2019.02.11GFM_Requirements_Statement.pdf

REQUIREMENTS STATEMENT

FOR

SURFACE DEPLOYMENT AND DISTRIBUTION COMMAND (SDDC)

GLOBAL FREIGHT MANAGEMENT (GFM)

Version 1.0 11 February 2019

Vision Statement:

The successful execution of this contract will provide System Development, Maintenance, and Sustainment for the Global Freight Management (GFM) System.

1.0 Introduction

The Military Surface Deployment and Distribution Command (SDDC) must expertly maintain software and hardware related to its transportation systems to effectively manage the 24 hour worldwide operation of moving freight for SDDC customers. SDDC requires the contractor to provide comprehensive, high quality software for GFM related transportation systems and report results effectively in order for SDDC to make critical implementation decisions.

1.1 Background

SDDC is the surface transportation component of the United States Transportation Command (USTRANSCOM). SDDCs primary functions include worldwide port operations, global traffic management, deployability engineering, and development of integrated transportation systems.

SDDCs Deputy Chief of Staff for Information Management - Chief Information Manager (IM/CIO) supports SDDCs mission by designing, developing, implementing, and operating standard Department of Defense (DOD) transportation systems for which SDDC has been assigned responsibility. The Surface Cargo Branch supports the SDDC mission by managing GFM. GFM is the capstone automated execution system of the Defense Transportation System (DTS) for the movement of domestic freight. It is also used to a certain degree as an outside the continental United States (OCONUS) shipping tool. Users access the GFM system through (Currently) Electronic Transportation Acquisition (ETA) System via an Internet connection 24 hours a day, 7 days a week.

1.2 Scope

The purpose of this effort is to provide the necessary services in support of GFM in system development, maintenance, and sustainment areas.

GFM is a complex, n-tiered system comprised of many components. The GFM system is comprised of 15 applications sustained by the contractor. Most of these applications are developed using Java, which are hosted on Apache and Tomcat application servers. There are two databases, Oracle and UniData. Many trading partners interact with GFM using Electronic Data Interchange (EDI) files, and GFM uses Axway to translate EDI to a User Defined File (UDF) and Java EDI (JEDI) to move the data between the translator and GFM servers. Some EDI trading partners interact with GFM using eXtensible Markup Language (XML) file exchange and web services as well.

The contractor shall plan for all tasks identified in this Performance Work Statement (PWS) and gather all pertinent information. Contractor estimates and timelines shall be determined based on the deliverable due dates specified in each task. The contractor shall coordinate with the

Government to ensure successful planning, documenting and executing of the sustainment and enhancement activities and ensure they are well synchronized and integrated with other efforts.

All reports, studies, or policies identified in the PWS to be accomplished shall be prepared and submitted for Government approval.

GFM may, as a part of becoming cloud native be required to migrate off of Unidata and Unibasic. GFM is currently in the process of migrating off Accuterm, and Green Screen functionality. Unidata database may be migrated to Oracle or another cloud native relational database, GFM logic will be migrated to PL/SQL and JAVA.

1.2.1 Government – Development Category Definitions

All Categories will be determined and identified by the Government and annotated within current Configuration Management application.

Sustainment:

Security Issues (Risk Management Framework (RMF)/DIACAP/STIG compliance) Emergency Patch testing Maintenance Releases Helpdesk/Functional support, (duplicate and verify issue and determine work-a-round) Contractual Obligations and Financial Audit Compliance Changes Statutory/Legal Compliance changes Internal /External Interface Changes (Existing) Internal System functionality Improvements Technical upgrade testing existing hardware, software or equipment Agile meetings for Sustainment requirements Analysis/Test Sustainment requirements, as required Update Test Cases/Test Plans as required to support operational business changes Review User Training and User Manuals for test planning and execution SCRs comprising in releases SCRs that support change to mitigate operational risk

Enhancements:

Adding new functionality to existing application Adding new fields to existing application Improved functionality Agile meetings for Enhancement requirements New Internal/external interfaces Update/Create User Training and User Manuals for test planning and execution Integrate Enterprise capabilities via data/application web services

Capital Projects:

New functionality New applications New projects/Development Create User Training and User Manuals for test planning and execution

1.2.2 Development Methodologies & Processes

Software development shall be performed on a SDDC network using SDDC certified hardware and software. Access to the USTRANSCOM/SDDC network, software and hardware is and can be accessed using VPN software or government provided solution. Although, VPN software is currently SDDC software of choice for access, future access to SDDC network, software and hardware shall not be limited to said product.

The Contractor shall be responsible for the successful installation and implementation of government-owned application software onto the government-owned environments. For all deliveries, the contractor shall provide all source code, documentation (including those related to architecture, test design and testing results, and installation procedures), delivered to the government.

The Government has an isolated common development and test environments for all software development and testing to complement the governments common integration and testing environment (Staging). The contractor shall conduct all software development entirely from within this consolidated government development environment. The contractor may access remotely from their facilities through a Government approved VPN connection, from isolated dedicated development workstations that comply with Government security guidelines.

SDDC Information Assurance policies require base-lined source code to be scanned prior to release to the Staging and Production environments. The tool currently used for these software scans is Fortify. Code Scans by Fortify shall be provided prior to code release to staging/production environment and within 30 days of a new rule pack release.

Software developer shall apply agile development methodology where practical for Sustainment, Enhancement and New projects. The Contractor shall develop, in accordance with agile and iterative development methodologies and the Government PM and COR/ACOR, a Project Execution Plan. The Project Execution Plan shall account for Sprint planning, cross-functional and technical team collaboration, capacity, backlog and burn down planning and velocity tracking. Additionally, as part of the Project Execution Plan the contractor shall implement sprint iterations in short timeframes (time boxes) that shall typically last from four (4) to six (6) weeks.

The Project Execution Plan shall also incorporate and account for Independent Verification and Validation (IV&V) testing or Government acceptance testing prior to every sprint Software release.

After the establishment of the Project Execution Plan the contractor shall be required to meet the scheduled sprint software release date, or not exceed the scheduled sprint release date by more than 10 business days unless the delay is coordinated with the Government and approved by the COR/ACOR. Delays greater than 10 business days, shall be documented and shall include the

PM/COR/ACOR signature or approved electronic message such as email or document with CAC digital signature.

1.3 Specific Tasks

1.3.1 Task 1: Contract Level and Project Management

The Contractor shall provide a Contract Manager who shall be responsible for the performance of the work. The name of the Contract Manager and alternate(s), who shall act for the Contractor when the Contract Manager is absent, shall be designated in writing to the COR. The Contractor shall notify the COR/ACOR in writing of any changes to personnel within three (3) workdays after the information is known.

1.3.1.1 Task 1 Subtask 1: Monthly Status Report (MSR)

The contractor shall provide an MSR. The MSR shall provide status of issues for discussion during the GFM technical meetings. The MSR shall outline the status of all new application development, enhancement, and maintenance activities. The MSR format should include sections categorized under the headings of: development in process; releases; development planned;

maintenance in process; maintenance planned, and personnel leave/travel schedule. Changes to the MSR format shall be agreed to by the COR or Government Program Manager.

1.3.1.2 Task 1 Subtask 2: Quarterly Program Management Reviews (QPMRs) The contractor shall conduct quarterly PMRs, as scheduled by the Contractor in coordination with the COR/ACOR, to begin the first month of each contract period; meeting typically lasts no more than an hour. The contractor shall present status, progress, recommendations, and concerns in the development of any tasks or documentation described within this PWS. The PMR shall reflect resolution to prior PMR actions items, new action items, record discussion activity, decisions made, date, locations, attendees, and a copy of the presentation slides used. The contractor shall provide the draft PMR slides to the COR /ACOR and the Program Manager, NLT two (2) days prior to the meeting. Final PMR slides, to include the milestone schedule, shall be delivered at the scheduled meeting. The contractor shall provide minutes of the PMR NLT five (5) business days after the meeting.

1.3.1.3 Task 1 Subtask 3: Employment Status Report

The contractor shall provide an employee status report (listing/spreadsheet) containing names and labor categories of personnel supporting the tasks identified in paragraph 1.3.1.2. The report shall be provided within thirty (30) days after contract award and updates to the COR /ACOR NLT 4:00 PM central time the first work day of the following week after contractor staffing levels or personnel are changed.

1.3.1.4 Task 1 Subtask 4: electronic Contractor Manpower Reporting Application (eCMRA) The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for Military Surface Deployment and Distribution Command via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address https://www.ecmra.mil/

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2019. Contractors may direct questions to the help desk by clicking on “Send an email” which is located under Help Resources on the right side of the login page. Reporting will start FY19 due to transition period.

1.3.1.5 Task 1 Subtask 5: Contractor Work Breakdown Structure (CWBS) & Integrated Master Schedule (IMS) The Contractor shall deliver a Contractor Work Breakdown Structure (CWBS) and Integrated Master Schedule (IMS). The CWBS and IMS shall be re-delivered upon mutually agreed to changes to the documents. The Contractor shall provide a copy of the GFM source code upon each versioning change to the code.

1.3.2 Task 2: GFM Sustainment

Operating System (OS) support for GFM Production, Alternate Site, Simulator, Staging, Development and Quality Assurance will be primarily supported under a separate contact by the Government’s Centralized Enclave (CE) Contractor. GFM requires limited systems administration and analysis support for the Production, Alternate Site, Staging, Simulator, Development and Quality Assurance environments. The Government’s CE contractor will grant the Contractor sudo ("superuser do") permission, which allows a user with proper permissions to execute a command as another user, such as the superuser.

Specific GFM Applications can be found in Appendix A. The GFM suite of interoperable systems consists of the applications described in Appendix A, GFM Application Descriptions.

The System Environment Description is in Appendix B.

The Contractor shall maintain, sustain and update all GFM applications, databases, and technologies. The Contractor shall provide software engineering services and support to ensure the GFM complies with U.S. Laws, Agency Policy, statutory, regulatory, and user requirements required to accomplish the existing mission and minimize operation risk.

The Contractor shall maintain software, tools, applications, servers, interfaces and databases for all GFM applications and related functional tools in support of the GFM user community and the GFM Program Management Office (PMO). The Contractor shall comply with SDDC Enterprise

Architecture Standards for database design; perform all development using ANSI and DOD standards. The Contractor shall apply agile and iterative development methodologies in order to provide timely capabilities to the user community and the war-fighter. The Contractor shall ensure that information systems security engineering is employed during all changes to the system and software development life cycle.

1.3.2.1 Task 2 Subtask 1: Tier II/III Help Desk Support

The contractor shall provide Tier II/III Help-Desk support during the core work hours. The contractor shall analyze problems reported via Tier I and take corrective actions to restore GFM functionality. The contractor shall make software changes and System/Data Administration actions as required in order to resolve service interruptions, errors or other problems reported by the user community. Historically, GFM Tier II/III Help Desk support averages one hundred fifty

(150) Tier II/III call per month.

The contractor shall log problem status and resolution information in the Government owned SDDC ticketing database (Service Now is the current tool to capture this data). The contractor shall identify trends and areas for improvement and include this analysis in the Monthly Status Report.

The contractor shall perform Help Desk support outside core work hours in case(s) of a system outage. The contractor shall respond to outages outside of core work hours no later than one hour after notification. The contractor shall identify on-call personnel for hours outside of the core work hours (07:00 – 16:30) that will be available via telephone/cell phone. The Government will not provide telephones or cell phones for this service.

The contractor shall assist the Government in providing updated information for the maintenance of the Service Response Center (SRC) Application and knowledge database. Contractor-provided updates will be sent by the Government to PMO/SRC staff for updating the SRC Application and knowledge database.

The Contractor shall diagnose and fully restore to service any malfunctioning component.

1.3.2.2 Task 2 Subtask 2: Problem Report – Service Request (SR) Support

The Contractor shall resolve Service Requests (SRs) or Problem Reports (PRs) escalated to the Contractor’s Tier 3 support. The SDDC Help Desk Standard Operating Procedure (SOP) for Service Request Escalation describes the escalation and de-escalation procedures between tiers and is used as a guide in this process.

The Contractor shall provide a PR Analysis and Recommendations Report each performance period with specific, feasible, and actionable recommendations in writing to reduce system factors that create SRs. The analysis period shall include PRs escalated to Tier 3 from 1 October through 30 September. The Government will determine which recommendations to implement in future software releases.

The Contractor shall analyze and resolve to the Government’s satisfaction escalated Problem Reports (PRs) or Service Request (SR) within five (5) business days after the Tier 3 escalation date. The Tier 3 escalation date is the date the SR is escalated through the Government-provided PR tool by Tier 1 or Tier 2 to the Contractor’s Tier 3 support. Periods of requests for Government clarification that are equal to or exceed one (1) business day shall not be counted in the five (5) business days. All communications from Tier 3 to Tier 2 shall be performed by or supported by an email or person-to-person telephonic communication to a Tier 2 representative.

Upon Contractor’s request, but no later than three (3) business days after SR escalation to Tier 3, the COR may authorize longer timeframes.

The contractor shall provide resolution of open software PRs through maintenance releases. Resolutions shall be incorporated into the baseline using software versioning methodology. The contractor shall prepare a document containing resolutions and test results for the PRs contained in each software version. The contractor shall provide a completion status of all PRs. The contractor shall design system applications and integration efforts to enhance/improve the performance and efficiencies of GFM software modules and applications.

Note of reference: Historically averaged two maintenance releases per month. For estimation purposes, between twelve (12) and twenty four (24) maintenance releases occur every year outside of core hours, each being six (6) hours in duration.

1.3.2.3 Task 2 Subtask 3: System Operations and Maintenance

* Unidata database and Unibasic migration to Oracle will resume in FY20.

GFM support team shall be responsible for all application and Unidata support for all GFM environments. The contractor shall provide the labor necessary to monitor, analyze, and optimize system performance and operations of supported environments. The Contractor shall maintain the operation of the system to meet the reliability, availability, and performance requirements.

The Contractor shall provide software corrective maintenance and sustainment services for GFM. The Contractor shall perform GFM application maintenance and updating in all environments. The Contractor shall notify the Government in writing prior to implementing any change to the configuration baseline. The Contractor shall coordinate with the Government’s CE contractor personnel to install and configure the application level patches in the GFM environments.

The Contractor shall perform remote maintenance on the GFM Development (Dev/QA) servers.

Maintenance such as patches, upgrades, application log reviews, configuration changes, incident monitoring and logging, and application tuning shall be performed for all GFM environments.

The Contractor shall satisfy application Security Technical Implementation Guide (STIG) requirements, application patches, and Unidata patching on all environments.

The Contractor shall ensure the GFM application and web servers are fully compliant with Information Assurance Vulnerability Alerts (IAVA) advisories, and DOD security guidance; that all patches and service packs are at the current level; and the application is fully functional prior to the Government’s contractor loading the GFM application to the GFM servers. The Contractor shall coordinate all IAVA actions with the PMO and supporting contractor.

The contractor shall track all security issues uncovered during the entire software lifecycle, whether a requirement, design, implementation, testing, deployment, or operational issue. The risk associated with each security issue shall be evaluated, documented, and reported to Government as soon as possible after discovery. The contractor shall include this risk along with risk mitigation COAs (Course of Action) and a recommended COA as part of the MSR.

The Contractor shall update server application configuration settings of GFM-related COTS applications and GFM software as hardware is added, repurposed, or replaced within the GFM environments or as Operating Systems (OSs) are upgraded. The Contractor is responsible for establishing the OS application configuration settings as they apply to the GFM application code residing under or dependent on those settings.

The Contractor shall improve system performance by tuning and optimizing the software code and/or COTS configuration parameters. The Contractor shall provide a quarterly system performance analysis and recommendations report for Government review and approval. The Contractor shall implement Government-approved tuning and optimization activities.

The Contractor shall update and comply with the Vulnerability Management System (VMS).

The Contractor shall evaluate the impact of each change on security.

Scheduled downtime shall be coordinated with the Government.

The Contractor shall perform system and data integration tasks necessary to assure GFM applications meet the technical, and performance requirements. This includes, ensuring accessibility through Electronic Transportation Acquisition (ETA) for all applications in all environments.

For all patches and releases, the contractor shall deliver, for each application, a useable product that is error- free with fully documented source program code and complimenting executable code for processing on SDDC hardware. The contractor shall make the GFM source code available to the Government via on-line access through a government provided Version Management tracking tool.

The Contractor shall implement STIGs as applicable or, if unable to implement the guidance, coordinate with the Government for mitigation. The contractor shall create and maintain Web

Services in compliance with the SDDC Service Oriented Architecture (SOA) vision, integrate and decouple to increase reusability, decrease redundant features and functionality and promote the SOA as directed by SDDC/G6.

The Contractor shall scan all environments, to include retina, Security Readiness Review (SRR), Gold Disk, and other DOD required scans will be maintained, updated and reported within Defense Information Systems Agency (DISA) Vulnerability Management System (VMS). Configuration and support for SDDC standard monitoring tools.

1.3.2.4 Task 2 Subtask 4: Unscheduled Downtime Events

The Contractor shall resolve unscheduled downtime events attributable to the GFM software, customized Commercial Off the Shelf (COTS), or interfaces. The GFM Production environment unscheduled downtime shall not exceed a total of four (4) hours per month. Unscheduled downtime is measured from PR or SR escalation to the Contractor’s service/help desk through resolution. Upon Contractor’s request, the COR may authorize in writing longer timeframes.

The Contractor shall analyze each unscheduled downtime event (i.e., attributable and non-attributable to the GFM software, customized COTS, or interfaces) to determine and document the root cause of event, event duration, modules affected, volume of accumulated backlog, possible users affected, agencies contacted, and actions taken to resolve the event. The Contractor shall utilize the Government-provided tools and coordinate with agencies, activities and resources associated with the event to provide a complete analysis. Report the analysis findings in an unscheduled downtime event report no later than 10:00 AM CT following the day the unscheduled downtime event is initially reported to the Contractor’s service/help desk. The status of accumulated backlog shall be reported in writing, each business day, until it is resolved.

1.3.2.5 Task 2 Subtask 5: Functional Requirements

The contractor shall review change requests ensuring understanding of functional and user requirements. The Contractor is responsible for performing system/functional analysis and creating/documenting user stories in support of Agile development efforts. These descriptions shall translate general or generic functional requirements received from the user, business process owner, and DOD transportation needs into a description that adequately defines the business process requirements to enable a technical solution. Each requirement will become a part of a G6 Configuration Management (CM) system currently Serena Business Mashups (SBM). The Contractor will be responsible for maintaining GFMs instance of the SBM Data Base (DB) instance that is not maintained by the Enterprise SDDC/G6 SBM.

1.3.2.6 Task 2 Subtask 6: Documentation

The contractor shall sustain, create, review, and update system documentation in accordance with this PWS for Sustainment, Enhancement, New projects and Accreditation. The contractor shall prepare technical documentation for the GFM Project to include System Requirements, System Manuals and processes, Interface Requirements, Database Description Documents (DDD), Flow chart, Checklists, Web Services documents, System-user documents and other GFM system documentation requested by the program management team. Existing documents such as Memorandum of Understanding (MOUs), The Interface Design Document (IDDs) and Interface Requirements Agreement (IRAs) will be provided to the contractor at the beginning of the contract.

The contractor shall prepare and maintain Standard Operating Procedures (SOPs) to ensure consistency of system performance. Activities related to hardware and software configuration shall be documented. SOPs should include, but not limited to: code standards, code scans, code promotion, backups and restores, baseline changes, licensing, installing software, and applying patches.

The Contractor shall prepare and maintain detailed Interface Requirement Agreement (IRA) documents for each interface between GFM and its trading partners. The Contractor shall maintain and update this information in the designated CM tool. Signed documents will be stored electronically on a government-owned server to be designated by the COR. Changes to a document shall be made by a complete revision and identified by unique Document History Control Number. The justification for the modification shall be recorded in the Document History. If no change proposals are submitted during the annual review period, that fact shall be noted in the Document History and the document will be notated Reviewed on (date) with no change required.

The Contractor shall document server application configuration changes for each server within the GFM environments. The Contractor shall provide a server application configuration change document when configuration changes are implemented.

The Contractor shall prepare and maintain system architecture diagrams, system documentation, and other system-related documentation.

System Administrator (SA) Manual

The Contractor shall maintain the SA Manual. At a minimum, the SA Manual shall address:

- Install application code, or packaging for CE SAs to install

- GFM System startup procedures

- User interfaces

- Standard Service Level Agreement (SLA) agreements with SDDC Enterprise Integration Program (EIP)/CE team

Database Administrator (DBA) Manual

The Contractor shall maintain the GFM DBA Manual. At a minimum, the DBA Manual shall address:

- Shutdown and restart GFM database servers or instances

- Recovering database procedures

- Creating and managing table space, user accounts, and privileges

- Database install and configuration procedures

Accreditation Sustainment

The contractor shall provide program specific input for the development of new application security documentation and the updating of existing application security documentation to facilitate the security accreditation of the GFM system, and the EDI and SOA environments IAW the current certification and accreditation guidance (current guidance is DODI 8510.01, DIACAP - will be migrating to NIST Risk Management Framework model). The contractor shall sustain the application and its environment in compliance with the DISA STIGs. The results of the DISA STIG documentation must always reflect the current status of the system;

contractor shall provide monthly updates. The contractor shall be required to provide a number of updates to existing certification and accreditation documentation, such as network diagrams, ports and protocol matrix, application certification package created during release cycle, and other existing documentation. This documentation is required whenever changes are made that may affect the security posture of the application environment. The contractor shall be required to provide a monthly update, no later than the last business day of the month, to the PM for the applications RMF and/or DIACAP Plan of Action and Milestones (POA&M). POA&Ms are maintained within the Enterprise Mission Assurance Support Service (eMASS)

1.3.2.7 Task 2 Subtask 7: Interface Support

The contractor shall support the current data exchange capabilities in GFM. These are currently done via Electronic Data Interchange (EDI) exchanges, Extensible Markup Language (XML), and Web Services.

The contractor shall create and maintain Web Services in compliance with the SDDC Service Oriented Architecture (SOA) vision. The contractor shall be responsible for the day-to-day processing of data exchanges within the GFM domain and its trading partners and ensure all inbound transactions are retrieved, processed and stored. The contractor shall support the Enterprise EDI team and Enterprise Interface team (EET) as needed for day-to-day receipt, distribution, and resolution of data exchanges outside the GFM domain.

The contractor shall provide support for updating existing and/or creating new schemas and Web Services Description Language (WSDL) to ensure accurate data exchanges between GFM and its trading partners. The contractor shall ensure schema and WSDL supports the procedures and requirements prescribed to Transportation Service Providers (TSP), providing commercial transportation and related services to the Department of Defense (DOD) and other authorized users of the Defense Transportation System (DTS), as published in the Military Freight Traffic Unified Rules Publication-1 (MFTURP-1). The contractor shall ensure all data elements are recorded in the schema and WSDL comply with GFM business requirements and enterprise standards.

The contractor shall provide support for updating existing and/or creating new XML to ensure accurate data exchanges between GFM and its trading partners. The contractor shall ensure XML support the procedures and requirements prescribed to Transportation Service Providers (TSP), providing commercial transportation and related services to the Department of Defense (DOD) and other authorized users of the Defense Transportation System (DTS), as published in the Military Freight Traffic Unified Rules Publication-1 (MFTURP-1). The contractor shall ensure all data elements are recorded in the User Designed Format (UDF) comply with GFM business requirements and enterprise standards.

The contractor shall ensure all inbound and outbound EDI transactions are retrieved from and/or deposited in the appropriate directory on a GFM server or the Managed File Transfer service (MFTS). The Contractor shall perform root cause analysis on data and the underlying business issues spanning multiple GFM applications, schemas or interfacing systems.

The Contractor shall ensure all inbound and outbound XML and web service transactions are deposited in and retrieve from the appropriate directory on a GFM server or ESB. Distribution failures occurring outside of the scope of GFM, worked in conjunction with the SDDC SOA POC, distribution failures outside the scope of SDDC will be escalated to the SDDC Enterprise Interface POC.

This task also requires migration support to the Enterprise Service Bus (ESB). To facilitate the success of this transition, the Contractor shall provide the necessary technical and functional support specific to GFM business requirements, to include creation and testing the schema and Web Services Description Language (WSDL) and GFM business requirements, to include creation, testing the XML.

1.3.2.8 Task 2 Subtask 8: User and Training Manuals - Distant Web Learning The contractor shall maintain the Distance Learning Program (DLP) for the GFM suite of applications in Appendix A. There are 2 training guides (16 & 17 pages) and 16 training manuals (80-90 pages each). The manuals and guides are maintained in soft copy format. The contractor shall ensure integration of these products with the existing developmental strategies of GFM and current training. The contractor shall ensure that all training and learning tools are updated consistent with and are synchronized with each software upgrade and each version release. No more than twice per year, the contractor shall be required to conduct system information briefings and system demonstrations at Government meetings, symposiums, workshops, conferences, and other events.

The Contractor shall maintain or create user interactive Web Based Training (WBTs) for all current and/or future web-enabled applications. Interactive WBTs is the primary method for user training. All WBTs shall include practical exercises containing data files that are consistent with the application and realistic to the functions being explained to the user. No less than five (5) times per month, the Contractor shall conduct training sessions in support of users for GFM Applications. Typical class time is approximately two (2) hours. Trainings are typically conducted via Defense Connect Online (DCO).

1.3.2.9 Task 2 Subtask 9: System and Database Administration

The Contractor shall perform all System Administration (SA) and Database Administration (DBA) on GFM Development, and Quality Assurance (QA) environments. On the GFM Dev, QA, Staging, Simulator, Production and Alternate Site Zones, the Contractor shall complete all Application Administration, Unidata Database administration, and uniquely GFM tasks for Oracle and System Administration. The Government’s CE contractor is the primary Systems Administrators and Oracle DBAs for these environments. The Contractor shall work with the Government’s CE contractor to ensure all databases, Operating Systems (OS), permissions and security are maintained at the appropriate levels.

The contractor shall coordinate database backup preparation. GFM requires specific database backups in order to keep the Oracle and Unidata databases synchronized on date and time stamp.

GFMs databases must remain synchronized together for accuracy and functionality. GFM SA shall prepare data for team to coordinate backups in all environments. The contractor shall monitor the accuracy and timeliness of the backup service provided by the SDDC Systems administration support contract, set-up directory structure and permissions for the GFM Unidata Database environment as well as other GFM applications (See Appendix A), set-up monitoring support tool configurations. GFM SA will be given the appropriate permissions required to support inherently GFM SA responsibilities via the SUDO Unix command. GFM SA shall work with CE/EIP SA support to ensure the SUDO commands are set up to support GFM.

GFM Quality Assurance (QA), Consolidated Training (CTE), Staging, Production and Alternate Site environments

Standard zones will be provided to the Contractor by the Government’s CE contractor. The Contractor shall work with the Government’s contractor to configure permissions, user groups and directory structures. The Contractor shall perform GFM application maintenance and updating of application patches. Systems Administration tasks that are uniquely GFM in nature, to include required Unidata actions, Database synchronization steps.

Green Screen Functionality, prior to backup and restore, etc., shall be performed under this task.

The contractor shall create accounts based on GFM Functional teams’ user list, and add static IP address to zones to allow access. The Contractor shall work with the Government’s CE contractor to verify user Information, setup accounts in GFM Green Screen Environment, ensure access to the application. The SDDC Help Desk installs the Accuterm software on the user’s desktop and configures the GFM customer desktop.

GFM Common Development Environment (CDE) (Development and QA) environments

Standard zones will be provided to the Contractor by the Government’s CE contractor. The Contractor shall configure permissions, groups, directory structures and load applications. The Contractor shall perform all required patching (excluding operating system) for application, database for Unidata, and any required maintenance, updating and documentation. The Contractor shall be fully responsible for maintenance and support of the development zones.

Contractor shall maintain virtual machines (VMs or VMware Horizon View Client) within the CDE environment. VM will be provided to GFM Support contractors to use for development and system administration within the CDE environment. The Contractor shall maintain these VMs.

Currently GFM has a development environment that consist of a front end application tier, a backend database tier, web tier, code repository server and code scanning server. These applications are housed on Solaris zones. The Contractor shall propose changes that the Contractor believes will improve the efficiency and/or performance of GFM or resolve software/ hardware problems which have the potential for causing system failure or situations which will improve the overall performance of GFM. The Contractor shall submit system and process changes where GFM may take advantage of code sharing and/or re-use, data or databases tables sharing; presentation changes focusing on uniformity in look and feel across multiple applications; and design and development practices that focus on overall improvements and advantages in system integration across multiple applications. Furthermore, the Contractor shall identify areas were SOA principles, methodology and Web Services, can be incorporated and utilized for interoperability and reuse.

The contractor shall provide maintenance to the GFM Development Environment, through database tuning and system patching. The contractor shall load all applications and COTS software within the Development Environment. The contractor shall provide technical support to the CE contractor in install/deploy software patches and releases into the Staging, Production, and DRE Environments.

Database Management Systems (DBMS) Unidata Administration (Green Screen HOST access)

The Contractor shall provide database administration remotely or on site and shall provide assistance and technical expertise in the identification, design, and development of the GFM Unidata databases and existing database elements.

The contractor shall update UNIX and GFM specific Unidata kernel configuration files, adding directories, creating and sizing Unidata files, creating new Unidata accounts, and prepare Unidata for backup and recovery files. The contractor shall optimize Unidata within the current GFM architecture/environment, ensuring system resources are kept at optimum levels. The contractor shall deploy UniObjects within the Unidata database, diagnose UniObject problems and provide appropriate solutions. The contractor shall customized UniObject pooling mechanisms and applies appropriate actions as necessary. The contractor shall be responsible for administrating UniData's Recoverable File System (RFS) to ensure that log files are sized appropriately and that the RFS files are monitored on a daily basis. The contractor shall provide long-range requirements for Unidata database design and administration.

1.3.2.10 Task 2 Subtask 10: Maintain Alternate Site

The contractor shall complete all required application configurations to ensure the GFM applications are correctly installed and configured to operate at the SDDCs Alternate site. The Alternate site is located at a separate Government facility, but the contractor shall usually be able to access the system(s) remotely. To ensure operationally correct software, the contractor shall install, configure and update application software at the Alternate site within one (1) day of access, connectivity and availability for installing/configuring the same software on the Production site.

The contractor shall provide support to the Government during contingency or emergency operations in accordance with approved disaster recovery and contingency operations plans. The contractor shall ensure resources/key personnel are available throughout an emergency in accordance with the established plan.

1.3.2.11 Task 2 Subtask 11: Disaster Recovery/Contingency Plan Minimum of twice a year, the contractor shall update the GFM plan for disaster recovery and/or contingency operations in coordination with the enterprise Disaster Recovery Exercise (DRE). Once the DRE schedule is determined, the Government will notify the contractor, and the contractor shall update the plan within ten (10) working days. The plan shall include: crisis emergency management (onsite and offsite) (technical and functional); disaster recovery; pre and post emergency operations requirements; and fail-over management.

1.3.2.12 Task 2 Subtask 12: Exercise Operations

The contractor shall participate in SDDC G6 DRE exercises. The exercise is an opportunity to ensure the plan is executable. The contractor shall perform activities as required by the plan for the GFM system/applications. The exercises are conducted on average over a one-week period, during normal work hours.

1.3.2.13 Task 2 Subtask 13: Data Analysis

The Contractor shall develop ad hoc queries and reports, such as:

- Historical/Archived reports

- Operational/Sustainment data

- In support of Freedom of Information Act inquiries

- Analysis/impact studies

- Data calls

1.3.2.14 Task 2 Subtask 14: Software Implementation

The contractor shall provide base-lined code to the CE Staging environment for Independent Verification and Validation to perform Software Acceptance (SAT) level validation. The enterprise IV&V effort is NOT included as part of this PWS. The IV&V Team will provide feedback to the developers and government team in the form of problem reports (PRs) recorded in the government approved change management tool, on any defects or functionality that does not meet the defined requirements.

The contractor shall analyze and resolve all defects identified by the IV&V Team. Corrections will be provided in a software release or patch, as required.

After, the IV&V Team has certified the software released to the IV&V/UAT environment as error-free and meets intended design, the contractor shall provide base-lined source code to the CE contractor for installation into the Production environment. The Contractor shall store for every designated GFM software release and interim release to the production environment, all base-line source and executable code to the SDDC environment. Methods for identifying software versions shall comply with the GFM CMP. Refer to paragraph 1.2 for IA related to this deliverable.

The Contractor shall provide an implementation plan that documents the discrete tasks required to install and/or deploy software patches and/or releases that will require system downtime exceeding 15-minutes. The implementation plan shall include

A. Schedule of events by task B. Bulletin, Message of the Day (MOTD), notifying customers and trading partners of the estimated duration and scope of the scheduled downtime C. The Contractor shall prepare a Software Release package for each software change package and deliver it at the time of software delivery. The package shall include all applications and shall be issued for all releases. In each package, the Contractor shall identify each SCR number and provide a brief description of the change.

Upon successful implementation of software patches/releases, the contractor shall notify the Government when GFM is operational and accessible to all customers and submit an After Action report, identifying events that deviate from the planned work schedule.

1.3.2.15 Task 2 Subtask 15: Configuration Management (CM)

The contractor shall provide Configuration Management (CM) support for the GFM program. The contractor’s configuration management processes shall complement the Government configuration management processes. The configuration management plan is due within 90 calendar days after contract award and updated 30 calendar days after the start of each period of performance.

The contractor shall maintain source code and provide change control for all GFM baselines and configuration items such as documentation, COTS software, application, source, and executable code. Currently the Contractor delivers the source code to the government for inclusion into the enterprise Source Code Repository. Future option, the Government will provide the contractor with web access to the SDDC Enterprise Change Control Tool (CCT) and Source Code Repository Tool (SCRT), currently supported by Serena Business Management (SBM) and Concurrent Versions System (CVS) and or Subversion software, respectively. The Contractor shall store all GFM software source code in the SCRT.

The Contractors shall provide input to the GFM Configuration Management Plan (CMP) and processes that are consistent with and complement the GFM processes. The GFM program has an existing CMP that defines the Government’s current CM processes; the Contractor shall provide updates to the document to define their developmental CM processes. The CMP includes the following:

- Application Plan

- Developers configuration management processes/procedures

- Methods, procedures, and controls

- Baselines (versioning)

- Source and Change control

- Configuration status accounting

- CM audits of total configuration of software

- CM Repository (Dimensions will be the delivery repository for source code prior to deployment-Government will provide network connection)

1.3.2.16 Task 2 Subtask 16 - Software Development Unit Test (SDT) The GFM software developer shall conduct Software Development Unit Tests (SDT) before releasing software to the GFM PMO. The contractor shall develop a Software Development Test Plan, test the software according to the plan, and develop a SDT Test Results Report for each software SCR and/or PR incorporated. The contractor shall regression test all software changes and development prior to Independent Verification and Validation (IV&V) Testing.

The developer shall ensure the software is error & abort free and shall verify interoperability and integration with interfacing systems.

1.3.2.17 Task 2 Subtask 17 - Software Version Description (SVD) The contractor shall prepare a SVD for each software release and present the SVD to the Government no later than five (5) workdays after deployment of the application. The SVD shall identify and describe an inventory of materials to be released, software/applications contents, changes to be installed, adaptation of data, related documents, installation instructions, and possible problems and known errors.

1.3.2.18 Task 2 Subtask 18 - Software Reviews

The contractor shall conduct software reviews for new development. Software reviews consist of Test Readiness Review (TRR), Fielding Decision Briefing (FDB), Other briefings, walkthroughs, and/or prototype demonstrations. The contractor shall develop meeting minutes.

1.3.2.19 Task 2 Subtask 19 - Bills of Lading (BLs)

The contractor shall provide for electronic transfer of BLs among all GFM trading partners through the development and maintenance of software and the monitoring of BL file transmissions. Additionally, the contractor shall develop/maintain the capability to cost and select for traffic currently moving under BLs in order to assure that the Government acquires the best value. The contractor shall enable the system to produce electronic and hardcopy BLs. The contractor shall ensure that the electronic files are available for transmission to GFM Trading partners (TPs) – 1 year active / 10 years archived.

1.3.2.20 Task 2 Subtask 20 - Tailored Transportation Contract (TTC) Interface The contractor shall maintain a current set of TTC tender rates. The contractor shall enter tender rates via a manual mode when necessary. The contractor shall continuously enhance this interface as necessary. Government acceptance as detailed by review of rates uploaded to the GFM. The contractor shall maintain the process of uploading TTC Rates received via electronic spreadsheets.

1.3.2.21 Task 2 Subtask 21 - Remote Carrier Access

The contractor shall provide the capability for commercial carriers to access the GFM CAVS, FCRP and TEOW applications from remote locations and obtain shipment Requests and Responses, Standard Tender of Freight Services, and Bills of Lading information. The contractor shall support and enhance the automated process of carriers accessing CAVS, FCRP, and TEOW via the Internet.

The contractor shall establish and maintain user accounts in accordance with Army and DOD security guidelines and regulations, and monitor system access patterns. These guidelines and regulations include, but are not limited, to DOD 8500.1, DOD 8500.2, AR 25-2, and AR 38019.

All user access shall be positively authenticated and monitored, and non-repudiation must be established. All attempts at non-authorized access shall be monitored, and access attempts that appear to be suspicious shall be reported in a timely manner to GFM PMO personnel.

- Performance Measure: Manage inactive user accounts. The below standards are the current DOD requirements and may be adjusted by the DOD with modification to this contract.

- Performance Standard: 100% of user accounts that have not been accessed for over 35 days are locked, unless authorized otherwise by the Government.

- Performance Standard: 100% of user…