(U) CDF PWS 11 April 2025.docx

UNCLASSIFIED

Classification: UNCLASSIFIED

Common Data Fabric (CDF)

Defense Intelligence Agency (DIA) Chief Information Office (CIO)

Common Data Fabric (CDF) Portfolio of Capabilities Performance Work Statement (PWS) 11 April 2025

Table of Contents

1. BACKGROUND

1.1. The Defense Intelligence Agency (DIA) is seeking a vendor to provide program oversight, operations & maintenance, and development & implementation services to the Common Data Fabric (CDF) Portfolio of Capabilities. The vendor will both maintain the existing suite of capabilities, as well as continuing to improve them. These capabilities consist of CDF – (Data Brokering and API Management capability), Policy Capture Tool (PCT), and Common Transformation Service (CTS).

1.2. The CDF delivers a data brokering capability from machine-to-machine across the Defense Intelligence Enterprise (DIE). CDF serves as a scalable, modular, open architecture that enables IT systems to collect, process, and disseminate intelligence data. CDF aims to support the DIE by enabling the integration of new and emerging data capabilities into an organization’s existing architecture. The CDF operates on multiple networks to enable seamless data brokering from tasking to collection to near real-time dissemination out to the warfighter. The CDF represents a technical solution to the complex challenge of sharing data in the DIE, constrained by networks, cyber policies, and human behavior. The current solution utilizes Cloudera Data Flow Management and Cloudera Data Platform Private Cloud, see Figures 1 and 2 for more specifics.

1.3. CDF initially began as a Prototype five years ago as a refinement for Distributed Common Ground / Surface System (DCGS) Modernization that has since moved to the Production/Operational phase. The prototype phase focused on the following benefits:

1.3.1. Modernization of the Distributed Common Ground I Surface System (DCGS) Enterprise.

1.3.2. Establishment of a working enterprise deployment model.

1.3.3. The capture of "machine-to-machine" data sharing policy.

1.3.4. Self-service access to data consumers.

1.3.5. Application of a commercial data lake platform for data brokering.

1.3.6. Elimination of bilateral sharing agreements.

Figure 1 CDF

Figure 2 CDF Systems

1.4. The PCT will provide a web-based self-service interface for customers to record their systems and data set policies. Customers will be able to enter policies for their system and/or dataset into PCT to create the associated Data Sharing Agreement (DSA).

1.5. The CTS will provide a capability integrated with CDF to provide data workflows supporting the capture of lineages, transformations, and operations of the data. CTS supports transformations for new and legacy information sharing frameworks that have unique constraints on data format and filtering. The current solution utilizes Cloudera Data Flow Management; however, this may change at the Government’s discretion.

2. SCOPE

2.1. The scope of this Task Order, (TO), includes the following tasks:

2.1.1. Task 1: Program Management for CDF Portfolio of Capabilities.

2.1.2. Task 2: Customer Services (Customer Support and Data Sharing Policy Capture).

2.1.3. Task 3: Cyber Security Service.

2.1.4. Task 4: Operations, Maintenance, and Enhancement Engineering of CDF Portfolio of Capabilities.

2.1.5. Task 5: Software Procurement.

3. OBJECTIVES

3.1. The objective of this contract is to provide program and technical services to support the design, engineering, implementation, operations, and enhancement of the CDF Portfolio of Capabilities (Common Data Fabric, Policy Capture Tool, and the Common Transformation Service). These efforts are multifaceted and involve maintaining and improving existing services, as well as delivering new services for the following CDF components:

3.1.1. Customer Services (Customer Support and Data Sharing Policy Capture): Planning, organizing, leading, and managing all contact with current and future DIE customers to ensure the DIE customers are informed on CDF current and future capabilities and assist customers through the CDF onboarding process. Providing understanding of the data being brokered and any required policies associated with the data and its handling.

3.1.2. Cyber Security Services: Designing, enhancing and operating with security and Zero Trust in mind. Planning, identification, and incorporation of security controls, documentation, and corresponding Risk Management Framework (RMF) requirements into the CDF Architecture. Following the DIA Cybersecurity processes, or other Intelligence Community (IC)/Department of Defense (DoD) defined Security Authorization processes to obtain and maintain an Authority to Operate (ATO) on multiple networks.

3.1.3. Operations, Maintenance, and Enhancement Engineering of CDF Portfolio of Capabilities: Providing Operations & Maintenance (O&M) and Research, Development, Test, and Evaluation (RDT&E) services to deliver and improve the current CDF capabilities. Providing operations, maintenance, and security monitoring of the CDF services. Following agency standards for configuration and change management processes for the capabilities and data-related policies. Ensuring data broker exchange mechanisms are functioning, data is flowing, policies are up to date, transformation functions are up to date and have been verified as functioning properly, integrate future requirements, and upgrades to the capabilities related to data brokering. Developing a discovery service for CDF customers to easily view data resource availability and associated data policy requirements.

3.1.4. Software Procurement: Purchasing software on behalf of the government to support the CDF portfolio software (e.g. Cloudera software subscription) and provide installation and maintenance support.

3.2. The above elements of this requirement apply across multiple security domains, deployment models, and environments. Security domains include Non-classified Internet Protocol Router Network (NIPRNet), Secret Internet Protocol Router Network (SIPRNet), and Top Secret//Secure Compartmented Intelligence (TS//SCI) connected via the Joint Worldwide Intelligence Communication System (JWICS). And, with the ability to extend to Special Access Programs (SAP), coalition, bilateral, and other mission networks as dictated by prioritized requirements. Deployment models include cloud (multiple), on-premises, and at the edge. On NIPRNet, SIPRNet, and JWICS, CDF employs development, testing, and production enclaves for the CDF Portfolio of Capabilities. DIA anticipates the potential for multiple instantiations of the CDF supporting different combinations outside of the current three security domains, deployment models, and environments as necessary to meet customer requirements. For example, a specific CDF instantiation on-premises may be appropriate for certain coalition customer use cases.

3.3. The CDF performance objectives for the level of service are specified in the Service Level Agreement (SLA) (Attachment B). The defined performance threshold measures describe the acceptable level of service for each element.

4. REQUIREMENTS

4.1. The Contractor shall provide and sustain the CDF Portfolio of Capabilities enabling a data brokering capability to support the war fighter, mission partners, and decision makers across the DIE. The Contractor shall provide labor, management, supervision, training, materials, and tools, not otherwise provided as Government Furnished Property (GFP), to meet the requirements set forth in this Performance Work Statement (PWS).

4.2. Task 1: Program Management for CDP Portfolio of Capabilities

4.2.1. The Contractor shall identify and assign a Program Manager (PM) to function as the Responsible Officer in Charge (ROC), accountable to address the Government’s questions and supervise the Contractor employees for this effort, and report any significant deviations in the project’s technical, cost, and/or schedule parameters immediately to the Contracting Officer Representative (COR) and Government PM/TPOC.

4.2.1.1. Provide the management, staffing, and associated programmatic activities to enable an integrated, timely delivery to the Government.

4.2.1.2. Provide support in the planning and execution of new O&M and RDT&E significant initiatives including composing summary analysis reports and advising the Government on feasibility, risk, budget, and schedules.

4.2.1.3. Participate in a kick-off meeting within five (5) business days of contract award.

4.2.2. The Contractor shall implement and oversee agile delivery, program management and planning services with the capability to manage large projects applying Project Management Institute (PMI) best practices (e.g., Project Management Body of Knowledge, (PMBOK), Guides & Standards).

4.2.3. The Contractor shall develop and submit a Program Management Plan (PMP) for Government approval. The PMP shall describe the Contractor’s methodology for ensuring schedule, cost controls, communications, quality assurance, risk mitigation, and performance measures as described in the SLAs to meet contract requirements and are easily monitored and quantified by the Government. Once approved, the PMP shall be incorporated into this PWS by this reference as though set forth in full text herein, and the contractor PM shall provide oversight of the program in accordance with the approved PMP. Any deviation in the program’s technical, cost, and/or schedule parameters shall be reported immediately to the Contracting Officer Representative (COR). The PMP shall be submitted for Government approval in accordance with Contract Data Requirements List (CDRL) A001 (Program Management Plan). The Contractor shall update and maintain the approved PMP as required. At a minimum, the PMP shall consist of the following:

4.2.3.1. The strategy to meet performance metrics, identifying technical performance, capacity, data collection schema, and the continuous service improvement methodology to resolve issues and improve the customer experience

4.2.3.2. Knowledge Management

4.2.3.3. Integrated Master Schedule

4.2.3.4. Staffing Plan

4.2.3.5. Risk Management Plan

4.2.3.6. Quality Assurance Management Plan

4.2.4. The Contractor shall report newly discovered best practices, lessons learned, and the relevant current specifications of the system architecture on the CDF knowledge management portal based on evolving technologies and knowledge related to recent and emerging commercial and non-commercial products that may be beneficial to the Government. The Contractor shall submit this information in accordance with CDRL A004 (CDF Knowledge Management)

4.2.5. The Contractor shall submit a Program Management Review (PMR) that addresses the program’s schedule, cost and technical performance, and program issues and risks (including mitigation strategies) due 30 days after contract award and updated on a monthly basis. Briefing slides shall be submitted on a quarterly basis regardless of whether review meetings are taking place, in accordance with CDRL A007.

4.2.6. The Contractor shall establish, update, and maintain an Integrated Master Schedule (IMS). The IMS shall be accessible to the Government and updated daily, Monday thru Friday excluding Federal holidays and official Government closures. The IMS shall consolidate all CDF projects and indicate the status of each project, as well as the overall program schedule. The Contractor shall have an established process for proposing project schedule changes for Government review and approval. The Contractor shall submit the IMS in accordance with CDRL A011 (Integrated Master Schedule).

4.2.6.1. The Contractor shall provide a Program Detail Report (PDR) in the Program Detail Workbook (PDW) for each contract month, within the Government designated portal. The PDR is due thirty (30) days after contract award and shall be submitted by the 10th calendar day of each month. The PDR submissions shall clearly depict the task order performance as it relates to cost, schedule status, technical accomplishments, personnel roster, and contract deliverable status for each reporting period.

4.2.6.1.1. Trend metric data shall be submitted and maintained within the workbook. The PDW shall be kept up to date. The Contractor shall submit their PDR in accordance with CDRL A002 (Program Detail Report).

4.2.6.2. The Contractor shall submit a detail of their major achievements and or accomplishments for the week, across all tasks in accordance with CDRL A003 (Weekly Activity Report (WAR)/Significant Activity Report (SAR)).

4.2.6.3. An After-Action Report (AAR) that provides the status of the deliverables; clearance report of Government Furnished Equipment / Government Furnished Property (GFE/GFP), to include software licenses, names of personnel who worked on the task order, and written confirmation that they have been read off IAW Sensitive Compartmented Information Administrative Security Manual DoD 5105.21-M-1. The AAR shall be submitted in accordance with CDRL A012, (After-Action Report (AAR)).

4.2.7. The Contractor shall provide and assign Product Directors (PDs) to build strong relationships with Government stakeholders and understand their requirements, challenges, and objectives. The PDs serve as the primary point of contact in their respective product areas, ensuring alignment between the product development roadmap and Government priorities. The Contractor shall:

4.2.7.1. Develop a comprehensive capability strategy.

4.2.7.2. Create and maintain a clear and prioritized product roadmap that aligns with the Government’s objectives and timelines.

4.2.7.3. Collaborate with engineering, design, operations, and other teams to define features, functionalities, customer experiences, customer care processes, and project milestones.

4.2.7.4. Translate Government needs into detailed product requirements, user stories, and use cases, and clearly communicate these requirements to development teams and ensure accurate implementation.

4.2.7.5. Ensure the quality and performance of products meet Government standards and compliance requirements.

4.2.7.6. Coordinate testing and validation processes to guarantee reliability, security, and functionality.

4.2.7.7. Prepare reports and presentations that effectively communicate product plans, progress, and results. PDs serve as Deputy Program Manager (DPM) focused on ensuring technical delivery maximizes value delivered to CDF customers.

4.2.8. The Contractor shall provide and assign a Technical Director (TD) for this effort. The Contractor shall be responsible for collaborating with cross-functional teams to develop and refine the CDF portfolio capabilities to align with business & mission objectives, development goals, and security requirements. The Contractor shall:

4.2.8.1. Integrate agile delivery methodologies (such as agile SCRUM and KANBAN) to ensure iterative development and continuous improvement, in alignment with DoD and IC agency-level software development lifecycle standards.

4.2.8.2. Apply current industrial development best practices that contain iterative and incremental project management techniques similar to agile software development lifecycle standards and utilizing NIST Risk Management Framework (RMF). (See National Institute of Standards and Technology, NIST.gov)

4.2.8.3. Conduct/facilitate Technical Exchange Meetings and Preliminary Design, Critical Design meetings. Meeting minutes will be provided IAW CDRL A017 (Report, Record of Meeting/Minutes)

4.2.8.4. Work directly with the CDF Government program management office to evaluate priorities and set deliverable timeline.

4.2.8.5. Collaborate with Product Directors and development teams to implement security best practices, such as secure coding guidelines and secure software design principles.

4.2.8.6. Identify potential security risks and vulnerabilities in applications, infrastructure, and processes, and work with relevant stakeholders to implement appropriate mitigations.

4.2.9. Concept of Operations (ConOps) Plan for the entire contract. This report is due sixty (60) business days after contract award and will be updated annually in accordance with CDRL A008, Concept of Operations (ConOps). The plan shall include, but is not limited to:

4.2.9.1. Systems Engineering Plan

4.2.9.2. Configuration Management Plan

4.2.9.3. Communications Plan

4.2.9.4. Risk Management Plan

4.2.9.5. Disaster Recovery Plan

4.2.9.6. Software Licensing Management Plan

4.3. Task 2: Customer Services (Customer Support and Data Sharing Policy Capture)

4.3.1. The Contractor shall provide customer services through outreach and system/data sharing policy capture support, interfacing with customers across the DIE to determine possible systems and data sets for onboarding to the CDF capability. The Contractor shall interface with DIE customers to determine their current and future data needs as well as any possible data transformations that may need to occur. The Contractor shall provide customer outreach to identify the key Information Systems data sets and systems supporting the DIE. The Contractor shall:

4.3.1.1. Create and maintain a CDF Engagement Tracker to manage, track, and perform stakeholder/customer engagements at the direction of the CDF Program Management Office IAW CDRL A006 CDF Document Portal.

4.3.1.2. Identify, create, and manage a prioritized systems list for integration into CDF, analyzing use cases to ensure alignment to customer requirements. This includes the identification of any missing systems that would benefit the DIE.

4.3.1.3. Create, maintain, and update a customer onboarding process in accordance with CDRL A005, Standard Operating Procedures (SOP).

4.3.1.4. Continuously communicate with customers to ensure all policies in the CDF Integrated Operations Guide are followed.

4.3.2. The Contractor shall provide data sharing policy capture support by working with customers to identify and record policies that govern data exchange. These policies will document how the consuming system must protect the data as seen in Figure 3.

Figure 3 CDF Data Policy

4.3.3. The policy discovery process shall involve understanding of applicable DoD policy and doctrine governing machine-to-machine exchange of information in support of each deployed CDF environment.

4.3.4. The Contractor shall apply the appropriate policy based on the CDF operational environment. (Example: IC Directives are typically only applicable to the CDF instance on the JWICS network). The Contractor shall provide data sharing policy capture support to customers as directed by the PMO. The data sharing policy capture support tasks will include but are not limited to:

4.3.4.1. Define Interconnect System Agreements (ISAs) between the data owning system and DIA; this will be done in conjunction with the Cyber Security Support services following a standard ISA format in accordance with CDRL A006 (CDF Document Portal). The ISA format template is provided in the Bidder’s Library.

4.3.4.2. Define and summarize policy and Data Sharing Agreements (DSAs) at the data resource level that will directly support the mission needs of warfighters and analysts across the DIE.

4.3.4.3. Generate an executable DSA, following the Government provided DSA format, Exhibit X, in accordance with CDRL A006 (CDF Document Portal).

4.3.4.4. Provide complete traceability to applicable published directives, issuances, manuals, and issuing authorities, policies, and doctrine so the original intent of the system owner can be understood, codified, and applied to the data set.

4.3.4.5. Provide the Government with all generated DSAs to include configuration management, trusted signature verification, revalidation prior to expiration date, and reporting to the PMO to support periodic DSA reviews.

4.3.4.6. Coordinate with the owning system organization’s Chief Data Office (CDO) to ensure Data Management Plans are documented for required data sets and tied to the corresponding DSA.

4.3.4.7. Determine the Needs, Retention, and Volume metrics from Data Providers and Consuming Missions.

4.4. Task 3: Cyber Security Services

4.4.1. The Contractor shall provide Cyber Security Services to support the CDF Portfolio of Capabilities. The Contractor Information System Security Engineer (ISSE) and Information System Security Officer (ISSO) staff shall follow DoD and IC Cybersecurity processes and policies to achieve and maintain an ATO for all CDF portfolio components. Systems security is foundational to all activities associated with CDF. Systems Security Life Cycle (IAW ICD 503 Risk Management Framework (RMF)) engineering is applied to all activities to achieve and sustain the necessary ATO for a new, existing, or modified service or solution. This includes preparing the necessary compliance and acceptance documentation and coordinating activities necessary to comply with the appropriate security regulations IAW Risk Management Framework (RMF). The contractor shall prepare design, to the extent possible, for emerging Zero Trust (ZT) security services and inform the Government of any new technologies to support ZT and issues related therein.

4.4.2. The Contractor shall ensure cybersecurity requirements for DoD information technologies (DoD 8510.01) are managed through RMF and are consistent with the principals established in the NIST Special Publication 800-37 (February 2021); Federal Information Security Manage Act (FISMA); and comply with the following guidelines: DoD 8510.01 (March 12, 2012), RMF for DoD Information Technology, and ISO 31000 Risk Management Framework.

4.4.3. For the CDF RMF requirements, the Contractor shall complete all associated tasks with RMF and collaborate with associated authorizing officials as required to:

4.4.3.1. Ensure that security requirements and objectives are identified, implemented, continuously monitored, automatically reported in compliance with RMF and other security directives as detailed by the Information System Security Manager (ISSM).

4.4.3.2. Ensure all applicable system security requirements are met in accordance with the network of deployment and associated system security level.

4.4.3.3. Document all security relevant changes in the associated risk management system (Xacta/eMASS). Xacta and eMASS are systems used to document all relevant System Cyber Security documentation.

4.4.3.4. Identify, assess, and document all vulnerabilities in the CDF Portfolio of Capabilities according to DIA CIO Cyber Security policies.

4.4.3.5. Assist the ISSMs in performing systems security requirements analysis where needed in preparation for security compliance and relay findings through the ISSMs that may impact design, operations and/or performance to the relevant engineering or operations groups. The Contractor shall provide a Body of Evidence (BOE) review and submit findings IAW CDRL A006, CDF Document Portal.

4.4.3.6. Enhance and deploy security services architecture keeping ZT principles in mind.

4.4.3.7. Participate in customer Technical Exchange Meetings (TEMs) to gather requirements and participate in Security TEMs in relation to systems security and system accreditation as required.

4.4.3.8. Maintain all system security documentation for accreditation in accordance with all specified National Institute of Standards and Technology (NIST) 800-53 controls for all project and service activities in support of ATO (i.e., System Security Plan, Monitor, Strategy, Security Control Traceability Matrix, CONOPS, architecture and boundary diagrams).

4.4.3.9. Collaborate on IA activities with the ISSMs and the appropriate Cyber Security Program Offices to ensure incorporation of RMF strategic goals and objectives.

4.4.3.10. Submit the Supply Chain Risk Management (SCRM) evaluation for all incorporated software and coordinating review with DIA Information Assurance using the RMF.

4.4.3.11. Work with DIA Cyber Security and partner Agencies/Departments as ATO authority.

4.4.3.12. Verify that security measures are taken, maintained, reported on and updated as required.

4.4.3.13. Notify the Government in writing (via assigned ISSM(s)) to edit Information Assurance Vulnerability Alert (IAVA) and Plan of Action and Milestones (POA&M) documentation when expected measures have not been implemented.

4.4.3.14. Design/enhance firewalls and controlled interface security architectures based on requirements provided by ISSM and appropriate security organization(s).

4.4.3.15. Identify, implement, monitoring, and reporting of detailed ongoing security hardening, patching, and virus-checking.

4.4.3.16. Implement procedural protective measures to maintain systems compliance for ATO.

4.5. Task 4: Operations, Maintenance, and Enhancement Engineering of CDF Portfolio of Capabilities

4.

4.3.

4.4.

4.4.1.

4.4.2.

4.4.3.

4.4.4.

4.5.1. The Contractor shall provide operations and maintenance and enhancement engineering support to the CDF Portfolio of Capabilities. The CDF Portfolio consists of three capabilities: the CDF (Data Brokering and API management capability), Common Transformation Service (CTS), and the Policy Capture Tool (PCT). In support of operations, maintenance, and enhancement engineering of CDF Portfolio of Capabilities, the contractor shall provide the below areas:

4.5.1.1. System/Software Operations and Maintenance: The Contractor shall provide operations and maintenance of the CDF Portfolio of Capabilities to include but not limited to:

4.5.1.1.1. Monitor system performance to conduct system testing, perform routine inspections, and preventative server maintenance.

4.5.1.1.2. Document and perform backup and recovery methods to manage data/system backups based on recovery strategies.

4.5.1.1.3. Provide technical support and troubleshooting to address user support requests.

4.5.1.1.4. Optimize functionality of system to incorporate vertical and horizontal scaling.

4.5.1.1.5. Perform system installation, configuration, and upgrades for the capabilities (on-premises or cloud based).

4.5.1.1.6. Manage and install associated new software licenses.

4.5.1.1.7. Engineer integrations between the CDF Portfolio capabilities with new and existing technologies/capabilities within the DIE (i.e., existing Enterprise Cross Domain and Enterprise Public Key Infrastructure (PKI) services).

4.5.1.1.8. Maintain a CDF Data Catalog of data available within CDF. Maintain any requisite connection to/from policy associated requirements with enablement of DIA’s data security services to and within the CDF data broker, transformation, and storage.

4.5.1.1.9. Develop and onboard new API connections for systems and datasets tied to the associated data policies for the systems and data sets for the enforcement of machine-to-machine policy-based access.

4.5.1.1.10. Provide data lineage and documentation to document the data transformations for data brokering. Lineage tracking includes identifying data origin, data transformations performed and where data moves over time. Data lineage gives visibility while greatly simplifying the ability to trace errors back to the root cause in a data analytics process.

4.5.1.1.11. Implement CI/CD pipelines, automation frameworks, and deployment processes that seamlessly integrate security checks and controls.

4.5.1.1.12. Provide support utilizing the current DIA ticketing capability, ServiceNow, for automating, streamlining, and providing service management support to ensure CDF tracks customer support, incident management, capacity management for system changes, project management, and cyber security change.

4.5.1.1.13. Customer support shall be provided during normal Government business hours, Monday – Friday 9 am to 5 pm (EST).

4.

4.3.

4.4.

4.4.1.

4.4.2.

4.4.3.

4.4.4.

4.4.4.1.

4.4.4.2.

4.5.1.2. Enhancement Engineering: The Contractor shall provide research, development, testing and evaluation of new requirements to the CDF Portfolio of Capabilities. System improvements will be tracking as program projects in the Integrated Master Schedule. The Contractor shall provide, but not limited to:

4.5.1.2.1. Research, develop, and engineer system scaling and redundancy to meet system demand.

4.5.1.2.2. Test and evaluate system enhancement integrations between the CDF Portfolio of Capabilities with new and existing technologies/capabilities within the DIE (i.e., existing Enterprise Cross Domain and Enterprise Public Key Infrastructure (PKI) services).

4.5.1.2.3. Integrate DIA Zero Trust guidelines and requirements as placed into effect.

4.5.1.2.4. Build data pipelines to perform the Extract Transform Load (ETL) functions to transform data based on the consumer data format needs within the CDF Portfolio, CTS.

4.5.1.2.5. Develop new API connections for systems and datasets tied to the associated data policies for the systems and data sets for the enforcement of machine-to-machine policy-based access.

4.5.1.2.6. Develop a web-based self-service interface to capture user input regarding a systems data sharing policies, PCT.

4.5.1.2.7. Automate the generation of an electronically executable Data Sharing Agreement (DSA) as an output from the PCT.

4.5.1.2.8. Test and evaluate system installation to be installed OCONUS.

4.5.1.2.9. Test and evaluate system enhancements into the CDF Portfolio of Capabilities.

4.5.1.2.10. Enhance CDF core functionality to support brokering of data object exchange among DIE Object Management Systems (OMS) and DIE sources feeding those OMS systems. This object exchange mechanism will streamline machine to machine data object exchange; will mitigate the duplication (via a standard global ID) of object and attribute passing from any given OMS to other DIE OMS systems; will ingest DIE sensor feeds supporting DIE OMS systems; and will perform this exchange in a secure and standardized manner (validating IC EDH/TDF meta data markings). Establish a user interface to visualize the object exchange mechanism.

4.5.1.3.

4.5.1.3. The Contractor shall submit an Innovation Project Plan for RDT&E related activities to the GPM and COR within the Knowledge Management portal as required in accordance with CDRL A015, (Innovation Project Plan).

4.6. Task 5: Software Procurement

4.6.1. The Contractor shall acquire software on behalf of the Government to maintain the CDF Portfolio of Capabilities. The Contractor shall purchase the licenses identified in Table 1 to support the CDF Portfolio.

4.6.2. The Contractor shall evaluate the current infrastructure (current servers and horizontal scaling requirements) to ensure the proper license coverage, Cloudera License Evaluation. Initial license evaluation of license amounts by type and network can be seen in Table 2.

4.6.3. The commodities purchased under this task order, which have been reimbursed by the Government IAW FAR 52.232-7 (Payments under Time-and-Materials and Labor-Hour Contracts), will remain Government property after completion of the task order IAW CDRL A010, Report of Government Property in Contractor’s Possession.

Table 1

Cloudera Data Platform (CDP) Private Cloud Base Edition - Annual Subscription per Node for up to 16 Cores/128 GB RAM for compute or up to 48 TB for storage. US Citizen US Soil Support Engineers, Technical Support Case SLAs Sev 2-4 8x5 Mon-Fri, Sev 1 24x7 Mon-Sun.

Cloudera Data Platform Flow Management (CFM) Edition - Annual Subscription, 4 Cores - Business Support. AGPL License

Table 2

5. PLACE OF PERFORMANCE

5.1. The Contractor shall have IC approved Sensitive Compartmented Information Facility (SCIFs) for 24/7 support located in the continental United States. The SCIF’s accreditation (TS/SCI) shall be in accordance with ICD 705, Sensitive Compartmented Information Facilities, and have adequate bandwidth with fully reliable connectivity to the Government classified and unclassified network infrastructure.

5.2. The primary place of performance/work site for this requirement will be at the Contractor’s provided facilities (to include SCIF space). The Contractor is required to have a sufficient number of employees with the appropriate level of security clearance(s) to access Government networks, communications systems, and facilities. (e.g., CONUS). The SCIF shall be located in the NCR with the necessary seats to hold the FTEs required to support the contract, within 45 days of contract award.

5.3. The Contractor may be required to perform services at OCONUS locations. The Government may add locations in support of changing requirements. Primary place of performance will be CONUS.

5.4. The Contractor shall provide Government access rights to the SCIF. Access shall be granted to personnel approved by the Government.

5.5. A portion of work performed under the scope of this contract is unclassified and may be performed at alternate work locations outside of SCIFs with prior written approval from the COR.

6. CERTIFICATIONS, LICENSES, PHYSICAL REQUIREMENTS, OR OTHER EXPERTISE REQUIRED

6.1. The Contractor shall provide fully qualified personnel to satisfy the conditions of this PWS. The Government will not reimburse the Contractor for maintaining qualifications. The Contracting Officer may approve special exceptions in advance, with agreement between the Contractor and Government.

6.2. All Contractor personnel must meet the appropriate operating system or computing environment certification for information assurance technical positions as required by DoD 8570.01-M “Information Assurance Workforce Improvement Program” for privileged/elevated access to any CDF. This includes separate specialized certifications or training that are required for each vendor specific CDF for the individual to architect, engineer, or sustain that specific capability.

6.3. Upon request by the Government, the Contractor shall provide documentation identifying the cyber security certification status of all personnel performing cyber security functions across the entire CDF TO.

6.4. The Contractor shall conduct all Government mandatory compliance training (e.g., annual Cyber Security Awareness, Privacy Act, Intelligence Oversight, etc.) as required on a recurring basis; the Contractor shall accomplish said training during normal duty hours.

7. KEY PERSONNEL

7.1. The term “Key Personnel” refers to the following positions:

7.1.1. Information System Security Officer (ISSO)

7.1.2. Information Systems Security Engineer (ISSE)

7.1.3. Systems Administrator

7.1.4. Program Manager

7.1.5. Technical Director

7.2. The Contractor shall provide written notice to the Contracting Officer at least thirty (30) calendar days prior to substituting/removing individuals occupying Key Personnel positions. All Key Personnel shall have an active Top Secret/Sensitive Compartmented Information (TS/SCI) with a Counterintelligence (CI) polygraph security clearance. If the employee is terminated for cause or separates voluntarily with less than thirty (30) days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor should provide the following Key Personnel:

7.2.1. Information Systems Security Officer (ISSO)

7.2.1.1. Information Systems Security Officer (ISSO) will manage and coordinate Risk Management Framework (RMF) activities for a system or systems as defined by the customer. Coordinate actions, as needed, with associated ISSO's for related systems. Lead colleagues as necessary and work in close coordination with all system stakeholders. Create and maintain existing information system security documentation, including System Security Plan (SSP), Critical Asset definitions, Security Controls Matrix and/or Assessment, Security Policy, and Security Configuration Guides for both high value assets and security services. Prepare system documentation for assessment in accordance with RMF.

7.2.1.2. Qualifications include Minimum of five (5) years of cybersecurity or information assurance experience. Minimum of three (3) years of experience implementing security frameworks and standards (e.g. RMF, DoD/IC, CNSS, NCDSMO) in complex system and organizational environments. Bachelor’s or Master’s degree in Computer Science, Engineering, Information Technology, or a related field from an accredited institution and current certification as a Certified Information System Security Professional (CISSP), Certification and Accreditation Professional (CAP), Certified Information Systems Auditor (CISA), or Certified Information Systems Manager (CISM). Excellent oral and written communication skills, including a demonstrated ability to explain complex technical issues to non-technical staff. Acute problem-solving and analytical skills.

7.2.2. Information System Security Engineer (ISSE)

7.2.2.1. The Information Systems Security Engineer (ISSE) will provide an Information System Subject Engineer for the assessment and authorization and continuous monitoring processes. Provide cybersecurity requirements analysis of architectures and designs. Identify architecture development best practices. Identify technical gaps and provide solution recommendations for services acquisition, development, migration, implementation, and monitoring. Explain security controls/requirements and guidance to the System Owners and System Teams and recommend implementation strategies. Identify vulnerabilities and recommend mitigation alternatives for Plan of Action and Milestones (POA&M) items.

7.2.2.2. Qualifications include Minimum of five (5) years of experience with IT security architecture, computer technology, design, standards, and products. Bachelor’s or Master’s degree in Computer Science, Engineering, Information Technology, or a related field from an accredited institution. Minimum of one of the following certifications: Certified Information System Security Professional (CISSP), Certification and Accreditation Professional (CAP), or Certified Information Systems Auditor (CISA). Minimum of five (5) years of experience implementing security frameworks and standards (e.g. RMF, DoD/IC, CNSS, NCDSMO) in complex system and organizational environments. Excellent oral and written communication skills, including a demonstrated ability to explain complex technical issues to non-technical staff. Acute problem-solving and analytical skills.

7.2.3. System Administrator

7.2.3.1. The System Administrator will maintain and support the integrity of the operating system environment and various computer systems. Perform systems maintenance tasks, such as system back-up, recovery, and file maintenance to promote uptime and efficient performance. Acquire, install, and test system software upgrades and computer components. Configure software and resolve technical problems. Maintain documentation of IT infrastructure and troubleshooting procedures.

7.2.3.2. Qualifications include minimum bachelor’s degree in a related field such as computer science or information technology. Demonstrated experience in the operating systems such as Windows and Linux, and expertise working in cloud platforms, and understanding how to maintain and troubleshoot operating systems.

7.2.4. Program Manager

7.2.4.1. The Program Manager will manage and oversee all aspects of a technology project to ensure it is completed on-time and within budget. Have overall responsibility for managing scope, cost, to include financial reporting, schedule, internal staffing, vendors, and contractual deliverables. Develop detailed project plans. Monitor project milestones and generate periodic status reports. Evaluate and manage risk. Incorporate quality measures and standards to project deliverables. Possess strong knowledge of Information Technology.

7.2.4.2. Qualifications include minimum bachelor’s degree in management, business, finance, economics, science, technology, engineering, or mathematics. Demonstrated experience in designing, testing, deploying, and maintain large networks and systems with a global footprint as well as in-depth knowledge of IC ITE services. Have a minimum of 8 years in project management experience and a minimum of 8 years of experience in IT business process engineering. Possess knowledge and experience with software development, systems engineering, business process engineering, customer relationship management, project management, financial management, change management, risk management and IT service management. Project Management Professional (PMP) certification and ITIL v4 Foundations Certification is preferred. The PM must have excellent communication, teamwork, leadership and conflict management, and critical thinking skills.

7.2.5. Technical Director

7.2.5.1. The Technical Director will direct the technical project management function. Develop and establish strategic project management and quality standards and methods that ensure on-time and in-scope delivery. Guide the development of technical estimates, work plans, methodologies, and deliverables. Build project delivery team skills and capability. Remove obstacles and negotiate with stakeholders. Manage and mitigate risk in all projects. Will have deep and broad knowledge of technology.

7.2.5.2. Qualifications include minimum bachelor’s degree in management, business, finance, economics, science, technology, engineering, or mathematics. Have a minimum of 10 years in a combination of program management, managerial, and Information Technology.

8. TRANSITION

8.1. The Contractor shall transition to assume control of operations to sustain critical operations and avoid delays and degradation of DIA CDF services. The Contractor shall provide a transition plan and schedule that at a minimum includes:

8.1.1. Describing specific activities necessary to successfully execute the transition to assume control of operations. The contract transition plan shall include ramp-up time and activities, identification of Key Personnel staffing, team hiring, risk management, orderly assumption of operations, and continued sustainment of processes by location.

8.1.2. The Contractor shall include a staffing plan and an accredited SCIF plan.

8.1.3. The Contractor shall provide a Transition In-Out Plan to include formal coordination with the COR plus the incoming contractor 90 days prior to contract expiration, IAW CDRL A009, Transition Plan.

8.1.4. The Contractor shall provide CDRL A016 (Contract Close-Out Plan), CDRL A009 (Transition Plan), CDRL A013 (Staffing Plan), and a CDRL A014 (SCIF Plan).

9. GOVERNMENT FURNISHED EQUIPMENT, INFORMATION, BADGES, KEYS AND/OR FACILITIES PROVIDED

9.1. The Contractor shall use, report, redistribute, and dispose of GFP in accordance with FAR 52.245-1 and 52.245-9, DFARS clauses 252.245-7001, 252.245-7002, 252.245-7003, and 252.245-7004, and DIA Acquisition Regulation Supplement and Instruction (DARSI) 5545.245-9000 and 9002 as applicable. The Contractor shall conduct an acceptance inventory of GFP and provide a written statement to the Contracting Officer (CO)/Property Administrator (PA) containing all relevant facts, such as cause or condition and recommended course(s) of actions if overages, shortages, or damages and/or other discrepancies are discovered upon receipt of GFP. The Contractor shall submit the Report of Government Property in Contractor’s Possession for GFP as provided in the DD-1423 in accordance with CDRL A010 (Report of Government Property in Contractor’s Possession)

9.2. The Contractor shall use GFP in performance of this contract. The Contractor shall not modify, disassemble or alter Government property unless this contract specifically identifies modifications, alternations or improvements as work to be done.

9.3. The Contractor shall return all contract materials, Government-provided data, and any materials procured during the contract (i.e., any hardware and/or software licenses procured at Government expense) at closeout. The Contractor shall conduct contract property closeout, to include reporting, investigating and providing closure of all loss of Government property cases; physically inventorying all property upon termination or completion of this contract; and disposing of items at the time they are determined to be excess to contractual needs in accordance with DIA Policy.

9.4. Contractor-Provided Facilities

9.4.1. The Contractor, at their expense, shall provide IT hardware and software, as well as any special tools and/or equipment requirements needed to perform work in Contractor owned/operated/leased facilities utilized for this PWS. The Contractor owned/operated/leased SCIF (TS/SCI) shall be operational and ready for occupancy within 45 calendar days of the contract kick off meeting. The Contractor owned/operated/leased facility will be located within 50 miles of DIA HQ’s.

9.4.1.1. The Contractor shall provide desktop equipment capable of accessing all classified networks. These components must meet security and network requirements.

9.4.1.2. The Contractor shall be responsible for the installation and maintenance, to include all required security requirements as well as the equipment and software necessary to provide Contractor’s employees with access to the required Government networks. This includes, but is not limited to, Security Technical Implementation Guidelines (STIGs), Information Assurance Vulnerability Management (IAVM), Intelligence Community Vulnerability Management (ICVM), security auditing and monitoring, provision of security log data, FISMA, and IAW requirements.

9.4.1.3. The Contractor shall provide all required network connectivity to the Contractor SCIFs from a Government provided connection point.

9.4.2. The Contractor shall be responsible to comply with all SCIF requirements and standards for operating classified IT systems. The Contractor shall be responsible to provide and maintain, as needed, the internal networks within the Contractor’s SCIF. Additional requirements may be necessary to properly secure and control access to crypto equipment and will be coordinated with the appropriate Government office by the Contractor’s Special Security Officer (SSO).

9.4.3. The Contractor shall provide all other necessary equipment, software, and supplies required to complete this task order. The Contractor may recommend COTS or other previously developed software components to enhance functions.

9.4.4. Upon completion or termination of this contract, unless sooner requested by the Government, the Contractor shall return to the Government all such physically deliverable property and/or equipment, as well as any Contractor acquired property which may accrue to the Government under contractual terms, provided such property has not been previously incorporated into any contractual line items as a part hereof, tested to destruction, or otherwise expended or rendered valueless as a result of performance.

9.4.5. The Contractor shall maintain physical security of Government Furnished Equipment and Property to prevent the loss of data, software and hardware (e.g., physical access, etc.).

9.4.6. The Contractor shall furnish reports required by applicable FAR and Agency guidance.

9.4.7. Utilization of Government Furnished Equipment / Property shall be limited to work assigned under this PWS.

9.4.8. The Contractor shall return all contract materials, Government-provided data, and any materials procured during the contract (i.e., any hardware and/or software licenses procured at Government expense) at closeout.

9.4.9. The Contractor shall produce, and maintain, a list of all equipment purchased under the Other Direct Costs (ODCs) Materials CLIN under this contract documenting each item purchased, location, date of receipt, current location, and other information as specified within this PWS.

9.4.10. The primary work location for this requirement is in the Contractor Provided Facilities. It is anticipated in the beginning of the contract there may be a transition period based on the SCIF plan provided during Proposal evaluation. The contractor shall submit, for Government approval, its request for Government provided space, along with a final plan to migrate from Government to Contractor provided facilities, within 45 days of the contract kick off meeting.

9.4.11. While providing support in Government Space, the Government will provide contractor personnel with an office environment (at Primary support locations listed above) that includes workstations, telephones, and computers with access to the internet and LAN. The office environment may be shared to support shift work or space shortages as approved by the COR and agreed to by both the Contractor and Government.

9.5. Reasonable Accommodations: Contractor employees are not in an employee/employer relationship with DIA; therefore, the contracting company is responsible for providing Reasonable Accommodations to their employee. While DIA will work with the contracting company to the extent that it is possible to facilitate a solution to a specific issue, DIA has no responsibility to provide Reasonable Accommodations for Contractor employees in order to enable them to perform work within DIA spaces.

9.6. Licensing and Software: The Contractor shall first receive COR approval prior to purchasing any software, licensing, equipment, or materials under this task order.