Unclassified IT Recompete PWS.pdf

F-35 JOINT PROGRAM OFFICE

DIRECTORATE OF ENTERPRISE SERVICES ACQUISITION

Unclassified IT Follow-On

Performance Work Statement

1.0 INTRODUCTION.

The F-35 Lightning II Joint Program Office (JPO) leads the life-cycle program management of the F-35A, F-35B, and F-35C: the fifth-generation joint strike fighter air system of choice for the

U.S. Air Force, U.S. Navy, U.S. Marine Corps, international partners, and foreign military sales customers. The mandate of the JPO is to deliver a capable, available, and cost-efficient air system to the warfighter - outpacing key competitors to win tomorrow's high-end fight as we develop, deliver, and sustain war-winning fifth-generation capabilities at high-end fourth-generation costs. The JPO mission is to ensure the F-35 is:

• lethal, scalable, and adaptable while safeguarding warfighters and outpacing aggressors.

• operationally sustainable by delivering parts when needed and leveraging predictive maintenance technologies to keep parts on wing longer while enhancing repair velocity.

• cost efficient for the U.S. services and international partners by optimizing procedures across the acquisition life cycle.

Scope.

The purpose of this effort is to obtain Contractor support to provide Information Technology (IT) and Information Assurance (IA)/Cybersecurity Services (CS) to the F-35 Lighting II Joint

Program Office (F-35 JPO) Virtual Enterprise (JVE) network and standalone workstations. The

IT Services support the F-35 JPO mission and enhance its effectiveness, efficiency, and productivity by providing the Government with a full range of IT and CS services.

The service requirements consist of program management, enterprise performance management, enterprise architecture, emerging capabilities and requirements implementation, life cycle management, operations & maintenance, enterprise data management and storage, service desk support, IT training, end-user capabilities and support, and cybersecurity incident response.

These services are critical to the successful fielding of F-35 mission capabilities.

The Contractor shall provide resources, materials, and services as necessary to perform the tasks defined in this PWS, except as specified in the Government-Furnished Resources and Property list. Operating, maintaining, and properly managing the life cycle of hardware, software, and https://hub.jsf.mil/sites/OCIO/win10 services is the crucial, primary service provided by this contract. Auxiliary IT engineer support will be provided to the F-35 Autonomic Logistics Information System (ALIS) team, as well as

CS support to the Air Systems team.

The F-35’s classified communications also traverse the JVE backbone. The Contractor shall provide networking services in support of the classified networks requirements by maintaining the JVE network and coordinating connections, changes, outages, etc. with the Contractor responsible for the classified systems. The Contractor shall ensure that service is maintained across the JVE network up to the switch port feeding the Tactical Local Area Network

Encryption (TACLANE) or other encryption device where support falls to the Contractor responsible for the classified system(s).

In addition to F-35 JPO-controlled networks, Government and Contractor personnel may require access to services provided on other networks. The F-35 JPO has established several trusted connections to include: af.mil, navy.mil, Lockheed Martin (LM) Autonomic Logistics

Information System (ALIS), and LM Failure Reporting, Analysis and Corrective Action System

(FRACAS). The Contractor shall maintain the JVE connections to the aforementioned systems and will work with those managing those systems to trouble-shoot issues when required.

2.0 APPLICABLE LAWS, REGULATIONS, AND POLICY.

• DoD Directive (DoDD) 2000.12 DoD Antiterrorism (AT) Program

• DoDD 5200.02 Defense Industrial Personnel Security Clearance Review Program

• DoDD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations

• DoDD 5230.24, Distribution Statements on DoD Technical Information

• DoDD 5000.59, DoD Modeling and Simulation Management

• DoD Instruction (DoDI) 4120.24 Defense Standardization Program

• DoDI 5000.02, Operation of the Adaptive Acquisition Framework

• DoDI 5000.82, Requirements for the Acquisition of Digital Capabilities

• DoDI 5000.88, Engineering of Defense Systems

• DoDI 5000.85, Major Capability Acquisition

• DoDI 5000.89 Test and Evaluation

• DoDI 5000.91, Product Support Management for the Adaptive Acquisition Framework

• DoDI 5000.97, Digital Engineering

• DoDI 5015.02, DoD Records Management Program

• DoDI 5200.02 DoD Personnel Security Program (PSP)

• DoDI 5220.31 National Industrial Security Program

• DoDI 5205.11, Management, Administration, and Oversight of DoD Special Access

Programs

• DODI 8140.01 CyberSpace Workforce Management

• DODI 8140.02 Identification, Tracking, and Reporting OF CyberSpace Workforce

Requirements

• DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology

(IT)

• DoDI 8500.01, Cyber Security

• DoDI 8580.1, Information Assurance (IA) in the Defense Acquisition System

• DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information

Systems

• DoD Manual (DoDM) 5200.01, Information Security Program Volumes 1-4

• Directive-type Memorandum (DTM) 22-001, DoD Standards for Records Management

Capabilities in Programs Including Information Technology

• Air Force Instruction 31-101, Air Force Integrated Defense

• Secretary of the Navy Instruction (SECNAVINST) 5510.30A, Department of Navy

Personnel Security Program

• SECNAVINST 5510.36, Department of Navy Information Security Program

• Joint Special Access Program Implementation Guide (JSIG)

• Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, Defense Information

System Network (DISN): Policy, Responsibilities, and Processes

3.0 TASKS/PERFORMANCE REQUIREMENTS.

The Contractor shall provide all services and project supervision, as required in connection with the Performance Work Statement (PWS).

The Contractor’s team shall be responsible for performance of the tasks and activities, as specified within this PWS, to support the following: the Government’s day-to-day IT operations management processes pertaining to IT service operations; IT engineering activities; continual service improvement across the Government’s enterprise; and managing and maintaining CS integrity of all servers, devices, storage, or cloud-based computing resources from external and internal security threats.

TECHNICAL OBJECTIVES

3.1 Operations Management Services

Operations Management Services is the maintenance and management of IT services to the F-35

JPO including, but not limited to, telephony services (1,300+ Voice over Internet Protocol

[VoIP] devices), video audio teleconference services (2,500+ video teleconferences [VTCs] annually), Network Operations Security Center (NOSC, 12 critical and 23 less critical service checks), network services (355 network devices, at CONUS, Japan, and Republic of Korea sites), application services and management (18+ applications and 170+ software titles), and infrastructure management services (338 servers).

3.2 Telephony Services

Contractor shall manage Government- devices, included but not limited to laptops, desktops, mobile phones, tablets, and mobile hotspot devices. Support covers licensing, throughout the F-

35 JPO community within the confines of DoD and F-35 JPO cybersecurity policies and procedures. Contractor shall include the following services:

• Ensure seamless and uninterrupted communication through the implementation and continuous support of both voice and data telecommunications infrastructure.

• Optimize the performance, reliability, and scalability of telecommunication services, including VoIP, mobile communication systems (laptops, mobile phones, iPads, and other like-type devices,) and integrated networks.

• Perform routine audits and troubleshooting to address any service degradation or failures within telecommunications systems.

• Provide recommendations that leverage other DoD or commercial technologies that enhance capabilities and reduce overall cost.

• Maintain records in accordance with DoD policies and commercial best-practices, support 100 percent accountability of GFE (government furnished equipment).

• Conduct initial user training and assistance for use as necessary to end users.

3.3 Video/Audio Teleconference (VTC) Services

Contractor shall manage Non-classified Internet Protocol (IP) Router Network (NIPRNet) audiovisual (A/V) services for standard conference rooms, VTC rooms, and the Conferencing

Center in addressing the following requirements:

• Provide onsite support at the Conference Center as well as onsite support in VTC and conference rooms during core hours from 0600-1800 in Arlington, VA.

• Provide high-quality, secure, and scalable video conferencing services to meet organization communication and collaboration needs, supporting both internal and external stakeholders.

• Monitor and maintain the video teleconferencing infrastructure, ensuring seamless operation of video, audio, and screen-sharing functionality.

• Implement and manage regular upgrades and maintenance to ensure compatibility with latest software versions, security protocols, and end-user devices.

• Provide written end-user audiovisual instructions specific to each integrated audiovisual conference room configuration.

• Provide end-user training on the audiovisual and collaboration applications in established conference rooms, VTC rooms, and the Conferencing Center upon request.

• Monitor equipment for functional and operational readiness daily. Maintain standard equipment replacements on-hand to quickly repair commonly failed or recommended spares by sponsored system agency.

• Coordinate with internal and external counterparts for troubleshooting or implementation of new equipment as necessary, (break/fix or new capability).

• Perform patch and firmware upgrades, break/fix support, daily operations, and management support, including onsite assistance for special events.

3.4 Network Operations Security Center (NOSC)

Contractor shall manage, monitor, and report on the state of confidentiality, integrity, and availability of Joint Virtual Environment (JVE) critical and less critical services, including, but not limited to what is contained in Table 1. Critical and Less Critical Services.

• Establish a Network Operations Security Center to monitor, detect, and respond to security events, incidents, and anomalies in real-time, and in accordance with defined operational hours.

• Ensure proactive management of mission-critical network operations to ensure optimal network performance and security, including detection of intrusion attempts, denial-of-service attacks, and malware threats.

• Implement automated and manual response protocols for identified incidents, minimizing the impact on operations and ensuring rapid recovery.

The table below is an example of some of the critical and less-critical services in F-35 JPO operations:

Table 1. Critical and Less Critical Services

Critical /

Less Critical

Service Short Description

Critical

BMC Helix or Industry Standard ITSM Digital service management solution that combines a service desk manager, a change manager, a service delivery manager, and an IT director into one suite.

Comply to Connect (C2C) DoD Cybersecurity framework used to manage and monitor networks and devices

Electronic Flight Clearance Tool Used to obtain clearance for an aircraft and to create, review, edit, and approve flight clearance envelopes.

Microsoft Exchange Microsoft email service that allows users to send and receive emails, manage calendars, and collaborate with others

File Shares/Profiles/My

Docs/OneDrive

User document storage

Microsoft 365 (to include MS Office

Tools, Dynamics, Power Platform, Power Apps, Power BI, and M365

Mobile (MDM))

Cloud based Microsoft tools that include an extensive array of business productivity applications such as

Word, Excel, Teams, PowerPoint, OneNote, OneDrive, Publisher, Access, and Outlook.

Networks Maintain on-prem, cloud networks, performing backups, troubleshooting issues

Printers Manage the printing needs of the F35

JPO

SharePoint Used to create websites and is a secure place to store, organize, share, and access information from any device.

VoIP Call Manager

Service Short Description

Cisco AnyConnect Virtual Private

Network (VPN)

Virtual Private Network (VPN)

Connectivity software

Vulnerability Analysis Tool the Cyber team uses to scan software and files to ensure there are no vulnerabilities

Less Critical

Accolade Web-based application used to streamline and automate the process of translating operational needs into acquisition activities and includes contracting, funding, and model-based systems engineering design work.

CMPRO Enterprise-wide project management tool. It gives users the ability to balance limited resources across multiple projects, to show the impact one project has on the program as a whole.

Content Server Centrally managed content repository, providing unified control over all types of content across the enterprise

Comcast Wi-Fi Commercial internet service

DefenseReady Enterprise human resource and total workforce management platform built specifically for the DoD.

Empower Web interface analytical tool that integrates earned value, schedule, work authorization, and other key performance data to enable proactive management of complex projects.

ETMS2 Automated tasking management system, enabling electronic end-to-end lifecycle task management within a single enterprise application tool.

FEDS Federal Export Documentation System

(FEDS) stores current and historical

JSF Technical Assistance Agreements

(TAA), Manufacturing License

Agreements (MLA), and Amendments.

Foreign Disclosure (FD) Training Training required for all US employees of the F35 JPO, housed in

DefenseReady (DR)

Government Property and Ordinance

Tracking System (GPOTS)

Facilitates the tracking of GFE weapons contractually required for JSF development and testing.

Service Short Description

F-35 JPO Public Website

(www.jsf.mil)

External website for the F35 JPO

Independent Assessment Capability

(IAC)

Collection of integrated software modules in a web-based application used to independently track, manage, and verify F-35 logistics and maintenance data and processes

LogRhythm Platform that combines security information, event management, log management, file integrity monitoring, and machine analytics with host and network forensics.

Project Server Multi-project and portfolio management and provides capabilities for planning, reporting, team collaboration and resource management.

ProPricer Web-based application used to streamline and automate the process of translating operational needs into acquisition activities and includes contracting, funding, and model-based systems engineering design work.

RadiantOne by Radiant Logic An identity integration layer that allows deployment of scalable solutions

Request for Information Tracker Facilitates the management, tracking, and approval of information requests from partner and security cooperative participant countries.

Rhapsody A modeling environment based on

UML, is a visual development environment for systems engineers and software developers creating real-time or embedded systems and software

SolarWinds Server and Application

Manager

Designed to monitor applications and their supporting infrastructure, whether running on-premises, in the cloud, or in a hybrid environment.

XCollab SharePoint collaboration tool for internal and external users designed for

CPPs to share data with home countries and for JPO personnel to share data externally with vendors, services, or other external entities.

http://www.jsf.mil/

Contractor shall perform NOSC daily checks for services listed in Table 1. Critical and Less

Critical Services and report status twice daily.

Contractor shall respond to critical and less critical changes in the NOSC service checks as required due to F-35 JPO mission priorities, Office of the Chief Information Officer (OCIO) IT roadmap, and/or user requirement adjustments. Contractor shall ensure services result in the following outcomes:

• The monthly uptime of critical services is 95% or more (excludes external outages, which are any outages outside the control of Contractor [i.e. DISA-related outages]).

• The monthly uptime of less-critical services during F-35 JPO operational hours (Monday

– Friday 0600-2100 ET except for Federal Holidays) is 90% or more (excludes external outages, which are any outages outside the control of Contractor [i.e. DISA-related outages]).

• Respond 24x7 to enterprise or core-site network outages unless a required third party is non-responsive (such as host-based support personnel or DISA local engineers, etc.).

• Respond to building or floor network outages between 0600 to 1800 (local site time).

Contractor shall submit an emergency Travel Authorization Request (TAR) if travel is required.

• Inform the OCIO upon observation of a critical service failure or service interruption.

• Send a user notification for outages and degradations upon service failures and/or service interruptions.

3.5 Network Management, Support, and Connectivity

Contractor shall manage network devices which will be provided post-award. These devices include Cisco Unified Communication Managers, firewalls, Identity Services Engines, routers, switches, Unified Computing Systems, Virtual Private Networks, DISA circuits, and commercial circuits. The network devices are found within the Data Center Diagram and the Network and

Server List located within the Enterprise Technical Library (ETL). Contractor shall:

• Ensure continuous and reliable connectivity for all organization networks by proactively managing network infrastructure, including local area networks (LANs), wide area networks (WANs), JPO-managed wi-fi connection points, and cloud-based network services.

• Provide technical support and troubleshooting for network connectivity issues, including issues related to bandwidth, routing, and switching, ensuring minimal downtime and maximum uptime.

• Implement redundance, failover systems, and load balancing solutions to guarantee network availability, especially for mission-critical applications.

• Provide recommendations that improve infrastructure, leverage cloud capabilities, or cost-saving initiatives that will benefit effectiveness and efficiencies for the government.

3.6 Software and Application Management

Contractor shall manage the operational software and applications utilized within the JPO infrastructure in accordance with OCIO Operations and Maintenance (O&M) process and procedures. Contractor shall:

• Provide recommendations that improve infrastructure, leverage cloud capabilities, or cost-saving initiatives that will benefit effectiveness and efficiencies for the government.

• Oversee the deployment, maintenance, and performance of enterprise-level software and applications to ensure optimal functionality, security, and user experience.

• Manage software patching and updates to ensure compliance with security standards, while minimizing disruptions to daily operations.

• Provide end-user support, troubleshoot software issues, and resolve application failures promptly to maintain productivity across the organization.

• Advise on application modernization and recommend future procedures that provide best value to the PMO organization. In event a solution is adopted, contractor will be responsible for data migration and application repatriation.

• Support the lifecycle of applications (design, build, integrate, test, implement, deploy, operate, and optimize) from a government-approved data center.

• Establish a software license management system to ensure compliance with software licensing agreements and track usage across the organization.

• Implement automated tracking and reconciliation of software licenses, including tracking usage, renewals, and audits to prevent over-licensing or under-licensing risks.

3.7 Infrastructure Management, Services, and Support

JVE infrastructure includes approximately 300 servers within Azure, SaaS, and the onsite data center; it also includes hardware, software, operating systems, backups, and data storage required to deliver IT services. Contractor shall support the JVE infrastructure in accordance with OCIO

O&M processes, procedures, and disaster recovery plan. Contractor shall:

• Maintain a robust and scalable IT infrastructure, including servers, storage solutions, cloud resources, and virtualization platforms, to meet business requirements.

• Ensure the optimal performance, security, and reliability of infrastructure systems through proactive monitoring, capacity planning, and routine maintenance.

• Implement backup, disaster recovery, and business continuity plans to mitigate risks associated with hardware failure or catastrophic events, ensuring that critical data and systems are always accessible.

3.8 Performance Reporting

Contractor Continual Service Improvement (CSI) uses management, monitoring, reporting, and analysis of services to identify opportunities for improvement. Contractor shall:

• Develop and implement a structured set of performance metrics and key performance indicators (KPIs) that effectively measure the performance, reliability, and efficiency of

IT services, infrastructure, and operations.

• Implement tools and systems that automate the collection, analysis, and reporting of performance data to reduce manual intervention and ensure accuracy in reporting.

• Ensure continuous, real-time monitoring of critical IT services and infrastructure, with automated alerts and notifications for performance degradation or anomalies, enabling proactive remediation.

• Provide stakeholders with detailed performance reports that include actionable insights, trends, and recommendations for optimizing service delivery and reducing downtime.

These reports should be delivered in an understandable format, such as dashboards or custom reports, for decision-makers.

• Conduct regular performance reviews with stakeholders to assess the effectiveness of current systems and processes, making adjustments where necessary to enhance service delivery.

3.9 IT Service Management

Contractor provides IT Service Management (ITSM) based on the ITSM framework and

Information Technology Infrastructure Library (ITIL) lifecycle phases—Service Strategy, Service Design, Service Transition, Service Operation, and Continual Service Improvement—to optimize efficiencies and increase resiliency and cybersecurity.

Contractor provides this support to current F-35 JPO IT enclave, F-35 U.S., and F-35

International Partners in CONUS and OCONUS.

3.9.1 Service Strategy

Contractor is expected to develop and deploy in accordance with a government-approved service strategy. Contractor shall:

• Ensure that the IT Service Management (ITSM) strategy is aligned with the organization's overall business goals, with a focus on improving service delivery, reducing costs, and driving business agility.

• Establish a service portfolio management approach to evaluate and prioritize IT services based on business value, ensuring that resources are allocated efficiently and aligned with strategic objectives.

• Implement governance structures and risk management processes to oversee the planning, implementation, and ongoing management of IT services in a secure, compliant, and controlled manner.

These requirements will be in accordance with CDRLs, or a periodicity agreed upon within 60 days of contract award.

3.9.2 Service Design and Transition

Contractor shall design upgraded services following OCIO’s Project Portfolio Management processes:

• Develop comprehensive service design frameworks, ensuring that IT services are designed with scalability, security, and performance in mind, meeting both current and future organizational needs.

• Manage the end-to-end transition of new or changed services into production, including conducting thorough testing, ensuring proper documentation, training, and ensuring all stakeholders are prepared for change.

• Integrate structured change management processes to ensure that service transitions, upgrades, or modifications occur with minimal disruption, optimizing change success rates and minimizing risk.

• Implement a knowledge management system to ensure smooth knowledge transfer during service transitions and maintain an updated repository of critical information for easy access by the team.

• Document all proposed changes, including risk identification and test plans, and provide subject matter expert feedback.

• Facilitate Technical Review Board (TRB), Change Approval Board (CAB), and

Emergency CAB (ECAB) meetings to promptly address any urgent concerns.

3.9.3 Service Operations

Contractor shall establish end-to-end, fully integrated processes and related governance to consistently deliver IT services at desired service levels. Contractor shall:

• Develop and enforce incident and problem management processes to ensure quick resolution of IT incidents and minimize service disruptions, while also analyzing root causes and preventing recurrence.

• Design and optimize processes for efficiently handling user requests and service fulfillment, ensuring timely and consistent service delivery according to predefined SLAs

(Service Level Agreements).

• Continuously monitor and assess service operations, identifying areas for process improvement, cost reduction, and operational efficiency.

• Enhance the service desk (JVE and AFNET networks) to provide excellent customer service, reduce resolution times, and ensure a high level of user satisfaction with IT services.

3.9.4 Continual Service Improvement (CSI)

Contractor shall align IT services with changing mission and business requirements by identifying and adopting improvements to IT services that support business processes at a level equivalent to an ISO: 20000-1:2018 compliant program. Contractor shall:

• Establish and maintain a Continual Service Improvement (CSI) framework that drives the continuous assessment, improvement, and optimization of IT services, based on both performance data and user feedback.

• Utilize data from performance monitoring, incidents, service requests, and user feedback to identify areas for improvement, with a focus on increasing service quality, reducing operational costs, and improving customer satisfaction.

• Conduct post-incident reviews and root-cause analyses after major incidents to identify areas for improvement, enhance knowledge management, and ensure that corrective actions are implemented to avoid future disruptions.

• Promote a culture of continual service improvement within the IT operations team by encouraging the identification and implementation of innovative solutions to improve service quality, increase efficiency, and reduce risk.

By implementing these technical objectives, IT operations will be able to enhance service delivery, maintain operational excellence, and continuously adapt to changing business and technological needs.

3.10 IT Asset Management (ITAM)

IT asset and inventory management includes receipt of inventory, issuance of inventory, tracking of inventory, and disposal of inventory. Contractor shall follow OCIO’s well-defined IT Asset

Management processes to manage the full lifecycle of all current assets and those procured from

Time of Award (TOA) until completion of the DoD Defense Logistics Agency (DLA) disposition process.

3.10.1 Strategic Objectives:

Contactor is expected to meet the following OCIO strategic initiatives through technical implementation by performing tasks that meet the following:

• Develop a comprehensive IT asset lifecycle management strategy to ensure the optimal performance and utilization of IT assets from acquisition through to disposal.

• Define and implement standardized processes for asset identification, tracking, procurement, usage, and retirement to ensure assets are effectively managed and aligned with organizational goals.

• Ensure that asset management supports the broader IT service management (ITSM) and procurement strategies, creating synergies with overall organizational objectives.

• Implement cost-effective asset management practices that optimize asset utilization and minimize unnecessary expenditures across procurement, maintenance, and disposal.

• Align asset management with budgeting processes to track and forecast asset-related costs, ensuring that all asset procurement aligns with the business’s financial goals and limits.

• Ensure compliance with industry regulations, security policies, and licensing requirements for all IT assets, including hardware and software.

• Implement procedures for asset tracking and reporting that meet regulatory standards.

• Develop risk management processes to identify potential vulnerabilities related to IT assets, ensuring secure disposal, lifecycle management, and adherence to data privacy laws.

• Implement strategies for the efficient reuse and recycling of IT assets where possible, reducing the carbon footprint and supporting green initiatives.

• Ensure seamless integration of IT Asset Management with other ITSM processes, including Incident Management, Change Management, and Configuration Management, for effective tracking and coordination of assets across the organization.

• Establish a centralized IT asset inventory to provide visibility into all IT resources, enabling efficient decision-making and reporting.

3.10.2 Technical Objectives:

• Implement automated asset discovery tools and systems to identify and record all IT assets across the organization, both on-premises and in the cloud.

• Develop real-time asset tracking and monitoring capabilities to ensure that assets are accurately inventoried, updated, and monitored for performance and usage.

• Ensure asset tracking covers both hardware and software, including mobile devices, workstations, servers, network equipment, and virtualized environments.

• Integrate IT asset management systems with the Configuration Management Database

(CMDB) to ensure consistent and accurate tracking of assets and their relationships to other IT services and configurations.

• Maintain a dynamic CMDB that reflects changes in asset configurations, lifecycle stages, and service impacts for greater operational awareness and risk mitigation.

• Develop and implement standardized processes for asset procurement and provisioning, ensuring assets are efficiently ordered, delivered, configured, and made available to end-users.

• Develop asset support processes to facilitate ongoing troubleshooting, issue resolution, and warranty management.

• Ensure that support contracts, maintenance agreements, and service-level agreements

(SLAs) are tracked and adhered to for each asset.

• Establish a formal process for asset retirement and disposition, ensuring the proper disposal of hardware, software, and components in line with organizational policies and legal requirements.

3.10.3 Reporting and Analytics:

• Develop comprehensive reporting capabilities that provide real-time visibility into asset usage, availability, lifecycle status, and costs.

• Leverage automation tools to improve asset management workflows, such as automated provisioning, configuration changes, and lifecycle management tasks.

• Integrate IT asset management software with other enterprise management platforms

(e.g., ITSM, ERP) to ensure a unified, seamless service delivery experience across business units.

• Develop and manage relationships with key IT asset vendors and suppliers to negotiate favorable procurement terms, warranties, and maintenance agreements.

• Ensure all vendor and supplier contracts are tracked for performance, compliance, and service quality.

• Ensure IT asset management tools are integrated with incident, change, and configuration management systems to track asset-related service requests and impacts.

• Ensure that all IT assets comply with organizational security policies, including access control, encryption, and regular security audits.

• Provide audit trails and logs for all asset-related transactions, including procurement, maintenance, and disposal activities, to ensure compliance with organizational policies and regulatory requirements.

By ensuring these strategic and technical objectives are well-defined in the Statement of Work

(SOW) for IT Asset Management, the organization can achieve optimized IT resource utilization, improved service delivery, cost savings, and regulatory compliance while maintaining a high level of operational efficiency.

3.11 System Administration

The Contractor will provide system administration services for all F-35 JPO servers, applications, and systems within the JVE environment. These services will support daily operations, ensuring the stability, security, and reliability of the environment. The contractor will adhere to OCIO Change Management and Information Security Management processes, and follow IT lifecycle best practices, including hardware assessment, upgrades, and system implementation.

Key responsibilities include:

• Handling user access requests, including creation, modification, and removal of access to critical resources. Ensure timely provisioning and de-provisioning of accounts as per established processes.

• Managing hardware and software configurations based on lifecycle and impact using

ITIL best practices. This includes updating documentation, implementing approved changes, and tracking vendor updates and software versions.

• Ensuring data accuracy, compliance, and security across all databases, while implementing mechanisms for validation, optimization, encryption, and backup/restoration. The contractor will also monitor database health and perform regular maintenance.

• Ensuring systems remain secure by applying patches, updates, and firmware. This includes following the change management process, scheduling maintenance, and managing vendor updates. The contractor will also track licenses and warranties and alert the Government ahead of expiration.

The Contractor will also identify opportunities for automating enterprise services and provide findings to the Government for consideration.

3.12 Access Management

F-35 OCIO views access management as a critical component of ensuring the security, integrity, and confidentiality of sensitive data and systems. It involves controlling and monitoring user access to resources based on the principle of least privilege, ensuring that individuals have only the access necessary for their specific roles. The government mandates strict adherence to regulatory frameworks, such as FISMA and NIST, to enforce policies like role-based access control (RBAC) and multi-factor authentication (MFA), and requires robust audit trails to track and document access events. Timely provisioning, deactivation, and periodic reviews of access rights are essential to mitigate risks from unauthorized access, insider threats, and non-compliance. Additionally, automation and integration with broader cybersecurity measures are prioritized to enhance efficiency, reduce human error, and maintain operational continuity while safeguarding sensitive information. To meet and maintain these goals, the Contractor shall:

• Ensure that user accounts are created within two (2) business days upon completion of the required access approval process (e.g., SAAR submission and required training certificates).

• Disable user accounts within one (1) business day and fully de-provision accounts within three (3) business days upon notification of user departure or role change.

• Ensure that all access requests undergo the necessary approval workflow, including validation against defined access control policies and roles, before account creation or modification.

• Implement and maintain records according to DoD Record Management Policy to support audits and investigations, as required.

• Develop and deliver training programs to educate users on access management policies, security best practices, and safe usage of organizational resources, reducing risk of inadvertent security breaches.

By achieving these technical objectives, the organization will ensure a secure, efficient, and compliant access management system, supporting organization security and operational continuity while providing users with timely and appropriate access to resources.

3.13 Configuration Management

Contractor shall manage configurations based on criticality, lifecycle, and impact utilizing ITIL best practices as follows:

• Develop and maintain configuration baselines for hardware (servers, workstations, network devices, etc.,) and software (COTS, GOTS, applications) to ensure consistency and control across the environment.

• Implement configuration processes to track and manage changes to hardware, software, and network configurations, ensuring all modifications are authorized, documented, and tested prior to deployment.

• Maintain accurate and up-to-date configuration documentation for all hardware, software, and network components, including detailed configuration settings, versions, and configurations of deployed systems.

• Perform periodic reviews and updates to configuration documentation, ensuring it reflects current system states and accurately describes all implemented configurations.

• Adhere to a formal change management process for configuration changes, ensuring all changes are evaluated, approved, and documented before implementation. This includes defining risk assessments, rollback procedures, and approval workflows.

• Implement automated processes to monitor for and remediate configuration drift, ensuring that all systems remain aligned with the approved configuration baselines.

• Maintain detailed audit trails of changes to ensure compliance with regulatory standards.

• Ensure all configuration management practices adhere to relevant standards and frameworks (e.g., NIST, ITIL, FISMA, etc.), supporting regulatory compliance and industry best-practices.

3.15 Database Management

Database Management focuses on the efficient and secure handling of data across various systems and applications. It encompasses a range of activities designed to ensure data integrity, accessibility, and security while maintaining compliance with applicable regulations and stands such as FISMA, NIST, and HIPAA. Key deliverables include the design, implementation, and optimization of database structures, ensuring high availability, performance, and scalability to meet evolving mission needs. It also involves regular backups, disaster recovery planning, and security measures like encryption and access control to safeguard sensitive information.

Additionally, database management includes ongoing monitoring, maintenance, patching, and version control to ensure system reliability, as well as ensuring that all database-related activities are properly documented and auditable for compliance purposes. The goal is to provide the government with a robust, secure, and efficient database environment that supports its operations and strategic objectives. To meet these objectives, the Contractor shall:

• Design and maintain efficient, scalable database architectures that meet both current and future business requirements. This includes the selection of database technologies, schema design, and normalization of data models.

• Continuously optimize database performance through indexing strategies, query optimization, and performance tuning techniques, ensuring the system can handle growing data volumes while maintaining high-speed query responses.

• Implement mechanisms to ensure the accuracy and integrity of the data, including validation rules, integrity constraints, and error-checking processes to prevent data corruption.

• Regularly perform data reconciliation tasks to ensure consistency across databases and ensure that discrepancies are identified and corrected promptly.

• Develop and implement a comprehensive database backup and recovery strategy to ensure data availability and integrity in the event of hardware failures, corruption, or other disasters. This includes regular backup schedules, off-site backups, and automated backup validation processes.

• Regularly test disaster recovery procedures to ensure quick and effective restoration of database services, minimizing downtime in the event of system failure.

• Define and enforce strict access control policies to limit access to sensitive database systems and data. This includes user role management, permissions configuration, and integration with Identity and Access Management (IAM) systems.

• Apply encryption techniques to safeguard data both at rest and in transit, ensuring compliance with data protection standards and safeguarding sensitive information.

• Maintain comprehensive audit logs for database access and modifications, enabling traceability and accountability for all actions performed on the database.

• Implement continuous monitoring solutions to track database performance, health, and availability. This includes real-time monitoring of key metrics such as CPU utilization, query performance, storage utilization, and connection counts.

• Perform proactive database maintenance, including routine database optimization, cleanup tasks, and capacity planning to prevent potential issues and ensure system health.

• Implement version control processes for database schemas and stored procedures to ensure that database changes are systematically tracked and managed throughout the development, testing, and production phases.

By achieving these technical objectives for Database Management, the contractor will ensure a stable, secure, and efficient IT environment, promoting system performance, data integrity, and compliance with regulatory and security standards.

3.16 Knowledge Management

F-35 OCIO defines knowledge management as the systematic process of capturing, organizing, sharing, and utilizing information and expertise to enhance decision-making, operational efficiency, and compliance. It includes the development and maintenance of centralized repositories or knowledge bases that store essential documents, processes, procedures, best practices, and lessons learned. Key deliverables typically include ensuring the accessibility and accuracy of information through structured categorization, version control, and secure access mechanisms. Knowledge management also emphasizes collaboration and the seamless sharing of information across departments and teams, often using enterprise tools like SharePoint, Confluence, or Teams. Additionally, it involves creating and maintaining training materials, standard operating procedures (SOPs), and facilitating knowledge transfer, particularly during onboarding and staff transitions. Regular review and update cycles are essential to ensure that knowledge assets remain current and aligned with evolving government objectives and compliance requirements. The ultimate goal is to foster a well-informed, efficient, and compliant workforce while reducing redundancy and enhancing organizational learning. The Contractor shall:

• Develop and maintain a centralized knowledge repository to store and manage all relevant organizational knowledge, including documents, processes, procedures, technical guides, and lessons learned.

• Organize content in a logical, accessible manner with standardized categorization and metadata to enhance searchability and ease of use for end-users.

• Implement version control processes for all knowledge management assets to ensure that users always have access to the most current and accurate information.

• Integrate knowledge management systems with collaboration tools (e.g., SharePoint, Confluence, Teams) to enhance real-time knowledge sharing and collaboration across teams and departments.

• Encourage user contributions to the knowledge base by implementing systems that allow for easy addition, modification, and sharing of knowledge and ensuring user accountability for contributions.

• Develop, document, and maintain standard operating procedures (SOPs) for knowledge management practices, ensuring consistency in processes such as content creation, approval, and publication.

• Integrate knowledge management processes with organizational change management practices to ensure that new systems, processes, and technologies are documented and communicated effectively.

• Implement advanced search functionalities that enable users to quickly find relevant documents, solutions, and resources based on keywords, tags, or other metadata.

• Implement strategies to capture tacit knowledge from departing employees, experts, and subject matter authorities to ensure organizational knowledge retention.

• Regularly report on the health and effectiveness of knowledge management processes, including content updates, user engagement, and compliance with retention policies.

By achieving these technical objectives in Knowledge Management, the organization will ensure optimal system performance, data security, and the seamless flow of knowledge across the enterprise. This will enhance operational efficiency, support compliance, and foster a collaborative environment that encourages continuous learning and improvement.

3.24 Information Assurance/Cybersecurity (CS) Services

Information Assurance and Cybersecurity services are critical components of an organization's

IT infrastructure. These services encompass the protection of digital assets and sensitive data while preventing unauthorized access and cyber threats. The Contractor shall implement a comprehensive cybersecurity strategy that enables the F-35 JPO to operate securely across all

CONUS and OCONUS environments. All plans and activities conducted by the Contractor shall fully comply with applicable DoD and Government policies, procedures, and mandates.

The Contractor shall provide cybersecurity services to identify vulnerabilities, enhance the cybersecurity management program, and maintain an acceptable risk level for the F-35 JPO Joint

Virtual Environment (JVE). Currently, the JVE comprises two Authorizations to Operate

(ATOs): one for the on-premises JVE and another for Azure IL-5. The Contractor’s responsibilities include:

• Continuously improving security practices and processes in alignment with evolving

DoD security guidance.

• Implementing and maintaining approved DoD continuous monitoring and scanning capabilities.

• Responding to cybersecurity tasking to ensure the appropriate level of confidentiality, integrity, authenticity, non-repudiation, and availability of data and delivery systems.

This shall be conducted in accordance with DoD Instruction (DoDI) 8510.01 – Risk

Management Framework (RMF) for DoD IT, ensuring proper security measures for data that is received, displayed, processed, transmitted, or stored.

3.25 Risk Management Framework (RMF) Management

The Contractor shall ensure that the F-35 JPO enterprise complies with all designated security controls as mandated by the latest applicable DoD Assessment and Authorization (A&A) requirements. These requirements include DoDI 8510.01, as outlined in the DoD RMF

Knowledge Service, and directives from the Chairman of the Joint Chiefs of Staff Instructions on

Defense Information Systems Networks. Compliance shall also align with NIST standards, Command Cyber Readiness Inspection (CCRI) 3.0 level standards, the Committee on National

Security Systems (CNSS), and Computer Network Defense guidelines.

The Contractor shall adhere to DoD Instruction (DoDI) 8500.01, ensuring the establishment of cybersecurity policies and assigned responsibilities necessary to achieve DoD Cybersecurity

(CS) through a defense-in-depth approach. This approach shall integrate personnel, operational procedures, and technological capabilities while supporting the transition to network-centric warfare.

Additionally, the Contractor shall demonstrate proficiency in the latest NIST publications listed in PWS Section 9.0, Cybersecurity References. All Risk Management Framework (RMF) processes shall be conducted in accordance with NIST Special Publication 800-37, and all

Assessment and Authorization (A&A) deliverables shall be submitted per CDRL A015 and

CDRL A015A.

3.26 Continuous Monitoring and Scanning

The Contractor shall perform comprehensive audits of all F-35 JPO IT systems, subsystems, and standalone components throughout their lifecycle, ensuring compliance with applicable governance and security policies. Audit reports shall be submitted upon Government request.

The Contractor shall execute audits using the following tools and methodologies:

• Security Technical Implementation Guides (STIGs)

• Assured Compliance Assessment Solution (ACAS) vulnerability scanning

• Endpoint Security Services (ESS) monitoring

Audit results shall be tracked in the Executive Dashboard and reported to the Government monthly.

Monitoring and Compliance Requirements

The Contractor shall ensure the following continuous monitoring requirements are met:

• ACAS Scans – Conducted monthly, achieving a 98% scan rate.

• STIG Reviews – Performed quarterly.

• Plan of Action & Milestones (POA&Ms) – Developed, tracked, and maintained in eMASS, with updates conducted weekly and uploads occurring at least quarterly.

• ESS Scores – Maintained at 95% or higher at least 90% of the time across all four (4) measured areas. If scores fall below this threshold, the Contractor shall coordinate with

CSSP and JFHQ-DoDIN to enhance security processes.

Security Compliance Tracking

The Contractor shall track and report compliance for the following security metrics:

• CC1 Operating System STIG Settings – Both reporting and compliance status

• IAVM-A Patches (Software Inventory) – Both reporting and compliance status

• IAVM-A Patches (Benchmark Compliance) – Both reporting and compliance status

• ESS Implementation Status

Risk Reporting & Dashboard Updates

The Contractor shall maintain and update a JVE Security Dashboard on a weekly basis, ensuring that it meets update compliance at least 75% of the time, as measured monthly.