G-4 ITKM PWS - 20191205 DRAFT.docx

Performance Work Statement (PWS) Information Technology and Knowledge Management Support Office of the Deputy Chief of Staff (ODCS), G-4 1 February 2020

1.0 Scope

This PWS defines the requirements for contractor-provided services necessary to support the ODCS, G-4. The contractor shall support all Internal IT and Knowledge Management functions to include the following: Information Technology (IT) Helpdesk, computer systems, operating systems and all application software loads, hardware, database management, customer support services and activities, telecommunications and telecommunication services, audio and video services, graphic design and support, facility management and operations, and the overarching systems enterprise architecture and its sub- components. The contractor shall also provide metrics, continuous improvement, strategic planning, training, requirement analysis, IT operations and management, configuration management, performance monitoring activities, continuity of operations planning, business systems management, video teleconferencing (VTC), information assurance (IA), knowledge management (KM), KM program development and sustainment, content management, and change management.

1.1 General

The ODCS, G-4 is a joint-capable logistics organization, charged to enhance soldier logistics readiness by providing integrated policies and programs to maintain a ready Army that can be sustained in the joint operating environment. Acting with unity of effort in the planning and execution of logistics across the joint operations area, ODCS, G-4 ensures that the Army (Active, National Guard, and Reserve) is properly equipped, maintained and sustained in order to achieve U.S. national objectives. In order to accomplish this task, massive amounts of information must be presented and shared properly to decision-makers who allocate resources and make informed decisions about our Army and Nation’s future on a daily basis. Action officers at all levels throughout the Army must share and manage this information and knowledge in efficient and productive ways.

1.2 Period of Performance

The period of performance (PoP) shall be twelve (12) months from the date of award with one (1) four-month (4) extension.

1.3 Place of Performance

Performance will take place at the Pentagon, Washington D.C., the Defense Distribution, Susquehanna, PA (DDSP), and Fort Belvoir, VA. All references to ODCS, G-4 written in this PWS include each of these places of performance unless otherwise specified.

1.4 Hours of Operation

The contractor is responsible for conducting IT and KM support and services as defined in this PWS at the Pentagon, the DDSP and Fort Belvoir, VA, except on recognized U.S. holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. The core hours of operation for IT and KM support shall be covered between 0900 and 1500, Monday through Friday. Operational hours are subject to the local policy at each place of performance and may require coverage from 0600 -1800. The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. Additionally, support of G-4 senior personnel may require on-call and weekend support. The contractors shall follow the Office of Personnel Management (OPM) or local guidance during emergencies. Telecommuting is not authorized unless specifically identified under Paragraph 3.0.

1.5 Recognized Holidays

The following are recognized U.S. holidays. The contractor shall not perform services on these days unless otherwise specified in Paragraph 1.4 or elsewhere in this PWS:

- Memorial Day: Last Monday in May

- Independence Day: July 4th

- Labor Day: First Monday in September

- Columbus Day: Second Monday in October

- Veteran’s Day: November 11th

- Thanksgiving Day: Fourth Thursday in November

- Christmas Day: December 25th

1.6 Contract Management

1.6.1. Contractor’s Progress, Status, and Management Report

This contract shall be addressed in the Contractor’s Progress, Status and Management Report, in accordance with DI-MGMT-80227, CDRL A001 applicable to this contract.

The contractor shall report the following cost data in accordance with CDRL A001:

a. Each Cost Contract Line Item (CLIN) will have expenditures for the reporting period by travel, material, and Other Direct Costs (ODC).

b. Materials costs and ODCs shall be identified by type, and vendor (as applicable), (as) discussed.

c. Total task expenditures for the fiscal year to date; indicated as total, labor, materials, and ODCs.

d. Total task expenditures since contract award; indicated as total, labor, materials, and ODCs.

e. Status of all deliverables located in the PWS Technical Exhibit 3

1.7 Government Furnished Equipment / Management / Facilities

1.7.1. All work will be performed at the Government’s site or designated locations. On- site contractor personnel working at Government facilities shall be provided work space and support equipment required for job performance. The government will provide computers, Secret Internet Protocol Router (SIPR) Network and Non-secure Internet Protocol Router (NIPR) Network and Internet access, dedicated telephones, and unclassified and classified copier access.

1.7.2. The Government will provide access to past studies and analyses, necessary plans, current data on forces, organization and structure designs, and information on current and future government programs. Contractor shall sign non-disclosure agreements as appropriate for assigned tasks. Additionally, the Government will authorize Common Access Cards (CAC) and access to all necessary locations and facilities.

1.8 Inspection and Acceptance / Free on Board (FOB)

1.8.1 Inspection and acceptance shall be at destination and FOB shall be destination. In addition, soft copies of all invoices, CDRLs, and travel details when not available in Wide Area Work Flow (WAWF) will be sent to Contracting Officer’s Representative (COR) and the Contract Management Officer (CMO), DoDAAC W90P20 will be used for WAWF.

1.8.2. Alternate destination and/or ship to address are as follows: Headquarters, Department of the Army, Office of the Deputy Chief of Staff, G-4, Attn: Contracting Officer’s Representative (COR), Room 1D343-242, 500 Army Pentagon, Washington, D.C. 20310-0500.

1.9 Security. The security requirements for this effort are defined in the DD254, as an attachment to the basic contract.

1.9.1 Security Clearance and Other Access Requirements

All personnel requiring SCI, Top Secret or IT-I access under this contract/order shall undergo a favorably adjudicated Tier 5 investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. The Tier 5 shall be maintained current within 6-years and requests for Tier 5 reinvestigation shall be initiated prior to the 6-year anniversary date of the previous Tier 5 investigation.

All personnel requiring Secret access under this contract shall undergo a favorably adjudicated Tier 3 investigation (formerly known as a National Agency Check, Local Agency Check and Credit Check, or Access National Agency Check and Inquiries) as a minimum investigation. The Tier 3 Investigation shall be maintained current within 10-years and requests for Secret Periodic Reinvestigations shall be initiated by submitting a Tier 3 reinvestigation prior to the 10-year anniversary date of the previous Tier 3 investigation.

Contractor personnel that do not meet the investigation requirements for Privileged IT1 access may be granted interim access by the G-4 ISSM provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated.

The Personnel Security Specialist assigned to the organization in which the contractor shall be working shall initiate a Tier 5 Electronic Questionnaire for Investigation Processing of which fingerprints shall be required. If the contractor has an adjudicated Tier 3 investigation, upon completion of the Tier 5 review and fingerprint results from the Federal Bureau of Investigation, the individual may be granted Interim eligibility/IT1 access if no disqualifying information is identified. If the individual has never had an investigation, then the National Agency Check and fingerprints must be completed prior to Personnel Security granting Interim eligibility/ IT1 provided all other conditions are met. Contract personnel found ineligible for Interim IT1 shall not be allowed to support a G-4 contract requiring IT1 access nor shall the Tier 5 Investigation move forward.

1.9.2 Physical Security

The contractor shall ensure the safeguarding of all government property provided for contractor use in accordance with AR 190-16 Physical Security. At the close of each work period (as defined in Paragraph 1.4 of this PWS), Government facilities, equipment, and materials shall be secured under Government control. The contractors will be provided security badges in accordance with the DCS, G-4 policy. The GTL will assist as needed in processing security badge request. The contractor shall comply with the security requirements at each location specified in the PWS and obtain all necessary passes, badges, or other items required for access to perform contract services. The contractor shall comply with all policies regarding entry to the installation, rules of the road, contingency operations compliance, and photography prohibitions. Contractor employees are authorized entry to the installation only for the purpose of work under this contract, and are not authorized in other facilities or areas without prior Government authorization.

1.9.3 Key Control

The contractor shall establish and implement methods of making sure all keys/key cards (to include the CAC) issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards and CAC. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in its Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the COR or GPM or GTL.

In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the COR or GPM or GTL, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

The contractor shall prohibit the use of Government issued keys/key cards/CAC by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR or GPM or GTL.

1.10 Post-Award Conference/Periodic Progress Meetings

The contractor shall attend a post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The conference shall be conducted at the Pentagon. The meeting shall provide an introduction between the contractor personnel and Government personnel who shall be involved with the contract. The meeting shall provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures. The meeting shall take place no later than ten days after the contract is awarded. The Contracting Officer, and/or the COR, GPM, GTL, and other Government personnel, as appropriate, may schedule periodic conference calls with the contractor to review the contractor's performance. At these conference calls, the contractor shall notify the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

1.11 Program Management Plan

Prepare Program Management Plan (PMP). The contractor’s PM shall prepare and deliver a PMP to identify the planned approach for accomplishing the tasks identified in the performance work statement. The plan requires COR concurrence and shall provide sufficient detail to satisfy management, personnel, and technical planning will accomplish this performance work statement. Government COR concurrence of the plan will occur within 30 days of receipt of contract award.

The contractor’s Program Manager shall provide a Weekly Activity Report to the COR. Each report shall include, as a minimum, a summary of the work accomplished during the reporting period, work to be accomplished during the following reporting period and activities planned for the following reporting period. The report shall include an accounting of contractor personnel by name, the specific level of support requested, actions taken, and resolutions or accomplishments during the week. Actions taken should include trips, meetings, and conferences attended. The reports shall also contain problems encountered, actions required to solve the problems, and identify issues that require government intervention. The contractor’s Program Manager, the government’s Program Manager, and the COR will meet no less than monthly to discuss progress of the PMP supporting the successful accomplishment of the plan.

2.0 Applicable Documents

The contractor shall comply with all applicable Department of Defense (DoD), Army regulations, and other guidance including, but not limited to, the documents and publications listed below.

The web address for the publications listed is:

DoD directives: https://www.esd.whs.mil/DD/

Army publications: http://www.army.mil/usapa/

Cybersecurity Policy and Guidance: https://login.milsuite.mil/?goto=https%3A%2F%2Fwww.milsuite.mil%3A443%2Fwiki%2FPortal%3AArmy_Information_Assurance%2FPolicy_and_guidance

3.0 General Requirements

The contractor shall provide the necessary support and resources to accomplish the tasks specified in this PWS. Services include IT and KM services to approximately 500 personnel.

Contractor personnel performing services under this contract shall be controlled, directed, and supervised at all times by management personnel of the contractor. The contractor's management shall ensure that employees properly comply with the performance standards outlined in this PWS and as required by the Contracting Officer or the COR. Contractor personnel shall perform independent of and without the supervision of any Government official upon receipt of prioritized requirements from the GPM or GTL. Actions of contractor employees may not be interpreted or implemented in any manner that results in any contractor creating or modifying Federal policy, obligating the appropriated funds of the U.S. Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government shall control access to the Government facility and shall perform the inspection and acceptance of completed work and efforts.

Note: The Government intends to fully fund these PWS requirements. However, the restraints of today’s Defense budget may dictate that one or more tasks are not funded. The Government may or may not provide advanced notice of any tasks that are no longer required or those that must be terminated due to the lack of funds or mission change.

3.1 IT Operations. Capture, record, analyze, and report to the Government selected metrics in each functional area which identify workloads, process efficiency, effectiveness, trends, and other factors.

3.1.1. Ensure processes and procedures are in place to notify service provider Customer Care of failures, utilizing trouble tickets, to facilitate the uninterrupted operations of G-4 automated hardware and software services. The contractor shall ensure the integration of service provider procedures, policies, software, and hardware and develop an implementation plan within the G-4. Also required is the rigorous application and integration of the Chief Information Officer (CIO)/G-6 information security/information assurance policies, principles, and practices.

3.1.2. Provide support to G-4 Information Management Officer (IMO) with managing the creation, maintenance, and deletion of all G-4 unclassified/classified local area network and e-mail accounts using Active Directory or User Account Registry (UAR) Systems keeping requestors updated weekly and in cases where delays occur.

3.1.2.1. Validate, request, and maintain license tracking for Commercial Off-the-Shelf (COTS) and Army-owned software and hardware as defined on the Army service provider Customer Care approved software and hardware list, which requires management on a daily basis. The list is provided by service provider to the IMO for contractor utilization.

3.1.2.2. The contractor shall provide "trouble-shooting" services regarding hardware/software problems, recommending a solution to the IMO if impacts affect more than one user or cannot be determined by service provider Customer Care.

3.1.3. Provide triage of IT incident reports regarding hardware/software problems, recommending a solution to the IMO if impacts affect more than one user or cannot be determined by service provider Customer Care.

3.1.4. Develop and maintain a structured management practice to monitor consumption of printer and copier consumables and facilitate the ordering process to ensure adequate stock levels of a 30 day supply to prevent equipment outages due to consumable shortfall.

3.1.5. Develop and maintain on-line distribution lists of the G-4 organization, data repositories and references located within G-4 network locations. Provide timely distribution of alerts from service provider and periodic informational messages within 4 hours of receipt to ensure the G-4 is immediately informed.

3.1.6. Assist the IMO and the G-4 Property Book Officer (PBO) with property responsibility in accordance with the G-4 IT hand receipts, G-4 property accountability guidance, and Army Regulation (AR) 735-5.

3.1.7. Develop hardware and software fielding plans for IT life-cycle replacements, to include overseeing the installation of and user training for hardware and software in ODCS, G-4, as directed by the IMO based on notification from service provider. The contractor shall complete a minimum of 20 installs per day unless otherwise approved in advance by the IMO.

3.1.8. Track and inventory Public Key Infrastructure (PKI) Tokens, IT equipment age and condition, and develop and maintain a program for life cycle replacements, as directed by the IMO based on the annual notification list from service provider.

3.1.9. In coordination with the G-4 Records Manager, manage the storage, protection, organization, retention, and disposal of electronic records in accordance with AR 25- 1 and AR 25-2 weekly.

3.1.10. Provide daily adjunct IT and audio visual support for conference room equipment when the IMO notifies the contractor that service provider Customer Care VTC personnel are not available.

3.1.11. Relocate desktop unclassified and classified workstations and complete installation within three hours of G-4 Very Important People (VIP) users and eight hours of a Non-VIP user requests.

3.1.12. Disseminate information to the G-4 staff that impacts user’s IT capabilities. Annotate and maintain a weekly electronic record of all IT degradation issues.

3.1.13. Examine and provide technical analysis on business processes and applications in support of any internal realignment and restructuring activities impacting the ODCS, G-4 IMO. Provide recommendations to G-4 IMO on process improvements to streamline G-4 IT operations and provide enhanced technical capabilities.

3.1.14. Maintain and operate the G-4’s Hardware/Software infrastructure configuration at a state-of-the-art level, considering cost and reliability. Perform market research to maintain an awareness and knowledge of new technologies. Continually and routinely analyze and evaluate off-the-shelf software, hardware and peripherals for applicability and improvement of the G-4’s Windows Servers, Windows workstations in accordance with the G-4’s Information Technology Strategic Plan (ITSP). This analysis and evaluation may include, but is not limited to:

• Product evaluation to improve performance

• Recommended solutions in response to users' requirements

• Written evaluations

• Recommendations for system evolution and modernization. Advise G-4 when network redesign would significantly improve network performance.

· Recommendations shall include a high-level description of the recommended redesign and an analysis of the advantages and disadvantages of the redesign, including interoperability with Army Automated Information Systems, security, cost, reliability, speed, downtime, etc.

• Assessments of the impact of new products on current configurations and services

3.1.15. Implement designated authentication techniques for access to Army systems, which include PKI / CAC, Army Knowledge Online (AKO) authentication, or AKO Single Sign-On (SSO).

3.1.16. Develop and implement appropriate procedural documents in the form of guidance statements, manuals, and IT desktop Standard Operating Procedures (SOPs) as necessary to implement approved IT policies in accordance with higher headquarters guidance and existing laws and maintained annually.

3.1.17. Product Integration. Operate, maintain, and upgrade the suite of servers and workstation hardware and software now in use at the G-4 location at the DDSP. G-4 anticipates upgrading approximately one-fourth of its workstations and servers each year.

3.1.17.1. Upon receipt of new hardware, perform all tasks associated with initial inspection, movement, installation of software, placement, installation of new equipment, quality testing after installation, and coordinate with the G-4 PBO for accountability with the proper disposal or relocation of old equipment.

3.1.17.2. Maintain a listing of IT equipment specifications to provide a basis for life-cycle replacement during monthly In-Progress Reviews (IPR).

3.1.18. Desktop Hardware Standardization. As part of the ITSP, the contractor shall be responsible for the Desktop Standardization Requirement. All changes to the hardware environment must be documented in the User’s Manual and the Trusted Facilities Manual (TFM).

3.1.19. Desktop Software Standardization. As part of the ISTP, prepare materials necessary for release of software loads and updates to end-users. All changes to the software environment must be documented in the User’s Manual and the TFM. Copies of the latest baseline images and applications will be retained in the software safe.

3.1.20. PKI and CAC Implementation. Support the PKI Trusted Agent in administering PKI and CAC on Army systems.

3.1.21. Hardware and Software Test and Evaluation. Conduct quality assurance tests on any new desktop installations as well as initial troubleshooting procedures on all defective servers and workstations. If the repair requires the replacement of parts, notify the IMO and PBO and remove the defective equipment. Tag excess equipment and return to the PBO. The tag will identify the manufacturer, the manufacturer’s model, the manufacturer’s serial number, and the condition code. Maintain the server consolidation list and support the Army Data Center Consolidation command plan.

3.1.22. Software Product Evaluation and Implementation. Maintain current information processes and communications services, including installing and testing regular workstation and server upgrades, drivers, and patches. All products developed or purchased (i.e. COTS) for release to the organization must undergo user acceptance testing with a validation test plan. Feature and data elements of the product must be identified in the test plan as well as a list of the specific names of users designated to test the product. All tests must include all operating systems and types of personal computers within G-4 and be in accordance with approved Army standards. Any changes to the defined platform baselines will be documented and approved by the Configuration Control Board prior to deployment.

3.1.23. Help Desk Support. Establish and operate a G-4 Help Desk to provide technical assistance to G-4 users.

3.2. Configuration Management (CM). Provide input to a CM plan meeting the CIO/G-6 and service provider approved configuration guidance that can be utilized when needed.

3.2.1. Document the configuration of ODCS, G-4 and service provider Customer Care supported systems and applications, identifying systems software, hardware, components submitted to IMO for approval.

3.2.2. Provide guidance to the IMO and maintain a technical library with up-to-date documentation concerning procedures, policies, operating manuals, and guidelines; application system documentation; training manuals, user guides; and any other documentation required for sustaining the maintenance of systems on a monthly basis.

3.2.3. Develop and implement appropriate procedural documents in the form of guidance statements, manuals, and IT desktop SOPs as necessary to implement approved IT policies in accordance with higher headquarters guidance and existing laws and maintained annually.

3.2.4. Software Accountability. Be responsible for the storage and accountability of all Government software and its associated licenses. Notify the Government of any potential software licensing violations. Assist key IT personnel with hardware and software accountability.

3.3. Performance Monitoring Activities. Conduct onsite monitoring of service provider approved hardware, software, desktop, laptop, and peripherals supporting the G-4 end users. Monitor system performance and utilization in order to detect and plan for potential problems assessing the efficiency, effectiveness, operation and integrity of systems and report this assessment on a weekly IT status report to the IMO.

3.4. Support to the G-4 Continuity of Operations (COOP) Plan, and Incident Response and IT Contingency Plan (IR/ITCP). Support an IT continuity of operations plan for the range of natural to terrorist driven disasters which corresponds to the G-4 COOP Plan. The plan will focus on coordinating IT support at relocated areas for critical personnel and will include planning for the required IT hardware and support to hosting agencies/locations. The U.S. plan will be made available after award.

3.4.1. Support the G-4 COOP manager and various agencies for the preparation and execution of disaster recovery procedures for the ODCS, G-4 and support of IT emergency backups annually as required by G-4, CIO/ G-6 and service provider policies.

3.4.1.1. On an annual basis, perform both on-site and remote technical coordination to ensure reliable and seamless cut-over between the Pentagon Logistics Operation Center (LOC) and contingency sites in the NCR for both exercises and in the event of actual crisis. The work will require coordination with representatives of the Command and Control Support Activity and the Joint Staff Support Center. Coordination with service provider Customer Care is required to ensure all ODCS, G-4 functional applications, data files, and network connectivity is fully synchronized between the LOC and contingency sites. Provide daily on-site technical coordination during periods when contingency sites are active.

3.4.2. Provide classified and unclassified IT support at contingency sites to include performing hardware and software troubleshooting and maintenance, as well as working with other agencies and technical personnel to establish and maintain network connectivity between special Task Forces, General Officers, and other persons or organizations located away from the Pentagon and requiring access to ODCS, G-4 systems and networked information. The contractor shall be evaluated on the response time and meeting service provider baseline reestablishment.

3.5. Business Systems Management. Monitor ODCS, G-4 business application systems in order to ensure compliance with the DoD Risk Management Framework (RMF) authorization process, including Information Assurance Vulnerability Assessment (IAVA) patch compliance and service provider Customer Care supported updates and patches. 100% compliance with applicable policy requirements is required for this task.

3.6. Video Teleconferencing (VTC). Provide NIPR and SIPR VTC configuration and system administration to ensure the systems remain operational. Current operating equipment consist of Internet Protocol (IP) connections. Serve as the interface between the ODCS, G-4 IMO and act as the VTC coordinator or facilitate coordination with the service provider Customer Care VTC Coordinator assigned to ODCS, G-4 to insure the dedicated and mobile VTC systems remain operational. Monitor hardware and service usage and determine requirements based on the service provider published list for life cycle management to ensure both quality and availability of services.

3.6.1. VTC Engineering. Configure all VTC systems in accordance with the Defense Information Systems Agency (DISA) Global Video Service (GVS) directives. The contractor VTC coordinator shall test audio and video to assure VTC briefings are prepared at the start of VTC sessions in accordance with G-4 policies.

3.6.2. Review, update, and maintain all VTC documentation, topology charts, and policies. Complete comprehensive VTC documentation that supports the integration and operation of video teleconferencing among, DCS, G-4, and other Government agencies. The plan shall include any information needed to coordinate with the DCS, G-4, other Government technical POCs, and private industry. The plan will be incorporated within local VTC policy.

3.7. Information Assurance (IA). Provide technical expertise in providing information for developing, implementing, and maintaining an effective computer and telecommunications security program and environment for both unclassified and classified information processing to ensure the ODCS, G-4 computer systems meet DoD and Headquarters, Department of the Army (HQDA) requirements. This will include performance of risk assessments, monthly IAVA patching to various ODCS G-4 business applications supporting Certification and Accreditation requirements, virus detection and prevention, illegal software incident management, security incident reporting, and sanitizing computer hardware as detailed in AR 25-1 and AR 25-2, AR 380-5.

3.7.1. Conduct weekly Assured Compliance Assessment Solution (ACAS) scans and report IAVA non-compliance to the Information System Security Manager (ISSM), Information Assurance Security Officer (IASO), and IMO weekly for remediation of risks.

3.7.2. Monitor daily and report weekly to the DCS, G-4 status on the Army and DoD IA program.

3.7.3. Report daily to IMO, ISSM, and IASO any security violations and incidents in accordance with applicable guidance and AR 25-1 and AR 25-2.

3.7.4. Assess risks in areas of security, privacy, waste, fraud, and abuse, and assess the adequacy of internal controls to eliminate and/or mitigate risks to systems being built. Report all identified risks to the IASO, IMO, and ISSM with recommendations for mitigating controls.

3.7.5. Maintain Security Controls mandated by Army and DoD in support of the G-4 site at the DDSP SIPR network, and G-4 workstations when the Army or other DoD publish implementing guidance for these networks. Assist the ISSM with network assessments, IT Contingency Plan exercises, and security plan updates as required.

3.7.6. All Information Assurance Messages, Technical Tips and Bulletins shall be acknowledged and reported as necessary. Configure and manage the G-4 ACAS system to scan and validate mandatory security controls.

3.8. Knowledge Management (KM). Provide program management and services in developing and sustaining a knowledge-based organization. The KM Office supports both internal and external business needs by fostering a continuous process improvement program and provides weekly Executive Summaries (EXSUM). The goal is to make KM a transparent activity and simply be considered a part of doing business. The KM team supports the Information Management Officer (IMO) with strategic direction and execution of communications and knowledge transfer throughout the DCS, G-4. Coordinate programs, projects, and strategic planning for approval. Recommend KM strategies that include enhancing the ability of G-4 staff to include the following: find mission related information; enhance the ability to access current, accurate, and actionable knowledge for decision-making through situational awareness; enhance the flow of information in the G-4 and across it’s directorates through internal communications; enhance coordinated joint effort towards common goals via collaboration tools, information systems, and competency enhancement; improve quality information, effectiveness and relevance of KM programs; and employing outreach and collaboration with other logistics organizations in response to overall Army Logistics KM requirements. The DCS, G-4 community has access to AKO, Joint Knowledge On-Line, and Microsoft SharePoint.

3.8.1. KM Program Development and Sustainment. Develop a KM Program that will meet the needs of the DCS, G-4 which includes content management, change management, web services, strategic planning, and training. Develop the SharePoint processes culminating into approved programs using a comprehensive phased approach. Define measures of effectiveness of the KM programs, obtain approval from the G-4 for those metrics, and track the accomplishment of the metrics through surveys and other means. Provide content management that engages functional leads within the organization to assure consistency in communication activities and alignment with the ODCS, G-4’s expectations and preparation of monthly stakeholder presentations. Contractor presentation materials will, upon the client’s request, include executive briefings, community-wide briefings on behalf of the ODCS, G-4.

3.8.1.1. Support coordination with Army CIO/G-6 to develop and maintain the G-4 KM policies, applying Army Knowledge Management (AKM) principles to ODCS, G-4 activities, managing the info-structure as an integrated enterprise to enhance capabilities and efficiencies. Provide training on KM concepts and methodologies, and, serving as administrator and advocate for Share Point Portal as the primary ODCS, G-4 enterprise portal. Sustain and improve the G-4’s on-boarding for new personnel in-processing. Develop and execute mentoring and knowledge transfer programs to include sustaining and improving knowledge retention, focusing on the continuity aspect of functional positions.

3.8.2. Develop appropriate policies in the form of guidance statements to inform the G-4 users monthly. Develop and maintain SOPs of IT business operations and Knowledge Management to implement approved G-4 and Army policies and publish to the G-4 SharePoint Portal and other taxonomy for G-4 utilization. Develop Knowledge Management governance plans for NIPR and SIPR knowledge management repositories.

3.8.3. Content Management. Manage content by ensuring work flow, data, documents, and other knowledge assets are captured, organized, and stored for easy intuitive access across G-4 using G-4 taxonomy.

3.8.4. Monitor subordinate components of the Logistics Community structure and assist and guide ODCS, G-4 end users in using SharePoint and other capabilities for KM and collaboration. Monitor usage statistics and data logs, modify configuration settings, and provide reports based on statistical findings weekly.

3.8.5. Weekly migrate content into both unclassified and classified websites for the ODCS, G-4 employing the single sign-on technique.

3.8.6. Assist in identifying sources of knowledge for knowledge forums. This shall include: the content required, for whom and when it is needed, the desired format, and how it will be made available for the organization to assist in accomplishing its mission. Report information during monthly content management meetings to the KMO.

3.8.7. Develop and recommend a taxonomy or structure for storing and managing content to the KMO for approval. Utilize the best taxonomy tool available and approved by the G-4 IMO to ensure knowledge is shared and captured monthly.

3.8.8. Develop a process for organizing content so it can be discovered and managed throughout its life cycle. This includes adding identifying features within the content to allow discovery and retrieval by users, and tracking by managers. Develop an activity map that will be integrated with the expertise locator system. Mapping will consist of designing and facilitating monthly meetings that promote knowledge sharing capturing best business practices by using process and knowledge maps, assessing gaps, sensing opportunities, and follow-up with development strategies. Provide the KMO monthly EXSUMs on the status of the expertise locator system.

3.8.9. Support the content managers in data management of the G-4 Directorates’ content, maximizing the use of identifying roles and access rights of SharePoint portal.

3.8.10. Develop and recommend a content management processes for internal management of directorate taxonomy by implementing a knowledge management map to improve the transparency of knowledge information on a monthly basis to the KMO.

3.9. Change Management. Employ change management practices by using a comprehensive phased approach methodology, develop and monitor metrics for KM projects in support of the contractor proposed G-4 IT strategy plan. Develop the scope of the change effort, identify the level of change and impacts, baseline the environment, and put structure and processes in place to facilitate behaviors and results desired.

3.10. Web Services. Provide technical support to include design, development, deployment, overall functionality and sustainment of the G-4 SharePoint & AKO falling under the KMO/IMO oversight. This includes development and design of website interfaces, front pages, and the tools to navigate public and internal websites. The contractor shall research, coordinate, and implement the application of collaboration tools that will allow a more efficient and effective way to perform missions. Provide support for the development and sustainment of a G-4 intranet and/or extranet, performing a detailed analysis of portal capabilities for inclusion in the implementation and integration of existing portal modules, to include AKO, refine and develop an architectural model for ODCS, G-4, and information workflow functions, in conjunction with the IMO. All web page content, information and links to other web sites must include system security compliance with the Freedom of Information Act, Privacy Act, Operational Security (OPSEC), DoD, and AR 380-5.

3.10.1. Provide analysis and review of G-4’s IT policies, procedures, protocols, methods, and standards addressing repository/database collection development and provide recommendations to G-4 on databases and storage requirements.

3.10.2. Manage and maintain the search tool for the G-4 searchable database(s) and/or repository accessible to all G-4 employees and key stakeholders, which shall include current and archived G-4 information/knowledge, and visually improve the appearance and performance of search tool outputs. Maintenance shall include, but is not limited to, installation of government provided software updates and patches and performance optimization.

3.11. System and Risk Analysis. Conduct risk assessments on G4 systems, networks, and processes and provide timely notifications and reports to G4 IMO. Collaborate with Business Analysts, Project Leads and G4 IMO to resolve issues and ensure solutions are viable and consistent. Ensuring all solutions meet Army IA, and G4 policies and procedures.

3.12. Training. Develop and present monthly training and/or informational tutorials to users for specialized ODCS, G-4 hardware and application training and on related services. User training is to be approved by the IMO/KMO. Maintain a continuity book of training objectives and outcomes. Facilitate training in G-4 facilities or other government sites as required. Training shall have a maximum number of sixty participants per class.

3.13. Conduct an annual review and maintain an IT and KM strategic plan, for approval by the Government, which includes, at a minimum: objectives and long-term tasks, capacity and capability metrics to identify and define the levels of information, and office automation resources required within the organization. Formulate models of problems for solution discovery, forecast future workloads and advise IMO/KMO of impact on ODCS, G-4 resources to improve and sustain knowledge management across the G-4.

3.13.1 IT Architecture Planning and Management. Provide input for updates to ITSP. The ITSP is a four year plan based on the current IT architecture and projected ITSP requirements. Provide input to the ITSP coordinator annually including, but not limited to:

• Providing life-cycle management information on servers, workstations, printers and communication devices

• Providing new Hardware/Software requirements to meet business and mission IT needs

• Providing software life-cycle management licensing information

• Providing topographies of current and projected infrastructure

• Identifying and recommending approved and emerging technologies and solutions to meet current and future IT missions

• Providing port protocol and port service requirements

• Providing IT Spend Plan input

3.13.2. Conduct NIPR and SIPR network IPR. Conduct monthly IPRs to include PowerPoint slides, technology demonstrations, and recommendations for identifiable issues that may affect G-4 IT support.

3.13.3. – Participate in IA working groups, Configuration Control Board meetings, and the IT Steering Committee assemblies.

3.14. Network and Data Administration. Classified and Unclassified Local Area Network (LAN) and Wide Area Network (WAN) Communication Support. Operate, maintain, and integrate LAN/WAN for the G-4 site at the DDSP. Perform network engineering duties and maintain technical coordination with the DCS, G-4 ISSM for support of inter-site application communications and the Continental United States (CONUS) Theater Network Operations Security Center (CTNOSC) support of external communications to include email capabilities.

3.14.1. Maintain continuous connectivity within each site, and Army and DoD Networks. Maintain technical coordination with the U.S. Army Network Command (NETCOM) and Joint Service Provider (JSP) which supports the DCS, G-4 in the Pentagon. The network will maintain 99% or better uptime. LAN/WAN operation and connections will be 24 hours a day/7 days a week except for monthly preventive maintenance which must be pre-approved by the Government Program Manager, Government Task Lead, and COR. Troubleshoot and repair the end-to-end transmission of data traffic using appropriate approved diagnostic tools and equipment.

3.14.1.1. Create, maintain, and delete network accounts and users’ home file directories. Verify that all requirements for system access to an information system are met and that there is a signed System Authorization and Access Requests, IA Training Certificate, and Acceptable Use Policy (AUP) on file. Ensure that all supported users receive initial and annual IA awareness training by verifying completion in the Army Training and Certification Tracking System (ATCTS) or the organization-specific system. The IASO shall report non-compliance to the ISSM. Coordinate final disposition of network accounts, files, and data assigned to new arrivals and departing personnel.

3.14.1.2. Report virus status weekly and during monthly IPRs and maintain support antivirus monthly IPRs with exception of any potential virus that could impact the security posture of the network in these instances a report is required immediately and manage Host Based Security System (HBSS) for G-4 assets. Monitor availability of the HBSS, the ACAS, Security Content Automation Protocol (SCAP), Symantec IT Management Suite, and other mandatory utilities and tools for operation and use to protect the enclave. Maintain and update all servers and PC anti-virus software and report virus findings. Maintenance and uninterrupted operation shall include:

• Server and desktop PC configuration and updating in accordance with AR 25-2, the Army Golden Master (AGM), Security Technical Implementation Guides (STIG), System Requirements Review (SRR), and Army Best Business Practice (BPP)

• Server room access control and equipment security in accordance with AR 25-2, AR 380-5, the Traditional Security STIG, and the Federal Information Security Management Act (FISMA)

• Desk side user support for IT equipment problems

• Infrastructure and cabling configuration and maintenance

• Systems administration documentation.

• Develop DoD RMF documentation support for SIPR and NIPR networks.

• Printer devices, print servers and scanners

3.14.2. Data Storage Management and Administration. Manage all mass storage devices including, but not limited to: prepping hard drives, allocating and organizing server drives by various functions, de-fragmenting drives as necessary, archiving files to back-up tapes, controlling the configuration of server operating systems, and properly disposing of hard drives prior to final disposition.

3.14.3. Network Authorization Support. Provide support to the ISSM/IASO as necessary to obtain an Authority to Operate (ATO) and Authority to Connect (ATC) for G-4 Systems and G-4 NIPR and SIPR networks at the DDSP. This support shall include providing documentation on servers and workstations, performing network scans to identify IA vulnerabilities on servers and workstations, APL workstations, resolving all RMF category 1, 2, and 3 findings and developing and executing Plan of Actions and Milestones (POA&M) when appropriate.

3.14.3.1. Assist in the preparation, distribution, coordination, and maintenance of plans, instructions, policies, guidance, and standard operating procedures necessary for implementation of the command’s IA program, and serve as the subject matter focal point for the command’s IA program.

3.14.3.2. Assist the ISSM in ensuring that a Certification and Authorization package is prepared and maintained in accordance with the RMF. Conduct ACAS assessments, Group Policy Object reviews, and anti-virus tests.

3.14.4. Remote Access Engineering. Operate, maintain, and configure the Cisco remote access solution. Provide enterprise level Cisco administration to include specialized knowledge of Cisco architecture and of Cisco AnyConnect. The contractor shall manage user access for remote access. In addition, the contractor shall administer the G-4 site at the DDSP Cisco remote access capability including installing, ensuring CAC policy sever checks, and administering the Cisco Adaptive Security Appliance (ASA) and Cisco AnyConnect in compliance with Army information assurance requirements. A daily connection shall be maintained. Maintain remote access log.

3.14.5. Firewall Engineering. Perform Cisco ASA firewall and Cisco Sourcefire Intrusion Detection Systems (IDS) administration at the G-4 site at the DDSP NIPR and SIPR networks. Maintain and update the Firewalls and IDS in accordance with AR 25-2, IAVAs, patches supplied by the software vendor, and local security policy. Review, comply with, and document all applicable STIG controls and IAVA alerts at a minimum. Periodically review other security alerts available from product manufacturers and associated software patches. Based on this review, recommended patches will be provided to the ISSM for review and approval on a monthly basis.

3.14.5.1. Maintain firewall Access Control Lists for classified and unclassified networks based on defined guidance. The rule set generation is based upon the system authorization access request (SAAR) form and signed approval of the ISSM.

3.14.5.2. Configure the firewall to provide public, private, and internal zones to enhance the security of Agency assets and help protect against external attacks via the NIPR and SIPR networks.

3.14.5.3. As required by the ISSM or whenever suspicious activity is detected, electronically report network probes, incidents, and any suspicious activity to the ISSM, who will report to the appropriate Regional Computer Emergency Response Teams (RCERT).

3.14.6. Network Maintenance. Perform system maintenance according to the terms and conditions of the manufacturer or in accordance with any on-site maintenance contract. Coordinate with Original Equipment Manufacturers, or their representative field service providers, to provide on-site maintenance of LAN/WAN infrastructure equipment including, but not limited to: Cisco routers, switches, firewalls, and hubs. At the discretion of the government, contact Cisco directly to troubleshoot the faulty hardware and identify remedial actions to include obtaining technical services, replacement hardware, and/or software patches (8X5, NBD).