DRAFT_-_Attn_4_-_Statement_of_Work.pdf

DRAFT – Attachment 4 – Statement of Work

SSA-RFP-17-1001

DISCLAIMER: THIS DOCUMENT, INCLUDING ALL ATTACHMENTS REFERENCED HEREIN, IS IN

DRAFT FORM, AND DOES NOT REPRESENT THE FINAL VERSION OF THE REQUIREMENTS AND

ASSOCIATED SERVICES REFERENCED HEREIN. INTERESTED PARTIES SHOULD SUBMIT

WRITTEN COMMENTS TO THE INDIVIDUAL NAMED IN THE FEDBIZOPPS NOTICE ON OR

BEFORE THE DATE AND TIME SPECIFIED IN THE NOTICE TO BE CONSIDERED IN THE

FORMATION OF THE FINAL VERSION.

STATEMENT OF WORK

1 PURPOSE

2 BACKGROUND

3 SCOPE

4 TASKS

5 CONTRACTOR COMPETENCIES/EXPERIENCE REQUIREMENTS

6 PLACE OF PERFORMANCE

7 PERIOD OF PERFORMANCE

8 GOVERNMENT-FURNISHED PROPERTY

9 GOVERNMENT-FURNISHED INFORMATION

10 HOURS OF OPERATIONS AND CONTRACTOR PERFORMANCE

11 DELIVERABLES/DELIVERABLES SCHEDULE/REPORTS

12 MONTHLY PERFORMANCE ASSESSMENT REPORTS

13 Attachment A – Hardware, Software, Tools and Technologies List

1 PURPOSE

The purpose of this Enterprise-Wide, multiple award, Indefinite-Delivery, Indefinite-Quantity

(IDIQ) contract is to acquire Information Technology Support Services for the Social Security

Administration’s (SSA) mission oriented information technology (IT) business functions and initiatives. The Contractor must provide all services under this contract in accordance with the terms and conditions of their subsequent contract.

2 BACKGROUND

The agency is responsible for administering one of the Nation’s largest entitlement programs – the Old Age, Survivors, and Disability Insurance program. We also administer the Supplemental

Security Income program, which provides financial support to aged, blind or disabled adults and children with limited income and resources.

We anticipate that the principal business functions of the agency will increase over the next decade due to the influx of over 70 million baby boomers. Because workloads in most critical areas will increase, we will continue to rely heavily on increased automation to provide high quality secure services to the public’s changing needs, delivered more efficiently, faster and at lower cost. We will continue to modernize our systems, particularly in the internet environment to achieve agency goals and objectives as outlined in the Vision 2025 document.

Vision 2025 has three priorities: a superior customer experience, exceptional employees, and an innovative organization.

To create a superior customer experience in 2025, we provide customer choice, personalized service, customer-centric technology, accurate information, and secure systems.

To create an innovative organization, we build and maintain a customer-centric infrastructure, cultivate a data-drive culture, provide continuous improvement, create smart rules, policies, and procedures, use fraud detection and program integrity, integrate health information technology, and enhance inter-organization data-sharing.

We are committed to improving productivity and customer service quality through technical innovation. Our deployment of state-of-the-art hardware and software will provide our employees with the tools to deliver excellent customer service to citizens. In addition to being able to implement service improvements and processing, our systems must be able to reply swiftly to legislative changes.

The hardware and software technologies from which we will be able to choose to reengineer and to build the future information systems architecture, present a major challenge. The challenge is how to select, apply, and control evolving hardware and software components at a reasonable price while meeting the changing information systems requirements of the agency and the citizens it serves.

The Federal Information Security Management Act (FISMA) and Office of Management and

Budget (OMB) federal security policy requires Federal Agencies to manage information security risks throughout the System Development Life Cycle (SDLC). This requires executing appropriate risk management practices and security control testing for a variety of specific circumstances throughout the SDLC.

OMB’s February 2011 Federal Cloud Strategy outlines the benefits of migrating to cloud services, including acceleration of data center consolidation and better utilization of existing infrastructure assets. SSA recognizes that cloud computing has the potential to increase our responsiveness to changing business and service delivery requirements.

Under the multiple-award contracts, Contractor services will include providing information technology (IT) services to support our Systems Development Life Cycle (SDLC) in support of our mission critical goals and objectives, especially those activities related to the continued and expanded use of IT products and services. The primary customers of these services are our component offices responsible for the maintenance, development, and evolution of our IT and telecommunications capabilities, as well as other offices that perform programmatic functions impacted by these capabilities.

This SOW will provide services to multiple programmatic areas within the agency that use the agency’s IT infrastructure. The programmatic areas include the Office of Budget, Finance, Quality, and Management, Office of Communications, Office of Disability Adjudication and

Review, Office of Human Resources, Office of Operations, Office of Retirement and Disability

Policy, Office of the Inspector General, and the Office of Systems.

3 SCOPE

Provide the expertise, technical knowledge, IT support personnel, and other related resources necessary to support the following areas:

A. Lifecycle activities for software improvement and web/interface;

B. Database and data administration;

C. Software engineering and management support;

D. Systems administration and systems security support; and

E. Contract Management

4 TASKS

[Note: The Government will define specific requirements at the individual task order level.]

A. Lifecycle activities for software improvement and web/interface

The Contractor must:

Provide lifecycle activities for software improvement and web/interface design including, but not limited to: planning, business process/application analysis, requirements definition, design alternatives, user-centered design, development, testing/validation, user-centered testing, accessibility compliance testing, integration, implementation, deployment, and training for waterfall, hybrid and agile methodologies.

Provide application and business planning, analysis, requirements, application design, development, testing, maintenance, and validation support for the Agency’s programmatic, administrative, business intelligence, and strategic analysis software applications.

Provide training for agile software development principles and techniques to software development teams and provide technical expertise in agile coaching, test driven development and guidance to project managers.

Other areas of support include:

Best Practices and Software Development Methodologies: Include adoption support of Agile and DevOps; unless assumed by PRIDE references.

Cloud, Big Data, Analytics, and Modernized Development Environment (MDE):

o Cloud Infrastructure strategy and adoption support, including but not limited to, analysis of FedRAMP approved cloud-based solutions that maintain alignment with SSA’s Cloud Computing Policy and Cloud

Adoption Criteria.

o Technology support for Cloud/Cloud-based solutions, Analytics, and our

Modernized Development Environment (MDE).

o Stewardship over cloud-based solutions in partnership with internal infrastructure support or vendor support relationships.

o Big Data strategy and adoption support, including but not limited to: (1) analysis and development methods for staging source data in agency approved data analytics repository or enabling the Data Lake repository concept, (2) analysis, design and development methods for solutions that appropriately leverage Analytics for both real time and long running business scenarios using agency approved security and analytics infrastructure and (3) analysis, design and development of modernized

Enterprise Data Warehouse from authoritative data sources using agency approved security, tools, infrastructure and architecture.

o Assistance with General Accounting Office (GAO)/Federal Risk and

Authorization Management Program (FedRAMP) acquisition guidelines procedures, following SSA Cloud Computing Policies, and Agency

Cybersecurity guidelines, including but not limited to the Agency

Information Security Policy (ISP).

o Working in an MDE, including but not limited to on-premises cloud from

SSA data centers or external cloud.

Software System Profiling and Performance Tuning support.

Automated testing and test driven development, continuous integration, and deployment on demand.

Development of code in modern and open source code languages (e.g. Java or

Linux vs COBOL) that provide ease of maintenance;

Utilization and development of automated testing for repeatable, reliable, efficient testing for the ability to work effectively using continuous integration and deployment tools;

Expertise in the following:

o Emerging technologies in software improvement and web and interface design and development, as well as security best practices for new and emerging technologies;

o Web and interface integration with backend or partner systems for efficient transactions;

o Customer facing technologies: chat, video, audio integration with web development and online collaborative tools;

o Expertise in web portal design and high transaction volume portals and exchanges for utilization of Big Data technologies to drive analytics for predictive modeling and strategic decision-making;

o Cloud technologies and development frameworks for development, deployment, and evolution of business operation;

Expertise and support for the business development, technical design and implementation of anti-fraud related tools, software, and techniques.

Expertise and support in advanced fraud detection technologies and techniques to identify fraudulent behavior, including identifying best practices in cybersecurity and fraud prevention.

Expertise in security and privacy governance and compliance with Federal laws, Directives, OMB and DHS instructions, NIST standards and guidance, and all

Federal cyber security policy and initiatives;

Expertise in cloud computing technology and best practices, including FedRAMP requirements and guidance; and

Other relevant technologies.

Note: Ensure all deliverables and modifications are compliant with agency policies

(including Section 508). Prepare all deliverables in accordance with SSA’s Software

Process Improvement Guidelines, the Project Resource Guide (PRIDE) where appropriate, and all of the other agency standards, guidelines, procedures, and architectures for mainframe, local, and distributed applications, as well as the Section 508 and Institute of Electrical and Electronics Engineers standards. The Contractor must adhere to the agency’s data naming and definition conventions, screen formats, source code language, and automatic source code generators. The agency will provide the

Contractor with applicable material (e.g. policies, guidelines, procedures, etc.) at the task order level for those areas where standards may vary given the specific requirement(s).

The agency provides all other applicable material (e.g. policies, guidelines, procedures, etc.) at the contract level under Section D - Contract Documents, Exhibits and/or

PRIDE is the agency’s web-based guide for project managers and project teams. It is designed to aid in the planning and execution of project lifecycle activities and is the repository for Project lifecycle models; Activities and work products; Work product templates and procedures; Policies and directives; Project management resources;

and Standards and guidelines.

Attachments.

The Contractor must ensure they meet requirements under Section 503 of the

Rehabilitation Act established in 2014.

B. Database and data administration

Technology and data analytics give the agency faster access to more and better data. The agency has streamlined processes and procedures to minimize errors while continuously monitoring transactions for potential program abuse and respond quickly to the possibility of incorrect payments. The agency designs the entire customer experience by relying on data and analytics tools to improve processes, policies, and service delivery.

Provide technical database and data administration support across multiple platforms.

This includes, but is not limited, to z/OS, WebSphere, UNIX, LINUX, and Microsoft

Windows. These architectures, standards/guidelines may include, but are not limited to:

the use of CICS, COBOL, ALC, Java, SAS, Structured Query Language (SQL), Oracle

PL/SQL, CA-IDMS, DB2, DB2 UDB for Multi-platforms (UNIX hosted DB2), Microsoft SQL Server, Microsoft SharePoint Server, Oracle, and SSA data naming and definition conventions.

Provide support in the areas of data warehousing, content management, data analytics, stored-procedure programming, SQL programming, database migration, Web/Internet-based database access and modern Big-Data Hadoop-related storage and compute platforms. Resources must have expertise in supporting Business Intelligence (BI) and

Extract, Transform and Load (ETL) languages/tools.

Provide security and assurance knowledge to ensure the confidentiality, integrity, and availability of SSA data – including sensitive data.

Provide expertise and support in various methods/technologies in capturing and evaluating historical data and using predictive analytics to identify and model future needs of customer.

Provide expertise in data management, business intelligence, and analytics tools that enhance quality and performance.

Technical Background:

Substantial mainframe code is written in Common Business-Oriented Language

(COBOL), Assembler Language Code (ALC), FORTRAN, and uses VSAM, DB2 (via

SQL or stored procedures), CA-IDMS/DB databases, and/or a proprietary file management and control system called the Master Data Access Method (MADAM).

Mainframe systems include batch as well as online CICS applications.

http://www.dol.gov/ofccp/regs/compliance/section503.htm http://www.dol.gov/ofccp/regs/compliance/section503.htm

Current front-end code is primarily written in JAVA language and uses IBM Rational

Application Developer for WebSphere Software V7.0 as the full function Eclipse 3.2 based development platform for developing Java 2 Platform Standard Edition (J2SE) and

Java 2 Platform Enterprise Edition (J2EE) applications.

IBM iSeries application development that runs in each State Disability Determination

Service (DDS) office. These are part of the Agency’s Disability programmatic processing. This code is developed both in-house and by vendors.

IBM’s WebSphere MQ is a message-oriented middleware used for asynchronous, guaranteed data transfer between locations, platforms, and applications; for example, State DDSs and SSA’s Central Office.

Distributed production applications run on UNIX (presently Sun Solaris) using

WebSphere or ColdFusion with DB2 on mainframe or Oracle (presently on HP-UX

UNIX) as the distributed relational database management system (DBMS). These are transitioning toward Red Hat LINUX.

End-user computing uses Windows Server and Microsoft SQL Server databases for applications not requiring high-end reliability, availability, and scalability or tight integration with programmatic SDLC processes.

There is some use of Web 2.0 technologies (blogs, Wikis, video sharing sites, etc.), change management tools (SourceSafe, CVS, etc.) and tools such as Macromedia Studio

MX Suite (Dreamweaver, Flash Professional, Fireworks, FreeHand, ColdFusion), Adobe

Creative Suite (Photoshop, ImageReady, Illustrator, InDesign, Acrobat), file transfer protocol (FTP), and audio editing software, understanding of Macromedia Authorware, Hypertext Markup Language (HTML) editors, JavaScript, JAVA, JSP, ColdFusion

Markup Language (CFML), Extensible Markup Language (XML), and Ruby on Rails.

There is some WebFocus development, WebFocus Developer Studio (Release 7 and above), Dashboard Development, MRE Administrator, using Report Caster/Report

Library, Focus programming (SQL, DB2, VSAM, and Hyperion.

C. Software engineering and management support

Assist the agency in all aspects of software engineering management. The Contractor must assist SSA in planning for the integration of systems into the cooperative processing architecture and establishing a baseline and controlling changes within each system.

Provide support to the agency’s software engineering community, users of the Enterprise

Software Engineering Facility (ESEF) and the production infrastructures, which include the Management Information Services Facility (MISF), Document Management Facilities

(DMF), and Programmatic Processing Facility (PPF). The ESEF is a general-purpose multi-platform computer facility dedicated to the interactive development, testing, validation and maintenance of SSA’s programmatic and Admin/BI software systems.

There are eleven general areas of support:

CICS Internals and Generations

Mainframe, Unix, Open Source/z-Linux, Cloud, LAN Applications Engineering &

Management Support

Networking on Multiple Platforms

Performance Analysis, System Monitoring, and Tuning

Quality Control

Software Release, Testing/Evaluation, and Problem Resolution

Systems Security and Access

IWS/LAN, Unix, Linux, Intranet/Internet, Cloud and Mobile Security

Tool Market Research, Evaluation, Integration, and Support

Help Desk

Version Management

Typical activities performed under this technical area are included in, but not limited to, the following list; more detailed, but not all-inclusive, activity descriptions follow below.

Alternatives Analysis

Backup and Restore of Application Data

Backup Software for Disaster Recovery

Business Re-engineering

Configuration Management

Cost Benefit and Return on Investment Analyses

Feasibility Studies

Function Point Measurements

Independent Verification and Validation

Quality Control/Quality Assurance

Requirements Management

Software Accessibility in Compliance with Section 508 Regulations

Software Benchmarking and Capacity Studies

Software Inventory Control

Software Process Improvement

Software Standards

Software Tool Assessments

Software Usability

Transition Planning for New Architectures

Windows/Software task automation through script generation

Areas of support as it relates to technologies affecting current and future SSA initiatives:

Software engineering methodology including Agile, Cloud, DevOps, and virtualized infrastructures or Platform as a Service (PaaS) as appropriate for SSA;

Software engineering technologies that support SSA Strategic IT and Enterprise

Architecture Roadmaps: Mobility, video, customer service delivery infrastructure, test methodology, architecture and automation to include virtualized environments, Linux environments, etc.;

Software engineering approaches that leverage open source code to speed development timeframes and ease code maintenance;

Implementation and utilization of Business Intelligence (BI) analytics tools and systems to provide decision analytics capabilities; and

Software engineering services to pilot or prototype new technologies for customer service.

The IV&V activities must be performed on systems/projects developed in-house and/or by another Contractor, including:

Review and assess the adequacy of technical and management approaches;

Perform an unbiased assessment of actual project status;

Review system development lifecycle products;

Conduct independent system testing and/or monitor the testing conducted by others;

Analyze System Development Team Practices/Performance;

Assess risk areas in the systems being built;

Conduct Post-Implementation Reviews of Developed Systems;

Monitor/Validate; and

Facilitate integration and use of Agile techniques around continuous improvement and support for continuous test approaches.

D. Systems Administration and Systems Security support

Provide technical server support and maintenance across multiple platforms including, but not limited to: z/OS, WebSphere, UNIX, Red Hat Enterprise Linux (RHEL), VMware, Microsoft Windows, Apple environments, Mobile Technology, Cloud

Computing and Virtualization.

Provide systems administrative technical support for Operating Systems including z/OS, WebSphere on z/OS, UNIX, LINUX, and on Windows platforms. Contractor support may include, but not be limited to, the following types of activities:

Installing, configuring, administering, and troubleshooting z/OS , Windows, Red

Hat LINUX, VMware, Solaris/UNIX 10 or 11 (or currently supported versions) operating systems as well as troubleshooting Solaris/UNIX hardware and software and taking corrective action;

Performing daily network and systems administration tasks;

Performing user administration for development, validation, and user tools;

Providing support for application developers; and

Installing, administering, and troubleshooting WebSphere servers (WAS 7.1 and

WAS 8.5 or currently supported versions) on a Solaris/UNIX platform or Red Hat

LINUX implementation.

Provide systems security and engineering support including, but not limited to, the following activities:

Performance analysis/system monitoring, and tuning;

Quality control support to the software engineering community;

Participate in the testing/validation of software changes;

Participate in the evaluation and implementation of metrics tools to access software quality control adherence;

Update quality control procedure documentation;

Participate in ongoing software security projects;

Participate in testing of new versions of security and access control software;

Review and revise security and access control reports pertaining to users, their access privileges and the use of resources;

Provide assistance to application developers with IWS/LAN and intranet/Internet security procedures and resource/data access problems;

Provide assistance to application developers with integrating security into SSA’s applications for the IWS/LAN and the intranet/Internet;

Design and development of IWS/LAN and intranet/Internet to mainframe security systems; and

Provide continuous and responsive Help Desk support, problem resolution, and software consultation to the user of the various engineering and production facilities.

Provide support to establish and maintain systems in the cloud on Linux, as well as installing/administering open source tools and platforms in the MDE.

Maintain compliance with security policies defined by the Chief Information Security

Officer, Office of Information Security (OIS) and the Agency Information Security

Policy (ISP).

Provide systems administrative technical support for WebSphere on z/OS, on UNIX, on

LINUX, on VMware, and on Windows platforms, and for each of the Operating Systems platforms. Contractor support may include, but not be limited to, the following types of activities in order to assure SSA of robust development, validation, and tools environments.

Building, installing, configuring, administering, troubleshooting and resolving problems for infrastructure devices (e.g. Windows 2012, or current version servers; HP UNIX systems; Virtual Hosts using Microsoft Hyper-V or VMware hypervisors; SAN equipment in support of Open Systems);

Developing, Building, Installing, configuring, administering, and troubleshooting

HP/Solaris/UNIX to include but not limited to:

o Servers;

o Daily network and systems administration and troubleshooting;

o Operational collaboration on performance and space;

o Developer and user administration application support;

o User tool development and validation;

o Distributed platforms; and o MKS interface;

Develop, Build, Install, configure, and administration of WebSphere (WAS) to include but not limited to:

o Program and project management oversight and reporting;

o WebSphere servers (WAS 5.1 and WAS 6.1 or current versions;

o z/OS, UNIX, and Windows;

o Servers;

o Multi-node network;

o Lightweight Directory Access Protocol (LDAP) security;

o DB2 connect;

o Oracle Client; and o Setting up the servers and directories.

Installing, configuring, and using SunOne Web Server.

Installing, configuring, and using Sun Java System Web Server.

Maintaining compliance infrastructure security procedures defined by the

Division of Information Systems Security Administration and Operations

(DISSAO).

Maintaining data files and monitoring systems configuration.

Patching, updating, and upgrading hardware, systems software, and application software.

Architecting, configuring, and maintaining the EMC Storage Area Network

(SAN) infrastructure.

Maintaining the Sunray environment.

Implementing and administering Backup and Recovery software (Veritas

NetBackup) to support disaster recovery for infrastructure as well as developers.

Testing, configuring, and implementing fail-over software to support critical developer applications.

Installing, configuring, and using eTrust Access Control.

Resolving eTrust issues.

Installing, configuring, and using IBM HTTP server.

Installing, configuring, and using Webmin.

Installing, configuring, and using Apache.

Writing scripts to automate repetitive administration tasks.

Scripting the deployment of software when applicable.

Maintaining existing scripts.

Upgrading and maintaining the Java Development Kits (JDKs) on all appropriate servers.

Configuring IHS and interpreting IHS logs.

Working with Java code and J2EE.

Providing guidance to software developers about systems requirements.

Presenting project status reports and other information to technical staff, customers and management.

Coordinating repairs and maintenance with vendors.

Building new WebSphere cells and performing upgrades and maintenance when needed.

Maintaining the WASIPM Website.

Updating WebSphere support documentation.

Providing z/OS support for MKS interface for WebSphere deployments.

Working with z/OS operational personnel to identify WebSphere performance issues.

SAN equipment tape library backup and recovery process for all critical server data.

Design, Develop, implement, support, and maintain the following, not all-inclusive, SSA

Networking Areas:

WAN;

LAN;

Routers (mainly Cisco);

Network Switches (mainly Cisco);

Network Access Control (NAC);

Video;

Wireless Technology;

Virtual Private Network (VPN);

Firewalls; and

Application Load Balancing Technology.

The SSA deploys call center services at the Teleservice Center (TSC) sites using sophisticated technologies and features such as Voice over Internet Protocol and

Intelligent Network Routing. In addition to the Call Center Network, the Agency also provides the National 800 Number Network and its associated self-service automation applications that allow callers to easily perform many common tasks without requiring the assistance of a TSC agent.

SSA requires Contractor staffing to support transition, maintenance and enhancement activities of SSA’s Call Center Systems solutions. Support is needed for telecommunications engineering, including Call Center, Intelligent Network Routing, Automated Telephony Application, and Management Information Support.

Provide Data Center Optimization Management (DCOM): including Internal Cloud

Management Services, Convergent Monitoring, Hardware Containment Optimization strategies and Cloud Services chargeback/show-back experience.

Provide cyber security support for OMB, DHS, and Agency initiatives, such as

Information Security Continuous Monitoring Mitigation (ISCM), Identity, Credential, and Access Management (ICAM), Anti-Phishing & malware defense (APMD), Continuous Diagnostics and Mitigation (CDM), and Federal Cyber Strategy.

Provide expertise in industry-leading cybersecurity practices and tools.

Provide support in monitoring agency systems for specific network vulnerabilities, threats, and larger-scale events in the digital environment as part of the agency’s cybersecurity strategy in order to quickly address weaknesses and prevent cyber intrusions.

Conduct risk assessments, vulnerability and compliance scans, penetration testing, and other Security Assessment and Authorization (SA&A) activities in compliance with

FISMA and FedRAMP, and applicable laws, directives, instructions, standards, and guidance, as well as the Agency Information Security Policy (ISP).

E. Contract Management

Contract Management (CM) ensures that the technical tasks performed by the Contractor will be effectively planned, staffed, and managed. It also ensures the effective interaction of senior contract managers with the Contracting Officer (CO) and Contracting Officer's Representative

(COR) on planning, management, technical reporting, and performance issues. CM is under the same performance measurement and Government control as the technical tasks.

Labor expenditures that support technical task orders but cannot be appropriately charged to an individual technical task order must be charged to CM. Such labor expenditures include

Program Director, Project Managers, Business Operations, Human Resources, and Task

Managers.

The following activities will take place under CM:

Provide for the planning, management and Government interaction necessary on the part of the Program Director for the successful performance of the program.

The Project Management Plan will be followed as part of CM. Policies, procedures, and techniques used to ensure readiness and a high quality of performance are part of this activity. (This includes the Contractor's plans for staffing, training and certification of personnel and a logical approach for ensuring operational readiness and quality performance.).

Provide the weekly and month reports required for Task Orders.

Provide ad hoc reports required by executives and/or CORs.

Ongoing planning for preparedness and continuity of technical skills necessary to perform a series of related tasks.

Performance in accordance with contract requirements and company policies, including ethics standards.

Overall direction and monitoring of work performed on the program.

Quality assurance and quality control on active tasks.

Allocation of personnel, and technical and operational resources.

Management of subcontractors.

Communication with Contractor management and subcontractors on contract performance and program related issues.

Ongoing maintenance of the Project Management Plan as required under the contract.

Special activities/technical direction from the COR, such as: Contractor presentations, reports and research on state of the art technical topics for SSA

Executive Management personnel that emanate from tasks issued and approved under this contract.

5 CONTRACTOR COMPETENCIES/EXPERIENCE REQUIREMENTS

Provide support, of which the aggregate personnel have diverse knowledge, skills and experience. The Government will identify specific skill sets at the task order level. The future marketplace will dictate any additional skills, knowledge, and experience the agency may require.

In addition to the technical skills required in the contract, the Contractor’s management team and employees must provide administrative and management skills to plan, organize, lead and provide quality deliverables in a timely manner. Due to the anticipated volume of task orders placed under the contract, it is crucial the Contractor’s personnel be able to keep up with the number of projects under the task order without sacrificing the quality of the deliverables.

Labor Categories and Qualifications

The labor categories described in Section D Attachment 3, Contract Labor Categories and

Qualifications of the contract, represent the Government’s best estimate of the types and kinds of personnel required for successful Contractor performance. Note: The Government reserves the right to negotiate with the Contractor to add labor categories to the contract to acknowledge changes in the future marketplace.

6 PLACE OF PERFORMANCE

Individual task orders will define the place of performance for each requirement awarded under this contract. However, in general, the Contractor must perform the necessary services called for by this contract primarily at the Contractor's location(s). On a limited basis, agency requirements may dictate that Contractor personnel perform services at the following agency location:

Headquarters buildings (e.g. Main Complex buildings, National Computer Center, National Support Center (Urbana, Maryland), and Second Support Center (Durham, North Carolina));

Regional Offices (Atlanta, Boston, Chicago, Dallas, Denver, Kansas City, New York, Philadelphia, San Francisco, and Seattle); and

Other surrounding satellite buildings located in Woodlawn, Maryland.

Note: The Government does not intend to establish stand-alone offices (see Section VIII, Government-furnished property (GFP)) for Contractor personnel at any agency location.

The Contractor place of performance location(s) must be located within the United

States ; unless otherwise waived by the agency due to the nature of services required for successful performance. The agency will not pay mileage or work time for Contractor personnel (to include subcontractor personnel) to travel to or from agency headquarters locations for routine meetings and work sessions. Contractor personnel (to include subcontractor personnel) response time to requests for virtual meetings, conference calls, and other technical assistance called for in the task order must not exceed 2 hours.

In addition, the Government may assess the Contractor place of performance location(s) to determine any associated risks, and to determine resources required to establish and support the computing platform, related IT infrastructure, and telecommunications resources necessary to perform the work of the contract.

7 PERIOD OF PERFORMANCE

This contract includes multiple periods of performance applicable at either the contract level, or individual task order level. (See Section B-4 of the contract)

8 GOVERNMENT-FURNISHED PROPERTY

The Government will provide GFP, to include property that is incidental to the place of performance, when the contract requires Contractor personnel to be located on a

Government site or installation, and when the property used by the Contractor within the location remains accountable to the Government. Items considered incidental to the place of performance include, for example, office space, desks, chairs, telephones, computers, and fax machines.

The Government will provide space for on-site conferences/meetings between agency personnel and Contractor personnel to facilitate performance of individual Task Orders.

The Government will provide the Contractor computer equipment and office software normally used by agency personnel to perform work if required for the individual task order(s). Other than GFP, to include property that is incidental to the place of performance, the Contractor must ensure that all Contractor personnel working on a task

Unites States as defined herein means the 50 States, the District of Columbia, Puerto Rico, the Northern Mariana

Islands, American Samoa, Guam, the U.S. Virgin Islands, and Wake Island.

GFP, as defined by FAR 45.101.

order have the equipment, software and tools routinely used in industry to accomplish their assigned tasks.

The Government may provide GFP for most, if not all, of the hardware and software resources under computing platform, related IT infrastructure, and telecommunications.

Therefore, the Government reserves the right to conduct periodic audits of the Contractor place of performance location(s) (as referenced under Section VII above) for this contract in order to survey and inventory GFP, as well as to assess the status of deliverables and project performance. The Contractor must maintain an inventory accounting system for

GFP. In addition, the Contractor must provide the COTR with a current GFP inventory list of items to be surveyed one week prior to the performance of a GFP inventory audit.

The inventory list must specify, as a minimum: product description (make, model), Government tag number, date of receipt, name of recipient, location of receipt, current location, and contract/task order number under which the GFP is being used.

Additional GFP provisions, defined further at the task order level, include:

Providing a crash site area for workspace when necessary;

Providing incidental GFP, such as Government phone, Government-furnished workstations, which will include a SSA standard workstation image, if Contractor personnel are working on-site;

Providing job related software required beyond standard workstation image must be provided via Enterprise Software Engineering Tools (ESET) management and oversight.

Providing standard system access is granted for workstation desktops

Any job related access is granted at least privilege using standard security procedures.

Ensuring SSA's computer systems must be used only for work-related purposes which are consistent with the justification on each user's approved request for system access

Providing that remote access to SSA systems is strictly controlled and allowed only on an as-needed basis.

Ensuring that all remote access service is limited to government owned computers through Virtual Private Network (VPN)

Granting Virtual Private Network (VPN) access on an as-needed basis should a

Contractor need to perform off-hours support through remote access.

(See Sections C - Contract Clauses, and Terms and Conditions, for clauses applicable to GFP.)

9 GOVERNMENT-FURNISHED INFORMATION

The Government will provide certain information classified as Government-furnished information (GFI) relevant to the specified tasks, as the agency deems appropriate at the

GFI, as defined in this contract, means technical information or data the Government furnishes to a Contractor, or the Contractor otherwise obtains through performance, in support of an agency contractual requirement for the task order level. Information classified as GFI, or otherwise obtained through performance may require Contractor personnel to sign confidentiality and non-disclosure agreements. The provisioning and coordination of GFI is the responsibility of each task order’s respective COR (or Task Manager as appropriate), and will be defined in the documentation provided with each individual task order.

10 HOURS OF OPERATIONS AND CONTRACTOR PERFORMANCE

The Government will specify the hours of operation for Contractor performance at the task order level as coverage varies (e.g. 24x7, 6:00am–6pm EST, 8:30am-4:30pm) (See also Section C clauses for SSA Building Closures, and Observance of Legal Holidays and Administrative

Leave)

11 DELIVERABLES/DELIVERABLES SCHEDULE/REPORTS

Submit all deliverables and other written reports to the COTR (and Task Manager(s) as appropriate) in an electronic format using the medium (e.g. Excel, Word, Power Point, etc.)

specified at the contract-level and task order-level on the date and time specified. All deliverables and other written reports produced under this contract remain the property of the

Government. Treat all deliverables and other written reports as “sensitive but unclassified,” and ensure appropriate markings (e.g. proprietary information herein, Contractor bid or proposal information herein, etc.) appear in the legend. Unless otherwise specified, all deliverables and other written reports must contain appropriate restrictions (e.g. encryption password, permission and editing restrictions, digital signature, etc.) commensurate with the information therein.

Lastly, the Contractor must implement effective document management for all deliverables and other written reports to include version control and comment resolution such that each release has clear inventory of comments that were accepted or rejected as part of the version.

Contract-Level Reports:

Weekly Work Status Reports: Provide, on the fourth workday of each week, written status reports entitled "Weekly Task Order Status Reports." One report must be prepared for each active task order. These reports must identify each task order and work order by number, title, SSA and Contractor task order manager, SSA and

Contractor work order manager, start and end dates, status, problems/concerns and planned resolutions, and planned accomplishments during the next reporting period.

On a bi-weekly basis, utilization of hours by work order and by resource name must also be included.

Monthly Electronic Technical Progress Report (eTPR) by Task Order: Submit a

Monthly eTPR for each task order to the COTR, and each Task Manager on or before incorporation of GFI or specific agency characteristics into the Contractor’s deliverable end item. GFI includes, but is not limited to, third-party proprietary technical data or computer software, manuals, drawings, and test data, to be provided to the Contractor that require additional controls to monitor access and distribution (e.g., technical specifications, system specifications, maps, building designs, system schedules, etc.), as determined by the agency at the task order level as applicable.

the 2 nd

Thursday of each month. This collection of reports will be used to document the status, progress toward completion, accomplishments, opportunities, problems, resources used during the reporting period, and any Contractor recommendations.

Distribute the report(s) electronically via email, by SharePoint, or other specified mutually agreed to form of delivery specified by the COTR.

Each eTPR must contain the following information for each active task order completed during the reporting period:

1. General Information

Include the following information in the heading of the report:

Title "Monthly Technical Progress Report,"

Contractor's name, Contract number, Task Order title, Task Order number, Reporting period, Date report prepared, and

Person reporting.

2. Task Order Status Information

A. A narrative assessment of the Contractor's progress toward completion of the task order including:

a) Description of status and progress for each milestone and deliverable reached in the work-plan.

b) Explanation of the reasons for any differences between planned and actual progress.

c) Description of any unplanned accomplishments, efforts, or expenses during the reporting period.

d) Specific accomplishments planned for the coming month.

e) Opportunities or problems foreseen by the Contractor that need to be brought to the attention of the Government.

f) Opportunities or problems encountered and the actions taken during the reporting period.

g) [For T&M (and LH) task orders] - Total labor hours expended on the task order including labor hours expended on the task order by labor category and labor hours expended on the task order by individual. Individuals are to be uniquely identified by name and labor category for both the

Contractor and subcontractors during the reporting period.

h) Explanation of cumulative labor hour variances from the work-plan projections of 10 percent or more.

i) Recommendations for Government action or approval for the coming month.

j) Contractor’s Task Order Manager’s comments.

B. Task Order Update

a) Identification of any changes to the work-plan approved by the COTR during the reporting period.

b) Updates to progress charts identified in the work-plan.

c) Labor hours expended during the reporting period by the Contractor and subcontractors and the variance from their work-plan projections.

d) Labor hours by labor category expended during the reporting period by the

Contractor and subcontractors.

C. Deliverables Log

a) Identification by number and description of each deliverable outstanding or completed during the reporting period.

b) Identification of the dates deliverables are due, submitted, and approved.

Monthly Contract Summary Report/Invoice for Time and Materials Task Orders:

Submit a Monthly Contract Summary Report/Invoice to the COTR, with a copy to the

CO, by the 15 th calendar day of each month, to provide a detailed breakdown of contract resource expenditures as well as a workload summarization. The specific content, format, and method of delivery for this collection of report(s) must be agreed upon with the COTR prior to the due date of the first report. At a minimum, include the following information:

1. Identification of any significant issues concerning the contract or its administration needing to be brought to the attention of the Government. Note:

Issues that have been previously reported and resolved need not be repeated in subsequent reports. Issues that have been previously reported and not yet reported as resolved must be updated.

2. The Contractor’s organizational chart to include the following information about all personnel assigned to the contract:

a) The Contractor's contract management structure and its relationship within/to the company.

b) The chart preparation date must appear in the upper right hand corner.

c) For each task order, the task order name and number, the Contractor task order Manager's name, and Key personnel name(s) must be indicated.

d) For each task order, all other (non-management, non-Key) personnel assigned to the task order, including subcontractor personnel, must be indicated.

NOTE: Beyond the initial Monthly Contract Summary Report/Invoice submitted each Contract Year (CY), subsequent Monthly Contract Summary

Reports/Invoices must include part “e.” of this organizational chart only when significant changes have occurred.

3. For each task order active or completed during the reporting period, indicate the direct labor categories, direct labor hours, and direct labor dollars incurred by the

Contractor and each subcontractor (if any) during the reporting period and from

CY inception-to-date (ITD).

4. For each task order active or completed during the reporting period, indicate the direct costs incurred by the Contractor and each subcontractor (if any) during the reporting period and from CY ITD.

5. Indicate and account for any variance in actual direct labor hours worked and dollars/expenses incurred, versus direct labor hours and dollars/expenses billed/invoiced, during the reporting period. This report must contain a separate entry for each individual, both Contractor and subcontractor, by labor category, direct labor rate, and by task order. Supporting documentation must be provided on direct labor hour and direct labor cost variances.

6. Provide CY ITD variance in actual direct labor hours worked and dollars/expenses incurred, versus direct labor hours and dollars/expenses billed/invoiced, through the reporting period. This report must contain a separate entry for each individual, both Contractor and subcontractor, by labor category, direct labor rate, and by task order and work order.

7. List personnel changes made during the reporting period and since the beginning of the CY.

8. Indicate the cumulative direct costs for each task order active or completed during the reporting period.

9. Indicate total labor hours and labor expenses expended by each individual, both

Contractor and subcontractor, during the reporting period. For each individual, the report will identify the labor category, labor rate(s), and Work Order(s) that identify the individual's involvement in the contract.

10. List all task orders that expired during the reporting period.

11. List all task orders that were due to expire during the reporting period for which activities are not complete.

12. List all task orders that are due to expire during the next reporting period.

13. Provide update(s) to the Contractor's Project Management Plan (including Phase-

In Plan and/or Staffing Plan) that has/have been mutually agreed upon.

Monthly Financial Planning Report for Time and Materials Task Orders: Submit a

Monthly Financial Planning Report to the COTR by the last calendar day of each month. Expect modifications to the content and formatting of this report during the life of the contract. This collection of reports provides financial planning information for the contract period specified by the COTR. This report must include, at a minimum, the following information:

1. Show the full-time equivalents (FTEs) by direct labor category assigned to each task order. For each task order, show totals for the number of FTEs available for future task orders after the instant task order's completion. Format the list of task orders by their completion/end date and indicate the total FTEs available by month.

2. Show, by month and overall/total, the estimated value and start date of each planned task order type with a start date within that month. Show monthly and overall totals for estimated task order values.

3. For each task order issued, show the approved direct labor hours, approved cost, actual direct labor hours expended to date, actual dollar expenditures to date, direct labor hour balance, and remaining dollar balance. Show overall totals for these categories as well, and indicate which task orders have been completed.

4. Show projected/estimated balance of un-incurred/available funding for the current contract term/period based on the value of current approved/in process task orders, pending task orders, and planned funding adjustments for completed or active task orders.

5. Show by month, the estimated balance of un-incurred/available funds for projected planned task orders.

6. For each active task order, show the approved direct labor hours, actual direct labor hours, estimated-to-complete (ETC) labor hours, projected direct labor hour expenditures, variance between approved and projected direct labor hours, and percentage variance.

7. For each active task order, show the approved dollar cost, actual cost, estimated-to-complete cost, projected cost, variance between approved and projected expenses, and percentage variance.

Weekly COTR Progress Review Meeting: The COTR will meet weekly with the

Contractor's PMO to review and discuss information contained in the Weekly Task

Order Status Report and the Monthly Electronic Technical Progress Report (eTPR) by Task Order, and to address Task Order performance, progress, and future directions.

Ad-Hoc Reports: Ad-hoc reports may be requested. For the most part, these ad-hoc reports will ask for information that is already captured by the Contractor and can be reformatted for a new report.

Monthly RAS Reports: The Contractor must submit two Monthly RAS Reports to the

COTR…