development and operations and maintenance efforts. Knowledge of the conventional and strategic arms control treaties and agreements supported and of the ACES framework and tools.

3.6.1 Other Personnel

The following positions are not considered key personnel but shall meet the stated qualifications.

Subject Matter Expert – Extensive knowledge of the ACES application and how it supports the various treaties and agreements. Extensive knowledge of the conventional and strategic treaties and agreements and a solid understanding of the roles, responsibilities and organizational structure of our customers.

Senior Applications Developer – Extensive knowledge of the ACES programming frameworks and tools to include Java, JBoss, Struts/Springs MVC framework, Enterprise Java Bean (EJB), XML, and Web Services.

Senior Systems Administrator – Extensive experience with both Windows based operating systems and Microsoft Exchange email.

3.7 Travel

Contractor shall provide a detailed estimate of any required travel:

All Contractor CONUS travel shall be in accordance with the General Service Administration, Federal Travel Regulations. All travel shall be approved by the Contracting Officer Representative (COR) in writing via memorandum or email prior to the Contractor incurring any travel expensive prior to any departure.

Short-notice trips shall be approved verbally, with e-mail follow-up immediately thereafter. Contractor shall be required to travel to multiple locations throughout the National Capital Region (NCR), Continental United States (CONUS) and Outside of Continental United States (OCONUS) during the performance of this contract. All travel shall be reimbursed at cost with no fee.

Travel shall include two (2) customer site trips to various military sites in

Germany per year (any travel between sites will be via land – either government provided rental or contractor rented vehicle). Military sites visited would likely be EUCOM Headquarters (Stuttgart), USAREUR HQ (Wiesbaden), and USAFE HQ (Ramstein). Germany trips will be for four nights in Germany with a day each of travel to and from. Both Germany trips would be for (2) two people.

3.8 Security Requirements

DoD Contract Security Classification Specifications Requirements DD Form 254:

Contractor personnel performing work under this contract must be U.S. citizens and require a minimum of a DoD Secret Clearance at the time of the proposal submission, and shall maintain the level of security required in order to provide the required support.

3.9 Place of Performance

The place of performance will be at the contractor facility and periodically at the Defense Threat Reduction Center (DTRC) on Fort Belvoir. When on-site at DTRC, there will be two cubicle workstations in OB Directorate allocated for ACES contractor personnel working on this contract. Occasionally, work may also be performed at the DTRA Dulles Airport office location and/or at the ACES COOP site (this may be a DTRA site in the short-term and could be a DISA site in the longer term).

The contractor shall not work on federal holidays unless there is a time sensitive system issue or user help request that needs to be addressed on the holiday to facilitate mission success.

3.10 Section 508

This service Contract does not have Section 508 requirements due to the nature of the military mission it supports.

3.11 Government Furnished Property and/or Equipment (GFP/GFE)

There will be some GFP transferred from the current contract. This equipment is primarily at the contractor site as part of their lab environment. There will be two DTRA/OB-IS suite cubes allocated to team members on this contract. The two cubes will have UNET, SNET and VoIP phone capability. Additionally, three to four (estimated) dedicated DTRA notebook computers will be provided to the PM and a few others for remote access to DTRA UNET capabilities.