EPoS_Attach_13_Group_2_Task_Order_1_Fixed_Software_Development_PWS_20170820.docx

GENERAL DESCRIPTION:

The contractor shall provide the necessary technical and subject matter expertise to accomplish the tasks described within the PWS of the Task Order (TO) on a Firm Fixed Price basis. The work shall be performed in accordance with all sections of this Task Order and the contractor’s proposal for the overall EPoS Indefinite Delivery Indefinite Quantity (IDIQ) effort for Group 2: Fixed Facility Devices. This Task Order will be the initial task order for this Group.

TECHNICAL PROPOSAL:

In accordance with the solicitation, Factor 1: Technical, Subfactor A: Technical Approach of the Solution, Subfactor B: Management Approach and Capabilities, and Subfactor C: Key Personnel Qualification under Group 2, the contractor shall provide a technical proposal that shall include:

1. A list of assumptions used in your proposal

1. Resumes of Key Personnel

1. Documentation demonstrating the contractor’s understanding of the TO PWS and the contractor’s proposed methodology and technical approach to completing the stated tasks. Additionally, the contractor shall provide a proposed plan (including milestones and timelines) for overall implementation and execution of project.

PRICING:

In accordance with solicitation, the contractor shall provide a firm fixed price proposal for this Task Order utilizing sample pricing sheet for task order provided in the attachment section of the solicitation.

Performance Work Statement (PWS) Table of Contents

ATTACHMENT 13

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services Group 2 Task Order 1 Fixed Facility Device Interface and Application Software Development PWS

Background, Objective and Operational Environment Background DLA Energy requires an electronic Point of Sale (EPoS) turn-key solution for capturing military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions and capturing aviation fuel transactions for mobile airfield/flight line operations that meets the current standards for Cybersecurity and Audit Readiness. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 80053r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security as specified in this PWS.

Turn-key is defined as immediately ready to use upon implementation and designed to fulfill the requirements including required interfaces.

Operational Environment The operational environment consists of sites described by the Government-provided site diagram and site requirements.

Task Order Scope Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of program deliverables, project status, project plans, and general Task Order oversight.

Fixed Facility Device Interface and Application Software Development The conceptual operational view of the solution is in Section C. Performance Work Statement, 4.0 Scope.

The contractor shall develop interface software that meets the requirements detailed in section 2.2.1 of this Task Order.

The contractor shall develop fixed facility device application software that meets the requirements in section 2.2.2 of this Task Order.

Interface Requirements The contractor shall provide an interface solution that:

· Interfaces with the Active Directory

· Interfaces with the inventory system of record Fixed Facility Application Software Requirements The contractor shall provide all personnel, equipment, tools, materials, supervision and other items and non-personal service necessary to deliver, install, test and ensure devices are operational at all Continental United States (CONUS) and Outside of Contiguous United States (OCONUS) locations listed in Attachment J.1.1, List of EPoS Fixed Device Locations.

0. Overall Device Requirements

· End-user training must come with the product and provided by the vendor upon initial fielding.

· User manual should be easily used by end users

· No formal in residence training post initial fielding training should be required to operate this program

· The data must be encrypted at rest and in transit using the National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2)

· Ability to update devices real time when changes occur (updates, password protect, etc.) as a whole, not individually

· All updates will be managed through a DLA Managed Active Directory Solution

· Push updates to devices wirelessly (Cellular or Satellite dependent on location)

· Transaction data must be secured at Service Station pedestals, handhelds or during transfer to the enterprise system

· User must not be able to manipulate, update or change data once a transaction has been completed

· The same system shall be used by all branches of military service using a standardized configuration

· The Vendor must provide an image for the GFE to be used with their Software that has had all applicable STIG’s applied when a change is made for the device configuration

· Image updates will be pushed through Windows Active Directory/Software management solutions

· Fixed facility equipment shall be provided as Contractor Furnished Equipment (CFE)

· System must be worldwide deployable and legal to operate in all Host Nations

0. Custody Transfer Device Requirements

· Automated capture of fuel sale transactions at unattended military service stations, via mobile fuel dispensers (e.g., trucks), aviation flight lines via hydrant systems or handheld devices, and in other environments where custody transfer of fuel is performed

· Transmits transactional data in accordance with data transfer standards for information integrity assurance to DLA Energy’s Enterprise Systems

· Utilizes current industry best practices to meet the DLA Energy needs and consists of established commercial items having documented commercial installation history and performance records, which demonstrate the system has a proven record of reliable field performance

· Supports Audit Readiness and DOD reporting requirements for validation of source media and transactional integrity by authenticating against the enterprise repository

· In the event that authentication does not occur within 15 seconds the device will failback to authenticate against a locally stored blacklist

· Provides secure data transfer technology that meets DOD/DLA IT security standards

0. Environmental Requirements

· The System must be safe to operate in a Class 1 Division 1 area

· In which ignitable concentrations of flammable gases or vapors may exist under normal operating conditions; or

· In which ignitable concentrations of such gases or vapors may exist frequently because of repair or maintenance operations or because of leakage; or

· In which breakdown or faulty operation of equipment or processes might release ignitable concentrations of flammable gases or vapors, and might cause simultaneous failure of electric equipment.

· Rain: Handle exposure to rain, water spray, or dripping water during storage, transit, or operation (Water Resistant)

· Salt (Salt Fog): The device shall be able to withstand high levels of salt in the atmosphere associated with operating in salt (marine) environment

· Sand and Dust: The device must resist the effects of sand and dust obstructing openings, penetrating into cracks, crevices, bearings, and joints degrading its effectiveness, reliability and maintainability due to abrasions or clogging

· The device screen must be easily viewable in low light and high glare environments

0. Electronic Communication Requirements

· All communications must be secured in transit using the National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2)

· The device shall electronically transmit captured transactional data to the centralized enterprise repository

· Vendor must provide internet connectivity for wirelessly obtaining lists of authorized source media and for the transmittal of transactional data to the enterprise solution

· Communications protocols will meet formats and specifications in section 2.2.1.12

· All transmissions must occur in the background and not prohibit the continued use of the device

0. Black Listed Transaction Requirements

· Must have the ability to have a self-contained black list of source media that is no longer a valid purchase media

· Must have the ability for the blacklist to be updated remotely using format specified in section 2.2.1.13

· The blacklist must be updated a minimum of three times daily, or during the first available connection in the event of loss of communications. The blacklist must also have the ability to be updated via a connection to a local computer in the event that the environment prohibits wireless communication

· All transactions initialized with authorized source media shall be validated against the black list if communication to the enterprise repository fails or is unavailable

0. Source Media Requirements

· Source Media is defined as source media authorized by DLA Information Operations for the purchase of products from DLA

· All source media must be validated before authorizing the transaction

· Must have the ability to be configured to accept one or more commercially used electronic purchase media (i.e. magnetic stripe card, radio frequency identification (RFID), smart card, Quick Response (QR) Code)

· Reconfiguration of the type of authorized source media must be completed remotely through the Active Directory

· The initial means shall be through magnetic stripe cards issued through the DLA Energy Card Management Office

0. Receipt Printing

· All devices must have the ability to print a receipt at the user’s option

0. Customer Identification

· Customer identification shall be completed by capturing the receivers full name (First Name, Last Name) from DOD and Federal PIV cards complying with FIPS 201 or state issued identification card complying with the Real ID Act of 2005

· If the Identification Card is not available or non-compliant with the above identified standards, the user must be able to manually type in the First and Last Name

· The device will be limited to capturing the required information from the identification card and will not be required to authenticate the customer’s identification.

0. Fixed Device Temperature Requirements

· High Temperature: 120 Degrees F Radiant, Low Temperature: 0 Degrees F ambient.

· Devices deployed in locations where the environment exceeds the operating range must have the capability of adding a vendor provided retrofit of heating and cooling mechanisms

· Retrofitted equipment must not change the Intrinsically Safe rating of the device

· High temperatures in some environments may exceed 150 degrees Radiant and may fall below -60 degrees

0. Fixed Device Requirements

· Must have an alternate method for obtaining transactional data in the event that the communication link is broken

· All direct interfaces with computers must meet all cybersecurity requirements

· Must have the ability to store 10,000 transactions in the event that communications fail

· Fixed devices shall be configured with the available fuel products through an update from the Active Directory solutions

· The device shall prohibit the dispensing of fuel until an authorized purchase media has been authenticated, and identification has been presented

· The device must allow users to input the odometer reading at the time of purchase

· The device must capture the user’s name

· User Identification shall be completed by the user inserting their Federally issued PIV or a driver’s license

· The device shall capture their name from the presented identification

· The device shall be configurable with facility specific information that shall be leveraged to capture the selling location information

· Information shall include Issuer Department of Defense Activity Address Code (DODACC), and Processing DODAAC

· The device must have the ability to be manually bypassed by the facility operator

· Access to the bypass must be secured

· the bypass must be secured

0. Card Authentication Data Because they contain sensitive data, the Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record for card authentication data as required by this Task Order at Task Order award.

0. Data Transmission Data Because they contain sensitive data, the Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record for data transmission data as required by this Task Order at Task Order award.

0. Blacklist Data Because they contain sensitive data, the Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record for blacklist data as required by this Task Order at Task Order award.

Information System and Industrial Cybersecurity The contractor shall develop a software solution that:

· Complies with the security control requirements documented in

· National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, "Security and Privacy Controls for Federal Information Systems and Organizations"

· NIST 800-82r2, "Guide to Industrial Control Systems (ICS) Security”

· NIST Special Publication 800-82 "Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security

· United Facilities Criteria (UFC) 3-460-01, “Design; Petroleum Fuel Facilities,” 17 June 2015

· UFC 4-010-06, “Cybersecurity of Facility-Related Control Systems,” 19 September 2016

· UFC 4-020-02FA, “Security Engineering: Concept Design,” 1 March 2005 as specified in this PWS

· Obtains an Authorizing Official (AO) Authority To Operate (ATO) by utilizing the Department of Defense (DOD) processes and procedures as defined in the DoD Instruction 8510.1 “Risk Management Framework (RMF) for DoD Information Technology (IT)” as implemented by DLA The contractor shall be responsible for:

· Performing preventative and analytical activities aimed at enhancing the overall cybersecurity posture of the solution associated with integration within DLA networks, information systems, and applications.

· Providing full cybersecurity support for the scope of the solution and services as stated below.

· Ensuring compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards as applicable.

The contractor shall provide cybersecurity support that includes:

· Enterprise Architecture Support and Compliance Support

· Cybersecurity Engineering Support

· Cybersecurity Certification and Accreditation (C&A) Services

· Cybersecurity Plan of Action and Milestones (POA&M) Services

· Cybersecurity General Support Services

· Applicable Cybersecurity Controls (Industrial Control Systems Enhancement)

· Controlled Unclassified Information (Contractor Internal Cybersecurity Controls) Tasks Task 1: Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of program deliverables, project status, project plans, and general Task Order oversight.

Project Management Plan The contractor shall prepare a Project Management Plan (PMP) (Contract Data Requirements List ((CDRL) D001) describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements for the proposed effort. The contractor shall provide the planning, supervision, coordination and controls necessary to accomplish all work contained in this PWS. The contractor shall document the approach and plan that defines the activities, tools, and techniques to ensure high-quality products that are defect-free, that meet PWS requirements and that are delivered in accordance with the approved schedule.

The plan shall include a description of the organization structure and assigned responsibilities, including the contractor staff that will deliver and implement this Task Order. The organization structure shall include the identification of key personnel. The contractor shall provide an organization chart and describe other corporate organizations that will support the team.

The contractor shall provide an explanation of how, within the scope of the Task Order, the contractor will perform technical management and will manage personnel and physical resources. .

The plan shall include a work breakdown structure (WBS) (CDRL D002) that shows tasks required to complete the work and the dependencies of each task. The WBS shall be detailed to the level of effort necessary to support the accomplishment of work to be performed under this PWS. The contractor shall deliver the PMP to the Contracting Officer’s Representative (COR) in a contractor proposed, Government approved format within 30 days of contract award.

Integrated Master Schedule The Integrated Master Schedule (IMS) is a time-based schedule containing the networked, detailed tasks necessary to ensure successful project/ Task Order execution. The IMS is traceable to the PMP, the WBS, and this PWS. The IMS is used to verify attainability of Task Order objectives, to evaluate progress toward meeting project objectives, and to integrate the project schedule activities with all related components.

The contractor shall produce and maintain an IMS (CDRL D003) that shows the activities required for the completion of tasks and deliverables for this Task Order. The contractor shall deliver to the COR a draft and baselined IMS within 30 and 75 calendar days after Task Order award, respectively.

The contractor shall deliver a Project IMS, with updated actuals, to the COR a minimum of two business days prior to each Monthly Performance and Progress Report (See section 3.1.5 of this Task Order). The IMS shall be delivered in a contractor proposed, Government approved format.

Risk Register The contractor shall apply a risk management approach to develop and maintain a risk register that documents and tracks contractor and Government identified project risks. For each risk, the register shall include at least a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur and a mitigation strategy. The contractor shall deliver a Risk Register (CDRL D004) resulting from the contractor’s risk management process to the COR within 30 calendar days of the issuance of the Task Order and provide updates as changes are made, at least monthly. The Risk Register shall be provided in a contractor proposed, Government approved format.

Monthly Performance and Progress Report The contractor shall monitor activities and deliverables under this Task Order and provide a Monthly Performance and Progress Report (MPPR) (CDRL D005) that describes project progress, costs, issues, problems and their status. The MPPR shall be the contractor’s method of reporting progress against the PMP. The period covered by the MPPR shall include the previous calendar month’s activities; any issues, actions or other MPPR reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings or other commitments. If applicable, travel costs shall be broken down by destination, duration, purpose, and costs for both monthly and cumulative to date. MPPRs for the previous month shall be delivered to the COR by the fifth day of the following month.

The MPPR shall include but not be limited to the following information:

· Summary of Activities

· Activities and Progress (Integrated Master Schedule)

· Software Engineering Metrics and Measures

· Costs

· Deliverables

· Significant Meetings

· Significant Issues

· Significant Plans

· Travel

· Action Item Status

· Risks to the contractor based on Government pending actions

· Risks to EPoS application performance based on contractor issues Briefing, Meeting, Conference Call Presentation Material and Minutes The contractor shall prepare briefing materials and represent the EPoS program at briefings, meetings and conference calls with organizations of interest, stakeholders, external and internal systems. This representation shall be at a level that functionally and technically represents EPoS mission and capabilities.

The COR or an authorized Government representative will be present at all briefings, meetings and conference calls. Read ahead and presentation materials (CDRL D006) shall be delivered to the COR five days prior to any meetings, briefings or conference calls, as required. If meetings, briefings or conference calls are scheduled less than five days in advance, the contractor shall provide read ahead and presentation material as soon as practicable.

The contractor shall document meeting notes including, but not limited to, any action items, status of action items, and summary of discussions. The contractor shall deliver these meeting notes (CDRL D007) to the COR no later than five days after the meeting. Approved meeting notes will be disseminated by the COR.

Kick-off Meeting The contractor shall schedule a kick-off meeting with the PMO, COR, and stakeholders within two weeks of award or as agreed on between the Government and contractor, to introduce the Government team to the contractor’s overall operating plans and approach to this work. The contractor shall present and deliver the Kick-off Meeting Briefing Presentation Material (CDRL D006) and be prepared to discuss the content of the Program Management Plan, to include the staffing plan, schedule and proposed metrics. The contractor shall produce and distribute Kick-off Meeting Minutes (CDRL D007) identifying all the discussion points, agreements and action items within five days following the meeting.

Task 2: Interface and Device Application Software The contractor shall provide the necessary software engineering, technical, programming, documentation and analytical services, as directed by this Task Order, in support of the requirements analysis, functional specification development, design, development/configuration, interface/integration, testing and deployment of EPoS interface and fixed facility device application software.

Configuration Management The contractor shall develop and execute a written configuration management plan that addresses product management and version control for changes to software, hardware, business processes documentation and all other control items. The contractor shall recreate all baseline deliveries from any point in time; support the EPoS configuration control governance structure; evaluate all changes to the approved system requirements baseline for risk to security, for schedule and cost impact; provide evaluations in writing and in sufficient detail to allow for review and approval by the configuration control governance structure as required.

The contractor shall develop and deliver to the COR a Configuration Management Plan (CMP) (CDRL D008) within 30 days after Task Order award. The contractor shall manage and document the hardware and software configuration baselines. The CMP shall address the process for any initial solution capability delivery changes, changes to the software, hardware, business process, documentation, or any other control item for the established baseline. The process shall also be sufficiently robust to recreate all baseline deliveries from any point in time; it shall address configuration management administration, configuration identification, configuration control, configuration status accounting, and configuration audit procedures for hardware, software, and documentation.

Business Requirements Analysis Using system and software engineering best practices, the contractor shall review, analyze, validate and manage requirements, software configurations and customizations.

Systems Specification Development The contractor shall analyze EPoS requirements and shall document them in two primary deliverables: the Software Requirements Specification (SRS) (CDRL D009) and the Requirements Traceability Matrix (RTM) (CDRL D010). The contractor shall employ an iterative process that involves continuous stakeholder participation in frequent and informal reviews and, as instructed by the COR, the contractor shall participate in meetings with the functional community to be clear on the requirements.

The Software Requirements Specification (SRS) is a document that details the decomposition of the requirements to a level which will support the design and development of the interface and fixed facility device application software.

The Requirements Traceability Matrix (RTM) is a document that links requirements throughout the validation process. The purpose of the requirements traceability matrix is to ensure that all requirements defined for the interface and fixed facility device application software are tested.

The contractor shall deliver the SRS and RTM to the COR as required by the IMS. The Government’s acceptance of the SRS and RTM is required prior to the contractor designing the EPoS interface and fixed facility device application software. The contractor shall use a documented and repeatable process for definition, collection, prioritization, and management of the requirement specifications in this Task Order.

Design The contractor shall prepare an Interface Control Document (ICD), Database Design Description (DBDD), Software Design Description (SDD), and other similar application/system Design Documentation (CDRL D011) based on an analysis of the requirements described in sections 2.2.1, 2.2.2, and 2.2.3 of this Task Order. The contractor shall translate that understanding into a System Design Specification (CDRL D012) to be used to develop the solution.

Development/Configuration The contractor shall design, configure, customize, develop, enhance and debug software. The contractor shall enact processes and practices that control or reduce system development costs and risks through a series of development reviews, including in-depth review of development items, technical accomplishments, and remaining technical risks and major tasks to be accomplished. The contractor shall obtain approval from the COR prior to integrating system applications.

The contractor shall deliver the Production Source Code, Executable Code, and a Software Version Description (SVD) (CDRL D013) to the COR.

Interface/Integration The contractor shall coordinate with external and internal entities that require interfaces including but not limited to the interfaces identified in the IDIQ; identify, design, develop and test necessary interfaces with external and internal systems; develop interface test requirements, strategies, devices and systems; participate in interface testing; resolve problems.

The contractor is responsible for coordinating/maintaining all EPoS interfaces and implementing interfaces on the EPoS side of the exchange, for this Task Order. Oversight of these interfaces will be provided by the COR.

The contractor shall prepare and maintain an Interface Design Description (IDD) (CDRL D014) for each interface to include incoming and outgoing traffic.

The contractor shall document all required interfaces in an Interface Control Document (ICD) (CDRL D015) and engage in technical interchange meetings and other coordination with the interfacing system representatives.

Testing The contractor shall provide testing to ensure system requirements are met. The contractor shall develop and maintain test scripts and architectures for application products; write, implement and report status for system test cases; analyze test cases and provide regular progress reports; provide testing procedures for the support of user requirements in applications; and provide inputs to risk management assessments on test design and test tools selection.

Section 508 Testing Testing shall ensure compliance with Section 508 of the Rehabilitation Act Amendment of 1998, which requires Federal agencies acquiring electronic and information technology to ensure that Federal employees with disabilities have access to and use of information and data that are comparable to the access and use by Federal employees who are not individuals with disabilities. IT products and services developed in response to this PWS are required to comply with Section 508 standards (available on the U.S. Access Board website at: www.access board.gov/508.htm) and the Federal Acquisition Regulation (FAR) both Subpart 7.103 and Subpart 39.2. The tools required by the DLA CIO include e.g. JAWS, Zoom Text, Dragon Naturally Speaking, and Kurzweil. The contractor shall document Section 508 Test Results (CDRL D016) and provide them to the COR.

Unit Testing The contractor shall conduct unit testing on multiple code modules or components and to execute the entire series of events surrounding a development object or configured transaction. The test shall include the transactions, the flow of data from the source system to the destination system through the architecture, and the completion of the developed actions in the destination system. The contractor shall document Unit Test Results (CDRL D017) and provide them to the COR.

Integration Testing The contractor shall conduct integration testing that combines and tests units to expose problems with the interfaces among solution components. The contractor shall document Integration Test Results (CDRL D018) and provide them to the COR.

System Testing The contractor shall conduct a system test that tests the solution at the business transaction level to ensure that all business events can support the EPoS mission and that end-to-end business processes function properly. The system test confirms interoperability between systems (interface testing), test objects, verifies that new system functionality does not adversely impact existing system functionality and confirms security profiles for each job and role. The contractor shall document the System Test Results (CDRL D019) and provide them to the COR.

Regression Testing The contractor shall conduct regression testing that involves retest of all existing functionality to verify that defect resolution and additional functionality does not adversely impact existing functionality. The contractor shall document the Regression Test Results (CDRL D020) and provide them to the COR.

Performance Testing The contractor shall verify that the production system is capable of handling production-level user and transaction volumes while maintaining pre-determined system performance requirements. The contractor shall assess the performance characteristics of the hardware and software to manage risks by identifying and resolving performance issues. The contractor shall document the Performance Test Results (CDRL D021) and provide them to the COR.

User Acceptance Testing The contractor shall conduct user acceptance testing that will be facilitated by end-users, partnered with functional analysts, to provide confirmation that the product is ready for distribution and acceptable to the users. The contractor shall document User Acceptance Test Results (CDRL D022) and provide them to the COR.

Security Testing The contractor shall participate in the EPoS Certification Test and Evaluation and Security Test and Evaluation activities. The contractor shall ensure compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards as applicable and described in section 2.2.3 of this Task Order. In completing the steps in the RMF process, the contractor shall support the EPoS PMO in reviewing the detailed checklists and the results evaluation scripts for each Security Technical Implementation Guide (STIG) to support Security Readiness Reviews (SRR) and site self-assessments.

As directed by the COR, the contractor shall develop, review and update, as necessary, the test plans and reports in this section and shall make recommendations for mitigating residual risks.

The contractor shall support cybersecurity testing as detailed in section 3.3 Information System and Industrial Cybersecurity of this Task Order.

Production Readiness The contractor shall plan, develop and test software before releasing to the production environment ensuring the software is suitable to the scope of the requirement with respect to the application baselines and the type of software developed; and shall provide agile approaches as appropriate and as a part of an integrated design and development team working in shared development environments.

The contractor shall prepare and conduct a formal production readiness briefing to determine if the product is ready for production and to demonstrate adequate production planning. The contractor shall coordinate the date, time, location, and attendance for the briefing with the COR, representatives from the Government EPoS Program Management Office (PMO), DLA J62 PEO, and stakeholders in attendance. The contractor shall provide Read Ahead and Presentation Material (CDRL D023) to the COR 5 business days prior to the briefing. The contractor shall work with the PMO to determine if all requirements have been met for approval to move the solution to production. The contractor shall record the results of the briefing and submit to the COR in a Production Readiness Report (CDRL D024) within 10 calendar days after the briefing.

System Deployment The contractor shall plan, develop and conduct application implementation; deliver required implementation components; demonstrate the solution; monitor use; verify that the solution works; verify accuracy of the products; verify interface and reports are in accordance with requirements; resolve problems.

The contractor shall configure the application for installation and sustainment; evaluate, recommend and implement tools and strategies required to monitor application performance; ensure technical requirements are met considering computer equipment capacity and limitations, operating time and form of desired results. The contractor shall provide the minimum software, hardware, and network infrastructure specifications necessary to support the solution.

The contractor shall make the interface and fixed facility device application software products available to the prescribed users; develop a Deployment Plan (CDRL D025) that details the deployment schedule, user registration and access control, on-site support for the execution of the deployment plan. The contractor shall provide on-site deployment support as required; ensure that the delivered capability complies with DOD cybersecurity requirements; follow a transition plan, as applicable; validate application configuration; assess configuration management processes; measure and monitor system performance and user acceptability.

Technical Architecture The contractor shall develop and execute an architecture plan that includes, at a minimum, the architectural process and approach, the architectures documentation or electronic models including hardware, connectivity, network infrastructure and components; associated IT software in terms of component functions, implementation techniques, and interfaces; storage, backup and recovery procedures, recommended administration procedures. The contractor shall comply with current Department of Defense Architecture Framework (DoDAF), Business Enterprise Architecture (BEA), and DLA Architectural standards. All architecture material will be usable by the Government without any specialized tools or software.

The contractor shall develop and update Enterprise Architecture (EA) Documents (CDRL D026) as required to assert to the DOD Enterprise Architecture (BEA) including but not limited to Operational, System and Technical Views required by DLA.

Systems Engineering The contractor shall provide engineering expertise to integrate the technical efforts described in each Task Order related to the design, development, testing, configuration, implementation and sustainment of the system baselines and their life cycles. The contractor shall provide the technical information to support program management to include the definition and management of each system configuration as it changes.

The contractor shall provide engineering expertise to support a systems engineering management process that provides mutual support for a solution specific System Engineering Plan (SEP) based on DOD and DLA guidelines. The contractor shall develop and adhere to a SEP (CDRL D027).

System Documentation The contractor shall develop and maintain Documentation (CDRL D028) for all capabilities delivered in a contractor proposed Government approved format as required by this Task Order that includes but is not limited to:

· System/Subsystem Specification

· Logical and Physical Data Models

· Database Specifications

· Software Test Plan

· System/Subsystem Design Description

· Application, Physical Architecture, Other Architectures

· User’s Manual

· Operator’s Manual

· Database Management Procedures

· Source Code

· Functional Requirements

· Design Documentation Task 3: Information System and Industrial Cybersecurity The contractor shall ensure compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards detailed in section 2.2.3 of this Task Order as applicable.

Enterprise Architecture Support and Compliance Support The contractor shall provide Enterprise Architecture Support and Compliance support to assist DLA in ensuring compliance with DOD and DLA cybersecurity policy and perform the daily activities required for successful cybersecurity Architecture. The contractor shall develop:

· DODAF Diagrams/Models for the solution (CDRL D029)

· Implementation Plan for Solution Cybersecurity Architecture (CDRL D030) Cybersecurity Engineering Support The contractor shall provide systems engineering and engineering support as identified in individual tasks for the solution. The contractor shall develop Cybersecurity Engineering Documentation (CDRL D031) to support this effort that includes, but is not limited to the following requirements

· Developing network models

· Providing technical support in assessing the function, security vulnerability, usefulness,

· and potential applications of current and future technology

· Participating in modifications and improvements to existing cybersecurity products

· Supporting and engineering cybersecurity solutions for the upgrade of the solution to conform to Federal, Department of Defense (DOD), or DLA initiatives such as Defense-in-Depth (DID) and Department of Defense Information Network (DODIN) Joint Information Environment (JIE)

· Providing advice during technical reviews and selection, development, and testing of cybersecurity components

· Providing technical support in assessing the function, security vulnerability, usefulness, and potential applications of current and future technology, available from commercial, Government, or other sources.

Cybersecurity Assessment Program (CAP) Support DLA relies on information systems to carry out its mission and business functions in a global setting. These systems are susceptible to exploitation through targeted attacks, natural disasters, and human and system errors. Compromise of any information system could jeopardize DLA’s logistical operations and endanger other organizations and national interests. To combat these threats, the Department of Defense utilizes cybersecurity as its first line of defense.

Cybersecurity is the collection of tools, policies, security concepts and safeguards, guidelines, training, and best practices, used to protect the cyber environment, and organizational assets. These assets include connected computing devices, applications, services, telecommunications systems, and the transmitted or stored information in the cyber environment. Cybersecurity strives to ensure the confidentiality, integrity, or availability of such information.

DLA has developed, documented, and implemented the Cybersecurity Assessment Program (CAP) to ensure the confidentiality, integrity, and availability of its information. CAP consists of two major subprograms: the COMSEC Assessment and Assistance Program (not part of this PWS) and the Cybersecurity Compliance Review Program (CCRP). CAP was designed to improve the cybersecurity posture of DLA.

The contractor shall provide CAP Documentation (CDRL D032).

Command Cyber Readiness Inspections (CCRI) CCRI inspections utilize the DISA FSO Security Technical Implementation Guides (STIGs), checklists, USCYBERCOM Communication Tasking Orders, and USCYBERCOM CCRI contributing factors as the evaluation criteria to validate compliance with DOD cybersecurity policy, best practices, and configuration requirements. DLA performs two types of CCRIs; staff assistance (SA), and formal. Formal CCRIs are performed as prescribed by the USCYBERCOM published schedule. SA CCRIs are generally performed in conjunction with CVAs. The same methodology is used for both types of CCRI. The contractor shall assist DLA in its CCRI efforts by developing and/or updating the DLA CCRI Methodology (CDRL D033) that defines the approach, actions and appropriate responses used in conducting an inspection. The contractor(s) shall participate in CCRIs, as directed by the Primary or Alternate CORs.

Penetration Testing Support DLA employs Penetration testing to evaluate the security of a computer system or network by simulating an attack from outside and inside DLA’s network boundary. The contractor shall assist DLA in its compliance assessment efforts by developing and/or updating the Penetration Testing Methodology (CDRL D034) that defines the approach, actions and appropriate responses used in conducting a test. The contractor(s) shall participate in Penetration testing, as directed by the Primary or Alternate COR. Testing done outside DLA’s network boundary will be accomplished from a safe, secure facility under the contractor’s control.

Cybersecurity Certification and Accreditation (C&A) Services The contractor shall provide cybersecurity program support to assist DLA in ensuring compliance with DOD and DLA cybersecurity polices and perform the daily activities required for successful C&A program completion.

· C&A Control Compliance Validation Support

· C&A Process Support

· C&A Analysis Support

· C&A Coordination Support

· C&A Security Documentation (CDRL D035) Support Cybersecurity Plan of Action and Milestones (POA&M) Services The contractor shall be responsible for monitoring and tracking the status of all Plans of Action & Milestones (POA&M) weaknesses through to a resolution for DLA.

· POA&M Process Support

· POA&M Analysis Support

· POA&M Coordination Support

· POA&M Documentation (CDRL D036) Support Cybersecurity General Support Services The contractor shall provide general cybersecurity engineering capabilities and services per individual tasks. General support includes:

· Quality Assurance Support

· Program Reviews Support

· Centralized Administrative, Clerical, Documentation and related Support

· Progress/Status Reporting Support (Include in MPPR CDRL D005) Federal Information Security Management Act (FISMA) Tracking and Reporting Not applicable.

Applicable Cybersecurity Controls (Baseline) Not applicable.

Applicable Cybersecurity Controls (Industrial Control System Enhancements) The solution shall comply with the specific requirements in IDIQ PWS, section 5.6.10 in accordance with the security requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. It is important to note that the IDIQ PWS section 5.6.10 controls were derived from a preliminary system categorization utilizing the processes and procedures defined in the Federal Information Processing Standards (FIPS) Publication 199. The preliminary system categorization for Confidentiality, Integrity, and Availability (CIA) is MODERATE overall.

It is important to note, not all of the controls cited will be the responsibility of the contractor; however, the contractor shall be prepared to provide support services as required.

Cybersecurity controls are specific to Supervisory and Data Acquisition (SCADA) Systems and other control system configurations such as Programmable Logic Controllers (PLC).

Controlled Unclassified Information (Contractor Internal Cybersecurity Controls) In support of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”, the contractor shall:

· Provide a complete Listing of Information System(s) (CDRL D0037) owned and operated by the contractor and a System Security Plan (SSP) (CDRL D038) document that, at a minimum, specifies that security controls be implemented for the applicable information system(s) internal to the contractor or as outsourced (Subcontracted).

0. Access Control

0. Audit and Accountability

0. Configuration Management

0. Identification and Authentication

0. Incident Response

0. The contractor shall provide all applicable incident response plans and procedures

0. Media Protection

0. Personnel Security

0. Physical Protection

0. Security/Risk Assessments

0. The contractor shall include verification of the most current assessment performed (this may include an actual report of findings/vulnerabilities/etc.)

0. System and…