TO1 PWS_26F7602_211024.pdf

PERFORMANCE WORK STATEMENT

Program Management Warfare Logistics Integrated Information Solutions – Marine Corps

Data Environment & Integration Logistics Data Transformation

Information Technology Services Support Task Order 01

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide Information Technology Service Support (ITSS) to Data Environment & Integration (DE&I) portfolio in support of Logistics Data Transformation (LDT) projects. The Government shall not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government.

1.1. Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and services necessary to perform ITSS as defined in this Task Order (TO) except for those items specified as Government Furnished Property (GFP) in Part 2 of this PWS and services. The contractor shall perform to the standards set forth in this contract.

1.2. Background: The Deputy Commandant of the Marine Corps for Installations and Logistics (DC I&L) and Logistics Integrated Information Systems – Marine Corps (LI2S-MC) have a requirement to bring United States Marine Corps (USMC) Logistics Product Data (LPD) into the 21st Century with an intuitive application design that facilitates user interactions, provides high-quality data and effective business process automation. The result is the Technical Data Management (TDM) Application Development Platform which provides the technical architecture for the rapid reengineering of logistic processes using modern technology and systems design; managed using a modern software development model; and producing high-quality data through standardization while focusing on warfighter usability and information needs.

The TDM Platform technical architecture consist of Platform as a Service offerings supported by development, security, and operations (DevSecOps) pipeline tools; the performance of the Government and the contractors that support the project using a tailored SAFe agile approached.

Successful performance of this TO will require ITSS that will maintain the necessary team staffing and provide requested developmental capacity; process improvements that lead to increased delivery velocity;

reliability and availability of the application; and quality of software developed for current TDM Platform.

1.2.1. Hosting Facility: TDM Platform stage and production environments are hosted in a cloud environment located at Marine Corps Business Operation Support Services (MCBOSS) which resides in the Amazon Web Services (AWS) Government cloud west. The development and test environments are currently hosted within Appian’s commercial cloud.

1.2.2. System Descriptions: The TDM Platform is a data management platform that supports the Marine Corps Logistics Information Technology community. It is a key digital transformation tool used to improve product lifecycle data management and implement improved logistics processes in order to increase operational efficiency, improve data standardization, reduce maintenance costs, and improve equipment readiness. The technical architecture includes a low code/no code application development platform with a Not Only Structured Query Language (SQL) (NoSQL) database backend supported by data integration software and other AWS cloud services. The team utilizes an agile software development lifecycle and an agile project management tool suite supported by DevSecOps software tools to deliver logistics applications and services on a continuous delivery pipeline. TDM is currently comprised of two applications: TDM-CATALYST and TDM-Publications with the ability to scale to support additional functionality and transformation efforts that fall within the scope of product lifecycle data management.

1.3. Objectives: The overarching objectives of the work contained in this TO are to:

• Provide program management, project management, and ITSS necessary to support all tasks/sub-tasks described in this TO.

• Provide Agile teams and services that are properly staffed and organized for tasks identified in subsequent task orders.

• Ensure software quality and availability through the implementation of best practices utilizing an Agile software development life-cycle methodologies.

• Actively contribute to the continuous process/product improvement of technology, architecture, software development, and value delivery. Focus is to improve process effectiveness and efficiency, software quality, and to evaluate, recommend, and possibly implement technology changes that increase capability relative to the cost of the improvement.

• Provide metrics that support Government reporting requirements. Categories include metrics on Agile performance (examples: burn-up, burn-down, velocity, etc.); Customer satisfaction (examples: net-promoter scores, surveys, etc.); system performance (examples: operational availability, interface status, etc.); and software quality (examples: released defects, technical debt, etc.). Metrics will used as part of the CPI process and for value assessments to support business decisions.

• Provide release management utilizing continuous integration/continuous delivery methodologies that support a “release on demand” cadence using Government provided DevSecOps tools.

Ensure configuration management tasks are performed in accordance with Government direction and guidance.

• Conduct and document, to the Government’s satisfaction, that sufficient testing, either automated or manual, has been conducted prior to each release.

• Produce, update, and maintain training materials in support capability releases.

• Provide Customer/Service Desk Support

• Provide cybersecurity support in compliant with applicable Department of Defense, Department of the Navy, and Marine Corps regulations including Risk Management Framework (RMF) tasks and cyber workforce requirements.

1.4. Scope: The contractor support services are required to:

• Provide development capacity through subsequent task orders that are organized and staffed to accomplish the requirements of the task order within the parameters of the quality assurance plan.

Development capacity is typically delivered in the form of Agile Development Teams (ADTs) consisting of application developers, database developers, business analysts, other information technology specialists, and Agile process personnel (i.e. SCRUM Masters) as required.

• Provide a release management capability to coordinate value delivery from the ADTs via Agile Release Trains (ARTs). The release management capability performs all tasks required for a successful release to include but not limited to configuration management, documentation (i.e.

release notes), training updates, etc.

• Provide engineering and IT architecture personnel to address the reliability, availability, maintenance, and cybersecurity of the underlying IT technology.

• Provide program and product management support to enable stakeholder engagements and communications in support of Government Product Owner and Project Office requirements.

Examples include producing or contributing to the development and maintenance of the product roadmap, briefing materials, demonstrations, and other various documentation requirements that support the management and execution of the project.

• Provide personnel and resources to support Agile ceremonies/events to include Product Council Meetings, Program Increment Planning, value assessment reporting.

1.5. General Information

1.5.1. Quality Control: See base PWS contract #M6785426D7601.

1.5.2. Quality Assurance: See base PWS contract #M6785426D7601.

1.5.3. On-Site Working Conditions, Holidays, and other Closures: See base PWS contract #M6785426D7601.

1.5.4. Hours of Operation: See base PWS contract #M6785426D7601.

1.5.5. Place of Performance: See base PWS contract #M6785426D7601.

1.5.6. Type of Contract: For this TO, the Government will award a hybrid contract with Firm-Fixed Priced (FFP) Contract Line-Item Numbers (CLINs) for services and/or not to exceed cost reimbursable CLINs for travel and other direct costs.

1.6. Security Requirements: See base PWS contract #M6785426D7601.

1.6.1. Physical Security: See base PWS contract #M6785426D7601.

1.6.1.1. Defense Biometric Identification (DBID) Card: See base PWS contract #M6785426D7601.

1.6.1.2. Marine Corps Base Quantico Installation Gate Access: See base PWS contract #M6785426D7601.

1.6.1.3. MCSC Facility Access: See base PWS contract #M6785426D7601.

1.6.2. Key Control: See base PWS contract #M6785426D7601.

1.6.2.1. See base PWS contract #M6785426D7601.

1.6.2.2. See base PWS contract #M6785426D7601.

1.6.3. Lock Combinations: See base PWS contract #M6785426D7601.

1.7. Cyber Security: See base PWS contract #M6785426D7601.

1.7.1. Common Access Card (CAC) Requirement: See base PWS contract #M6785426D7601.

1.7.1.1. Marine Corps Enterprise Network (MCEN) Computer Access: See base PWS contract #M6785426D7601.

1.7.1.2. Contractor Assets Connectivity to the MCEN: See base PWS contract #M6785426D7601.

1.7.1.3. Magnetic Hard Drive Storage Devices: See base PWS contract #M6785426D7601.

1.8. Special Qualifications: See base PWS contract #M6785426D7601.

1.8.1. Annual Block Training: See base PWS contract #M6785426D7601.

1.9. Post Award Conference (PAC)/Periodic Progress Meetings: See base PWS contract #M6785426D7601.

1.10. Monthly Status Report (MSR): See base PWS contract #M6785426D7601.

1.11. COR Responsibilities: See base PWS contract #M6785426D7601.

1.12.Transition:

1.12.1. Phase In: The contractor shall execute a 30-calendar day phase-in period with the incumbent contractor to ensure a smooth transition and to prevent decreases in productivity or service quality. At a minimum, the phase-in activities will include obtaining administrator access to the systems; obtaining points of contact for functional, programmatic, and technical matters; attending all technical, cybersecurity, and programmatic meetings; scheduling and performing at least five (5) days of over-the-shoulder system administration activities with incumbent contractor personnel; and executing other activities as necessary to ensure maximum transfer of functional, technical, and programmatic knowledge from the incumbent contractor. The contractor shall conduct a full configuration audit of all configuration items to include hardware and software during the phase-in period. All discrepancies shall be reported to the Government before the end of the phase-in period. After the end of the phase-in period, any discrepancies not reported become the responsibility of the contractor to remedy.

1.12.2. Phase Out: The contractor shall provide a phase-out plan for the 30-calendar day period prior to the contract end date (i.e., at the end of all option periods) to ensure an efficient and effective transition to the follow-on contractor and to prevent possible decreases in productivity or service quality. During this period, while still maintaining full performance, the contractor shall make available to key incoming contractor personnel, a representative of the incumbent contractor who is versed in the operation of all functions to be performed. All non-proprietary data, documentation, templates, schedules, processes, procedures, work instructions, configuration management repositories, code repositories, etc. used to execute the performance of the contract shall be transferred to the Government at the beginning of the phase-out period. Transfer of GFP will be made at the end of the phase-out period.

1.13. Key Positions: (Also designated in Attachment 6.3 DevOps Team Requirement)

Key positions identified are designated as key based upon their criticality for their knowledge and experience needed to accomplish the mission by supporting daily operations. They shall be designated by title, and each individual performing in one of these positions must meet the qualifications as specified by the Government. The contractor is required to provide notification to the Government for the key positions ONLY and shall meet, or exceed, those outlined in this TO. Key positions shall be determined by the tasks specified on this TO.

1.13.1. Agile Development Team (ADT)

The following positions are considered Key Personnel for each ADT. All personnel must be capable of performing the tasks as detailed for each position and must meet the minimum experience unless waived in writing by the Contracting Officer.

1.13.1.1. Application Developer – Senior

Personnel assigned to this position need to be capable of performing the following:

• Complete the delivery of design, code, or testing for modules or multiple features and enablers;

• Analyzes user requirements and defines technical project scope and assumptions for backlog grooming ceremonies;

• Prepare requirements definition, design, technical specifications as part of sprint planning;

• Create business and/or technical designs for new or modified features or enablers;

• Complete system configuration per specifications;

• Triage and resolve configuration issues; and

• Assist and guide the customer in writing test plans and test cases to ensure testing aligns with the requirements presented Preferred Minimum Experience: 5 years of experience with BPM platform technology

1.13.1.2. NoSQL Database Developer – Senior

Personnel assigned to this position need to be capable of performing the following:

• Perform related database functions including designing, implementing and maintaining new databases, backup/recovery and configuration management at the ADT level;

• Maintain databases by capacity planning, conducting database backups, monitoring logs for potential problems, monitoring software database license process, managing technical action reports to resolve software issues, performing software upgrades and patches;

• Provide outage resolution support and perform analysis to resolve recurring database issues;

• Provide input for modification of procedures and documentation used for problem resolution and day-to-day maintenance;

• Develop/maintain/participate disaster recovery plans; install, configure and maintain DBMS;

• Coordinate with the MCBOSS team for issue escalation; and

• Provide in depth problem diagnosis and troubleshooting skills.

Preffered Minimum Experience: 5 years of experience with NoSQL database and rapid application development.

1.13.1.3. Business Analyst – Mid

Personnel assigned to this position need to be capable of performing the following:

• Work with business units and other stakeholders to gather requirements, using techniques like interviews and requirement gathering sessions;

• Elicit, analyze, document, and communicate business requirements as well translate them into more detailed user stories and other functional requirements documents such as process flows, screen mock-ups, gap analysis (also known as Business Requirements Documents);

• Create documents and other artifacts to promote sustainable knowledge management within the organization;

• Experience conducting Facilitated Workshops for requirements analysis;

• Experience creating workflows using formal notation such as the Business Process Modeling

Notation (BPMN);

• Knowledge of formal requirements gathering methodologies;

• Experience developing Business Requirements - project initiation document, what the needed achievements will be, and the quality measures;

• Experience developing Functional requirements - describe what the system, process, or product/service must do in order to fulfill the business requirements.

Preferred Minimum Experience: 3 years of experience with NoSQL rapid application development.

1.13.2. Release Management Team (RMT)

The following positions are considered Key Personnel for each RMT. All personnel must be capable of performing the tasks as detailed for each position and must meet the minimum experience unless waived in writing by the Contracting Officer.

1.13.2.1. Release Train Engineer – Senior

Personnel assigned to this position need to be capable of performing the following:

• Demonstrated ability to achieve the culture change needed when successfully transitioning to SAFe-like Agile teams;

• Breadth and depth of experience in the tools and techniques of the SAFe Agile Framework, including a proven track record of continuous improvement in knowledge and implementation of Agile methods;

• Experience guiding program managers using Agile in a large program that includes multiple Agile teams, releases, and projects that operate in parallel (e.g., Scrum of Scrums);

• Knowledge and understanding of how to implement architecture in an Agile environment, how to combine the use of component and feature teams, and how to coordinate multiple teams when managing Agile software development for large-scale enterprise development; and

• Understanding of the constraints and demonstrated ability to apply means and methods to overcome these constraints when implementing Agile in a federal contracting environment.

Preferred Minimum Experience: 5 years of experience leading Agile/SCRUM teams and release planning and management on an Agile continuous delivery pipeline

1.13.2.2. Application Technical Lead – Senior

Personnel assigned to this position need to be capable of performing the following:

• Provide technical leadership and best practice guidance to the Government program office and supported Agile development teams;

• Work closely with the platform architect to ensure continuous integration, forecast risks and issues, and provide leadership to individual ADT application developers to ensure continuity of effort;

• Highly experienced in complex, enterprise implementations on the software platform;

• Undertake complex system integration configuration;

• Provide technical support for complex installation requirements and provide hardware and architecture design recommendations;

• Collaborate with the hosting site manager to install, configure, and accredit the software platform;

• Implement security-related configuration to the application infrastructure;

• Lead design reviews and production readiness reviews with the team to ensure the solution is designed and configured for optimal performance in the designated environments;

• Install and configure the software platform and configure integration with LDAP/Active Directory or other enterprise services;

• Provide recommendations for and undertake custom development if required

Preferred Minimum Experience: 5 years of experience with rapid application platform development.

1.13.2.3. Database Technical Lead – Senior

Personnel assigned to this position need to be capable of performing the following:

• Work closely with the Government engineering and architecture team, and the PMT to ensure NoSQL database implementation standards across one or more ADTs;

• Provide input, review, and oversight on strategic execution and targeted activities;

• Develop the database design commensurate with the application design;

• Perform design reviews of implementations;

• Collaborate with the hosting site manager to install, configure, and accredit the database;

• Manage the noSQL resources deployed to the project; and

• Identify and mitigate risks to the project.

Preferred Minimum Experience: 5 years of experience with w noSQL database and rapid application development.

1.13.3. Key Position(s) Replacement. If circumstances require replacement of any personnel in a key position, the contractor shall provide the Contracting Officer with a qualified replacement within 30 business days. In the event of an employee departure, the company shall notify, in writing, the COR and Contracting Officer one business day from employee notification that the employee is departing. The notification of replacement shall be submitted, in writing, to the COR and Contracting Officer as soon as practicable, but not to exceed 15 business days after the departure of any personnel from a key position.

Any exceptions to this must be coordinated, in writing, with the COR, or the Contracting Officer in the event that the COR is unable to respond in a reasonable time. Each replacement notification shall provide, a complete snapshot of the replacement personnel’s qualifications, and any other information required by the COR or Contracting Officer. All proposed replacements (no matter when they are proposed during the performance period) shall have qualifications that are equal to or higher than the qualifications of the incumbent.

1.14. Non-Key Positions:(Also designated in Attachment 6.3 DevOps Team Requirement)

See Attachment 6.3 DevOps Team Requirement. Non-key positions shall be determined by the tasks specified on this TO.

1.15. Identification of Contractor Employees: See base PWS contract #M6785426D7601.

1.16. Contract Travel & Other Direct Costs (ODC): See base PWS contract #M6785426D7601.

1.16.1. Contractor Travel: See base PWS contract #M6785426D7601.

1.16.2. Other Direct Costs: See base PWS contract #M6785426D7601.

1.16.3. Contractor Procure IT Assets: See base PWS contract #M6785426D7601.

1.16.3.1. Software: See base PWS contract #M6785426D7601.

1.16.3.2. Hardware: See base PWS contract #M6785426D7601.

1.17. Organizational Conflict of Interest (OCI): See base PWS contract #M6785426D7601.

1.18. Rights in Data and Software: See base PWS contract #M6785426D7601.

1.19. Section 508: See base PWS contract #M6785426D7601.

PART 2

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

2. GOVERNMENT FURNISHED ITEMS AND SERVICES:

2.1. General: See base PWS contract # M6785426D7601.

2.2. Services: See base PWS contract # M6785426D7601.

2.3. Facilities: The Government will not provide the workspaces for the contractor staff in execution of this

TO.

2.4. Equipment: The Government will not provide GFE in support of this TO.

2.5. Materials/Information: In addition to the base IDIQ contract #M6785426D7601, the Government will provide the below GFI, as relevant to the subject task order. This information is subject to change at the discretion of the Government.

The Government currently provides funding to the system integrator to maintain a development and test environment with Appian. The contractor shall utilize this environment for the purpose of developmental and software testing. The development and test environment has 100 licenses for named users and is used to support Government and contractor personnel. The contractor is responsible for ensuring they comply with the current licensing agreements.

In addition, the Government will provide the below GFI, as relevant to this PWS. This information is subject to change at the discretion of the Government.

2.5.1. Licenses: (purchased by the Government for contractor’s use)

Name Vendor

Appian Appian

MarkLogic MarkLogic

2.5.2 Software List: (General list of current software use)

Name Vendor Function

Appian Appian Low-Code Rapid App Development Platform

AWS Elastic File Sys. AWS Network Attached Storage servicing Appian

AWS RDS MySQL AWS Internal Business Data Storage for Appian

MarkLogic MarkLogic NoSQL Data Platform

Apache Nifi Apache SFTP Workloads

Confluence Atlassian Wiki and Collaboration

Jira Atlassian Project Tracking and Management

GitLab GitLab Source Code Repository

Jenkins Jenkins Build process

Jfrog Artifactory Jfrog Build artifact repository

SonarQube SonarQube Code security and Code quality

Gradle Gradle MarkLogic deployment execution (Jenkins plugin)

MarkLogic Gradle MarkLogic MarkLogic deployment execution

Fitnesse Fitnesse Automated Testing Tool

Apache Jmeter Apache Performance Testing

Harness Harness Deployment orchestration

Threadfix Fitnesse Security reporting/Threat Analysis

CloudWatch AWS Security reporting/Threat Analysis/System Analysis

2.5.3. Standard Operating Procedures (SOP), User Manuals, Guides, and technical/required documents:

The Government anticipates there will be instances when Government owned technical data will be made available to the contractor as GFI. GFI shall be used in the performance or administration of this effort, shall be used only for those purposes, and shall not be used in any other way without the written consent of the Contracting Officer. Contractor and/or contractor personnel shall not divulge, or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorized government personnel or upon written approval of the Contracting Officer. The contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of efforts within this PWS. Nothing herein will preclude the use of any data independently acquired by the contractor without such limitations or prohibit an agreement at no cost to the Government between the contractor and the data owner which provides for greater rights to the contractor.

The contractor agrees to assume responsibility for protecting the confidentiality of Government records, which are not considered public information. Each contractor or employee of the contractor to whom information may be made available or disclosed, shall be notified in writing by the contractor that such information may be disclosed only for purposes and to the extent authorized within the individual call order. The contractor shall not release any information to the public, media or other unauthorized persons or organizations unless the government has conducted the appropriate security review and granted written approval (e.g. posting information to a public website). Performance of this effort may require the contractor to access and use data and information proprietary to a Government agency or Government contractor, which is of such a nature that its dissemination or use, other than in performance of this effort, would be averse to the interests of the Government and/or others.

PART 3

CONTRACTOR FURNISHED ITEMS AND SERVICES

3. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

3.1. General: See base PWS contract # M6785426D7601.

3.2. Services: See base PWS contract # M6785426D7601.

3.2.1. Facility & Security Clearance: See base PWS contract # M6785426D7601.

3.3. Materials & Equipment: See base PWS contract # M6785426D7601.

3.4. Contractor furnished IT Assets: See base PWS contract # M6785426D7601.

PART 4

SPECIFIC TASKS

4. Specific Tasks:

4.1. Basic Services: See base PWS contract # M6785426D7601.

4.2. System Administration and Product Support. See base PWS contract # M6785426D7601 in conjunction with the below specifications.

4.2.1 Requirements:

a) Maintain system software (i.e., operating system, database, application) in an operating condition.

b) Test and deliver new system software in coordination with the ADT for inclusion in established release cycles.

c) Request COR approval and coordinate with the ADT to schedule system downtime. The downtime should be scheduled to cause minimal impact to site operations.

4.2.2. Operational Availability and System Downtime: The contractor shall be accountable for maintaining the uptime and performance of TDM Platform in accordance with MCBOSS Teaming Agreement by:

a) Troubleshooting and finding solutions for escalated issues that involve TDM Platform technical components and the affected users.

b) Developing and/or using troubleshooting, monitoring, and reporting tools to analyze the root cause of serious and impactful technical issues.

c) Working closely with Customer Support, MCBOSS escalation teams, the Product Management Team (PMT), and the systems engineering/architecture team to seek solutions for customers and drive tasks toward completion.

d) Recommending improvements to the whole lifecycle of operational readiness from inception and design through release, operation, and refinement. Approved recommendations shall be identified as user stories and placed in the product backlog for prioritization by the product management team and product owners.

e) Developing tools, operational improvements, and automated solutions that enable self-service configuration changes, speed deployments, and improve monitoring.

f) Assisting the SAFe-like ADT(s) to ensure accurate monitoring and metrics are built in before deployment to production.

g) Coordinating with the hosting environment, MCBOSS, to manage periodic environmental changes that impact the TDM Platform technology landscape.

4.2.3. Interoperability: The contractor shall maintain interoperability within the LDT project architecture and sustain existing internal/external joint interfaces, to include the development of supporting documentation. Currently approved LDT interfaces are as follows:

• GCSS-MC

• DLA-FPW

• DLA-FPDW

• TFSMS

• DLA GEX/WSSP

• DLA-SOMA/DSG

• MDR

• FEDLOG

• LDS

4.3. Software Maintenance Support. See base PWS contract # M6785426D7601 in conjunction with the below specifications.

4.3.1. Environments: If required, the contractor shall provide a development and test hosting environment for a production representative system instantiation. The hosting environment shall be representative of the constraints and limitations of the production environment. The contractor’s hosting environment shall support the contractor’s development and testing activities. The contractor shall be responsible for the security of the environment and the appropriate protection of any production data used during development or testing. The contractor shall abide by the Cybersecurity Maturity Model Certification (CMMC), if directed by the government.

4.3.2. Code Reviews: The contractor shall perform automated code reviews in accordance with MARADMIN 657/13 - Requirement for System Source Code Review, the contractor shall provide a copy of the System Source Code to the Government prior to the release of updated code, as part of the 95% of the identified OPDIRS/Information Assurance Vulnerability Alerts (IAVAS)/ Information Assurance Vulnerability Bulletins (IAVBS) and vendor patches associated with a risk assessment report and provided to the Government within five (5) business days, and/or upon Government request. The Government is currently using Hewlett Packard (HP) Fortify for Government automated code reviews. The contractor is responsible for obtaining their own license(s) to the tools necessary to perform the automated code reviews.

The contractor shall use the results of the automated code review in the software development process to mitigate or eliminate identified issues.

4.3.3. Methodology: The contractor shall use an Agile, or similar methodology, as approved by the Government within the Contractor’s Software Development Plan (SDP), which promotes the continuous iteration of concurrent development and testing throughout the software development lifecycle of the project (DevSecOps). System features and requirements are subject to change based on program increment planning, backlog grooming and sprint planning during the period of performance of the contract. The forecasted features listed under performance objectives may be accelerated, changed, or interchanged within the scope as determined in program increment or Sprint planning.

The contractor shall continuously evaluate DevSecOps tools provided as a service from the hosting environment (i.e., MCBOSS) for sufficiency. The contractor shall make recommendations for additional tools, configuration of existing tools, and other recommendations to support successful execution of task orders awarded through this contract. Examples of current DevSecOps and Agile project management tools include, but are not limited to:

a) Code repository/code management tool like GitHub.

b) Agile Development Project Management tools like Jira, Confluence, and Jira Helpdesk.

c) Code Vulnerability Scan tools like Microfocus Fortify.

d) Code Quality Scanning tools like SonarQube.

e) Code Automated testing tools like Selenium or Robot Framework.

4.3.4. Software Changes: The contractor shall perform SAFE-like best practices to develop, track, test and deploy software changes. These changes in agile come as themes, epics, and user stories for features or software bugs/defects. The contractor shall utilize agile best practices for managing the development, operations, and maintenance activities associated with each task order. Management of activities shall be traceable from Theme to Epic to User Stories in order to account and manage work efforts and inform future program increment planning events.

4.3.5. User Acceptance Testing (UAT): An approved UAT/System Demo is required prior to fielding any changes to production.

4.3.6. Software Documentation: The contractor shall deliver their technical approach, consistent with the contractor’s SDP, to describe how the team intends to execute the tasks and subtasks located within this this PWS. Additionally, the contractor shall develop, maintain, and/or update a Software Release Plan, SOPs, user manuals, user guides, Technical Data Packages, System Design Specifications (SDS), Test Plans and Reports, and Requirements Traceability Matrix(s) (RTM).

4.3.7. Obsolescence Management: The contractor shall address the challenges posed by aging technology and diminishing manufacturing sources and must proactively plan for and manage obsolescence and Diminishing Manufacturing Sources and Material Shortages (DMSMS). Every product is susceptible to these effects. As product service lives extend beyond the technology life cycle, obsolescence and DMSMS issues arise. Effective management should address DMSMS throughout the product’s life cycle. The contractor shall resolve obsolescence problems before they impact life cycle costs and system availability.

Potential approaches include:

• Designing features that facilitate technology change or insertion.

• Establishing effective change management processes.

• Leveraging Performance-Based Logistics (PBL) approaches to manage technology refreshment.

4.4. Implementing New Capability/Functionality: See base PWS contract # M6785426D7601.

4.5. Cybersecurity Support: See base PWS contract # M6785426D7601 in conjunction with the below specifications.

4.5.1. Specific Cybersecurity Tasks:

The contractor shall:

• Coordinate with the LDT project cybersecurity teams to ensure products comply with current and/or successor versions of the Federal Information Security Management Act of 2002, Federal Information Security Management Act, 44 U.S.C. §3541, DoD Directives (DoDD), DoD Instructions (DoDIs), USMC policies, and all other applicable regulations.

• Ensure user story design and development is compliant with appropriate Defense Information Systems Agency (DISA) STIGs and Security Requirements Guides (SRGs) throughout the Software Development Lifecycle.

• Assist in the preparation and review of Assessment and Authorization documentation by providing technical information and review to ensure engineering and architectural designs are in accordance with the DoDI 8500.01 - Cybersecurity, DoDI 8510.01 - RMF, and in compliance with all applicable regulations, publications, manuals, and local policies and procedures.

• Ensure the systems comply with the Information Assurance Vulnerability Management process to ensure dissemination, reporting, and compliance per direction of the DE&I system Cybersecurity Teams.

• Develop and complete user stories as either part of sprint planning or emergency release planning for identified vulnerabilities.

• Coordinate with TDM team in developing processes to inform stakeholders of information assurance and cybersecurity monitoring and reporting to ensure compliance to include the development and maintenance of a Plan of Action and Milestones (POA&M).

• Coordinate the creation, prioritization, and completion of user stories (features, enablers, or bugs) that align with POA&M completion dates.

• Prepare and Submit Information Assurance/Cybersecurity project deliverables as required by the Cybersecurity team.

4.5.2. Risk Management Framework: The contractor shall perform RMF Cyber tasks for each individual LDT project as referenced in DOD 8510.01 RMF for all DOD Systems. The contractor shall maintain Cybersecurity controls for the LDT projects in accordance with all mandatory directives and instructions to satisfy the DoD Cybersecurity Assessment and Authorization requirement.

4.5.3. Cybersecurity Documentation: In the event of changes that impact the system’s architecture, the contractor shall work with/support the ADT to develop, maintain and/or update, submit and review Cybersecurity documentation to support continued ATO / ATC for LDT projects using the Marine Corps authorized RMF process. The contractor shall ensure the documentation accurately reflects the current system configuration, architecture, and security posture for Government approval and concurrence.

4.5.4. Cyber Incident Reporting: In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, the contractor shall report Cyber incidents to the Damage Assessment Management Office (DAMO) via the DIB-Net website (http://dibnet.dod.mil) within three calendar days of discovery of a Cyber incident. The contractor shall also submit all information related to a Cyber incident to the Defense Cyber Crime Center (DC3) within 15 calendar days of each Cyber incident.

4.6. Service Desk Support: See base PWS contract # M6785426D7601 in conjunction with the below specifications.

TDM projects are implementing a customer focused design that better supports agile principles, enabling better user self-help, and shortening lines of communications to bring about faster incident response and closure. The goal of this construct is to promote rapid resolution by reducing front-end (traditional tier-one support) to minimal staffing and processes. Customer requests are categorized into either incident (features or environmental defects); new or modified features (customer desires different outcome or capability), or training (instructions on the use of a feature). Incidents are quickly escalated to technical representatives with minimal ticketing documentation. Direct communication with the customer and the technical representative is desired to quickly resolve and deploy fixes.

The contractor shall provide support within the application customer support site, and monitor Government provided customer support email for ticket submission and Self Service Knowledge Base content.

To support this effort the contractor shall provide a customer support representative(s) to perform the following tasks:

• The contractor shall provide Service Desk support operational five days per week, 08:00 – 17:00 EST and closed on weekends and Federal holidays utilizing methods for contact, which includes an in-system customer support section and email for ticket submission, and Self Service Knowledge Base content.

• Training issues:

o Assist customer in identifying published knowledge base articles to resolve the issue.

If knowledge base article cannot be identified coordinate with Program Team for resolution o Incidents:

Assist customers in identifying the nature of the incident.

Facilitate discussions with the customer; engineering team; product and release management team; and product owners.

As directed, coordinate escalation to the MCBOSS escalation team.

o Emails and online portal ticket submissions will be acknowledged within one business day. Completion timeline will be based on acknowledged time to completion time.

Complexity and development actions will be reported as dependences to customer support tickets for metrics reporting. Current Service Desk Contact Information:

Customer Support URL:

https://app.mcboss.usmc.mil/suite/sites/support/page/support-cases

Customer Support Email: MCSC_LI2S_Catalyst_Support Catalyst_Support@usmc.mil

CDRL B001 - DI-MGMT-82246 - Enterprise Information Technology (IT) Performance Metrics Report

4.7. Configuration Management (CM): See base PWS contract # M6785426D7601.

4.8. Program Management Support: See base PWS contract # M6785426D7601 in conjunction with the below specifications.

4.8.1. Programmatic Documentation: The contractor shall assist with developing, monitoring, updating and/or maintaining programmatic documentation.

4.8.1.1. Meeting Minutes and Agendas: The contractor Program Manager (PM) may be required to meet at least weekly with the COR during the first month of the period of performance (POP). Meetings will be as often as necessary thereafter as determined by the COR. However, if the contractor PM requests, a meeting will be held whenever a Contract Discrepancy Report (CDR) is issued. As requested, the written minutes of all performance evaluation meetings will be prepared by the Government and shall be signed by the contractor PM and COR and provided to the Contracting Officer. Should the contractor not concur with the minutes the contractor shall so state any areas of non-concurrence in writing to the Contracting Officer within seven workdays of receipt of the signed minutes. The minutes will be included in the contract file.

4.8.1.2. Program Management Plan (PMP): The contractor shall provide a PMP within 45 calendar days of the TO POP effective date. The PMP shall include:

a) Project scope and scope management plan

b) Quality Control Plan

c) Requirements management plan

d) Schedule management plan

e) Cost management plan

f) Personnel staffing plan

g) Communication management plan

h) Risk management plan

i) Process improvement plan

j) Configuration management plan

k) Cybersecurity

The PMP shall be developed in contractor standards and submitted in electronic format and approved by the COR. Changes to the PMP shall be made in accordance with the contractor’s schedule change management process and approved by the COR.

4.8.1.3. Performance Evaluations: Refer to Section 4.8.1.1. of this PWS.

4.8.1.4. Monthly Status Report: Refer to Section 1.10. of this PWS.

4.8.1.5. Briefs and Demonstrations: Using the SAFe-like agile methodology, progress will be assessed via briefing and demonstration to DC I&L and other stakeholder representatives for alignment to mission requirements. Demonstrations will be conducted virtually utilizing MS TEAMS or equivalent virtual platform and are used to demonstrate that sprint work has met the definition of done prior to release.

Demonstrations conducted as a part of an information brief to higher, adjacent, or other stakeholder organizations are more infrequent (on demand) and will also be conducted virtually. Printed briefing materials are not required.

4.8.2. Support Integrated Product Teams (IPTs): As requested with prior notice, the contractor shall provide support for meetings related to tasks within this PWS. This support excludes the team-specific agile/scrum meetings/ceremonies which will be facilitated and run at the team level and meetings/ceremonies performed at the program level. The contractor shall be responsible for the following activities:

• Create, modify, and distribute the agenda and presentation materials for a meeting at least 24 hours prior to the meeting.

• Schedule, facilitate, and coordinate meetings .

• Create, track, and distribute meeting minutes/action item(s).

• Provide meeting minutes within two business days after the meeting.

• Track and manage all action items to closure.

4.8.3. System Artifacts: The contractor shall assist the Government in producing System Artifacts to ensure continuity of operations and to meet regulatory and statutory requirements. System artifacts include system briefs, tracking of registered software, maintaining SOPs, and system demonstrations. In summary, artifacts are significant from a project management perspective as deliverables.

4.8.3.1. System Briefs: The contractor shall prepare, update, and deliver system briefs, whose criteria and location are determined by the COR within five business days of request. The brief may include, but is not limited to, business process and functional workflow of the system and system features, capabilities, characteristics, and technical specifications.

The briefs may be in contractor format unless a format is specified by the COR for a particular brief.

4.8.3.2. Track Registered Software: The contractor shall assist the Government in validating, tracking, and documenting any software to be installed and implemented as part of the LI2S-MC portfolio of systems is first registered and approved for Marine Corps use in the Department of Navy Application and Database Management System (DADMS), in sync with the system’s release cycle. The contractor shall request approval from the COR prior to using any software that is not registered in DADMS. Additionally, the contractor shall provide notification of end of Life (EOL)/end of sale (EOS) for software licenses supporting the LDT projects.

When within contractor’s control, the contractor shall assist the Government in tracking registered end of support software licenses one hundred and twenty (120) days out in coordination with the Government’s management of Department of Defense Information Technology Portfolio Repository – Department of the Navy (DITPR-DON).

4.8.3.3. Maintain SOPs: The contractor shall assist with developing new, or update and maintain existing copies of, system SOPs, system administrator manuals, software installation guides and user manuals in sync with new system releases. The Government or contractor can propose an approach to consolidate, or merge, documentation based on changes to system design. Any changes to documentation will be implemented upon Government approval.

4.8.3.4. System Demonstrations: The contractor shall perform system demonstrations of system functionalities and system architectures when requested by the COR, in conjunction with the appropriate programmatic personnel. The contractor shall perform these demonstrations at least once per quarter. Each demonstration should take no more than 2-4 hours.

4.8.4. Schedule/Product Roadmap: The contractor shall provide a Product Roadmap that addresses the epics and user stories (features, enablers, product defects, etc.) planned for each program increment, current sprints, and forecasted release dates. Initial Product Roadmap due no later than 45 days after contract award. The contractor shall update the roadmap at the end of each sprint to support sprint planning and provide insight into release burn down. The format shall be proposed by the contractor and product shall be approved by the Government (current Product Roadmap software is Road Munk).

4.9. Communication and Coordination: See base PWS contract # M6785426D7601.

4.10. Training See base PWS contract # M6785426D7601 in conjunction with the below specifications.

4.10.1. End User Training: Development team of subject matter experts provide new developer educational and hands on training, online or in person.

4.10.1.1 Training Products: Training support is required to maintain the minimum acceptable level of proficiency or capability required for the System User to accomplish the mission objectives. Training team will participate in ADT events to establish parallel training released that correspond with release of a new feature/s, modified feature/s, or enhancements. The contractor shall determine the impact to the user and impact to the current training material based on these events and coordinate with the Product Owner/s for training releases. In cases that an impact to the user requires enhanced or in person training, the contractor shall work with the ADT and PO team to develop or modify training products to support the feature release/s. The contractor shall create training documentation. Currently developed training products include:

a) Webinars: web-based seminars that augment primary training materials and used to provide sustainment or differences training.

b) Web-based Training: any training curriculum that is provided via the Internet through the use of a learning management system.

c) Job performance aids: anything added to the work situation that improves job performance by guiding, facilitating, or reminding the performers in their execution of job tasks.

d) Newsletters: aids to communicate training updates and system enhancements to a dispersed user community.

e) Frequently Asked Questions/ Knowledge Based Articles: listed questions and answers, all supposed to be commonly asked in some context, and pertaining to a particular topic.

f) Video of complex tasks shall be created to assist users in performing tasks. Videos consist of computer video capture with voice over instructions.

g) Course Surveys: feedback from stakeholders.

4.10.1.2 Training Plans: Not required for this TO.

4.10.2 On-site Functional Training: Not required for this TO.

4.10.3 Exercise On-site Functional Training: Not required for this TO.

PART 5

APPLICABLE PUBLICATIONS

5. APPLICABLE PUBLICATIONS

5.1. Appendix A: Applicable References: The contractor shall abide by all applicable regulations, publications, manuals, and local policies and procedures. Citations will include nomenclatures, numbers, and locations.

Title Authority/Version Location Cyberspace Workforce management DoD Directive 8140.01 Government Repository

DOD CUI DoD Directive 5200.48 https://www.dodcui.mil/Home/Policy/

DoD Operations Security (OPSEC) Program

DoD Directive 5205.02E https://www.esd.whs.mil/Directives/issuances/ dodd/

DoDAAC Management MCO 4400.201 Vol 2 https://www.marines.mil/News/Publications/M CPEL/Electronic-Library- Display/Article/900715/mco-4400201-volumes-1-17/

RMF DoD Directive 8510.01 https://dodcio.defense.gov/library/ FISMA Compliance N/A Government Repository

Homeland Security Presidential Directive

12 (HSPD-12) https://www.dhs.gov/homelandsecurity-presidential-directive-12

Issue Release/Receipt Documents DD-1348-1A https://www.esd.whs.mil/Portals/54/Documents /DD/forms/dd/dd13481a.pdf

Marine Corps Cyberspace Information Technology /Cybersecurity Workforce Qualification Program (Cyber IT/

CSWF QP)

ECSM 024 Government Repository

Organizational Conflict of Interests

(OCI)

FAR Subpart 9.5 https://www.acquisition.gov/far/subpart-9.5

Operations Security…