B08 Attachment 0003 AESD MSP PWS 28 Oct 21.pdf

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 1

ARMY ENTERPRISE SERVICE MANAGEMENT 10

PLATFORM (AESMP) 11

ARMY ENTERPRISE SERVICE DESK 13

MANAGED SERVICE PROVIDER TASK ORDER 14

PERFORMANCE WORK STATEMENT 16

Version Date: October 28, 2021 24

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 2

Table of Contents 27

Introduction ..................................................................................................................... 3 29

Summary Scope .............................................................................................................. 3 30

Place of Performance and Hours of Operation ................................................................ 3 31

Services to be provided by the Contractor ...................................................................... 4 32

AESD Assumption of Responsibility ................................................................................ 4 33

ITSM Assumption of Responsibility ................................................................................. 5 34

AESMF Compliance and Optional Functionality .............................................................. 6 35

AESD Supported Services and Installations ................................................................... 7 36

Supporting Tasks .......................................................................................................... 10 37

Optional Capabilities ..................................................................................................... 13 38

Optional Capability for Asset Discovery & Service Mapping ......................................... 13 39

Optional Capability for AESMF Business Management Processes ............................... 13 40

Optional Capability for Software Management .............................................................. 14 41

Optional Capability for Field Service Management ....................................................... 14 42

Optional Capability for Security Operations Management ............................................. 14 43

Staffing .......................................................................................................................... 15 44

Contractor Furnished Equipment .................................................................................. 20 45

Government Furnished Equipment (GFE) ..................................................................... 20 46

Performance Requirements ......................................................................................... 21 47

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 3

1.0 Introduction 50

This task order will establish and configure the cloud-based Software as a Service (SaaS) 51 environment to support the Army’s implementation of the Army Enterprise Service 52

Management Framework (AESMF) for service delivery and provide Tier 0 and Tier 1 support of 53 over 1.3M end users for IT services on DODIN-A. The AESMP and service support operations 54 will enable the Army to continue existing Army Enterprise Service Desk (AESD) operations, 55 optimize AESMF-based service delivery processes, and expand the functionality provided by 56 the SaaS environment via optional capabilities which may be exercised over the life of the task 57 order. 58

2.0 Summary Scope 59

The Contractor shall provide a scalable and configurable cloud-based SaaS environment that 60 supports the processes and functions defined in the AESMF. 61

The Contractor shall provide two full service (turnkey) customer service centers capable of 62 supporting AESD’s mission, agents on-site at designed Government locations, functional 63 management including subscriber maintenance, and ongoing operational maintenance of the 64

Army-wide AESMP provided on a SaaS basis for Government and Contractor use under a 65 separate task order. 66

The turnkey operations shall include all staff, telephony support systems, Workforce 67

Management Systems, and AESMP functional management support. Additionally, the 68

Contractor shall provide project management, ITIL, and onboarding services. The Contractor 69 shall integrate the telephony support systems and designated Government systems with the 70

AESMP. 71

All these services are provided from the Contractor's United States-based facilities having 72 network connectivity to the Army NIPR network and from Government furnished facilities at Ft. 73

Huachuca, AZ; Ft. Shafter, HI; and Camp Humphreys, South Korea which have network 74 connectivity to the Army NIPR/SIPR network. Travel may be necessary to support government 75 requirements. 76

3.0 Place of Performance and Hours of Operation 77

The work under this task order shall be performed at the following Government-provided 78

NIPR/SIPR service desk sites augmented by approved contractor-provided NIPR sites and 79 contractor-provided remote agents to meet required service levels. 80

Facility Type Location NIPR/SIPR

Government-owned and contractor-operated

Ft. Huachuca, AZ

NIPR/SIPR

Ft. Belvoir, VA NIPR/SIPR

Ft. Shafter, HI

Camp Humphreys, South Korea

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 4

Facility Type Location NIPR/SIPR

Contractor-owned and operated

TBD NIPR

TBD NIPR

Remote NIPR

The Contractor shall operate AESD 24x7x365 from a primary contractor location and provide a 82 secondary Contractor location for Continuity of Operations Plan (COOP) in order to confirm 83 continued operations in the event of problems at the primary site. In addition, four SIPR sites 84 are required to support Government operations. The contractor must staff agents at the 85 following three sites: Ft Huachuca, Ft. Shafter and Camp Humphreys. The following 86

Government facilities are available for contractor use: 87

Ft. Huachuca (up to 28 agent seats) (24x7x365 hours of operation) 88

Ft. Belvoir (up to 12 agent seats) (24x7x365 hours of operation) 89

Ft. Shafter (up to 22 agent seats) (24x7x365 hours of operation) 90

Korea - Camp Humphreys (up to 15 agent seats) (12x5x52 weeks per year hours of 91 operation). 92

The Ft. Belvoir facility may be substituted by commercial SIPR facilities if the contractor 93 has a facility that meets all current security and technological requirements. 94

The Contractor shall provide personnel as required in order to support on-boarding for up to 15 96 onboarding actions per year and may be required to travel to government designated locations 97 to support the new work. 98

All Contractor personnel providing services and managed capabilities may be considered 100

Emergency Essential, regardless of assigned working location. 101

4.0 Services to be provided by the Contractor 102

The Contractor shall provide technical and management services including program 103 management, technology management, information assurance, customer relationship 104 management, workforce management, knowledge management, incident management, 105 performance management, quality assurance/quality improvement, management reporting, 106 contingency/disaster recovery, onboarding, and continuous service improvement. 107

4.1 AESD Assumption of Responsibility 108

The Contractor shall stand up AESD-Worldwide (AESD-W), AESD-Pacific (AESD-P), and 109

AESD-Korea (AESD-K) operations and assume within six months of contract award the 110 service and support responsibilities from the incumbent AESD contractor. 111

At 6 months the contractor shall use the AESMP ITSM SAAS for NIPR enterprise 112 services ticketing, while continuing to use the government furnished ESMS and SIPR 113

SIF systems, for NIPR and SIPR C4IM services ticketing, until those government 114 systems are also replaced by the AESMP ITSM SAAS. 115

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 5

4.2 ITSM Assumption of Responsibility 116

From the initial award, the Contractor shall migrate operations and any necessary data to the 117

AESMP ITSM SaaS from: 118

1. The ITSM provided by the incumbent AESD contractor supporting NIPR enterprise services 119 ticketing within six months of contract award; 120

2. The ITSM known as the ESMS provided by the Government supporting both NIPR and 121

SIPR C4IM services ticketing within one year of contract award; and 122

3. The ITSM known as the SIF supporting SIPR enterprise services within one year of 123 contract award. 124

The migration shall include: 125

1. Obtaining the Authority to Operate (ATO) for the AESMP ITSM SaaS application in 126 accordance with the Department of Defense (DoD) Risk Management Framework 127 described in DoD Instruction 8510.01 dated March 12, 2014. 128

2. Loading, maintaining, and optimizing Government information in the AESMP ITSM SaaS, 129

3. Training Government Subscribers on use of the AESMP ITSM SaaS, and 130

4. Interfacing the NIPR AESMP ITSM SaaS with the contractor provided telephony system 131 and the following NIPR Government systems: 132

a. Enterprise Access Management Service-Army (EAMS-A)/Single Sign ON (CAC 133

Access), 134

b. NETPLUS/TMS (Call Management System), 135

c. ARCYBER Data warehouse, 136

d. DISA JRSS, 137

e. NETCOOL, 138

f. SPECTRUM, 139

g. DCOD, 140

h. ARMS (Scheduling Application) and 141

i. Through transition to additional and replacement common services provided by 142 cArmy (See attachment 0034 cArmy Cloud Common Shared Services List). 143

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 6

4.3 AESMF Compliance and Optional Functionality 145

The Contractor shall comply with the processes defined in the AESMF and configure the 146

AESMP ITSM SaaS for operations supporting the Army. The Contractor shall provide AESMP 147

ITSM SaaS access to authorized end users and enable Army subscribers to use the AESMP 148

ITSM SaaS for AESMF processes that are the responsibility of the Army. On this task order, 149 the government is outsourcing only Tier 0 and Tier 1 service support and is not outsourcing 150 responsibility for the execution of the remaining AESMF processes for Army activities such as 151

Army Asset Management. 152

The Contractor shall provide the AESMF functionality to Army subscribers with 54 optional 153 capabilities: an optional capability for Discovery & Service Mapping, an optional capability for 154

Business Management, an optional capability for Software Management, an optional capability 155 for Field Service Management and Security Operations Management. In the table below, the 156

AESMF processes and functions being provided for Army subscriber use are identified by 157 optional capability: 158

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 7

**Please see the Optional capabilities description is section 4.6 160

4.4 AESD Supported Services and Installations 161

The Contractor shall adjust staffing levels to address projected ticket volume ranges and 162

SLAs/KPIs while providing support for the following services: 163

Enterprise Services and applications for users located worldwide: 164

Email for basic class users and the following Commands for other service classes 165 and entitlements: 166

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 8

o NIPR (17 commands for Business Class and above) – AFC, AMC, 167

ARCYBER, ARNORTH, ARSOUTH, ATEC, FORSCOM, IMCOM, NETCOM, 168

RESERVES, SMDC, USACE, USAASC, USACIDC, USARPAC, USASOC, 169

and USMA. 170 o SIPR (33 commands for Business Class and above) AFC, AFRICOM, AMC, 171

ARCENT, ARCYBER, ARNORTH, ARSOUTH, ATEC, AWC, EUCOM, 172

FORSCOM, GUARD, HRC, HQDA, IMCOM, INSCOM, MDW, MEDCOM, 173

RESERVES, SDDC, SMDC, SOUTHCOM, TRADOC,USAASC, USACE, 174

USANTO-BDE, USACIDC, USAEUR, USARPAC, USARAF, USMA, 175

USMEPCOM, and USASOC. 176

Defense Mobility Unclassified Capability (DMUC) (Supporting Android/iOS 178 devices) (Purebred/Email+) 179

Army Knowledge Online (AKO) and AKO-SIPR 180

Enterprise Content Management Collaboration System (ECMCS) 181

Army Contracting Command (ACC) 182

Procurement Automated Data and Document System (PADDS) 183

Office of the Deputy Assistant Secretary of the Army (Procurement) (ODASA (P)): 184 o Standard Procurement Systems (SPS) 185 o Virtual Contracting Enterprise (VCE) 186 o Federal Procurement Data System – Next Generation (FPDS-NG) 187 o Army Contract Writing System (ACWS) (Currently Onboarding) 188

Web Emergency Operations Center (WebEOC) 189

Army Data Center Consolidation Plan (ADCCP) 190

Army Training Management System (ATMS) 191

Army Endpoint Security System (AESS) 192

US Army Reserve Command, Secure Army Reserve Network (USARC SARNET) 193

Office of the Administrative Assistant to the Secretary of the Army Migration (OAA) 194

Installation Management Command, Moral, Welfare, and Recreation 195

Systems Support Division (IMCOM MWR SSD) 196

Army Futures Command (AFC) 197

EAMS-A 198

Army Food Management Information System (AFMIS) 199

Army Endpoint Management Solution (AEMS) 200

Electronic Financial Liability of Property Loss (EFLPL) 201

Army Enterprise Staffing Management System 202

Reserve Component Automation System (RCAS) 203

Defense Readiness Reporting System-Army (DRRS-A) 204

Force Management System (FMS) 205

Army 365 206

Army-wide AESMP ITSM SaaS access and maintenance 207

Army Enterprise Information Technology as a Service Microsoft (AEITaaS-M) 208

(Currently Onboarding) 209

AEITaaS – Verizon (Currently Onboarding) 210

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 9

AEITaaS – AT&T (Currently Onboarding) 211

ARCYBER Headquarters G6 (ARCYBER HQS) (Currently Onboarding) 212

Virtual Mobile Infrastructure – Bring your own device/NIPR (VMI-B/N) 213

(Currently Onboarding) 214

Command, Control, Computers, Communications, Information Management (C4IM) for 216 the following command and installations: 217

93rd Signal Brigade, 7th Signal Command 218

Mid-Atlantic RNEC: Aberdeen Proving Ground

NE RNEC: Ft. Drum RNEC:Ft.

Campbell

Adelphi (Currently Onboarding) Ft. Devens Ft. Knox

Carlisle Barracks Ft. Dix Stand-alone NECs

RNEC: Redstone Arsenal Ft. Hamilton Ft. Bragg

Detroit Arsenal Natick SSC Ft. Gordon

Rock Island Arsenal Picatinny Arsenal Ft. Benning

SW RNEC: Ft. Stewart West Point Ft. Buchanan

Ft. Jackson RNEC: Ft. Eustis (JBLE)

Ft. Rucker Ft. Lee

106th Signal Brigade, 7th Signal Command 220

West RNEC: Ft. Carson NE RNEC: Joint Base San Antonio

Camp Hunter-Liggett Ft. Polk

Camp Parks Stand-alone NECs

Dugway Proving Grounds Ft. Bliss

Ft. Huachuca White Sands Missile Range

Ft. Irwin Ft. Hood

Presidio of Monterey Ft. Lewis (JBLM)

Midwest RNEC: Ft. Riley

Ft. Leavenworth

Ft. Leonard Wood

Ft. McCoy

Ft. Sill

21st Signal Brigade, 7th Signal Command 222

Stand-alone NECs

Ft. AP Hill

Ft. Belvoir

Ft. Detrick

Ft. Meade

Ft. Myer/McNair

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 10

AESD Pacific (311th Signal Command/516th Signal Brigade) 224

Hawaii Japan

Ft. Shafter Camp Zama

JB Pearl Harbor-Hickman Sagami Army Depot

Schofield Barracks Ft. Buckner/Torii Station

Wheeler Army Airfield Guam

Alaska Andersen Air Base

JB Elmendorf-Richardson Kwajalein

Ft. Greely Bucholz Army Airfield

Ft. Wainwright

SW RNEC: Ft. Stewart

Ft. Jackson

Ft. Rucker

AESD Korea (311th Signal Command/1st Signal Brigade Area NEC’s 1-4) 226

Area I NECs Area III NECs

Camp Casey Camp Humphreys

Camp Red Cloud K55/Osan Air Base

Camp Bonifas K-51 Kwangju Airbase

Camp Hovey Area IV NECs

Camp Stanley Camp Walker

Camp Kang Sa Ri K2/Daegu Air Base

Area II NECs K8/Kunsan Air Base

Yongsan Garrison Camp Henry

FEDE Compound Camp Carroll

Camp Kim Chinhae Naval Base

K16/Seoul Air Base Pier 8, Busan

CP Tango Busan Storage Facility

Camp Mujuk

Camp Seongju

DLA DRMO

K-1 Gimhae Airbase

Please also see Attachment 0030 Current System and Service Profile for understanding of 227 existing system coverage. 228

4.5 Supporting Tasks 229

The Contractor shall provide Information Assurance (IA) services for AESD and the 230

AESMP. These IA efforts shall enable AESD and AESMP to achieve its stated 231 missions, goals, and objectives. These include maintaining the IA levels in accordance 232 with DoD and Army policies and regulations; providing subject matter expertise in 233 accordance with the Risk Management Framework (RMF), all aspects of populating and 234 managing eMASS, including artifacts and documents; and other IA policies and 235

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 11

regulations. The skill sets and experience levels shall be commensurate with the 236 complexity and challenges of operating in a DoD environment. 237

The Contractor shall provide account administration and training of the Government-provided 238

BOMGAR technology for use by AESD agents. The Contractor shall provide Systems 239

Administration (SA) services for AESD and AESMP. These SA efforts shall enable AESD and 240

AESMP to achieve its stated missions, goals, and objectives, including system administration 241 and vulnerability management for CAP and GFE within the security boundary for which the 242

Contractor has access and privilege. This includes items, such as installation, upgrading, and 243 monitoring software and hardware; maintaining operating systems, remote access tools (e.g., 244

BOMGAR), security tools, web-servers, local and wide area networking; and troubleshooting 245 software and hardware. Personnel shall have the required training and/or certifications 246 necessary for the various hardware, software, and/or applications operating within the network 247 environment, per section 5.0. 248

The Contractor shall provide a working papers repository allowing unlimited 250

Government Program Office access in accordance with the working papers contract 251 deliverable. 252

The Contractor shall provide Service Management Reporting in the form of dashboards and 253 required deliverables as outlined in the contract. The interactive dashboards shall have the 254 ability to filter, sort, summarize, and drill down for variable periods (such as daily, weekly, 255 monthly, and annually) using real time and historical activity metrics and providing: 256

Performance against all SLAs/KPIs 257

Call volume analytics such as calls by queue and type; average handle time by call 258 type; other call attributes captured by the call management system 259

Email volume analytics such as emails by queue and type 260

Ticket volume analytics such as tickets by origination, type, ticket status, mean 261 time to restore (MTTR), VIP ticket handling 262

Users/seats volume analytics such as by type, organization, new/total, 263 active/inactive 264

Integrations and interfaces analytics such as by name, type, and data 265 volume. 266

The Contractor shall provide the necessary personnel and automation to facilitate Continual 267

Service Improvement (CSI) in order to increase efficiency/ improve effectiveness through 268 reduction in mean time to restore, standardization, technology insertion, process optimization, 269 and strategies to move IT support resolution knowledge closer to users/less technical agents. 270

The contractor shall facilitate process improvement support for, but not expressly limited to: 271

Active Directory management services 272

Enterprise service account management services 273

Desktop Software Delivery to AESD-W 274

Ad hoc CSI changes/recommendations 275

Support to 7th Signal Command and CONUS 276

Support to 311th Signal Command and the Pacific Theater 277

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 12

Project Office Enterprise Email 278

Defense Enterprise Email (DEE) Support, Defense Enterprise Provisioning Online 279

(DEPO) 280

The Contractor shall provide customer relationship management for all supported 281 services and locations in order to establish and maintain positive customer relationships 282 between the Contractor and the organizations supported by AESD. 283

The Contractor shall provide the Government with a monthly program review of Contractor 284 performance in the past month against established SLAs/KPIs, projected business needs, and 285 other supporting information as detailed in the contract deliverable Exhibit A. 286

The Contractor shall assist the Government Project Management Office (PMO) to initiate and 287 document a strategic planning process aligned under the service strategy component. This 288 must, at a minimum, provide 6, 12, and 24-month views of a strategic plan. The views shall 289 encompass plans for technological evolution, process improvement, service migration and 290 transition, ATO compliance, and cost performance optimization. The Contractor shall also 291 conduct a quarterly review of the strategic plan while providing summary assessments as 292 detailed in contract deliverable Exhibit A of the past quarter of ongoing continuous 293 improvement projects, onboarding actions, and system/service desk past performance 294 information as obtained from monthly reports and dashboards. 295

As directed by the Government, the Contractor shall also use additional Government-provided 296 ticketing or service management systems. The Contractor shall execute all AESD operations 297 activities to the extent possible given the level of administrative rights and access afforded the 298

Contractor in each Government-provided ticketing or service management system. 299

When directed by the Government after the initial AESMP ITSM SaaS training provided by the 300

Contractor prior to implementation, the Contractor shall provide Government personnel with 301 training on the configured AESMP ITSM SaaS in accordance with the recommended best 302 practices of AESMP ITSM SaaS tool being provided by the AESMP ITSM SaaS provider. 303

When performing software or integration development such as configuration and integration of 304 the AESMP ITSM SaaS with Government systems or addition of Government required 305 functionality, the Contractor shall: 306

1. Build to the highest abstraction of cloud services in order to meet functional, technical, 308 performance and cost goals. These services include commercial SaaS, Platform as a 309

Service (PaaS), Database Management as a Service, and others to accelerate testing, 310 accreditation and fielding to the Army. 311

2. The contractor must use microservices architecture and automation where technically and 313 economically feasible. 314

3. Comply with publishing all application programming interface (API) information within the 316

Enterprise Data Services Catalog (EDSC). 317

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 13

4. Work with Army Future Command (AFC)'s Command, Control, Communications, 319

Computers, Cyber, Intelligence, Surveillance and Reconnaissance Center (C5ISR) to 320 establish Cyber Security Service Provider (CSSP) services (as required by DoDI 8530 and 321 as described by the DISA Cloud Computing Security Requirements Guide) for Army 322 services hosted in commercial cloud. 323

5. Ensure that all new and existing applications, systems, or services deemed non-legacy 325 shall expose their data and functionality through service interfaces (for example, OpenAPI 326 specification). 327

6. Ensure that all service interfaces, without exception be designed to be consumable from 329 external sources and must plan and design to be able to expose the interface to 330 developers. 331

7. Ensure that all Army data assets are registered in the Army Enterprise Data Service 333

Catalog (EDSC) and comply with Dublin Core Metadata Element Sets and International 334

Standards Organization Metadata Registries requirements. 335

8. Ensure that All Army data sources are developed with built-in data exchange capabilities. 337

Data mapping shall also be implemented to increase efficiency and ease of use of data 338 assets as they are being translated or transformed. At a minimum, comply with the Global 339

Force Management Data Initiative ; International Standards for dates; Geopolitical Entities, 340

Names and Codes, Common (GENC); Joint Consultation, Command and Control 341

Exchange Data Model; or Resource Description Framework standards and schemas. 342

9. Ensure that all cloud-related costs/price, which include but are not limited to: Cloud 344

Service Provider (CSP) costs, and cloud Operations and Maintenance (O&M) costs/prices 345 are clearly identified and available for government reporting purposes. 346

4.6 Optional Capabilities 347

Optional Capability for Asset Discovery & Service Mapping 348

Within 6 months of exercise of the Asset Discovery & Service Mapping optional 349 capability, the Contractor shall configure asset discovery and service mapping 350 capabilities and reconfigure existing asset discovery processes in operation to support 351 the migration for up to 5 NECs, (at a minimum FT Detrick, Ft Drum, and FT Natick 352

NECs). The Contractor shall train Government subscribers on use of the asset 353 discovery and service mapping capabilities. Upon successful implementation for those 354

NECs, the Government will establish a schedule with the Contractor for the Contractor 355 to incrementally train and onboard the remaining ARCYBER/NETCOM/Signal 356

Commands/Brigades/NECs worldwide to the asset discovery and service mapping 357 capabilities in a 1 year period or less. 358

Optional Capability for AESMF Business Management Processes 359

When directed by the Government to provide the AESMF business management 360 processes, the Contractor shall expand the configuration and capabilities of the AESMP 361

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 14

ITSM SaaS to provide Government subscriber use of the AESMP ITSM SaaS for the 362 execution of the additional AESMF processes and functions identified above. The 363

Contractor shall train subscribers identified by the Government for these additional 364 capabilities. The Government will establish a schedule with the Contractor for the 365

Contractor to incrementally train and onboard ARCYBER/NETCOM/Signal 366

Commands/Brigades/NECs worldwide to the AESMF business management processes 367 in a 1 year period or less. 368

Optional Capability for Software Management 369

When directed by the Government to provide the software management optional 370 capability, the Contractor shall expand asset management capabilities to provide 371 software asset management that enables software license management, integrates with 372 existing discovery capabilities to identify active in-use quantities, supports license use 373 optimization, and provides a summary dashboard of software use activities in 374 comparison to software license positions with supporting drill-downs to individual 375 software licenses status. The Contractor shall train subscribers identified by the 376

Government for these additional capabilities. The Government will establish a schedule 377 with the Contractor for the Contractor to incrementally train and onboard 378

ARCYBER/NETCOM/Signal Commands/Brigades/NECs worldwide to use of the 379 software management capabilities in a six month period or less. 380

Optional Capability for Field Service Management 381

When directed by the Government to provide the field service management optional 382 capability, the Contractor shall provide enhanced mobile device and desktop 383 workspaces enabling field service and technical management tasks to include project 384 estimating, work order assignment to include external 3rd party work assignments, work 385 order scheduling, dispatch and routing of service technicians, onsite equipment 386 scanning and lookup, installation and repair checklists, work order status tracking, and 387 an overall dispatch/work order dashboard. The Contractor shall train subscribers 388 identified by the Government for these additional capabilities. The Government will 389 establish a schedule with the Contractor for the Contractor to incrementally train and 390 onboard ARCYBER/NETCOM/Signal Commands/Brigades/NECs worldwide to use of 391 the field service management capabilities in a two year period or less. 392

Optional Capability for Security Operations Management 393

When directed by the Government to provide the security operations management 394 optional capability, the Contractor shall provide enhanced IT operations management 395 orchestration that uses workflow, scripting, and automation to enable mass device 396 changes based on CMDB data populated from discovery or other means. This 397 functionality shall enable the Government to identify, prioritize, and remediate device 398 configurations providing proactive, coordinated responses to vulnerabilities or other 399 security concerns. 400

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 15

5.0 Staffing 401

5.1 Staff To Be Provided 402

The Contractor shall provide qualified personnel in sufficient quantities to perform all tasks, 403 including agents, project management, and support staff. The Contractor shall verify the staff 404 has the appropriate clearances, qualifications, and skills required to perform the tasks. A 405 secret clearance is required for all positions other than Entitlement Managers listed below. 406

The Contractor shall provide recruiting, screening, hiring, training, and monitoring of staff for all 407 tasks. The Contractor shall facilitate confidentiality of data and conduct security background 408 checks for each employee before an employee receiving work. A Government representative 409 will do the fingerprinting process; however, the Contractor shall facilitate the FBI fingerprinting 410 requirements for each contracted employee. 411

The Contractor shall require its employees supporting AESD to be citizens or legal residents of 413 the United States. However, local nationals are acceptable at the Korea help desk. Employees 414 must have the ability to speak, read, and write English fluently (Korean required at Camp 415

Humphreys and Japanese at Ft. Shafter, a minimum of 1 agent per shift shall be available to 416 support Korean / Japanese speaking end users ). The Contractor's direct employment of any 417

Korean-National labor for performance of this contract shall be governed by Republic of Korea 418

(ROK) labor law and United States Forces Korea (USFK) regulations pertaining to the direct 419 employment and personnel administration of Korean National personnel. 420

5.2 Staff Training and Certifications 421

The Contractor is responsible for training to maintain skills and certifications for their staff and 422 shall verify that personnel accessing information systems have the proper and current 423 information assurance certification to perform information assurance functions in accordance 424 with DoDD 8140.01, Cyberspace Workforce Management. Contractor employees and sub-425 contractor employees performing work under this contract and who have access to 426

Government information systems and networks shall create a user account and profile in the 427

Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in 428 the unit container managed by the COR. 429

The Contractor shall maintain training data in order to confirm compliance for all contractor 431 personnel in ATCTS. Certificates of successful completion of IA training, Acceptable Use 432

Policies (AUP), applicable baseline and computing environment certifications, and continuing 433 professional education credits, as required by DoD 8570.01-M, shall be uploaded to the 434

ATCTS and provided to the COR for continuous compliance monitoring and reporting. 435

The Contractor shall ensure that all employees IA certifications are released to the Department 437 of Defense through the Defense Workforce Certification Application 438 at https://www.dmdc.osd.mil/appj/dwc/index.jsp 439

Contractor personnel who do not have proper and current certifications shall be denied access 441 to DoD information systems for the purpose of performing information assurance functions. 442 https://web-mech02.mail.mil/owa/redir.aspx?C=7bSLFWcE4HwCzMCclYAaX0sLGXjvN51XplkyyBFQou-3bLoNk1nYCA..&URL=https%3a%2f%2fatc.us.army.mil https://web-mech02.mail.mil/owa/redir.aspx?C=077UrWX4yNSUM6jUJPxmwv_2aSvWGsy-8RAlZTBBMN8YzrwNk1nYCA..&URL=https%3a%2f%2fwww.dmdc.osd.mil%2fappj%2fdwc%2findex.jsp

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 16

5.3 Information Assurance Training and Documentation 443

All contractor personnel shall comply with the following mandatory and recurring training 444 requirement for AESD training: 445

Training Requirement

DoD Cyber Awareness Challenge* Annually

Derivative Classification* + Bi-Annually

Cyber Security Fundamentals Training One-time

Threat Awareness and Reporting Program * Annually

Personally Identifiable Information (PII)* Annually

Operation Security Awareness for Military Members, DoD Employees, and Contractors Course (GS130.16)

Annually+

Anti-Terrorism Level 1 Annually

Information Security Program Training Annually

*Training certificates shall be saved in PDF format and maintained by the Contractor. 448

+Training required only for personnel having SIPR access or any personnel performing 449 derivative classification. 450

Contractor personnel shall comply with the following IA documentation requirements for AESMP 452

ITSM SaaS accesses: 453

Document Requirement

PII Handling and Incident Response Annually Review

AESD PII Purpose and Inventory Annually Review

PEO EIS Cyber PII SOP Annually Review

PII Acceptance Document Annually

Acceptable Use Policy Annually

Privileged Level Access Agreement One-time (no expiration)

In addition to the IA training/certification requirements above, Contractor personnel requiring 455

SIPR access shall complete the following: 456

Course Requirement

Derivative Classification Training IS 103.06 Initial and Annually Review

Marking Classified Information Initial and Annually Review

Insider Threat Awareness Training Initial and Annually Review

5.4 Technical Training 457

Contractors shall, as required, use Army Skillport to complete the MD 100 Windows 10: 458

Configuring Windows Devices Learning Program. Agents must complete the training and save 459 the certificate. 460

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 17

Contractor personnel accessing the service desk are required to obtain Information 462

Assurance Technical (IAT) Level I Certification before onboarding to AESD-W. 463

Certifications for performing in other roles shall be in accordance with DoDD 8140.01 as 464 specified in Section 5.2.: 465

Certification

A+ Continuing Education (CE)

Cisco Certified Network Associate (CCNA)-Security

Network+ CE

Systems Security Certified Practitioner (SSCP)

Agents in Tier 1-2 and above are required to have the ITILv3 or above Foundations 468 certification. If an agent from Tier 1-1 is promoted to a 1-2 position, that employee shall have 469

90 days from the date of promotion to attain the ITIL Foundations certification. Contractor shall 470 be responsible for verifying the agent attains this certification. 471

The Contractor shall ensure that all Contractor personnel receive AESMP ITSM SaaS role 472 training/certification applicable to their position as an agent, system administrator, or other 473

AESMP ITSM SaaS maintenance position in accordance with the recommended best practices 474 of AESMP ITSM SaaS tool being provided by the AESMP ITSM SaaS provider. 475

5.5 Other 476

Entitlement Manager positions shall have the following qualifications: 477

Qualification

Must be a U.S. Citizen

Must have a High School Diploma

Completed Trustworthiness/Public Trust investigation

6 months of experience

5.6 Key Personnel 479

The following roles are identified as Key Personnel for performance of all tasks. The 480

Government requires one full time Program Manager, one full time Technical Capabilities 481

Manager, and at least one full time Operations Manager (OPSMGR). 482

The Contractor shall provide complete resumes for key personnel supporting AESD in order to 484 demonstrate alignment of individual skills and experience. In the event a position is vacated, 485 the Contractor will submit a complete resume when they submit the application for a Common 486

Access Card (CAC) for the person replacing the vacated position. Any key personnel position 487 shall not remain vacant for more than 5 calendar days, the Contractor may propose a 488 temporary substitute by providing a resume of the substitute personnel, if the substitute meets 489 or exceeds the qualifications of the personnel being replaced. In addition, the Contractor will 490 supply additional information requested by the Contracting Officer. Proposed permanent 491 replacement personnel should have equal to or superior qualifications to those personnel 492

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 18

being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after 493 receipt of the required information of the consent on replacement personnel. No change in 494 fixed unit prices may occur because of key personnel substitution. A temporary substitute 495 shall not be in place for longer than 30 business days, before a permanent replacement is 496 found. 497

Core Competencies for Key Positions -- Key Position candidates, regardless of their 498 particular subject matter expertise, shall have the following capabilities: 499

The ability to communicate in both oral and written forms, demonstrating an ability to 500 communicate effectively with all levels of staff, as well as clients. 501

Familiarity with DoD security requirements as applied to their subject matter expertise. 502

Experience working in an environment similar in size (or larger) and scope to AESD. 503

Strong working knowledge of large, complex IT environments. 504

Program Manager (PM) – The Program Manager is defined as having responsibility for 505 oversight of operational planning, establishment, execution, and evaluation of a multifaceted 506 program/project typically consisting of a set of closely related sub-programs or associated 507 activities. The PM should have the qualifications required as follows: Help Desk Institute 508

Support Center Director (HDI SCD) Certification 509

ITIL v4 or higher Foundations and ITIL 4 Specialist, Create, Deliver, and Support 510

(CDS)Certified 511

Secret Clearance 512

Current Program Management Institute Program Management Professional (PMI PMP) 513

Certification 514

Oversees fiscal, operational, administrative, and human resources management of the 515 program. 516

Serves as principal point of representation and liaison with external constituencies 517 on operational matters. 518

Provides day-to-day technical/professional guidance and leadership, as appropriate, to 519

AESD. 520

The following experience is highly desirable: 521

Demonstrated excellence in planning, directing, and managing Call Center or sales 522 efforts in a similar sized services organization to AESD 523

Demonstrated successful management and supervision of employees of various labor 524 categories and skills in efforts similar in size and scope to AESD 525

Knowledge of industry accepted standards and best practices related to Call Center 526 missions 527

Demonstrated experience in a DoD IT environment 528

Experience managing performance-based contract Task Orders and knowledge of 529

Federal Acquisition Regulations (FAR) 530

Demonstrated ability for oral and written communication with the highest levels of 531 management 532

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 19

Planning, directing, and managing IT projects/operations in an organization similar 533 in size to AESD 534

Knowledge of industry accepted standards and best practices related to Information 535

Management operations, and ITSM best practices. 536

Technical Capability Manager – The Technical Capability Manager is responsible for 537 operational planning, implementation, and operation of technical capabilities provided by the 538

Contractor for service desk use, such as the call management, workforce management, and 539 ticketing systems. The Technical Capability Manager shall have the qualifications required in 540 accordance with DoDD 8140.01, as well as the following qualifications: 541

Secret Clearance 542

ITIL v4 or higher Foundations or above certification 543

ITIL 4 Specialist, CDSCompTIA Security+ CE certification or equivalent 544

At least 4 years overall DoD IT environment and RMF experience 545

At least 4 years of IT Service Desk management or IT Service Desk operations experience 546

At least 1 year of experience in planning, directing, and managing large scale 547

IT operations in an organization similar in size to AESD 548

Knowledge of industry accepted standards and best practices related to Information 549

Management operations, and with ITSM best practices 550

Familiarity with AR25-1 and AR25-2 551

Experience with AESS/HBSS, SCCM, NESSUS Assured Compliance Assessment 552

Solution (ACAS), and POA&M submission 553

An understanding of DoD culture and standards. 554

Operations Manager (OPSMGR) – The Operations Manager is responsible for service desk 556 operations and acts as the contractor liaison between the Government PM/COR and the 557

Contractor’s service desk workforce. Provide oversight of the locations, including CONUS and 558

OCONUS. This individual will confirm that day-to-day activities are running efficiently and 559 properly. The Operations Manager shall have the qualifications required in accordance with 560

DoDD 8140.01, as well as the following qualifications: 561

Secret Clearance 563

ITIL v4 or higher Foundations certification 564

ITIL 4 Specialist,CDScertification 565

Help Desk Institute Support Center Manager certification 566

DoDD 8140.01 Baseline certifications, such as COMPTIA A+, Network+, or Security+ 567

At least 4 years overall IT Service Desk management or IT Service Desk operations 568 experience 569

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 20

At least 1 year of experience planning, directing, and managing service support operations 570 in an organization similar in size to AESD 571

Knowledge of industry accepted standards and best practices related to Information 572

Management operations and with ITSM best practices 573

Strong customer service skills and technical aptitude 574

An understanding of DoD culture and standards 575

Responsible for facilitating the timely process through which incidents and problems are 576 managed. Includes problem recognition, research, isolation, resolution and follow-up 577 steps 578

Resolve less complex problems immediately, while more complex problems are 579 assigned to second level support or supervisor (to the PM or the appropriate Army 580 operations center), typically involving the use of problem management database and 581 help desk system 582

Provide guidance/training for less experienced personnel 583

The following experience is highly desirable: 584

Planning, directing, and managing IT projects/operations in an organization similar 585 in size to AESD 586

Supervising employees in efforts similar in size and scope as referenced within 587 the PWS. 588

Knowledge of industry accepted standards and best practices related to Information 589

Management operations, and with ITSM best practices. 590

6.0 Contractor Furnished Equipment 591

The Contractor shall configure and provide the following: 592

United States-based primary and secondary COOP facilities 593

Automated Call Director (ACD) call processing technology 594

Phones and supporting standard office equipment such as copiers, fax machines, etc. 595

Workforce management software system providing automated cost accounting linking 596 individual agent labor, calls/contacts, and tickets to specific supported AESD services and 597 providing detailed analytics for work queue analysis and optimized IVR/ACD/service 598 management system configuration and integration 599

Public Internet Connectivity subject to DoD firewalling and Information Assurance policies 600

Functional management including subscribers maintenance, and ongoing operational 601 maintenance of the Army-wide fully IA accredited and configured AESMP ITSM SaaS 602 including web-based portal with knowledge bases to support Tier 0 self-service and live 603 agents. 604

7.0 Government Furnished Equipment (GFE) 605

The Government will provide the following: 606

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 21

Sponsorship in order for the Contractor to obtain NIPR/SIPR access 607

SIPR facilities, as required, to support SIPR-based operations for AESD 608

Sponsorship in order for the Contractor to obtain telecommunications services to support 609

AESD Operations using Government- provided toll free numbers and Video 610

Teleconferencing technologies. 611

Secure Host Baseline-Army for configuration of GFE desktop computers. 612

NIPR connectivity to the AESD contact centers and contractor access to existing 613

Government ticketing/workflow/knowledge management service management systems 614

Technology to support the Contractor with obtaining and maintaining RMF compliance 615

Laptop/Desktop computers for Agents, PMO, and SMS technicians, as required. GFE 616 computers are to be configured and maintained by the Contractor for AESD Agents 617

Provide and administer the BOMGAR server and provide the Contractor access to the 618

BOMGAR remote tool and the ability to administer accounts and provide reporting. 619

Access to cloud-based common services (such as EAMS-A, ACAS, or others provided by 620 cARMY) with which AESD needs to interface for operations and compliance 621

8.0 Performance Requirements 622

The Performance requirements for AESD are specified as Service Level Agreements 623

(SLAs) and Key Performance Indicators (KPIs). The following table summarizes the 624

SLAs and KPIs for AESD to be tracked by user community: 625

ITEM NAME TYPE

1 First Contact Resolution KPI

2 Average Speed to Answer SLA

3 Abandonment Rate SLA

4 Response Time to an Inquiry Submitted via Web Form KPI

5 Ticket Accuracy SLA

6 AESD Customer Satisfaction KPI

7 AESD MSP Responsiveness SLA

In addition, the Contractor shall accumulate performance metrics at least by call, call type, 628 ticket, ticket type, originating user community, and agent, where applicable, in order to provide 629 visibility to the Government on general performance, SLA, and KPI compliance for the 630

Contractor and the AESD Operations. 631

The Contractor shall provide the Government transparency for its current agent staffing 632 levels and skills training for the ability to handle each call type and ticket type by user 633 community. The Contractor shall accumulate metrics on: (1) the total hours used in 634 support of each user community by call type, call volume, ticket type, and ticket volume; (2) 635 how many on-hand agents are trained/cross trained to service each call type and ticket type by 636 user community; and (3) what are the current training requirements for each call type and 637

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 22

ticket type by user community in terms of hours per agent in order for the agent to either 638 attain or maintain skills necessary to handle that call type or ticket type. 639

The Government and the Contractor shall review the structure of SLAs and KPIs quarterly in 640 order to add, modify, or remove SLAs or KPIs for the support services being provided by 641 the Contractor for AESD. 642

Projected ticket volumes shall be reviewed quarterly by the Government and the Contractor 643 with Service Owners for any adjustments. 644

The Contractor shall provide the Government and AESD customers the capability to access a 645 reporting dashboard unique to their organization. Generally, this dashboard consists of the 646

AESD operational profile (the supported services and locations of AESD customers and AESD 647

End Users), call/ticket volumes by supported service, SLA/SLA activity measurements by 648 supported service, AESD functional capabilities profile, contact center locations, and real time 649 views of call center technologies such as real time call queues and wait times being captured 650 by the telephony system. 651

These standardized metrics and other ticketing and telephony information shall be available to 652 the Government and AESD customers, and reviewed weekly as a measure of AESD 653 operational performance and to identify AESD service improvements. Along with 654 communication of AESD operational activity to customers, the ticketing and telephony 655 information is used in the execution of the AESD QASP for monitoring the performance of the 656 underlying AESD supporting infrastructure. Because of this continuous operations analysis, if 657

AESD Government management identifies projects it feels will improve service, a change 658 request may be provided to the Contractor for review. 659

The following business rules will be used in determining when tickets should and should not be 660 created: 661

Channel Event/Contact Result Exceptions

Inbound Call

An inbound call is received with an inquiry, incident, problem, or service request

A ticket is generated

A ticket already exists for a specific user for the incident, problem, service request, or other inquiry

The user is calling to check status on an existing ticket

The user is calling to provide additional information on an existing ticket

The user is calling to further discuss an existing ticket

The user is calling back because the initial call was disconnected

An inbound call is received from a user related to a problem reported by other users

A ticket is generated

A ticket for the specific user already exists for the problem

UNCLASSIFIED//FOUO//ACQUISITION SENSITIVE 23

Channel Event/Contact Result Exceptions

Outbound Call

An outbound call is placed in response to a web form request for call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a web chat request for call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a voicemail request for call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a user request for a call-back

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

An outbound call is placed in response to a user request for a call-back related to a problem reported by other users

A ticket is generated

A ticket for the specific user already exists for the problem

Web Chat A request to initiate a Web Chat session is received

A ticket is generated

A ticket already exists for the incident, problem, service request, or other inquiry

The web chat is initiated for the purpose of checking status on an existing ticket

The web chat is initiated for the purpose of providing…