PWS 20240612 CLEAN_Redact.pdf

Defensive Cyberspace Operations (DCO)

Performance Work Statement

For

Task Order 2 - Cyber Platforms and Systems Program Management Advisory and Assistance Services

12 June 2024

Task Order 2 for CPS Program Management Advisory and Assistance Services PWS

TABLE OF CONTENTS

1. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

2. DEFENSIVE CYBER OPERATIONS (DCO) PROGRAM MANAGEMENT ADVISORY

AND ASSISTANCE SERVICES

3. BACKGROUND

4. OBJECTIVES

5. SCOPE

6. SPECIFIC TASKS

6.1 Task Area 1 – General Support

6.2 Task Area 2 – Technical Management Support

6.3 Task Area 3 - Program Management Support

7. STAFFING AND KEY PERSONNEL

7.1 Program Manager

7.2 Project Manager

8. PERSONNEL REQUIREMENTS

8.1 Contractor Personnel, Disciplines, and Specialties

8.2 Contractor Identification in the Government Workplace

8.3 Personnel Administration

9 PERFORMANCE STANDARDS

10. PLACE OF PERFORMANCE

11 PERIOD OF PERFORMANCE

12 SECURITY REQUIREMENTS

12.1 Facility Security Clearance

12.2 Security Clearance and Information Technology (IT) Level

12.3 Information Security and Other Miscellaneous Requirements

13 GOVERNMENT FURNISHED PROPERTY (GFP)/ GOVERNMENT FURNISHED

EQUIPMENT (GFE)/ GOVERNMENT FURNISHED INFORMATION (GFI)

13.1 Government Furnished Property (GFP)

13.2 Government Furnished Information

13.3 Government Furnished Data/Contractor Furnished Data

14. OTHER PERTINENT INFORMATION OR SPECIAL CONSIDERATIONS

14.1 Identification of Potential Conflicts of Interest (COI)

14.2 Identification of Non-Disclosure Requirements

14.3 Packaging, Packing and Shipping Instructions

14.4 Inspection and Acceptance

14.5 Property Accountability

14.6 Transitioning

14.7 Supply Chain Risk Management

14.8 Training

15 CONTRACTOR TRAVEL AND OTHER DIRECT COSTS (ODCS)

16. DATA RIGHTS

17. DELIVERABLES

18. QUALITY CONTROL (QC)

19. POST-AWARD AND KICK-OFF MEETING

20. SECTION 508 ACCESSIBILITY STANDARDS

ATTACHMENT A-1 NON-DISCLOSURE AGREEMENT (NDA)

ATTACHMENT B-1 CONTRACTOR LABOR CATEGORY MATRIX

ATTACHMENT B-2 PERFORMANCE REQUIREMENTS SUMMARY

3. BACKGROUND

PM DCO provides Defensive Cyberspace Operations Suite of Complimentary Systems (DSCS) equipping capability, as well as other specific defensive cyberspace capabilities, to the Army Cyber Protection Brigades (CPBs), Cyber Protection Teams (CPTs), and the Cyber National Mission Forces (CNMF). In addition, PM DCO provides critical capabilities in accordance with (IAW) Joint Publications (JP) 3-12 to preserve the Army’s ability to utilize blue cyberspace capabilities and protect data, networks, cyberspace-enabled devices, and other designated systems by defeating on-going or imminent malicious cyberspace activity.

The Army's cyber mission requires the integration of worldwide suites of complementary systems capabilities for U.S. Army Cyber Command (ARCYBER) designated global, regional, and local CPTs. To provide the required capabilities tailored to the specific threat and mission urgent need, the Army must enable flexible, scalable, elastic, and responsive changes driven by the evolving threat landscape, technological innovations, and the availability of cyberspace solutions and tools.

The PM DCO provides the DSCS equipping capability to Army CPBs and CPTs, which provides critical capabilities to preserve the Army’s utilization of friendly cyberspace capabilities and protection of data, networks, net-centric capabilities, and other designated systems in all operating environments and conditions. More specifically, defensive cyberspace operations protect against, detect, mitigate, and respond to anomalous network activity generated by known and unknown cyber threats. Commanders conduct defensive cyberspace operations using organic and externally supplied assets. The overall mission objective of PM DCO is to establish defense-in-depth across the entirety of Department of Defense (DoD) cyberspace by simultaneously combining defensive cyberspace operations capabilities at the global, regional, and local levels to enable mission assurance using a layered, adaptive approach in support of unified land operations.

To meet this mission objective, PM DCO has adopted an open, flexible, scalable, elastic, and agile development approach that is designed to be responsive to change driven by both the ever-evolving threat landscape, technological innovations, and the availability of cyberspace solutions and tools. PM DCO is leveraging a variety of procurement avenues to meet the urgent and ever evolving operational needs, to include standard acquisitions under the Federal Acquisition Regulation (FAR) and acquisitions using non- FAR Other Transaction Authority (OTA).

The PM DCO requires the capability to create and manage our emerging technology assessment environment, hosting environment, operational environment, and sustainment environment.

The DCO program currently provides ten (10) Acquisition Category (ACAT) III and IV Programs of Record (PORs):

• Cyber Analytics (CA)

• User Activity Monitoring (UAM)

• Castle Keep

• Defensive Cyber Operations Mission Planning (DCOMP)

• Threat Emulation

• Defensive Cyber Operations Tools Suite (DCO Tools Suite)

• Deployable Defensive Cyberspace Operations Systems-Modular (DDS-M)

• Garrison Defensive Cyberspace Operations Platform (GDP)

• Forensics and Malware Analysis (F&MA)

• Counter Infiltration (CI)

Near-Term Mission: Continue delivery of initial operating DCO capabilities to CPTs, Regional Cyber Centers, and select Corps and below units across all three components (COMPOs): Active, Reserve and National Guard. Careful exploration and prototyping of technologies are required to support the mid-term development and deployment of DCO solutions.

Mid-Term Mission: Provide full operational capabilities to the force. Solutions stemming from the approved DCO Information System Initial Capabilities Document (IS-ICD), and follow-on Requirements Definition Packages (RDPs) will start to be fielded during this period as PORs. Technology advances will increase the flexibility and support rapid fluidity of operations. The Army will strive to influence Science and Technology (S&T) efforts to meet long-term requirements.

Long-Term Mission: Employ advanced technologies resulting from academia and DoD S&T efforts to increase the ability of cyberspace defenders in the future, and expand and develop responsive, dynamic, and tailorable DCO capabilities. Advanced technologies offer giant leaps in solutions, requiring less size, weight, and power (SWaP) and generating effects that ensure use of friendly cyberspace.

This work is primarily being placed within the Program Manager (PdM) for CPS. The CPS office is responsible for the day-to-day operations of the Forge, and the Armory. The Forge is the environment to find, assess and integrate new cyber technologies; the Armory is the environment used to store and maintain DCO capabilities; the Development, Security and Operations (DEVSECOPS) is the environment used by Soldiers to make real-time adjustments to DCO capabilities.

Forge Background: The Forge is an environment that provides assessment and integration capabilities during the development and integration phases of operations. In this environment, the Government assesses new technologies within a controlled environment, tests capabilities in an integrated environment, provides virtual training access 24/7 Worldwide, and tests and pushes approved updates remotely. The DCO Program leverages non-FAR based OTA to solicit prototypes/new technologies for procurement consideration. The Cyberspace Real-Time Acquisition Prototyping Integration Development (C-RAPID) process allows DCO to rapidly procure and evaluate capabilities before making a significant monetary obligation based on explicit entry and exit criteria for each solicitation. The C-RAPID process drives Cybersecurity/Risk Management Framework (RMF), system of systems engineering and integration, and testing focused on early operational utility evaluations to the forefront of decision making. The C-RAPID process concludes when a prototype has demonstrated sufficient maturity to warrant procurement and insertion into POR baselines.

Armory Background: The Armory serves as the authoritative source for capabilities within the approved operational baseline. Additionally, the Armory provides opportunities for warfighters to provide feedback for optimization of tools based on available training and mission focused training. The Armory is the primary focus area for DCO mission supported logistics and sustainment. The DCO will field and stage equipment at Armories. The DCO currently has two Armories--one located at Fort Gordon to support the Active component CPBs, and another located in Fort Belvoir to support Compos 2 and 3.

DEVSECOPS Background: The Forge currently utilizes the DevSecOps process to allow defensive cyberspace operations developers to rapidly develop, test, release, and operate defensive cyber solutions.

This process is key to how the Forge operates and supports finding technologies to address new requirements. This process supports the warfighter by allowing rapid integration of critical solutions into the current hardware platforms, and by providing them with the most up-to-date capabilities to utilize on their missions.

4. OBJECTIVES

The objective of this contract is to provide strategic level program management advisory and assistance services to PdM CPS to facilitate evolving PdM CPS practices, with the intention of meeting critical milestones, delivering capabilities, and continuously improving performance.

The Contractor shall assist in establishing requirements to support activities related to the Army Defensive Cyber initiatives within the DCO portfolio by providing seamless, transparent, and efficient services.

5. SCOPE

The Contractor shall provide program management advisory and assistance services to support a full range of required cyber-related advisory assistance services and work products for the PM DCO & PdM CPS.

This contract support will include identifying issues; sustaining capabilities; monitoring performance;

testing technologies; recommending capabilities; managing facilities; providing real-time integration and development of capabilities; creating environments; and recommending solutions to enhance the mission effectiveness of military personnel; enhance supporting platforms, systems, components, or materials proposed to be acquired or developed by the DoD; and/or enhance current platforms, systems, components, or materials in use by the armed forces.

The scope of services includes support in each of the following task areas:

Task Area 1: General Support Task Area 2. Technical Management Support Task Area 3: Program Management Support

6. SPECIFIC TASKS

The Contractor shall follow a performance-based approach throughout contract execution. The Contractor shall furnish all management, labor, tools, supplies, and materials necessary to provide a full range of information technology (IT) and defensive cyberspace operations expertise to support the planning, design, assessment, testing, updating, documentation, implementation, development, sustainment, and fielding of automated systems, to include implementation of the IT Box Model construct through the Joint Capabilities Integration Development System (JCIDS) process. The “IT Box” construct requires fewer iterations of validating capability requirements documents through the JCIDS process by describing the overall Information Systems (IS) program and delegating validation of detailed follow-on requirement and solution oversight to a flag-level organization other than the JROC or Joint Capabilities Board (JCB). The Contractor shall support the Doctrine, Organization, Training, Material, Leadership and Education, Personnel, and Facilities (DOTMLPF) process.

The Contractor shall provide personnel capable of performing the tasks specified below. All Contractor personnel shall meet or exceed the position descriptions, clearance levels, and skills & qualifications specified in Attachment B-1, CONTRACTOR LABOR CATEGORY MATRIX.

6.1 Task Area 1 – General Support

The Contractor shall provide general support in the following areas. Requirements-based priorities shall include, but are not limited to, the following: Reduction in facilities support/property management is deemed necessary in support of the DCO mission.

Priority 1

a. Provide onsite Executive and Operational assistance in monitoring and facilitating the integration of tasks and the administration of Product Offices.

Priority 2

b. Provide telecommunications support, as part of the ODCs, to include providing and maintaining two separate commercial internet service lines at minimum level of 1Gb and 5Gb, respectively.

6.1.1 Acquisition Management (DoDD 5000.01, DoDI 5000.02)

The Contractor shall apply knowledge and experience in acquisition program management laws, regulations, policies, and procedures to DCO systems, subsystems, and equipment or software procurement activities, pre/post-award project/program management tasks, and acquisition programs throughout their life cycles. The Contractor shall be proficient in systems development using the JCIDS IT Box Model and acquisition management IAW Department of Defense Directive (DoDD) 5000.01, Department of Defense Instruction (DoDI) 5000.02, and other DoDI 5000 series instructions and guidance. The Contractor shall apply rapid contracting methodologies, as well as Agile, Scaled Agile Framework (SAFe), Scrum, and other methodologies utilized in the rapid development and acquisition of capabilities.

The Contractor shall provide support to PM DCO Product Managers (PdMs) and Assistant Product Managers (APM) with the following activities, including, but not limited to:

Priority 1

• Develop, maintain, and adhere to the Simplified Acquisition Management Plan (SAMP).

• Develop and maintain Test and Evaluation Master Plans (TEMPs).

• Develop, maintain, and adhere to the Integrated Master Schedule (IMS).

• Assure projects/programs conform to DoDD 5000.01, DoDI 5000.02, and other DoDI 5000 series instructions and guidance.

• Appropriately and clearly interpret regulatory and legal requirements applicable to acquisitions, but not provide legal advice to Government officials.

• Interpret DoD acquisition guidance and support acquisition planning and cyber program integration.

• Prepare planning documents to coordinate integrated acquisition strategies.

• Support the development of acquisition implementing/operating instructions, directives, plans, and policies.

• Review and provide analysis on various acquisition documents and products.

• Prepare cyber-focused acquisition documentation and executive-level decision papers and prepare and staff actions for functional and technical review and comment.

Priority 2

• Perform internal and external agency coordination and reporting.

• Support the preparation and execution of executive-level Acquisition Strategy Panels and Boards, component Acquisition Plans, program acquisition baseline reviews, acquisition lifecycle phase reviews, and other acquisition documentation and reviews.

Priority 1 cont.

The Contractor shall develop and prepare documentation to support the planning, coordination and review of acquisition policy and documentation; daily, weekly, and monthly status updates and reports; and the management of the electronic tools used to create, store, retrieve and manage documents for Government review and approval. The Contractor shall create, maintain, update, and execute a comprehensive IMS and time-based plans for PM DCO consistent with system acquisition management plans, milestones, best practices, and the latest scheduling and tracking program management software. All schedules, timelines, and plans shall leverage industry best practices, and focus on the integration of known and risk-based timelines to support the management of programs and projects at the lowest level possible. The Contractor shall develop, coordinate, maintain, and brief all time-based metrics, schedules, Earned Value Management (EVM) data, action plans, and “get well” plans based on established goals and milestones. The Contractor shall develop and maintain Plan of Actions and Milestones (POA&Ms); produce supporting metrics for timeliness and speed of execution; and keep the PM DCO staff informed of timelines, risks and upcoming events. The Contractor shall be involved in the scheduling, coordination, planning, and execution of programmatic events.

6.1.2 - REMOVED

6.2 Task Area 2 – Technical Management Support

The Contractor shall provide technical management support in the following areas. Requirements shall include, but are not limited to, the following:

6.2.1 Analytics Support

This LCAT has been deemed unnecessary for the DCO Mission.

6.2.2 Technical Editing

The Contractor shall provide Technical Editing support in the following areas. PM DCO identifies 6.2.2a, 6.2.2b and 6.2.2d as the top priorities for this LCAT. Requirements shall include, but are not limited, to the following:

a. Provide publications support to PM DCO program managers, engineers, and other personnel in developing DoD and Army publications in support of the civil engineers’ IT automated systems.

b. Prepare documents pertaining to National Defense Authorization Act (NDAA) Certification and the IT

Management Application (ITMA).

c. Update the Enterprise Information Technologies Data Repository (EITDR), Mission Assurance Support

Service (eMASS), and/or other designated repository for all PM DCO systems and PM DCO managed systems.

d. Review and correct program plans, instructions, manuals, handbooks, pamphlets, catalogs, visual aids, newsletters, engineering technical letters, military style handbooks, various technical reports, professional journal articles, policy letters, staff summary sheets, etc.

e. Provide packages for staffing to outside agencies.

6.2.3 Systems Security Certification and Accreditation (C&A) Services

6.2.4 Information Assurance Officer (IAO), Information Systems Security Officer (ISSO) and Information Systems Security Engineer (ISSE) IAO, ISSO, and ISSE shall provide support at the Unclassified and Secret platform level. Reduction in ISSO support is deemed necessary in support of the DCO mission.

The Contractor shall provide IA support in the following areas. PM DCO identifies 6.2.4b, 6.2.4c, 6.2.4d and 6.2.4g as the top priorities for this LCAT. Requirements shall include, but are not limited, to the following:

a. Develop A&A documentation for assigned systems.

b. Utilize Certificate of Networthiness (CON) or RMF process requirements, as appropriate.

c. Complete system-level risk assessments of all existing documentation to identify gaps in RMF objectives and security compliance, and update the documentation, as necessary, for RMF compliance for all systems.

d. Identify mandated Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs).

e. Identify and document the gap analysis between the DoDI 8500.02 security controls and the STIGs for all system-level components.

f. Provide A&A support for security certifications, and annual review requirements.

g. Provide support for updating and maintaining the eMASS and APMS records.

6.2.5 Independent Validation and Verification (IV&V)

6.2.6 Quality Control (QC)

6.2.7 Cybersecurity Program Support

The Contractor shall provide technical expertise on cybersecurity, commercial IT hardware, commercial IT software, data analytics, algorithm creation, insider threats, command and control platforms, application creation, software code writing, anti-tamper software, anti-tamper hardware, advanced cyber sensors, cyber threat detection methods and products, air/surface transportation methods and regulations, cyber threat simulation, training methods and regulations, contract writing and regulations, logistics management, knowledge management, Risk Management Framework, Program Management, cost and budget management/development, schedule management/development, and systems engineering.

6.2.7.1 Secure Software Assessment – Software Code Review

6.2.7.2 Cybersecurity Policy and Strategy Planning

6.2.7.3 Cyber Analytics

6.2.8 Systems Engineering (SE) Support

PM DCO identifies that 6.2.8a – 6.2.8c are the top priorities for this LCAT. Requirements shall include, but are not limited, to the following:

The Contractor systems engineering support shall assist in balancing the conflicting design constraints of cost, schedule, and performance, while maintaining an acceptable level of risk. The Contractor systems engineering support shall solve systems acquisition problems using a multi-disciplined approach. The Systems Engineer should possess the experience, skills, and critical thinking ability to identify and focus efforts on the activities needed to enhance the overall system effectiveness, suitability, survivability, and sustainability.

a. Review Logical and Physical Architectures.

b. Support bare metal and virtual representations of current and future defensive cyber systems in the

Forge, Armory, and DevSecOps environments.

Systems Engineering support and services are specific to cloud engineering, big data engineering, hardware engineering, and/or software engineering. The applicable technical and management Systems Engineering processes, as defined within the Defense Acquisition Guidebook, across the entire systems and software life cycle are as follows:

Systems Engineering

Process Capabilities / Features

Technical Analysis • Assists in tracking, measuring, and assessing metrics.

• Assists in metric collection

Requirements Management

• Provides requirements bi-directional traceability capability.

• Provides requirements flow-down capability.

• Tracks requirements changes

Risk Management

• Assists in risk management, to include, technology issues, opportunity planning and risk identification, analysis, mitigation/management, and monitoring

Stakeholder Requirements

Definition

• Assists in capturing and identifying stakeholder requirements.

• Assists in analyzing and maintaining stakeholder requirements

Verification • Assists in determining the system and system elements performance as designed through demonstration, examination, analysis and test

Validation • Assists in determining, the effectiveness, suitability, and survivability of the system in meeting end-user needs

c. Support system engineering technical reviews, such as design reviews, test readiness reviews, and deployment readiness reviews for all PM DCO assigned programs.

6.2.9 Software Engineering

6.2.10 Requirements Management, Analysis and Definition

6.2.11 Configuration Management

6.2.12 Automation Testing Support

6.2.13 Network Engineering

Reinstating 6.2.13 which was previously removed in an administrative error.

The Contractor shall assist the Government in the acquisition, development, implementation, and operation of a worldwide layer 3 virtual routing and forwarding (VRF) mission network that integrates non-VRF capable installations/networks, as required, via virtual private network(s) (VPNs). The Contractor shall verify and validate that the products and solutions being provided to and/or developed for PM DCO meet or exceed the specified cybersecurity and operational requirements. The Contractor shall develop and/or recommend network security measures, such as firewalls, network security audits, or automated security probes, as necessary, based on the requirements and operational exigencies. The Contractor shall identify complex networking problems; review related information to develop and evaluate options; analyze the information and evaluate the results to choose the best solution to solve the problems; and implement the approved solutions. The Contractor shall develop conceptual, logical, or physical network designs. The Contractor shall coordinate network or design activities with the designers of associated/interfacing/integrating networks. The Contractor shall monitor and analyze network performance and report on data input or output to detect problems, identify inefficient use of computer resources, and/or perform capacity planning and recommend changes to improve the network, infrastructure or information systems. The Contractor shall analyze data to identify or resolve operational problems. The Contractor shall develop computer or information security policies or procedures. The Contractor shall perform additional duties, as required, which shall include, but are not be limited to:

a. Perform market research to identify new or improved solutions to PM DCO requirements

b. Maintain and develop disaster recovery plans

c. Identify complex networking problems and reviewing related information to develop and evaluate options and implement solutions

6.3 Task Area 3 - Program Management Support

The Contractor shall provide Program Management support in the following areas. Requirements shall include, but are not limited to, the following:

a. Provide ongoing planning, tracking, and reporting; meeting support; communications and document support; information sharing; and cross-program coordination.

b. Identify and recommend risk management strategies to handle cost, schedule, and/or performance problems.

c. Perform program risk management analysis.

d. Provide engineering assessments, analyses, reviews, evaluations, and provide recommendations pertaining to risk management strategies and plans, which will be used to identify, analyze, mitigate, track, and control risks throughout the life cycle.

e. Provide briefings, studies, and analysis for the development of programs, which may take the form of information, advice, opinions, alternatives, analyses, evaluations, or recommendations to complement the Government’s technical expertise in accomplishing its initiatives.

6.3.1 Agile Program Management and SCRUM Management

PM DCO identifies that all responsibilities detailed for this LCAT are top priorities. Requirements shall include, but are not limited, to the following:

The Contractor shall provide Agile program management and SCRUM management assistance. The Contractor shall generate new or unique solutions and embrace new ideas that help sustain PM DCO and CPB business, which shall encompass everything from continuous improvement to new product and package innovation. The Contractor shall collaborate with stakeholders and develop and leverage relationships with stakeholders to appropriately stretch and impact the development network.

The Contractor shall assist leadership and the development partners with an Open-Source Freestyle software development life cycle process. This will include:

a. Processing definition

b. Agile Scrum based software development

c. Hybrid Agile based module development, along with cross functional communication The Contractor shall provide software technical project management, to include:

a. Requirements traceability and source code control

b. Test case management and defect tracking

c. Metrics definition to be used to track process improvement.

The Contractor shall monitor and coordinate activities for the DCO Tools Automation Pilot and DCO Labyrinth Pilot projects. Requirements shall include, but are not limited to, the following:

a. Perform analyses of data relative to the projects

b. Develop and maintain project documentation and technical reports.

c. Conduct assessments and communicates results.

d. Contribute to the evaluation, analysis, and development of recommended solutions!

e. Monitor project progress and customer satisfaction.

f. Provide periodic status reports, as needed.

g. Facilitate efficient communication and project support between the client and external agencies.

h. Assist in the preparation of project correspondence, as needed.

i. Assist in the development of project briefs.

j. Perform detailed reviews of project documentation.

k. Establish, implement, and monitor project controls for consistency of approach on document controls, contracts, project schedules, estimates to complete, reports, minutes, and other correspondence

7. STAFFING AND KEY PERSONNEL

The Contractor must maintain an adequate workforce during PM DCO’s core hours (i.e., 0900-1530) for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

If one or more of the Key Personnel becomes, or is expected to become, unavailable for work under this contract for any reason for a continuous period exceeding thirty (30) business days or is expected to devote substantially less effort to the work than indicated in the Contractor’s proposal or initially anticipated, the Contractor shall immediately notify the Contracting Officer (KO). In addition, subject to the concurrence of the KO or his/her authorized representative, the Contractor shall promptly replace the individual with an individual with no less than equal ability and qualifications.

The Government identifies the following roles as Key Personnel for the performance of this contract. See Attachment B-1, CONTRACTOR LABOR CATEGORY MATRIX, for position descriptions, clearances, experience, skills, and qualifications for required key personnel.

• Project Manager III (7.2)

7.1 Program Manager

7.2 Project Manager

PM DCO identifies that all responsibilities detailed for this LCAT are top priorities. Requirements shall include, but are not limited, to the following:

The Project Manager will oversee all aspects of a project, leading a team on large projects or a significant segment of large and complex projects. The Project Manager shall analyze new and complex project-related problems and create innovative solutions that address the schedule, technology, methodology, tools, solution components, and financial management of the project. The Project Manager shall provide applications systems analysis and long and short-range plans for application selection, systems development, systems maintenance, and production activities for necessary support resources.

The Project Manager shall be proficient in systems development using the JCIDS IT Box Model and shall be proficient in acquisition management IAW Department of Defense Directive (DoDD) 5000.01 and Department of Defense Instruction (DoDI) 5000.02. The Project Manager shall apply rapid contracting methodologies, Agile, Scaled Agile Framework (SAFe), Scrum, and other methodologies utilized in rapid acquisition.

The Project Manager shall assist the PdM CPS in project management; ensuring projects are delivered on time, to budget, and IAW the technical specification. The Project Manager shall assist the PdM CPS in planning, developing, testing, and documenting projects. The Project Manager shall apply business process improvement practices to reengineer methodologies/principles and modernize projects. The Project Manager shall apply, as appropriate, activity and data modeling, transaction flow analysis, internal control, risk analysis, modern business methods, and performance measurement techniques. The Project Manager shall assist in establishing standards for information systems procedures, including, but not limited to, International Organization for Standardization (ISO) 9001 Quality Management System, 20000 Information Technology.

7.3 REMOVED

7.4 REMOVED

8. – PERSONNEL REQUIREMENTS

8.1 Contractor Personnel, Disciplines, and Specialties

The Contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combination of education, training, and experience, as specified in the Attachment B-1, CONTRACT LABOR CATEGORY MATRIX. The Contractor shall not allow personnel without the job competency training specified in the PWS and the qualifications and competency levels identified in the Attachment B-1, CONTRACT LABOR CATEGORY MATRIX, to perform any tasks. In the event of any identified noncompliance, the Contractor shall, upon Government request, provide proof of the individual’s training and/or qualifications (individual name, training/qualification type, training/qualification certificate, and date of training/qualification) to perform the specified contract activities.

8.2 Contractor Identification in the Government Workplace

All Contractor and subcontractor personnel shall wear company picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, during approved virtual environments, or via electronic mail, Contractor and subcontractor personnel shall identify themselves as such to avoid situations in which Contractors and Government personnel discuss sensitive information proper only for intra-Government communications. Contractors and subcontractors shall identify themselves on any attendance sheet or coordination documents they may review. Electronic mail signatures shall identify the company affiliation of all Contractor and subcontractor personnel. All Contractor and subcontractor personnel shall wear Government-issued identification, as specified. The Government will provide the necessary Common Access Card (CAC) and appropriate building badge for all Contractor and subcontractor personnel providing services under this contract.

8.3 Personnel Administration

The Contractor shall provide the following management and support, as required:

a. The Contractor’s Program Manager shall notify the COR of those personnel who will perform duties during Government closures.

b. The Contractor shall continue to provide support, as specified in the PWS, during Government training and stand-down days.

c. The Contractor shall provide support, as specified in this PWS, except on Federal holidays or when the

Government facility closes due to local or national emergencies, administrative closings, or similar Government-directed facility closings.

d. The Contractor shall provide initial and refresher employee training, as required, to meet the PWS requirements.

e. The Contractor shall make necessary travel arrangements for employees.

f. The Contractor shall provide necessary personnel to support the tasks defined in this PWS.

g. The Contractor shall provide administrative support to employees in a timely fashion (e.g., time keeping, leave processing, pay, emergency needs).

9 PERFORMANCE STANDARDS

The Performance Standards for this contract are listed in Attachment B-2, PERFORMANCE

REQUIREMENTS SUMMARY.

10. PLACE OF PERFORMANCE

The primary place of performance shall be Government facilities located at Fort Belvoir, VA, Fort Eisenhower, GA, Tobyhanna, PA, and other designated locations. The Contractor is expected to provide workspace, and all required supporting office equipment and services at its own facilities, and an acceptable Telework Policy, if required, for staff members not assigned to a government facility. The Contractor shall provide on-site functional and certified SMEs to support all task areas, as described in Attachment B-1, Contractor Labor Category Matrix.

Alternate Place of Performance - Contingency Only. As determined by the COR, Contractor employees may be required to work at an alternate place of performance (e.g., home, the Contractor's facility, or another approved facility within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather, etc.). Additionally, the Contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR. Non-emergency/non-essential Contractor personnel should not report to a closed Government facility. The Contractor shall prepare all deliverables and other contract documentation utilizing the Contractor’s resources. To the extent possible, the Contractor shall use its best efforts to provide the same level of support as stated in the PWS. In the event services are impacted, reduced, compromised, etc., the KO or the Contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

The Contractor is responsible for providing services, work products, and maintaining an adequate workforce for the uninterrupted performance of all tasks defined within this PWS during the core hours of 0900-1530 hours, Monday thru Friday, except on Federal holidays or when the Government facility closes due to local or national emergencies, administrative closings, or similar Government-directed facility closings.

Business days are Monday through Friday, with an average workweek of 40 hours, with the exception of Federal holidays. The Government recognizes the following Federal holidays:

• New Year's Day (1st of January)

• Martin Lutheran King's Birthday (3rd Monday in January)

• Washington's Birthday (3rd Monday in February)

• Memorial Day (Last Monday in May)

• Juneteenth (19th of June)

• Independence Day (4th of July)

• Labor Day (1st Monday in September)

• Columbus Day (2nd Monday in October)

• Veteran's Day (11th of November)

• Thanksgiving Day (4th Thursday in November)

• Christmas Day (25th of December)

11 PERIOD OF PERFORMANCE

The period of performance (POP) of this task order is a one (1) 12-month base period, and four (4) 12-month option periods for a total of sixty (60) months.

12 SECURITY REQUIREMENTS

The Contractor shall coordinate site visits with the site Point of Contact (POC) at least 72 hours prior to requiring any site access. Contractor personnel without security clearances, who are performing any task under this PWS, must be escorted by Government personnel who are cleared.

This section shall be considered a supplement to Block 13 of the Government-provided DD Form 254, DoD Contract Security Classification Specification. The following security requirements shall apply to this effort.

a. DoDM 5200.01, Vol 1-4 Information Security Program, 28 July 2020

b. DoD 5200.02, Procedures for the DoD Personnel Security Program, 29 October 2020

c. 32 Code of Federal Regulations Part 117, National Industrial Security Program Operating Manual, dated 24 February 2021

d. DoDM 5105.21, Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Information and Information Systems Security, 6 October 2020 requiring access to classified information on this contract. (DISS replaced the Joint Personnel Adjudication System (JPAS) as the System of Record on March 31, 2021)

12.3.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed, as required.

12.3.5 The Government retains the right to request the removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interests of the Government.

12.3.6 Contractor personnel will generate or handle documents that contain Controlled Unclassified Information (CUI) information at the Government facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the Government facility. Contractor personnel will have access to, generate, and handle classified material up to Top Secret classification level only at the Government facilities listed in the place of performance section of this document. All Contractor deliverables shall be marked IAW DoDM 5200.01, Vol. 2, Incorporating Change 4 Effective July 28, 2020, DoD Information Security Program: Marking of Information, and DoDM 5400.07, DoD Freedom of Information Act Program, unless otherwise directed by the Government. The Contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables.

12.3.7 The Contractor and all associated subcontractors’ employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures the Government representative provides. The Contractor shall also provide all information required for background checks to meet installation access requirements by the installation Provost Marshal Office, Director of Emergency Services, or Security Office accomplishes. The Contractor workforce shall comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy.

In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

12.3.8 U.S. Army Installations participate in a standardized entry protocol. The Contractor shall enroll all employees that require routine access. The Contractor shall be responsible for providing all necessary and accurate information to obtain and maintain enrollment in the base/facility access system. The Contractor shall also be responsible for ensuring that the personnel enrolled remain enrolled during the entire period of performance in which that Contractor/employee is needed. The Contractor shall meet all requirements identified by the Office of the Garrison Commander in compliance with any installation policy memorandum. In the event that there are changes to any Contractors and/or employees thereof, the Contractor shall notify the United States Government (USG) and ensure enrollment is properly updated.

Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures;

or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the Federal Bureau of Investigations (FBI) fingerprint check and a successfully scheduled NACI at the Defense

Counterintelligence and Security Agency (DCSA).

12.3.9 Contractors and associated Subcontractor employees who do not require a CAC, but require access to a DoD Facility, shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by Government representative)., or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

12.3.10 The Contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 30 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This SOP/Plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it, and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the Contractor shall have an identified Level II OPSEC coordinator per AR 530-1. (See Deliverable Number 14, OPSEC Standing Operating Procedure (SOP)/Plan)

12.3.11 The Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top-Secret” and requires all Contractors and its employees to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the Contractor.

13 GOVERNMENT FURNISHED PROPERTY (GFP)/ GOVERNMENT FURNISHED

EQUIPMENT (GFE)/ GOVERNMENT FURNISHED INFORMATION (GFI)

13.1 Government Furnished Property (GFP)

All GFP provided under this contract shall remain the property of the Government and shall remain in place.

The Contractor shall be responsible for any lost, damaged (through negligence), or stolen GFP IAW FAR Part 45. All GFP shall be hand-receipted to all Contractor and subcontractor personnel performing work under this PWS and shall be maintained at the Government’s facilities. The Government may grant exceptions during emergency or ad hoc telework situations. During emergency or ad hoc telework situations approved by the Government, GFP may be issued to Contractor and subcontractor personnel performing work under this PWS. The Government will provide GFP including, but not limited to: (1) workspace, classified/unclassified workstations, office supplies, computer equipment, telephones, fax machines (local, DSN and long distance), electronic mail, reproduction facilities, and proper building access identification badges, as required; (2) any computer software that the Contractor may need to accomplish tasks at the Government site; (3) access to appropriate reference material and databases necessary in the performance of this effort and the authority to access all information required to perform this effort; and (4) coordination assistance to assist the Contractor in accessing required information. The Government requires the Contractor to follow standard operating procedures established by the Government for the use of property provided.

13.2 Government Furnished Information

The Contractor shall be responsible for safeguarding all Government property provided for contract use, as well as all Government information to which the Contractor has access. The Contractor shall establish and implement methods safeguard all badges, access cards, etc. issued to Contractor personnel, and to ensure that they are not lost or used by unauthorized persons. The Government considers information from the Government’s secure web site to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars. At no time will the Government release any data to the public with the Contractor’s name and contract number associated with the data.

13.3 Government Furnished Data/Contractor Furnished Data

All physical records, files, documents, and work papers provided and/or generated by the Government, generated for the Government in the performance of this PWS, and/or maintained by the Contractor in the performance of this PWS for transfer or release to the Government or a successor Contractor shall become and remain Government property. Nothing in this section alters the rights of the Government or the Contractor with respect to patents, data rights, copyrights, or any other intellectual property, or proprietary information, as set forth in any other part of this PWS. Data will be available IAW DFARS clauses 252.227- 7013, 252.227-7014, and 252.227-7015, as appropriate.

14. OTHER PERTINENT INFORMATION OR SPECIAL CONSIDERATIONS

14.1 Identification of Potential Conflicts of Interest (COI)

The Contractor is advised that, due to the nature of the requirements to be performed under this contract, an OCI may result in current or future PEO-EIS DCO acquisitions. In order to avoid any appearance of a conflict, the Contractor shall be prohibited from proposing on any future DCO POR procurements or DCO Other Transaction Authority (OTA) competitions during the period of performance of the contract and for one year thereafter.

14.2 Identification of Non-Disclosure Requirements

Attachment A-1, Non-Disclosure Agreement (NDA), shall be signed and submitted prior to assignment or in-processing of any Contractor and subcontractor employees performing work in support of this contract

IAW Deliverable Number 1.

14.3 Packaging, Packing and Shipping Instructions

Not applicable.

14.4 Inspection and Acceptance

The Government will inspect and accept all services at destination. The Government will have ten (10) business days from the date of delivery to accept or reject submitted deliverables and data items. If the deliverable is rejected, the Contractor shall have five (5) business days to resubmit. When a deliverable is rejected, it will immediately be reported as late. Upon second submission, if the deliverable is again rejected, it will be considered a failure to deliver. Failed deliverables must be re-worked until they are acceptable at no additional cost to the Government.

14.5 Property Accountability

The Contractor shall perform property accountability.

14.6 Transitioning

14.6.1. Transition-In (Phase In)

All Key Personnel/Key Positions must be onboard at start of the period of performance. The Contractor shall complete 50 percent of the total staffing requirements within two weeks after the start of the PoP and shall complete 100 percent no later than 30 business days after the start of the PoP. (See Deliverable Number 10)

14.6.2. Transition-Out (Phase Out)

The Contractor shall provide transition support services throughout the phase-out period of the PWS to support a seamless transition of data and services, and to minimize interruptions or delays to work that would impact the mission. (See Deliverable Number 11)

14.7 Supply Chain Risk Management

See corresponding paragraph in the Base PWS for PM DCO CPS PM A&AS.

14.8 Training

See corresponding paragraph in the Base PWS for PM DCO CPS PM A&AS.

14.8.1. AT Level I Training

14.8.2. iWATCH Training

14.8.3. OPSEC Training

14.8.4. Cybersecurity Awareness Training

14.8.5. Threat Awareness Reporting Program (TARP)

14.8.6. Information Assurance (IA)/Information…