16 EPoS Attach 16 Group 3 Task Order 1 Mobile Device Integration PWS 20171201 CC.docx

GENERAL DESCRIPTION:

This is a DRAFT of Task Order 1 to be used for IDIQ price evaluation purposes. The vendor who is awarded Group 3 will have an opportunity to revise pricing when the final Task Order 1 is issued. The DRAFT task order is based on information available at the time of IDIQ solicitation.

The contractor shall provide the necessary technical and subject matter expertise to accomplish the tasks described within the PWS of the Task Order (TO) on a Firm Fixed Price basis. The work shall be performed in accordance with all sections of this Task Order and the contractor’s proposal for the overall EPoS Indefinite Delivery Indefinite Quantity (IDIQ) effort for Group 3: Mobile Devices.

TECHNICAL PROPOSAL:

In accordance with the solicitation, Factor 1: Technical, Subfactor A: Technical Approach of the Solution, Subfactor B: Management Approach and Capabilities, and Subfactor C: Key Personnel Qualification under Group 3, the contractor shall provide a technical proposal that shall include:

1. A list of assumptions used in your proposal

1. Resumes of Key Personnel

1. Documentation demonstrating the contractor’s understanding of the TO PWS and the contractor’s proposed methodology and technical approach to completing the stated tasks. Additionally, the contractor shall provide a proposed plan (including milestones and timelines) for overall implementation and execution of project.

PRICING:

In accordance with solicitation, the contractor shall provide a firm fixed price proposal for this Task Order utilizing sample pricing sheet for task order provided in the attachment section of the solicitation.

ATTACHMENT 16

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services Group 3 Task Order 1 Mobile Device Integration PWS

ATTACHMENT 16

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services Group 3 Task Order 1 - DRAFT Mobile Device Integration PWS iv

Performance Work Statement Table of Contents

Background DLA Energy requires an electronic Point of Sale Device (EPoS) turn-key solution for capturing military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions and capturing aviation fuel transactions for mobile airfield/flight line operations that meets the current standards for Cybersecurity and Audit Readiness. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 80053r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security as specified in this PWS.

Turn-key is defined as complete implementation to include physical preparation and installation of the device to include minor device-related work required to make the device operational, electrical wiring and full implementation of the software solution to meet the requirements included in this PWS.

Task Order Scope Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of program deliverables, project status, project plans, and general Task Order oversight.

Mobile Device Application Software Development The conceptual operational view of the solution is in Section C. Performance Work Statement, 4.0 Scope.

The contractor shall develop mobile device interface software that meets the requirements detailed in sections 3.2.1 of this Task Order.

The contractor shall develop mobile device application software that meets the requirements in section 3.2.2 and 3.2.3 of this Task Order.

Mobile Device Application Software Sustainment EPoS environments must be operational 24 hours a day, 7 days a week.

The contractor shall sustain the mobile device interface and application software and its functionality.

The contractor shall ensure that the EPoS mobile device interface and application software are appropriately sized and tuned for the most efficient operations/performance possible. The contractor shall ensure all detected problems are promptly reported to the EPoS PMO.

The contractor shall provide the processes, procedures, people, documentation, operations support, deployment, security, configuration management and training materials required to sustain the mobile device interface and application software. The contractor shall correct faults, improve performance or other attributes, and adapt the applications to a changing organizational and technical environment. The contractor shall support the resolution of problems discovered through the testing or operation of the EPoS mobile device interface and application software.

Mobile Device Delivery Oversight The contractor shall provide mobile device delivery oversight to ensure Task Order activities including coordination and update of project status and plans are completed timely and successfully.

Mobile Device Delivery The contractor shall deliver mobile devices from their storage location to designated customers according to a deployment schedule.

For the purposes of pricing this Task Order as part of evaluation, the contractor shall notionally deliver one hundred eighty (180) units of mobile device hardware and operating system software to:

Defense Logistics Agency – Energy 10400 Furnace Road, Suite G Lorton, Virginia 22079 Mobile Device Replacement The contractor shall maintain sufficient inventory of mobile devices to replace failed devices to any supported location within 48 hours of failure.

Information and Industrial Cybersecurity The contractor shall ensure the solution:

· Complies with the security control requirements documented in

· National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, "Security and Privacy Controls for Federal Information Systems and Organizations"

· NIST 800-82r2, "Guide to Industrial Control Systems (ICS) Security”

· NIST Special Publication 800-82 "Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security

· United Facilities Criteria (UFC) 3-460-01, “Design; Petroleum Fuel Facilities,” 17 June 2015

· UFC 4-010-06, “Cybersecurity of Facility-Related Control Systems,” 19 September 2016

· UFC 4-020-02FA, “Security Engineering: Concept Design,” 1 March 2005 as specified in this PWS

· Obtains an Authorizing Official (AO) Authority To Operate (ATO) by utilizing the Department of Defense (DOD) processes and procedures as defined in the DoD Instruction 8510.1 “Risk Management Framework (RMF) for DoD Information Technology (IT)” as implemented by DLA The contractor shall be responsible for:

· Performing preventative and analytical activities aimed at enhancing the overall cybersecurity posture of the solution associated with integration within DLA networks, information systems, and applications.

· Providing full cybersecurity support for the scope of the solution and services as stated below.

· Ensuring compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards as applicable.

The contractor shall provide cybersecurity support that includes:

· Enterprise Architecture Support and Compliance Support

· Cybersecurity Engineering Support

· Cybersecurity Certification and Accreditation (C&A) Services

· Cybersecurity Plan of Action and Milestones (POA&M) Services

· Cybersecurity General Support Services

· Federal Information Security Management Act (FISMA) Tracking and Reporting

· Applicable Cybersecurity Controls (Baseline)

· Controlled Unclassified Information (Contractor Internal Cybersecurity Controls) System Documentation The contractor shall provide documentation required to operate the mobile device with the equipment delivery.

Tasks Task 1: Project Management Project Management Plan The contractor shall prepare a Project Management Plan (PMP) (Contract Data Requirements List ((CDRL) M001) describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements for the proposed effort. The contractor shall provide the planning, supervision, coordination and controls necessary to accomplish all work contained in this PWS. The contractor shall document the approach and plan that defines the activities, tools, and techniques to ensure high-quality products that are defect-free, that meet PWS requirements and that are delivered in accordance with the approved schedule.

The plan shall include a description of the organization structure and assigned responsibilities, including the contractor staff that will deliver and implement this Task Order. The organization structure shall include the identification of key personnel. The contractor shall provide an organization chart and describe other corporate organizations that will support the team.

The contractor shall provide an explanation of how, within the scope of the Task Order, the contractor will perform technical management and will manage personnel and physical resources. y.

The plan shall include a work breakdown structure (WBS) (CDRL M002) that shows tasks required to complete the work and the dependencies of each task. The WBS shall be detailed to the level of effort necessary to support the accomplishment of work to be performed under this PWS. The contractor shall deliver the PMP to the Contracting Officer’s Representative (COR) in a contractor proposed, Government approved format within 30 days of contract award.

Integrated Master Schedule The Integrated Master Schedule (IMS) is a time-based schedule containing the networked, detailed tasks necessary to ensure successful project/ Task Order execution. The IMS is traceable to the PMP, the WBS, and this PWS. The IMS is used to verify attainability of Task Order objectives, to evaluate progress toward meeting project objectives, and to integrate the project schedule activities with all related components.

The contractor shall produce and maintain an IMS (CDRL M003) that shows the activities required for the completion of tasks and deliverables for this Task Order. The contractor shall deliver to the COR a draft and baselined IMS within 10 and 30 calendar days after Task Order award, respectively.

The contractor shall deliver a Project IMS, with updated actuals, to the COR a minimum of two business days prior to each Monthly Performance and Progress Report (See section 3.1.5 of this Task Order). The IMS shall be delivered in a contractor proposed, Government approved format.

Risk Register The contractor shall apply a risk management approach to develop and maintain a risk register that documents and tracks contractor and Government identified project risks. For each risk, the register shall include at least a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur and a mitigation strategy. The contractor shall deliver a Risk Register (CDRL M004) resulting from the contractor’s risk management process to the COR within 30 calendar days of the issuance of the Task Order and provide updates as changes are made, at least monthly. The Risk Register shall be provided in a contractor proposed, Government approved format.

Monthly Performance and Progress Report The contractor shall monitor activities and deliverables under this Task Order and provide a Monthly Performance and Progress Report (MPPR) (CDRL M005) that describes project progress, costs, issues, problems and their status. The MPPR shall be the contractor’s method of reporting progress against the PMP. The period covered by the MPPR shall include the previous calendar month’s activities; any issues, actions or other MPPR reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings or other commitments. If applicable, travel costs shall be broken down by destination, duration, purpose, and costs for both monthly and cumulative to date. MPPRs for the previous month shall be delivered to the COR by the fifth day of the following month.

The MPPR shall include but not be limited to the following information:

· Summary of Activities

· Activities and Progress (Integrated Master Schedule)

· Software Engineering Metrics and Measures

· Costs

· Significant Meetings

· Significant Issues

· Significant Plans

· Travel

· Action Item Status

· Risks to the contractor based on Government pending actions

· Risks to EPoS application performance based on contractor issues Briefing, Meeting, Conference Call Presentation Material and Minutes The contractor shall prepare briefing materials and represent the EPoS program at briefings, meetings and conference calls with organizations of interest, stakeholders, external and internal systems. This representation shall be at a level that functionally and technically represents EPoS mission and capabilities.

The COR or an authorized Government representative will be present at all briefings, meetings and conference calls. Read ahead and presentation materials (CDRL M006) shall be delivered to the COR five days prior to any meetings, briefings or conference calls, as required. If meetings, briefings or conference calls are scheduled less than five days in advance, the contractor shall provide read ahead and presentation material as soon as practicable.

The contractor shall document meeting notes including, but not limited to, any action items, status of action items, and summary of discussions. The contractor shall deliver these meeting notes (CDRL M007) to the COR no later than five days after the meeting. Approved meeting notes will be disseminated by the COR.

Kick-off Meeting The contractor shall schedule a kick-off meeting with the PMO, COR, and stakeholders within two weeks of award or as agreed on between the Government and contractor, to introduce the Government team to the contractor’s overall operating plans and approach to this work. The contractor shall present and deliver the Kick-off Meeting Briefing Presentation Material (CDRL M006) and be prepared to discuss the content of the Program Management Plan, to include the staffing plan, schedule and proposed metrics. The contractor shall produce and distribute Kick-off Meeting Minutes (CDRL M007) identifying all the discussion points, agreements and action items within five days following the meeting.

Weekly Production Status Contractor personnel shall be prepared to actively participate in support calls by having status updates ready and also be available for any questions from the customer. As requested by the COR, the contractor shall provide a Weekly Status Report (CDRL M008) on the first Monday of the following week that describes issues, resolutions and timeframes.

Configuration Management Plan The contractor shall conduct Configuration Management (CM) for all mobile device interface and application software development and sustainment to include incidents, and requests for change using the Government’s in-place CM tracking system. The contractor shall update and track all development and sustainment efforts by submission, review, level of effort (LOE), funding, approval, delivery, testing and enhancements to production.

The contractor shall develop and deliver to the COR a Configuration Management Plan (CMP) (CDRL M009) within 30 days after Task Order award.

Task 2: Mobile Device Application Software Development Mobile Device Application Software Requirements Overall Device Requirements

· End-user training shall come with the product and provided by the contractor upon initial fielding. User manual shall be easily used by end users. (No formal in residence training post initial fielding training should be required to operate this program)

· The data shall be encrypted at rest using the National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2)

· Ability to update devices real time when changes occur (updates, password protect, etc.) as a whole, not individually through Active Directory Solution

· Push updates to devices wirelessly (Cellular or Satellite dependent on location) from Active Directory Solution

· Transaction data shall be secured at Service Station pedestals, handhelds or during transfer to the enterprise system

· User must not be able to manipulate, update or change data once a transaction has been completed

· The same system shall be used by all branches of military service using a standardized configuration

· The contractor shall provide an image for the hardware to be used with their Software that has had all applicable STIG’s applied that can be applied to the device via Active Directory/Software Management solution

· System shall be World Wide deployable and legal to operate in all Host Nations Custody Transfer Device Requirements

· Automated capture of transactions at unattended military service stations, via mobile fuel dispensers (e.g., trucks), aviation flight lines via hydrant systems or handheld devices, and in other environments where custody transfer of fuel is performed

· Transmits transactional data in accordance with data transfer standards for information integrity assurance to DLA Energy’s Enterprise Systems

· Communications Standards Defined in section 5.2.1.4 Electronic Communication Requirements

· Utilizes current industry best practices to meet the DLA Energy needs and consists of established commercial hardware that has a documented commercial installation history and performance records, which demonstrate the system has a proven record of reliable field performance

· Supports Audit Readiness and DOD reporting requirements for validation of source media and transactional integrity

· Provides secure data transfer technology that meets DOD/DLA IT security standards Environmental Requirements

· Flammable Gases or Vapors: The device shall be safe to operate in a Class 1 Division 2 area in which

· Volatile flammable liquids or flammable gases are handled, processed or used, but the hazardous liquids, vapors or gases shall normally be confined within closed containers or closed systems from which they can escape only in the event of accidental rupture or breakdown of such containers or systems, or as a result of abnormal operation of equipment

· Ignitable concentrations of gases or vapors are normally prevented by positive mechanical ventilation, and which might become hazardous through failure or abnormal operations of the ventilating equipment

· Adjacent to a Class I, Division 1 location, and to which ignitable concentrations of gases or vapors might occasionally be communicated unless such communication is prevented by adequate positive-pressure ventilation from a source of clean air, and effective safeguards against ventilation failure are provided

· Water Resistance: Handle exposure to rain, water spray, or dripping water during storage, transit, or operation

· Salt (Salt Fog): The device shall be able to withstand high levels of salt in the atmosphere associated with operating in salt (marine) environment

· Sand and Dust: The device shall resist the effects of sand and dust obstructing openings, penetrating into cracks, crevices, bearings, and joints degrading its effectiveness, reliability and maintainability due to abrasions or clogging

· Vibration: The device shall be able to withstand vibrations associated with transportation (aboard aircraft and vehicles and during operations supplemental) and where it is located (in a facility, a certain type of vehicle, etc.)

· Shock (Drop Test for Mobile Only): The device shall be able to physically and functionally withstand the relatively infrequent, non-repetitive drops encountered in handling, transportation, and service environments for drops less than 4 feet

· Low Pressure (Altitude): Capable of being stored or operated at high ground elevation sites and transported or operated in pressurized or unpressurized areas of aircraft with a maximum operating ceiling of 50 feet.

· Visibility: The device must be easily viewable in low light and high glare environments Electronic Communications Requirements

· All communications shall be secured in transit using the National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2)

· The device shall electronically transmit captured transactional data and scanned documentation to the centralized enterprise repository

· The contractor shall provide internet connectivity for wirelessly obtaining lists of authorized source media and for the transmittal of transactional data to the enterprise solution

· All transmissions shall occur in the background and not prohibit the continued use of the device Black Listed Transaction Requirements

· Shall have a self-contained blacklist of source media that is no longer a valid purchase media

· Shall allow the blacklist to be updated remotely

· The blacklist shall be updated a minimum of three times daily, or during the first available connection in the event of loss of communications.

Note: The blacklist shall also be updated via a connection to a local computer in the event that the environment prohibits wireless communication

· All transactions initialized with authorized source media shall be validated against the blacklist Source Media Requirements

· Source media is defined as source media authorized by DLA Energy for the purchase of products from DLA Energy Locations

· All source media shall be validated before authorizing the transaction

· Shall be configured to accept one or more commercially used electronic purchase media (i.e. magnetic stripe card, radio frequency identification (RFID), smart card, Quick Response (QR) code, etc.)

· Source media will categorized as capitalized and non capitalized

· Initial capitalized source media shall be the magnetic strip cards issued through the DLA Energy Card Management office

· Initial non capitalized source media will be contractor produced QR codes affixed to vehicles

· Devices shall have the capability of being configured to only allow use of capitalized source media, non-capitalized source media, or both

· Reconfiguration of the type of authorized source media shall be completed remotely through device configurations Receipt Pricing

· All devices must have the ability to print a receipt at the user’s option Customer Identification

· Customer identification shall be completed by capturing the receivers full name (First Name, Last Name) from a DOD issued Common Access Card (CAC) Card or state issued identification card

· For purchases, the user’s information only needs to be captured

· For mobile devices, the users will be required to PKI authenticate to the device using middleware from the Windows Active Directory that manages the device

· The contractor may add additional middleware to handle the implementation that shall be controlled by a central enterprise system on a Windows based platform (e.g., Windows Server 2014 with Active Directory)

· If the identification card is not available, the user must be able to manually type in the First and Last Name. The Government will not place additional restrictions on this field. The contractor may, as his best practice, implement industry best practices for the lengths of the data and field validations as required by DOD 8570 requirements

· Note: Manual input shall not be validated or verified Mobile Device Temperature Requirements The contractor shall provide a list of compatible hardware for the software solution that meets the following temperature specifications:

· The contractor may provide two mobile device types to meet the temperature requirements.

· The Government will identify the locations where Device 2 is required

· Device 1 – High Temperature: 120 Degrees F Radiant, Low Temperature: 0 Degrees F Radiant

· Device 2 – High Temperature: 140 Degrees F Radiant, Low Temperature: 0 Degrees F ambient Additional Requirements

· Shall require PKI authentication using a Common Access Card (CAC) to grant the User access prior to utilizing the device

· Shall be agnostic to the source vehicle or header with which the device is used

· Shall scan (provide an image of) an identification marking on the source header or vehicle

· Identification markings shall be in the form of a QR code

· The contractor shall provide barcoding media

· Information contained in the QR code shall include in the information identified in section 5.5.2.14 Equipment Identification and QR code Requirements

· Shall leverage OCR recognition in combination with a scanner to scan meters already installed on some of the source headers or vehicles

· Some meters will also include QR codes that will be scanned to determine beginning and ending fuel totalizer values

· Totalizer values will be used to determine meter quantity if scanned by the user

· Totalizer quantity of scanned readings will be considered to be at 60 degrees

· Shall read QR codes. See section 5.5.2.14 for QR code data elements

· Shall print a receipt Note: The Government will resupply paper for the receipts.

· Shall scan (provide an image of) up to a maximum 8.5 X 11 inches document

· Shall store policy and procedure documents based at their location for review by end users.

· Documents shall be configured for the location at the enterprise level based on a standard load for each Service Type (Air Force, Army, Navy, Marine, DLA, etc.)

· Shall transmit transactional data and scanned documents to the enterprise solution

· Shall be remotely managed through a Windows Active Directory Solution

· Shall be connected to a computer and have the information downloaded in the event that the wireless communication fails or is unavailable due to the location

· All direct interfaces with computers shall meet all cybersecurity requirements

· Shall store 10000 transactions in the event that wireless communication fails

· Ability to remotely erase the data on the device in the event of it being lost or stolen

· Ability to activate or deactivate internet transmission (Airplane mode)

· Device shall be configurable to include the following options for using when creating transactions. (New options shall be added at the enterprise and pushed to devices as required by Configuration Files)

· Quantity Determination Method – The initial list shall be Conveyance Tank Gauge, Non-Temperature Compensating Meters, Shipping Tank Gauge, Temperature Compensating Meters, and Weight Conversion

· Unit of Issue – The initial list shall be Cubic Foot, Cubic Meter, Each, Liter, Thousand Cubic Feet, U.S. Gallons, U.S. Pound, and U.S. Ton

· Devices shall be Enterprise configurable to compensate fuel to 60 degrees Fahrenheit using an industry standard conversion method specific to the grade of product. All movements shall have a gross quantity and net quantity

· Mobile devices shall be configured with the available fuel products at the enterprise level that are specific to the location

· Device backlighting shall be adjustable by the end user

· Device shall have a minimum screen size of 8 inches

· Contractor shall provide software as a software package and include configuration instructions for the devices

· Contractor software configuration shall be accomplished with information that will be generated by a system that is not managed by the contractor or that does not use the contractors COTS application

· Contractor software configuration changes shall be device images or enterprise managed software using Microsoft solutions

· Mobile equipment will function in an Active Directory environment and be managed by a system similar to Windows Software Center

· Operating systems shall include an Internet browser capable of access DOD PKI enabled Websites

· Mobile device shall include PKI middleware.

· Mobile devices shall receive files from the enterprise containing blacklist information using a standard format Card Authentication Data Because they contain sensitive data, the Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record for card authentication data as required by Task Order at Task Order award.

Data Transmission Data Because they contain sensitive data, the Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record for data transmission data as required by Task Order at Task Order award.

Blacklist Data Because they contain sensitive data, the Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record for blacklist data as required by Task Order at Task Order award.

Mobile Device Equipment Identification and QR Code Requirements The following data fields are used solely for the identification of the asset from which the fuel is being pumped, owned or maintained by DLA. The mobile device shall not be hardcoded to contain information specific to the refueling equipment or infrastructure.

Refueling Equipment

· Issue Point

· Issue Point Number

· Equipment ID Number

· Issuer DODAAC

· Processing DODAAC

· Grade

· Issuers Supplemental DODAAC (Only used if Issuer DODAAC does not match Processing DODAAC)

· Issuers Organizational Code (Only used if Issuer DODAAC does not match Processing DODAAC) sub account

· Issuers Use Code (Only used if Issuer DODAAC does not match Processing DODAAC)

· Issuers Fund Code (Only used if Issuer DODAAC does not match Processing DODAAC)

· Issuer BOS (Only used if Issuer DODAAC does not match Processing DODAAC)

· Unit of Measure

· Issuer MDS (Only used if Issuer DODAAC does not match processing DODAAC)

· Use Code Fuel Headers

· Issue Point

· Issue Point Number

· Owner DODAAC – Shall map to the Issuer DODAAC for shipment operation, the Receiver DODAAC for receipt operations.

· Processing DODAAC Customer Vehicles

· Vehicle ID

· Customer DODAAC

· Customer Sub-Account Testing The contractor shall provide testing to ensure system requirements are met. The contractor shall develop and maintain test scripts and architectures for application products; write, implement and report status for system test cases; analyze test cases and provide regular progress reports; provide testing procedures for the support of user requirements in applications; and provide inputs to risk management assessments on test design and test tools selection.

Section 508 Testing Testing shall ensure compliance with Section 508 of the Rehabilitation Act Amendment of 1998, which requires Federal agencies acquiring electronic and information technology to ensure that Federal employees with disabilities have access to and use of information and data that are comparable to the access and use by Federal employees who are not individuals with disabilities. IT products and services developed in response to this PWS are required to comply with Section 508 standards (available on the U.S. Access Board website at: www.access board.gov/508.htm) and the Federal Acquisition Regulation (FAR) both Subpart 7.103 and Subpart 39.2. The tools required by the DLA CIO include e.g. JAWS, Zoom Text, Dragon Naturally Speaking, and Kurzweil. The contractor shall document Section 508 Test Results (CDRL M010) and provide them to the COR.

Unit Testing The contractor shall conduct unit testing on multiple code modules or components and to execute the entire series of events surrounding a development object or configured transaction. The test shall include the transactions, the flow of data from the source system to the destination system through the architecture, and the completion of the developed actions in the destination system. The contractor shall document Unit Test Results (CDRL M011) and provide them to the COR.

Integration Testing The contractor shall conduct integration testing that combines and tests units to expose problems with the interfaces among solution components. The contractor shall document Integration Test Results (CDRL M012) and provide them to the COR.

System Testing The contractor shall conduct a system test that tests the solution at the business transaction level to ensure that all business events can support the EPoS mission and that end-to-end business processes function properly. The system test confirms interoperability between systems (interface testing), test objects, verifies that new system functionality does not adversely impact existing system functionality and confirms security profiles for each job and role. The contractor shall document the System Test Results (CDRL M013) and provide them to the COR.

Regression Testing The contractor shall conduct regression testing that involves retest of all existing functionality to verify that defect resolution and additional functionality does not adversely impact existing functionality. The contractor shall document the Regression Test Results (CDRL M014) and provide them to the COR.

Performance Testing The contractor shall verify that the production system is capable of handling production-level user and transaction volumes while maintaining pre-determined system performance requirements. The contractor shall assess the performance characteristics of the hardware and software to manage risks by identifying and resolving performance issues. The contractor shall document the Performance Test Results (CDRL M015) and provide them to the COR.

User Acceptance Testing The contractor shall conduct user acceptance testing that will be facilitated by end-users, partnered with functional analysts, to provide confirmation that the product is ready for distribution and acceptable to the users. The contractor shall document User Acceptance Test Results (CDRL M016) and provide them to the COR.

Security Testing The contractor shall participate in the EPoS Certification Test and Evaluation and Security Test and Evaluation activities. The contractor shall ensure compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards as applicable and described in section 2.2.4 of this Task Order. In completing the steps in the RMF process, the contractor shall support the EPoS PMO in reviewing the detailed checklists and the results evaluation scripts for each Security Technical Implementation Guide (STIG) to support Security Readiness Reviews (SRR) and site self-assessments.

As directed by the COR, the contractor shall develop, review and update, as necessary, the test plans and reports in this section and shall make recommendations for mitigating residual risks.

The contractor shall support cybersecurity testing as detailed in section 3.3 Information System and Industrial Cybersecurity of this Task Order.

Production Readiness The contractor shall plan, develop and test software before releasing to the production environment ensuring the software is suitable to the scope of the requirement with respect to the application baselines and the type of software developed; and shall provide agile approaches as appropriate and as a part of an integrated design and development team working in shared development environments.

The contractor shall prepare and conduct a formal production readiness briefing to determine if the product is ready for production and to demonstrate adequate production planning. The contractor shall coordinate the date, time, location, and attendance for the briefing with the COR, representatives from the Government EPoS Program Management Office (PMO), DLA J62 PEO, and stakeholders in attendance. The contractor shall provide Read Ahead and Presentation Material (CDRL M017) to the COR 5 business days prior to the briefing. The contractor shall work with the PMO to determine if all requirements have been met for approval to move the solution to production. The contractor shall record the results of the briefing and submit to the COR in a Production Readiness Report (CDRL M018) within 10 calendar days after the briefing.

System Deployment The contractor shall plan, develop and conduct application implementation; deliver required implementation components (CDRL M019); demonstrate the solution; monitor use; verify that the solution works; verify accuracy of the products; verify interface and reports are in accordance with requirements; resolve problems.

Task 3: Mobile Device Application Software Sustainment The contractor shall provide the necessary software engineering, technical, programming, documentation and analytical services, as directed by this Task Order required to sustain the mobile device interface and application software. The contractor shall correct faults, improve performance or other attributes, and adapt the applications to a changing organizational and technical environment. The contractor shall support the resolution of problems discovered through the testing or operation of the mobile device interface and application software.

Sustainment Plan The contractor shall develop and implement a Sustainment Plan for the installed solution by site to ensure that the installed systems and equipment meet the requirements. The Sustainment Plan shall include the periodic maintenance, repair, replacement, and overhaul of existing systems, hardware, and software inclusive of Information Assurance Vulnerability Alerts (IAVA Patching).

The Sustainment Plan shall include the contractor’s approach to:

· Position qualified personnel, test equipment, etc. needed to quickly diagnose and make repairs

· Plan, perform, and document system confidence tests, periodic inspections, and preventive maintenance

· Identify critical system operations and implement strategies to prevent potential failures or administrative down-time from creating a critical system outage

· Analyze fault histories and fault trends to proactively predict and mitigate repetitive issues

The contractor shall develop and deliver to the COR a Sustainment Plan (CDRL M020) within 30 days after Task Order award.

Tier 1 Help Desk Support Tier 1 is the initial entry point for all customer support. This is where all initial customer information and problem definition data is collected, acted on, or forwarded to higher support echelons. Tier 1 provides limited technical and functional support of all applications, hardware, and software. Tier 1 support provides initial triage and proper routing for all problems.

The DLA Enterprise Help Desk (EHD) will provide tier 1 Help Desk Support. Instructions on EHD access and use will be provided at contract award.

Tier 2 Help Desk Support Tier 2 provides advanced technical and functional support of all EPoS owned applications, hardware, and software that are beyond the scope of the tier 1 analysts. Tier 2 analysts provide advanced and complex technical support for all EPoS applications.

The contractor shall provide tier 2 Help Desk support through technical assistance to the Government in resolving any problems associated with EPoS. These problems may include but are not limited to hardware or software failure or errors that hinder operations.

The contractor shall review and analyze production trouble tickets and propose fixes.

The contractor shall identify methods and mechanisms to actively assist system users in performing their tasks, minimizing the need to communicate with the help desk for items that are addressed by online system documentation or other methods.

The contractor shall provide issues, resolutions and timeframes related to tier 2 Help Desk support in the Weekly Status Report (CDRL M008).

Tier 3 Help Desk Support Tier 3 is support beyond the scope of the tier 2 analysts and includes functional application support and making recommendations for changes to the EPoS applications software or business processes.

The contractor shall provide tier 3 Help Desk support on tickets assigned to them and report on work done on those tickets to the EHD. Tier 3 is the support beyond the scope of tier 2 and includes functional application support and making recommendations for changes to mobile device interface and application software or business processes. It includes developers, subject matter experts, other representatives that are appropriate to ensure tickets for the EPoS software, both Commercial off the Shelf (COTS) and developed software, are resolved within the EPoS configuration management process.

The contractor shall support the resolution of problems discovered through the testing or operation of the EPoS mobile device interface and application software.

The contractor shall provide issues, resolutions and timeframes related to tier 3 Help Desk support in the Weekly Status Report (CDRL M008).

Problem Resolution The contractor shall work as an integrated team with Government personnel and other Government contractors supporting sustainment of the solution. The contractor shall assist the Government with continued interface support between the contractor’s application and upstream energy applications, currently FuelManager® Defense (FMD). The contractor shall use the system change process in use at contract award, currently Eagle Incident and Request for Change process to complete all changes to the system. Instructions on access to and use of the DLA change process will be provided at contract award.

The contractor shall perform all necessary research, analysis, and troubleshooting of work orders generated by a help desk ticket, to address problem issues with configuration management, cybersecurity, DOD Network, the contractor’s application and associated interfaces. The contractor shall coordinate and work with Military Services Local Area Network (LAN) Administrators and Information Operations technical staff at Fort Belvoir, Area Support Group (ASG) senior analysts, Service Control Points (SCPs) and other support activities involved with connectivity, configuration, and access to resolve problems. The contractor shall document the description of the problem and its resolution for the user and help desk in accordance with the ASG Standard Operating Procedure (SOP).

The contractor shall provide issues, resolutions and timeframes related to problem resolution in the Weekly Status Report (CDRL M008).

Conditions reported to the EPoS PMO for problem resolution shall be assigned a priority level 1 through 4 based on the following criteria.

capability, or violate security policy and procedures, for example, buyer is unable to obtain account ledger information or a seller is unable to obtain inventory ledger information in order to process base-level transactions.

capability; technical, cost, or schedule risks to the project; or the life-cycle support of the system. No work-around solution is known.

operational or mission-essential capability, and is non-value-added practice for development or support personnel, but does not prevent them from accomplishing their responsibilities.

Problem resolution standard response time will be in accordance with the table below. Response and resolution times are measured from the initial ticket assignment until the ticket is resolved.

System Response and Resolution Time Requirements

Post Production Support The contractor shall provide post production support. The contractor shall provide support to users, business process analysts, others as designated by the Government until the capability is within acceptable process and system performance thresholds; support the complete acceptance of the capability as it transitions to normal operations, support and sustainment. Within the first 30 days of a production release, any confirmed production problem associated to the contractor developed and tested components shall be resolved as part of post-production support even if a service ticket is created and assigned to the contractor.

Security Incident Reporting In addition to adhering to the reporting requirements as outlined in DFARS clause 252.204-7012, when the contractor discovers a cyber-incident that affects covered defense information or the contractor’s ability to meet the requirements of the contract, the contractor shall:

1. Provide the results of any reviews conducted for evidence of compromise of covered defense information or that affect the contractor’s ability to provide operationally critical support; including, but not limited to, identifying compromised computers, servers, specific data, and user accounts.

1. Rapidly report the incident(s) to the applicable Contracting Officer and the DLA Cyber Resilience Program Office (the point of contact information will be provided at the time of contract award).

1. Preserve and protect relevant artifacts (e.g., configurations, audit logs, packets, etc.) for at least 90 days from the submission of the cyber-incident report so that if it is deemed necessary, DLA’s Cyber Resilience Program Office or Cyber Emergency Response Team may request access to the artifacts.

1. Provide, as requested by the Contracting Officer on behalf of the DLA Cyber Emergency Response Team, access to additional information (to include damage assessment information gathered, etc.) or equipment that is necessary to conduct a forensic analysis related to an identified incident.

The contractor shall provide issues, resolutions and timeframes related to security incident reporting in the Weekly Status Report (CDRL M008).

Change or Release Requirement For any change or release, the contractor shall provide the following to the COR within 10 days of the scheduled change or release implementation:

· The Updated Software (CDRL M021)

· Software Version Description (SVD) – defining all the changes included in the software update (CDRL M022)

· Software Installation Plan (SIP) – defining how the software is to be installed at the Government site (CDRL M023)

· Developmental Plan and Results – results of contractor testing conducted prior to delivery (template to be agreed upon at time of Task Order award) (CDRL M024) Task 4: Mobile Device Delivery Oversight The contractor shall ensure oversight of the work complies with the requirements of this Task Order. The contractor shall develop Quality Control Procedures (CDRL M025) that address the areas identified in Section 5.0 Performance Requirements. The contractor shall submit the initial procedures 5 days after Task Order Award to the Contracting Officer’s Representative (COR)/Contracting Officer (CO) for review and approval. Any proposed changes to these procedures shall be submitted to the COR/CO in writing and the contractor shall not implement any changes until approval is received.

Task 5: Mobile Device Delivery Shipments shall be by the most expeditious traceable means at contractor expense at the lowest cost, consistent with security concerns and delivery timeframes.