TRAC2ES Re-compete PWS.docx

Program Executive Office USTRANSCOM (PEO-T)

Performance Work Statement (PWS)

For

TRANSCOM Regulating and Command & Control Evacuation System (TRAC2ES)

21 September 2020

UNCLASSIFIED

Table of Contents

UNCLASSIFIED

Description of Services Background The United States Transportation Command (USTRANSCOM) provides global air, land, and sea transportation for the Department of Defense (DoD), both in times of peace and war through its Transportation Component Commands (TCCs): Air Mobility Command (AMC); Surface Deployment and Distribution Command (SDDC); and Military Sealift Command (MSC). USTRANSCOM provides synchronized transportation, distribution, and maintenance. Additionally, USTRANSCOM projects and maintains national power with the highest efficiency, the greatest speed and agility, and the most reliable level of trust and accuracy.

DoD Instruction (DoDI) 6000.11, Patient Movement, assigns the Commander of USTRANSCOM as the single manager for global patient movement and directs USTRANSCOM to develop and implement integrated patient movement regulation and evacuation processes. The Joint Publication (JP) 4-02 provides the doctrinal foundation for the patient movement system and clarifies DoD policy for patient movement of contaminated, contagious, or potentially exposed casualties. Supplemental guidance, USTRANSCOM Instruction (USTCI) 90-9, Roles and Functions, further assigns theatre patient movement requirements center processes and responsibilities to the USTRANSCOM Surgeon General (TCSG) and clarifies USTRANSCOM policy for patient movement of contaminated, contagious, or potentially exposed casualties.

The TRANSCOM Regulating and Command & Control Evacuation System (TRAC2ES) combines relevant doctrine, policies, processes, and procedures along with an automated decision support system to manage the DoD global patient movement process. TRAC2ES provides for patient movement monitoring, forecasting, and planning to support both fixed and deployable operations and includes medical regulating and patient evacuation. TRAC2ES provides in-transit visibility (ITV) and command & control decision support. TRAC2ES supports the Assistant Secretary of Defense for Health Affairs (ASD(HA)), the Joint Staff, Combatant Commanders, and USTRANSCOM during war, peace, contingencies, and operations other than war.

At present, TRAC2ES Non-Secure Internet Protocol Router (NIPR) production environment is currently in the USTRANSCOM Unclassified Government Cloud (TC-UGC).

Objective The objective of this requirement is to provide software development support, Information Technology (IT) security, administration, and expertise for TRAC2ES NIPR and Secure Internet Protocol Router (SIPR) environments. This includes all software code and associated components and integrations. Software development support shall include any phase of the Software Development Lifecycle (SDLC), including concept development, planning, requirements elicitation and analysis, systems design and development, coding and testing, deployment, implementation, integration, troubleshooting, security posture, documentation, software application maintenance, and sustainment.

Responsibilities include managing the code baseline, the hosted environment, and system interfaces. The code baseline may change as a result of user preference, latent defects, change requests, security requirements, or updates to Commercial Off The Shelf (COTS) products used by the system. Additionally, production support to include troubleshooting and resolving user problems as well as identifying opportunities to improve the system is required in the performance of this effort. Overall, software development support shall include all aspects of the SDLC necessary to sustain and modify the system baseline.

Scope The purpose of this requirement is to provide software development support for TRAC2ES. The Contractor shall provide solution consulting and programming to: (1) implement new system capabilities; (2) implement software change requests; (3) sustain deployed capabilities by rapidly troubleshooting and repairing software issues (i.e. correct software defects); (4) provide technical expertise to ensure high availability of the application to meet the USTRANSCOM mission; (5) receive and respond to problems reported by system users (i.e. correct incidents); (6) support security documentation and continuous monitoring; and (7) improve the system’s security posture. The Contractor shall provide support in achieving the discipline of Development/Security/Operations (DevSecOps). The Contractor shall utilize the most current available USTRANSCOM Enterprise approved tools for achieving DevSecOps and maximize cloud services. The Contractor shall provide system functionality while reducing and/or eliminating dependency on individually licensed Commercial Off The Shelf (COTS) products. This support shall include expertise with Java.

In addition, the Contractor shall provide support to build and maintain the TRAC2ES development and staging environments and maintain the TRAC2ES production environment in the USTRANSCOM – Unclassified Government Cloud (TC-UGC). Additionally provide support to maintain the classified on-premisis production environment and build and maintain the classified production environment when the TRANSCOM – Classified Government Cloud (TC-CGC) becomes available. The Contractor shall work closely with other members of the team to include Government Product Owners, engineers, security, and end-users.

The Government may require surge support during the base or any option period; surge modifications will be within the scope and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8. The Contractor shall coordinate with the Government to ensure that all activities are well synchronized and integrated with other USTRANSCOM and distribution management efforts. All functions and activities shall be task driven and work performed shall be in accordance with (IAW) all applicable regulations and guidelines.

References All references, including electronic libraries, can be found in Appendix A, References.

Performance Requirements The Contractor shall use a Government provided Application Lifecycle Management (ALM) tool (e.g. JIRA and Confluence) to effectively manage and execute the Agile Scrum methodology to analyze requirements, decompose large requirements into logical sub artifacts, create user story level artifacts and technical specifications (i.e. Epics or large features must be decomposed into user stories), coordinate with the appropriate subject matter experts (both technical and functional) to receive approved acceptance criteria for Epic/Task/Subtask level artifacts, set story points and establish a waterline to develop and test software, create test scripts and implement User Acceptance Testing (UAT), and keep artifact statuses updated (artifacts are the method for identifying a change with software which will be deployed into Production). To maintain predictable velocity, team members are encouraged to collaborate towards requirements completion and the developers shall complete the artifacts they commit in each software sprint. User stories and design documentation shall be maintained within the Government provided ALM tool. The technical release documentation shall document all changes and procedures necessary to promote a release into production.

The Government will assign requirements to the Contractor for fulfillment via the Government provided ALM tool. Each assigned requirement will have one (1) or more associated artifacts.

The software development sprint length shall be mutually agreed upon. Sprints may be a minimum of one (1) week but shall not exceed four (4) weeks in length, and result in releasable product.

Task Area 1: Task Order Management The Contractor shall provide the planning, direction, coordination, and control necessary to accomplish all requirements in this PWS. The Contractor shall designate key personnel responsible for the cost, schedule, and technical performance for the contract and shall serve as a primary Point of Contact (POC) for both management and technical matters. In addition, the Contractor shall participate in Program Management Reviews where the status of the work and associated deliverables are reviewed in the context of the business processes supported by the system.

Deliverables:

Task Order Management Plan (TOMP). The Contractor shall prepare a TOMP describing management’s plan to track the quality/timeliness of deliverables, organizational resources, and management controls to be employed to meet performance requirements.

Product Roadmap. The Contractor shall maintain a product roadmap to plan out new system capabilities, functionality changes, system maintenance, and/or product upgrades. The product roadmap shall include, at a minimum the current sprint, sprint+1, and sprint+2. The Contractor shall collaborate with the Contract Officer Representative (COR) to obtain the Government’s priority on software features and product updates.

Monthly Status Report (MSR) The Contractor shall provide an MSR that includes by task the financial performance, performance based on Net Ready-Key Performance Parameters (NR-KPP) identified in Paragraph 2, system availability, and schedule status. The MSR will include proposed changes to the schedule as detailed in the management plan as well as, technical accomplishments, issues and risks, and planned activities for the next reporting period. Any issue requiring Government response or action shall be brought to the Government’s attention immediately upon identification, and status captured in monthly reports.

This report will contain the calls and artifacts received and the actions taken during the reporting period. It shall correlate actions taken to other tasks or solutions that address resolving the reason for the artifact. Since the artifacts are assigned via the ALM tool, and the Contractor will enter results into the ALM tool, metrics associated with the responsiveness, quantity, and duration of the artifacts will be extracted directly from the ALM tool. The status report shall include a cumulative tally of all artifacts assigned to the most recently completed release that have not been previously reported. This tally shall include the release identifier, total number of artifacts assigned to a release per category, the category (e.g. established within the ALM tool such as Requirement, Change Request (CR), Defect), and a total sum of total artifacts across all categories. Further, the report shall contain a sum of artifacts (per category and overall total) that were planned for each sprint (i.e., above the waterline after sprint planning using story points), as well as the sum of artifacts that are accepted in User Acceptance Testing (UAT) (per category and overall total) and placed into production with the scheduled release. A notional example is provided below:

Table 1 – Notional Example

10.3.1

Deliverable:

Monthly Status Report (MSR) Scrum Ceremonies and Weekly Updates The Contractor shall provide a detailed approach on how the Scrum teams will satisfy the requirements. The Contractor shall provide Scrum Master(s) to lead the scrum team(s), and conduct scrum ceremonies (i.e. Sprint Planning, Daily Stand-ups, Sprint Reviews, and Sprint Retrospectives). Additionally, the Contractor shall conduct Weekly Update Meetings to (1) provide status on current development efforts and discuss any blockers or impediments, (2) schedule early looks or demos to aid developers throughout development as needed, (3) provide status on getting the Sprint +1 user stories and acceptance criteria to meet Definition of Ready, (4) Help Desk issues, and (5) Administrative updates such as upcoming calendar events, etc. The Contractor shall provide presentation material in a format compatible with Microsoft Office.

· Sprint Retrospective Output. The contractor shall provide the list of improvements team members have agreed to achieve in the upcoming sprints.

· Weekly Update Meeting Agenda and Meeting Minutes. The Contractor shall provide the status on current development sprints, the status on planning and preparations for the next development sprints, the status on production support issues, and administrative items.

Task Area 2: Software Development Support This task includes responding to requirements that are generated by the Government through change requests, program, security, production support, or trouble reporting mechanisms. ALM artifacts are the method for identifying software changes, which will be deployed into the Production environment. The Contractor shall properly record user stories, associated acceptance criteria, issues, and software solutions to create a knowledge base. The Contractor shall use the Agile Scrum Framework, along with extreme programming practices such as test driven development, refactoring, and continuous integration when completing artifacts (i.e., requirements elicitation and decomposition, completion of user stories and specifications, software development, security code scans with analysis, unit testing, integration testing, and User Acceptance Testing (UAT)). The Contractor shall use a microservices architecture for new code, and decouple monolithic legacy code when appropriate (e.g. failure isolation, multiple rates of change, simplify external dependencies, etc.) for long-term usability and scalability of the application. Additionally, the Contractor shall automate testing, security updates, configuration management, the software build process, etc. necessary to achieve Continuous Integration/Continuous Delivery (CI/CD).

Deliverables:

Software. The primary deliverable of this task is software code, system configurations, database schemas, etc. All software code, system configurations, database schemas, etc. associated with this contract shall be provided to the Government with unlimited rights and shall not contain any company proprietary markings, logos, or any distribution restrictions except as identified by the Government. Software code shall be installed on the Government’s Staging and Production servers and provided as a tagged code segment via the Government managed code repository and/or delivered on other mutually agreed upon format.

Release Documentation. As a minimum, this shall include a work plan with recurring updates, static code scans (e.g. Fortify scans), release test plan with results, UAT plan with test scripts, and contractor inputs to minor mod checklists (i.e. release notes), which include all artifacts with associated descriptions and solutions, and deployment instructions.

Updated Project Documents. Documentation sufficient to install, operate, and maintain the system shall be provided and maintained. These documents shall include updates to the product roadmap, COTS products, Web-Based Training Course Lesson updates, Web-Based Training Course Story Board updates, User Training Guide updates, Instructor’s Training Manual updates, system installation procedures, and any supporting documents necessary for the Government to sustain the system. The user guides will cover all end-user sections of the system, to include the Business Intelligence analytics tool. The Contractor will ensure that TRAC2ES Web-based training course (hosted on Joint Knowledge Online (JKO)) is maintained and up-to-date. The User Training Guide will consist of volumes based on end-user role to include, but not limited to:

· Overview

· Patient Movement Clerk

· Transport Crew Member and Secondary Roles

· PMRC User

· Report User Updated System Documents, Security Documents, White Papers. All solution changes shall be documented as user stories, technical specifications and/or diagrams, interface control documents, system configuration documents, and/or Department of Defense Architecture Framework (DoDAF) architectural artifacts. Additionally, documentation will be generated and maintained to support Static Code Analysis, the Risk Management Framework (RMF), Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), DoDI 8530.01, Cybersecurity Activities Support to DoD Information Network Operations, and the DoD Cloud Computing Security Requirements Guide (CC SRG).

Agile Software Development Support The Contractor shall respond to ALM artifacts to change the system, as prioritized and assigned by the Government Product Owner. The Contractor shall participate in and/or lead the Scrum process and other meetings to define, build, test, document, and deploy updates to the system baseline. The Contractor shall ensure ample lead-time for understanding and responding to unique change requests. The planning for requested functionality may include the Contractor’s recommendations to minimize rework and cost. If a change is beyond the Contractor’s capacity to complete within one sprint, the Contractor shall decompose the Epic and/or Features into smaller user stories, and update the schedule (i.e. product roadmap). Complex tasks may require additional planning before coding. These tasks are assigned to a sprint for development of a specification prior to the implementation sprint. The Contractor shall work with subject matter experts to create, and receive approval on, user stories and associated acceptance criteria, functional specifications and/or technical specifications. The Contractor shall support UAT for releases to ensure proposed changes are acceptable to users; and, when required, host release reviews for functional users to illustrate system changes. The Contractor shall assist with minor modification checklists (i.e. release notes); and shall provide necessary support to maintain and document the security posture of the application as required by RMF or applicable DoD accreditation processes.

Software Defect Support The Contractor shall respond to escalated production support issues that cause work stoppage or operational problems with the system, and ensure the Production system operates without interruption to functional users. Severity one (1) issues shall be acknowledged within four (4) business hours and resolution provided within one (1) business day. Severity two (2) and three (3) issues shall be acknowledged within one (1) business day and resolution provided within five (5) business days. Software defects that result in a work stoppage or impact to business operations shall result in an unplanned software Hot Fix. Correcting defects identified through production support that do not result in a work stoppage shall be prioritized and assigned to current sprints or to a future sprint by the Government depending on the impact to business operations. The Contractor shall assist the production support activity in identifying the root cause of production support malfunctions and creating ALM artifacts (i.e. software code changes) to permanently resolve or prevent them. The Contractor shall input all actions taken to resolve artifacts into the ALM tool. The Contractor shall coordinate with production support to ensure minimal rework and downtime during software changes, and to ensure the production support activity understands planned system changes.

Unclassified Deployment Pipeline Support (Optional Priced) Once TRAC2ES has established the Development environment in the TC-UGC, the Contractor shall provide the necessary support required to operate and maintain the Unclassified Development, Production, Test, and Staging environments to reliably and efficiently compile, build, test, and deploy code. This shall include maintaining virtual machines and components, such as servers, memory, firewalls, load balancers, and storage (i.e. databases). Additionally, the Contractor shall maintain and update the Ports, Protocols, and Services (PPS) information. This shall include ports for internal and external traffic as well as the source and destination IP Addresses information. Air Force Department of Defense (AF-DoD) approved PPS worksheet will be used; available on the PPS Management at http://intelshare.intelink.gov/sites/ppsm.

Task Area 3: Monitoring and Production Application Support This task includes monitoring and troubleshooting production applications and responding to incidents that are generated by system users. Production support tickets shall be generated within the ALM tool. Production support tickets are the method for tracking and resolving incidents (i.e. specific issues), as well as processing user account requests. Incidents may involve generating software defect artifacts (i.e. for systemic problems requiring code changes), which will be prioritized by the Government. The Contractor shall document incidents and systemic problems for accurate reporting, metrics, and to provide a knowledge base within the Government ALM tool. The Contractor shall be responsible for ensuring the description and resolution for incidents they resolve are documented clearly.

Deliverables:

· System Performance Report. This report shall contain all open tickets and include the ticket number, priority, associated tickets, descriptions, corrective action, date opened and closed with the user, as well as trend and other pertinent data. This report shall have the ability to be sorted. It shall correlate actions taken to other tasks or solutions that resolved similar tickets. If the Contractor has detected a trend, this report shall include a brief summary of the trend, associated tickets, pertinent distribution of causes, and recommended corrective action to prevent similar troubles. The Contractor shall use their expertise to recommend changes to software code, queries, data validations, etc. The Government will review these recommendations and provide guidance when appropriate. Since the production support tickets are managed via the Government ALM tool, metrics associated with responsiveness, quantity, and duration of tickets shall be extracted directly from the ALM tool and summarized in the report.

· Cyber Intrusion Incident Report. This report shall provide details identifying the root cause, impacts, and actions taken to resolve and prevent the vulnerabilities. The Initial Cyber Intrusion Incident Report is due within four (4) hours of the event. The Cyber Intrusion Incident Report Update is due within twenty-four (24) hours of the event. See paragraph 5.1, Cybersecurity for details.

Contingency Plan and Incident Response Plan Exercises The Contractor shall participate in an annual contingency plan exercise. The scenario based exercise includes a situation where participants “walk through” government supplied contingency procedures without any actual recovery operations occurring.

Deliverable: Server Logs upon Government request Monitoring Support The Contractor shall monitor current health, performance statistics, recent errors, full logs, and key metrics. The Contractor shall report and resolve any breaches, security attacks, or anomalies in activity. The Contractor shall use log collection, monitoring, and analysis to understand the relationship between network, infrastructure, servers, application framework, and user behavior to gain a comprehensive view across all activity, across all sources, servers, and locations. In the event of a Cyber incident or intrusion, the contractor shall conform to the policy outlined in the TRAC2ES Incident Response Plan. The Contractor shall report any detected cyber intrusions. Cyber incidents shall be documented in a Cyber Intrusion Incident Report. The incident report shall document and report loss/compromise, suspected compromise, suspicious contact, or activity involving systems accredited to process classified information. It may be used as a preliminary response to supplement national reporting requirements and provide a resource to document initial or first response to a Cyber incident.

Production Support Analysis The Contractor shall analyze problems and solutions to detect and report trends and “worst actor” features and/or processes. These recommendations shall consider the simplest solutions first. For example, a trend in user errors for entering data might be resolved by adding help text or changing data validations. On the other hand, recurring errors may require changes to functionality or the database. The Contractor’s expertise must be sufficient to support such an analysis and provide concise, actionable recommendations. For complex recommendations, the Contractor may have to collaborate with the Government or other Contractor personnel to create change specifications. Support analysis may also result in recommending changes to system documentation or training material.

System Data Analysis Support (Optional Task) – Pre-priced The Contractor shall provide advanced-level report query templates and data dashboards for functional users in support of patient movement operations and research. Using the business intelligence analytics tool, the Contractor will be available to respond to FMO requests for report query templates and data dashboards that can be downloaded. The Contractor shall be able to provide products within 3 business days of receiving the finalized request.

Deliverables:

· Business Intelligence analytics tool report query templates and data dashboards Cybersecurity Analysis The Contractor shall monitor and analyze Information Assurance Vulnerability Management (IAVM) Notices, DISA Security Technical Implementation Guides (STIGs), Joint Force Headquarters (JFHQ) Department of Defense Information Network (DODIN) orders, United States Cyber Command (USCYBERCOM) orders, USTRANSCOM Security Notifications, United States Computer Emergency Readiness Team (US-CERT) notices, and vendor security advisories. The Contractor shall determine system impact, identify mitigating factors, and provide recommendations to the Government regarding potential courses of action. The Contractor’s recommendations shall be compliant with DoD security requirements and industry best security practices. The Contractor shall ensure that cybersecurity remediation, patch deployments, and other significant security activities are considered in the Product Roadmap.

Cybersecurity Service Provider (CSSP) Support The Contractor shall provide Host Based Security System (HBSS) and Assured Compliance Assessment Solution (ACAS) scans weekly; and shall participate in one (1) Continuity of Operations (COOP) exercise (i.e. Intrusion Assessment or Incident Response) annually.

Interoperability Certification Support The Contractor shall ensure TRAC2ES maintains interoperability certification by the Joint Interoperability Test Command (JITC) in accordance with Chairman Joint Chiefs of Staff (CJCS) Instruction (CJCSI) 5123.01H, Charter of The Joint Requirements Oversight Council (JROC) And Implementation of The Joint Capabilities Integration And Development System (JCIDS). All documentation delivered also must meet recommendations and guidelines defined in DoDI 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS). The Contractor shall comply with the most current version of each reference. The Contractor shall review and provide inputs (if applicable) to the DoDAF artifacts provided by the USTRANSCOM enterprise architecture team and review the Enhanced Information Support Plan (e-ISP).

Platform/Infrastructure Support Until TRAC2ES is migrated to the TC-CGC, the Contractor shall provide System Administration (SA) and Database Administration (DBA) support focusing on architecting, deploying, maintaining and documenting TRAC2ES infrastructure in the current hosting environment. This includes, but is not limited to, the following activities: supporting the TRAC2ES infrastructure, promoting software deployments, security patching, incident and problem management, monitoring resource usage, application performance, and managing all system accounts. This position shall maintain a current Secret Clearance, with a current T-5 background investigation (See Paragraph 5.2), and current IAT I or IAT II certification. (See Attachment 2).

Commercial Off The Shelf (COTS) Support The Contractor shall provide support services for changes in COTS products to include patches (e.g. application, operating system, database), upgrades, and/or migration to newer technologies. This will involve analyzing the system for incompatibilities and deprecated features. Once prioritized by the Government, the Contractor shall refactor the necessary code to ensure continued system stability.

Task Area 4: Risk Management Framework (RMF) Support The Contractor shall be responsible for creating and maintaining System Security Assessment and Authorization documentation for RMF security authorization. The Contractor shall develop documentation in accordance with (IAW) DOD Instructions 8500.01, Cybersecurity, 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), and National Institute of Standards and Technology NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems and NIST SP 800-53A. In addition, the Contractor shall support existing system security documentation to facilitate security authorization in accordance with DOD Risk Management Framework (RMF). The TRAC2ES program currently functions under a Conditional Authority to Operate (cATO) package. The TRAC2ES program has submitted for a full RMF ATO – August 2020, which is pending approval. The contractor will be required to support the plan of actions and milestones (POA&M) required to acquire and sustain full RMF ATO or interim authorizations. In the event the ATO is not granted prior to this award, surge support may be required to support RMF activities as outlined in paragraph 1.5.5.2 of this PWS.

Along with the System Security Plan (SSP), the Contractor shall submit a plan and timeline to create any missing cybersecurity supporting artifacts IAW Attachment 1, Compelling Evidence Standards. The contractor shall participate in TRAC2ES assess and authorize (A&A) activities. The contractor shall manage and update existing system security documentation developed to facilitate TRAC2ES security authorization IAW RMF procedures. The Contractor shall conduct security certification activities as required to maintain current authorization and support follow-on authorizations.

The Government will be responsible for providing policy requirements associated with the program, while the developer will be responsible for building and incorporating the language into the required artifacts. In support of Task Area 5, the Contractor shall provide qualified staff with IAT II certification who will work under the guidance of the CISSP.

Deliverables:

· System Security Plan (SSP) & Plan for Cybersecurity Support Artifacts. The Contractor shall develop an SSP IAW DOD Instructions DoDI 8500.01, DoDI 8510.01, and NIST SP 800-18 and NIST SP 800-53A. The SSP will be a formal document that provides an overview of the security requirements for the system and describes the security controls in place or plans for meeting those requirements. The information gathered in paragraph 1.5.5.1 will be included in the SSP as it becomes available so that TRAC2ES remains continuously up to date.

Cybersecurity Planning Support The Contractor shall perform A&A and RMF activities to maintain system authorization and support follow-on activities. The Contractor shall ensure compliance by providing documentation of applicable RMF Controls, Assessment Procedures (APs), and Control Correlation Identifiers (CCIs). This involves coordination with the Government, and other Government appointed Contractors, such as System Administration, Security Engineer, Information System Security Manager, Information System Security Officer, and Functional Subject Matter Expert teams.

Additionally, the Contractor shall provide the required compelling evidence to demonstrate compliance with the requirements of the APs or CCIs, such as screen shots, audit logs, messages, completed forms, signed letters or other documentation, etc. Acceptable compelling evidence per requirements, APs, and CCIs are documented in Attachment 1--Compelling Evidence Standards. After contract award, the Government will provide the Contractor a list of the current controls, APs, and CCIs relevant to the TRAC2ES system. The Contractor shall contribute artifacts to demonstrate compliance with the requirements of the APs or CCIs. Some of the security controls within each control family may be inherited from the hosting environment or a third party provider.

Artifacts may include, but are not limited to:

Logical Diagram Network Diagram Data Flows (PPS) External Interfaces Type of Data Exchange Firewall Rules Authenticated Scans Protection Mechanism(s) Hardware and Software Inventory Lists Memorandums of Agreement/Understanding (MOA/MOU), Service Level Agreements (SLA), Interface Control Agreement (ICD) Acceptable Use Policy Task Area 5: Build Development Environment (Optional Task – Priced) The Contractor shall establish, configure, and validate a development environment for the TRAC2ES application within the TC-UGC (via the CITRIX/Virtual Desktop Infrastructure (VDI). The Cloud Service Provider (CSP) for the TC-UGC is currently Amazon Web Services (AWS) GovCloud. The Contractor shall ensure the environment can support development activities to include modifying software code, testing, and promoting software changes from the TC-UGC Development environment into the Test, Staging, and Production (i.e. Non-Production and Production) environments. This task requires a CITRIX/VDI account, CITRIX Receiver Software installed on the user workstation, and a DOD Common Access Cards (CAC) with a Non-Secure Internet Protocol Router Network (NIPRNET) email.

The Contractor shall enter the current product and sprint backlogs into the Government ALM and all appropriate program documents shall be maintained in the TC-UGC.

Deliverables:

TRAC2ES Cloud Development Environment Task Area 6: Contract Phase-In/Transition (Priced Optional) All key personnel/key positions must be onboard at start of the period of performance. Fifty percent (50%) total staffing must be complete within two weeks of the start of the Period of Performance (PoP) and 100% percent within 30 days. Upon completion of the phase-in period, the contractor shall ensure that personnel start dates and staffing levels do not impair performance to meet all deliverables. Contractor shall fill vacated positions within 3 weeks of vacancies, with equally skilled employees.

Delivery Schedule Table 2 Contract Deliverables is the authoritative source for the periodicity of all deliverables.

The Contractor shall deliver data and software with applicable data rights with the appropriate markings IAW Federal Acquisition Regulation (FAR) 52.227-1, 52.227-2, 52.227-3, 52.227-10, 52.227-11, 52.227-12, and Defense Federal Acquisition Regulation Supplement (DFARS) 252.227-7013, 252.227-7014, 252.227-7016, 252.227-7019, 252.227-7025, 252.227-7026, 252.227-7027, 252.227-7030, 252.227-7037, 252.227-7039, and 252.246-7001. The Government obtains under this contract “unlimited rights” to all computer software, software source code, computer software documentation, enhancements, technical data, and similar data developed exclusively at Government expense and delivered to the Government under this contract. “Unlimited rights” means rights to use, modify, reproduce, release, perform, display or disclose in whole or in part, in any manner and for any purpose whatsoever, and to have or authorize others to do so. For all non-commercial software provided by contractor, contractor shall ensure that any individual who creates any of the computer software provides an assignment of any and all proprietary rights in the computer software including all copyrights and patent rights to the software so that the Government has the unlimited rights to the software specified above. It is the contractor's obligation to ensure compliance with all open source covenants or requirements if any open source software is included in any deliverable. The contractor shall not use open source software with licenses that are incompatible with Federal law and regulation. See paragraph 4.4.2.1.

The Contractor shall embed the following Code Header in all software components delivered to the Government:

/// SECURITY CLASSIFICATION: UNCLASSIFIED

/// UNLIMITED RIGHTS

/// DFARS Clause reference: 252.227-7013 (a)(16) and 252.227-7014 (a)(16) /// Unlimited Rights. The Government has the right to use, modify, reproduce, release, perform, /// display or disclose this (technical data or computer software) in whole or in part, in /// any manner, and for any purpose whatsoever, and to have or authorize others to do so.

/// Distribution Statement D. Distribution authorized to the Department of Defense and /// U.S. DoD contractors only in support of US DoD efforts. Other requests shall be /// referred to the Program Executive Officer, USTRANSCOM.

/// Warning: This document contains data whose export is restricted by the Arms Export /// Control Act (Title 22, U.S.C., Section 2751, et seq.) as amended, or the Export Administration /// Act (Title 50, U.S.C., Section 4601 et seq.), as amended. Violations of these export laws /// are subject to severe criminal and civil penalties. Disseminate in accordance with /// provisions of DoD Directive 5230.25, Incorporating Change 2, October 15, 2018 and DoDI 5230.24, Incorporating Change 3, October 15, 2018.

The Contractor shall protect non-public information from unauthorized disclosure IAW DoDI 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information; DODI 5200.48, Controlled Unclassified Information (CUI); and DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. For specific CUI (https://www.archives.gov/cui/registry/category-list), see the CUI Registry. The Contractor shall reference The CUI-Marking Handbook.pdf and Protecting DOD’s Unclassified Information.pdf (included in GFI.) The contractor shall also comply with the Standards for Privacy of Individually Identifiable Health Information privacy rule issued under the Health Insurance Portability and Accountability Act (HIPAA) of 1996.

Table 2: Contract Deliverables

Final – due 5 business days after receipt of Government comments

1.5.1.2

Sprint Retrospective Output

1.5.2

1.5.2, 1.5.3,

1.5.2, 1.5.3,

Updates – due within 24 hours of the event

Updates – Annually; or upon changes to system security posture

AND/OR

Annually per Option Year (OY) – 20 business days prior to the end of each POP

Performance Standards Service Delivery Summary The Services Delivery Summary (SDS) represents the most important contract objective that, when met, will ensure contract performance is satisfactory. Although not all PWS requirements are listed in the SDS, the Contractor is expected to fully comply with all requirements in the PWS.

Table 3: Services Delivery Summary

Risk Management Framework deliverables shall be delivered on time and IAW the PWS.

Materials contain required information and no more than one late delivery in a twelve (12) month period.

Periodic Inspection – COR will review each product for completeness, accuracy & timeliness.

later than 4 hours after discovering a reportable cyber incident.

No more than one late cyber incident report or unreported cyber incident in a twelve (12) month period.

100% Inspection of all Cyber incidents and reports – COR will review assigned tasks for completeness, accuracy & timeliness.

Net Ready – Key Performance Parameters (NR-KPP) The Contractor shall ensure TRAC2ES meets all performance parameters and technical requirements identified in the current requirements specifications. The performance of each parameter shall be reported in the MSR. The system shall meet the NR-KPPs identified below.

Availability The ability for users to sign on and access the TRAC2ES system is paramount to the success of the program and this will be monitored by measuring the system’s ability to allow users to sign on and access the different TRAC2ES environments.

Availability is measured monthly by dividing the time (minutes) that the system was available by the total minutes within the month. This will include scheduled downtime.

An example:

· The month of September consists of 43,200 minutes

· The system was down 435 minutes in September, so the system was available 42,765 minutes

· 42,765 divided by 43,200 equals .9899

· Convert .9899 to a percentage format

· Availability = 98.99% There are different availability expectations, depending on the TRAC2ES system environment.

· TRAC2ES Production Availability (NIPR) = 99.3%

· TRAC2ES Production Availability (SIPR) = 99.3%

· TRAC2ES Exercise Availability = 99.3% The government will supply the format for the reporting that also details system and component degradation. Degradation may not directly affect availability, but it is an important indicator for the PEO for tracking performance trends. An important aspect of Availability reporting is to detail the items that affect availability, or might affect it in the future. The Contractor shall report on what is being done to mitigate these issues.

Production Support The Contractor shall respond to and resolve operational problems with the system. This task includes responding to incidents, analyzing and correcting specific incidents, creating software development artifacts for systemic problems requiring code changes, and following escalated tickets to resolution. Typical incidents to be resolved under this task include database updates for specific records with incorrect data, which involves determining the cause of the issue, correcting the database, and determining whether a code fix is necessary. Failover and recovery times are described in Table 4:

Table 4: Failover and Recovery Times

Identification of Potential and/or Follow-On Work The following performance tasks may be required under this task order as a result from the completion of the other tasks listed above, or as required by agency instruction.

Classified Deployment Pipeline Support – Upon establishment of the Classified Production environment in the TC-CGC, the Contractor shall provide the necessary support required to operate and maintain the Classified Non-Production and Production environments to reliably and efficiently compile, build, test, and deploy code. This shall include maintaining virtual machines and components, such as servers, memory, firewalls, load balancers, and storage (i.e. databases). Subtasks include: Static Application Security Testing (SAST) Support and DoD Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) Compliance Support

Cloud Migration Support: The Contractor shall…