VIA BOA Call 1 - IT Sustainment PWS (Draft 15May2025).pdf

Variable Infrastructure Award (VIA) Call 1 - IT Sustainment i

Variable

Infrastructure Award (VIA)

Information

Technology (IT) Sustainment

Call #1

Command, Control, Communications, Computers, Cyber and Intelligence

(C5ISC)

Performance Work Statement

(PWS)

and Performance Metrics &

Measures

DRAFT

Version 1.0

15 May 2025 ii

Document Revision History

Revision No.

Modification No.

Description of Changes Date

None None Initial version (DRAFT) 15 May 2025 iii

Table of Contents

1.0 INTRODUCTION

1.1 Background

1.2 Scope

1.3 Performance Objectives

1.4 Assumptions & Constraints

2.0 PROGRAM MANAGEMENT OFFICE (PMO)

2.1 Program Management

2.1.1 Key Personnel

2.1.2 Program Management Office (PMO)

2.1.3 Security Awareness and Training

2.1.4 Quality Management

2.1.5 Risk Management

2.1.6 Management Meetings & Reporting

2.2 Program Governance

2.3 Business Relationship Management (Customer Service)

2.3.1 Customer Satisfaction Surveys

2.4 Service Portfolio Management

2.4.1 Alignment to DESMF, ITIL and TBM

2.5 Performance Management

2.5.1 Service Level Management

2.6 Project Management

2.6.1 Schedule Management

3.0 TECHNICAL SCOPE AND SPECIFIC TASKS TO DELIVER RESULTS

3.1 Workplace

3.1.1 Workplace: Client Computing

3.1.1.1 Computer

3.1.1.1.1 Workplace Hardware Management

3.1.1.1.2 Workplace Software Management

3.1.1.2 Mobile

3.1.1.3 Virtual Client

3.1.1.4 Digital Experience Management (DXM)

3.1.2 Workplace: Communication & Collaboration

3.1.2.1 Collaboration

3.1.2.2 Communication

iv

3.1.2.3 Print

3.1.2.4 Productivity

3.1.3 Workplace: Connectivity

3.1.3.1 Network Access (Direct)

3.1.3.1.1 Network Access Control (Workplace)

3.1.3.1.2 Wired Ethernet Connection

3.1.3.2 Remote Access

3.2 Infrastructure

3.2.1 Infrastructure: Compute

3.2.1.1 Compute on Demand (Cloud Compute)

3.2.1.2 Physical Compute

3.2.1.3 Virtual Compute & Containers

3.2.2 Infrastructure: Data Center

3.2.2.1 Enterprise Data Center

3.2.2.1.1 Data Center Facility Management

3.2.2.1.2 Equipment Management

3.2.2.1.3 Installation

3.2.2.1.4 Decommissioning and Removal

3.2.2.1.5 Critical Infrastructure Systems Monitoring

3.2.2.1.6 Data Center Operations

3.2.2.1.7 Application Server Connectivity

3.2.2.1.8 Data Center Capacity Management

3.2.2.1.9 Colocation Management

3.2.2.2 Other Data Center Services

3.2.3 Infrastructure: Network

3.2.3.1 Data Network

3.2.3.1.1 Network (LAN)

3.2.3.1.2 Network (WAN)

3.2.3.1.3 Satellite/Non-Terrestrial Radio

3.2.3.1.4 Network Data Circuits (Transport)

3.2.3.1.5 Designated Agency Representative (DAR) Services

3.2.3.1.6 Enterprise Infrastructure Solutions (EIS) Transition

3.2.3.2 Domain Services (Shared Services)

3.2.3.2.1 IP Address Management

3.2.3.2.2 Domain Name Services (DNS)

3.2.3.2.3 Network Time Protocol (NTP)

3.2.3.2.4 Network Access Control (Domain Services)

3.2.3.3 Load Balancing

3.2.3.3.1 Network Load Balancing

3.2.3.3.2 Application Load Balancing

3.2.3.4 Virtual Private Network

3.2.3.4.1 Virtual Routing and Forwarding (VRF)

3.2.3.4.2 Dynamic Multipoint Virtual Private Network (DMVPN)

3.2.3.4.3 Software Defined WAN (SD-WAN)

3.2.3.4.4 Remote Access Services Virtual Private Network (RAS-VPN)

3.2.3.4.5 Site-to-Site VPN

3.2.3.5 Voice Network

3.2.3.5.1 Plain Old Telephone Service (POTS)/Traditional Voice

3.2.3.5.2 Voice Transport Services

v

3.2.3.5.3 Video Teleconferencing (VTC) Services

3.2.3.5.4 VoIP and VoSIP Services

3.2.3.5.5 Private Branch Exchange (PBX)

3.2.3.5.6 Public Address (PA) System

3.2.3.6 Other Networks

3.2.3.6.1 Testing, Staging, and Development

3.2.3.6.2 Integration Support

3.2.4 Infrastructure: Storage

3.2.4.1 File & Object Storage

3.2.4.1.1 Online Storage: On-Premises Storage

3.2.4.2 Networked Storage

3.2.4.2.1 Cloud Storage: Off-Premise Storage

3.2.4.3 Backup & Archive Storage (Online and Offline, On-Premise, and Cloud)

3.2.4.3.1 Media Handling and Offsite Storage

3.3 Platform

3.3.1 Platform: Application

3.3.1.1 Application Hosting (Web/Application/Middleware)

3.3.1.1.1 Middleware Management

3.3.1.1.2 Application Monitoring

3.3.1.2 Message Bus & Integration

3.3.2 Platform: Data

3.3.2.1 Database

3.4 Delivery

3.4.1 Delivery: Development

3.4.1.1 Design & Development

3.4.1.1.1 Systems Architecture (Baseline)

3.4.1.2 System Integration

3.4.1.2.1 Build Services - DevSecOps

3.4.1.2.2 Configuration Management

3.4.1.3 Modernization & Migration

3.4.1.3.1 Technology Refresh and Modernization

3.4.1.3.2 Migration to Cloud

3.4.1.4 Testing

3.4.2 Delivery: Operations

3.4.2.1 Deployment & Administration

3.4.2.1.1 Release Management

3.4.2.1.2 Orchestration & Automation (Container Orchestration)

3.4.2.2 Information Technology Service Management (ITSM)

3.4.2.2.1 Enterprise Service Management Platform

3.4.2.2.2 Incident Management

3.4.2.2.3 Problem Management

3.4.2.2.4 Change Management

3.4.2.2.5 Asset Management

3.4.2.2.6 Tools Management

3.4.2.2.7 Software License Management and Compliance

3.4.2.3 Capacity Management

3.4.2.4 Availability Management

3.4.2.5 Event Management (NOC/Monitoring)

3.4.3 Delivery: Security & Compliance

vi

3.4.3.1 Identity & Access Management

3.4.3.1.1 Directory Services (Client Computing)

3.4.3.1.2 User Account Administration (Client Computing)

3.4.3.1.3 Online Certificate Status Protocol (OCSP) Support

3.4.3.1.4 Network Administration Identity Management

3.4.3.2 Cyber Security & Incident Response

3.4.3.2.1 Cybersecurity Incident Handling

3.4.3.2.2 Endpoint Protection Services

3.4.3.2.3 Boundary Protection Services (BPS)

3.4.3.2.3.1 DISA Whitelisting

3.4.3.2.3.2 Syslog Server Support

3.4.3.2.3.3 Secure FTP Server Support

3.4.3.2.4 Security Information and Event Management (SIEM) Support

3.4.3.3 Threat & Vulnerability Management

3.4.3.3.1 Enterprise Vulnerability Scanning Support

3.4.3.4 Data Privacy & Security

3.4.3.4.1 Data Loss Prevention

3.4.3.4.2 Encryption Services

3.4.3.5 Governance, Risk, & Compliance

3.4.3.5.1 Risk Management Framework (RMF Processes)

3.4.3.5.2 Cybersecurity Controls

3.4.3.5.3 Cybersecurity Control Design

3.4.3.5.4 Cybersecurity Authorization

3.4.3.5.5 Cybersecurity Validation Service

3.4.3.5.6 Cybersecurity Audit

3.4.3.6 Business Continuity & Disaster Recovery

3.4.3.6.1 Business Impact Analysis

3.4.3.6.2 Business Continuity Planning & Management

3.4.3.6.3 IT Disaster Recovery

3.4.3.6.4 Contingency Planning

3.4.3.6.5 Cloud-Based Disaster Recovery

3.4.4 Delivery: Strategy & Planning

3.4.4.1 Enterprise Architecture

3.4.4.2 Innovation & Ideation

3.4.4.3 IT Vendor Management (Service Integration and Management)

3.4.4.3.1 Associate Contractor Agreements (ACAs)

3.4.4.4 Technology Business Management (TBM)

3.4.4.5 Program, Product, & Project Management

3.4.5 Delivery: Support

3.4.5.1 Service Desk

3.4.5.1.1 Priority Service Support (IT Service Desk)

3.4.5.1.2 Site Support (Deskside Support)

3.4.5.1.3 Knowledge Management

3.4.5.1.4 Service Request Management (Request Fulfillment)

3.5 Business

3.5.1 Customer Service

3.5.1.1 Order Management

3.5.1.1.1 Standard Service Requests (Service Catalog / Electronic Storefront)

3.5.1.2 Customer Care (ACD/VRU)

vii

3.5.2 Manufacturing & Delivery

3.5.2.1 Inventory & Warehousing (Request Fulfillment / Logistics)

3.5.2.1.1 Logistics Management

3.5.2.1.2 Hardware Device Return and Disposal

3.5.2.1.3 Supply Chain Risk Management

4.0 STORAGE MEDIA DISPOSAL

4.1 Storage Media Disposal SOPs and Reporting/Dashboard

4.2 Storage Media Disposal Services

5.0 CONTRACT TRANSITION

5.1 Transition In/Discovery

5.2 Transition Out

6.0 DELIVERABLES

6.1 Meetings to be Held

6.2 Management Plans

6.3 Reports, Data, and Hardware Deliverables

6.4 Transition/Discovery Deliverables

7.0 ADDITIONAL DELIVERY REQUIREMENTS

7.1 Place of Performance

7.2 Telework

7.3 Period of Performance

7.4 Hours of Operation

7.5 Government Furnished Property

7.6 Contractor Furnished Property

7.7 Contractor Travel

7.8 Data Rights and Information Rights

8.0 PERFORMANCE METRICS & MEASURES

viii

9.0 CONTRACT SECURITY REQUIREMENTS

List of Figures

FIGURE 1-1. C5I PRODUCT LINES

FIGURE 1-2. C5I SHARED SERVICES

FIGURE 1-3. C5I/CGCYBER RELATIONSHIP

List of Tables

TABLE 1-1. PERFORMANCE OBJECTIVES

TABLE 1-2. KEY PERSONNEL

TABLE 3-1. USCG EA ELEMENT SUMMARY

TABLE 6-1. MEETINGS TO BE HELD

TABLE 6-2. PLANS FOR PROPER MANAGEMENT AND OPERATIONS

TABLE 6-3. MANAGEMENT REPORTS, DATA, AND HARDWARE DELIVERABLES

TABLE 6-4. OPERATIONAL REPORTS, AND DATA DELIVERABLES

TABLE 6-5. OPERATIONAL PROJECT DELIVERABLES

TABLE 6-6. TRANSITION/DISCOVERY ARTIFACTS

TABLE A-1. INCIDENT PRIORITIZATION MATRIX

TABLE A-2. URGENCY DEFINITIONS

TABLE A-3. IMPACT DEFINITIONS

TABLE A-4. SERVICE LEVEL AGREEMENTS (SLAS)

TABLE B-1. GOVERNMENT FURNISHED PROPERTY

ix

Acronym Table

Acronym Term AAR After Action Review ACA Associate Contractor Agreement ACD Automated Call Distributor ACL Access Control List AD Active Directory AES Advanced Encryption Standard AI Artificial Intelligence ALC Aviation Logistics Center ALD Asset Logistics Division AMVER Automated Mutual Assistance Vessel Rescue AOR Assumption of Responsibility API Application Programming Interface AQL Acceptable Quality Level ARM Application Reference Model ATO Authority To Operate AWS Amazon Web Services AVD Azure Virtual Desktop BIA Business Impact Analysis BIOS Basic Input/Output System BOD Business Operations Division BOM Bill of Materials BRM Business Reference Model BRM Business Relationship Management / Business Reference Model C2PL Command, Control, Navigation & Combat Systems C5I Command, Control, Communications, Computers, Cyber and Intelligence C5ISC Command, Control, Communications, Computers, Cyber and Intelligence Service Center CAB Change Advisory Board CAC Common Access Card CAD Cybersecurity Assurance Division CAL Category Assurance List CAP Cloud Access Point CCSP Cloud Certified Security Professional CDM Continuous Diagnostics and Mitigation CDRL Contract Data Requirements List CFP Contractor Furnished Property CG Coast Guard CG-6 Coast Guard Commandant CG-671 Coast Guard Enterprise Architect, Commandant CG-68 C5ISC Program Management, Commandant CG-914 Office of C5I Contracting & Procurement CGIP Coast Guard Intelligence Program CGOne USCG primary internal network CI Configuration Item CI/CD Continuous Integration/Continuous Deployment CIO Chief Information Officer CISM Certified Information Security Manager CISSP Certified Information Systems Security Professional CLIN Contract Line Item Number CM Configuration Management CMDB Configuration Management Database CMS Configuration Management System COMPL Communications Systems CODEC Coder/Decoder COOP Continuity of Operations x

Acronym Term COR Contracting Officer's Representative CORA Cyber Operational Readiness Assessments COTS Commercial off the shelf CP Contingency Plan CPU Central Processing Unit CSA Configuration Status Accounting CSD Centralized Service Desk CSfC Commercial Solutions For Classified CSN Communications System Network CSP Cloud Service Provider CTBME Certified TBM Executive CTO Certificate To Operate CTO Chief Technology Officer CWMS Cellular Wireless Management Services DAR Designated Agency Representative DDIL Denied Degraded Intermittent Limited DXM Digital Experience Management DESMF Defense Enterprise Service Management Framework DHCP Dynamic Host Configuration Protocol DHS Department of Homeland Security DISA Defense Information Systems Agency DKIM Domain Keys Identified Mail DLA Defense Logistics Agency DMARC Domain-Based Message Authentication Reporting and Conformance DMVPN Dynamic Multipoint Virtual Private Network DMZ Demilitarized Zon DNS Domain Name System DoD Department of Defense DODAF Department of Defense Architecture Framework DoDIN Department of Defense Information Network DPM Deputy Program Manager DR Disaster Recovery DR RTO/RPO Disaster Recovery Recovery Time Objective/Recovery Point Objective DRM Data Reference Model DRMO Defense Reutilization Marketing Office DSL Definitive Software Library DSP Defense Standardization Program EA Enterprise Architecture EAB Enterprise Architecture Board EDC Enterprise Data Catalog EDC Enterprise Data Center EDMS Enterprise Directory Management System EIS Enterprise Infrastructure Solutions ELT Executive Leadership Team EOA Exchange Online Administration EOL End of Life EOP Exchange Online Protection EOS End of Support ePM Enterprise PM ERB Engineering Review Board ESB Enterprise Service Bus ESD Engineering Services Division ESD Electronic Support Detachment ESI Enterprise System Inventory ESMP Enterprise Service Management Platform ESP Enterprise Standards Profile xi

Acronym Term ET Electronics Technician EUHW End User Hardware FAR Federal Acquisition Regulation FBB Fleet Broadband FCAC Federal Cyber Awareness Challenge FEAF Federal Enterprise Architecture Framework FedRAMP Federal Risk and Authorization Management Program FIPS Federal Information Processing Standard FISMA Federal Information Security Management Act FTE Full Time Equivalent GFI Government Furnished Information GFP Government Furnished Property GPO Group Policy Object GRC Governance Risk and Compliance GTN Government Transportation Network HBSS Host Based Security System HQ Headquarters HSAR Homeland Security Acquisition Regulation HW Hardware IA Information Assurance IaaS Infrastructure as a Service IAB Innovation Advisory Board IaC Infrastructure as Code IAM Identity and Access Management IAP Internet Access Point IAW In accordance with ICAM Identity Credential and Access Management IDIQ Indefinite Delivery/Indefinite Quantity IL Impact Level IMAC Install/Moves/Adds/Changes IOS Internetworking Operating System IP Internet Protocol IPAM IP Address Management IRM Infrastructure Reference Model IS Information System ISD Infrastructure Services Division ISDN Integrated Services Digital Network ISO Information System Owner ISO International Organization for Standardization ISP Inside plant ISPL Intelligence Systems ISSO Information Systems Security Officer IT Information Technology ITBM Information Technology Business Management ITIL Information Technology Infrastructure Library ITOM Information Technology Operations Management ITSCM Information Technology Service Continuity Management ITSM Information Technology Service Management ITSO Information Technology Support Organization JIE Joint Information Environment JRSS Joint Regional Security Stack JWICS Joint Worldwide Intelligence Communication System KEDB Known Error Database KM Knowledge Management KO Contracting Officer KP Key Personnel xii

Acronym Term KPI Key Performance Indicator KT Knowledge Transfer KVM keyboard, video monitor, and mouse LAN Local Area Network LCC Large Cutter Connectivity LMS Learning Management System LPR Line Printer Request M365 Microsoft 365 MAC Moves Adds Changes MAM Mobile Application Management MBSE Model Based System Engineering MCU Multi-Point Control Unit MDM Mobile Device Management MECM Microsoft Endpoint Configuration Manager MEF Mission Essential Function MFD Multifunction Device MOSA Modular Open Systems Architecture MPC Maintenance Procedure Card MPLS Multiprotocol Label Switching MSBM Mission Support Business Model MSR Monthly Status Report MSSPL Mission Support Systems Product Line MVD Manta Virtual Desktop NAC Network Access Control NARA National Archives and Records Administration NAS Network Attached Storage NAT Network Address Translation NCR National Capitol Region NIC Network Interface Card NIST National Institute of Standards and Technology NOC Network Operations Center NSEP National Security Emergency Preparedness NSS National Security Strategy NTP Network Time Protocol NTR Named Technical Representative NVMC National Vessel Movement Center O&M Operate and maintain OCM Organizational Change Management OCSP Online Certificate Status Protocol OEM Original Equipment Manufacturer OISPL Operations Information Systems Product Line OLA Operational Level Agreement OMB Office of Management and Budget OPSEC Operation Security ORR Operational Readiness Review OS Operating System OSI Open Systems Interconnect OSP Outside Plant OU Organization Unit PA Public Address PaaS Platform as a Service PaC Policy as Code PBX Private Branch Exchange PII Personally Identifiable Information PIV Personal Identity Verification PKI Public Key Infrastructure xiii

Acronym Term PL Product Line PM Program Manager PM&Ms Performance Metrics and Measures PMBOK Project Management Body of Knowledge PMI Project Management Institute PMO Program Management Office PMP Program Management Professional PMP Program Management Plan PMR Program Management Review PO Performance Objective POA&M Plan of Action and Milestones POC Point of Contact POTS Plain Old Telephone Service PPB&E Planning, Programming, Budgeting, and Execution PPC Pay and Personnel Center PRM Performance Reference Model PSTN Public Switched Telephone Network PWS Performance Work Statement QA Quality Assurance QA/QC Quality Assurance/Quality Control QAP Quality Assurance Plan QASP Quality Assurance Surveillance Plan QC Quality Control QoS Quality of Service RACI Responsible, Accountable, Consulted, Informed RAM Random Access Memory RAS Remote Access Service RCA Root Cause Analysis REST Representational State Transfer RFC Request for Change RMA Return of Material Approval RMF Risk Management Framework RMS Rights Management Service ROI Return on Investment RPA Robotic Process Automation RPO Recovery Point Objective RTO Recovery Time Objective SA2 SATCOM Availability Analyst System SaaS Software as a Service SAN Storage Array Network SATCOM Satellite Communications SBU Sensitive But Unclassified SCC Small Cutter Connectivity SCI Sensitive Compartmented Information SCRM Supply Chain Risk Management SDP Software Designed Perimeter SD-WAN Software Defined Wide Area Network SELC System Engineering Life Cycle SFLC Surface Forces Logistics Center SFP Small Form-factor pluggables SHB Secure Host Baseline SIAM Service Integration and Management SIEM Security Information and Event Management SIPRNet Secret Internet Protocol Router Network SLA Service Level Agreement SLM Service Level Management xiv

Acronym Term SME Subject Matter Expert SOC Security Operations Center SOO Statement of Objectives SOP Standard Operating Procedure SPF Sender Policy Framework SPI Sensitive Personal Information SPOC Single Point of Contact SRG Security Requirements Guide SRM Security Reference Model SSD Solid State Drive SSH Secure Shell SSL Secure Sockets Layer STIG Security Technical Implementation Guide TAP Test Access Point TAV Total Asset Visibility TBM Technology Business Management TCO Total Cost of Ownership TEM Technical Exchange Meeting TRB Technical Review Board TRM Technical Reference Model TTP Tactics Techniques and Procedures TWH Technical Warrant Holder UAA User Account Administration UCPL Unified Capabilities Product Line UDMZ Unrestricted Demilitarized Zone UEM Unified Endpoint Management UPNMOD User Principal Modification Tool UPS Uninterruptible Power Supply USCG United States Coast Guard UTS User Transfer Service VDD Version Description Document VDE Virtual Desktop Environment VDSS Virtual Data Center Security Stack VIA Variable Infrastructure Award VIP Very Important Person VLAN Virtual Local Area Network VM Virtual Machine VoIP Voice over Internet Protocol VoSIP Voice over Secure Internet Protocol VPN Virtual Private Network VRF Virtual Routing and Forwarding VRU Voice Response Unit VTC Video Teleconferencing VTS Vessel Traffic Service WAN Wide Area Network WBS Work Breakdown Structure WFD Workforce & Facilities Division WITS Washington Interagency Telecommunications System WSM Workplace Software Management

1.0 Introduction

1.1 Background

The U.S. Coast Guard (USCG) Command, Control, Communications, Computers, Cyber and Intelligence Service Center’s (C5ISC) mission is to provide information technology infrastructure solutions to enable Coast Guard men and women to access information needed to effectively and efficiently perform their jobs to accomplish the Coast Guard’s 11 statutory missions. USCG’s IT services are critical to meeting the rapidly growing demand for secure information availability anytime, anywhere, and anyplace in a full, degraded, or disconnected network environment. The C5ISC reports to CG-6, Assistant Commandant for C4IT, and provides full life-cycle support for IT systems and infrastructure across the USCG. The C5I Service Center exists to deliver technology solutions for mission success through the accomplishments of the C5ISC Product Lines (PL).

Product Line management provides a single support team responsible and accountable for the performance of a specific capability's execution and sustainment in with the USCG Mission Support Business Model (MSBM). The C5ISC is comprised of six (6) PLs supported by six (6) Shared Services.

FIGURE 1-1. C5I PRODUCT LINES

FIGURE 2-2. C5I SHARED SERVICES

The C5ISC maintains a close relationship with Coast Guard’s Cyber Command. In August 2023, the Coast Guard established CGCYBER’s Centralized Service Desk (CSD) as an individual USCG command under Coast Guard’s Department of Defense Information Network (DoDIN) Division (CGCC-36). The CSD provides centralized user support for the Coast Guard’s information technology and electronics environments. Its mission is to provide users with improved service and support, acting as the front door to the C5ISC services across the Coast Guard. The diagram below identifies the various interrelationships between CGCYBER and the C5ISC.

FIGURE 3-3. C5I/CGCYBER RELATIONSHIP

1.2 Scope

The USCG requires the Variable Infrastructure Award (VIA) Basic Ordering Agreement (BOA) Contractor to provide Information Technology (IT) infrastructure operations and maintenance (O&M) sustainment, herein named as VIA Sustainment, support for the Coast Guard’s classified (Secret) and unclassified environments including:

End User hardware services, including the ongoing refresh of end user devices (excludes mobile device hardware);

Infrastructure O&M including for physical and virtual server, storage, network, and security and refresh of hardware;

Infrastructure IT Asset tracking and End of Life (EOL)/ End of Support (EOS) status for planned replacement through refresh and/or modernization per USCG direction to meet infrastructure recapitalization objectives;

Maintaining the standard images for all types of physical and virtual devices;

Operating and maintaining the various USCG environments including Development, Test, Stage, Production and Disaster Recovery on the NIPRNet and SIPRNet networks;

Monitoring server and network performance and responding to events;

Facilities and O&M management of the USCG’s Data Centers;

Supporting the USCG in engineering initiatives;

Ensuring compliance with Federal, Department of Defense (DoD), Department of

Homeland Security (DHS), and USCG regulations and rules;

Administering the UCCG access controls, user accounts, email system, Privileged User

Management Program (PUMP), etc.;

Preventing and responding to security threats;

Providing tiered Service Desk support for ticketing intake through to closure in alignment with Information Technology Infrastructure Library (ITIL) practices;

Administering the USCG’s Enterprise Service Management Platform (ESMP) including the

IT Service Management (ITSM), IT Operations Management (ITOM), Configuration Management Database (CMDB), and asset collection tools;

Working with the USCG Field Touch Labor/Electronic Systems Support Detachments (ESDs) to provide the necessary support all field locations; and

Providing Program Management support for all aspects of the contract including for risk management, quality management, performance management and reporting, etc.

1.3 Performance Objectives

C5ISC will continue to leverage advances in Information Technology to reliably deliver the information needed for the successful execution of USCG missions and mission support activities.

The performance objectives for VIA BOA Call 1 identified in Table 1.1 are designed to be obtainable and measurable:

TABLE 1-1. PERFORMANCE OBJECTIVES

Objective Critical Success Factors / Strategic Challenges

1. Stabilize and secure USCG’s Information Technology (IT) infrastructure to fulfill mission outcomes.

a. Protect Coast Guard’s data at rest and deliver information securely.

i. Deploy hardware and software updates (i.e., patches) consistently and within mandated timelines across the IT infrastructure, including integrating Defense Information Systems Agency’s (DISA) latest Secure Host Baseline (SHB) into the environment for workstations and servers.

ii. Comply with all Federal and DoD security and privacy mandates, including DoD cybersecurity policy, DoD cloud standards, FISMA, Privacy Act, FedRAMP, and NIST.

iii. Document and ensure compliance with USCYBERCOM/CGCYBER Task Orders and DoD Security Technical Implementation Guide (STIG) and enable the ability to pass JFHQ-DoDIN Cyber Operational Readiness Assessments (CORAs) related to the IT infrastructure.

iv. Improve upon cybersecurity monitoring and incident response capability by using advanced toolsets and Continuous Diagnostics & Mitigation (CDM) capabilities.

v. Enforce multi-factor authentication and eliminate user ID and password.

b. Ensure the existing IT infrastructure is maintained and operates effectively allowing continuous access to business applications, information, and services.

i. Realize cost savings and minimize total cost of ownership through operational consolidation, asset management, and commoditization of services.

ii. Meet end user expectations through high levels of responsiveness, relevant communications, and improved positive customer service experiences.

iii. Provide relevant 24x7x365 infrastructure monitoring, reporting, and response capabilities.

iv. Implement problem management and reduce the number of incidents.

v. Ensure all IT process and procedures are standardized, documented and easily accessible to USCG personnel.

vi. Minimize the need for on-site touch labor at Base C5ISC Departments and their Electronic Systems Support Detachments (ESD).

vii. Maximize automation and cognitive assistance to minimize manual activities and lower cost.

viii. Mitigate the introduction of unintended defects into the NIPR and SIPR production environments by ensuring the test environment enables the C5I enterprise to effectively test.

ix. Ensure redundancy and disaster recovery capabilities are tested and enabled.

x. Provide backup, recovery, and records management in accordance with National Archives and Records Administration (NARA) Records Schedules, and eDiscovery capabilities.

xi. Ensure that the USCG is in compliance with OMB and DoD mandates for IPv6, per the OMB memo - Completing the transition to Internet Protocol Version 6 (IPv6).

c. Improve governance of IT asset, configuration, and change management to ensure a stable and efficient environment.

i. Establish and maintain total IT asset visibility (TAV) of hardware and software leveraging both business process and advanced technology capabilities for inventory management.

ii. Achieve and continuously execute configuration management through the implementation of a Configuration Management Database

(CMDB).

iii. Utilize the Government-provided Enterprise Service Management Platform (ESMP), including an Information Technology Service Management (ITSM) tool suite to effectively manage the USCG IT infrastructure.

iv. Refresh equipment at a rate to sustain performance, security and privacy requirements and no more than N-2 prior models where N is the most recent generally available hardware and software version.

2. Improve mission outcomes.

a. Support the USCG transition to a mature IT Managed Services environment, including migration to an appropriate mix of government and commercial cloud computing solutions.

i. Support the design and implementation of a flexible, secure, and scalable

IT infrastructure that will evolve with growing consumption of IT resources.

ii. Facilitate the development of USCG’s cloud strategy and transition to a hybrid cloud computing environment, including migration of complete service areas to cloud- based solutions.

iii. Identify & evaluate emerging and disruptive technologies to improve the management of information as a strategic resource.

iv. Transition engineering activities seamlessly into the Service Operations environment.

v. Implement a development, test, training, production, and disaster recovery cloud environment.

vi. Implement and maintain USCG electronic messaging; files storage and sharing; print sharing; and collaboration platform.

b. Support the demands of a fully mobilized workforce (i.e., deliver reliable access to business services and data across heterogeneous networks from any device and location worldwide).

i. Support USCG’s ability to provide information availability anywhere and anytime in a full, degraded or disconnected environment.

ii. Enable & integrate mobility and remote access solutions.

iii. Ensure architecture allows for future transition to Voice over Internet

Protocol (VoIP) solutions for telephony and video-teleconferencing (VTC) services across all classification levels.

3. Improve the integration of all

USCG C5I

systems with the infrastructure.

a. Manage the Service Desk to accommodate external services and stakeholders.

b. Resolve IT infrastructure configuration issues to optimize integration of existing C5I systems managed by external programs (ex. Rescue 21 or Vessel Traffic Service (VTS).

c. Develop and implement an automated test environment to include testing new Windows SHB versions and the associated USCG’s applications.

d. Enable external programs’ access to the ESMP, IT infrastructure test, development and production environments.

4. Create a collaborative public/private partnership that will enable industry and USCG to share risk and achieve shared goals.

a. Ensure relevancy of staff.

i. Deliver an experienced and highly technical management team that understands commercial solutions as well as Government frameworks and DoDIN operations.

ii. Attract and retain top technical talent.

iii. Keep talent motivated and rewarded for success. Ensure resource skill sets are aligned with emerging and forward- looking technologies and processes and are constantly refreshed.

b. Enable USCG to better align support with organizational intent in accordance with the new C5I framework.

i. Utilize Department of Defense Enterprise Services Management Framework (DESMF) in alignment with the USCG’s current organizational structure and achieve consistent adherence to process across the organization.

ii. Provide a contract support structure that helps to prevent silos across the C5I enterprise organization.

iii. Establish effective interfaces with government-staffed entities of the C5I enterprise through Operational Level Agreements (OLAs), problem management Maintenance Procedure Cards (MPCs), and Standard Operating Procedures (SOPs).

c. Assist USCG in enabling investment decisions.

i. Develop and maintain a Service Catalog.

ii. Report costs using the latest Technology Business Management (TBM) taxonomy (cost pools, IT towers, and services).

iii. Predict and manage the potential impact to the baseline pricing, ensuring small fluctuations do not trigger equitable adjustment requests and anticipated adjustments are communicated early, enabling timely consideration of alternative courses of action.

d. Adhere to relevant and measurable performance measures and metrics for achieving USCG’s performance objectives with appropriate incentives and disincentives to motivate high performance.

i. Recognize, share, and manage risks.

ii. Ensure metrics measure the “right things.”

iii. Provide meaningful financial incentives and disincentives tied to Service Level Agreements (SLAs) to motivate outstanding performance.

e. Ensure a seamless transition to the next contracting mechanism and/or vendor prior to the end of the period of performance.

iv. Ensure operational documentation is updated or created as needed and organized and stored accessible to the USCG.

v. Develop and maintain operational transition out plans for all service areas.

vi. Avoid vendor “lock-in.”

vii. Ensure no USCG data is stored, accessed, or edit controlled in proprietary data formats or systems.

viii. All USCG data and access control mechanisms must remain property of the United States Government.

1.4 Assumptions & Constraints

Assumptions and constraints relevant to the Contractor’s execution of PWS scope are as follows:

1. Throughout this PWS all “shall” statements apply to scope of performance regardless of the level in the section the statements are located.

2. All scoped services apply throughout the PWS within the SIPRNet and NIPRNet environments and are for On-prem and Cloud services as applicable, unless stated otherwise within a specific section.

3. The Contractor shall not begin the recurring charges of a CLIN/Service until Transition in of the CLIN/Service has completed a successful Operational Readiness Review (ORR).

4. The Contractor will interface with USCG field touch labor. The Contractor must establish processes and practices that minimizes the use of touch labor in the field in accordance with stated “shall” statements throughout the PWS.

5. The suite of tools used in performance of this Call will be provided by the USCG for contractor use; however, if the contractor identifies additional or different tools that will enhance performance, then a business case will be needed for USCG review. If USCG approves, a determination will be made for how to move forward, whether as a separate VIA Call or other USCG managed project.

6. This Call is for the sustainment of operational USCG requirements. Any requirements for new tools and services beyond what’s scoped within this Call may be issued as a separate Call under the VIA BOA or be provided via other sources. Impacts of new tools and services to this Call will be evaluated on an as needed basis.

7. Shipping costs for delivery from the Contractor, or it’s supplier, to any USCG location shall be embedded in the unit price of the item(s).

8. The USCG Open Systems Interconnect (OSI) Layer 1 / Building Cabling is out of scope of this Call. This is assumed to include copper and fiber patch cables and transceivers.

9. The amount of time it generally takes to obtain a USCG Authority to Operate (ATO) approval is 12 months.

2.0 Program Management Office (PMO)

This section defines the scope of services the Contractor shall perform in the management of the of the PWS’s technical scope. The objective of the VIA Sustainment Program Management Office (PMO) is to ensure that all scope of work meets the requirements of this PWS, that deliverables are submitted on time with high quality, and that the USCG user community is able to perform their own duties without impacts and delays due to the USCG operational IT environment. The VIA Sustainment PMO shall serve as the PMO for any additional calls issued to this vendor.

2.1 Program Management

The Contractor shall plan, execute, manage, and control the work described in this PWS, employing industry best practices for project and program management according to the standards and methodologies published by the Project Management Institute (PMI). The Contractor shall provide relevant staff to perform the in-scope services and provide a comprehensive staffing approach that enables the Contractor to hire and retain a technically proficient, diverse workforce.

2.1.1 Key Personnel

The Contractor shall propose key personnel who are available within 30 days of award to rapidly achieve desired outcomes and institutionalize effective implementation of DESMF processes, by combining their USCG knowledge, DoD Managed Service delivery experience, and technical/commercial expertise. The Contractor shall drive efficiencies across people and processes as part of stabilizing operations using a proper tier structure and roles to realize quick efficiencies.

All designated key personnel, as identified in Table1.2 – Key Personnel must be dedicated Full Time Equivalents (FTEs) supporting only Calls under the VIA BOAs and be located within the local commuting area of the appropriate Coast Guard facility. Key personnel are considered essential to the work being performed and may, with the consent of the contracting parties, be changed from time to time during the contract by adding or deleting personnel, as appropriate. All key personnel changes shall be in accordance with Homeland Security Acquisition Regulation (HSAR) Clause 3052.215-70, Key Personnel or Facilities (DEC 2003).

TABLE 1-2. KEY PERSONNEL

Key Position High-Level Function Program Manager (PM) Serves as the USCG’s primary point of contact (POC) and provide overall leadership and guidance for all contractor personnel assigned to the program. The PM is ultimately responsible for the quality and efficiency of the program, to include both technical issues and business processes. The PM is directly responsible for the execution and performance of the contract.

Deputy PM (DPM) As Deputy PM serves as backup to the Program Manager.

Chief Technology Officer

(CTO)

Oversees IT engineering and technology implementations, providing direction and guidance to the team.

Business Relationship Manager

Serves as liaison to the Business Units, making sure that contractor-proposed solutions meets the needs of the mission owners; makes certain solutions are aligned to the USCG mission, desired outcomes, and IT strategy.

IT Operations Lead Oversees the enterprise operations model that executes management of events, incidents, problems, and changes. Manages the Command Center Operations.

Security Lead Manages all aspects of cyber and applicable physical security.

Responsible for ensuring all Authority to Operate (ATO) statuses for systems within the VIA Contractor’s purview remain current.

Quality Assurance Lead Oversees program reporting and deliverables to make sure they meet requirements and are delivered on time with high quality. Develops and leads the execution of the Quality Assurance Plan (QAP).

Service Management Lead Responsible for ensuring that services are delivered in accordance with DESMF/ITIL to achieve Service Level Agreements (SLAs);

leads continual performance improvement and manages the lifecycle of services. Establishes governance and process frameworks necessary to integrate services and enable seamless operations and service delivery.

Asset Manager Responsible for Total Asset Visibility, oversees Logistics, and manages Maintenance and Warranty. Responsible for the accuracy and completeness of asset data and processes to maintain the data.

Regarding the replacement of Key Personnel, the Contractor shall:

a. Notify the Contracting Officer (KO) and Contracting Officer Representative (COR), in writing, prior to making any changes in Key Personnel.

b. Notify the KO/COR, in writing, of any proposed substitution at least thirty (30) calendar days in advance of the proposed substitution – including: (1) an explanation of the circumstances necessitating the substitution; (2) a complete resume of the proposed substitute; and (3) any other information requested by KO to enable him/her to determine whether the Contractor is maintaining the same high quality of personnel that provided the partial basis for award.

c. Propose only substitutes who have qualifications equal to or higher than the qualifications of the person to be replaced and required for that Key Position.

d. Submit sufficient information to support the proposed action and to enable the KO/COR to evaluate the potential impact of the change on this contract.

e. In response to notice from the KO of a disapproval, resubmit another substitution within fifteen (15) calendar days.

f. Not remove or replace personnel until the KO approves the change.

Key personnel must possess certifications relevant to the position they hold such as Program Management Professional (PMP), Information Technology Infrastructure Library (ITIL), Certified TBM Executive (CTBME®), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Cloud Certified Security Professional (CCSP), position specific DoD 8140.03 (Cyberspace Workforce Qualification and Management Program) compliant certification, and possess the necessary security clearance level as identified in the DD-254, Contract Security Classification form.

For any proposed Key Personnel without the required certification(s) – at the time of award or substitution – the Contractor shall provide supporting documentation to indicate that the proposed candidate will have obtained any such certification(s) and by what date.

In support of this activity, the USCG is responsible to:

a. Evaluate key personnel submissions and promptly notify the Contractor of the USCG’s approval or disapproval in writing within 5 business days.

2.1.2 Program Management Office (PMO)

The Contractor shall provide a management structure that optimizes enterprise delivery as needed to manage and deliver all performance requirements across all tasks/sub-tasks described within this

PWS.

The Contractor shall:

a. Create and maintain a Program Management Plan (PMP) that clearly documents the management approach for the program’s operational, project, and administrative activities and is maintained current and available to the USCG COR and Technical Monitors (TMs).

b. Create and maintain a Strategic Notification Plan that defines who should be given specific information, when that information should be delivered and what communication channels will be used to deliver the information.

c. Maintain an organization chart stored within the PMP and review for updates monthly to maintain currency.

d. Designate a Named Technical Representative (NTR) for each of the IT Service Management processes for each of the Services described in PWS Technical Scope. The NTR shall be empowered to represent the Contractor in matters pertaining to their role.

e. Maintain a Contact List for Key Personnel, managers, and NTRs to include the name, role, and contact information (phone number, location, email address) and backup name and contact information. This list shall be available to the USCG staff and be published upon contract start. This list shall be maintained with all updates and published monthly to the USCG Portal.

f. Maintain and submit a Quarterly Staffing Report which contains a comprehensive listing of all staff members associated to this Call from contract inception. The staffing report shall identify the individual name, company employed by, area of the Call supported, start date on the Call, end date on the Call (if applicable), FTE equivalency, and level of security clearance.

g. Maintain status of USCG required employee training in compliance with Section I.11.F, Information Technology Security and Privacy Training of the VIA BOA and report on at least annually.

h. Report within one hour the termination of an existing employee from the VIA Sustainment Call and take appropriate action to terminate accounts and recover any Government Furnished Property (GFP) (e.g., property, data, etc.).

i. Enable the USCG to comply with the restrictions from the 2019 DHS Appropriations Act regarding C5ISC Kearneysville location staffing, wherein Sec. 227 states, “None of the funds in this Act shall be used to reduce the Coast Guard’s Operations Systems Center mission or its government-employed or contract staff levels.”

j. Ensure that staff performing on this Call meet the applicable certification requirements as required by DoD 8140.03.

k. Assign only VIA employees (including internal and external consultants and/or support staff) who are citizens of the United States; meet the security background criteria as defined in Section 3: Cyberspace Workforce Structure and Qualification Program of DoD 8140.03;

and have a favorably adjudicated background investigation as defined by the USCG, per the DD-254, prior to being granted access to a USCG IT System.

l. Apply for, obtain, and maintain a valid Common Access Card (CAC) for each employee, if applicable to their role, as a condition of continued employment under the contract.

m. Propose and assign staff only in accordance with all requirements of Section I.11 Security.

n. Provide a Monthly Funds & Expenditure Report (F&E) reflecting funding by CLIN, planned invoicing by month, actuals by month, and remaining balance – where the structure of the report shall be in contractor format but must include details that aligns invoicing costs to Technology Business Management (TBM) taxonomy IT towers, sub-towers, and cost pools. Upon TBM implementation include costs by IT Services/Solutions.

o. Provide an Equipment Value Report, at least annually, with the value of all non-peripheral IT property procured during the life of the contract including for both Government and Contractor procured.

p. Maintain the most up-to-date documents, regulations, policies, guidance, and instructions used for reference and compliance in the performance of this Call and any other Calls issued under the VIA BOAs. The BOA’s identified Reference Documents List serves as the baseline of the document to be maintained.

q. Ensure all contractor personnel have access to and abide by stated reference and compliance documents.

2.1.3 Security Awareness and Training

Security awareness and training ensures that all employees have a proper awareness of Government training requirements and ensures compliance management.

The Contractor shall:

a. Track and verify that all individuals receive initial and annual Information Technology Security Awareness Training.

b. Verify that all account holders complete Federal Cyber Awareness Challenge (FCAC) training and accept Information System (IS) User Acknowledgement Form CG- 5500A.

c. Track and verify that all applicable personnel receive initial and annual Operations security (OPSEC) awareness training.

d. Track and verify that all applicable personnel receive initial and annual DHS-provided Protecting Personal Information training before accessing personally identifiable information (PII) and or Sensitive Personal Information (SPI).

e. Ensure that individuals requiring elevated system access rights have a favorable background investigation appropriate to the level needed.

f. Ensure that individuals requiring elevated system access rights complete elevated rights training.

In support of this activity, the USCG is responsible to:

a. Provide access and administer elevated rights training in the USCG Learning

Management System (LMS).

2.1.4 Quality Management

Quality Management oversees all activities and tasks that must be accomplished to maintain the desired level of service excellence. This includes establishing a quality program and quality policy, and creating and implementing quality planning, quality assurance, quality control and quality improvement.

The Contractor shall:

a. Develop practices and solutions that fulfill the USCG’s needs and meet or exceed expectations across several dimensions: comprehensive and timely deliverables; adherence to established standards, policies, and procedures; frequent and candid communications.

b. Develop and maintain a Quality Assurance Plan (QAP) that describes the quality assurance/quality control (QA/QC) activities for the Sustainment program and contains measures the team will take to assure and control quality, completeness, and timeliness of delivery across all deliverables and services. The QAP shall describe repeatable, scalable processes to track and analyze progress toward the USCG’s performance objectives and desired outcomes.

c. Document within the QAP how quality will be embedded and standardized across all components of this Call.

d. Develop the QAP with sufficient detail to allow the USCG program oversight team the ability to validate and perform inspections to verify alignment with performance objectives and SLAs.

e. Should the Contractor determine that government action is adversely affecting its ability to meet the agreed upon SLAs, formal written notice must be submitted to the KO and COR within three (3) business days of such a determination.

f. Provide Quality Management and Continual Service Improvement through review and analysis of reports and ticket information and continued communication with the USCG.

g. Review monthly performance reports and trending to identify business processes that could be improved.

h. Certify all deliverables in adherence with the program’s Quality Control Program and maintain an audit log for any delivered items. Note that deliverables made through the Systems Engineering Life Cycle (SELC) process will follow established SELC processes.

a. Review, provide feedback, and approve the QAP.

b. Review and approve Contractor recommendations for Continual Service Improvement projects.

2.1.5 Risk Management

Risk Management is the process for ongoing and systematic identification, analysis, and response for any risk that could potentially impact the Sustainment program’s timeline, performance, or budget as well as the USCG’s end user community and mission.

The Contractor shall:

a. Develop and maintain a Risk Management Plan that documents the approach to identifying, evaluating, and ranking risks, issues, and opportunities and developing, selecting, and managing options for mitigating, remediating, or pursuing each.

b. Provide risk tracking tools and maintain a Government-accessible Risk Register. The Risk Register shall contain a description of the risk, the assigned owner, risk evaluation, risk impact to the USCG, risk response strategies/Courses of Action (COA), response tracking and status reporting, and closure date.

c. The Contractor shall provide the USCG with a solution that engages stakeholders, provides clear guidance, informs decision- making, facilitates continual improvement, creates a support culture, and achieves measurable value.

d. Review the status of high-priority/high-impact risks routinely with the COR(s) and system stakeholders.

a. Collaborate with the Contractor to review and approve the course of action(s) for responding to risks.

2.1.6 Management Meetings & Reporting

Regular and routine meetings provide the USCG with insight into the management and performance of the products and services being provided to the Coast Guard on behalf of the C5ISC and CGCYBER. PWS Section 6.1, Meetings to be Held, summarizes the meetings formally defined as deliverables for this program.

For meetings…