PWS_Draft_16-R-0006_2_Dec_15.pdf

PERFORMANCE WORK STATEMENT (PWS)

Software/Application Engineering Programming Sustainment Support HQ, United States Military Entrance Processing Command

Part 1

General Information

1. GENERAL: This is a non-personal services contract to provide Software/Application Engineering Programming Sustainment Support at HQ United States Military Entrance Processing Command (USMEPCOM).

The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, supervision, and services necessary to perform Software/Application Engineering Programming Sustainment Support as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The mission of USMEPCOM is to process applicants for the regular and reserve components of the Armed Forces of the United States. Processing consists of aptitude testing, medical examining, security background screening, administrative processing, enlisting, and shipping of applicants. USMEPCOM collects, processes, and provides applicant data to the Services (i.e., Army, Navy, Air Force, Marines and Coast Guard), Defense Manpower Data Center (DMDC), Defense Investigative Service (DIS), other Department of Defense (DoD) and Federal agencies, as authorized.

a. The Command HQ is located in Building 3400, at 2834 Green Bay Road, North Chicago, Illinois. The Command HQ is responsible for total administration of the Eastern and Western Sector HQ, the virtual MEPS, in addition to the 65 individual Military Entrance Processing Stations (MEPS) throughout the continental U.S., Alaska, Hawaii, and Puerto Rico.

b. USMEPCOM ensures that applicants or inductees meet the requisite aptitude, medical, and moral standards established by law and the specific military services. USMEPCOM processes individuals for accession into the Armed Services based on DoD peacetime and mobilization requirements.

c. The USMEPCOM J-6 Information Technology (MEIT) Directorate has management oversight and control for all Command Information Technology and Automation Data Processing (ADP) services, hardware and software.

1.3 Objectives: The contractor shall successfully accomplish the tasks in this PWS when the contractor provides Software/Application Engineering Programming Sustainment Support services to:

Sustain USMEPCOM applications by maintaining Oracle databases, and applications composed of Oracle

Forms, Oracle Reports, Oracle Discoverer, Oracle 10g or higher, Sequel, Hypertext Markup Language, Java Script, Oracle Real Application Clustering;

Maintain database dictionaries Sustain current legacy applications through end-of-life, providing technical reports and code modifications Analyze, identify, and extract Business Rules from the existing system which are embedded in Oracle Forms, databases, database procedures, and other legacy applications. The Contractor shall produce a Business Rules Architecture and provide recommendations of best business practices for Business Rules Engine (BRE) Architecture.

Produce a Business Rules Architecture and provide recommendations of best business practices for Business Rules Engine (BRE) Architecture

Provide Oracle BPEL Process Manager WorkFlow services to install Oracle BPEL Process Managers, and integrate BPEL Process Manager with USMEPCOM’s Oracle Business Rules

Perform analysis of the various current USMEPCOM application security methods and procedures to determine transition path to a fully integrated standardized framework.

Implement a Standardized Application Security Framework; the solutions standard framework is to be based upon implementation of the Oracle Identity and Access Management Suite, to include PKI enabling applications to allow provisioning and authentication via use of the Common Access Card (CAC).

Design, develop, and implement a new application which is web-enabled, based upon an applet which interacts with Optical Mark Reader (OMR) scanners and be hosted on USMEPCOM’s Oracle Web Logic platform.

1.4 Scope: The contractor shall provide:

Task 1 – IT Systems Application Programming Support Function Task 2 – J2EE Programming Software Support Function Task 3 – Oracle Business Rules Architecture, Analysis, Authoring Tool and Rules Engine Support Task 4 - Oracle BPEL Process Manager Workflow Services Task 5 - Implement Standardized Application Security Framework Task 6 - Convert Testng2000 Student Testing Functions to a Web-Enabled Application

1.5 Period of Performance: The period of performance shall be for a potential 16-day phase-in period, one 50 week base period, and two one-year option periods.

1.6 General Information

1.6.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The contractor shall provide their quality control plan (QCP) within 30 days of contract award. Any changes shall be provided to the government within seven business days of notification prior to changes. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to the QC system.

1.6.1.1The contractor’s QCP shall include, as a minimum, the following:

An inspection system covering the services stated in the contract, specifying areas to be inspected on a scheduled or unscheduled basis and the title of the individual(s) who shall perform the inspections. The inspection system shall address the performance standards identified in the PWS and include representative quality control metrics related to the performance standards.

A method of identifying deficiencies in the quality of service performed before the level of performance becomes unacceptable.

Maintain a file of all inspections conducted by the contractor and any corrective action taken. The contractor shall make documentation available to the government upon request throughout the term of the contract.

1.6.1.2 Software version disclaimer. The contractor shall use the latest versions of all software to include Operating Systems (OS) permitted by DoD or other pertinent regulator bodies. The contractor shall coordinate with the USMEPCOM Risk and Compliance Office to verify and confirm software is in compliance.

1.6.2 Quality Assurance: The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: Information Technology (IT) services will normally not occur on the following holidays below. However, for special projects it may be necessary to conduct activities during this period to avoid unnecessary system outages during normal business hours. Proper coordination shall be made with the Contracting Officer’s Representative (COR) to ensure that USMEPCOM personnel are available to support and allow access.

Legal Federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 0600 and 1800 Central Time, Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor shall not be reimbursed when the government facility is closed for the above reasons. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: All work to be performed under this contract will be conducted at HQ USMEPCOM, 2834 Green Bay Road, North Chicago, IL 60064. Telework or work performed off site is not permitted.

1.6.5.1 USMEPCOM is a MAC II Sensitive environment. The work is SENSITIVE but UNCLASSIFIED.

1.6.5.2 Attire. Contractor personnel shall wear clothing commensurate with that worn by their counterparts in the civilian business community. Contractor personnel shall not wear undergarments as outer garments, transparent or loose weave clothing without underclothing; any ornament or symbol on the clothing expressing derogatory, lewd, profane or obscene words, gestures, connotations or drawings; swimsuits; any ornament, insignia, or symbol on the clothing implying disrespect for the United States, the United States flag, or military service; any item advocating or glorifying the use of illegal drugs or other unlawful conduct; cut-offs or short shorts.

1.6.5.3 Smoking Policy. Contractor personnel shall comply with smoking policies in federal buildings. Smoking is prohibited within 50 feet of any exit or entrance to the building. Contractor personnel shall place cigarette butts in proper containers and shall not dispose of butts at or near entrances and/or exits to the facility. USMEPCOM provides a designated “smoke shack” outside the west entrance of building 3400.

1.6.5.4 Drug and Alcohol Prevention. The contractor shall have a program that enacts a “No Tolerance” policy and includes a procedure for immediate elimination from employment under this contract. The contractor shall have a pre-hiring screening test. The contractor shall furnish a copy of the pre-hiring screening test and a copy of the “No Tolerance” policy to the COR within five business days after contract award and updated pre-hiring screening test as changes occur. Recurring and random test procedures should be included in this plan. The contractor’s drug and alcohol plan shall be in accordance with Federal, State, and local laws and regulations. This screen shall include a valid driver’s license, valid state identification card, or other approved form of identification and verification that employees are free of alcohol or drug related offenses.

1.6.5.5 Weapon/Firearms Control. The contractor shall ensure personnel do not transport, possess, or use dangerous weapons on government-operated installations or facilities. Dangerous weapons include all forms of firearms, missile-throwing devices (e.g., bow and arrow), switch blade or automatic blade knives, knives with blades in excess of three inches, ammunition and pyrotechnics, fireworks, bludgeons (e.g., nunchaku aka: nunchuks), brass knuckles, shooting pens, and similar devices. Dangerous weapons shall be confiscated by the government. A state weapon permit does not supersede this contract provision.

1.6.6 Reserved.

1.6.7 Security Requirements: Contractor personnel to include subcontractor personnel performing work under this contract shall have a SECRET security clearance. The security requirements shall be met at the time of the proposal submission, and shall maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254.

1.6.7.1 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.2 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government will be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.2.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.2.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.3 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

These procedures shall be included in the Contractor’s QCP.

1.6.7.4 Security Investigation Requirements. In accordance with Army Regulation 25-2, Army Regulation 380-67, and DoD Directive 5200.8, there are certain categories of positions or duties which, although not requiring access to classified information, if performed by unworthy persons, could enable them to jeopardize the security of USMEPCOM or otherwise endanger the national security. The investigative requirements for personnel occupying Information Systems Positions designated IT-I, IT-II and IT-III are as follows: IT-I: SSBI (Single Scope Background Investigation), IT-II: NACLC (National Agency Check with Local Credit Check) and IT-III: NAC (National Agency Check). This investigation is required for all contractor personnel working on and off-site under this task. The request for investigation shall be submitted by the contractor’s Facility Security Officer to DISCO before the start of the task, in accordance with DoD5220.22-M, Chapter 2.

1.6.7.5 Each task in this PWS shall require at a minimum an IT-II NACLC investigation for all positions unless otherwise stated.

1.6.7.6 The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the government may require changes in contractor security matters or processes. Forms DD 1172-2 and DD 2875 along with the appropriate IT certificates, as described for a specific task, shall be submitted to the COR before the individual contractor is permitted to access any USMEPCOM IT systems, information or perform any task related activities.

1.6.7.7. Building Security.

1.6.7.7.1 Verification Access Roster/Visit Access Request (VAR). Any contractor management or contractor who requires access to USMEPCOM on either a regular or occasional basis shall provide an initial or updated VAR to the COR specifying those employees who require access. The initial VAR shall be provided not later than one week in advance of arrival. A VAR shall be completed once per contract period or when any significant information changes. The information on this document shall include: name of individual who requires access, reason for access, social security number, place and date of birth, clearance level and investigation date, and country of citizenship. Specific contract information for submission will be provided post award.

1.6.7.7.2. All visiting vendors/contractors shall be signed into the building and escorted by a government employee only.

1.6.7.7.3. Operations Security (OPSEC) Plan. Contractors shall follow the USMEPCOM OPSEC policies and regulations.

1.6.7.7.4. Government administrative leave authorization does not constitute approval of contractor time off. In order to complete some projects, a redistribution of work hours outside of the normal working hour schedule shall be coordinated with the Government Program Manager (GPM) and the COR. The COR shall be notified in advance when any work schedules need to be changed. Contractor work from any other off-site location (to include from home) shall be arranged and approved on a case-by-case basis through the COR in advance or work may not be paid.

1.6.7.7.5. Contractor management shall notify the COR at least one week before new personnel are to begin working at USMEPCOM. If the start date changes, the COR shall be notified not later than the scheduled start date. The contractor shall notify the COR as soon as possible before any personnel are terminating work at USMEPCOM.

The contractor shall work with the COR on a smooth transition, including any final documentation and knowledge transfer to the GPM and COR as applicable.

1.6.8 Special Qualifications:

1.6.8.1. The contractor shall provide a sufficient number of trained personnel to perform the duties and services specified herein. The Contractor’s employees, performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industrial Security Clearance Office. The contractor shall be responsible for maintaining the qualifications and knowledge standards of employee competence, conduct and integrity. The contractor shall ensure that the same requirements and standards applicable to the contractor are maintained by the sub-contractors performing under this contract. The contractor shall provide resumes, with firm commitments for key personnel listed in the proposal, to perform services in this contract for government review and verification of skills and experience.

1.6.8.2. OPSEC Training. All contractors’ employees, including subcontractor employees, shall complete Level I OPSEC training within twenty business days of their reporting for duty with the results reported to the COR NLT seven business days after completion of training. All contractors shall complete annual OPSEC Awareness training (IAW AR 530-1). This training is available on the USMEPCOM Contractor Training web page:

http://www.USMEPCOM.army.mil/contractors.html. This training website is available to any computer capable of accessing the internet.

1.6.8.3. AT Level I Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas, and support USMEPCOM mission on-site or remotely shall complete AT Level I awareness training within twenty business days after contract start date. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within seven business days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following websites:

http://jko.jten.mil/courses/atl1/launch.html or http://www.USMEPCOM.army.mil/contractors.html.

1.6.8.4. iWATCH Training. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within twenty business days of contract award and within forty business days of new employees commencing performance with the results reported to the COR NLT thirty business days after completion of training. This training is available on the USMEPCOM contractor training web page: http://www.USMEPCOM.army.mil/contractors.html.

1.6.8.5. Contractor Employees Who Require Access to Government Information Systems. All contractor employees with access to a government info system shall be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services.

1.6.8.6. Information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees shall complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions shall comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 before being allowed to access USMEPCOM IT Systems. Training will be provided on site at HQ USMEPCOM, 2834 Green Bay Road, North Chicago, IL 60064.

1.6.8.7. Information assurance (IA)/information technology (IT) certification. Per DoD 8570.01-M , DFARS

252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification and computer environment certification as stipulated in DoD 8570.01-M shall be completed upon contract award. USMEPCOM does not permit a delay in obtaining the computer environment certification.

1.6.8.8 Information Assurance Fundamentals. All contractors or sub-contractors working in IT roles that require privileged level access are required to pass the Information Assurance Fundamentals Training Course every two years. The certificate shall be uploaded into the contractor’s ATCTS profile and an electronic copy (pdf) sent to the

COR.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer (KO), COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer’s Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract:

perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor’s performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The contractor shall submit resumes, with letters of commitment for the On-Site Point of Contract (IT Manager) and alternate IT Manager listed as Key Personnel in the proposal. Resumes shall not be added or substituted by the contractor after proposal submission, unless approved by the KO. No key personnel or key personnel positions shall be added, deleted, or changed without a formal contract modification. The contractor shall provide an IT Manger who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the IT Manager is absent shall be designated in writing to the contracting officer. The IT Manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The IT Manager or alternate shall be available between 8:00 a.m.

to 4:30p.m Central Time., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

The following personnel are deemed key personnel:

On-Site Point of Contact (IT Manager) and alternate IT Manager:

o The contractor shall designate, in writing, an IT Manager and an alternate that can represent the contractor in daily tasks, addressing government concerns with performance and deliverables, and is a communication conduit between the government and contractor management. All contract related requests of the contractor shall be communicated through the COR to the IT Manager, not the individual contractor employees performing the work, excluding those cases that involve the preservation of safety and life.

o IT Manager and alternate IT Manager Qualifications: a minimum of five years of experience managing IT department or team is required. In addition, if this person will be working in a technical role, the IT Manager shall also possess the applicable Information Assurance (IA) workforce certificate(s).

1.6.12. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties shall be required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel shall be required to obtain and wear badges in the performance of this service.

1.6.13 Contractor Travel: Contractor personnel may be required to travel during the performance of this contract.

Contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. The contractor shall be reimbursed for actual expenses for COR approved travel in accordance with the Joint Travel Regulation (JTR) and FAR 31.205-46 for permissible use and reasonableness of travel expenses. The contractor shall adhere to the per diem and lodging limits identified in the JTR. The contractor shall provide receipts for all lodging, rental cars, mileage, and any miscellaneous expenses exceeding $75.00 with the next invoice after travel is completed. No General and Administrative expenses or profit shall be added. All travel requires Government approval/authorization and notification to the COR. Travel requests should be sent to the COR for approval no later than two weeks prior to the travel.

1.6.14 Other Direct Costs – Not applicable.

1.6.15 Data Rights: The Government has unlimited rights to all documents/material produced under this contract.

All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government will be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights. All of the contractor-generated data in performance of this contract shall be provided or transferred IAW the contractor’s phase-out plan prior to the contract’s termination or expiration, whichever occurs first.

1.6.16 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.17 Intellectual Property. All programs and materials developed at Government expense during the course of this contract are the property of the Government and are applicable to DFARS clauses 252.227-7013 Rights in Technical Data-Noncommercial Items, 252.227-7015 Technical Data-Commercial Items, 252.227-7028 Technical Data or Computer Software Previously Delivered to the Government, and 252.227-7037 Validation of Restrictive Markings on Technical Data.

1.6.18. Indemnity. The contractor shall hold the government harmless for any damage to or loss of property or any injury to or death of persons as a result of the action or inaction of the contractor or its employees.

1.6.19. The successful completion of this contract, in part, dependent upon close cooperation between USMEPCOM personnel and contractor personnel. Maintaining established schedules requires responsiveness in providing functional expertise, guidance, information, review of deliverables, and copies of, or access to, publications and documentation. All government resources and documentation shall be returned to the COR upon completion of this contract.

1.6.20. All employees of this contract shall be U.S. Citizens and read, write, and speak English fluently and have a demonstrated knowledge of protocol, office etiquette and professionalism at all times.

1.6.21. Personnel Hiring. The contractor shall not hire "Off Duty" government employees (civilians or military) or other personnel whose employment conflicts with Defense Joint Ethics Regulation 5500.7-R, 5 CFR 2635.

1.6.22. The contractor shall comply with all applicable regulations and laws.

1.7. Reserved.

1.8. OTHER REQUIREMENTS.

1.8.1. The contractor shall ensure that proper security techniques and procedures are followed in all maintenance of code utilizing DISA Security Technical Implementation Guides (STIGs), in the maintenance and testing of database procedures and processes (including replication supporting the application and/or facilitating database operations) and to protect web content and infrastructure.

1.8.2. The contractor shall ensure compliance with DIACAP process and Department of Defense Directive Number

8500.1 and 8500.2. The government is currently using NIST Risk Management Framework.

1.8.3. The contractor shall ensure compliance with DTM 08-027 “Security of Unclassified DoD Information on Non-DoD Information Systems.”

1.8.4. All vendors/contractors shall sign an Acceptable Use Agreement or a Privileged Level Use Agreement and an NDA (Non-Disclosure Agreement) regardless of work location. These documents shall be signed prior to execution of the contract or the beginning of work and submitted to the COR.

1.8.5. Once all system security requirements and IT certification requirements have been satisfied, contractor shall be issued a CAC card for access to the system. The CAC card will be valid for the current contract option period only.

1.8.6. The contractor, in the performance of this contract, may receive or have access to "non-public information".

The contractor personnel shall sign non-disclosure statements, to be filed in the COR’s contract file, and agrees to use and examine this information exclusively in the performance of this contract and to take the necessary steps in accordance with government regulations to prevent disclosure of such information to any party outside the government. "Non-public information", as used herein, includes trade secrets, confidential or proprietary business information (as defined for government employees in 18 USC 1905); advance procurement information (future requirements, acquisition strategies, statements of work, budget/program/planning data, etc.); source selection information (proposal rankings, source selection plans, contractor bid or proposal information); information protected by the Privacy Act (social security numbers, home addresses, etc.); sensitive information protected from release under the Freedom of Information Act (pre-decisional deliberations, litigation materials, privileged material, etc.); and information that has not been released to the general public and has not been authorized for such release (as defined for government employees in 5 CFR 2635.703). The contractor shall exercise good faith and reasonable judgment in deciding whether information regarding other contractors is to be considered privileged or confidential.

When in doubt, such information shall be considered privileged and confidential, and not disclosed, except as required to perform the contracts.

1.8.7. Indoctrination of Personnel. The contractor agrees to indoctrinate contract personnel who have access as to the sensitive nature of the information and the relationship under which the contractor has possession of or access to the information. Contractor personnel shall have an agreement with contractor management not to engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information to include access by contract management. The contractor shall restrict access to sensitive/proprietary information to the minimum number of employees necessary for contract performance.

1.9. Correspondence. To promote timely and effective administration, correspondence shall be subject to the following procedures:

1.9.1. Technical correspondence (where technical issues relating to compliance with the requirements herein) shall be addressed to the COR with an information copy to the KO.

1.9.2. All other correspondence, including invoices, (that which proposes or otherwise involves waivers, deviations or modifications to the requirements, terms or conditions of this PWS) shall be addressed to the KO with an information copy to the COR.

1.10. Communication Plan.

1.10.1. For all escalation issues, the contractor shall contact his/her PM. The PM shall notify the COR, if the COR cannot resolve the issue in a timely or satisfactory manner as determined by the government, the COR will inform the KO. The COR will contact higher government management and other personnel as necessary. In no case shall contractor management directly contact government management without express consent of the KO or the COR.

1.10.2. For contractor management who has contractors working on the premises, contractor management shall inform the COR with dates, timelines and a brief agenda before coming to the building. The COR shall be contacted with timelines and agenda to arrange any meetings with government management. In no case shall contractor management have ad hoc or spontaneous meetings with government management that were not pre-arranged with knowledge of the agenda by the COR. If the government determines capabilities briefings are required, the COR will request such briefings from contractor management. Contractor management shall not use their building access privileges to “sell” additional services or products to the government without express invitation. All contractor management shall be signed into the building and escorted by a government employee only, not a contractor employee.

The contractor shall provide information turnover to government personnel for all tasks of the contract whenever there is a change of personnel or if specifically requested to do so by the COR. This shall occur at the least twenty business days before the end of each contract period (as applicable) or as soon as a change in personnel is anticipated by the contractor.

1.10.3. Transition Plan/Information Turnover. IAW FAR 52.237-3, approximately sixty business days before the end of the contract period, the contractor, COR and GPM shall hold a meeting to discuss transition activities or continuity of services. This discussion shall include knowledge transfer and a draft from the contractor of any final documentation which shall be due between forty business days but NLT thirty business days before the end of the contract period. The contractor shall provide a transition plan to USMEPCOM as part of the final documentation.

The government will have ten business days to review the draft documentation and provide comments through the

COR. The contractor shall provide final documentation to the government no later than five business days before the end of the contract.

The contractor shall provide information turnover to government personnel for all tasks of the contract whenever there is a change of personnel or if specifically requested to do so by the COR. This shall occur at the least twenty business days before the end of each contract period (as applicable) or as soon as a change in personnel is anticipated by the contractor.

1.11. Briefings and Reviews. The contractor shall attend weekly review meetings, participate in software coding reviews and prepare and deliver technical presentations and briefings as required.

1.12. Monthly Status Reports. The contractor shall provide a monthly status report. This report shall include at a minimum status, quantity and if applicable ticket numbers associated with all contract deliverables.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1 Acceptable Quality Level (AQL) – The AQL is a designated value (percent) of defective outcomes/service that the government indicates will be accepted using acceptable sampling techniques and procedures. Adaptive Maintenance: a change that adapts the personnel IT system to a changing or different service delivery environment.

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime. Contract Discrepancy Report (CDR) – A formal method documenting unsatisfactory contractor performance (contract deficiencies and defects against the AQL) in the contract file.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the PWS.

2.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports. Emergency Maintenance: Is a change that corrects software components that deny the operational capability of the personnel IT system.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PERFECTIVE MAINTENANCE: A change that improves an existing capability of the personnel IT system.

2.1.8. PERFORMANCE REQUIREMENTS SUMMARY (PRS) – The PRS identifies key performance indicators and standards that represent logical service outputs that will be evaluated by the government to assure contractor is fulfilling the terms of the contract.

2.1.9. PERFORMANCE STANDARD – A measurable output or result associated with the performance-based description of a requirement found in the PWS.

2.1.10. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

Perfective Maintenance: A change that improves an existing capability of the personnel IT system.

Planned Sampling – A sampling (inspection) method used to evaluate contractor tasks and services performed less frequently than daily. These are inspections that are scheduled when tasks and services are performed.

2.1.11. PREVENTIVE MAINTENANCE: Preventing service incidents and defects from occurring in the personnel IT system through pre-planned events.

2.1.12. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.13. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.14. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.15. RANDOM SAMPLING. A sampling (inspection) method used to evaluate contract tasks and services performed daily. Random sampling will be conducted as needed.

Unscheduled Sampling – An impromptu method of evaluating contract performance. It enables the government to monitor and document those contract requirements where increased levels of surveillance are deemed necessary.

2.1.16. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.17. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.18. WORK WEEK. Monday through Friday, unless specified otherwise.

2.1.19. Emergency Maintenance: Is a change that corrects software components that deny the operational capability of the personnel IT system.

2.2. ACRONYMS:

ACOR Alternate Contracting Officer's Representative

ADF (Oracle) Application Development Framework

ADP Automation Data Processing

AFARS Army Federal Acquisition Regulation Supplement

ALBPM AquaLogic Business Process Management

ALUI AquaLogic User Interaction

API Application Program Interface

AR Army Regulation

Army GNEC

Global Network Enterprise Construct, is the focused, timed-phased, prioritized, resource sensitive Army-wide strategy to transition LandWarNet from many loosely-affiliated independent networks into a truly global capability that is designed, deployed, and managed as a single integrated enterprise.

ATCTS Army Training Certification System

ATO Approval to Operate

BPEL Business Process Execution Language

BPM Business Process Management

BRE Business Rules Engine

CAC Computer Access Card or Common Access Card

CCE Contracting Center of Excellence

CFR Code of Federal Regulations

CM Configuration Management

CMMI Capability Maturity Model Integration

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

Corrective Maintenance

Corrective Maintenance: A change that corrects and repairs software components that degrade the operational capability of the personnel IT system.

COTR Contracting Officer's Technical Representative

COTS Commercial-Off-the-Shelf

CPU

Central Processing Unit is the hardware within a computer that carries out the instructions of a computer program by performing the basic arithmetical, logical, and input/output operations of the system.

CTS

Centralized Test Scoring - An Intranet application used to scan ASVAB answer sheets to produce test scores

CTV

Centralized Test Validation - An Oracle Database application used to validate applicant test scores based on business rules

DA Department of the Army

DBA Database Administrator

DD250 Department of Defense Form 250 (Receiving Report)

DD254 Department of Defense Contract Security Requirement List

DDD Detail Design Documents

DFARS Defense Federal Acquisition Regulation Supplement

DIACAP

Department of Defense Information Assurance Certification and Accreditation Process

DIS Defense Investigative Service

DISA Defense Information Systems Agency

DISCO Defense Investigative Service Contract Office

DMDC Defense Manpower Data Center

DoD

The Department of Defense (also known as the Defense Department, USDOD, DOD, DoD or the Pentagon) is the Executive Department of the Government of the United States of America charged with coordinating and supervising all agencies and functions of the government concerned directly with national security and the United States armed forces. The Department is also the largest employer in the world, with more than 2.13 million active duty Soldiers, Sailors, Marines, Airmen, and also civilian workers, and over

1.1 million National Guardsmen and members of the Army, Navy, Air Force, and Marine Reserves. The grand total is just over 3.2 million servicemen and servicewomen, plus the civilians who support them.

DoD EA RM Department of Defense Enterprise Architecture Reference Model

DoD GIG

Global Information Grid is an all-encompassing communications project of the United States Department of Defense. It is defined as a "globally interconnected, end-to-end set of information capabilities for collecting, processing, storing, disseminating, and managing information on demand to warfighters, policy makers, and support personnel."

DoD IA Department of Defense Information Assurance

EA Enterprise Architecture

EFCS Electronic Fingerprint Capture Station

EPTS Existed Prior to Service

FAR Federal Acquisition Regulation

FEA Federal Enterprise Architecture

FPCON Force Protection Condition

FSC Federal Service Code

GFE/GFI/GFP

Government Furnished Equipment / Government Furnished Information / Government Furnished Property

GOTS

Government off-the-shelf is a term for software and hardware government products that are ready-to-use. They were created and are owned by the government. Typically GOTS are developed by the technical staff of the government agency for which it is created. It is sometimes developed by an external entity, but with funding and specification from the agency. Because agencies can directly control all aspects of GOTS products, these are generally preferred for government purposes.

GPM Government Program Manager

HIPAA Health Insurance Portability and Accountability Act of 1996

HQ Headquarters

HTML Hyper Text Markup Language

IA/IT Information Assurance / Information Technology

IIS

Internet Information Services, a set of Internet-based services for servers using Microsoft Windows.

IT Information Technology

J2EE Java 2 Platform, Enterprise Edition

JDBC Java Database Connectivity

JSF Java Server Faces

JSON JavaScript Object Notation

JSP Java Server Pages

JTR Joint Travel Regulation

KO Contracting Officer

LAN Local Area Network

LDAP Lightweight Directory Access Protocol

MEIT MEPCOM Information Technology

MEPCOM Military Entrance Processing Command

MEPS Military Entrance Processing Station

MOC MEPCOM Operations Center

MPLS

Multiprotocol Label Switching is a mechanism in high-performance telecommunications networks that directs data from one network node to the next based on short path labels rather than long network addresses, avoiding complex lookups in a routing table. The labels identify virtual links (paths) between distant nodes rather than endpoints. MPLS can encapsulate packets of various network protocols. MPLS supports a range of access technologies, including T1/E1, ATM, Frame Relay, and DSL.

MSR Monthly Status Report

MVC Model View Controller

NACLC National Agency Check with Local Credit Check

NDA Non-Disclosure Agreement

NLT No Later Than

OCI…