Attachment_02_PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Enterprise Management Tool (EMT)

1.0 BACKGROUND: US Army Corps of Engineers (USACE) requires professional services for the Institute for Water Resources’ (IWRs) Enterprise Management Tool (EMT). This includes services of system maintenance, data file updates and functionality development for the current EMT which includes two components a Project Management Tool and a Dashboard. The current Project Management Tool has been operational since 2009 and the Dashboard since 2015. The operational EMT resides within the Corps network (Corpnet) and is under a Corps system called P2.

The EMT is a tool for project, program, and enterprise management. It is a repository of data, which are used to generate project and corporate level reports using Oracle, Cold Fusion and javascript. The EMT currently has less than 100 active users with the intent of expansion and contains 106 database tables. Access to modules of the tool is driven by the role(s) of the user.

The Project Management Tool is a planning tool used by project managers, budget/program analysts and the IWR Corporate Board. It includes automated reports mixing planning data with data in Corps of Engineers Financial Management System (CEFMS) and P2. In addition to Project Management Plans (PMPs) for individual projects, the EMT is a repository of data for all IWR projects that are used to generate project and corporate level reports. Examples include Deliverables and Milestones by Business Lines, Project Review Board (PRB) Reports, Monthly Execution Report, Labor Hours by Employee by Project, IWR Contract Plan, and Headquarters (HQ) Proponents and Projects.

The Dashboard is a management tool used by the IWR Corporate Board for enterprise management. It provides a single location for management to view a general IWR profile and evaluate the overall performance of the organization using key indicators (travel, overhead, funding and manpower). The displays show trends with the ability to forecast Corps data as it relates to IWR and is available for management to have monthly In Progress Reviews.

2.0 SCOPE: The contractor, in support of the EMT, must be familiar with the USACE Project Management Business Processes (PMBP); PMBP Manual; ER 5-1-11, Management, USACE Business Process; and EC 11-2-211, Execution of the Annual Civil Works Program. The contractor must be familiar with CEFMS, Program and Project Management Information System (PROMIS) and the USACE Enterprise Data Warehouse. Publications, ER and EC information can be found by searching the web. The contractor must also have enough breadth to provide quick product turnaround during work load surges during the year. These surges may occur during preparation for a new fiscal year (FY) when new project management plans are being developed, during the start of an FY when reports need to be transitioned or when development and recurring report generation occur at the same time. Timeframes for surge activities are developed in coordination with the contractor during bi-monthly In Progress Reviews (IPRs) (see Task 4). Documentation and code is due to the Contracting Officer Representative (COR) upon the completion of each task.

3.0 APPLICABLE DOCUMENTS:

Section 508: Section 508 of the Rehabilitation Act of 1973, as amended, states that agencies must buy and use accessible electronic and information technology (EIT). This is to ensure that government information and data is accessible to all citizens, including those with disabilities. For example, accessible EIT allows a person who is visually-impaired to consume information on an agency’s website. The contractor for this requirement shall provide EIT as required by Section 508;

any contractor who cannot provide these services must specify why it isn’t possible. Additional information on Section 508 is available at www.section508.gov

Army Regulation (AR) 25-1 Army Knowledge Management and Information Technology

4.0 PERIOD OF PERFORMANCE: The period of performance will consist of a 12-month base year and two (2) 12-month option year to be exercised at the government’s discretion. Both base and option years contain optional tasks, that may also be exercised at the government’s discretion.

5.0 SPECIFIC REQUIREMENTS: Activities within major task areas will be evaluated and prioritized by the IWR Project Manager and COR. Activities will reflect program requirements and resolution of user issues. The testing of all database and interface modifications will be performed on government furnished equipment (GFE). This requirement is designed to provide service for 365 days from the date of award. USACE will maintain possession and ownership of all work done under this work statement, including source code and executable files. All Army and/or Corps mandated software/platform changes will be implemented in coordination with ACE-IT. USACE will provide guidance to the contractor when software/platform changes are issued. Government does not accept cost for software or graphic license fees.

5.1. Task 1. Routine Maintenance: The contractor shall provide regular maintenance to ensure the EMT operates on a continuous basis. Maintenance will include new data code updates, resolving user issues, minor operating bug fixes, implementing user registration, modifying performance measure parameters and any required data format display changes.

5.2. Task 2. EMT Modifications: The contractor shall perform modifications to the EMT to provide management with required information views for management decisions to include both the Project Management Tool and Dashboard. This shall include Project Management Tool modifications to current reports and modules and generation of new reports. Dashboard modifications shall include performance measure target parameter changes and displays. Dashboard profile views display modifications, both graph and data, and some new views within the current data sets. Examples of modifications include, but are not limited to:

a. Dashboard list of employees with greater than 25 years of service

b. Dashboard new travel report

c. Dashboard profile for Method of Accomplishment (MOA)

d. Dashboard Labor by appropriation

e. Dashboard Overhead labor by employee

f. PMP Obligation and Expenditure Schedules and Reports

5.3 Task 3. Data Updates: The contractor shall refresh all data and production modules and perform regular quality assurance evaluations to ensure system integrity on a regular basis. The Project Management Tool is updated mid-month (minimum of 2 files) and at the end of the month (minimum of 12 files). The Dashboard is updated monthly using data updated for the Project Management Tool.

The Project Management Tool, Direct Funding Status by Army Management Structure Code (AMSCO), will be updated within one working day of receiving notification of either data availability or data files, the complete Project Management Tool within three days and the Dashboard within five days. The intent is to reduce the time for updates.

5.4 Task 4. Bi-Monthly In-Progress Reviews (IPRs): The contractor shall participate in bi-monthly IPRs. During these meetings, the IWR Project Manager and Contracting Officer’s Representative (COR) will consult with the contractor to evaluate and prioritize specific activities to be accomplished. Additional requests for updates and enhancements will be forwarded to the contractor by the IWR Project Manager for evaluation and addressed by the contractor in the bi-monthly prioritization recommendations. Bi-monthly reviews shall be conducted upon request from the IWR Project Manager for specific project activities and deliverables.

5.5 Task 5. Control Panel: The contractor shall create a “control panel”, for users with administrative permission, to add/change look up information. This control panel will be a new module within the EMT and the contractor will integrate lookup tables. Activities carried out through the control panel may include: add or make inactive organization codes, add or make inactive resource codes, adjust schedule program lock dates, view update data dates, view user that makes updates, and other potential look up information that may change due to business requirement changes during the task order.

5.6 Task 6. CAC Access: Currently the EMT is accessed via user ID and password. The contractor shall convert access to the EMT to the DoD Common Access Card (CAC).

5.7 Task 7. Documentation: The contractor shall update the Project Management Tool User Guide if any changes are made to the tool. The contractor shall document the parameters for the Project Management Tool and Dashboard report data loading and format.

5.8 Travel. Three onsite visits to IWR to include; 1 Offeror Primary Program Manager at Kick off meeting, 1 Offeror Primary PM site visit, and 2 Offeror’s local team members.

5.9 Optional Task 1. Mandatory Corps Software Updates: Allow for needed coding changes due to Corps approval changes to application versions that impact application design or functionality. Currently the Corps approved software being used on the server is:

ColdFusion 10 Oracle Express Oracle SQL Developer

5.10 Optional Task 2. Database consolidation, automation and table integration:

Enhance user access table elements. This would contain additional elements necessary for functionality when the EMT is within Corpsnet and utilizing the Corps userid/password system. It would also include additional elements, but not limited to elements, needed to enhance data integrity, efficiency, and automation. This would include the Project Management Tool and Dashboard database consolidation and people table integration.

5.11 Optional Task 3. Test EMT with second Engineer Reporting Organization Code (EROC). Make appropriate application and report changes from one District of data to second District information.

5.12 Optional Task 4. Coordination Requirements: Assistance with coordination requirements required by Army and/or Corporate Information for system certification.

6.0 OPTION YEAR 1 TASKS

For the Option Year 1, the contractor personnel shall execute the following tasks.

6.1 Task 1. Routine Maintenance: The contractor shall provide regular maintenance to ensure the EMT operates on a continuous basis. Maintenance will include new data code updates, resolving user issues, minor operating bug fixes, implementing user registration, modifying performance measure parameters and any required data format display changes.

6.2 Task 2. EMT Modifications: The contractor shall perform modifications to the EMT to provide management with required information views for management decisions to include both the Project Management Tool and Dashboard. This shall include Project Management Tool modifications to current reports and modules and generation of new reports. Dashboard modifications shall include performance measure target parameter changes and displays. Dashboard profile views display modifications, both graph and data, and some new views within the current data sets. The specific reports are TBD but are expected to include approximately 10 modifications and the development of 5 new reports.

6.3 Task 3. Data Updates: The contractor shall refresh all data and production modules and perform regular quality assurance evaluations to ensure system integrity on a regular basis. The Project Management Tool is updated mid-month (minimum of 2 files) and at the end of the month (minimum of 12 files). The Dashboard is updated monthly using data updated for the Project Management Tool.

The Project Management Tool, Direct Funding Status by Army Management Structure Code (AMSCO), will be updated within one working day of receiving notification of either data availability or data files, the complete Project Management Tool within three days and the Dashboard within five days. The intent is to reduce the time for updates.

6.4 Task 4. Bi-Monthly IPRs: The contractor shall participate in bi-monthly IPRs. During these meetings, the IWR Project Manager and COR will consult with the contractor to evaluate and prioritize specific activities to be accomplished. Additional requests for updates and enhancements will be forwarded to the contractor by the IWR Project Manager for evaluation and addressed by the contractor in the bi-monthly prioritization recommendations. Bi-monthly reviews shall be conducted upon request from the IWR Project Manager for specific project activities and deliverables.

6.5 Task 5. Documentation: The contractor shall update the Project Management Tool User Guide if any changes are made to the tool. The contractor shall document the parameters for the Project Management Tool and Dashboard report data loading and format.

6.6 Travel. Three onsite visits to include; 1 Offeror Primary Program Manager at Kick off meeting, 1 Offeror Primary PM site visit, and 2 Offeror’s local team members.

6.7 Optional Task 1. Mandatory Corps Software Updates: Allow for needed coding changes due to Corps approval changes to application versions that impact application design or functionality. Currently the Corps approved software being used on the server is, but maybe newer versions at time of this option:

ColdFusion 10 Oracle Express 12c

6.8 Optional Task 2. Coordination Requirements: Assistance with coordination requirements required by Army and/or Corporate Information for system certification.

This could include automation and table integration.

6.9 Optional Task 3. Implement multiple USACE Organizational Access: Make appropriate application and report changes from two Districts of data to all of the Corps District/Division information. This information would be as an individual district or Field Operating Activity (FOA) and information rolled up to a Division level.

7.0 OPTION YEAR 2 TASKS

For the Option Year 2, the contractor personnel shall execute the following tasks.

7.1 Task 1. Routine Maintenance: The contractor shall provide regular maintenance to ensure the EMT operates on a continuous basis. Maintenance will include new data code updates, resolving user issues, minor operating bug fixes, implementing user registration, modifying performance measure parameters and any required data format display changes.

7.2 Task 2. EMT Modifications: The contractor shall perform modifications to the EMT to provide management with required information views for management decisions to include both the Project Management Tool and Dashboard. This shall include Project Management Tool modifications to current reports and modules and generation of new reports. Dashboard modifications shall include performance measure target parameter changes and displays. Dashboard profile views display modifications, both graph and data, and some new views within the current data sets. The specific reports are TBD but shall include approximately 10 modifications and the development of 5 new reports.

7.3 Task 3. Data Updates: The contractor shall refresh all data and production modules and perform regular quality assurance evaluations to ensure system integrity on a regular basis. The Project Management Tool is updated mid-month (minimum of 2 files) and at the end of the month (minimum of 12 files). The Dashboard is updated monthly using data updated for the Project Management Tool.

The Project Management Tool, Direct Funding Status by Army Management Structure Code (AMSCO), will be updated within one working day of receiving notification of either data availability or data files, the complete Project Management Tool within three days and the Dashboard within five days. The intent is to reduce the time for updates.

7.4 Task 4. Bi-Monthly IPRs: The contractor shall participate in bi-monthly IPRs. During these meetings, the IWR Project Manager and COR will consult with the contractor to evaluate and prioritize specific activities to be accomplished. Additional requests for updates and enhancements will be forwarded to the contractor by the IWR Project Manager for evaluation and addressed by the contractor in the bi-monthly prioritization recommendations. Bi-monthly reviews shall be conducted upon request from the IWR Project Manager for specific project activities and deliverables.

7.5 Task 5. Documentation: The contractor shall update the Project Management Tool User Guide when changes are made to the tool. The contractor shall document the parameters for the Project Management Tool and Dashboard report data loading and format.

7.6 Travel. Three onsite visits to include; 1 Offeror Primary Program Manager at Kick off meeting, 1 Offeror Primary PM site visit, and 2 Offeror’s local team members.

7.7 Optional Task 1. Mandatory Corps Software Updates: Allow for needed coding changes due to Corps approval changes to application versions that impact application design or functionality. Currently the Corps approved software being used on the server is, but maybe newer versions at time of this option:

ColdFusion 10 Oracle Express 23c

7.8 Optional Task 2. Coordination Requirements: Assistance with coordination requirements required by Army and/or Corporate Information for system certification.

8.0 PERFORMANCE STANDARDS:

PRS Statement(s) Acceptable Quality

Level

Incentive or

Remedy

Compliant/Relevant (All statements) 100 % of the time Re-perform/correct at no cost to the Government.

Compliant with applicable standards (All statements)

100% of the time Re-perform/correct at no cost to the

Government

Deliverables completed IAW Schedule. 95% of the time

Early identification of problems and/or corrective actions. Report to gov’t within 2 days of discovery.

90% of the time

Operational/Effective. 100% of the time Re-perform/correct at no cost to the Government.

9.0 GOVERNMENT FURNISHED MATERIALS: Contractor will be provided government furnished equipment. It is the responsibility of the contractor that the GFE is maintained with the most recent software versions via the Corps ACE-IT support.

10.0 KICK OFF MEETING: The government will have a kick off meeting within 30 days of award.

11.0 PLACE OF PERFORMANCE: The work will be completed at the contractor’s site.

12.0 OTHER REQUIREMENTS

12.1 Information Assurance

Information Assurance (IA) Training. All contractor personnel with access to Government information systems and networks shall successfully complete all required initial and annual IA awareness training as specified in AR 25-2 and as specified by the Government requiring activity. Training is available at https://ia.signal.army.mil

Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atus.army.mil, in the unit container managed by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

The contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract.

Information Assurance Workforce Certification. DFARS clause 252.239-7001 (Information Assurance contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

The contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

The contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdosd.mil/appj/dwc/index.jsp.

Non-Government-owned computing systems or devices (if applicable). The contractor shall comply with AR 25-1 and AR 25-2. The contractor shall not install or connect non- Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information Assurance Program Manager (IAPM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

Protection of Sensitive Unclassified Data (if applicable). The contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), and proprietary information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD

Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media and in DoD Component implementing instructions.

12.2 Security Requirements.

Army Training Certification Tracking System Registration. All contractor employees with access to a government info system must be registered in the Army Training Certification Tracking System (ATCTS) (https://atus.army.mil/iastar/login.php) at commencement of services, and must successfully complete the DOD Information Assurance (IA) Awareness training prior to access to the information systems and then annually thereafter in accordance with personnel security standards listed in AR 25-2 (Information Assurance), an appropriate background investigation will be conducted prior to accessing the government information systems

Operational Security (OPSEC) Training. All new contractor employees will complete Level I OPSEC Training within 30 calendar days of NTP. Additionally, all contractor employees must complete annual OPSEC awareness training. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. OPSEC awareness training is available at the following websites:

https://www.iad.gov/ioss/ or http://www.cdse.edu/catalog/operations-security.html.

E-Verify: The contractor must pre‐screen candidates using the E‐verify Program (http://www.dhs.gov/E‐Verify) website to meet the established employment eligibility requirements. The vendor must ensure that the candidate has two valid forms of government issued identification to ensure the correct information is entered into the E‐ verify system. An initial list of verified/eligible candidates must be provided to the COR no later than 5 business days after the initial contract award.

Common Access Card (CAC): The contractor will obtain a CAC card for all contractor employees requiring access to Government networks. This is a four step process: 1) Sponsorship and Eligibility; 2) Registration & Enrollment; 3) Background Investigation 4) Obtain Card. These steps are explained in more detail at the following website:

http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/ . Note that this process includes two in-person visits (1. Registration in the Trusted Associate Sponsorship System (TASS) and fingerprinting; and 2. card-issuance) at a RAPIDS site (location list here: http://www.dmdc.osd.mil/rsl ). Registration in TASS and obtaining a CAC requires close coordination with a USACE Sponsor and Trusted Agent. Contact the COR for contact information for the nearest Sponsor and Trusted Agent. The contractor will require Tier 1 clearance.

Suspicious Activity Reporting Training (e.g. iWATCH, Corps Watch, or See Something, Say Something): The contractor and all associated sub-contractors shall receive a brief/training (provided by the RA) on the local suspicious activity reporting program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the project manager, security representative or law enforcement entity. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after the completion of the training.

For Information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.

Information assurance certifications: All contractor employees supporting IA/IT functions shall be appropriately certified upon contract IAW DoD 8570.01-M, DFARS 252.239-7001 and AR 25-2. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

All contractor employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

12.3 Quality Control/Quality Assurance

Quality Control (QC). The contractor shall develop a quality control plan (QCP) and implement a quality control program to satisfy the specific requirements of this contract. An optimal QCP shall identify potential problem areas and evolve over the life of the contract.

The contractor shall provide the QCP to the Contracting Officer (KO) and COR for approval no later than 30 calendar days after contract award. The contractor shall update the QCP as required and provide copies to the KO and COR for approval.

Quality Assurance (QA). The Government will monitor the contractor's performance under this contract. The Government has the right to conduct inspections and performance evaluation at any time and at any place where contract performance occurs. If any aspect of the performance is not in conformance with the requirements of this contract, the Government has the right to issue to the contractor a Contract Discrepancy Report (CDR).

The contractor shall explain in writing why performance was not in conformance with the requirements of the contract, how performance will be returned to conformance, and how recurrence of the problem will be prevented in the future. The contractor shall complete and return the CDR to the Contracting Officer and COR within five workdays after receipt of the CDR. The contractor shall maintain copies of all inspection and evaluation reports.

Government review of contractor deliverables will be guided by the QASP. The QASP will be based on the requirements and acceptance criteria in the PWS and aligned with the design, implementation and testing plans in coordination with the contractor.

12.4 Data Rights/Source Code:

The Government has unlimited rights to all source code, documents and material produced under this contract. All documents and materials, to include the source code of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

12.5 Applicable Documents.

The contractor shall comply with the publications, including Army regulations, listed below.

The PWS may set a higher standard of performance than an applicable Army regulation.

The PWS will have precedence over the regulations unless a particular PWS provision is in direct conflict with the applicable provision of the Army regulation. Unless otherwise noted, the publications can be accessed at www.apd.army.mil. Upon request, the Government will provide those publications not available on a web site. The contractor shall comply with changes to publications. The contractor shall inform the KO of any changes to a publication or documents that impact the cost of the contract.

AR 25-1 Army Information Technology

AR 25-2 Information Assurance

AR 380-5 Department of the Army Information Security Program

AR 525-13 Antiterrorism (FOUO requires AKO access)

AR 530-1 Operations Security (OPSEC) (FOUO requires AKO access)

DoDM 5200.01-V4 DoD Information Security Program: Controlled Unclassified Info (CUI)

DoDD 5205.02E DoD Operations Security (OPSEC) Program

DoDD 5400.11 DoD Privacy Program

DoD 8570.01-M Information Assurance Workforce Improvement Program

DoDI 8500.01 Cybersecurity