B08_Amendment_0002_W91CRB19R0007_TAMIS.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

See Summary of Changes

1. CONTRACT ID CODE PAGE OF PAGES

Y 1 33

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 06-Jun-2019

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W91CRB19R0007

X 9B. DATED (SEE ITEM 11)

30-May-2019

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

06-Jun-2019

CODE

ACC - APG - W91CRB

BLDG 4310

6515 INTEGRITY COURT

ABERDEEN PROVING GROUND MD 21005-3013

W91CRB 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

W91CRB19R0007

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SUPPLIES OR SERVICES AND PRICES

CLIN 0005

The CLIN extended description has changed from:

In accordance with PSOW 3.1

To:

In accordance with PSOW 3.1. This CLIN is normalized The pricing detail quantity 1.00 has been added.

The cost constraint NTE has been added.

The following have been modified:

INSTRUCTIONS TO OFFERORS

Proposals shall remain valid for a period of at least 120 days from the due date.

Offerors shall submit their proposals electronically to ian.a.warner.civ@mail.mil and sabrinna.r.cosom.civ@mail.mil.

The Government will consider how well the offeror complied with these instructions when evaluating the offeror’s capability to perform the prospective contract. Offerors are advised to ask the contracting office for clarification of any part of these instructions that they do not understand.

General Content of Proposals:

1. The offeror’s proposal must include all data and information requested and must be submitted in accordance with these instructions. Any offeror who submits an incomplete package may be considered unacceptable. The offer shall be compliant with the requirements as stated in the PWS. Non-conformance with the instructions provided may result in an unfavorable proposal evaluation. Pages containing text shall be typed on 8-1/2 x 11 inch paper. Drawings or other graphics should be reduced only to the extent legibility is not lost. Each page shall be single spaced with a minimum of twelve

(12) point Times New Roman font and one (1) inch borders. Within tables and graphics, a minimum of ten (10) point Times New Roman font shall be utilized. Offerors shall submit their proposals electronically to ian.a.warner.civ@mail.mil and sabrinna.r.cosom.civ@mail.mil. The email file size limit is 10MB. If the file size is larger than 10MB, more than one email may be submitted. It is incumbent upon the offeror to ensure proposals are received prior to the due date and time.

2. The proposal shall be clear, concise, and shall include sufficient detail for effective evaluation and for substantiating the validity of stated claims.

3. Elaborate brochures or documentation, binding, detailed art work, or other embellishments are unnecessary and are not desired.

4. The Government may evaluate offers and award a contract without discussions.

Therefore, the offeror’s initial offer should contain the offeror’s best terms from a price and technical standpoint. However, the Government reserves the right to conduct discussions in accordance with FAR 15.306(d), if later determined by the Contracting Officer to be necessary. The Government may reject any or all offers if such action is in the public interest; and waive informalities and minor irregularities in the offers received.

5. No pricing information shall be included in the non-price factor submissions.

Proposals that fail to separate the price factor may be determined unacceptable and may not be considered for award.

6. Proprietary information shall be clearly marked.

7. The Government may incorporate portions of the contractor’s proposal into the contract.

8. Each factor shall be submitted as a separate volume. Proposals shall adhere to the following page count limitations. Excess pages will be removed from the back of each section and will NOT be read or evaluated.

Volume Page Count Factor 1 – Technical Approach 20 pages not including resumes, letters of commitment and/or contingent letters of offer and acceptance

Factor 2 – Past Performance

Maximum 5 citations. Limit 2 pages per citation.

Factor 3 – Price

No page limit

Each Volume shall be independent. Information relating to a specific factor shall not include references to other volumes or information contained to support other factors.

Factor 1 – Technical Approach

Offerors shall submit their approach in providing an overall quality management team, the company’s overall structure, management approach and the capabilities of the managerial team to manage and maintain efficient levels of staffing throughout the contract performance period. In addition, facilities, munitions management knowledge and problem resolution, as well as responsiveness to customer concerns shall be addressed.

Offerors shall provide responses which address each requirement listed in the PWS/Section C. The response to each of these requirements shall provide an explanation indicating the offeror’s ability and proposed methodology to be utilized to meet each requirement. The proposal should not simply rephrase or restate the Government’s requirements, but rather shall provide convincing rationale to address how the offeror intends to meet these requirements. Offerors shall assume that the Government has no prior knowledge of their facilities and experience, and will base its evaluation on the information presented in the offeror’s proposal.

Offerors shall provide resumes and letters of commitment and/or contingent letters of offer and acceptance counter‐signed by the employer and the prospective employee for each of the nine (9) Key Personnel positions listed in Section 4 of the PWS. Resumes shall document the education, experience and other minimum qualifications of Section 4 of the PWS. Letters shall include a fully burdened labor rate. In addition, an Officer of the offering company shall certify the accuracy of all submitted resumes and the validity of any contingent employment agreements. Offerors shall identify and provide their Software Development Life Cycle (SDLC) management and DoD information technology compliance approach and detail how they will be applied to meet or exceed minimum performance requirements. Offerors shall include their process improvement approach and describe how key personnel will apply these processes to deliver reliable and secure software and system enhancements.

Offerors shall include a Transition Plan which includes schedules and timelines needed to execute paragraph 5 of the PWS with minimal impact on the TAMIS customer base.

Offerors shall identify the National Capital Region (NCR) physical location of their proposed site in their transition plan. Only non-production Government Furnished Equipment (GFE) will be moved to the new location.

Factor 2 – Past Performance

The Offeror shall submit recent and relevant past performance information for its proposed team. Offerors shall submit no more than five (5) citations and each citation shall not be greater than two (2) pages. “Recent” is defined as contracts under which work has been performed within the past five (5) years. “Relevant” is defined as substantially the same in size, scope, and complexity as the requirements of this Request for Proposal (RFP). The Government will use past performance information provided by the offeror, and other information obtained from other sources, to develop an assessment of the offerors.

The Offeror shall provide Past Performance Information (PPI) for no more than five (5) previous Government contracts. Each PPI will be limited to 2 pages and shall contain the following information:

(1) Contractor place of performance, CAGE Code and DUNS number

(2) Government contracting activity

(3) Contracting POC name, telephone number and email

(4) Government's technical representative/COR name, telephone number and email

(5) Contract Number, Duration, Contract title

(6) Awarded price/cost

(7) Final or projected final price/cost

(8) Original delivery schedule

(9) Final or projected final delivery schedule

(10) Narrative - A brief summary of the services provided. Offerors shall provide a specific narrative explanation of each contract listed describing the objectives achieved and detailing how the effort is relevant to the requirements of this solicitation. The offeror shall also specify to what extent subcontractors were involved in gaining related experience, and their level of involvement with respect to the scope of work, objectives achieved, and personnel resources utilized, and how previous contracts relate to this effort. The narrative shall also identify whether any of the Key Personnel proposed contributed directly or indirectly to any of the past performance citations.

Factor 3 – Price

For the FFP CLINS (0001-0004), the offeror shall propose the total price for completing tasks 1 through 4 considering the offeror’s proposed approach.

For the T&M CLIN, the ceiling will be set at a Not To Exceed (NTE) amount of $100,000.00.

1. The price proposal shall identify labor categories, descriptions, and fully burdened labor rates by Task. Travel is not to be included in the price of any task. Travel and other direct costs (CLIN 0005) have been provided and shall not be changed.

2. An excel sheet Cost Model (attachment 5) shall be submitted as part of the price proposal with pricing for the base year. The total evaluated price (TEP) will be the sum of all CLINs in Section B. CLIN 0005 – Travel/Other Direct Costs will have a value of $100,000.00. Pricing information shall be contained and addressed ONLY in the Factor 4-Price Volume.

PERFORMANCE WORK STATEMENT

T Introduction

1.1 Scope

Headquarters, Department of the Army (HQDA), G-3/5/7 Munitions Management Office (DAMO-TRA) requires continued sustainment, software improvements, and munitions management support for its Total Ammunition Management Information System (TAMIS).

This performance statement of work (PSOW) requires the offeror to continue to improve the

TAMIS design, functionality and interoperability while providing munitions support IAW with the munitions battle rhythm. This PSOW requires a broad range of information technology skills coupled with a deep understanding of United States Army munitions management operations and familiarity with United States Marine Corps munitions management.

1.2 Background

TAMIS is an information technology acquisition project sponsored by Department of the Army G-3/5/7, Munitions Management Office. TAMIS has a long history of updates and improvements resulting from changes in munitions governance, system consolidation and improved technology.

Over the last five years Army G-3/5/7, Munitions Management Office together with the Army G-4, Office of the Deputy Chief of Staff for Logistics, and the US Marine Corps has streamlined munitions work-flow, improved relationships, and generated better munitions information by consolidating data and reforming munitions management with TAMIS.

As the Munitions Management Office enters the next phase, the project will continue its evolutionary acquisition approach and employment of agile management, development and operations (DevOps) practices to support the annual munitions battle rhythm and system engineering efforts. Evolutionary meaning fielding an operational and supportable system with initial capability in as short a time as possible, with the explicit intent of delivering improved or updated capability in the future.

The agile management and DevOps approaches minimize risk by developing software in iterations that typically last three to twelve weeks. Each iteration includes requirements analysis, design, coding, testing, and basic documentation—all the tasks necessary to release a min-increment of new or improved functionality. After each increment, TAMIS project management reevaluates and baselines priorities. The agile method is aligned with DoD 5000 and appropriate DoD Instructions. As such, it emphasizes continuous communication, with secure working software as the primary performance measure. The offeror shall describe how its agile and DevOps practices will achieve Army objectives contained in this

PSOW.

1.3 Objectives

The offeror shall sustain and protect the TAMIS enterprise while applying expert knowledge of Army and Marine Corps munitions practices to make improvements in accordance with this PSOW. The HQDA G-3/5/7 Munitions Office overarching objectives are listed below and detailed in the Detailed Requirements section.

Maintain TAMIS in the cloud ensuring reliability, scalability, security, and affordability.

Update and maintain system engineering, cybersecurity accreditation, and user documentation.

Update and maintain a TAMIS systems architecture that applies DoDAF standards and meets Army Enterprise Architecture and Risk Management Framework (RMF) requirements.

Independently verify that all new TAMIS code is free of known defects using automated mechanisms before implementation.

Maintain and improve the TAMIS requirements and prioritization process so that requirements can be rapidly determined and efficiently disseminated as force structure, training strategies, programs of instructions, and munitions tests change.

Applying a deep understanding of munitions management provide on-site OCONUS munitions assistance; TAMIS help desk support and support prescribed in the munitions battle rhythm.

Applying a deep understanding of munitions management, develop, optimize and maintain forecasting by training event, test event and aircraft CAD/PAD (Cartridge Actuated Device / Propellant Actuated Device).

Improve and enhance the processing, handling and storage of electronic documents and records. This includes: requests for munitions; records of expenditure; and other munitions documents required to improve munitions management and the end user experience.

Develop, maintain and improve system interfaces and data exchanges with existing and emerging military information systems requiring munitions data.

Implement and maintain an up-to-date, ad-hoc business intelligence tool that more effectively enables munitions analytics on the desktop and mobile devices.

Applying a deep understanding of munitions management maintain, update and improve the on-line handling, management and publishing of Department of the Army Pamphlet 350-38, Standards In Training Commission (STRAC).

Maintain and update the TAMIS cross-platform, mobile strategy and deploy a TAMIS mobile capability that enables requesting, reporting and managing munitions on any capable mobile device. This may include building and/or deploying a TAMIS app or apps to the Army, DISA or other approved DoD app store.

Additional products and services required in support of munitions management are stated below. Any acquisition of IT shall be coordinated in advance with the Government and shall be made in accordance with all IT related laws and regulations applicable to Army purchases (for example, reference AR 25-1, RMF Supply Chain Security Guidance, and FAR and Supplements part 39).

COTS licensed software products, maintenance and support services Application hosting, cloud services and/or software as a service

(SaaS) services Networking, cabling and other wiring and telecommunications services Temporary facilities to conduct munitions conferences, training and meetings

1.4 Changing Word Events (Task 2)

While overarching sustainment and enhancement objectives are identified above and detailed in paragraph 2, Army warfighting functions drive TAMIS enhancements. As a result, certain requirements may not always be known. As the military becomes a more agile force, changes may impact munitions management practices whereby rapid TAMIS modifications are necessary.

2. Requirements

2.1 Summary

The scope of services under the TAMIS PSOW covers the full Systems Development Life Cycle Management (SDLCM) process and includes munitions governance, enterprise architecture, security, training and performance reporting.

The Contractor will execute Operations and Maintenance (O&M) support by conducting routine system administration, database administration and tuning functions. Routine maintenance includes regular backups, software upgrades, hardware maintenance and upgrades, and diagnostics as required to maintain the integrity of the system. The Contractor will maintain a prioritized list of engineering changes and implement engineering changes as directed by the Government configuration control process. The Contractor will conduct sufficient regression testing to ensure engineered changes will successfully function within the TAMIS production environment. The Contractor will only implement TAMIS code changes that have been determined free of vulnerabilities by the government furnished HP Fortify static code analyzer or alternate government approved device, service or software.

The Contractor shall support the TAMIS web-based system and its 7000+ users that perform between 400K and one-million transactions each month. For the purposes of this PSOW, the term “support” includes, but is not limited to, those activities associated with:

o Protecting and defending the existing system from cyber threats and maintain certification, accreditation compliance and Authorization to Operate (ATO).

o Providing munitions support that sustains and enhances Army readiness.

o Training and helping end users manage munitions and interact with the system to extract meaningful information.

o Managing changes to the program baseline through continuous use of appropriate configuration management and software quality assurance practices.

o Enhancing system responsiveness through tuning and optimization measures.

o Designing, developing, testing, and delivery of system enhancements free of security defects.

o Leveraging new technologies to enhance performance and functionality.

2.2 Army Munitions Battle Rhythm

The Contractor shall administer TAMIS based upon the Battle Rhythm in the graphic and table below. While the Battle Rhythm may change from time-to-time, it illustrates the rhythm of significant management activities in the HQDA G3/5/7 Munitions Office and also identifies key TAMIS functions. Specific TAMIS tasks are documented in the Detailed Requirements section.

Munitions Battle Rhythm

Item Frequency/Date

Monthly Progress Report to HQDA—Contracting Officer Technical Representative (COTR). See T-01-01. Monthly

Receive/Obtain Force Structure update from Army Organization Server (AOS) or FMSWeb; align with Army Stationing and Installation Plan (ASIP) and stationing and manpower allocation system (SAMAS) as required. Load in

TAMIS.

JUN/NOV and as directed

Build TAMIS Hierarchy

JUL

Load Munitions Requirements

AUG

TAMIS Advisory Group In-Progress Review (IPR)—Prepare TAMIS update Up to twice annually

Publish following year DRAFT DA PAM 350-38 in TAMIS July 2014 release FY 2016; July 2015 release FY 2017; July 2016 release FY 2018…….and so on.

NLT 1 JUL

Army Munitions Working Group Support (AMRWG)— STRAC weapon systems and strategies reviews and adjustments. Capture and organize approved strategy changes. Update TAMIS as required.

SEP & MAR

Army Munitions Council of Colonels Support—STRAC weapons systems and strategies reviews and adjustments.

Capture and organize approved strategy changes. Update TAMIS as required

OCT & MAR

TAMIS Advisory Group (TAG) OCT & MAR

Requirements Module Locked OCT & APR

Total Army Ammunition Authorization and Allocation Conference (TA4C) Support; distribute authorizations to each command for next FY.

APR & AUG

Publish current FY DA PAM 350-38 in TAMIS NLT 1 OCT

Army Munitions Support to GOSC-- STRAC weapons systems and strategies reviews and adjustments (as required). NOV & MAY

Process MTOE/TDA/POI changes and load in TAMIS. As required WEB Ammo Authorization Update to ASALT. NOV

Year-end Close-out and crossover activities; Report to ASA

FMC OSMIS. OCT

Conduct TAMIS training Continuously

2.3 Detailed Requirements

The Contractor shall provide continued support, conduct maintenance and implement improvements to the system as defined in the four specific tasks below. Any acquisition of hardware or software shall be made in accordance with Army Regulations including AFARS 5139.101(c).

2.4 Task 1 – Project Management and Cost Control (Firm Fixed Price) ID Requirement Performance Criteria T-01-01 Delivery Order Management and Program Management

The Contractor shall provide a delivery order management plan that describes the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout this PSOW period of performance.

The Contractor shall report the status of all work performed under this PSOW, including, but not limited to all work orders, software and hardware purchases and license payments. The Contractor shall provide a Contractor's Progress, Status and Management Report (CDRL T-01-01) on a monthly basis to the TAMIS Program Manager. The Contractor shall include sections containing TAMIS system performance details; the number of personnel trained by location, help desk statistics, current or anticipated problems and recommended solutions.

20 Days after award.

Contractor's Progress, Status and Management Report delivered 15th of each month

T-01-02 Master Work Breakdown Structure

(WBS)

The Contractor shall develop and maintain a Master Work Breakdown Schedule (WBS) consistent with their Proposal. The Contractor shall also develop and maintain a Master Project Schedule that shall integrate all tasks into a master plan and shall align with the Contractors Master WBS. The WBS should be traceable to each identified task in the Team Foundation Server.

Updated when requested and during scheduled project status updates.

T-01-03 Master Project Schedule

The Contractor shall assume the management of the existing Master Project Schedule. The Contractor Master Project Schedule shall document the tasks, start dates, end dates, durations, predecessors, successors, and resources required to execute the program of work.

Master Project Schedule shall be updated weekly and be included in the monthly progress report.

T-01-04 Government Furnished Equipment

(GFE)

The Contractor shall identify, label, and update all GFE to create an inventory of system components.

This shall include the recording of information about GFE, including hardware and software versions, documentation, and other unique identifiers. No GFE shall be modified, replaced or removed without the appropriate controlling documentation. The Contractor shall monitor all GFE, capturing all current and historical lifecycle data, including tracking of GFE status (ordered, received, under test, live, under repair, withdrawn or for disposal.)

Tracking information shall be update weekly and be included in the monthly progress report.

2.5 Task 2—Engineering and Sustainment (Firm Fixed Price)

ID Requirement Performance Criteria T-02-01 Document Management

The Contractor shall prepare and maintain all system documentation describing software and hardware configuration management, software development process, software testing process, system interfaces, user guides, training materials, computer based training videos, and any other documentation as required by DoD and Army guidance.

Per the Offeror’s Technical Approach and included in the C&A package.

Per CJSI 3170 and PSOW

T-02-02 Secure Software Design, The Contractor shall apply an agile and DevOps approach to design, development, and testing of TAMIS to ensure the rapid delivery of high quality

Approach

Development and Testing software is aligned with customer needs.

Emphasis shall be on the demonstration of clear and definable improvements in the confidentiality, integrity, availability, supportability, reliability, maintainability, and performance of the item and system in the cloud. Design concepts shall include provisions for continuous technological improvement utilizing the latest cloud technologies that maximize cross-platform opportunities available from emerging technological advances in the commercial market place. Any commercial products and processes proposed for implementation shall be thoroughly evaluated using an Analysis of Alternatives (AoA) to provide the Government with recommendations and justification for which commercial solutions are appropriate to implement.

The contractor shall support standard development languages including XML, HTML5, CSS3 and JavaScript, and the VisualStudio IDE. The contractor shall also support mobile frameworks for iOS, Android and Windows 10 Mobile platforms in order to enable key TAMIS functions such as requesting munitions, viewing munitions status and calculating requirements in native code-based apps.

Enable browser based report viewing on mobile devices. DoD policy and technology will guide TAMIS mobile development and implementation.

The Contractor software development procedures will include at a minimum, static code and dynamic or binary application analysis. The Contractor shall have their software reviewed for security flaws, in binary format (i.e. compiled or byte code format), by an independent organization that specializes in application security, at their expense, prior to delivery to the Government. The

Achieve total contract cost reduction (ODCs and labor) IAW technical approach existing independent review is conducted via Software as a Service (SaaS) from Veracode. At a minimum, the review shall cover common software vulnerabilities. The review shall include a combination of static analysis of the binary code and dynamic web application vulnerability scanning. Additionally, the review may include manual penetration testing. All development will utilize the government furnished HP Fortify static code analyzer (or other government approved product or service) prior to releasing updates into production. The Contractor shall certify all delivered code is free of known defects prior to implementation.

The Contractor shall conduct a software risk analysis after each major TAMIS enhancement. The analysis shall produce a vulnerability rating similar to the NIST recommended CVSS (Common Vulnerability Scoring System). All TAMIS improvements, updates, and modifications shall be aligned with the DoD Security Technical Implementation Guide (STIGs) for the appropriate delivered component.

T-02-03 Database and Application Administration

The Contractor shall perform tasks relating to the setup, maintenance, and routine administration of TAMIS SQL database definitions and data for all TAMIS environments. These tasks shall include deploying the TAMIS database servers in a highly available and scalable configuration in the cloud, setup and maintenance of the TAMIS database management system, user accounts, table spaces, indices, triggers, views, and stored procedures. The Contractor shall automate routine maintenance and operational activities in executable scripts, which shall be adequately documented and tested. The database shall be appropriately. The Contractor shall document the relational schema in terms of tables, columns, relationships, primary and foreign keys, indices, and table constraints. normalized for the intended purpose of the data and contain complete audit trail information.

Per the Offeror’s Technical Approach and IAW the appropriate DISA STIG

T-02-04 System Integration and Testing

The Contractor shall integrate and interface new equipment and prepare required documents in accordance with applicable government instructions and industry best practices. The Contractor shall prepare integration and test plans for database, system/network, and web server hardware and software upgrades that may be required during the contract period. Plans shall document all requirements for integration and testing, support services, instrumentation, and logistics support if required.

T-02-05 Application Maintenance and Sustainment

The contractor shall continue to utilize the .NET framework and continue using the Microsoft Team Foundation Server (TFS) and 11 MSDN GFE licenses. The Contractor shall update, maintain and support all TAMIS web sites. This shall include all HTML and JavaScript source

Per the Offeror’s Technical Approach

Per DoDI 8510.01 and AR 25-2 documents, scripts, Java code, data validation scripts, and any other components that may become part of the overall TAMIS web-based application.

T-02-06 Hardware/Software Development

The Contractor shall configure and deploy new hardware and software as older hardware is phased out for all TAMIS environments. The Contractor shall conduct appropriate testing to ensure the new hardware and/or software is tested, operational and secured. The Contractor shall document the software test description, plan and results. The Contractor shall ensure that new hardware and/or software is installed with minimal disruption to the end user.

The Contractor shall develop implementation procedures that document and provides details of the deployment process of new hardware and/or software to all TAMIS environments.

T-02-07 Change Control and Configuration

The Contractor shall develop and maintain a configuration control/management plan that continually regulates the change control processes.

At a minimum this shall include maintaining a list of all defects and proposed changes reported by the user community. The Contractor shall annotate the disposition and conduct a Security Impact Analysis of each defect or proposed change reported by the user community. The Contractor shall estimate the time associated with the repair of the defect or implementation of the proposed change. The Contractor shall identify any impacts the defect and its repair may have on other elements of the system and report on the status of the baseline and scheduled changes to the baseline. The Contractor shall provide an updated Configuration Status Accounting Information Report to the TAMIS Program Manager as part of the monthly

Per the Offeror’s Technical Approach and included in the Contractor's Progress

Report report or as necessary to maintain sufficient configuration control of

TAMIS.

T-02-08 Release Management

The Contractor shall refine, document and maintain a testing and release management process that ensures the most efficient use of resources with the least impact on the customer. The release management process must include publishing updates, modifications, and bug fixes to a cloud environment.

Updates, modifications, and bug fixes are defined below:

UPDATE: A change to an existing function such as DA making a change in procedure that was already functioning.

MODIFICATION: The addition of new functionality, a process or procedure or view not previously utilized.

BUG FIX: A correction to a function not working correctly or displaying something incorrectly on the screen.

The Contractor shall maintain the external TAMIS test site http://UAT.tamis.org where TAMIS users and designated testers can view and comment on upcoming TAMIS modifications prior to implementation.

Approach and included in the Contractor's Progress

Report

T-02-09 System Interfaces

The Contractor shall establish, document, and maintain interfaces with new and evolving information systems to include the Standard Army Ammunition System- Modernized (SAAS-MOD), Global Combat Support System (GCSS-A), Logistics Modernization Program (LMP), supply and asset visibility systems, research and development systems, procurement, training and requirements systems and the Marine Corps Ordnance

System as well as other Services’ systems as requirements emerge.

The Contractor shall maintain, support and modify as required TAMIS web services library where designated system developers may review, select and test TAMIS (WSDL files) Web Services Description Language.

T-02-10 Munitions Reporting

The Contractor shall apply its deep understanding of munitions management to build and administer useful reports. In order for munitions queries to trigger decisions, they must be presented in an intuitive way -- in graphical forms, grids, scorecards or a combination. Reports must be descriptive, visually appealing and accessible to discrete sections of the TAMIS hierarchy. Continue development and tuning of the TAMIS statistical reporting capability and develop an enhanced ad-hoc user report capability.

Reports must be configured and viewable for mobile users using either personally owned devices or Government provided devices.

T-02-11 System Enhancements

The Contractor shall maintain the existing TAMIS engineering model built around Microsoft Team Foundation Server and its various components. The Contractor shall review and follow the existing Master Project Schedule and recommend adjustments, where appropriate, after contract award. Several enhancements, modifications and updates are currently programmed. Sample enhancement listed below:

Develop a cross-platform TAMIS mobile strategy, deploy and manage a TAMIS mobile capability that enables requesting, reporting and managing munitions on any capable mobile device while maintaining mobile authentication and identity validation. This may include the building and deploying a TAMIS app or apps to an Army, DISA or other approved DoD apps store.

The contractor shall establish a flexible life-cycle support architecture for TAMIS mobile that includes a concept of operations and covers the entire life cycle of the apps.

The contractor shall provide an advanced natural language search/query capability that includes the ability recall saved searches, to search by unit, document number, problem/incident report, or key word.

Maintain, update and publish DA PAM 350-38 with Government provided updates in TAMIS annually.

Develop, implement and manage a munitions requirements Program Objective Memorandum (POM) capability in TAMIS so that future year requirements are calculated, managed and governed using the existing TAMIS interface

The contractor shall implement and maintain an up-to-date, ad-hoc business intelligence capability that more effectively enables munitions analytics on the desktop and mobile devices.

Improving munitions management over the period of performance requires an agile management approach that focuses on continuous process improvement as well as improving system performance.

The examples cited above and the existing project schedule is not all-inclusive

Per World Wide Web Consortium http://www.w3.org/standards Accomplished during the base year

Apply expert knowledge to improve system performance and enhance munitions management functions.

2.6 Cybersecurity Support (Firm Fixed Price)

As cybersecurity is a major focus area for all of DoD, the contractor must have demonstrated experience performing all of the tasks under Task 3 – Cybersecurity Support for cloud environments of similar size and complexity. The contractor shall perform the following tasks for all TAMIS environments to maintain the system’s confidentiality, integrity, and availability. All security requirements cover all aspects of the software delivered, including third party components, services, and code libraries.

ID Requirement Performance Criteria

T-03-01 Cybersecurity Documentation and eMASS Support

The Contractor shall develop, maintain, and review the TAMIS Assessment and Authorization (A&A) package in the Enterprise Mission Assurance Support Service (eMASS) system to maintain the Authorization to Operate (ATO) of the TAMIS system IAW DoD and Army rules, regulations, and standards. The Contractor shall develop, maintain, and update all Cybersecurity documentation required for all TAMIS environments to remain compliant which includes all documentation of the TAMIS system architecture (DoDAF diagrams, Network Diagrams, Hardware/ Software/ Firmware Lists, and other related content).

Per the Offeror’s Technical Approach

T-03-02 Annual RMF Self- Assessment and Continuous Monitoring

The Contractor shall perform an official RMF Self- Assessment annually reporting the status of security controls in eMASS. The contractor shall manage the TAMIS Plan of Action and Milestones (POA&M) in eMASS ensuring mitigation and remediation actions are implemented in a timely manner. Additionally, the Contractor shall conduct continuous risk assessments by applying appropriate federal guidelines to determine risks associated with potential changes to the TAMIS system.

The application of risk management shall include the continuous monitoring and weekly reporting of the TAMIS security posture while in operation.

Per the Offeror’s Technical weekly reporting

T-03-03 STIGs, Scans, and Analysis

The contractor shall assist in designing, analyzing, and assessing network architectures to ensure the network and network devices are of sufficient cybersecurity resiliency to meet the system's operational requirements. The Contractor shall conduct initial and continual assessments to detect Information System (IS) and network vulnerabilities using approved tools, tactics, and techniques to facilitate the risk management process and to ensure compliance with the DoD, Army, and TAMIS network management, configuration management, and

Per the Offeror’s

Approach.

security policies and procedures. All TAMIS systems, networks, and devices shall be assessed periodically, including, but not limited to, scanning for vulnerabilities, poor security practices, noncompliance, backdoor connections, missing patches and unauthorized network connections.

Upon contract award, and annually, the Contractor shall complete and/or update each applicable DoD Security Technical Implementation Guide (STIG) Checklist for the appropriate system components. The Contractor shall perform quarterly Security Content Automation Protocol (SCAP) scans, monthly Assured Compliance Assessment Solution (ACAS) scans, and monthly static and dynamic code scans. The Contractor shall analyze the results of these scans and provide a Scan Analysis Report to the TAMIS Program Manager as part of the monthly report or as necessary to maintain the security posture of TAMIS.

The Contractor shall implement mitigating or remediation actions approved by the Government. The periodicity, approved tools, and process of the security STIGs, scans and analyses is subject to change as DoD, Army, and HQDA requirements evolve.

IAW with DoD, Army, and HQDA policy

T-03-04 Security Management and Software Acceptance

The Contractor shall track all security issues uncovered during the security review and the entire life cycle, whether a requirements, design, implementation, testing, deployment, or operational issue. The risk associated with each security issue will be evaluated, documented, and reported to the Government as soon as possible after discovery. The Contractor will appropriately protect information regarding security issues and associated documentation to help limit the likelihood that vulnerabilities in operational Government software are exposed.

The Government and Contractor shall create a mutually agreed upon remediation roadmap to resolve security issues that are identified. Contractor shall make all commercially feasible efforts to fix all high level issues prior to delivery to Government. The software shall not be considered accepted until the independent review is complete and all security issues have been assigned to a mutually agreed upon remediation roadmap.

After acceptance, if security issues are discovered or reasonably suspected, the Contractor shall assist the Government in performing an investigation to determine the

Per the Offeror’s nature of the issue. The Contractor shall use all commercially reasonable efforts consistent with sound software development practices, taking into account the severity of the risk, to resolve all security issues as quickly as possible.

T-03-05 Information Assurance Vulnerability Management

(IAVM)

The contractor shall ensure secure configuration to include all pertinent patches and fixes by routinely reviewing vendor sites, bulletins, and notifications and proactively updating systems with fixes, patches, definitions, service packs, or implementation of vulnerability mitigation strategies. The Contractor shall ensure applicable security patches are applied in accordance with the Army’s Information Assurance Vulnerability Management (IAVM) program. The Contractor shall document and report weekly on the status of the TAMIS IAVM program including Information Assurance Vulnerability Alerts (IAVAs) that are declined, accepted, and implemented.

Per the Offeror’s Technical Approach

Weekly

T-03-06 Akamai and DISA Global Content Delivery System

(GCDS)

Administration

The Contractor shall provide highly capable personnel with a deep understanding of Army applications deployed in the cloud to administer the TAMIS Akamai and DISA Global Content Delivery System (GCDS) connections, identifying the most appropriate security, caching, and storage strategies for TAMIS commercial internet and NIPRNet traffic optimization. As DoD and Army cybersecurity requirements change, the Contractor shall work with Akamai and GCDS to evolve the TAMIS system to ensure continual compliance.

Per the Offeror’s Technical Approach

T-03-07 Cloud Cybersecurity Service Provider

(CSSP)

Management

The Contractor shall provide highly capable personnel with a deep understanding of Army applications deployed in the cloud to be the primary interface with the CSSP.

The Contractor shall be responsible for properly installing, configuring, and deploying the security tools provided by the CSSP to the TAMIS cloud environment. The Contractor shall be the primary liaison with the CSSP to ensure stable connectivity for cloud hosted systems, perform joint troubleshooting when necessary, respond to security incidents, and continue to evolve the TAMIS system as DoD and Army requirements change.

Per the Offeror’s

T-03-08 Cloud Access Point (CAP)/Internet Access Point

(IAP)

Management

The Contractor shall provide highly capable personnel with a deep understanding of Army applications deployed in the cloud to be the primary interface with the CAP/IAP Management Office. The contractor shall be responsible for working with CAP/IAP technical personnel to ensure stable connectivity for cloud hosted systems, perform joint troubleshooting when necessary, and continue to evolve

Per the Offeror’s the TAMIS system as DoD and Army requirements change.

T-03-09 Cybersecurity Technical Requirements

The contractor shall implement all technical, procedural, and documentation focused security controls IAW DoD and Army rules, regulations, and policies to ensure the confidentiality, integrity, and availability of TAMIS environments. The contractor shall assist in the identification and development of cybersecurity methodologies and engineering efforts utilizing scientific methods in accordance with best practices, policies, and guidance to develop material solutions that will fill capability gaps within the cybersecurity discipline.

The Contractor shall ensure that all TAMIS sensitive data whether at rest or in transit is encrypted using government approved encryption standards. The Contractor shall ensure that the TAMIS system is deployed using a Secure System Architecture in a highly available, scalable configuration in the cloud. The Contractor shall ensure that TAMIS properly identifies and authorizes individual access to the system. The Contractor shall ensure full backups are performed weekly and incremental backups of TAMIS are performed daily.

Per the Offeror’s

2.7 Task 4– Training and User Support Service (Firm Fixed Price)

ID Requirement Performance Criteria

T-04-01 Provide

TAMIS

Training Site

The Contractor shall manage, administer and maintain a separate TAMIS training web site. All technical requirements identified in Task 2 and Task 3 apply to the TAMIS training site.

Per the Offeror’s Technical Approach

T-04-02 User Training

The Contractor shall provide training and user support as required by command ammunition managers and the HQDA Munitions Management Office. The Contractor shall provide: operator training, ammunition manager training, ammunition supply point training and requirements training. The Contractor shall, update maintain and develop training material for the targeted munitions audiences.

The Contractor shall develop and administer regular and frequent training sessions at its facilities and at military facilities. The Contractor will provide facilities (at no additional cost) sufficient to train 20 military/civilians per class. User training shall include the preparation of training materials and the conduct of classes. The Contractor shall use Army Distance Leaning Facilities and DoD collaboration services as much as possible to deliver training across the Army, National Guard and Army Reserve. Training shall be targeted to the user based on the user’s functional position.

All scheduled training and class statistics shall be documented in the monthly Contractor Status Report.

Length of required training sessions varies from one to four days. Classes generally range in size from ten to twenty participants. For each training class, up to two Contractor personnel may be required. Training sessions will be coordinated through DAMO-TRA and with individual training ammunition managers prior to scheduling online using the TAMIS class manager utility. The Contractor shall provide this on-site training at facilities agreed to by the command and the Munitions Management Office.

Travel costs shall not exceed DA approved travel funding contained in the Travel CLIN.

T-04-04

HQDA

Munitions Council Support

The Contractor shall provide administrative and technical support to HQDA Munitions Management Office sponsored conferences, councils and weapon system reviews IAW the TAMIS battle rhythm.

Per TAMIS Battle Rhythm

T-04-05 CONUS Help Desk

The Contractor shall designate and provide a CONUS based multi-Tier Customer Support structure that includes a Tier 0 (self-help), Tier 1 and Tier 2 type support through a Service Desk using the existing internal TAMIS capabilities to manage tickets. The help desk shall be located at the contractor site in the National Capital Region (primary site). The Contractor shall maintain telephonic help desk and munitions support for all users and offer an afterhours contact number for emergency issues. The Contractor’s CONUS Service Desk and all inbound End User contact channels shall be available (min) M-F 10 hrs per day, with the exception of Government holidays.

The Contractor shall keep End Users informed regarding status of their ticket, incident, problem, or Service Request through (1) voice response to phone calls, (2) email responses to email inquiries, (3) web chat responses to web

Per the Offeror’s Technical Approach.

Respond to approx 500 calls/ contacts per month. 90% are typically tier 1. Maintain 0730-1730 hours of support in

CONUS.

chat inquiries, or (4) through the TAMIS self-serve access to status information. The Contractor shall verify closure of Tickets with the affected End User verbally by phone or in writing via email. A maximum of three (3) attempts to reach End Users for confirmation shall be made and must be made during business hours.

The Contractor shall maintain and improve the Tier 0 self-help capability through the TAMIS customer support module. Customer support module shall provide an improved Frequently Asked Questions (FAQs), user guides, Knowledge Documents, and access to TAMIS support tools.