Attachment_4_-_TO_0001_Performance_Work_Statement_(22_May_2015).pdf

SP3300-15-R-5007

Amendment 0001

Revised 5/22/2015

Attachment 4 – Task Order 0001 Performance Work Statement

Performance Work Statement (PWS)

DLA Distribution System Support (DSS)

Multiple Defense Logistics Agency Sites

TABLE OF CONTENTS:

A. The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency that provides worldwide logistics support for the missions of the Military Departments and the

Unified Combatant Commands under conditions of peace and war.

B. In support of DLA’s mission, DSS Portfolio Management is a support organization providing a single, unified material distribution system for DoD under DLA management. DSS Portfolio

Management currently has responsibility for developing and maintaining standard systems to support

DLA and DoD Distribution. Services for the development of the DLA Distribution Support Systems are supported by DSS Portfolio Management and have been developed and maintained in accordance with DLA J6 directives.

C. Information Technology (IT) Services performed at DSS Portfolio Management consist of the following Sections that should be read as a single interrelated document:

Section1, General Conditions and Requirements

Section 2, Definitions and Acronyms

Section 3, Resource Requirements and Specific Tasks

Section 4, Applicable Directives, Publications, Instructions, Forms and Reports

Section 5, Technical Exhibits (TEs)

Throughout the contract, the term “Contractor” includes subcontractors.

1.0 GENERAL CONDITIONS AND REQUIREMENTS

This Section provides general information relating to the conditions of operation and general requirements relating to the IT support services performed at DSS Portfolio.

1.1 SCOPE OF WORK

A. The Contractor shall provide IT support services as set forth in this contract. The Contractor shall provide all management, personnel, supervision, and services to complete the requirements detailed in the PWS.

Revised 5/22/2015

B. The primary mission of DSS Portfolio Management is to provide Software Engineering system support in the development and maintenance of the DLA Distribution Support Systems.

C. This is a non-personal services contract to provide information technology support services. The

Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the

Contractor who, in turn, is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the

Contractor. The Government may provide technical direction which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the

Contractor to perform the service requirements set forth in the PWS.

1.2 GENERAL OPERATING CONDITIONS

1.2.1 CONTRACT STRUCTURE

A. The Government intends to award a Task Order from the DSS Support Indefinite Delivery Indefinite

Quantity (IDIQ) contract. This PWS provides the scope of the work and the tasks that the Contractor shall be required to perform.

B. This task order will be firm fixed price for the support services and cost reimbursable for other direct costs (ODCs) and travel. A firm fixed price task order will be awarded only after the awardee has provided an offer in response to a Task Order RFP that states that “the Government intends to award a Firm Fixed Price task order resulting from this Task Order RFP.”

1.2.2 INTERACTIONS WITH OTHER GOVERNMENT ORGANIZATIONS

The Contractor’s primary interaction with the Government shall be through the Contracting Officer’s

Representative (COR). The COR will be located in Ogden, UT. The COR will perform all COR functions and perform quality assurance evaluations of the Contractor’s performance. The Contractor shall interface with and support key personnel (including other Contractors, subcontractors and vendors) and other customers as needed to accomplish the contract requirements.

1.2.3 SAFETY AND HEALTH

The Contractor shall comply with the installations written safety and health program along with industry standards for safety and health.

1.2.4 FEDERAL HOLIDAYS

A. Federal holidays generally observed by government personnel include:

Revised 5/22/2015

Observed Federal Holidays

New Year’s Day Martin Luther King Day

Presidents Day Memorial Day

Independence Day Labor Day

Columbus Day Veterans Day

Thanksgiving Day Christmas Day

B. In the event an Executive Order issued by the President of the United States declares Agencies of the

Federal Government closed for a regularly scheduled workday, the COR will determine and advise the Contractor on whether services are required for that day.

1.2.5 DLA PERFORMANCE LOCATIONS

A. Work under this PWS is anticipated to be performed at the following two (2) locations within the

DLA organization listed below.

1. Hill Air Force Base (AFB), Ogden, Utah

2. DLA Distribution, New Cumberland, Pennsylvania

B. The DLA requires DSS support at both New Cumberland, PA and Ogden, UT sites. The Government estimates it can accommodate up to forty five (45) Contractor personnel at each of the primary sites:

New Cumberland, PA and Ogden, UT.

1.2.6 CURRENT DUTY HOURS AND ACCESS TO THE HOST INSTALLATION

A. Due to changing traffic requirements brought on by construction, changing missions, and security concerns within the host installation, access to the host installation is subject to change, sometimes with little or no warning. Inbound and outbound traffic restrictions exist.

B. The Contractor shall provide services under this PWS between the hours of 6:00 AM to 5:30 PM

Monday through Friday, except Federal holidays. The government maintains core hours between 9:00

AM – 11:00 AM and 12:30 PM – 2:30 PM. The Contractor shall staff appropriately to ensure that the increase of issues that occur during this timeframe are addressed and to support necessary knowledge

Revised 5/22/2015 exchange. Work outside of these time periods may also be required for Contractor personnel on an infrequent basis for reasons related to emergency services, etc.

C. The Contractor shall input hours and tasks worked daily into the Employee Activity Guide for Labor

Entry (EAGLE) Time & Task reporting system. The EAGLE Software tool is only for project tracking. The purpose of Eagle project tracking is so the Government knows what hours are expended by Contractor employees on specific ongoing DSS projects.

1.2.7 TRAVEL

Contractors shall be required to travel periodically throughout the year. All travel must be approved by the Contracting Officer (KO) or COR prior to the Contractor making travel arrangements. All travel charges will be in accordance with the Joint Travel Regulations (JTR). Receipts for all travel expenses excluding food shall be provided to the COR when travel vouchers are submitted. Additionally, detail in regards to estimates and Government projected needs for Contractor travel may be further defined in individual task orders.

1.3 SECURITY

A. All personnel employed by the Contractor in the performance of this contract, or any representative of the Contractor entering a U.S. Government installation, shall abide by all security regulations and policies of the installation including access badges, parking, access to controlled or restricted areas, classified information, controlled unclassified information, data and IT resources.

B. DLA reserves the right to direct the removal of an employee, whose actions, while assigned to this contract, clearly conflict with the interests of the Government, regardless of prior clearance or adjudication status. DLA also reserves the right to direct the removal of an employee for misconduct, security violations, or performance reasons. The reason for removal shall be fully documented in writing by the Contracting Officer. When and if such removal occurs, the contractor shall assign qualified personnel to any vacancy(s) thus created within 10 working days. This action does not relieve the contractor from total performance of the contract tasks specified herein.

C. Contractor shall return all government issued identification, access badges, and vehicle passes to

Program Managers upon termination of service.

D. The provisions outlined above apply to the prime contractor and any subcontractors the prime contractor may employ during the course of this contract. No contractor personnel performing sensitive duties shall be allowed to commence work on this effort until his or her trustworthiness has been favorably adjudicated.

E. To ensure that all employees know and understand regulations and policy pertaining to physical, information, operations and personnel security, the contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements and as deemed appropriate by the KO or designee. At a minimum, security training requirements as required by the

DLA Instructions and other applicable DOD guidance will be completed annually for;

Antiterrorism/Force Protection (AT/FP), Operations Security (OPSEC), Counterintelligence, and

Revised 5/22/2015

Information Security (INFOSEC) and Combating Trafficking in Persons (CTIP). Training shall be provided to the contractor by the KO or designee upon request. Additional, detail about the training requirements is listed in the attachment, (Annual Security Training).

F. A record of training for each employee will be kept on file by the contractor and made available to the

KO or designee when requested. Records shall be retained for at least one review cycle or as designated by the KO or designee.

1.3.1 REPORTING OF CRIMINAL VIOLATIONS

The Contractor shall report to the KO or designee any suspected, alleged, or actual criminal incidents

IAW DLAI 5105, Reporting of Criminal Incidents.

1.3.2 VISITOR CONTROL

A. Authorized visitors to the Contractor shall obtain approval from the host Law Enforcement and

Security Office for entrance to the host installation. The Contractor shall submit a DLA Form 1818, “Visitor Request Form” or equivalent to the KO or designee at least one (1) week in advance for all planned off-base visitors and at least 24 hours in advance for all unscheduled visitors.

B. The Contractor shall develop specific procedures for identification (ID) and control of all visitors to warehousing and administrative areas and submit to the KO or designee for acceptance. The

Contractor’s procedures shall include the following:

1. Positive methods of establishing the authority for admission of visitors, as well as any limitations concerning access.

2. Positive identification of all visitors by means of personal recognition, visitor security badge, visitor permit, or other identifying credentials. The Contractor shall contact the employee, supervisor, or officer in charge to ascertain the validity of the visit.

3. Using the DLA Form 584 “Visitor Register” or Contractor equivalent form to provide a record of the identity of the visitor, the time and the duration of the visit, and other pertinent control data.

The Contractor may use an automated system instead of the DLA Form 584 provided the system records, at a minimum, the same data included on the DLA Form 584. The Contractor shall establish procedures for recovering any visitor security badges, visitor permits, or other identifying credentials at the completion of the visit.

C. Foreign Visits. The Contractor shall not allow visits from foreign nationals to the distribution center without the written approval from the KO or designee. A foreign national is defined as a person who is not a citizen or national of the United States. If approval is obtained, the Contractor shall follow the instructions for coordinating the visit IAW DLAI 4303, Foreign Visits and Disclosure Program.

1.3.3 PERSONNEL CLEARANCE

A. The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 August 2004 has established criteria for contractors who require a Common Access Card (CAC) for either physical access to a

Revised 5/22/2015

U.S. Government controlled installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and/or are eligible for a public trust or sensitive position. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary information technology access pending final adjudication of the PSI. (See Contractor Investigative

Requirements in the Technical Library). The required investigation for contractors in a position of trust requiring IT II access is a National Agency Check with Law and Credit (NACLC) or equivalent.

If the employee is placed in a position with a higher level of trust, a different level of investigation will apply.

B. The Contractor shall follow the following procedures for obtaining a NACI:

1. Each Contractor employee shall complete a SF 86, Questionnaire for Non-Sensitive Positions, using the Electronic Questionnaire for National Security Positions (e-QIP) located on the Office of Personnel Management (OPM) website, http://www.opm.gov/e-qip/.

2. The Contractor shall submit a hardcopy of the form with the employee’s original signature/date and two fingerprint cards (FBI Form FD 258) to the KO or designee who will forward them to the

DLA Intelligence New Cumberland Security Office.

3. The SF 85 and fingerprint cards are submitted with the Contractor Investigative Request (CIR) annotating the appropriate designation and a DD Form 2875 (see paragraph 1.3.5, Information

System Security).

C. For access to classified information or material, the Contractor will possess the appropriate Facility

Clearance and will be required to provide appropriate background investigation for all personnel requiring access to classified information or material. The Site Managersand any Contractor employees who will have access to classified information or material shall have the appropriate favorably adjudicated background investigation and/or security clearance as required by DoD

5220.22-R, Industrial Security Regulation, Chapter 2, Clearance Procedures, paragraph C-2.3.2, Security Clearances for Personnel; and DoD 5200.22-M, NISPOM, Chapter 2, Security Clearances, prior to full performance of contract requirements and/or handling classified information/material.

Further information about obtaining a Facility Clearance is available at the Defense Security Service website (http://www.dss.mil/isp/fac_clear/fac_clear_check.html). The contractor must possess a

Facility Clearance to process its employees for Personnel Security Clearances.

D. All Contractor employees issued a security clearance under this contract shall complete a SF 312

“Nondisclosure Agreement” and DLA Form 1834 “DLA Security Brief/Debrief Certificate” and receive a briefing from the Contractor Facility Security Officer (FSO) or designee prior to starting work on the contract and/or handling classified information/material. The Contractor shall direct any employee having a security clearance who ends employment with the Contractor to the FSO or designee to receive a debriefing and sign the DLA Form 1834. A copy of all briefing and/or debriefing forms for contractor employees will be provided to the KO or designee.

E. Not later than 5 calendar days after the contract phase-in start date, the Contractor shall provide the

KO or designee a roster of all key personnel, to include those requiring access to restricted or controlled access areas. The roster shall include each employee’s full name, Social Security number, Revised 5/22/2015 identification card number (if assigned), branch or section (if applicable), and security clearance

(level of clearance and last investigation date, if applicable). The Contractor shall provide additions to rosters and an updated roster to the KO or designee at least five working days prior to the date of required access. The Contractor shall make all modifications to the rosters and provide an update to the KO or designee within 12 hours for employees whose employment has been terminated and for employees who no longer require access to restricted or controlled access areas.

1.3.4 DOD COMMON ACCESS CARD (CAC)/ACCESS IDENTIFICATION BADGE (ID

BADGE)/ELECTRONIC KEY CARD

A. Every Contractor employee shall obtain and possess a DoD Common Access Card (CAC) and an

Access ID Badge as required. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary Automated Information System

(AIS) access pending final adjudication of the PSI, the Contractor shall submit to the KO a request for the DoD CAC and ID Badge.

B. The Contractor shall safeguard CAC and ID Badges furnished to them. Contractor employees shall not share CAC and ID Badges. Each Contractor employee shall wear the ID Badge conspicuously on his or her outer clothing above the waist at all times while working on the installation. Personnel may be challenged and removed from the work area or denied access to the host installation if the ID

Badge is not worn.

C. In the event that a Contractor employee damages or loses his or her CAC and ID Badge, the

Contractor shall report the lost or damaged CAC and ID Badge within two (2) working hours of damage or loss to the KO or COR who will arrange for a replacement CAC or ID Badge. The

Government will issue the Contractor employee a temporary ID Badge to be used for an eight to ten

(8-10) working day waiting period until a new permanent ID Badge is issued. The Contractor shall return all government-furnished CAC or ID Badges to the Government either within one (1) working day of the completion of the contract or upon termination of an individual’s employment, whichever comes first. Contractor personnel failing to return their Government CAC or ID Badge are subject to criminal charges under USC Title 18, Chapter 1, Section 499 and 701.

D. The KO or COR will provide and maintain electronic key cards for the security access system. The electronic key card allows access to specific controlled areas of the facilities. The KO or COR will approve and provide the electronic key cards to the Contractor for access to the facilities.

1.3.5 INFORMATION SYSTEM SECURITY

A. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary AIS access pending final adjudication, but not less than thirty (30) calendar days prior to the full performance commencing employee’s start date, the Contractor shall request Information Technology (IT) eligibility for an employee requiring access and passwords to the government-furnished data systems. All positions involving computer activities require a minimum IT III category eligibility. The Contractor shall submit a Contractor Investigative Request

(CIR) and a DD Form 2875 for temporary IT III eligibility, with final eligibility contingent upon receiving a favorably adjudicated background investigation.

Revised 5/22/2015

B. All Contractor personnel provided with access to government-furnished computers and systems shall observe local AIS security policies and procedures as provided by the KO or COR. The Contractor shall notify the KO or COR within 12 hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to government systems.

C. The Contractor shall observe all copyright agreements. In the interest of protecting Government systems from computer viruses, the Contractor shall not use public domain software nor shall

Contractor personnel download software from public bulletin boards or Internet websites. The

Contractor shall use only commercial off-the-shelf (COTS), Contractor-developed, or Government-furnished software in performance of the contract requirements. Should the introduction of a computer virus or malicious destruction of computer software, stored information, or hardware result from the use of public domain software or from software taken from a public bulletin board or

Internet website, the Contractor shall be required to repair the damage and incur all costs at no expense to the Government and without impact on delivery schedules.

1.3.6 VEHICLE REGISTRATION

A. The Contractor shall ensure that Contractor employee vehicles to be driven on the New Cumberland, PA host installation, to include motorcycles, are registered with the host installation security office and are in conformance with local regulations in effect at the time of registration and as long as employed by the Contractor. The Government will not permit access to the host installation without proper vehicle identification and registration. Evidence of a valid driver’s license, vehicle registration card, and insurance are required for registration. Contractor employees shall maintain current registration and proof of insurance on all privately-owned vehicles (POVs) brought on host installation.

B. To gain access to the Ogden, UT host installation, Contractor employees shall present their CAC or

ID Badge at the point of access. The Government will not permit access to the host installation without proper identification.

C. Specific information for vehicle registration at Battle Creek Michigan and other DLA sites will be defined in individual task orders.

1.3.7 PARKING AND TRAFFIC CONTROL

A. The Contractor and its employees shall abide by host installation parking regulations. All vehicles shall be parked in designated parking areas only. The Contractor and its employees shall conform to

Federal, State and host installation driving regulations.

Revised 5/22/2015

1.3.8 CONTACT OF A SUSPICIOUS NATURE

A. Contractor personnel who have been contacted under suspicious circumstances shall report that contact immediately, either verbally or in writing, to their supervisor who shall report it within two

(2) hours to the KO or designee for action. Key contacts for reporting purposes are defined as:

1. Contact with an individual (regardless of nationality) that suggests to the Contractor employee that an intelligence gathering or terrorist organization may have targeted him or her for possible intelligence exploitation.

2. A request by anyone (regardless of nationality) for illegal or unauthorized access to classified or unclassified sensitive information.

3. Contact with a known or suspected intelligence officer from any country.

4. Contact with a foreign diplomatic establishment, whether in the U.S. or abroad, for personal or official reasons. Certain Contractor personnel in positions designated as “sensitive” by the

Government may also be required to inform their chain of command in advance of the nature and reason for contacting a foreign diplomatic establishment or travel to countries on the State

Department list whose interests may be adverse to the United States.

B. Additionally, Contractor personnel who have information about activities pertaining to espionage, terrorism, unauthorized technology transfer, sabotage, sedition, subversion, spying, treason, unauthorized release of classified or unclassified controlled information, or unauthorized intrusions into automated information systems shall report that information to the KO or designee for action.

1.3.9 SAFEGUARDING INFORMATION

A. The Contractor shall not allow access or disclosure of classified information to any government agency, non-government agency, or individual unless specifically authorized by the KO or designee.

The Contractor shall provide documents and files requested by such parties to the KO or designee within one (1) hour of receipt of the authorized request. All files are the property of the Government and the Contractor shall turn all files over to the KO or designee and shall maintain no copies or drafts at the completion or termination of this contract.

B. The Contractor may be required to access data and information that is proprietary to a government agency or contractor or that is of such nature that its dissemination and use other than as specified in this contract would be adverse to the interests of the Government or others. The Contractor and its personnel shall not divulge or release data or information developed or obtained under performance of this contract except to government personnel who are authorized to receive the information or upon written approval of the KO or designee. The Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend other than as specified in this contract.

C. Disclosure of information or failure to safeguard any classified information that may come into the

Contractor’s control in connection with work under this contract, may subject the Contractor, its agent, or its employees to criminal liability under USC Title 18, Crimes and Criminal Procedure, Part

I, Crimes, Chapter 37, Espionage and Censorship, Sections 793, Gathering, Transmitting or Losing

Defense Information, and Section 798, Disclosure of Classified Information.

Revised 5/22/2015

1.3.10 POTENTIAL OPERATIONAL CONSTRAINTS

Force Protection Conditions (FPCONs) may affect access to the host installations and DLA facilities.

The FPCON is established by the host installation or higher national command authorities, and the

Installation Commander is responsible for implementing the proper response to progressive levels of terrorist threats. FPCONs are normally displayed at most entrance gates, building entrances and office entrances. The Contractor shall adhere to and operate IAW any restrictions imposed as a result of a

FPCON. Measures implemented under the various levels of terrorist threat may impact the Contractor’s normal operational approach to IT support services. The Contractor shall ensure that IT support services are sustained during heightened security measures.

1.3.11 PREPAREDNESS EXERCISES

A. As directed by the KO or COR, the Contractor shall participate in preparedness exercises relating to security disaster preparedness and response, wartime response, and emergency and environmental and similar preparedness exercises.

B. The Contractor shall participate in emergency and recall notification and personnel accountability exercises. The Contractor shall establish emergency notification and recall and personnel accountability procedures in accordance with DoDI 3001.02, Personnel Accountability in

Conjunction with Natural or Manmade Disasters, and test those procedures twice a year when directed by the KO or COR. During the exercise, the Contractor shall determine the status and whereabouts of assigned personnel, report the status of each Contractor employee to the KO or COR within established timelines, and continue to report periodic status until further direction by the KO or

COR. The Contractor shall follow their personnel accountability procedures in the event of a real emergency as directed by the KO or COR.

1.4 GOVERNMENT-FURNISHED PROPERTY (GFP)

As required, the DSS portfolio will provide suitable, secure office space/team room, computer equipment, supplies, furniture, reproduction, telephone and facsimile access and other facilities for contractor throughout the performance of the contract. No specific GFP is anticipated in the contract.

1.5 PHASE-IN PERIOD

A. The Government has chosen to include a 30 day phase-in period to allow for a smooth and orderly transfer of the IT support services from the incumbent Contractor to a new Contractor. The

Contractor shall participate in the phase-in period during which time the incumbent Contractor shall continue to perform the IT support services.

B. Within ten (10) calendar days from the start date of the phase-in period included in the task order, the

Contractor shall complete all required hiring actions for the key personnel.

C. Within fifteen (15) calendar days from the start date of the phase-in period included in the task order, the Contractor shall submit to the KO or COR a complete staffing plan of all non-key personnel proposed to provide service under the task order. The staffing plan shall include the names of all

Revised 5/22/2015 personnel proposed, labor category, training certifications, qualifications/experience/skills/knowledge, and copies of all required certifications as mandated by their specific labor category.

D. Following receipt of the proposed staffing plan from the contractor, the Government will then have a maximum of five (5) calendar days to review and approve/disapprove the proposed contractor resources for the purpose of confirming that all proposed contractor resources meets the requirements of the PWS. The KO or COR will provide to the contractor a list of approved contractor personnel authorized to begin work under the task order.

E. Following Government approval, the contractor then shall have no more than fifteen (15) calendar days to hire those contractor resources.

F. There will then be a fifteen (15) day on-boarding period conducted by the Government whereby the

Government approved contractor resources will be provided local site information, CAC cards, access to all systems needed for performance in their designated positions, etc.

G. Once an employee is hired, on-boarding shall commence immediately and must be 100% complete prior contractor coming on board and knowledge transfer beginning. Contractor resources shall participate in a knowledge transfer from the incumbent contractor staff and Government personnel.

The Contractor shall ensure that all new employees are trained on Government systems and ready to begin working on the first day of full performance.

2.0 DEFINITIONS AND ACRONYMS

2.1 GENERAL DEFINITIONS

The following list provides definitions for terms found throughout this document or commonly used in the distribution process:

A. Acceptable Performance Level (APL): The minimum performance of each requirement before the

Government considers performance unsatisfactory.

B. Contracting Officer (KO): The person with the authority to enter into, administer, and/or terminate contract and make related determinations and findings.

C. Contracting Officer’s Representative (COR): An individual designated and authorized in writing by the KO to perform specific technical or administrative functions.

D. Designee: The individual(s) designated and authorized in writing by the Contracting Officer to perform specific technical or administrative functions.

E. Information Technology (IT) Eligibility Categories:

IT I: Those positions in which the incumbent is responsible for planning, directing, and implementing a security program; and directing, planning, and designing a computer system including hardware and software. The incumbent is also able to access a system during the

Revised 5/22/2015 operation or maintenance in such a manner that the system would be gravely damaged or the incumbent would realize significant personal gain.

IT II: Those positions in which the incumbent is responsible for directing, planning, designing, operating, or maintaining a computer system and whose work is technically reviewed by a higher authority of the IT I category to ensure integrity of the system.

IT III: All other positions involved in computer activities not covered in IT I and IT II.

F. Operational Hours: The hours an activity is available to conduct the required tasks.

G. Quality Assurance: The functions and associated actions performed by the Government to ensure that contract requirements are performed and that an appropriate level of Contractor quality control activities are in place and operational.

H. Quality Control: Those internal management functions that include, but are not limited to, training, documented procedures, inspections, and tests (taken at the point of performance) necessary to ensure that Contractor products and services conform to contract requirements, specifications, and APLs.

I. Quality Deficiency: A defective or nonconforming condition, which limits or prohibits the product or service from compliance or usability.

2.2 ACRONYMS AND ABBREVIATIONS

Acronyms and abbreviations as used throughout this contract are listed for information and reference:

Acronym/

Abbreviation

Clear Text

ACAS Assured Compliance Assessment Solution

AC & Phy Sec Please Remove

AESA Please remove

AIS Automated Information Systems

AMB APS Master Builder

APL Acceptable Performance Level

APS Advanced Programming System

ASP Active Server Page

ASSP Application System Security Plan

Revised 5/22/2015

Abbreviation

Clear Text

CAC Common Access Card

CCA Citrix Certified Administrator

CCAA Citrix Certified Advanced Administrator

CCDA CISCO Certified Design Associate

CCNP CISCO Certified Network Professional

CE Computing Environment

CERT Computer Emergency Response Team

CFR Code of Federal Regulations

CIAK Comprehensive Information Assurance Knowledge Base

CICS Customer Information Control System

CIR Contractor Investigative Request

CISSP Certified Information Systems Security Professional

CJCSM Chairman of the Joint Chiefs of Staff Manual

CLIN Contract Line Item Number

CM Configuration Management

COB Close of Business (Day)

COBOL Common Business Oriented Language

CONUS Continental U.S.

COOP Continuity of Operations Plan

COR Contracting Officer’s Representative

COTS Commercial Off The Shelf

CSS Cascading Style Sheets

DB2 Database 2

DBMS / Database Management System / Relational Database Management System

Revised 5/22/2015

Abbreviation

Clear Text

RDBMS

DFARS Defense Federal Acquisition Regulation Supplement

DIACAP DoD Information Assurance Certification and Accreditation Process

DISA Defense Information Systems Agency

DITSCAP DoD Information Technology Security Certification and Accreditation Process

DLA Defense Logistics Agency

DLAD Defense Logistics Agency Directive

DLAI Defense Logistics Agency Instruction

DLAR Defense Logistics Agency Regulation

DoD Department of Defense

DoDD Department of Defense Directive

DoDI Department of Defense Instruction

DoDM Department of Defense Manuals

DSS Distribution Standard System

E-FORMS Electronic Forms

E-QIP Electronic Questionnaire for National Security Positions

EAGLE Employee Activity Guide for Labor Entry

EO Executive Order

ET Environmental Testing

FAR Federal Acquisition Regulation

FMR Financial Management Regulation

FPCON Force Protection Condition

FT Functional Testing

GCFW GIAC Certified Firewall Analyst

Revised 5/22/2015

Abbreviation

Clear Text

GCIA GIAC Certified Intrusion Analyst

GCUX GIAC Certified Unix Security Administrator

GCWM GIAC Certified Windows Security Administrator

GFP Government-Furnished Property

GIAC Global Information Assurance Certification

GOTS Government Off The Shelf

GSOC Global Security Operations Center

HBSS Host Based Security System

HSPD Homeland Security Presidential Directive

HTML Hyper Text Markup Language

IA Information Assurance

IAO Information Assurance Officer

IAT Information Assurance Technical

IAVA Information Assurance Vulnerability Assessment

IAVM Information Assurance Vulnerability Management

IAW In Accordance With

ID Identification

IDIQ Indefinite Delivery Indefinite Quantity

IDS Intrusion Detective System

INFOCON Information Conditions

IOC Initial Operational Capability

IP Internet Protocol

IPS Intrusion Prevention System

IR Incident Report

Revised 5/22/2015

Abbreviation

Clear Text

ISPP Information Systems Security Program

ISS Internet Security System

IT Information Technology

J6 DLA Information Operations

JCL Job Control Language

JSP Java Server Faces

JTR Joint Travel Regulations

KO Contracting Officer

LAN Local Area Network

MAC Media Access Control

MCDBA Microsoft Certified Data Base Administrator

MCITP Microsoft Certified Information Technology Professional

MCM Microsoft Certified Master

MCSA Microsoft Certified Systems Administrator

MCSE Microsoft Certified Systems Engineer

MFEEE Micro Focus Enterprise Editions

MS Microsoft

NACI National Agency Check with Investigation

NACLC National Agency Check with Local Agency Check and Credit Checks

NGX Next Generation Firewall

OCM Oracle Certified Master

OCP Oracle Certification Program

ODC Other Direct Cost

OMB Office of Management and Budget

Revised 5/22/2015

Abbreviation

Clear Text

OPSEC Operational Security

OSHA Occupational Safety and Health Administration

PK Public Key

PKI Public Key Infrastructure

PM Project Manager

POC Point-of-Contact

POV Privately Owned Vehicle

PSI Personnel Security Investigations

PTR Program Trouble Report

PWS Performance Work Statement

QASP Quality Assurance Surveillance Plan

QC / CSP Quality Control / Customer Satisfaction Plan

RFC Request for Change

RHCE Red Hat Certified Engineer

RHCT Red Hat Certified Technician

SCNA Sun Certified Network Administrator

SCSA SNIA Certified Storage Architect

SF Standard Form

SME Subject Matter Expert

SQL Structured Query Language

SRR Security Readiness Reviews

SSAA System Security Authorization Agreements

SSBI Single Scope Background Investigation

SSN Social Security Number

Revised 5/22/2015

Abbreviation

Clear Text

ST System Testing

STIG Security Technical Implementation Guides

TCP Transmission Control Protocol

TE Technical Exhibit

TFS Team Foundation Server

TSO TCP Segmentation Offload

UM / MM User Manual / Maintenance Manual

U.S. United States

USC United States Code

VCAP VM-Ware Certified Advanced Professional

VCP VM-Ware Certified Professional

VMS Vulnerability Management System

2.3 DOD DICTIONARY

The DoD Dictionary of definitions and terms is available on the Internet at http://www.dtic.mil/doctrine/dod_dictionary/

3.0 RESOURCE REQUIREMENTS AND SPECIFIC TASKS

The scope for this PWS is specifically to:

Design, code, test and integrate requirements into supported systems.

Provide expertise for general and specific activities related to software development and maintenance, data administration, configuration management, software process improvement, information assurance, documentation and IT support infrastructure.

Coordinate and implement system software changes at various operational sites, to include overseas locations.

http://www.dtic.mil/doctrine/dod_dictionary/

Revised 5/22/2015

3.1 RESOURCE REQUIREMENTS

Personnel assigned to or utilized by the Contractor in the performance of this Task Order shall possess the qualifications and skills set forth below and shall be fully capable of performing in an efficient, reliable, and professional manner. If the KO or COR questions the qualifications or competence of any person performing under the contract, the burden of proof that the person is qualified as prescribed herein shall be upon the Contractor.

3.1.1 KEY AND NON-KEY PERSONNEL

A. KEY PERSONNEL

The Government has designated the minimum full-time equivalent (FTE) support by Key Personnel positions in Table 1.

Table 1- Minimum Required Key Personnel

Labor Categories

Key

Personnel

SITE PROJECT MANAGER (PM) 2

SOFTWARE ENGINEER (LEVEL IV) – APPLICATIONS 1

SOFTWARE ENGINEER (LEVEL IV) – TECHNICAL SUPPORT 1

SOFTWARE ENGINEER (LEVEL III) – APPLICATIONS 7

SYSTEMS/SOFTWARE ANALYST 2

DATABASE ADMINISTRATOR – ORACLE 2

INFORMATION ASSURANCE SUBJECT MATTER EXPERT (SME) 1

Some of the individuals in Key Personnel positions must hold a SSBI IT I access due to the type of support required. The remaining Key Personnel positions shall have a minimum a NACLC Investigation and an IT II classification. Designation must be held upon acceptance of employment or be eligible to obtain a security waiver that shall be applied for and approved prior to task order proposal submission by the Contractor. The following chart outlines the IT access required for the Key Personnel positions.

Table 2- Key Personnel IT Access Requirement

Labor Categories

Key

Personnel

SSBI IT I SSBI IT II

SITE PROJECT MANAGER (PM) 2 0 2

SOFTWARE ENGINEER (LEVEL IV) – APPLICATIONS 1 0 1

SOFTWARE ENGINEER (LEVEL IV) – TECHNICAL SUPPORT 1 1 0

SOFTWARE ENGINEER (LEVEL III) – APPLICATIONS 7 0 7

SYSTEMS/SOFTWARE ANALYST 2 2 0

DATABASE ADMINISTRATOR – ORACLE 2 2 0

INFORMATION ASSURANCE SUBJECT MATTER EXPERT (SME) 1 1 0

Revised 5/22/2015

B. NON-KEY PERSONNEL

All Contractor provided Non-Key Personnel resource requirements shall have at a minimum a NACLC

Investigation and an IT II classification:

3.1.1.1 SITE PROJECT MANAGER (PM)

The Contractor shall identify one (1) full-time equivalent (FTE) for New Cumberland, PA and one (1) FTE for Ogden, UT to provide on-site coordinating and supervising activities for all contractors at each location.

The PM shall provide overall coordination in direct support of matters pertaining to specific support services performed under this task order and shall act as the principal point of contact (POC) for technical issues at their designated site or sites. The PM shall participate in formal activities, project management reviews, and informal meetings. The PM shall provide support through the management and prioritization of day-to-day

Contractor activities, and the preparation of documents to include, but not limited to, briefings, point papers, trip reports, coordination of leave, resolution of contractor personnel issues and meeting minutes related to the status of the performance under this task order. The PM shall be able to provide overall supervision for

Contractor employees, to include, but not limited to, planning and managing the project professionally;

ensuring that work is scheduled properly to obtain maximum use of resources; ensuring that accurate and timely reports are provided; effective supervision to prevent inefficient or wasteful methods in the performance of the services ordered; ensure cost saving factors and quality controls are used to ensure work is performed as scheduled and at a fair and reasonable cost. The PM shall demonstrate the ability for carrying out established planning, budgeting, and program execution functions for designated projects to ensure program deliverables meet the performance requirements and objectives. The PM shall be responsible for strategies to attain budget, schedule and performance goals. The PM shall meet the minimum skills/knowledge and perform the functions of one (1) of the functional labor categories 3.1.1.2 through

3.1.1.102. Historically, the PM has spent approximately 30% of their productive hours monthly performing the duties of the PM. The PM shall possess and demonstrate the following knowledge and skills:

Excellent Program or Project Management Skills, including Team Leadership.

Excellent Communication and Facilitation Skills.

Expertise in project development from inception to deployment.

Demonstrated capability in managing multi-task contracts of various types and complexity.

3.1.1.2 SOFTWARE ENGINEER (LEVEL IV) – APPLICATIONS

Specialized Experience:

SME in mainframe and mid- tier technologies, methodologies, and applications for supply chain distribution systems;

Seasoned Programming experience/analysis on supply chain distribution systems;

Revised 5/22/2015

Experience with Mainframe and mid-tier software development, web-based application development, relational database design, requirements analysis/development, information engineering;

Perform moderately complex analysis, design, development, testing and debugging of computer software. Activities range from operating system architecture integration and software design to recommendation of products; Knowledge of relational database structures and modeling;

Proficiency in Micro Focus Enterprise Edition (MFEEE), Micro Focus, APS Master Builder

(AMB), and experience with IBM Enterprise COBOL, HTML,IBM DB2 SQL programming, IBM Z/OS DB2 DBMS, IBM DB2 LUW, IBM Query Management Facility, IBM CICS command level coding interface, IBM Z/OS TSO,IBM ISPF, IBM Z/OS Job Control Language, IBM WebSphere MQ, CA Intertest, Micro Focus Enterprise Link, IBM Z/Linux, IBM AIX, IBM

DB2 Stored Procedures;

Knowledge and use of IBM CA Endeavor, and CA Harvest;

Knowledge and use of TCP/IP Communication and Programming;

Cross-Functional knowledge of Supply Chain end-to-end with emphasis in DoD wholesale and retail distribution; and

Working knowledge of IBM's Query Workload Tuner.

3.1.1.3 SOFTWARE ENGINEER (LEVEL IV) – TECHNICAL SUPPORT

Specialized Experience:

Seasoned Programming experience on supply chain distribution systems;

Experience with mainframe and mid-tier software development, web-based application development, relational database design, requirements analysis/development, information engineering;

Knowledge of relational database structures and modeling;

Proficiency in Micro Focus Enterprise Edition(MFEEE), Micro Focus, APS Master Builder

(AMB), and experience with IBM Enterprise COBOL, HTML,IBM DB2 SQL programming, IBM Z/OS DB2 DBMS, IBM DB2 LUW, IBM Query Management Facility, IBM CICS command level coding interface, IBM Z/OS TSO,IBM ISPF, IBM Z/OS Job Control Language, IBM WebSphere MQ, CA Intertest, Micro Focus Enterprise Link, IBM Z/Linux, IBM AIX, IBM

DB2 Stored Procedures;

Working knowledge and use of CA Endeavor, and CA Harvest;

Working knowledge and use of AIX lPR command and print spooling methodologies;

Working knowledge of the IBM AIX operating system;

Working knowledge and proficiency in the administration of MicroFocus Enterprise Server and

Micro Focus Mainframe Express Enterprise Edition;

Working knowledge and proficiency in the administration of CA Access Control and CA

Workload Automation;

Working knowledge and proficiency in the administration of LRS, VPS, VPSX and

PageCenterX; and

Working knowledge of IBM's Data Studio and Query Workload Tuner.

Revised 5/22/2015

3.1.1.4 SOFTWARE ENGINEER (LEVEL III) – APPLICATIONS

Specialized Experience:

Programming experience on supply chain distribution systems;

Experience with mainframe and mid-tier software development, web-based application development, relational database design, requirements analysis/development, information engineering;

Knowledge of relational database structures;

Proficiency in Micro Focus Enterprise Edition(MFEEE), Micro Focus, APS Master Builder

(AMB), and experience with IBM Enterprise COBOL, HTML,IBM DB2 SQL programming, IBM Z/OS DB2 DBMS, IBM DB2 LUW, IBM Query Management Facility, IBM CICS command level coding interface, IBM Z/OS TSO,IBM ISPF, IBM Z/OS Job Control Language, IBM WebSphere MQ, CA Intertest, Micro Focus Enterprise Link, IBM Z/Linux, IBM AIX, IBM DB2

Stored Procedures;

Knowledge and use of , CA Endeavor, and Harvest;

Knowledge and use of TCP/IP Communication and Programming;

Cross-Functional knowledge of Supply Chain end-to-end with emphasis in DoD wholesale and retail distribution; and

Working knowledge of IBM's Query Workload Tuner.

3.1.1.5 SOFTWARE ENGINEER (LEVEL III) – SQL SERVER/.NET PROCESSES

Specialized Experience:

Proficiency in analyzing user-defined functional and technical system requirements;

Working knowledge of IBM , CA Endevor and CA Harvest;

Proficiency in Oracle, C, C++, C-Sharp, SQL Server, Windows SQL Server Database

Administration, ASP, ASP.NET, JAVA;

Working Knowledge of Windows Server Administration, HTML, Visual Basic, Java Script, Software Configuration Management;

Proficiency in C-Sharp (C#), Microsoft SQL Server, and Microsoft Visual Studio 2010

Working knowledge of Microsoft Team Foundation Server (TFS); and

Working knowledge of Windows Server Administration, HTML, Java Script, and Cascading

Style Sheets (CSS).

3.1.1.6 DATABASE ADMINISTRATOR – ORACLE

Specialized Experience:

Working knowledge of Oracle Application Server, Oracle Database Server, Oracle Infrastructure

Server, Oracle Reports, Oracle Forms, Oracle PL/SQL, Oracle Database Administration and tuning;

Proficiency in C pre-compiler, Java/JDeveloper and similar Object Oriented development languages;

Working knowledge of a Relational Database Table Modeling;

Revised 5/22/2015

Working knowledge of the internal architecture of systems to include Information Assurance, Menu Construction, Report Scheduling and Job Scheduling;

Working knowledge of CA Harvest;

Working knowledge of the following DoD Documents and Instructions: DoDD 8500.1

(Information Assurance), DoDI 8500.2 (IA Implementation), DoDI 8510.01 (DIACAP).

Familiar with the contents of OMB-A0130 and CJCSM 6510.01;

Experience in the following: Software Development Lifecycle, Network Architecture to include

IDS, IPS, encryption anomaly detection architectures, Security Architectures, Operating Systems

(to include Windows Environment, Unix, Virtual Machine), Database Systems (to include Oracle

Database Server, and Windows SQL Server), and Public Key Infrastructure (to include CAC

Implementation, PK Enabling servers and applications);

Knowledge in protective and preventive measures and in methods to employ for recovery from intrusion and destruction;

Ability to recognize symptoms manifested by a system under attack and the methods that can be employed to neutralize the attack; and

Knowledge of and skill in applying IT System security principles, methods and tools to participate in defining IT security requirements.

3.1.1.7 INFORMATION ASSURANCE SUBJECT MATTER EXPERT (SME)

Specialized Experience:

Current and comprehensive knowledge of Federal laws, DoD, DLA and local regulations, policies guidelines, standards and procedures mandating requirements and standards for the management and protection of information technology resources;

Broad knowledge of systems analysis and design techniques and characteristics of computer equipment;

Knowledge in protective and preventive measures and in methods to employ for recovery from intrusion and destruction;

Current and comprehensive knowledge of the vulnerability of personal computers and how they may be used for typical and/or sophisticated criminal activity or abuse;

Ability to recognize symptoms manifested by a system under attack and the methods that can be employed to neutralize the attack;

Comprehensive knowledge and understanding of the DoD Information Technology Security

Certification and Accreditation Process or DITSCAP as outlined and defined by DoD Instruction

(DoDI) 5200.40, and all associated references;

A knowledge of and skill in applying IT System security principles, methods and tools;

Knowledge of the DoD 8500.2 Security Controls;

Working knowledge of PKI;

Working knowledge of Laptop support, Retina/REM IAVM…