2024.09.30 DTOD PWS.pdf

Controlled Unclassified Information (CUI)

PERFORMANCE WORK STATEMENT FOR SURFACE

DEPLOYMENT AND DISTRIBUTION COMMAND (SDDC)

DEFENSE TABLE OF OFFICIAL DISTANCE (DTOD)

24 September 2024

This page intentionally left blank

PERFORMANCE WORK STATEMENT

FOR UNITED STATES TRANSPORTATION COMMAND

MILITARY SURFACE DEPLOYMENT AND DISTRIBUTION COMMAND (SDDC)

Defense Table of Official Distance (DTOD)

Table of Contents

1. DESCRIPTION OF SERVICES

1.1 Background

1.2 Scope

2. TASK AREA 1 – SYSTEM INTERFACE / INTEGRATION / AND

PROGRAMMING

2.1. Subtask 1 – System Interface Support

2.2. Subtask 2 – Internal/External Interface Support

2.3. Subtask 3 – System Programming and Development

2.4. Subtask 4 – DTOD System Development and Product Integration

3. TASK AREA 2 – SUSTAINMENT AND MAINTENANCE

3.1 Subtask 1 – System Administration

3.2. Subtask 2 – Operating System Support

3.3. Subtask 3 – Database Management Support

3.4. Subtask 4 – DTOD—PC*Miler System Software Support

3.5. Subtask 5 – Configuration Management (CM)

3.6. Subtask 6 – Cloud Sustainment and Maintenance

3.7. Subtask 7 – Disaster Recovery (DR)/Contingency Operations

4. TASK AREA 3 – PROGRAM MANAGEMENT

4.1. Subtask 1 – Weekly Activity Report (WAR)

4.2. Subtask 2 – Project Schedule - Work Breakdown Structure (WBS)

5. TASK AREA 4 – INFORMATION ASSURANCE (IA) – RISK MANAGEMENT

FRAMEWORK (RMF)

5.1. Subtask 1 – Authorization and Assessment (A&A) Support

5.2. Subtask 2 – Accreditation Sustainment

6. TASK AREA 5 – CLOUD OPTIMIZATION

6.1. Subtask 1 – Cloud Optimization Services

6.2. Subtask 2 – Cloud Infrastructure Support

7. DELIVERABLES

8. SERVICE DELIVERY SUMMARY

9. GENERAL INFORMATION

9.1. Place of Performance/Work Hours

9.2. Period of Performance

9.3. Contractor Employees

9.4. Government Furnished Equipment (GFE) And Software

9.5. Government Furnished Information (GFI)

9.6. Non-Disclosure Agreement (NDA) for Contractor Employees

9.7. Safety Requirements

10. SECURITY REQUIREMENTS

10.1. General Security Information

10.2. Personnel Clearance (PCL)/Investigation Requirements

10.3. Company Facility Clearance (FCL)

10.4. Personnel Clearance Validation

10.5. Common Access Card (CAC) Issuance

10.6. Scott AFB/USTRANSCOM/HQ SDDC Physical Access

10.7. Visits By Non-Assigned Contractors

10.8. In/Out-Processing

10.9. Security Briefing/Debriefing Statement

10.10. Security Training

10.11. Security Permissions on DoD Systems

10.12. Security Compliance/Deviation

10.13. FPCON Impact on Work Levels (US Installation Only)

10.14. Security Regulation Compliance

10.14.1. DEPARTMENT OF DEFENSE (DOD) SECURITY REGULATION :

11. CYBERSECURITY

11.1. Operationally Critical Support

11.1.1 Handling of Non-Public Information

11.1.2. Periodic Government Inspections

11.2. Cybersecurity Incident Reporting

11.3. Cybersecurity Incident Reporting Timelines

11.4. Mandatory Reporting Data

11.5. Incident Reporting Coordination

11.6. Confidentiality and Non-Attribution Statement

11.7. Cyber Workforce Certification

12. CONTRACT TRANSITION AND KNOWLEDGE TRANSFER

12.1. Successor Contractor Transition Phase-In

12.2 The Phase-Out Transition

12.3. Transition Execution

14. APPENDICES:

APPENDIX A – Federal and DoD Regulations APPENDIX B –Nondisclosure Agreement (NDA) APPENDIX C - DTOD Current Interface Partners APPENDIX D – DoD Cyberspace Workforce Framework (DCWF)

APPENDIX E – ACRONYMS

PERFORMANCE WORK STATEMENT

DEFENSE TABLE OF OFFICAL DISTANCE

1. DESCRIPTION OF SERVICES

1.1 Background

As the Army component of the United States Transportation Command (USTRANSCOM) and a major Department of Army (DA) Command, the Surface Deployment and Distribution Command (SDDC) performs a vital role for the Department of Defense (DoD) in deploying, redeploying, and sustaining United States forces worldwide. To facilitate this mission, SDDC has developed several integrated transportation and business system capabilities that support the various DoD functional, financial, and operational elements. SDDC’s programs leveraged against new technologies within the command have increased the efficiency, effectiveness, and security of DoD’s business processes.

Defense Table of Official Distance (DTOD) is the official designated source for worldwide distance calculations used by the DoD for global official military, government travel and transportation of defense related cargo. SDDC is responsible for operating and maintaining the DTOD system on behalf of all DoD, including the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff (CJCS), the Combatant Commands (CCMDs), the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this issuance as the “DoD Components on worldwide basis, e.g., North America, South America, Europe, Africa, Oceania, and Asia. DTOD provides vehicular land distances for all DoD household goods, all DoD freight, Overweight/Over dimension (OW/OD), Hazardous Material (HAZMAT), Permanent Change of Station (PCS) travel and Temporary Duty (TDY) travel needs. DTOD generates point-to-point distances and routes for origin/destination pairs of locations.

The DTOD website’s distance calculation and mapping functions provide a road segment and cumulative distances over the network of truck-usable highways and roads. DTOD provides interface web services to internal/external interfacing systems. The web services receive up to 60,000-plus web services distance request per day.

1.2 Scope

The purpose of this requirement is to provide technical support services, Software Development Life Cycle (SDLC) management, and related project management support for continuous operations of the DTOD system. Specifically, the contractor shall provide services in support of DTOD within the cloud environment or any environment SDDC determines DTOD should run in to manage DTOD cloud system resources and data. The DTOD system is managed at Scott

AFB, IL.

The DTOD system services includes: DTOD’s web page interface, web services, systems located in remote/standalone areas (with limited to no Internet access), Batch-Pro, and Multi-Version Switch (MVS). Operations include but are not limited to maintenance and support of the DTOD.

PC*Miler is the Commercial Off-The-Shelf (COTS) product utilized as the core application for DTOD web application. PC*Miler software generates worldwide road routing and mileage for the DTOD Program.

DTOD operations require development and testing of new releases, resolution of mileage issues relating to current DTOD releases, and support of client utilization of DTOD web page and/or web services. All tasks shall be performed in accordance with (IAW) regulations and guidelines as shown in Appendix A and any new mandated regulations implemented throughout this performance period. The services provided within the scope of this requirement are considered Operationally Critical Support (OCS) as defined in Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

The Contracting Officer’s Representative/Alternate Contracting Officer’s Representative (COR/ACOR) or Government Program Manager (PM) will make all decisions regarding Government requirements and priorities.

Unless otherwise specified in this PWS, all days designated are business days. The contractor shall establish and utilize best practices, standard operating procedures, and repeatable and measurable controls in performing and delivering services associated with PWS tasks.

Services and support under this contract exist within the scope of the following PWS task performance areas:

Task Area 1: System Interface / Integration / and Programming Task Area 2: Sustainment and Maintenance Task Area 3: Program Management Task Area 4: Information Assurance (IA) – Risk Management Framework (RMF) Support Task Area 5: Application Cloud Optimization

The contractor shall provide technical and SDLC management support for DTOD. The contractor shall support all DTOD environments in a Government approved cloud environment using an agile development in a cloud DevSecOps, Non-Prod and Prod environment with scheduled updates. The contractor shall implement DTOD software changes, performance improvements, conformance to security requirements, and risk mitigation. The contractor shall coordinate with the Government to ensure all activities are well synchronized and integrated with other applications and transportation management efforts.

2. TASK AREA 1 – SYSTEM INTERFACE / INTEGRATION / AND

PROGRAMMING

The contractor shall develop interface requirements and provide PC*Miler software engineering and technical assistance support for the development of internal/external system interfaces. The contractor shall provide integration support of new interfaces and provide impact analysis and testing results of integration. Systems located in remote areas with limited to no Internet access may utilize a standalone version of DTOD PC*Miler. The contractor shall distribute a PC*Miler downloadable link to remote areas, per the approval from the DTOD program manager.

The contractor shall provide customers the ability to interface with DTOD to receive PC*Miler calculations over the Internet and utilizing the DTOD Web Services. The contractor shall ensure compatibility between DTOD system and any internal/external systems requesting DTOD web service interfacing. All web service interfacing shall require a Web Service Agreement (WSA) provided to the service partner from the DTOD PM.

2.1. Subtask 1 – System Interface Support

The contractor shall provide support to all existing interfaces and web services. The contractor shall review system requirements, current interfaces, architectural documentation, and configuration manual. The contractor shall perform routine analysis of PC*Miler software for maintaining and ensuring system functionality and accessibility. The contractor shall be responsible for:

A. Providing efficient and effective processes and methods for implementing system support.

B. Managing any complexities associated with operating from a cloud environment.

C. Managing DTOD system support requirements with system users both internally and externally.

D. Providing DTOD-PC*Miler technical reviews and functional capabilities testing.

The contractor shall update and maintain documentation of DTOD system web services NLT 30 days after each DTOD-PC*Miler version release when changes are made to existing web services exchange. The document is located at OneDrive shared contractor Continuity Plan folder.

The contractor shall coordinate with the DTOD PM in providing interface and web services support which include Configuration Control Board (CCB) and service partner notifications for all planned and unplanned DTOD system downtime, coordination on major version releases, acceptance testing of changes in DTOD interfaces or web services, and security patching.

The contractor shall provide, system information for data calls requested from PM within 3-business days or sooner when a short notice data call is required. Data calls include software validation, extracting/analyzing web service data and providing web service metrics, etc. This work may require working with the interfacing systems partners to identify their functional and technical requirements and interface requirements.

2.2. Subtask 2 – Internal/External Interface Support

The contractor shall provide assistance in developing a new external system requesting web service interface. The contractor shall support interfacing systems in maintaining usage of the DTOD Web Service and assist remote/standalone client users.

The contractor shall perform numerous tasks to support interfacing systems in consuming DTOD web services:

A. Communicate with internal/external interfacing systems development team members to provide Web Services Description Language (WSDL) instructions.

B. Provide support on how to utilize DTOD services and functions within the DTOD

PC*Miler COTS product.

C. Assist systems with service connectivity, functional interfacing testing, and verify test results.

D. Assistance shall be in the form of code development as it pertains to the utilization of

DTOD external system interfaces and web services.

E. Troubleshoot interface issues and verify calculation results with the external system development team.

F. Assist PM in preparing and maintaining system interface WSAs as required. DTOD maintains a standardized WSA provided to each system consuming services via DTOD web service. The WSA outlines the following transaction attributes:

a) DTOD system availability: threshold 98%; (24/7)

b) Network protocol: HTTPS

c) Transaction type: Simple Object Access Protocol (SOAP), used to exchange data, system to system, automatically with DTOD service partners.

NOTE: A listing of current internal/external interfacing systems consuming DTOD web services are listed in Appendix D, (DTOD Current Interface Partners).

2.3. Subtask 3 – System Programming and Development

The contractor shall provide web development, software development, and automated testing for the DTOD system in all common computing/cloud environments as needed. In addition, support will be given to web interfacing systems regarding troubleshooting issues with the DTOD web service and development of new code to interface with the DTOD web service.

The contractor shall provide coding to include:

A. Writing well designed, testable, efficient code by using best practices for development.

B. Creating a website layout/user interface by using standard Hypertext Markup Language

HTML/CSS development practices.

C. Gathering and refining system specifications and user requirements based on user trouble tickets.

D. Creating and maintaining software documentation.

2.4. Subtask 4 – DTOD System Development and Product Integration The contractor shall follow a Software Development Life Cycle (SDLC) process to include plan and analysis, design, develop, test, implement and sustainment, to be performed within the USTRANSCOM GovCloud. The contractor shall develop, maintain, and sustain the DTOD web site and page design, its functionality, and all DTOD service application(s).

The PC*Miler software vendor will deliver annually the PC*Miler BETA product to the Government. The DTOD contractor shall deploy the annual PC*Miler COTS software release (NLT 15 October) unless otherwise directed by the PM.

The contractor shall perform the following tasks:

A. Evaluate and validate the PC*Miler annual BETA product, with DTOD test plan.

B. Develop a front-end solution for the release if required.

C. Identify any issues with the software and ensure all customer driven feedback and requirements are presented in BETA release.

D. Provide feedback to the PC*Miler COTS vendor development team in bug report if fix action is required.

E. Evaluate and test the final PC*Miler production release.

F. Coordinate with DTOD PM to determine the release dates for stage and production and create CCB workflow for PM approval.

G. Maintain and ensure up-to-date documentation and artifacts are filed in all DTOD contractor OneDrive shared folders. Additionally, perform annual review of contractor shared drive after each PC*Miler version update.

H. Deploy PC*Miler software releases utilizing the change management (CM) and CCB business process for software implementation into the stage and production environments.

In addition, the PC*Miler software vendor will provide delivery of quarterly data updates, emergency updates, and application overrides when changes are necessary. The contractor shall provide continuous integration of updates from PC*Miler vendor. In the event of emergency updates, the PM or contractor (as directed by PM) shall notify via email of all impacted internal/external systems. Contractor shall provide all changes through change management, CCB workflow.

3. TASK AREA 2 – SUSTAINMENT AND MAINTENANCE

The contractor shall provide daily operations and support for the DTOD system and PC*Miler COTS product. The contractor shall maintain DTOD’s databases and servers, using Microsoft Structured Query Language (SQL) database and Windows operating systems. The contractor shall maintain and sustain application software, tools, applications, servers, interfaces, databases, and any other supporting software for DTOD applications and related functional tools in support of the DTOD user community and the Program Management Office (PMO). The contractor shall continuously maintain and update documentation on the architecture of interfaces, data, and software.

The contractor shall provide operational support to maintain DTOD applications, PC*Miler products and capabilities hosted in the USTRANSCOM (USTC) cloud environment. The contractor shall utilize the development and testing environment to diagnose and correct any issues that arise within DTOD. If any fix action is required, the change management (CM) and CCB workflow will be submitted for PM review/approval.

The contractor shall coordinate and cooperate with the SDDC, USTC, and IA/Cyber PMO to maintain compliance with the current governance for the certification and accreditation process to help maintain Authority to Operate (ATO) and Interim Authority to Operate (IATO).

3.1 Subtask 1 – System Administration

The contractor shall provide system administration and analysis for DTOD server infrastructure and PC*Miler software support. In this role, the contractor shall perform the following tasks:

A. System administration, container administration, SQL database administration, and

DTOD system support.

B. Plan and respond to service outages and all server related issues.

C. Diagnose any system outages upon notifications from System Response Center (SRC), Tier I helpdesk or calls from system users.

D. Provide Tier II and Tier III support to resolve DTOD routine helpdesk issues that are escalated from the Tier I SRC helpdesk level. The contractor shall respond to routine helpdesk request within one business day.

E. Provide after hour support in order to restore services. The contractor shall respond within one (1) hour of outage notification from Tier I SRC.

F. Diagnose and provide resolutions to technical problems reported by DTOD customers, interfaced system partners, or DTOD PM.

G. Install PC*Miler software.

H. Monitor servers and database performance, ensuring connectivity, and complying with all

Information Management Security and Risk Management Framework (RMF) requirements.

I. Comply with up-to-date Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), and any other upgrades/modifications.

J. Support USTRANSCOM GovCloud (or any environment SDDC utilizes) maintenance outages/upgrades.

K. The contractor shall provide instruction and/or web help for Product Improvements on the DTOD web site and provide customer support via email, phone and face-to-face when required.

3.2. Subtask 2 – Operating System Support

The contractor shall maintain hardware and software of the DTOD testing and development environment. In coordination with the CCB, the contractor shall apply server upgrades and patches as necessary to be compliant with the DoD Information Assurance Vulnerability Alerts (IAVAs). The contractor shall ensure that security vulnerability patches are installed by their suspense dates 98% of the time.

3.3. Subtask 3 – Database Management Support

The contractor shall maintain the database of the DTOD test and development environments.

Additionally, the contractor shall also maintain tables, stored procedures, and SQL jobs in the DTOD production environment. Database maintenance includes the installation and support of the current version of SQL server on DTOD test and development systems, as well as the creation or modification of all tables, stored procedures, and SQL jobs in the DTOD production, test, and development environments. The contractor shall provide system administrative and database administrative support for DTOD production and staging environments.

3.4. Subtask 4 – DTOD—PC*Miler System Software Support

The contractor shall maintain, sustain, support, and update the DTOD system and PC*Miler COTS product. System support includes installation and configuration of the DTOD web application and server service, troubleshooting and support of the system, and release of all revisions. The Government is responsible for procuring/providing the PC*Miler COTS product on an annual basis.

PC*Miler COTS product support includes the installation and configuration of the current software product. It also includes testing of all system revisions to the COTS product. The DTOD Government PM or contractor shall provide feedback to the COTS vendor for all issues or changes requested to the COTS product.

The contractor shall create, maintain and review DTOD Web Service Installation Guide annually upon PC*Miler Beta testing and development for DTOD-PC*Miler release, to ensure up to date instructions (update as changes are needed). The guide shall define instruction on installing PC*Miler web services. This document will be saved at OneDrive shared contractor ALK Installation folder.

3.5. Subtask 5 – Configuration Management (CM)

The contractor shall participate in the Government’s weekly enterprise CCB workflow meetings to review and discuss the status of all ongoing updates and changes to existing system capabilities. Participation will ensure contractor activities are focused on areas deemed important by the Government and facilitate proper vetting of changes within the Government’s cloud environments across all affected programs and environments.

The contractor shall follow standard operating procedures (SOP) as provided by the Government. These procedures include enterprise infrastructure, configuration control board, infrastructure change requests, infrastructure Approved System Interruption (ASI) and configuration management standards to support all SDDC GovCloud application and infrastructure changes.

The CM process includes the following:

A. Providing any information the CCB requires.

B. Providing support meeting SDDC’s technical requirements.

C. Facilitating orderly configuration identification, change identification and control, status reporting and configuration auditing. This process aims to revise capability, improve performance reliability and maintainability and reduce system defects.

D. Ensuring changes take place in an identifiable and controlled process and does not adversely affect any properties of the other system or interfaces.

E. Establishing and maintaining the integrity of a project’s products throughout the project lifecycle.

F. Identifying the configuration items of products developed and delivered to the customer, systematically controlling changes to the configuration, and maintaining configuration traceability.

G. Providing continuous delivery of all source code into the Government GIT repository following each DTOD release or change to web site and web services.

H. Coordinating with the SDDC CCB and DTOD PM prior to implementing changes to any environment.

I. Input/update all changes into the Government provided Serena Business Mashups toolset to support automated workflow management of Software Change Request (SCR) processing.

3.6. Subtask 6 – Cloud Sustainment and Maintenance

The contractor shall sustain DTOD capabilities as a component of SDDC’s cloud computing environment, including tools that reside within the Cloud Environment. The contractor shall support development, testing, staging, and production for DevSecOps, Auto-Resiliency, Web-services, Micro-Services and Platform Agnostic in the Cloud computing environment, leveraging cloud-native services and automated pipeline technologies.

The contractor shall provide status updates on cloud modernization strategy milestones in a Government provided format. Once the system is determined to be Cloud Native, the contractor shall continue to upgrade and enhance cloud and functional operations throughout the duration providing sustainment, ensuring DTOD meets all current and emerging Cloud Native and functional criteria.

3.7. Subtask 7 – Disaster Recovery (DR)/Contingency Operations The contractor shall provide support to the Government during emergency operations or application disruption in accordance with the program’s approved disaster recovery and contingency operations plans prepared by each program. The contractor shall ensure resources and key personnel are available throughout an emergency in accordance with the established plan.

The contractor shall participate twice a year/during disaster recovery/contingency exercises as specified by the Government. The contractor shall develop/update disaster recovery contingency exercise test plan. For each disaster recovery contingency exercise, the contractor shall submit the Contingency Exercise Test Plan which covers the exercise summary to include; lessons learned, recommendations, and areas to be re-tested (if any). The contractor shall deliver the contingency exercise test plan which covers exercise summary. Contactor shall provide to the PM within 3-business days after DR contingency exercise.

4. TASK AREA 3 – PROGRAM MANAGEMENT

This task consists of the functional activities relating to the administration and management of this requirement. The contractor shall provide day to day project management oversight of all projects and tasks. Contractor shall communicate with the DTOD PM in keeping him/her updated weekly on project status.

The contractor shall participate in Program Management Reviews (PMRs), Technical Interchange Meetings, and assist in other technical meetings/presentations, as required by the DTOD PM/designated Government representative.

4.1. Subtask 1 – Weekly Activity Report (WAR)

The contractor shall provide written Weekly Activity Reports (WARs) to the PM every Monday including an update to all proposed, approved, in-progress, and completed activities.

4.2. Subtask 2 – Project Schedule - Work Breakdown Structure (WBS) The contractor shall prepare a project schedule with WBS that defines all tasks, sub tasks, durations, resources, and dependencies.

The contractor shall perform the following for this task:

A. Create project schedule with work breakdown structure in Microsoft Office formats (i.e.

Project schedule, Word document or Excel spreadsheet) and updated weekly to include each newly assigned project from the PM.

B. The contractor shall develop and maintain schedule breakdown for each project C. The schedule shall be maintained and kept up to date weekly to identify all in progress and planned projects and tasks as they progress to completion.

D. The schedule shall be kept in the OneDrive shared contractor project folder.

5. TASK AREA 4 – INFORMATION ASSURANCE (IA) – RISK MANAGEMENT

FRAMEWORK (RMF)

Risk Management Framework (RMF) Support: The contractor shall work with the Government and Contractor Information Assurance Team as designated within SDDC/USTRANSCOM to provide and share system security data and program information.

The contractor shall develop, configure, and operate information system components securely in accordance with the current versions of DOD policy, National Institute of Standards and Technology (NIST), Special Publications (SPs), National Security Agency (NSA) publications, Committee on National Security Systems (CNSS) issuances, and United States Cyber Command (USCYBERCOM) tasking orders and requirements. Furthermore, the contractor shall improve cyber resiliency for the information system and reduce vulnerability to the DODIN by monitoring and integrating security and RMF activities into the SDLC.

5.1. Subtask 1 – Authorization and Assessment (A&A) Support

Upon annual RMF revalidation, the contractor shall create, edit, update, and maintain the information system security assessment and authorization (A&A) as well as document control compliance for all applicable security control families necessary to achieve an authorization decision (authorization to operate/connect [ATO/ATC] or interim authorization to test [IATT]) and support continued authorization IAW, the current version of DOD Instruction (DODI) 8500.01, Cybersecurity, DODI 8510.01, NIST Special Publication 800-37, Risk Management Framework (RMF) for DoD Information Technology (IT), Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling Program, Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National Security Systems, NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53A, assessing Security and Privacy Controls in Federal Information Systems and Organizations.

The contractor shall coordinate with the SDDC, USTC, and IA/Cyber PMO to update ATO requirements to ensure compliance with the current governance for the certification and accreditation process to help maintain Authority to Operate (ATO) and Interim Authority to Operate (IATO).

In addition, the contractor shall support and update existing system security documentation within the Enterprise Mission Assurance Support Service (eMASS), or other Government selected tools in accordance with timelines and frequencies specified by the Government to facilitate and maintain security authorization in accordance with DOD RMF and USTRANSCOM RMF authorization requirements.

5.1.1. The contractor shall support requirements with submitting systems for authorization decisions (ATO/ATC/IATT) within the timelines identified in the USTRANSCOM Chief Information Officer (CIO) memorandum and RMF Guidance. The contractor will produce evidence/artifacts that validate security control requirements established within NIST SP 800-53, IAW USTRANSCOM published standards and guidance by utilizing the current USTRANSCOM RMF grading rubric. Evidence/artifacts meeting the assessment standards of NIST SP 800-53a will be utilized to support an authorization decision according to the normal processing times and date of need. The contractor shall identify sources of evidence/artifacts for the A&A package to the Government.

5.1.2. The contractor shall support Interim Authorization to Test (IATT) activities for system testing on the operational network or when using live data (data that has not been sanitized to remove operational information) by providing the following documentation:

• An updated architectural diagram (showing test configuration)

• Proposed ports, protocols and services (PPS) declaration worksheet

• Comprehensive test plan that describes the test environment, projected specific testing events and schedules, and expected outcomes for remediating existing or future vulnerability.

5.1.3. The contractor shall have an ongoing responsibility for writing and updating supporting evidence/artifacts required by the applicable security controls for all deliverables as identified in control guidance in eMASS, NIST SP 800-53 series documents and CNSSI 1253. The contractor shall demonstrate requirements compliance, outline non-compliance and mitigations, and justify non-applicable controls to support information system continuous monitoring efforts and the USTRANSCOM Digital Modernization Strategy.

The contractor shall ensure security control evidence/artifacts clearly support compliance or describe non-compliance with the security control within eMASS. Non-compliance shall state the raw severity of the risk, mitigations (in place and/or planned), and a recommendation for residual risk to the Government. Evidence/artifacts shall be specific to the security control and shall have annotation within the artifacts to call attention to the topic. Evidence/artifacts shall be delivered to the Government upon annual RMF revalidation according to the Government-specified authorization/ reauthorization timeline within eMASS or other Government-selected tools.

5.1.4. The contractor shall provide evidence for applicable security controls, as identified in the current version of NIST 800-53A and NIST SP 800-30, Guide for Conducting Risk Assessments, as specified in DOD, CNSS, and USTRANSCOM guidance to demonstrate compliance with the requirements of the Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs)/Security Requirements Guides (SRGs), Assessment Procedures (APs), and Control Correlation Identifiers (CCIs), such as:

• screen shots

• audit logs

• Messages

• Security Content Automation Protocol (SCAP) scans

• software code scans (as required by the USTRANSCOM Code Scanning Policy)

• Assured Compliance Assessment Solution (ACAS) scans

• mitigation plans

• diagrams

• completed forms and checklists

• signed letters and/or other documentation, etc.

The contractor shall automate and conduct scans and accompanying analyses in accordance with USTRANSCOM RMF, scanning, and continuous monitoring policies. Additionally, scan results and analysis to the Government to allow vulnerability remediation shall be provided. The contractor shall upload software code scans (fortify or similar government-specified tool), ACAS, STIG/SRG scans, and STIG/SRG manual checklists in eMASS to facilitate authorization/reauthorization activities. In addition, the contractor shall:

• Document compliance/non-compliance within eMASS or other Government selected tools.

• Track non-compliance and milestones in the Plan of Actions and Milestones (POA&M).

• Identify planned and implemented countermeasures for risk mitigation with realistic timelines and resources for resolving the non-compliant security controls.

• Maintain/update POA&M to ensure proper disposition of vulnerabilities (e.g. Completed, Ongoing, Risk Accepted, etc.)

• Update changes, plans, milestones, mitigations, and risk levels as required.

5.2. Subtask 2 – Accreditation Sustainment

The contractor shall provide DTOD specific input for the development of security documentation and the updating of existing system security documentation to facilitate the security accreditation of the SDDC G6 IMA systems IAW Department of Defense Instruction (DODI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT). Additionally, the contractor shall meet and sustain the application and its environment in compliance with the DISA STIG. The results of the DISA STIG documentation shall reflect the current status of the associated information system which shall require monthly updates. The contractor shall provide updates to existing certifications and accreditation documentation, such as network diagrams, ports and protocol listings, and other existing documentation when required. The contractor shall be required to provide updates to the program manager for the GovCloud Infrastructure’s RMF POA&M. The contractor shall assist in annual RMF review and monitor the status of the RMF package through the accreditation phases.

6. TASK AREA 5 – CLOUD OPTIMIZATION

The contractor shall monitor, control and sustain DTOD cloud computing resources and environments. The contractor shall support this application in a Government-approved Cloud environment, leveraging cloud-managed services and automated pipeline technologies.

6.1. Subtask 1 – Cloud Optimization Services

The contractor shall support DTOD in a cloud environment using agile development and provide technical and systems engineering support to the SDDC Enterprise as well as:

• Be responsible for any application-specific issues within cloud environments.

• Stay abreast of new technologies and DoD guidance regarding DTOD infrastructure and supporting technologies.

• Implement new technologies to ensure the DTOD infrastructure remains current.

The contractor shall provide cloud optimization services in support of DTOD system to include:

A. Optimize delivery of DTOD application to a government-approved Cloud Service Provider (CSP) cloud service offering (CSO) using an agile development.

B. Provide support of the DTOD system in production and staging cloud hosted environments.

C. Leverage cloud-managed services and automated pipeline technologies.

D. Maintain cloud security and compliance services with IA remediation strategies for vulnerabilities.

6.2. Subtask 2 – Cloud Infrastructure Support

The contractor shall maintain and update DTOD tools and applications, web, database, and virtual services within cloud environments, and participate in SDDC scheduled patch cycles to ensure optimal operational functionality.

The contractor shall be responsible for any application-specific issues within cloud environments while staying abreast of new technologies and DoD guidance regarding infrastructure and supporting technologies. Additionally, technologies and infrastructure shall remain current.

7. DELIVERABLES.

The contractor shall deliver data and software (with required data rights) when applicable. All technical data and noncommercial software delivered under this task order are developed exclusively at the Government’s expense, and IAW DFARS 252.227-7013, 252.227-7014, 252.227-7015, 252.227-7016, 252.227-7017, 252.227-7019, 252.227-7030, and 252.227-7037, the Government has unlimited rights in these deliverables. For all other commercial data delivered under this task order, the Government has the right to use, modify, reproduce, release, display or disclose, in whole or part, in any manner and for any purpose whatsoever, without restrictions of any kind, within and without the Government.

All deliverables shall be electronically delivered to include; title identifying the content, version number for PC*Miler updates, and date.

The contractor shall provide all deliverables electronically in Army-approved versions of Microsoft Office formats pursuant to the following schedule.

Table 1 - Deliverable Requirements Table

PWS

Para

Deliverable Title

Format

Schedule

Data Rights

2.1 Update and maintain

system web services documentation.

Digital

NLT 30 days after each DTOD-PC*Miler version release .

Unlimited

3.4 Create, maintain, and

review DTOD Web Service Installation Guide instructions on installing PC*Miler web services.

Digital During each PC*Miler Annual Release Beta testing update (update installation guide as changes are needed)

Unlimited

3.5 Source Code.

Digital

Immediately following each DTOD release or change to web site or web service.

3.7 Disaster Recovery (DR)/

Contingency Exercise.

Twice a year for IA planned readiness exercises

3.7 Disaster Recovery/

Contingency Exercise Test Plan which covers exercise summary.

Due 3-business days after DR contingency exercise.

4.1 Weekly Activity Report

(WAR).

Weekly, every Monday.

4.2 Create Project Schedule

with Work Breakdown Structure.

Updated weekly.

5.1

IA RMF

revalidation/RMF Support Documentation/ Authorization to Operate

(ATO)/POA&M.

Digital / eMASS

Upon annual RMF revalidation, or as required by IA.

Unlimited

8. SERVICE DELIVERY SUMMARY

The Services Delivery Summary (SDS) represents the most important contract objective that, when met, shall ensure contract performance is satisfactory. Although not all PWS requirements are listed in the SDS, the contractor shall comply with all requirements in the PWS.

Table 2 – Service Delivery Summary Table

PWS

Para

Performance Objective Performance Threshold

2.2 System Availability 98% of the time the

system shall be available and operational to all users and interfacing systems.

2.4

Create CCB workflow for PC*Miler software release dates (stage and Prod).

Upon delivery of BETA software delivery from PCMiler, create CCB within 7 business days, but not exceeding 10 business days.

2.4 Release Annual PC*Miler

COTS Software Product

Annually – (software release NLT 15 October), 98% of the time annual software release shall be pushed to production.

2.4 Release PC*Miler

quarterly updates, emergency updates and application overrides.

NLT 30 days after PC*Miler COTS updates released.

3.2 Upgrades and patches to

ensure compliance with DoD Information Assurance Vulnerability Alerts (IAVAs).

98% of the time security vulnerability patches are installed by IA suspense dates.

3.4

Create, maintain and review DTOD Web Service Installation Guide instructions on installing PC*Miler web services.

Provide NLT each PC*Miler Annual Release (if significant changes are needed), 98% of the time.

Provide NLT each PC*Miler Annual Release Beta update (update installation guide as changes are needed), 98% of the time.

4.2 Project Schedule with

Work Breakdown Structure

98% of the time project schedule with WBS is provided on time and accurate.

5.1 IA RMF

Revalidation/RMF Support Documentation/ Authorization to Operate

(ATO)/POA&M

98% of the time upon annual RMF revalidation.

11.3 Provide timely cyber-

incident reporting.

Notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident

9. GENERAL INFORMATION

9.1. Place of Performance/Work Hours

Services shall be performed at Scott AFB, at the contractor’s facility, or telework if approved.

If the contractors are required to perform duties on Scott AFB (an office cubicle workspace will be provided for three (3) contractor personnel). DTOD staff shall be available during normal duty hours Monday thru Friday, 0730-1700 Central Time (CT). System availability shall be 24 hours a day, 7 days a week. The contractor may be called upon at night, on weekends, and/or on federal holidays in the event of a DTOD system outage, to perform after hour support in order to restore service. The contractor shall respond within one (1) hour of outage notification from Tier I SRC helpdesk.

9.2. Period of Performance

DTOD Contract Period of Performance FY Contract Year Dates

FY25 Transition 1 September 2025 - 30 September 2025 FY26 Base Year 1 October 2025 - 30 September 2026 FY27 Option Year 1 1 October 2026 - 30 September 2027 FY28 Option Year 2 1 October 2027 - 30 September 2028 FY29 Option Year 3 1 October 2028 - 30 September 2029 FY30 Option Year 4 1 October 2029 - 30 September 2030

9.3. Contractor Employees

At no additional expense to the Government, the contractor shall ensure assigned personnel retain necessary certifications and remain current with technical skills required to support and execute the contract. New employees shall attend mandatory SDDC security briefings, complete mandatory information assurance training, and complete necessary forms from SDDC. Refer to (para 10. for specific forms and training).

9.4. Government Furnished Equipment (GFE) And Software

All Government Furnished Equipment (GFE) and software shall be maintained in accordance with IAW FAR 52.245-1, Government Property, and Army Regulation 25-2, Para 4-5. The contractor shall notify the Government of all software malfunctions and shall safeguard and provide property accountability for all GFE. The Government and the contractor shall jointly create a GFE maintenance schedule.

The Government shall provide laptops to access specific applications via Client Virtual Private Network (VPN), Virtual Desktop infrastructure (VDI) Remote Desktop (RD) solutions, or other SDDC-approved solutions. A SDDC network account shall be required to obtain a VPN Client account.

Information services available on the Government furnished computers are used for official business only. Examples of information services include SDDC/USTC GovCloud network, Internet, Intranet, World Wide Web and electronic mail.

Government furnished equipment (GFE) hand receipt(s) shall be signed initially by the contractor. The contractor shall be responsible for ensuring GFE property is protected.

Contractor Furnished Equipment (CFE) shall not be employed for access to a Government network.

For remote users, the GFE is shipped to the employee via FEDEX or another carrier at SDDC expense when it is determined by the COR that the employee would be required to commute an unreasonable distance to receive or return the GFE. Equipment and GFE maintenance schedules will be delivered to the user on an agreed upon date. The equipment shall be returned to the Government at the completion of the contract or as requested by the Government. Equipment shall be returned in the same condition that it was provided with Government furnished computers and/or information services shall not be used for other than official business.

Misuse by a contractor employee may result in that employee losing access to Government systems and determined disqualified for Government system access. The contractor shall ensure that workload performed by disqualified employees is transferred to a qualified individual within 10 business days. Employee disqualifications for Government system access shall not relieve the contractor from meeting the performance standards and thresholds required by this PWS. The following are examples of misuse of information services:

• Illegal, fraudulent, or malicious activities.

• Partisan political activity, political or religious lobbying or advocacy, or activities on behalf of organizations having no affiliation with SDDC or DoD.

• Activities whose purposes are for personal or commercial financial gain. These activities may include chain letters, solicitation of business or services, sales of personal property.

• Unauthorized fundraising or similar activities, whether for commercial, personal, or charitable purposes.

• Accessing, storing, processing, displaying, or distributing offensive or obscene material such as pornography and hate literature.

• Annoying or harassing another person, e.g., by sending or displaying uninvited e-mail of a personal nature or by using lewd or offensive language in an e-mail message.

• Using another person’s account or identity without his or her explicit permission, e.g., by forging email.

• Viewing, damaging, or deleting files or communications belonging to others without appropriate authorization or permission.

• Permitting any unauthorized person to access a SDDC or DoD owned system.

• Modifying or altering the operating systems or system configuration (including the installation of software) without obtaining written authorization from the CO.

The contractor shall create an annual inventory of all GFE NLT the last business day of October.

The inventory shall be verified by providing a signed copy of the hand receipts.

9.5. Government Furnished Information (GFI)

The Government shall provide the contractor with information for various purposes to include location data and existing documentation for inclusion in the DTOD capability. The GFI provided shall remain the property of the Government and shall not be released to others without prior approval of the DTOD PM.

9.6. Non-Disclosure Agreement (NDA) for Contractor Employees

In performance of this contract, the contractor may have access to sensitive, non-public information. The contractor shall, (a) use and protect such information from unauthorized disclosure in accordance with DTM 08-027 - Security of Unclassified DOD Information on Non- DOD Information Systems, 31 July 2009; (b) use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) obtain permission of the Government before disclosing/discussing such information with a third party; (d) return and/or electronically purge, upon Government request, any non-public, sensitive information no longer require for Contractor performance; and

(e) advise the Government of any unauthorized release of such information. The contractor shall have its employees assigned to this contract execute a non-disclosure agreement for delivery to the Government. The Government will require contractor personnel to sign a non-disclosure statement (Appendix B) to protect non-public information of other contractors and/or the Government.

9.7. Safety Requirements

a. The contractor shall be directly responsible for the safety and occupational health (SOH) standards for its employees and must comply with The Occupational Safety and Health Act of 1970; or any other applicable Federal, State, and local laws, codes, ordinances, and regulations.

b. The Contractor shall provide and maintain work environments and procedures which will safeguard the public and Government personnel, property, materials, supplies, and equipment exposed to Contractor operations and activities.

c. The Contractor shall provide prevention plans and accident investigation procedures upon request from the COR within seven days.

d. The Contractor shall immediately notify the COR upon discovery of any incident and/or accident that results in injury or death to any personnel or damage to equipment.

e. In all instances where damage to government property/equipment or any injuries occur, the Contractor shall submit a preliminary investigation report to the COR within 24 hours. The Contractor shall follow-up with a full incident/accident investigation report identifying all root causes and corrective actions provided to the COR within 30 calendar days of occurrence.”

10. SECURITY REQUIREMENTS.

10.1. General Security Information

The overall classification of work associated with this PWS is SECRET. Tasks associated with the deliverables in this PWS shall require a SECRET Facility clearance (FCL) with eligibility and access for all contract employees, who require classified access, will possess a SECRET personnel clearance (PCL). All classified material handled by the contractor shall be safeguarded and derivatively classified IAW Executive Order (EO) 13526 and per Army Regulation 380-5 (Information Security Regulation) and all applicable Office of the Secretary of Defense (OSD) Classification Guides. Specific security requirements are identified in the DD Form 254, DoD Contract Security Classification Specification for this contract.

10.2. Personnel Clearance (PCL)/Investigation Requirements

Personnel assigned to this contract will require a favorably completed T3 investigation or National Agency Check with Local Credit (NACLC), resulting in SECRET eligibility (or higher) when adjudicated by the Defense Counterintelligence…