Draft_High_Level_Afghan_Personnel_and_Pay_System_PWS_ver_21.docx

For Official Use Only

Afghan Personnel & Pay System (APPS) Performance Work Statement (PWS)

1 January 201618 November 2015 Version 2117

TABLE OF CONTENTS

This page intentionally left blank

Performance Work Statement (PWS)

Afghan Personnel and Pay System (APPS)

1 January20 September 20165

Part 1 General Information

1. GENERAL: This is a non-personal services contract to list the requirements for the maintenance and sustainment of the Afghan National Security Forces (ANSFANDSF) AHRIMS program and to develop, implement, train, and deploy a fully integrated human capital management (HCM) system based on the current AHRIMS core software of OpenERP. The U.S. Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the U.S. Government.

1.1. Description of Services/Introduction: This PWS sustains AHRIMS version one point two (1.2) at the Ministry of Defense (MoD)/Afghan National Army (ANA) and at the Ministry of Interior (MoI)/Afghan National Police (ANP) and supports refinement and expansion of AHRIMS functions. APPS will deliver an integrated human capital management system that shall encompass all aspects of human resource management from personnel and equipment authorizations, personnel accountability, compensation planning and management, payroll services, retirement/pension management, and reporting. AHRIMS shall be retired upon the release and acceptance by the US Government of APPS version one (1) at which time such maintenance will transfansfer to the APPS and all future versions until the completion of the project. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, other items, and non-personal services necessary to perform the following key functions in this PWS except for those items specified as contractor government furnished property and services. The Contractor shall perform to the standards in this contract. The contractor shall also perform the following key functions:

1.2. Objectives:: Sustain the current AHRIMS version one point two (1.2) through the completion of development of the APPS to provide a fully functional human capital management system capable of managing all aspects of human resource planning and manning. Provide automated internal controls to the ministries aimed at reducing corruption, graft, and mismanagement of the ANDSF payroll.

1.3. Scope: Each job function listed herein is to be accompanied with a plan for the development, training, and turnover of the following objectives to be performed during the period of performance (POoP) to a designated ANDSF office. The goal is that by contract end, the ANDSF shall be managing and maintaining the APPS with limited exceptions. The turnover of functions from the Contractor to ANDSF personnel shall occur in a phased manner as described herein. Following turnover, the Contractor shall maintain a support function until the expiration of the sustainment contract.

1.4. Period of Performance: Base Contract award: Eighteen (18) months. Option 1: One (1) year post Base POP for sustainment only tasks.

1.5. Quality Assurance: The U.S. Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The QASP is primarily focused on what the U.S. Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards shall be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.1 Quality surveillance of contractor performance will be performed as stated in the US Government’s Quality aAssurance support Surveillance pPlan (QASP).

1.5.2 The US Government, through implementation of its QASP, will monitor the contractor’s performance on a continuing basis.

1.5.3 Performance evaluation will be accomplished by monitoring compliance with the performance requirements as described in the contract and in the QASP.

1.5.4 The surveillance methods to assess and evaluate the contractor will be used by the US Government and described in the QASP. These methods are, but not limited to:

1.5.4.1. 100% Inspection –- the US Government will evaluate 100% designated tasks.

1.5.4.2. Partial Inspection - tThe US Government will evaluate less than 100% of designated tasks and on a selective basis.

1.5.4.3. Random Sampling - tThe US Government will evaluate less than 100% of designated tasks on a random basis.

1.5.4.4. Independent Verification and validation (IV&V) - Verification and validation performed by an IV&V contractor engaged by APPS PMO may be used to determine that the work product delivered by the contractor matches the content requirement in the contract.

1.5.5 Operational Monitoring –- tThe US Government will examine reports generated by automated tools and logs and websites.

1.5.6 Customer Feedback - tThe US Government will evaluate survey and random sampling, which will be used to evaluate customer satisfaction.

1.5.7

1.6. Recognized Holidays::

New Year’s Day - 2 days Mohammad’s Birthday - 1 day Victory Day of Islamic Revolution - 1 day Independence Day - 1 day Masood’s Day - 1 day Parliamentary Elections - 1 day First Day of Ramadan - 1 day Eid Days - 3 days Big Eid - 4 days Ashura Day - 1 day Ramadan - Working hours during Ramadan shall be from 0800-1200

1.7. Hours of Operation: The Contractor shall provide services during normal ANDSF working hours Saturday through Thursday from 0800–1700.

1.8. Place of Performance:

1.8.1 The work shall be performed at the Ministry of Defense and its associated units, Ministry of Interior and its associated units, HQ Resolute Support, and the Contractor’s facility.

1.8.2 In addition, the Contractor shall deploy employees to perform monthly site visits and provide a week of training, oversight, and assistance at each ANSFANDSF location. This shall include help desk assistance, AHRIMS operability, trouble-shooting, and continuity for on-site personnel. The Contract employees shall work within the Force Protection umbrella of ANDSF when conducting tasks at MoD/ANA and MoI/ANP sites.

1.9. Type of Contract: The U.S. Government shall award a hybrid cost plus award fixed fee anda and a firm price contract.

1.10. Security Requirements:

1.10.1 Contractor Security

1.10.1.1. The contractor will abide by appropriate security regulations.

1.10.1.2. The contractor shall ensure that their individuals requiring APPS program access to the development system, system and development documentation, production system and documentation, or system data will have the proper background investigations conducted by the MOI or MOD personnel office and necessary training.

1.10.1.3. No individual without a valid background investigation and necessary training can access the any APPS documentation or system.

1.10.1.4. APPS PM retains the right to request removal of contractor personnel, regardless of prior clearance or adjudication status, whose actions while assigned to this contract conflict with the interests of the US Government. The reason for removal will be fully documented in writing by the contracting officer.

1.10.2 Protecting Personally Identifiable Information (PII)

1.10.2.1. Personally Identifiable Information is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.

1.10.2.2. System shall have the following safe guards, at a minimum, to limit access to personally identifiable information:

1.10.2.2.1. Limit maximum record retrieval to 700 records (kandak) displayed or printed

1.10.2.2.2. Maximum retrieval access limited to users with a validated need-to-know as deemed by MOI and MOD personnel policies

1.10.2.2.3. All access or reports generated with PII shall be captured in the system audit log to include, at a minimum:

1.10.2.2.3.1. User accessing the information/report

1.10.2.2.3.2. Date and time of access

1.10.2.2.3.3. Terminal used for access

1.10.2.2.3.4. Action generated by user: query, display, download, or print information

1.10.2.2.4. Repeated requests or access for maximum limit for similar PII reports shall be flagged in the system upon the second request for such information within a seven (7) day period and access to the system blocked at the third (3rd) request for such information with a report generated for the MOI or MOD designated security and chief of personnel records.

1.10.2.3. The system shall have controls that limit access to all PII and restrict the ability to access, download, or manage all PII designated fields or reports.

1.10.2.4. The following will are deemed PII and will have additional guards in place to protect the access and release of the specific data fields:

1.10.2.4.1. Person’s full name: last, first, middle

1.10.2.4.2. Passport or national identification number

1.10.2.4.3. Father or grandfather’s name

1.10.2.4.4. Personal characteristics - biometric records, photograph, finger prints, DNA

1.10.2.5. The following data fields shall be deemed PII if matched to any the elements in para 1.10.2.4.

1.10.2.5.1. Date and/or place of birth

1.10.2.5.2. Religion

1.10.2.5.3. Race/ethnicity

1.10.2.5.4. Home address

1.10.2.5.5. Medical records or information

1.10.2.5.6. Education – military or police training

1.10.2.5.7. Financial to include banking information, i.e. bank account number or mobile money identification

1.10.2.5.8. Employment information

1.10.3 Data at Rest (DAR) security and protection: Data at rest will be implemented on all computers; removable storage devices (thumb drives, data CD, portable hard drives, etc.) used on the network to access, store, or transport APPS personnel data.

1.10.3.1. Full Disk Encryption (FDE): The FDE solution will protect against unauthorized reading or copying of data off a protected hard drive or other components. Steps should be taken to ensure that pre-boot authentication (PBA) is also implemented which will allow only registered users to boot workstations following token or other authentication methods.

1.10.3.2. Removable Storage Encryption (RSE): Mandatory encryption is required for data copied to removable storage devices, such as USB thumb drives, external hard drives, compact discs (CDs), digital versatile discs (DVDs), etc. This encryption must protect all data transfansferred off of a DAR protected work station. Where necessary, and for official use only, an inter-operability utility must be installed on removable storage devices that may be used to decrypt data.

1.10.4 Safeguarding Classified Information and Materials. The contract is unclassified but some of the information handled by the contractor will be Sensitive.

1.10.4.1. The contractor will ensure requirements for safeguarding sensitive information and sensitive materials, for obtaining and verifying personnel security clearances, for verifying security clearances and indoctrination of visitors, for controlling access to restricted areas, for the security of automated and non-automated management information systems and data are fulfilled.

1.10.4.2. The contractor’s management system shall prevent unauthorized disclosure of sensitive unclassified information.

1.10.4.3. The US Government shall be immediately notified of any security incident or any indication of a potential unauthorized disclosure or compromise of sensitive unclassified information.

1.11. Physical Security: The contractor shall be responsible for safeguarding all U.S. Government equipment, information and property provided for contractor use. At the close of each work period, U.S. Government facilities, equipment, and materials shall be secured.

1.12. Special Qualifications: N/A

1.13. Post Award Conference: The Contractor shall attend a post-award conference to be conducted within seven days after contract award. The conference date, place and time shall be coordinated by the COR.

1.14. Contracting Officer Representative (COR): A COR shall be designated in writing by the Contracting Officer. All duties and authorities shall be as stated in a COR designation letter. The COR shall not have delegated contractual authority and therefore may make no changes in the terms or conditions of the contract.

1.15. Key Personnel: Key personnel are those people considered essential to successful contractor performance.

1.15.1 Program Manager.

1.15.1.1. The contractor shall provide a program manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the government contracting officer.

1.15.1.2. The Program Manager (PM) shall be a working PM overseeing the team using best business practices and working as an integrated team and shall be responsible for all contractual responsibilities and delivery of all contract deliverables listed in the Deliverable Schedule (Section 3, Deliverable Schedule).).

1.15.1.3. The PM shall work side-by-side with Government personnel andPM shall ensure an efficient, effective and economical level of support is provided to the APPS PMO.

1.15.1.4. PM shall provide oversight of staff and support activities, oversee contract costs and coordinate with the COR.

1.15.1.5.

1.15.2 System Architect

1.15.2.1. The System Architect is responsible for developing, communicating, maintaining, and enforcing the overall architecture of APPS, to include:

1.15.2.2. Business Processes

1.15.2.3. Applications

1.15.2.4. Data

1.15.2.5. Third Party products

1.15.2.6. Technical Infrastructure

1.15.2.7. The System Architect will be expected to understand all solutions components and how they inter-operate to support business processes and management information needs.

1.15.2.8. The System Architect shall be responsible for interface and integration strategies with external systems processes, including determining, understanding and maintaining business requirement for those interactions.

1.15.2.9. The System Architect shall be responsible for ensuring compliance with external requirements.

1.15.3 Technical Lead.

1.15.3.1. The Technical Lead serves as direct liaison to function process owners in order to translate and prioritize requirements for assigned area project and maintenance work.

1.15.3.2. The Technical Lead is responsible for translating high-level business requirements into detailed functional specifications and managing requests for changes to the design specifications, and assists the business in determining which business requirements can and should be automated and how they are then integrated with other business and technical processes.

1.15.4 Functional Lead.

1.15.4.1. The Functional Lead is responsible for program activities related to analysis, design (including fit/gap analysis), documentation, development, and development testing of the APPS solution, including but not limited to:

1.15.4.1.1. Presenting proposed design options to business users and Army leadership.

1.15.4.1.2. Generating detailed design documentation

1.15.4.1.3. Documenting requirements and designs for reporting and business intelligence.

1.15.5 Senior Configuration Management Manager

1.15.5.1. The senior configuration management manager is responsible for configuration management (CM) tasks to include use of Software Configuration Management tools for configuration identification, configuration control, configuration status accounting, configuration verification and audits, product release and delivery, and preparing and migrating builds and deployments.

1.15.5.2. Manages all APPS environments enforces strict version control process to ensure all environments are consistently configured.

1.15.6 Senior Test Manager. Senior Test manager is responsible for managing and directing the system test activities for APPS implementation.

1.15.7 Life-Cycle Logistics Manager.

1.15.7.1. The Integrated Logistics manager directs and coordinates program activities that support the deployment, sustainment, and customer support of APPS.

1.15.7.2. Life-Cycle Logistics Manager shall anticipate logistics problems related to operational effectiveness, maintainability, reliability and availability.

1.15.7.3. Life-Cycle Logistics Manager shall determine and execute the contingency requirements and solutions to APPS and APPS interface partners.

1.15.7.4. Life-Cycle Logistics Manager shall determine integrated logistic support activities, roles, responsibilities, sequences and timelines.

1.15.7.5. Life-Cycle Logistics Manager shall participate in the creation of procedure and communication material that document logistic practices.

1.15.8 Senior Training Specialist.

1.15.8.1. The Senior Training Specialist is responsible for the analysis, design, development, testing and fielding of training artifacts, guides, classroom instruction and Computer Based Training (CBT) offering.

1.15.8.2. The Senior Training Specialist shall ensure quality control checks are built into the successful implementation of training plans, deliverable and strategies.

1.15.8.3. The Senior Training Specialist must understand and translate business requirements and the system configuration/solution into training artifacts for the APPS implementation, and has demonstrated experience and strong knowledge of software training development, implementation, and maintenance.

1.15.9 Contracts Manager. The Senior Training Specialist must understand and translate business requirements and the system configuration/solution into training artifacts for the APPS implementation, and has demonstrated experience and strong knowledge of software training development, implementation, and maintenance. The contractor shall provide a program manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between the hours of 8:00 a.m. to 5:00 p.m. Sunday through Thursday except for holidays or when the U.S. Government facility is closed for administrative reasons. Program manager shall work side-by-side with Government personnel.

1.16. Identification of Contractor Employees: All contract personnel attending meetings, answering U.S. Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are U.S. Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor shall be responsible for obtaining security/identification badges for all employees within the scope of this PWS. Comment by Mcvay, Robert G. (US) COL/ PM APPS: KO to send desied verbiage.

1.17. Contract Travel: Contractor shall be required to travel within Afghanistan to include Kabul and the locations of the Corps and PHQs as specified within this contract.

1.18. Data Rights: The U.S. Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software produced under this contract shall be U.S. Government owned and are the property of the U.S. Government with all rights and privileges of ownership/copyright belonging exclusively to the U.S. Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied by the U.S. Government shall be the sole property of the U.S. Government and may not be used for any other purpose. This right does not abrogate any other U.S. Government rights.

1.19. Content Update Requirements: As individual and organizational users gain familiarity with AHRIMS, it is expected that system content shall be adapted to specific organizational needs on a not-to-interfere basis with overall system integrity. This tailoring should increase the functionality of AHRIMS to the unique requirements of separate services/organizations.

1.20. Software Update Requirements: As APPS development progresses across the ANDSF, the Contractor shall continue refinements to the integration of AHRIMS as required with software changes, database management actions, maintenance, upgrades, and other actions as required to ensure optimum operation of this function, as well as changes to improve AHRIMS integration/interface with different databases and ultimately replace AHRIMS with APPS.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DefinitionsEFINITIONS:

2.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the U.S. Government. The term used in this contract refers to the prime.

2.1.2 CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the U.S. Government. Note: The only individual who can legally bind the U.S. Government.

2.1.3 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does not have authority to change the terms and conditions of the contract.

2.1.4 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.5 KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6 PHYSICAL SECURITY. Actions that prevent the loss or damage of U.S. Government property.

2.1.7 QUALITY ASSURANCE. The U.S. Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8 QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.9 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.10 WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.11 WORK WEEK. Sunday through Thursday

2.2. ACRONYMSAcronyms:

PART 3

U.S. GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: No services shall be provided.

3.2. Facilities: No facilities shall be provided.

3.3. Utilities: No utilities shall be provided.

3.4. Equipment: No equipment shall be provided.

3.5. Materials: No materials shall be provided.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED FACILITIES, SUPPLIES, EQUIPMENT AND SERVICES:

4.1. Equipment:. The Contractor shall acquire, install, maintain and provide any equipment required to accomplish tasks in the PWS. All U.S. Government issued equipment from AHRIMS one point two (1.2) shall be used. At termination of completion of the contract, all equipment shall become the property of the U.S. Government.

4.2. Software:. The Contractor shall acquire, install, maintain, and provide any additional software products needed to accomplish the tasks related to the PWS. Contractor shall coordinate with the U.S. Government to transfansfer all items purchased to the Afghan Government at completion of the contract. The Contractor shall analyze and implement Commercial Off-The-Shelf solutions as well as Open Source software and hardware solutions when applicable to meet user capabilities as provided by the Government of Afghanistan.

4.3. Data Rights:. The U.S. Government retains unlimited data rights to all efforts and products developed in direct support of the APPS effort, including but not limited to all software, source code and documentation, without any restrictions whatsoever by the Contractor.

4.4. Contractor Responsibilities:. The Contractor is responsible for providing its employees with base life support and travel in order to achieve the objectives outlined in this PWS.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1. System Level Tasks:

5.1.1 Contractor shall ensure the system meets the best practices and standards as set forth in the 2015 Society for Human Resource Management, to include, but not limited to:

5.1.1.1. Segregation of duties

5.1.1.2. Defined roles and responsibilities

5.1.1.3. Internal controls

5.1.1.4. Audit logging and controls

5.1.1.5. Protection of Personally Identifiable Information (PII)

5.1.2 Contractor shall be responsible for the current hardware and software infrastructure required to maintain the existing AHRIMS system.

5.1.3 Contractor shall ensure that the core and ministry specific modules have the ability to easily migrate to other Afghan Government ministries for future growth.

5.1.4 Contractor shall systematically collect and report actual contract costs to provide cost analysts with needed data to estimate future costs.

5.1.5 The Contractor shall provide the system design services. Detailed system design shall include at a minimum: accurate and timely maintenance of detailed data and process models; program specifications; interface specifications; screen and report designs; program control specifications and/or teleprocessing considerations.

5.1.6 Contractor will propose any system or design changes to the existing infrastructure as part of their proposal response, with a detailed explanation of why the current system hardware/software is unable to support the development of the APPS, as part of the proposal as a separate priced options.

5.1.7 Within thirty (30) days of contract award, tThe contractor shall create and maintain a Software Configuration and Development plan that will specify how the contractor intends to complete the software development tasks within thirty (30) days of contract award.

5.1.8 At the start of each sprint, the Contractor shall present a Security Control Assessment Plan that discusses the methodology employed. This plan shall be presented and approved by the Program Management Office prior to implementation.

5.1.9 At the end of each sprint, the Contractor shall provide the risk management validation document developed for the use of program management office that discusses the methodology employed, Final Security Control Assessment Results for each system, Risk Assessment Results for each system and a Plan of Action and Milestones for each system.

5.1.10 Sprint Development:

5.1.10.1. Contractor shall deliver the APPS in “sprints” (a set period of time during which specific work has to be completed and made ready for review). Sprint capability deliveries will be twenty-one (21) days to twenty-eight (28) days in length. Each sprint shall be a complete and standalone capability for immediate use by the end user Army and Police, must include at a minimum:

5.1.10.1.1. Full APPS modules software documentation

5.1.10.1.2. Training package developed and ready for deployment to end user.

5.1.10.1.3. Contractor shall conduct end user training within seven (7) days of US Government acceptance of the sprint.

5.1.10.1.4. Contractor shall update sustainment training package, in English, Dari and Pashto for the complete APPS system within seven (7) days of US Government acceptance of the sprint.

5.1.10.1.5. All module capabilities shall be developed by the contractor. The module capabilities will be performed and maintained by the end user without contractor intervention or system changes.

5.1.11 Contractor shall provide a detailed work breakdown structure (WBS) to level three (3) within thirty (thirty (30)) days of contract award for all APPS modules that provide resources, time, and capabilities to be delivered in each “sprint” of the system release.

5.1.12 Contractor shall develop and maintain an Integrated Master Schedule (IMS) in accordance with (IAW) work breakdown structure (WBS).

5.1.13 Contractor shall participate in the Initial Baseline Review (IBR) of the WBS to be scheduled no later than fifteen (fifteen (15)) days after the delivery of the WBS to the US Government.

5.1.14 Contractor shall lead the weekly sprint reviews with the US Government providing at a minimum their assessment against the IBR approved WBS.

5.1.15 Contractor shall develop the system with a common core baseline applicable to both Ministries and then ministry specific modules with only those items not common to both Ministries.

5.1.15.1. All module capabilities shall be incorporated into both Ministry versions of APPS unless otherwise noted by module or ministry.

5.1.15.2. Contractor shall ensure that the core and ministry specific modules have the ability to easily migrate to other Afghan Government ministries for future growth.

5.1.16 Contractor shall provide meeting support and supporting material, including read-ahead and meeting minutes, for all meetings in which the contractor is the host.

5.1.17 Contractor shall systematically collect and report actual contract costs to provide cost analysts with needed data to estimate future costs. The Contractor will utilize the following documents:

5.1.17.1. Contractor Cost Data Reporting (CCDR)

5.1.17.2. Software Resource Data Reporting (SRDR). Contractor will submit completed SRDR after each individual software sprint release.

5.1.17.3. A weekly deviation report showing budgeted effort and cost to be performed, with the actual effort and cost of effort performed by WBS element. All variations greater than five (5%) of actual/budgeted cost of work performed will include a get well plan at time of submission.

5.1.18 The contractor shall provide Systems Integration services and support for APPS.

5.1.19 The contractor shall update and maintain the APPS Application Security Plan, APPS user Security Training Manual, APPS security administrator Training manual, and APPS application security design

5.1.20 The application security plan and design shall allow for the engineering of existing business processes to include but not limited to:

5.1.20.1. Department Security Tree configuration and maintenance

5.1.20.2. Query definition security

5.1.20.3. On-Line batch process security

5.1.20.4. Foundation tables security

5.1.20.5. Password Controls

5.1.20.6. Interface security

5.1.20.7. Workflow security

5.1.20.8. Third Party Application Security Configuration and Integration

5.1.20.9. Environment Inventory List with Security Function for each

5.1.20.10. Application Security Operations Strategy

5.1.20.11. Security and Access Controls

5.1.20.12. Define roles and responsibilities

5.1.20.13. Content Management Configuration

5.1.20.14. User profile configuration

5.1.20.15. Workflow design and configuration

5.1.20.16. Security for third party applications

5.1.20.17. Portal Content configuration

5.1.20.18. Data permission security

5.1.20.19. Security change management process

5.1.20.20. Help desk support procedures

5.1.20.21. Application Security testing procedures

5.1.20.22. Application Security Audit

5.1.21 The contractor shall develop and maintain a Data Archiving Plan. The contractor shall support the data archiving efforts to include all updates, fixes, maintenance, performance monitoring and tuning for database objects as well as any applicable processes or objects. The Data Archiving Plan addresses but is not limited to:

5.1.21.1. Archive Strategy

5.1.21.2. Frequency

5.1.21.3. Recovery Strategy

5.1.21.4. Roles and Responsibilities

5.1.22 The contractor shall perform or update a criticality analysis, vulnerability assessment, risk assessment and counter measure selection and implementation, with assumptions, rationale, and results before each of the System/Sprint Technical Release Reviews (SERRs).

5.1.23 The contractor shall identify the associated logic-bearing hardware, software, and firmware that implements critical functions or introduces vulnerability to the associated components.

5.1.24 The contractor shall update and maintain all technical documentation required for the design, development and ongoing operations of APPS. Documents include, but limited to:

5.1.24.1. Technical Architecture Specifications

5.1.24.2. Fit/Gap analysis

5.1.24.3. Analysis of requirements

5.1.24.4. Mapping requirements

5.1.24.5. Populating tables with approved domain value sets

5.1.24.6. Dry runs with the US Government

5.1.24.7. Detailed Functional Configuration Design Documentation

5.1.24.8. Course of Action Analysis

5.1.24.9. Detailed Technical Design Documents, i.e. physical and logical architecture

5.1.24.10. System-oriented Process Flow Charts

5.1.25 The contractor shall create and maintain a Software Configuration and Development plan that will specify how the contractor intends to complete the software development tasks within thirty (30) days of contract award.

5.1.26 Configuration Migration. The contractor shall build and maintain the gold master copy of configuration, using the baseline resulting from each of the sprint development activities.

5.1.27 The contractor shall conduct the following audit tasks to support the continuous examination of APPS records and documents to determine adequacy and effectiveness of budgeting, accounting, financial, and related policies and procedures; compliance with applicable statues, regulations, policies, and prescribed procedures; reliability, accuracy, and completeness of financial and administrative records and reports; and the extent to which funds and other resources are properly protected and effectively used. The contractor shall be prepared to create and submit to following documents:

5.1.28 Financial Auditing/Audit Readiness. Financial Audit Readiness Plan shall address all activities, business processes; data managed, stored or acted upon by APPS which impact and/or support financial statements.

5.1.29 Operational Auditing. The APPS Operational Audit Plan shall address all activities and data managed, stored or acted upon by APPS which impact the operation of the system.

5.1.29.1. Access or data access control violations

5.1.29.2. Access control duration and frequency audit

5.1.29.3. Domain Values.

5.1.30 The contractor shall perform system integration activities for APPS. The contractor shall prepare and submit the following:

5.1.30.1. Interface Control Documents (ICD) for each interface directed by the US government. The current required interfaces are:

5.1.30.1.1. MOI Identification Card system

5.1.30.1.2. MOD Identification Card System

5.1.30.1.3. MOI Biometric Personnel Database

5.1.30.1.4. NDS crime database

5.1.30.1.5. Afghan Financial Management Information System (AFMIS)

5.1.30.1.6. Future interfaces included, but are not limited to the National Identification Card Systems (e-NIC), the Afghan Passport System, and the MOI and MOD logistics system.

5.1.30.1.7. Electronic Payroll System (EPS)

5.1.30.1.8. Web-enabled Payroll System (WEPS)

5.1.30.2. Interface configuration and development. The contractor shall build and test all interfaces to include conversion and incremental data loads based on approved ICDs. The contractor shall map, stage, convert, migrate, and translate all data.

5.1.30.3. Contractor shall develop, test, and deploy a standard presentation layer for external out-bound access for each module of APPS. Presentation layer shall present the data in a standard data exchange medium with security and access control to preclude unauthorized access.

5.1.30.4. Verification and Validation. The contractor shall collaborate with the US Government to verify the interfaces through mock data loads and processing cycles. Develop weekly data validity reports.

5.1.30.5. The contractor shall leverage and maintain the existing AHRIMS development and production environment.

5.1.31 The contractor shall design, develop, implement, maintain, support, and document a training environment to include hardware and software that will replicate all APPS functionality. Training environment shall be updated to the latest version of APPS within seven (7) days of US Government acceptance of each release or sprint.

5.1.32 The contractor shall provide infrastructure support services for production sustainment and on-going development efforts. The contractor shall provide support for all incrementally deployed releases to include patches and fixes. Activities will include but not limited to:

5.1.32.1. Infrastructural Management

5.1.32.2. COOP /Disaster Recovery Management

5.1.32.3. Performance and Capacity Management

5.1.32.4. Provide Database Management and Administration

5.1.32.5. Provide Application Management and Administration

5.1.32.6. Provide Operating System Management and Administration

5.1.32.7. Provide Network Engineering Support

5.1.32.8. Provide Storage Engineering Support

5.1.33 The contractor shall populate and maintain the Data dictionary. The data dictionary shall be maintained using software acceptable and accessible to the U.S. Government. The Data dictionary at a minimum shall describe APPS information as column names, types, sizes, and descriptive information such as titles, captions, primary keys, and foreign keys. The data dictionary shall be updated within seven (7) days of the U.S. Governments acceptance of each release or sprint. The contractor shall produce:

5.1.33.1. Data Dictionary

5.1.33.2. Metadata Analysis Report

5.1.34 The contractor shall develop the Disaster Recovery Plan for US Government approval and execute Disaster Recovery activities in accordance with the approved plan. Develop Disaster recovery failover testing and activities results.

5.1.35 The contractor shall perform the activities necessary to conduct preliminary and sprint release design reviews for APPS.

5.1.36 The contractor shall conduct a System Verification Review (SVR) prior to deployment for each sprint release. For each SVR, the contractor shall develop an audit plan that describes the purpose, scope, activities, and schedule.

5.1.37 Technical Reviews: At a minimum, the contractor shall coordinate and conduct a System Requirements Review (SRR), a Preliminary Design Review (PDR), a Critical Design Review (CDR), Test Readiness Reviews (TRR), a Functional Configuration Audit, a Physical Configuration Audit, and a Production Readiness Review. At a minimum, the entrance and exit criteria identified below shall be met for each review:

5.1.37.1. System Requirements Review (SRR)

5.1.37.1.1. A preliminary agenda has been coordinated (nominally) fifteen (15) days prior to the SRR.

5.1.37.1.2. SRR Entry Criteria for technical products listed below for both hardware and software system elements have been made available to the cognizant SRR participants prior to the review:

5.1.37.1.2.1. System/subsystem specification (SSS)

5.1.37.1.2.2. System software functionality description

5.1.37.1.2.3. System/Subsystem Design Specification (SSDD)

5.1.37.1.2.4. Preferred system solution definition,

5.1.37.1.2.5. Systems Engineering Management Plan,

5.1.37.1.2.6. Updated logistics documents (Acquisition Logistics Support Plan (ALSP), Logistics Requirements and Funding Summary (LRFS), Preliminary Maintenance Plan, etc.)

5.1.37.1.3. SRR Exit Criteria: The SRR is considered complete when all draft Requests for Action (RFAs) are signed off, and an acceptable level of program risk is ascertained.

5.1.37.1.3.1. Exit Criteria shall include:

5.1.37.1.3.2. The system requirements, as disclosed, shall satisfy the SRD.

5.1.37.1.3.3. The system requirements shall be sufficiently detailed and understood to enable system functional definition and functional decomposition.

5.1.37.1.3.4. SSS approved

5.1.37.1.3.5. Processes will be adequate and metrics in place for the program to succeed.

5.1.37.1.3.6. Documented Information Assurance (IA) requirements.

5.1.37.1.3.7. Risks are known and manageable for design and development.

5.1.37.1.3.8. Program schedule is executable (technical/cost risks)

5.1.37.1.3.9. Updated cost estimate will fit within the existing budget.

5.1.37.2. The contractor shall conduct a preliminary design review (PDR) for the entire APPS system thirty (30) days after the IBR. The contractor shall develop the complete PDR entry and exit criteria in addition to comprehensive checklist and deliver to US Government for approval. Minimal requirements for entry and exit criteria for PDR:

5.1.37.2.1. PDR Entry Criteria:

5.1.37.2.1.1. All requirements have been thoroughly allocated to the Preliminary design.

5.1.37.2.1.2. Preliminary design is complete and ready for review.

5.1.37.2.1.3. Cost and schedule impacts have been identified during the development of preliminary design.

5.1.37.2.1.4. Risk candidates have been identified and documented.

5.1.37.2.2. PDR Exit Criteria:

5.1.37.2.2.1. Preliminary design correctly and completely implements all allocated system requirements, and traces to design.

5.1.37.2.2.2. Design can be implemented within budget and schedule.

5.1.37.2.2.3. Comprehensive risk assessment has been completed.

5.1.37.2.2.4. Approval to continue the detailed design sprint.

5.1.37.3. The contractor shall conduct a critical design review (PDRCDR) for each sprint. The contractor shall develop the complete CDR entry and exit criteria in addition to comprehensive checklist and deliver to US Government for approval no less than seven (7) days before the start of each sprint. Minimal requirements for entry and exit criteria for CDR:

5.1.37.3.1. CDR Entry Criteria

5.1.37.3.1.1. A PDR has been successfully completed, and all PDR RFAs have been responded to.

5.1.37.3.1.2. All PDR exit criteria key issues have been satisfied, if applicable.

5.1.37.3.1.3. A preliminary agenda has been coordinated (nominally) fifteen (15) days prior to the CDR.

5.1.37.3.1.4. CDR technical products (hardware and software elements of the product baseline to be reviewed and approved at the CDR) have been made available to the cognizant CDR participants prior to the review:

5.1.37.3.1.5. Updates to the SSS and functional specification,

5.1.37.3.1.6. Product specifications for each hardware and software configuration item, along with supporting trade-off analyses and data,

5.1.37.3.1.7. Current risk assessment

5.1.37.3.1.8. Updated (System Engineering Management Plan ( SEMP), if applicable

5.1.37.3.1.9. Software Design Document(s) (SDD) complete and ready to be placed under configuration management.

5.1.37.3.1.10. Software Interface Design Document(s) (IDD) complete and ready to be placed under configuration management.

5.1.37.3.1.11. Preliminary Test Procedures for Software Integration and Systems testing available for review

5.1.37.3.2. CDR Exit Criteria. The CDR is considered complete when all draft RFAs are signed off, and an acceptable level of program risk is ascertained. Exit Criteria include:

5.1.37.3.2.1. Status of the technical effort and design indicate operational success (operationally suitable and effective).

5.1.37.3.2.2. The detailed design, as disclosed, shall satisfy the SRD.

5.1.37.3.2.3. System product baseline established and documented to enable hardware fabrication and software coding to proceed with proper configuration management.

5.1.37.3.2.4. Processes shall be adequate and metrics in place for the program to succeed.

5.1.37.3.2.5. Risks known and manageable.

5.1.37.3.2.6. Program schedule executable (technical/cost risks).

5.1.37.3.2.7. Program shall be executable with the existing budget and the approved product baseline.

5.1.37.3.2.8. .Critical Safety Items is identified.

5.1.37.3.2.9. Updated cost estimate fit within the existing budget.

5.1.37.3.2.10. Software functionality in the approved product baseline shall be consistent with the updated software metrics and resource-loaded schedule.

5.1.37.4. Test Readiness Review (TRR)

5.1.37.4.1. Entry Criteria:

5.1.37.4.1.1. Configuration of system under test has been defined and agreed to. All interfaces have been placed under configuration management or have been defined in accordance with an agreed to plan and a Version Description Document has been made available to TRR participants (minimum of seven (7) working days prior to the review).

5.1.37.4.1.2. All applicable functional, unit level, subsystem, system, and qualification testing has been conducted successfully.

5.1.37.4.1.3. All TRR specific materials such as test plans, test cases, and procedures have been available to all participants prior to conducting the review (minimum of seven (7) working days).

5.1.37.4.1.4. All known system discrepancies have been identified and resolved in accordance with an agreed to plan.

5.1.37.4.1.5. All previous design review exit criteria and key issues have been satisfied in accordance with an agreed to plan.

5.1.37.4.1.6. All required test resources (people, facilities, test articles, test instrumentation) have been identified and are available to support required tests.

5.1.37.4.1.7. Roles and responsibilities of all test participants are defined and agreed to.

5.1.37.4.2. Test Readiness Review Exit Criteria. The TRR is considered complete when:

5.1.37.4.2.1. All draft RFA forms have been addressed, assessed, and agreed upon, and

5.1.37.4.2.2. Test plans completed and approved for the system under test.

5.1.37.4.2.3. Identification and coordination of required test resources is completed

5.1.37.4.2.4. Previous component, subsystem, system test results form a satisfactory basis for proceeding into planned tests.

5.1.37.4.2.5. Risk level identified and accepted by Program leadership as required.

5.1.38 The contractor shall provide and maintain the APPS Life-Cycle management services and support for APPS to include:

5.1.38.1. Requirements Management.

5.1.38.1.1…