AKO DRAFT BRIDGE PWS.pdf

Acquisition Sensitive Information IAW FAR 2.1.1, and 3.104 For Official Use Only (FOUO)

W15QKN-17-F-0006

Version 1.8

DEPARTMENT OF THE ARMY

PROGRAM EXECUTIVE OFFICE

ENTERPRISE INFORMATION SYSTEMS

(PEO-EIS)

FOR

ARMY KNOWLEDGE ONLINE ENTERPRISE SERVICES

(AKO-ES)

PERFORMANCE WORK STATEMENT (PWS)

Version 1.8 Updated 04 NOV 2019

W15QKN-17-F-0006

Version 1.8.

TOC 1

TABLE OF CONTENTS

1.0 PURPOSE

1.1 SCOPE .................................................................. Error! Bookmark not defined.

2.0 APPLICABLE DOCUMENTS

3.0 REQUIREMENTS

3.1 Task 1 – Program Management

3.1.1 Requirement Category 1A: Asset Management

3.1.2 Requirement Category 1B: Task Order Management

3.1.3 Requirement Category 1C: Periodic and Ad-hoc Reporting

3.1.4 Requirement Category 1D: Risk Management and Contingency Planning

3.1.5 Requirement Category 1E: Quality Management

3.1.6 Requirement Category 1F: Systems Configuration and Change Management ... 10

3.1.7 Requirement Category 1G: Incident and Problem Management

3.1.8 Requirement Category 1H: Availability Management

3.1.9 Requirement Category 1I: System Administration and Maintenance

3.1.10 Requirement Category 1J: Continuity of Operations and Disaster Recovery 16

3.1.11 Requirement Category 1K: Technology Refresh

3.1.12 Requirement Category 1L: Personnel In/Out processing

3.1.13 Requirement Category 1M: Third (3rd) Party Support

3.2 Task 2 – Identity, Certificate and Access Management (ICAM)

3.2.1 Requirement Category 2A: Identity and Access Management Support

3.2.2 Requirement Category 2B: Lightweight Directory Access Protocol (LDAP) 22

3.2.3 Requirement Category 2C: Extract, Transform and Load (ETL) Support

3.3 Task 3 –Operations and Maintenance

3.3.1 Requirement Category 3A: Network Operations

3.3.2 Requirement Category 3B: Firewall Management

3.3.3 Requirement Category 3C: Storage Management

3.3.4 Requirement Category 3D: Database Management

3.3.5 Requirement Category 3E: Server and Application Maintenance

W15QKN-17-F-0006

TOC 2

3.3.6 Requirement Category 3F: Data Center Operations and Management

3.3.7 Requirement Category 3G: Email Retention and Notification

3.4 Task 4 – Portal

3.4.1 Requirement Category 4A: Portal Application Administration

3.4.2 Requirement Category 4B: Portal Modification and Content Development . 46

3.4.3 Requirement Category 4C: Release Management

3.5 Task 5 – Security Management and Information Assurance

3.5.1 Requirement Category 5A: Cyber Security Planning

3.5.2 Requirement Category 5B: Cyber Security Operations

3.5.3 Requirement Category 5C: Cyber Security Support

3.5.4 Requirement Category 5D: IT Security Management

3.6 Task 6 – LISTSERV and Streaming Services Support

3.6.1 Requirement Category 6A: Web Site Development and Support Error! Bookmark not defined.

3.7 Task 7 - Integration Services, Technology Insertion and Enhancements

3.7.1 Army Knowledge Online 2.0 Portal Transformation

3.7.2 RESERVED ........................................................... Error! Bookmark not defined.

3.7.3 Army Knowledge Online Portal 2.0 Risk Management Framework

3.7.4 Army ICAM Support

3.7.4.1 Identity Management with Authentication Service Provider 70

3.7.4.2 Directory Services Management 71

3.7.4.3 ICAM Enhancement 72

3.7.4.4 Data Lifecycle Support 72

3.7.4.5 Application Integration Configuration Support 73

3.7.4.6 Disaster Recovery & High Availability Planning and Implementation 73

3.7.4.7 Security Management and Information Assurance 73

4.0 CONTRACTOR TRAINING AND CERTIFICATION

5.0 CONTRACTOR MANPOWER REPORTING

6.0 APPLICABLE INFORMATION ASSURANCE REGULATIONS

7.0 SECURITY

W15QKN-17-F-0006

TOC 3

8.0 GENERAL INFORMATION, MATERIALS, EQUIPMENT AND FACILITIES

8.1 GOVERNMENT FURNISHED INFORMATION

8.2 CONTRACTOR ACQUIRED PROPERTY

8.3 ACCOUNTABILITY

8.4 FACILITIES

8.5 IT BEST PRACTICES

8.6 OTHER DIRECT COSTS

8.7 SAFETY AND ENVIRONMENTAL

9.0 TRAVEL

10.0 THIRD PARTY INDEPENDENT VERIFICATION AND VALIDATION

11.0 KEY PERSONNEL

12.0 TRANSITION PLAN

W15QKN-17-F-0006

Version 1.8.

1.0 SCOPE PURPOSE

This Performance Work Statement (PWS) establishes the requirements to provide continued Operations and Maintenance (O&M) support services for an on-government premises effort for the Army. These efforts include Army ICAM Directory Services Support both non-classified Internet Protocol (IP Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet), and the existing Army Knowledge Online (AKO) Enterprise Services (ES) System.

Both the Army ICAM Directory Services Support and AKO-ES, are managed by Product Director (PD) Enterprise Services (ES).

AKO is comprised of a series of integrated systems for the purpose of combining information, applications, and processes across Department of Defense (DoD) organizational boundaries.

AKO-ES provides web-based enterprise information services to approximately 1.9 million Army, joint, and DoD customers with a Common Access Card in every country where the DoD has a presence on a 24 hour, seven (7) day a week, 365 days a year (24x7x365) basis. Enterprise services are provided to these customers on both classified and unclassified networks and include portal, directory, discovery, and single sign-on (SSO).

The AKO Portal, runs on the Adobe Experience Manager (AEM) platform, provides a single entry-point for Soldiers and Commanders to access and manage the wide variety of Army records and systems. Examples of these records and systems include training records via the Army Training and Certification Tracking System (ATCTS), Official Military Personnel Files via Human Resources Command, and financial records via the Defense Finance and Accounting Service. Some examples of the variety of services accessed by Soldiers include mypay, medical readiness, training, education, clothing, etc.

The AKO-ES system provides the framework to join together existing applications and information stores and create a flexible infrastructure that can adapt to emerging enterprise requirements.

The Contractor will be responsible to maintain and enhance all the systems, and shall provide innovation, efficiency and a demonstration of past performance in the areas of enhancement, administration, content management and identity management.

The agencies that drive requirements for AKO and the Army ICAM Directory Services to include EAMS-A and AMID include Program Executive Office-Enterprise Information Systems (PEO-EIS), Program Executive Office Global Information Grid Enterprise Services (PEO-GES) and the Chief Information Officer/G-6 (CIO/G-6).

1.1

The scope of this PWS includes both the existing Army Knowledge Online (AKO) Enterprise Services (ES) System and the Army ICAM Directory Services on both NIPRNet and SIPRNet. The Contractor will provide Army ICAM Directory Services

W15QKN-17-F-0006

Version 1.8.

systems Operation and Maintenance (O&M) and innovation using a collaborative and iterative process, and progressive addition of innovation as needed to maintain the environment with the government.

The Contractor shall provide support and maintain the Army Master Identity Database (AMID) as the core identity data component of the Army ICAM Directory Services.

2.0 APPLICABLE DOCUMENTS

Applicable documents are cited throughout this PWS.

3.0 REQUIREMENTS

This Task Order establishes Contractor requirements for the O&M sustainment of AKO- ES, the Army Master Identity Database (AMID and Army ICAM Directory Services, which encompasses Enterprise Access Management Service – Army (EAMS-A). This includes System O&M for these efforts on the [Non-Secure Internet Protocol Router (NIPR) and Secret Internet Protocol Router (SIPR)].

The AKO-ES systems, as referenced in this document, encompass multiple sub-systems and applications. These services include operations and maintenance of the AKO-ES system, support of the desktop devices and networks used by the Contractor, support of the Government Configuration Management Database (CMDB), as well as performing Business Process Management, Support and Content Management and Communications.

The Contractor shall support continuous technological improvement to maximize opportunities for product improvement available from emerging technological advances in the marketplace. This support will be through integration of new equipment technologies into existing system architectures in the form of virtualization, modernization and enhancements. Enhancements are requirements anticipated as a result of emerging technologies; the need for system improvements and changes; and for technology refresh of the AKO-ES System. Enhancements may include, but are not limited to, software updates; a combination of hardware and software updates typically generated through life-cycle management of hardware components; and new capabilities requiring changes in hardware, software, or both. Major enhancements may include, but are not limited to, changes to the system by (1) designing and implementing a new software platform in a loosely coupled, standards-compliant, service-oriented application architecture, and/or (2) moving data or services to/from other data centers.

After formal notification from the Government Contracting Officer Representative to sunset legacy products, Army Knowledge Online 1.0 and all legacy products, except LDAP and mini portal will be sunset in 1st Quarter FY20. All legacy systems will be shutdown (Including but not limited to Web, Application, K Database servers).

W15QKN-17-F-0006

Version 1.8.

PERIOD OF PERFORMANCE:

Date of Contract Award through one (1) year, with two (2) one (1) year Option Periods, if exercised. At the discretion of the Government, additional period of performance maybe required.

The total period of performance of the bridge effort will be nine (9) months.

PLACE OF PERFORMANCE:

The Contractor shall provide expert technical operations and maintenance support, multi-tier end user support, and management of the system to ensure continued service at the Fort Belvoir, Virginia VA and Contractor Facility, as well as multi-tier end user support and management of the production network and work stations.

Remote administration from Fort Belvoir, VA, can be expected to other sites where network boundaries extend or management of production network devices exist.

Services may be required at any combination of future AKO-ES facilities including but not limited to: Acquisition, Logistics and Technology Enterprise Systems and Services (ALTESS); and commercial cloud hosting, as best meets the Army’s objectives. The user community, including multi-tier end users, application owners, administrators, and others, will consist of current DoD users and any other users authorized by the Army.

The use of telework is NOT AUTHORIZED for this Task Order; however, the Contractor may use remote administration for On-Call break-fix work once the Government approves a presented solution that details procedures for reporting and tracking to the Government for all work done. The designated Contracting Officer Representative (COR) will provide the Contractor access to all available Government furnished information, facilities, material, equipment and services, as applicable. The Contractor shall provide the necessary documentation to gain access to sensitive or “rights guarded” data.

Support is to be provided on-site during a single shift [with the exception of the Continuous Operations and Management Center (COMC)] between the Business hours of 0700 to 1700. Core hours are 0900 to 1500. Personnel shall plan an eight (8) hour workday that provides the Government with consistent coverage over a 40 hour work week, Monday through Friday, Eastern Standard Time. The lunch period is not covered in the eight (8) hour workday and an additional 30 or 60 minutes should be added to the workday based on the amount of time taken for lunch. An alternate work site shall be utilized to support functional Program Management or Indirect labor duties such as program and financial reviews, and performance evaluations. In the event maintenance or patching requirements necessitate odd hours, the Contractor shall adjust individual work schedules to maintain 40 hour work weeks. All break-fix is to be executed as directed by the Government. Emergency Support for end–user service degradation or failure –on-call. Emergency Support from Northrop Grumman shall be in accordance

W15QKN-17-F-0006

Version 1.8.

with Attachment 0009, EMERGENCY NOTIFICATION PROCESS. (See Maintenance Window Table below). The Contractor shall ensure all personnel are compliant with DoD Directive 8570 certification requirements and Army computing environment certification/training for their position and assigned responsibilities to support AKO-ES.

A list of all certifications will be provided to the Government for verification monthly.

AKO Maintenance Windows

3.1 Task 1 – Program Management

The Contractor shall execute all activities related to Task Order Management, Project Management and Service Support for the overall Operations and Maintenance of the AKO ES and the Army ICAM Directory Services. These activities shall include, but are not limited to the following items:

The Contractor shall implement and maintain an internal Configuration Management System (CMS) to ensure technical and administrative integrity of all hardware and software, documentation, and data pertaining to this contract shall be under configuration control.

The Contractor shall assist the Government in the periodic review of the as-is system architecture, engineering, and technical refresh to the NIPR/SIPR system and make recommendations as to changes to the system development. The Contractor shall provide updates to the Government for inclusion into the CMDB as changes occur.

The Contractor shall provide engineering support to customers as required to resolve any and all support issues. The initiator for technical support may originate directly from the customer, the Army Help Desk(s), or other entities. The Contractor shall establish a

Green Changes with low complexity and easily reversible where an unsuccessful implementation has minimal impact to users or data (low probability, low impact)

• 0000-1559 Mon, Tue, Wed

• 0700-1259 Thu

Yellow Changes which are complex, uncommon, or not easily reversed, but not likely to impact users or data (medium probability, low impact)

• 1600-1759 Mon, Tue, Wed

• 1300-1559 Thu

• 0700-1159 Fri

Orange Changes which are complex, uncommon, or not easily reversed with potential to impact users or data for a short duration (medium probability, high impact)

• 1600-1759 Thu

Red High-risk changes that will impact production systems and may cause extended degradations or full outages for extended durations (high probability, high impact)

• 1800-2359 Thu

• 1600-2359 Fri

• 0700-2059 Sat, Sun

Name Description Maintenance Schedule (Times are Eastern Time Zone)

• 1200-1559 Fri

W15QKN-17-F-0006

Version 1.8.

centralized entry point (phone number and email) for such issues and track their status and history for reporting purposes.

To ensure a clear line of communications, the Contractor and AKO-ES will jointly develop and agree to a Communications Plan within 45 days after Task Order award and will be modified, as required, by mutual agreement, during the term of the Task Order.

The Contractor shall use and participate in cross-organizational Integrated Product Teams (IPTs) to facilitate communication and activity coordination among the Prime Contractor, subcontractors and Government teams. Each IPT will have co-leads from the Government and Contractor. The membership in each IPT shall be defined by the co-leads. Membership is expected to include representatives from Government and Contractor organizations that have a vested interest in the IPT. Each IPT shall focus on a specific program or technical management function. As a minimum, mandatory IPTs shall include management, systems engineering, software, test, supportability, and security/information assurance. Other IPTs will be established as necessary (e.g.

executive management, production, quality assurance, and program protection). Where possible, IPT activities will be conducted via video and teleconference or concurrently with other activities such as program reviews.

The Contractor shall perform tasks associated with Service Support as a component of Service Delivery Management. Service Support encompasses all tasks associated with ensuring users have access to the appropriate AKO-ES services and including but not limited to: Configuration Management of hardware, software, and infrastructure; Change Management of hardware, software, and infrastructure; Release Management; Incident Management; Problem Management; and Asset Management of hardware and software.

The Contractor shall perform tasks associated with Service Delivery as a component of Service Delivery Management. Service Delivery encompasses all tasks associated with delivering services to business users and including but not limited to: Requirements Management; Availability Management; Service Level Management; Test Management;

and IT Service Continuity Management.

3.1.1 Requirement Category 1A: Asset Management

ID Requirement Performance Criteria

1A-01 The Contractor shall support Asset Management, including acceptance of custody and accountability of all PD ES hardware, building 322, and AKO-ES data center Government Furnished Equipment (GFE). The Contractor shall initially assume responsibility for operations and maintenance of the AKO-ES GFE Service Management System that has been customized to support asset

In accordance with Army Regulation Series 710 (Inventory Management) and Series 735 (Property Accountability).

Specifically, the Contractor shall adhere to all asset management

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria inventory and system configuration data management. The Contractor shall also provide advice and assistance on all logistics matters as required including the participation in the design, developing and maintaining of a PD ES asset tracking system.

regulations as specified in AR 710-2, AR 735 -5, DA PAM 710-2-1 and FAR Part 45.

1A-02 The Contractor shall work in concert with the Government and the Government’s third party designee facility manager to identify security flaws that may place assets and the facility in jeopardy of misuse and abuse.

In accordance with Army Regulation Series 710 (Inventory Management) and Series 735 (Property Accountability).

Percentage of full inventory as specified by installation Property Book Officer.

1A-03 Contractor shall conduct a random physical sampling (provided by the Government) of ten percent (10%) of hardware assets and software assets each month under Government supervision.

Compare the asset to the asset description in the Asset Management database and include the sampling results in a Report provided to the Government.

N/A

1A-04 The Contractor shall manage AKO-ES asset transport and shipping operations. Shipping labels and turn-in documents will be coordinated through the Government. The Contractor shall coordinate the packaging, transportation, and distribution of all AKO-ES GFE within and from the PD.

In accordance with Army Regulation Series 710 (Inventory Management) and Series 735 (Property Accountability).

1A-05 Reserved N/A

3.1.2 Requirement Category 1B: Task Order Management

ID Requirement Performance Criteria

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1B-01 The Contractor shall implement and manage a file area, available to all AKO-designees and containing all key Deliverables, working documents, Service Level Objective / Agreement data, other performance data, and other key information. All documents and deliverables required by the Task Order shall be posted to the file area within 24 hours of submission to the AKO Contracting Officer Representative (COR) or revision and approval per AKO feedback.

N/A

1B-02 Contract Funds Status Report (CFSR): The Contractor shall report cost data as applicable to this contract in accordance with the requirements stated herein. All reporting shall correspond to applicable CWBS elements. The Contractor shall reconcile reporting elements in the Contract Funds Status Report (CFSR).

(B001) DI-MGMT-81468, Contract Funds Status Report (CFSR)

N/A

1B-03 The Contractor shall develop and provide a Resource Allocation document for the purpose of mapping named individuals to all requirements in the PWS. This is to be submitted to the COR on a monthly basis.

N/A

3.1.3 Requirement Category 1C: Periodic and Ad-hoc Reporting

ID Requirement Performance Criteria

1C-01 The Contractor shall prepare a Daily Standup Report NLT 1300 each business day for the Government to include both NIPR and SIPR.

IAW Government approved Communications Plan

1C-02 The Contractor shall participate in Weekly Operations briefings to the Government and shall develop an appropriate briefing for those meetings.

IAW Government approved Communications Plan

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1C-03 The Contractor shall participate in Weekly Change Request Approval meetings to the Government and shall develop appropriate content for those meetings.

IAW Government approved Communications Plan

1C-04 The Contractor shall provide and present a monthly Program Management Review (it shall replace the second weekly Operations brief of each month) to PD EC2M management.

IAW Government approved Communications Plan

1C-05 The Contractor shall support AKO and Army ICAM Directory Services ad-hoc data calls and report requests to provide information including, but not limited to, statistical data and analytics that describe general and specific aspects of AKO-ES and Army ICAM Directory Services system operations and performance. Turnaround time dependent on nature and complexity of request.

Upon Government request

1C-06 The Contractor shall support information transfer to the Government on items such as, but not limited to inquiries on technical subjects; software instance counts; hardware maintenance counts;

and collaboration with the Government personnel in system design, flows, and functionality, as requested.

Upon Government Request

3.1.4 Requirement Category 1D: Risk Management and Contingency Planning

ID Requirement Performance Criteria

1D-01 The Contractor shall develop a Risk Management Plan that conforms to best practices and provides visibility into all categories of Project Risk. In support of Risk Management Framework and Accreditation activities.

Annex A-002 Risk Management Plan

N/A

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1D-02 The Contractor shall execute proactive risk mitigation and contingency planning and shall identify techniques to mitigate risks before they occur and contingency plans to reduce their negative effects.

N/A

1D-03 The Contractor shall Maintain a monthly Risk Register in accordance with the Risk Management Guide for DoD Acquisition and provide updates to PD leadership as part of the monthly Program Management Review. The Risk Register shall include the proactive risk mitigation and contingency planning completed by the Contractor.

The Contractor shall also identify the techniques used to mitigate the risks along with contingency plans.

W15QKN-17-F-0006

3.1.5 Requirement Category 1E: Quality Management

1E-01 The Contractor shall execute quality assurance and quality control of all portal releases, Army ICAM Directory Services including changes to EAMS-A and the AMID, deliverables, products, and artifacts. The Contractor shall monitor the effectiveness of their quality system and continually improve the quality processes. The Contractor shall refine, document, and maintain the currency of its Quality Assurance and Quality Control processes and procedures and post such documentation in the Contractor’s Management Files Area.

N/A

3.1.6 Requirement Category 1F: Systems Configuration and Change Management

A change is defined as any addition, modification, or removal to the architecture, hardware, network, software, and configurations of any AKO-ES environment:

Production; Pre-Production External (PPA); Pre-Production Internal (PPI); and administrator workstations or Army ICAM Directory Services including changes to EAMS-A and the AMID environments.

ID Requirement Performance Criteria

1F-01 The Contractor shall update, maintain, and execute the System Configuration and Change Management processes and procedures and include such processes in a System Configuration and Change Management Plan delivered to the Government for review and approval.

Annex A-016 System Configuration and Change Management Plan

N/A

1F-02 The Contractor shall prepare System Change Requests and Service Change Requests (in a Government approved template), including project

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria plans and timelines, for each change and shall participate in review and discussion as a part of the weekly Government led Change Approval Board meeting. The Government shall approve all changes, change extensions and CR closeouts for the system.

1F-03 The Contractor shall ensure all Change Requests that affect a change to the software baseline, hardware baseline, hardware configuration, hardware location, Operational Views, System Views or data flows are properly updated in the Configuration Management Documentation prior to closing the CR. Updates must also be made to the Remedy Database prior to closing the CR. All such changes will be communicated to the Government via the Change Management process for inclusion into the CMDB, including custom software version updates, such as scripts or policy changes.

N/A

1F-04 The Contractor shall provide qualified network, security, and engineering resources in support of the appropriate Change Review (CR) body for the purpose of evaluating the technical approach, impacts, feasibility, risk, alternatives, security and Certification & Accreditation requirements.

100% attendance in all AKO-directed Change Review meetings

1F-05 The Contractor shall administer the flow of System Change documentation between the various change review and control bodies, change requestors, and other participants in the change review and control processes; this includes administering the flow of requests (1) rejected, (2) deferred, (3) returned for more information, (4) approved, and (5) approved with conditions.

N/A

1F-06 The Contractor shall coordinate and execute a System Change Request Impact Assessment for any System Change Request when so requested

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria by the Government. Specifically, the Contractor shall provide written advice and recommendations regarding the impact of changes to the network infrastructure to the originators of System Change Requests, including participation by Network Engineering and Security specialists in the weekly change review board meetings.

1F-07 The Contractor shall maintain a plan for implementing changes or patches, to be approved by the Government, with particular focus on minimizing negative impact of the change on the End User.

N/A

1F-08 The Contractor shall conduct post-implementation assessments and shall report findings and recommendations to the Government in the weekly Change Review (CR) board meeting. Upon concurrence of the Government and Contractor, the CR shall be closed with any system hardware or software changes communicated to the Government for inclusion into the CMDB.

N/A

1F-09 The Contractor shall create and maintain a software baseline for each AKO-ES and Army ICAM Directory Services including EAMS-A and the AMID hardware asset, both physical and virtual, to be updated monthly and assist the Government with any requests for license counting.

Updated monthly

1F-10 The Contractor shall ensure that no changes are made, within their control, to any AKO-ES and Army ICAM Directory Services including changes to EAMS-A and the AMID environments (e.g., production, development, and test) until Government approval is obtained.

Software license availability must be verified by the

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

Government Project Management Office (PMO).

Any additional changes made outside Contractor control are to be reported when identified.

1F-11 The Contractor shall create, populate, and maintain the Configuration and Change Management System Baseline with all Tasks, System Baseline Artifacts, Architecture Drawings, Hardware lists, and Software baseline to document changes to the system as they are updated over time. Government must have access to the data at all times.

Updated as changes are incorporated

3.1.7 Requirement Category 1G: Incident and Problem Management

ID Requirement Performance Criteria

1G-01 The Contractor shall refine and maintain the currency of the Incident Management processes and procedures and include such processes in an Incident and Problem Management Plan posted on AKO-ES and Army ICAM Directory Services including changes to EAMS-A and the AMID for Government review.

Annex A-015 Incident and Problem Management Plan

N/A

1G-02 The Contractor shall execute Incident and Problem Management for all AKO-ES and Army ICAM Directory Services including changes to EAMS-A and the AMID incidents and outages in accordance with best practices, DoD/Army policy and the AKO or Army ICAM Directory Services-approved Incident and Problem Management Plan.

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1G-03 The Contractor shall deliver an Information Special Outage (INFOSPOT) report to the Government for one- time security violations, and minor incidents and outages that do not affect customers and do not persist.

IAW Government approved Communications Plan

1G-04 The Contractor shall deliver an Executive Summary (EXSUM) for all AKO and Army ICAM Directory Services including EAMS-A and the AMID major incidents that occur during business hours, outages, service degradations, or other applicable events. The EXSUM shall use a Government approved template/form. EXSUMs shall be submitted at the mark of an event, with an updated, and then daily until resolved to the mutual agreement of the Government and the Contractor.

IAW Government approved Communications Plan

1G-05 The Contractor shall provide an After Action Report (AAR), in a format approved by the Government, describing the root cause and remediation identified for each incident, outage, service degradation, or other applicable event.

IAW Government approved Communications Plan

1G-06 The Contractor shall ensure all incident management activities are centrally managed through the Continuous Operations and Management Center (COMC), and perform classification of all incidents.

N/A

1G-07 RESERVED N/A

1G-08 The Contractor shall develop knowledge articles to support tickets being resolved through the Army Enterprise Service Desk.

IAW Government Approved Communications Plan

3.1.8 Requirement Category 1H: Availability Management

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1H-01 AKO will continue to monitor and report on the LDAP 1.0 as long as GFE is available and functional.

1H-02 The Contractor shall perform analysis to determine the root cause of availability that fails to meet Service Level Agreements (SLA) requirements and shall report root cause and recommended remediation to the PD EC2M management in the monthly Program Management Review, if required.

N/A

3.1.9 Requirement Category 1I: System Administration and Maintenance

ID Requirement Performance Criteria

1I-01 The Contractor shall implement account management processes to allow and/or deny access to all AKO-ES and Army ICAM Directory Services including EAMS-A and the AMID systems for AKO-ES Army ICAM Directory Services including EAMS-A and the AMID (including third party contractors) and Contractor staff.

Provision local accounts and Submit account request as needed within 24 hours of arrival. Suspend access with 15 minutes of departure.

1I-02 In accordance with AR 25-1, the Contractor shall ensure inactive but authorized user application accounts are disabled. Inactive users mean the account is not used within the last 30 calendar days or no longer needed.

N/A

1I-03 Moved to Task 4A N/A

1I-04 Moved to Task 4A N/A

1I-05 RESERVED N/A

1I-06 The Contractor shall notify the third party software or hardware maintenance provider for all service issues that cannot be resolved by the application administration team or Continuous Operations and Management Center (COMC). In accordance with the Government - approved Incident and Problem

W15QKN-17-F-0006

Version 1.8.

Management Plan.

3.1.10 Requirement Category 1J: Continuity of Operations and Disaster Recovery

1J-01 The Contractor shall develop and maintain a Continuity of Operations Plan (COOP) in accordance with AR 500-3 and DoD 8500-2 that includes but is not limited to load balancing, replication, failover procedures, roles and responsibilities, staffing, in the event Identity and Access Management (ICAM) is inoperable at the primary site. The Contractor shall maintain the plan in a manner that provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event, with minimal loss of operational continuity.

Annex A-014 Continuity of Operations Plan

(COOP)

N/A

1J-02 The Contractor shall develop and maintain a Disaster Recovery Plan in the event of a catastrophe at the Primary facility. The plan should include all steps necessary to reconstitute the alternate facility with minimal services required to access the portal, conduct password resets, access files, and continue ICAM services.

Annex A-013 Disaster Recovery Plan

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1J-03 The Contractor shall manage backup copies of the application software at an AKO-provided location such that the software media is not collocated with operational software. The Contractor shall establish procedures to assure the backup and restoration of the system in accordance with DOD and Army policy. Contractor shall accomplish the same for backup tasks for Army ICAM Directory Services including changes to EAMS-A and the

AMID

N/A

1J-04 For ICAM and supporting services, the Contractor shall manage data replication between installations such that the total loss of one (1) installation will result in the minimal loss of data. In accordance with the Army ICAM Directory Services COOP.

N/A

1J-05 The Contractor shall demonstrate an ICAM COOP capability by successfully conducting a failover and reconstitution exercise at least every six (6) months (semi-annually).

Every six (6) months

1J-06 The Contractor shall provide a COOP results report in accordance with the Government approved Communications Plan.

Submitted within three

(3) days of completion of a COOP exercise; IAW Government Approved Communications Plan

3.1.11 Requirement Category 1K: Technology Refresh

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1K-01 The Contractor shall participate in meetings and reviews of new technologies and architectures to assess and provide expert opinions regarding the feasibility and risk associated with the introduction of new technology or architectures into the infrastructure.

N/A

1K-02 RESERVED N/A

1K-03 RESERVED N/A

1K-04 RESERVED N/A

1K-05 RESERVED N/A

W15QKN-17-F-0006

3.1.12 Requirement Category 1L: Personnel In/Out processing

1L-01 The Contractor shall execute the New Personnel in-processing process for eligible AKO and Army ICAM Directory Services and Contract employees working at the AKO Army ICAM Directory Services sites. In accordance with all applicable Army regulations, including Series 725 (Requisition and Issue of Supplies and Equipment) and Series 735 (Property Accountability).

N/A

1L-02 The Contractor shall enable network connectivity for new personnel and shall ensure compliance with applicable Security training requirements.

N/A

1L-03 The Contractor shall enable cryptographic network login with GFE Common Access Card (CAC) for new employees.

N/A

1L-04 The Contractor shall create new system access accounts as appropriate to the specific personnel requirements and shall ensure compliance with applicable Security training requirements.

N/A

1L-05 The Contractor shall support the Asset Manager in inventorying desktop/laptop assets and associated peripherals received from Departing Employees, in accordance with Army regulation Series 725 (Requisition and Issue of Supplies and Equipment) and Series 735 (Property Accountability).

N/A

1L-06 The Contractor shall support the Asset Manager in formatting/degaussing storage media, in accordance with Army regulations. In accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization), and DoD Directive 5220.22

(NISPOM).

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

1L-07 The Contractor shall implement an employee verification process, to include sub-contractors, whether through background checks or other similar processes and provide a written response explaining how the verification process was completed and attest to the trustworthiness of the workforce.

(B003) DI-MGMT-80934, Operations Security (OPSEC) Plan

Within 45 calendar days after contract award

3.1.13 Requirement Category 1M: Third (3rd) Party Support

ID Requirement Performance Criteria

1M-01 The Contractor shall provide any required documentation for national background checks for on-site technicians, in compliance with Army policies.

N/A

1M-02 The Contractor shall provide the necessary documentation and support to facilitate physical access to PD spaces by on-site technicians, including: (1) issuing access badges; (2) obtaining initial facility access; and (3) renewals, as required.

1M-03 The Contractor shall coordinate with the End User or other site staff to schedule onsite technical support visits in response to an escalated incident or service request.

W15QKN-17-F-0006

3.2 Task 2 – Identity, Certificate and Access Management (ICAM) Operation and maintenance of the AKO-ES ICAM solution is comprised of Lightweight Directory Access Protocol (LDAP), and the Data Sharing Initiative (DSI) and supporting services.

Hours of operation shall be:

1. ICAM service - 24x7x365

2. Emergency Support for service degradation or failure – 24x7x365 on-call

The core capabilities of the ICAM solution need to be supported out of the AKO-ES Primary data center and the PD ALTESS data center. PD ALTESS data center will provide the COOP capabilities for ICAM. The Contractor is responsible for managing the ICAM applications on the PD ALTESS systems only. ICAM applications operating on the PD ALTESS servers need to be maintained in conjunction with the applications operating on the AKO-ES servers, to ensure a seamless COOP capability.

3.2.1 Requirement Category 2A: Identity and Access Management Support

The Identity Management service is used to authenticate access to the AKO-ES Portal and approximately 600 External applications. With the AKO’s LDAP directory as its user store, authenticates valid users and allows these users access to all protected resources. Identity management eliminates the need for applications to manage a separate registration process; instead, all registration and verification of users is done at the enterprise level.

The Contractor shall perform tasks such as:

1. Creating customer IDs

2. Creating site administrators for new customers

3. Resetting passwords for site administrators

4. Helping customers migrate to, or onboard with SSO

5. Assist with site testing for customers Assisting with diagnosing and correcting customer site and user issues

6. Answering second level support questions for SSO customers and users

7. Creating LDAP Server IDs for LDAP customers

8. Provide engineering support for LDAP customers

9. Assist with the systems interface agreement (SIA) process, policies and procedures

10. Creating internal and external documentation for end-users of EAMS-A

STRACTCOMS and customer specific documentation

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

2A-01 The Contractor shall support the - Army ICAM Directory Services, to include EAMS-A and AMID for all internal and external ICAM customers (i.e.

Army and DoD applications that utilize identity and authentication services).

N/A

2A-02 The Contractor shall assist with the systems interface agreement (SIA) process, policies and procedures

N/A

2A-03 The Contractor shall provide customer support for all SSO application owners.

N/A

2A-04 The Contractor shall provide Service Now support for Agreements between third parties and EC2M.

N/A

2A-05 RESERVED N/A

2A-06 RESERVED N/A

2A-07 RESERVED N/A

2A-08 RESERVED N/A

2A-09 RESERVED N/A

2A-10 RESERVED N/A

3.2.2 Requirement Category 2B: Lightweight Directory Access Protocol (LDAP) Operate and maintain the Army Master Identity Directory (AMID) data store for AKO-ES user credentials, preferences and other commonly accessed information. The solution delivers user-management infrastructure for AKO-ES that allows management of a high volume of user information such as address, phone and e-mail information.

ID Requirement Performance Criteria

2B-01 The Contractor shall operate, maintain, and monitor the AMID service in support of all DoD customers and external LDAP customers.

As specified in SLA 2-2, as outlined in the Task Order QASP

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

2B-02 The Contractor shall operate and maintain the Army ICAM, Directory services to include EAMS-A and AMID reconciliation process. Conduct reconciliation with Enterprise Directory Database (EDD) once daily, Monday through Friday.

N/A

2B-03 The Contractor shall operate and maintain the Global Directory Service (GDS) LDAP consumer servers. Operations include maintaining server uptime and replication agreements with GDS replication hubs.

N/A

2B-04 The Contractor shall modify the existing LDAP attribute set to accommodate Army ICAM Directory Services approved requirements (e.g., for identifying unique or specific user population profile attributes).

Modify LDAP to accept new attribute(s) within one (1) business day after an actionable request.

2B-05 The Contractor shall enroll, implement/register, and support External LDAP application customers.

Enrollment, implementation, and registration completed within 48 hours after an actionable request.

2B-06 The Contractor shall perform an ongoing audit and review of existing external LDAP applications for compliance of accreditation, memoranda of agreement, and enrollment process.

N/A

2B-07 The Contractor shall perform capacity management to optimize performance of the LDAP application for Internal and External Users.

N/A

2B-08 The Contractor shall modify the LDAP to support all DoD services as follows: Day to day monitoring schema changes; patching on a regular cycle (quarterly) to both operating system and/or applications; continuously changing configuration to maximize stability and performance. Requests for schema changes from CI's or other, will be approved by the Government

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

2B-09 The Contractor shall deliver the LDAP Operations Document.

Annex A-008 LDAP Operations Document

N/A

2B-10 The Contractor shall execute hardware technology refresh and application updates and upgrades as specified by the Government. It is anticipated that hardware refresh will occur at 20% per year.

Application updates are dependent upon the software vendor.

W15QKN-17-F-0006

Version 1.8.

3.2.3 Requirement Category 2C: Extract, Transform and Load (ETL) Support The Contractor shall operate and maintain the ETL process for reconciliation of data.

The Contractor will ensure agreements are in place with DoD authoritative sources to pull data needed to populate the Directory Database and LDAP.

ID Requirement Performance Criteria

2C-01 The Contractor shall operate, maintain, and monitor the ETL data warehouse and support the import and reconciliation of data from multiple sources into the AKO and or Army ICAM Directory Services to include EAMS-A and AMID LDAP.

N/A

2C-02 The Contractor shall support the ongoing collection, reformatting, consolidation, warehousing, and presentation of various data sources including data extraction, transformation, and load procedures.

N/A

2C-03 The Contractor shall maintain the interface to the various internal and external ETL data sources for AKO-ES and Army ICAM Directory Services to include EAMS-A and AMID.

N/A

2C-04 The Contractor shall manage the processes for designating account types based on identity data, and individual attributes.

N/A

2C-05 RESERVED N/A

2C-06 The Contractor shall manage and maintain the implementation of data transfer methodologies (Including but not limited to S-FTP, ETL, XML, web services) used to aggregate data in the AKO-ES and Army ICAM Directory Services to include EAMS-A and AMID ETL.

N/A

2C-07 The Contractor shall enable/control access to identify management data through web services to the enterprise Service Orientated Architecture (SOA) foundation.

N/A

2C-08 For potential upgrades to data requirements, the Contractor shall identify data sources and

Upon Government request

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria recommend data transfer methodologies to the PL EC2M management.

2C-09 The Contractor shall, on as an-needed basis, support the development of Memoranda of Agreement between AKO and Army ICAM Directory Services to include EAMS-A and AMID and authoritative source database owners and shall advise PL EC2M management on technical and non-technical considerations. Upon AKO request.

N/A

2C-10 The Contractor shall execute nightly updates to the DSI warehouse ETL by identifying changes to source records from within the data center environment, pulling the changes, and pushing them to the LDAP and Groups applications.

N/A

2C-11 The Contractor shall modify existing interfaces to allow for extraction of new attributes, as needed.

N/A

2C-12 The Contractor shall support the Enterprise Data Directory (EDD) and its back end database.

N/A

2C-13 The Contractor shall maintain certification of the repository for the purpose of storing Personally Identifiable Information (PII).

N/A

2C-14 The Contractor shall attend appropriate Change Review and Change Control meetings when requested by the PL EC2M management.

N/A

2C-15 The Contractor shall support and maintain a requirements management process during any addition or modification of attributes and data sources.

N/A

2C-16 The Contractor shall coordinate, interface with, and maintain external data sources in response to changes in source data and changes in requirements to data sources.

Within one (1) business day of change in source data or change in requirements

W15QKN-17-F-0006

Version 1.8.

ID Requirement Performance Criteria

2C-17 The Contractor shall update and maintain the ETL Operations Document.

Annex A-007 ETL Operations Document

2C-18 RESERVED N/A

W15QKN-17-F-0006

Version 1.8.

3.3 Task 3 –Operations and Maintenance

The Contractor shall provide remote server, application, and database maintenance support: Including but not limited to include patching, IAVA compliance, and updates.

The Contractor shall provide network and domain management.

The Contractor shall manage, operate, maintain, monitor, troubleshoot and support the specified networks and their component parts including but not limited to: routers;

firewalls; servers; switches; network devices; IPNs; load balancers; subnets; Virtual LANs; routing tables; workstations. The Contractor shall track and allocate IP addresses, interface with Theater Regional Cyber Centers (RCCs) as necessary and develop and maintain required documentation.

The Contractor shall maintain custom scripts, stored procedures, middleware, interface logic code and subroutines used for reporting, integration, interface control, and network process automation.

The Contractor shall assist AKO in the periodic review of the as-is network architecture and make recommendations as to changes to the network architecture in areas including but not limited to, compliance, vulnerability mitigation, and performance improvement. The Contractor shall perform end-to-end monitoring of devices, bandwidth capacity, internal and external device interfaces, AKO-ES circuits, configurations, and configuration state changes.

The Contractor shall monitor WAN performance and interface with Army and theater Network Operations and Security Centers (NOSCs) to investigate network outages and performance issues. The Contractor shall log and track network incidents, system failures, vulnerabilities, and performance issues.

The Contractor shall maintain circuit availability to ensure data replication across all AKO-ES sites. The Contractor shall monitor circuit performance and advise the Government on rising or falling circuit requirements to maintain appropriate best sizing for economic and performance purposes.

The scope of Production Network Management includes devices and network infrastructure on the Production networks which include:

a. NIPRNet

b. SIPRNet

c. SunRay Network – NIPR

d. SunRay Network – SIPR

e. Pre-production Internal (PPI)

The Contractor shall maintain the Network availability – 24x7x365 with Emergency support for service degradation or failure – On-Call.

W15QKN-17-F-0006

Version 1.8.

3.3.1 Requirement Category 3A: Network Operations

The Contractor shall manage, operate, monitor, troubleshoot and support the specified networks and their component parts including but not limited to routers; firewalls;

servers; switches; network devices; IPNs; remote access; load balancers; subnets;

Virtual LANs; routing tables; workstations. The Contractor shall track and allocate IP addresses, interface with Theater Regional Cyber Centers (RCCs) as necessary and develop and maintain required documentation.

ID Requirement Performance Criteria

3A-01 The Contractor shall update and maintain the Network Operations Document.

Annex A-003 Network Operations Document

Updated Table of Contents

3A-02 The Contractor shall manage, configure and monitor all network devices including, but are not limited to firewalls, routers, switches, bulk encryptors, load balancers, DNS Servers – Internal and External.

Implement network changes within 72 calendar hours of…