GFEBS_Portfolio_Task_Descriptions_20161213.docx

1.

2.

1.0 Cybersecurity and Program Protection Support

The Contractor shall perform the activities necessary to implement the Risk Management Framework (RMF) as defined in the Department of Defense Instruction (DoDI) 8500.02 and DoDI 8510.01, to include:

A) Assessment and Authentication (A&A) / Cybersecurity Compliance - Support the RMF process and activities (e.g., Security Risk Assessment, Plan of Action and Milestones (POA&M)) to facilitate the security A&A of the system according to all relevant cybersecurity standards/directives/policies (e.g., DoDI 8510.01, NIST SP 800-30 Rev 1) and the associated security controls as defined in DoDI 8500.1 to ensure GFEBS INC II is fully accredited throughout the program lifecycle. This includes updating the DoD Enterprise Mission Assurance Support Service (eMASS) system as required, providing supporting cyber security documentation for upload as artifacts in eMASS, mitigating all security risks and vulnerabilities found during A&A and continuous monitoring and scanning activities. All vulnerabilities must be mitigated in accordance with DoDI 8510.01 based on the Category Level. The Contractor shall support the implementation of DoD/Army-directed Cybersecurity mandates such as information operations conditions (INFOCONs), Information Assurance Vulnerability Alerts and Bulletins (IAVA/Bs) and all applicable vendor released security updates, fixes, patches and bundles for the COTS solution throughout the program lifecycle. The Contractor shall develop system documentation required for the Security Authorization Package.

B) Program Protection – The Contractor shall develop and update the mission Critical Functional Analysis (CFA), vulnerabilities assessments, risk assessments, identification and counter-measurement implementations, demonstration of visibility into supply chain and Software Assurance for critical components, and update of CFA results and Program Protection risks and mitigations at each Technical Review (assuming the system does not contain Critical Program Information (CPI)). The Contractor shall develop and implement a Program Protection Implementation Plan (PPIP) that describes the Contractor's implementation of the Government - Program Protection Plan (PPP). The final GFEBS INC II PPP will be published after contract award. The GFEBS INC II PPP appendix, Cybersecurity Strategy, will be finalized within 10 calendar days after contract award.

C) Software Assurance – The Contractor shall provide a plan to achieve and demonstrate the level of confidence that the software is reliable and functions as intended and that the software is free from security vulnerabilities and malicious code, either intentionally or unintentionally designed or inserted as part of the software, throughout the lifecycle. At a minimum, the plan shall include countermeasures to prevent, detect, respond, and report to Government vulnerabilities in software; continuous monitoring; and adhere to secure coding standards. The Contractor shall develop, document, and update Software Assurance Countermeasures, which summarizes the planned and current state of a program's software assurance activities in accordance with the table description provided in the Defense Acquisition Guidebook section 13.7.3. The Contractor shall verify all software code against the Common Weakness Enumerations (CWE), Common Vulnerabilities and Exposures (CVE), and Common Attack Pattern Enumeration and Classification (CAPEC).

D) Software Compliance – The Contractor shall ensure software complies with all DoD Instructions/Federal Standards (e.g., DoDI 8500.1, DoDI 8551.1, and Federal Information Security Modernization Act of 2014 (FISMA)). The Contractor shall design, develop, and implement secure software and configurations through applying applicable DoD Secure Technical Implementation Guides (STIGs), checklists, vendor security guidance, industry best practices, and applicable vendor product security patches as provided in the CAC-enabled DISA Information Assurance Support Environment (IASE) web site.

The Contractor shall support GFEBS INC II Security Control Assessor (SCA) in preparation for the system evaluation tasks as defined in the DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle.

The Contractor shall leverage, to the maximum extent necessary, automated tools (including Government-provided) to identify and remediate vulnerabilities or weaknesses in the commercial-off-the-shelf) (COTS) solution and software design/coding. The Contractor shall provide visibility into software versioning down to the lowest feasible software component level. The Contractor shall mitigate new, critical vulnerabilities detected no later than 15 days after detection, depending upon the criticality of the vulnerability and whether the system is in Production or not. The Contractor shall ensure vulnerabilities are successfully mitigated during the build development period of the affected software and no later than the established release/deployment date of that same software.

E) Incident Management – The Contractor shall perform Incident Management and Escalation services to detect and record incidents, send security alerts, prevent onset of threat and vulnerability that results in catastrophic or critical failure (e.g., spillage), and restore the system to a normal operational state.

The Contractor shall support the GFEBS INC II PMO in preparation for the system evaluation by the Security Control Assessor (SCA).

The Contractor shall perform all requisite activities to obtain and maintain an ATO and a Certificate of Networthiness for all GFEBS INC II landscapes / environments in accordance AR 25-1 and AR 25-2.

The Contractor shall be responsible for maintaining a system that can be certified and accredited in accordance with Army and DoD Security Requirements and Policy for operating on Non-Secure Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol Router Network (SIPRNet), as appropriate The Contractor shall remediate or mitigate all vulnerabilities and security deficiencies noted in the RMF POA&M.

The Contractor shall:

· Coordinate with the Security Team until all weaknesses are eliminated or mitigated

· Provide or perform system updates and revisions in accordance with the POA&M and as approved by the Configuration Control Board (CCB)

· Upon completion of the POA&M, support efforts to extend the existing Authority to Operate (ATO), as required

· Provide artifacts in support of efforts to satisfy RMF requirements and facilitate the production and deployment of new capabilities

· Provide input to meet Certificate of Networthiness requirements

The Contractor shall provide access to operational data (found in systems, services, devices, logs, or databases) in support of RMF, security audit, and cybersecurity activities.

The Contractor shall serve as a custodian for classified material through written authorization by PD GFEBS INC II.

In performing patch and system baseline management, the Contractor shall collect and review information regarding security impacts and issues to identify security shortfalls and software updates that are relevant to each environment.

The Contractor shall alert, in writing, PD GFEBS INC II and end users of security issues or updates to the applications on systems in use.

The Contractor shall obtain, test, and implement vulnerability releases from the software vendors. The Contractor shall resolve all vulnerability releases through priority and in coordination with the GFEBS INC II PMO. The Contractor shall deploy critical security and functionality patches and updates. The Contractor shall register for and monitor updates, notifications, and security alerts to maintain timely awareness of when automated alerts are available for each application within the GFEBS INC II baseline. The Contractor shall ensure the system and installed applications have current patches, security updates, and configuration settings in accordance with approved CCB actions and Army Cyber Command policy.

The Contractor shall address vendor-reported criticality (e.g., high, medium, low) and the existence of known vulnerabilities and other malicious code in recommending timing of patch releases. The Contractors shall comply with AR 25-2 for required vulnerability mitigation. The Contractor shall execute the Contractor Configuration Management Plan (CMP) patch management process from the acquisition of the software updates through acceptance testing after production deployment.

The Contractor provide monthly Vulnerability Scan Results.

The Contractor shall develop, implement, and maintain a Disaster Recovery Plan (DRP) [in accordance with the NIST SP 800-53, Revision 4 contingency planning (CP) control requirements for a high integrity system.

The Contractor shall meet GFEBS INC II Contingency of Operations (COOP) requirements to enable recovery of the full GFEBS INC II capabilities within 24 hours (Recovery Time Objective (RTO)) of the official declaration of a disaster (e.g., loss of the primary data center), to include reestablishment of all system interfaces, to a state not more than four hours prior to Disaster Recovery Point Objective (RPO).

The Contractor shall test all DR tasks at any authorized PD GFEBS INC II site.

The Contractor shall verify GFEBS INC II products, to include open source products, against the Approved Product List (APL) and/or submit APL approval and waiver requests as required by PD GFEBS INC II, Army, and DoD Cybersecurity policy. The use of open source software must comply with DoD and Army directives regarding open source software, namely in accordance with DoD Memorandum, Clarifying Guidance Regarding Open Source Software, dated 16 October 2009, and AR 25-2.

The Contractor shall provide a Security Information Special Outage (INFOSPOT) Report.

The Contractor shall provide a STIG Compliance Status The Contractor shall provide an IAVA Compliance Status Report protecting vulnerability information.

2.0 Risk Reduction Phase

FOR PURPOSES OF THE RFI, A WAVE IS EQUIVALENT TO A DODI 5000.02 MODEL 3: INCREMENTALLY DEPLOYED SOFTWARE INTENSIVE PROGRAM “BUILD”.

A) Requirements Analysis Functional Governance Board (FGB) requirements will be provided to the contractor at the beginning of Requirements Analysis Stage. This solution shall include draft scope, cost estimate and schedule as defined below:

In performance of this TO, the Contractor shall:

· Assess and coordinate the system impact of Wave requirements, to include infrastructure, applications, and partner systems

· Create an engineering solution based upon highest Government priorities

· Propose an optimally engineered solution with cost efficiencies that total beneath each Wave’s cost ceiling

· Define draft system impacts, to include infrastructure, applications, and partner systems.

· Provide a Rough Order of Magnitude (ROM) based on Government-provided Requirements Traceability Matrix (RTM) and inputs from FGB discussions for both engineering solutions.

· Shall develop a draft schedule to incorporate the changes into a Wave release(s).

· Format for infrastructure requirements to DISA (ALTESS/Redstone).

· White paper and presentation briefing summarizing the recommended Wave engineering solution with associated costs and overarching schedule.

B) Analyze / Preliminary Design Review (PDR)

The Contractor shall perform a detailed analysis of the selected Wave requirements against the existing GFEBS business processes and system capabilities. This analysis shall result in clear documentation of the desired end state. The Contractor shall analyze the GFEBS INC II requirements contained in the GFEBS Government RTM provided at the beginning of the Risk Reduction Phase and shall decompose/derive requirements to the software level; allocate the requirements to the component level in support of the PDR; and update requirements document(s), to include the Contractor RTM. The contract shall analyze each prioritized functional requirement and decompose/derive measurable and testable system specifications.

As necessary, the contractor shall coordinate with organizations and teams to ensure sufficient understanding in order to determine scope and timeline for each development requirement. The contractor shall perform management activities to oversee and support the analysis, design, development, and test of the GFEBS INC II solution, including conducting meetings and technical reviews, providing the appropriate documentation, and ensuring compliance with DoDI 5000.02.

The contractor shall manage the development of solution-specific architecture viewpoints; maintain DoD Architecture Framework (DoDAF) architecture viewpoints to ensure the architecture remains consistent with current solution configurations and designs; and ensure compliance with the prevailing release of the DoD Business Enterprise Architecture (BEA).

The following Analyze (PDR) stage products and processes shall be developed:

· Conduct functional prioritized requirements group workshops to ensure sufficient understanding of functional/end user requirements.

· Assess and validate functional/end user requirements to define in the detailed functional and technical system specifications to realize the specified functional/end user requirements.

· Provide a Fit Gap Analysis prior to creating any new functionality to determine whether or not standard SAP can accommodate the change, to include providing detailed rationale and justification.

· Document the business, functional, and technical requirements in a system specification consistent with GFEBS application development life cycle or applicable development life cycle methodology.

· The system specification (BPD)/RTM shall present testability and traceability of requirements.

· Develop and modify Architectural Viewpoints & Plan per guidance provided in Architecture Standards.

· Create Final Development and SAP Configuration Object Inventory that encompasses Wave solution to be presented at PDR.

· Determine if an incremental approach to delivering the requirements within the Wave is appropriate. Provide Build Plan that describes the number and timing of release(s) to occur during the Wave and how the functional prioritized requirements align to the release(s).

· Provide Software Test Plan for PDR that encompasses contractor development T&E activities.

· Create cost estimate based upon approved prioritized functional requirements for engineered Wave solution and the final Development and SAP Configuration Object Inventory.

· Conduct a high level design review with Government-approved entry and exit criteria to obtain approval of the requirements baseline (e.g., system specification) for the preliminary design review (PDR). The Contractor shall meet Government-approved entry and exit criteria for each planned review.

· White paper and presentation briefing summarizing the Build Plan and engineered Wave solution with associated costs and overarching schedule.

· The Contractor shall ensure that the solution complies with Human Systems Integration in the System Acquisition, Army Regulation 602-2, January 27, 2015 or later, Army Regulation (AR) 73-1 Test and Evaluation Policy, Section 2-15.

3.0 Wave Development

a) Design / Critical Design Review (CDR) & Develop

The overall Design / CDR & Development objective is to perform all design, development, and unit testing necessary for the successful future delivery of the GFEBS solution.

2.1.

2.2.

2.3.

2.4.

2.5.

2.6.

2.7.

2.7.1.

1) Design (CDR) Stage The following Design (CDR) Stage products and processes shall be developed:

· Document each customization to the SAP application in a GFEBS specification consistent with GFEBS application development life cycle or applicable development life cycle methodology.

· Provide SAP Configuration Design and Rationale documentation for any changes to the SAP configuration.

· The SAP CD/FD/RTM shall present testability of requirements.

· Design security and system controls required to meet system certification and accreditation in accordance with (IAW) NIST documents.

· Conduct value assessments for the GFEBS specifications to generate an impact analysis and provide alternative design scenarios, as needed.

· Update Architecture Products to support detailed design of each release per guidance provided Architecture Standards.

· Update, as necessary, Development and SAP Configuration Object Inventory that encompasses Wave solution and engineering designs developed for each CDR. All changes to Development and SAP Configuration Object Inventory require Government CCB approval and shall be updated in accordance Contractor CMP.

· Conduct a CDR for each planned release, IAW the Build Plan, with Government-approved entry and exit criteria. The Contractor shall meet Government-approved entry and exit criteria for each planned review, as specified in the SEMP.

· The Contractor shall ensure that the solution complies with Human Systems Integration in the System Acquisition, Army Regulation 602-2, January 27, 2015 or later, Army Regulation (AR) 73-1 Test and Evaluation Policy, Section 2-15.

· Update Build Plan for each CDR, as necessary.

· Update Software Test Plan for each CDR that encompasses contractor development T&E activities, as necessary.

2) Build Stage In performance of this TO, the Contractor shall:

· Program, script, activate, configure and/or customize the application and/or system using the information from the previous phases as critical input within the boundaries of the involved application platforms and/or application frameworks.

· Conform to PEO EIS Memorandum 12-65, “Software Code Reviews,” and the PEO EIS Software Code Review Standard Operating Procedure to implement the use of Software Code Quality and Software Assurance Tools (such as CAST and HP Fortify) in order to detect errors, enable best business practices, find security vulnerabilities, and remediate the applicable vulnerabilities within developed software source code.

· Update all related technical designs, software documentation, and version description documentation.

B) Test and Evaluation The Test and Evaluation objective is to support the GFEBS INC II Design (CDR) and Development Phase by serving as a feedback mechanism in the iterative GFEBS INC II Systems Engineering and Planning process. In addition, the outcomes provide feedback to the Government on the progress of the design process and product compliance with contractual requirements. These outcomes aid in evaluating the system’s ability to meet the complete set of validated and derived capability requirements, the ability to verify achieving high level objectives (HLO)s, and whether initial system production and deployment can be supported. The level of test and evaluation rigor should be adequate to identify risk areas and demonstrate the reduction of risk to acceptable levels.

Test and Evaluation includes the verification and validation of the ability of the system to achieve HLO’s and Key Performance Parameters (KPP’s) as defined in the GFEBS INC II RTM and traced in the Contractor Requirements Traceability Matrix (CRTM). Planning must ensure that adequate resources (e.g., test articles, test facilities, specialized tools, funding, and manpower) are available and that duplicative or redundant testing is minimized. Documentation must provide the objective evidence that stated requirements are tested and evaluated in the applicable context of the supporting referenced guidance (e.g., plans, procedures, scripts, readiness reviews, result reports, corrective actions, risk identification and mitigation, and requirements traceability).

The effort requires completion of test and evaluation activities consistent with Army policy. All Government-directed testing will be conducted in accordance with Army Regulation (AR) 73-1, “Test and Evaluation Policy,” and Department of Army Pamphlet 73-1 “Test and Evaluation in Support of Systems Acquisition.” Successful completion of adequate testing with production representative articles is the primary basis for authorizing Wave Deployment.

During Test and Evaluation, the Contractor shall:

· Incorporate Test Management that integrates key Test and Evaluation (T&E) processes with critical program management processes (e.g., requirements management, performance baseline control, risk management, configuration and data management, defect management, and interface management).

· Clearly define T&E roles and responsibilities within their organization.

· Conduct a requirements testability analysis to (1) ascertain if the requirements will be proved via Analysis, Inspection, Demonstration, or Test, (2) identify the requirements with test limitation(s) or constraint(s) that reduce testability, and (3) provide recommendations to improve requirements testability.

· Identify, prepare, coordinate, plan, conduct, execute, review, support, and document test and evaluation events (e.g., performance, stress, regression, interface, network, backup, restore, connectivity, security, survivability, vulnerability, integration, functional, acceptance, interoperability, reliability, availability, maintainability) to ensure that both the system’s individual components and the complete solution meet requirements.

· Include all test planning and reporting, test event based reviews, and test events in the integrated master schedule (IMS).

· Develop and implement a Software Test Plan that encompasses all contractor development T&E activities.

· Develop and execute Software Test Procedures that encompasses all SI development T&E activities

· Support collaborative planning and execution of test phases and testing events (both Contractor and Government events) to provide data in support of independent analysis, evaluation, and reporting by all stakeholders, particularly the developmental and the operational test and evaluation communities.

· Provide Government access to Contractor data, tests, and results to support all independent system evaluations at the request of the Government. Provide comprehensive testing services, including the coordination of security and customer acceptance testing for all requested GFEBS INC II items.

· Comply with the test requirements for a release, to include testing code prior to migration into the production environment, and validating the system’s performance, technical, functional, security, and interoperability characteristics (hardware, software, interfaces, and communications).

· Validate the system’s performance, technical, functional, security, and interoperability characteristics (hardware, software, interfaces, and communications) throughout the testing phase to ensure that, 1) capabilities and requirements of the system are exercised and analyzed, and 2) the effectiveness and suitability of the configured system meets the Army’s financial processes in terms of the GFEBS documented system performance, technical, and functional requirements.

· Incorporate holistic system and operating environment tests as necessary prior to deploying new capabilities or functionality. This includes end-to-end regression testing of impacted business processes, testing of impacted interfaces with partner systems, and testing of cross-process integration points and reports.

· Develop and provide Test Reports following the execution of each Contractor-led test event. Contractor shall be responsible for analyzing and reporting the development test data used to demonstrate requirements compliance test and performance result reports should track progress over time and graph thresholds and/or objectives against actuals.

· Support the development test/user acceptance test (DT/UAT) Test Readiness Review (DTRR) prior to DT/UAT being performed.

· Participate in the Government UAT.

· Support up to five Operational Test Readiness Reviews (OTRRs) prior to a Wave’s operational test (OT) being performed.

· Support OT events.

· Support Government interoperability testing.

· Formally validate a PMO-provided GFEBS baseline through an approved verification and validation or equivalent type event.

· Develop and provide a GFEBS Validation Test Report.

· Maintain a Failure Reporting and Corrective Action System strategy that is aligned with the Government failure reporting and corrective action implementation process defined in the GFEBS INC II Test & Evaluation Master Plan (TEMP).

· Track all flaws found during code review in a Contractor-furnished defect tracking system that is accessible by the Government. The Contractor-furnished defect tracking system shall be part of an application development life cycle management tool.

· Conduct and report analyses of test failures to assist in isolating causes of failures during testing.

· Perform efforts associated with the development of any specialized tools and the testing data elements necessary to ensure the timely and successful execution of test and evaluation events.

· Complete development and implementation of automated test scripts using the Worksoft Certify government furnished equipment (GFE) regression test tool within one year of award.

· Update and maintain the test scripts and Worksoft Certify (GFE) regression test tool.

C) Training The training objective is to develop, deliver, manage, and document a comprehensive training solution and approach that establishes and maintains user proficiency throughout the GFEBS INC II lifecycle. The effectiveness of training and support will be measured across the entire GFEBS INC II user community. Training may also include elements of change management and user adoption of the additional capability over legacy capability.

In the performance of this task, the contractor shall:

· Develop and implement a comprehensive training plan that describes the training methods to be deployed throughout the GFEBS INC II life cycle phases.

· Provide a training curriculum/approach and associated training materials for the proposed solution that covers the progression from basic knowledge through intermediate and advanced subject matter, including business processes and skills.

· Deliver training/certification to 50 Government personnel for potential use as training Subject Matter Experts (SMEs) and on-site support. These SMEs may augment the Contractor trainers and support the help desk.

· Perform test operator training and user training in support of DT/UAT and OT events at a designated location.

· Perform end user training (e.g., initial/deployment, new employee, new build, and refresher) for 3000 users across 17 designated training regions, 14 within the Continental United States and three outside the Continental Unites States.

· Provide training augmentation services (e.g., in person, virtual) to organizations with limited or no local support resources.

· Educate existing users of the production system of changes that impact the operations of the solution as new builds are deployed into production. Provide continuing education/refresher training required to sustain and enhance skills of the selected SMEs prior to the release of each software build.

· Develop and deliver training for field supervisors and/or staff on management of user role assignments and provisioning.

D) Deployment The Solution Deployment objective is to provide the GFEBS INC II user community access to the GFEBS INC II solution in accordance with assigned “GFEBS INC II User Roles”. Solution Deployment includes the integration of hardware, software, training, and organizational change management in a synchronized and efficient manner.

In the performance of this task, the contractor shall:

· Develop and implement a Deployment Plan that describes the approach for site preparation and activation.

· Support pre-deployment, deployment/go live, and post-deployment activities to provide the GFEBS INC II community access to the GFEBS INC II solution at user sites in accordance with the Government approved IMS.

· Conduct pre-deployment site assessments, surveys, and/or visits.

· Prepare the sites for implementation.

· Upload end user identification, mapping, provisioning, and implementation.

· Support user analysis regarding roles and permissions, to include assigning roles (includes training supervisors on system roles) and provisioning end users through Governance, Risk, and Compliance (GRC).

· Define command roles and need-to-know profiles per site to establish fund center and cost center hierarchies.

· Plan and execute interface partner data exchange, data conversion activities, and site-specific business process procedures.

· Support business process and site-specific usage analyses.

· Assure on-site support as required during the Go-Live event.

· Provide on-site support.

· Perform on-site configuration and checkout.

· Support master data transfer from GFEBS.

· Validate Government designated hosting infrastructure readiness. Configuration, installation, and troubleshooting of all software components in the production environment.

· Provide technical services required to promote software Builds into an operational production environment.

· Providing technical support services required to monitor, assess, troubleshoot, and respond to incidents related to solution performance in the production environment during deployment and prior to hand-off of the solution to the Operations and Support.

· Ensure all configuration changes are documented in accordance with job aide standards and configuration management processes.

· Provide After Action Reviews (AARs) at the conclusion of any significant issues encountered as determined by the PMO.

· Participate in post-implementation review of implemented system changes.

· Providing Tier 2 help desk technical support to troubleshoot system errors.

· Providing Tier 3 help desk support, to include software configuration and/or customization maintenance (i.e., break fix), security upgrades, and COTS product upgrades.

· The Contractor shall deliver the approved Wave solution after the Milestone Decision Authority (MDA) Wave Deployment Decision (WDD).

5.0 Tier 1 Help Desk

The objective of this task is to provide phone, voicemail, email, and self-service portal single-point-of-contact (SPOC) for end users. Tier I Help Desk is principally the entry point for GFEBS operational issues that are reported by GFEBS end users. The help desk services proposed shall be based on industry practices and aligned to descriptions used by the HDI (formerly known as the Help Desk Institute).

In performance of this TO, the Contractor shall:

Provide operational support 24 hours per day, seven days per week, 365 days per year.

Provide a toll-free Help Desk SPOC. Contractor shall provide the automatic call distributor/telephony system and toll free number for the Tier I Help Desk. Contractor will be given access to Citrix and Remedy (both of which are GFE and reside in the Government datacenters). However, workstations and software for Tier I Help Desk agents are not provided by the Government.

Provide end-to-end ownership (e.g., logging, tracking, resolution, and reporting) of Help Desk Incidents and Service Requests using the Government provided BMC Remedy.

Provide efficiency and timeliness of resolutions to trouble tickets (submitted by phone, voicemail, email, or Self-Service Portal) as indicated by the proportion of inbound calls, emails, and web tickets. Phone calls shall be answered within one minute. Emails shall be responded to within two hours.

Maintain GFEBS Remedy Knowledge Management Tool. GFEBS requires continuous updates. Approximately 60% of the content may be considered mature; however, Contractor shall examine the other 40% and make updates. Contractor shall plan on continuously updating and improving customer support processes. The content is primarily written for the end-users.

Provide recording, referral of requests for support, closure of calls for support to the help desk, management escalation of tickets or calls requiring urgent support, and development of a Knowledge Base Inventory for future Tier I issue resolutions.

Coordinate, manage, and respond to Incidents and Service Requests made by GFEBS users and Army technical staff located worldwide.

Answer basic questions using knowledgebase scripts.

Support users with connectivity issues, printing, navigation, general questions, and Job Aid locations.

Aid the GFEBS Help Desk in resolving any incidents or problems if related to minor technical queries for in scope applications.

Identify initial prioritization based on published criteria.

Escalate issues to Tier II or Tier III (when necessary).

Provide Tier I Help Desk metrics bi-weekly work product showing helpdesk statistics, trends, and issues.

Provide, when requested, end-user, system administrator, and support staff documentation and/or manuals such as user aids and Tier I scripts.

6.0 Sustainment

The objective of this task is to provide integrated system sustainment and infrastructure upgrade support services for the entire GFEBS environment to include the principle SAP ERP Central Component (ECC), BI, Business Warehouse Accelerator (BWA), and Business Objects Enterprise (BOE), cProjects, GRC, BMC, SAP Solution Manager and Global Templates, and other system tools. Responsibilities shall include, but not limited to: a) Systems Sustainment (systems, software, and hardware), b) Tier III Help Desk (includes development, quality, and production-type environments), c) BI, d) Cross-Team/Service Integration, and e) Technical Operations Management.

The Contractor shall meet GFEBS’ requirements including requirements from customers throughout DoD. This includes software and system upgrades, changes based on business process efficiencies, system assessments (e.g., performance, compliance), technical refresh, prevailing industry standards, compliancy, audit, and emerging technologies.

In performance of this TO, the Contractor shall:

Provide risk-based preventive maintenance. This activity should include such items as: a) evaluation of changing data volumes; b) staying up to date with current releases, technology, and support tools (e.g., BMC, GRC); c) execution of system patches; d) proactive performance tuning, e) pre-production execution simulation, and f) special testing for events. These activities include coordination with the PMO through a capacity plan. Issues and risks shall be discussed every other week or weekly (if needed).

Maintain the Sustainment Plan for the following categories: preventive, corrective, and perfective maintenance services which includes the repair of defects to applications in production used by Contractor and/or GFEBS, and to enable such applications to provide the required functionality to meet the service level requirements detailed within this PWS or shown within attachments hereto.

Coordinate maintenance activities (e.g., emergency fixes, monthly patches and releases) with PMO and PMO-recommended stakeholders (functional, sustainment, and technical teams/sub-teams).

Provide corrective maintenance to repair defects to applications in production use by Contractor and/or GFEBS and enable such applications to provide the required functionality to meet service level requirements.

Provide perfective maintenance which includes activities associated with sustainment modifications and maintenance that ensure applications operate at peak efficiency.

Perform regression testing for support packs, enhancement packs, technical upgrades, SAP Online Service System (OSS) notes, and all sustainment changes. Contractor shall continue to enhance current automated regression testing capabilities.

Support and maintain a close, collaborative relationship with partner ERP systems (e.g., AESIP, LMP, GCSS-A, and GFEBS-SA) to ensure design and configuration data is accurately shared.

Analyze the impact of vendor required or recommended modifications including SAP OSS notes, SAP patches, and NetWeaver plug-ins on GFEBS.

Maintain GFEBS software and support applications (e.g., Remedy, BladeLogic, ARIS) and ensure integration to production.

Closely monitor and maintain integration and accurate data exchanges between ECC and BI.

Closely monitor and maintain interfaces such that data exchanges are accurate, and ensure that schedules are adhered to as indicated in the design or partner agreement.

Provide adequate controls and implementation of all Master Data changes (i.e., ECC, BW, and BusinessObjects).

Provide and coordinate patch management and software updates for the GFEBS system components.

Improve data validation (Master Data) and interface monitoring. Contractor shall outline the need for improvements overall on data validations and error handling to prevent errors from occurring. Most (but not all interfaces) have Intermediate Documents (IDocs) corrected by the end-users. However, there are times that the Contractor shall make corrections dependent upon the error.

Support system closings, year-end, and year-start activities.

Prepare and present a summary of all capability in the system at the end of each fiscal year, highlighting the new capability introduced during the year to Army executive leadership and commands.

Support financial auditability and system compliance requirements in accordance with guidance, policy, and standards.

Keep GFEBS within Federal Financial Management Improvement Act (FFMIA), Financial Improvement Audit Readiness (FIAR), Federal Information System Controls Audit Manual (FISCAM), Real Property Information Model (RPIM), Business Enterprise Architecture (BEA), and Standard Financial Information Structure (SFIS) compliance, and other Army/OSD level compliancy requirements.

Maintain and upgrade GFEBS to meet policy changes aligned with Army guidance. Establish formal processes to monitor and ensure the integrity and auditability of GFEBS.

Provide a complete set of architecture views for GFEBS per DoD Architecture Framework (DODAF) artifacts. Current framework and models shall be utilized and updated based on new enhancements/functionality.

Establish mechanisms for assessing, tracking, controlling, and reporting on compliance as changes are made to the system.

Establish mechanisms for reconciling financial data with outside data sources (e.g., Defense Departmental Reporting System (DDRS), DFAS, and Treasury systems).

Work with SAP to resolve data integrity issues.

Develop and implement internal controls around GFEBS financial systems to ensure they comply with guidelines in Office of Management and Budget (OMB) Circular A-123, “Management’s Responsibility for Internal Control.”

Provide a monthly GFEBS Update Package after any release.

Provide biweekly Sustainment Services Review Status Reports.

Provide the following work products on a regular basis:

· GRC Approver Master Listing (WKLY)

· List of IDs (when changed)

· User to Role Mapping (BI-WKLY)

· Remedy User List (BI-WKLY)

· Help Desk Metrics (WKLY)

· Project Status (WKLY)

· Business Operations Metrics (WKLY)

· User Role Matrix (MTHLY)

· Role to T-Code Matrix (MTHLY)

· Remedy User List (MTHLY)

· User Status Report (WKLY)

· List of Firefighter IDs (MTHLY)

· Interface Metrics (BI-WKLY)

· SAP OSS Notes (BI-WKLY) Conduct bi-weekly deep dive of operations topics (e.g. tickets, interface metrics) meetings.

Provide Pro Forma which is used to define posting logic to help Army reach auditability. Frequency and submissions may be driven by business process redesign, DoD SFIS GL regulatory changes, and annual review of logic.

Provide After Action Reviews at the conclusion of any significant issues encountered as determined by the PMO.

A) Tier III Help Desk

The objective of this subtask is to provide maintenance and problem resolution of the GFEBS environment for ECC, BI, BWA, and BOE as well as bolt-ons and software. This includes the following: a) Break/Fix; b) Complex Software Solutions; c) Functional Application Maintenance; d) Technical Support and System Monitoring; e) Basis Support; and f) Interface Exchange and Data Assurance.

In performance of this TO, the Contractor shall:

Operate a Tier III Help Desk and receive service requests from various sources including the Tier I and II Help Desks. All tiers use the same system and escalation processes. At times, GFEBS receives ad hoc queries from senior leaders which generate a Tier III request.

Provide emergency support (respond within one hour and resolve within four hours to all critical issues) capabilities for continuous 24 hours per day, seven days a week, 365 days per year.

Manage details and resolution of assigned tickets for entire incident/problem life cycle including detection, interaction with other support functions (Tier I and II), and interaction with infrastructure operations, diagnosis, status reporting, repair, and recovery.

Provide and coordinate support activities and maintain close integration with Tier II which is the responsibility of Assistant Secretary of the Army Financial Management & Comptroller (ASA(FM&C)).

Provide monitoring and reporting services associated with the ongoing health checks, status reporting, and problem management (ongoing surveillance, tracking, escalation, resolution, and tracking of problems) of GFEBS support activities.

Identify and provide any additional requirements from change requests (CR)s and feedback from the Help Desk as a result of collecting and analyzing trend data or other metrics, including performance, availability, and use.

Maintain incident/problem classifications and update as the GFEBS environment evolves.

Maintain and update the incident/problem workflows, escalation, communication, and reporting processes in order to achieve intended performance requirements.

Manage handoffs of workflow and incidents including the involvement of third party providers (e.g., SAP, network service providers, and Redstone).

Perform and provide Root Cause Analysis of incidents, including engaging GFEBS teams as required, documenting findings, and taking corrective actions for in-scope services. Resolve problem and/or substantiate that all reasonable actions have been taken to prevent future reoccurrence. Conduct proactive trend analysis to identify recurring problems.

Follow the GFEBS Requirements Management process and the GFEBS Test and Release Management Plans.

Develop an Implementation Plan for monthly patches and quarterly releases of break/fix changes that have been approved by the Army focusing on minimizing negative impacts of the change on the system and the end user.

Provide infrastructure and application Capacity Management Planning to include schedule/impact for changes desired by Army.

Assist in the periodic review of GFEBS “as-is” and identify and recommend software and/or hardware rationalization and consolidation with the objective to improve performance and reduce operating costs.

Recommend improvements in designs (i.e., interfaces, business processes, configuration, or hardware) that will improve performance and reduce operating costs.

Conduct thorough and comprehensive testing adhering to the GFEBS testing requirement and policy before migrating code to the production environment. All of the processes and facilities used for testing will be available to GFEBS PMO or any Independent Verification and Validation (IV&V) Contractor for monitoring and consultation.

Use Worksoft Certify (GFE) regression test tool. Develop remaining automated regression test scripts within one year. Applicable automated regression test scripts shall be applied to all system changes prior to production migration. Contractor shall update, maintain, and create automated test scripts using Worksoft Certify. Identify any test scripts that may not be applicable to a local solution.

Develop test and release management processes, checks, and plans for each software release normally containing sustainment modifications and fixes, some of which may have already been issued as unscheduled fixes.

Provide personnel with SAP Basis (i.e., SAP’s base, foundation, and bottom-layer) expertise that are knowledgeable of both ECC and BI and ensure there are no challenges in sustaining either environment.

Monitor all batch processes to ensure they are operating on demand or according to schedule and performing as expected.

Monitor interfaces - inbound and outbound such as: a) ensure that scheduled interfaces are processed on-time; b) notify Army immediately of any discrepancies; and c) ensure that data received is validated against data processed.

Provide detailed assessment of key issues to the Sustainment Team and Sustainment Director.

Provide Tier III Help Desk metrics showing helpdesk statistics, trends, and issues as part of the Sustainment Services (bi-weekly) Status Report.

B) Business Intelligence

The objective of this subtask is to have a reporting capability and an intuitive BI interface to enable users to explore data without much training. Responsibilities include, but not limited to: data management, data warehouse, data marts, and delivery.

In performance of this TO, the Contractor shall:

Provide SAP BI certified technical and financial functional design resources capable of developing and managing various strategy definitions and services definitions, service designs, cross-functional activities, quality assurance, and continual improvement programs.

Make efficient and effective use of current and future BI/Business Warehouse (BW) data architecture implementing a data warehouse that references and incorporates layered scalable architecture principals of SAP. This BI/BW data architecture should include layers containing differing levels of granularity.

Persistent staging area Data warehouse Architected data marts Operational data store Support the current BI/BW process chains and meta-chains to extract, transform, and load (ETL) data that is highly tested and vetted, performance efficient, and offers high level data accuracy.

Automate the validation and ‘checkout’ process to ensure data consistency. This is focused on process chains, data loads, and/or manual data loads.

Maintain the GFEBS financial dashboard (e.g., obligations rate, unliquidated obligations, and IDoc errors).

Maintain an up-to-date diagram at detailed level logging process-chains (their interdependence and dependencies on) for various BW InfoObjects.

Monitor and mitigate process chain collisions.

Expand the use of SAP monitoring software (GFE) that can audit process chains events to derive current performance benchmarks and collisions for improvements.

Include performance testing and an assessment of cross-component impacts (e.g., an ECC change which will degrade BI performance or cause data to be omitted from reports) for sustainment modifications and sustainment enhancements.

Use Worksoft Certify (GFE) regression test tool.

Develop test and release management processes, checks, and plans for each software release normally containing sustainment modifications and fixes, some of which may have already been issued as unscheduled fixes.

Define and implement a rigorous technology assessment and planning process in order to address any gaps that GFEBS BI solution may have.

Provide BI training to end users, as required.

Implement a standard security, metadata, administration, portal integration, object model, and query engine.

Provide a robust way to search, capture, store, reuse, and publish metadata objects (e.g., dimensions, hierarchies, measures, and performance metrics) and report layout objects.

Maintain the SAP software developer’s kit for creating BI applications, integrating them into a business process, and/or embedding them in another application.

Assign and track events or tasks allotted to specific users, based on predefined business rules.

Provide the ETL of data and information from other Government (DoD and non-DoD) partners.

Data Management Implement operational processes that enable planning, discovery, and programmatic functions for all areas of BI (e.g., financial management and contract management).

Develop BI processes necessary to affect schemas and establish the logic, design, mapping, and transfer of data from authoritative sources.

Identify authoritative sources, issues, and barriers to accessing data sources, make recommendations on a governance structure, and establish methods for ensuring data quality.

Data Warehouse Responsibilities include: a) analysis and design of the data warehouse and ongoing operations; b) controls for managing cost, schedule, and risk; c) data security; d) data architecture; and e) continuous improvement between data storage, retrieval, and archiving.

Maintain an Information Lifecycle Management (ILM) archiving strategy that enables more complex criteria for storage management without replication.

Maintain Standard Operating Procedures (SOPs) for BI activities at all levels.

Maintain the data warehouse that supports operative data analysis by means of the operational data store. This data should be updated to an operational data store on a continual basis or at short intervals and be available for read and for operative analysis including all the changes to the data.

Data Marts Automate the data mart processes aligned with schemas, organize data into separate tiers according to specified policies, and automate data migration from one tier to another based on those criteria.

Define, develop, and maintain ongoing data cleansing processes and procedures, and monitor and track data quality levels.

Utilize data quality assessment and management processes to ensure atomic data integrity and mitigate data continuity gaps.

Perform comprehensive data inventory listing to support data reusability when developing data marts.

Develop an end-to-end data use lineage to aid in identifying and pinpointing data quality concerns in BI, effected reports, and impacted users.

Create a BI metadata management process with the goal of improving data quality and integrity, flexibility, standardization, and centralization of administration and usage of the BI platform. The metadata management process shall include all metadata associated with BI systems, information sources, data integration systems, and modeling utilities.

Del…