TAMIS_PSOW_Update_(DRAFT).pdf

Performance Statement of Work

Introduction

1.1 Scope

Headquarters, Department of the Army (HQDA), G-3/5/7 Munitions Management Office (DAMO-TRA) requires continued sustainment, software improvements, and munitions management support for its Total Ammunition Management Information System (TAMIS). This performance statement of work (PSOW) requires the offeror to continue to improve the TAMIS design, functionality and interoperability while providing munitions support IAW with the munitions battle rhythm. This PSOW requires a broad range of information technology skills coupled with a deep understanding of United States Army munitions management operations and familiarity with United States Marine Corps munitions management.

1.2 Background

TAMIS is a non-Program Executive Officer (PEO) managed information technology acquisition project sponsored by Department of the Army G-3/5/7, Munitions Management Office. TAMIS has a long history of updates and improvements resulting from changes in munitions governance, system consolidation and improved technology.

Over the last five years Army G-3/5/7, Munitions Management Office together with the Army G- 4, Office of the Deputy Chief of Staff for Logistics, and the US Marine Corps has streamlined munitions work-flow, improved relationships, and generated better munitions information by consolidating data and reforming munitions management with TAMIS.

As the Munitions Management Office enters the next phase, the project will continue its evolutionary acquisition approach and employment of agile management, development and operations (DevOps) practices to support the annual munitions battle rhythm and system engineering efforts. Evolutionary meaning fielding an operational and supportable system with initial capability in as short a time as possible, with the explicit intent of delivering improved or updated capability in the future.

The agile management and DevOps approaches minimize risk by developing software in iterations that typically last three to twelve weeks. Each iteration includes requirements analysis, design, coding, testing, and basic documentation—all the tasks necessary to release a min-increment of new or improved functionality. After each increment, TAMIS project management reevaluates and baselines priorities. The agile method is aligned with DoD 5000 and appropriate DoD Instructions. As such, it emphasizes continuous communication, with secure working software as the primary performance measure. The offeror shall describe how its agile and DevOps practices will achieve Army objectives contained in this PSOW.

1.3 Objectives

The offeror shall sustain and protect the TAMIS enterprise while applying expert knowledge of Army and Marine Corps munitions practices to make improvements in accordance with this

DRAFT

PSOW. The HQDA G-3/5/7 Munitions Office overarching objectives are listed below and detailed in the Detailed Requirements section.

• Maintain TAMIS in the cloud ensuring reliability, scalability, security, and affordability.

• Update and maintain system engineering, cybersecurity accreditation, and user documentation.

• Update and maintain a TAMIS systems architecture that applies DoDAF standards and meets Army Enterprise Architecture and Risk Management Framework (RMF) requirements.

• Independently verify that all new TAMIS code is free of known defects using automated mechanisms before implementation.

• Maintain and improve the TAMIS requirements and prioritization process so that requirements can be rapidly determined and efficiently disseminated as force structure, training strategies, programs of instructions, and munitions tests change.

• Applying a deep understanding of munitions management provide on-site OCONUS munitions assistance; TAMIS help desk support and support prescribed in the munitions battle rhythm.

• Applying a deep understanding of munitions management, develop, optimize and maintain forecasting by training event, test event and aircraft CAD/PAD (Cartridge Actuated Device / Propellant Actuated Device).

• Improve and enhance the processing, handling and storage of electronic documents and records. This includes: requests for munitions; records of expenditure; and other munitions documents required to improve munitions management and the end user experience.

• Develop, maintain and improve system interfaces and data exchanges with existing and emerging military information systems requiring munitions data.

• Implement and maintain an up-to-date, ad-hoc business intelligence tool that more effectively enables munitions analytics on the desktop and mobile devices.

• Applying a deep understanding of munitions management maintain, update and improve the on-line handling, management and publishing of Department of the Army Pamphlet 350-38, Standards In Training Commission (STRAC).

• Maintain and update the TAMIS cross-platform, mobile strategy and deploy a TAMIS mobile capability that enables requesting, reporting and managing munitions on any capable mobile device. This may include building and/or deploying a TAMIS app or apps to the Army, DISA or other approved DoD app store.

• Additional products and services required in support of munitions management are stated below. Any acquisition of IT shall be coordinated in advance with the Government and shall be made in accordance with all IT related laws and regulations applicable to Army purchases (for example, reference AR 25-1, RMF Supply Chain Security Guidance, and FAR and Supplements part 39).

COTS licensed software products, maintenance and support services Application hosting, cloud services and/or software as a service (SaaS) services Networking, cabling and other wiring and telecommunications services

Temporary facilities to conduct munitions conferences, training and meetings

1.4 Changing Word Events (Task 2)

While overarching sustainment and enhancement objectives are identified above and detailed in paragraph 2, Army warfighting functions drive TAMIS enhancements. As a result, certain requirements may not always be known. As the military becomes a more agile force, changes may impact munitions management practices whereby rapid TAMIS modifications are necessary.

2. Requirements

2.1 Summary

The scope of services under the TAMIS PSOW covers the full Systems Development Life Cycle Management (SDLCM) process and includes munitions governance, enterprise architecture, security, training and performance reporting.

The Contractor will execute Operations and Maintenance (O&M) support by conducting routine system administration, database administration and tuning functions. Routine maintenance includes regular backups, software upgrades, hardware maintenance and upgrades, and diagnostics as required to maintain the integrity of the system. The Contractor will maintain a prioritized list of engineering changes and implement engineering changes as directed by the Government configuration control process. The Contractor will conduct sufficient regression testing to ensure engineered changes will successfully function within the TAMIS production environment. The Contractor will only implement TAMIS code changes that have been determined free of vulnerabilities by the government furnished HP Fortify static code analyzer or alternate government approved device, service or software.

The Contractor shall support the TAMIS web-based system and its 7000+ users that perform between 400K and one-million transactions each month. For the purposes of this PSOW, the term “support” includes, but is not limited to, those activities associated with:

o Protecting and defending the existing system from cyber threats and maintain certification, accreditation compliance and Authorization to Operate (ATO).

o Providing munitions support that sustains and enhances Army readiness.

o Training and helping end users manage munitions and interact with the system to extract meaningful information.

o Managing changes to the program baseline through continuous use of appropriate configuration management and software quality assurance practices.

o Enhancing system responsiveness through tuning and optimization measures.

o Designing, developing, testing, and delivery of system enhancements free of security defects.

o Leveraging new technologies to enhance performance and functionality.

2.2 Army Munitions Battle Rhythm

The Contractor shall administer TAMIS based upon the Battle Rhythm in the graphic and table below.

While the Battle Rhythm may change from time-to-time, it illustrates the rhythm of significant management activities in the HQDA G3/5/7 Munitions Office and also identifies key TAMIS functions.

Specific TAMIS tasks are documented in the Detailed Requirements section.

Munitions Battle Rhythm

Item Frequency/Date Monthly Progress Report to HQDA—Contracting Officer Technical Representative (COTR). See T-01-01. Monthly

Receive/Obtain Force Structure update from Army Organization Server (AOS) or FMSWeb; align with Army Stationing and Installation Plan (ASIP) and stationing and manpower allocation system (SAMAS) as required. Load in TAMIS.

JUN/NOV and as directed

Build TAMIS Hierarchy

JUL

Load Munitions Requirements

AUG

TAMIS Advisory Group In-Progress Review (IPR)—Prepare TAMIS update Up to twice annually

Publish following year DRAFT DA PAM 350-38 in TAMIS July 2014 release FY 2016; July 2015 release FY 2017; July 2016 release FY 2018…….and so on. NLT 1 JUL

Army Munitions Working Group Support (AMRWG)—STRAC weapon systems and strategies reviews and adjustments. Capture and organize approved strategy changes. Update TAMIS as required.

SEP & MAR

Army Munitions Council of Colonels Support—STRAC weapons systems and strategies reviews and adjustments. Capture and organize approved strategy changes. Update TAMIS as required.

OCT & MAR

TAMIS Advisory Group (TAG) OCT & MAR

Requirements Module Locked OCT & APR

Total Army Ammunition Authorization and Allocation Conference (TA4C) Support; distribute authorizations to each command for next FY. APR & AUG

Publish current FY DA PAM 350-38 in TAMIS NLT 1 OCT

Army Munitions Support to GOSC-- STRAC weapons systems and strategies reviews and adjustments (as required). NOV & MAY

Process MTOE/TDA/POI changes and load in TAMIS. As required WEB Ammo Authorization Update to ASALT. NOV Year-end Close-out and crossover activities; Report to ASA FMC

OSMIS. OCT

Conduct TAMIS training Continuously

2.3 Detailed Requirements

The Contractor shall provide continued support, conduct maintenance and implement improvements to the system as defined in the four specific tasks below. Any acquisition of hardware or software shall be made in accordance with Army Regulations including AFARS 5139.101(c).

2.4 Task 1 – Project Management and Cost Control (Firm Fixed Price) ID Requirement Performance Criteria T-01-01 Delivery Order Management and Program Management

The Contractor shall provide a delivery order management plan that describes the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout this PSOW period of performance.

The Contractor shall report the status of all work performed under this PSOW, including, but not limited to all work orders, software and hardware purchases and license payments. The Contractor shall provide a Contractor's Progress, Status and

20 Days after award.

Contractor's Progress, Status and Management Report delivered 15th of each month

Management Report (CDRL T-01-01) on a monthly basis to the TAMIS Program Manager. The Contractor shall include sections containing TAMIS system performance details; the number of personnel trained by location, help desk statistics, current or anticipated problems and recommended solutions.

T-01-02 Master Work Breakdown Structure

(WBS)

The Contractor shall develop and maintain a Master Work Breakdown Schedule (WBS) consistent with their Proposal. The Contractor shall also develop and maintain a Master Project Schedule that shall integrate all tasks into a master plan and shall align with the Contractors Master WBS. The WBS should be traceable to each identified task in the Team Foundation Server.

Updated when requested and during scheduled project status updates.

T-01-03 Master Project Schedule

The Contractor shall assume the management of the existing Master Project Schedule. The Contractor Master Project Schedule shall document the tasks, start dates, end dates, durations, predecessors, successors, and resources required to execute the program of work.

Master Project Schedule shall be updated weekly and be included in the monthly progress report.

T-01-04 Government Furnished Equipment

(GFE)

The Contractor shall identify, label, and update all GFE to create an inventory of system components.

This shall include the recording of information about GFE, including hardware and software versions, documentation, and other unique identifiers. No GFE shall be modified, replaced or removed without the appropriate controlling documentation. The Contractor shall monitor all GFE, capturing all current and historical lifecycle data, including tracking of GFE status (ordered, received, under test, live, under repair, withdrawn or for disposal.)

Tracking information shall be update weekly and be included in the monthly progress report.

2.5 Task 2—Engineering and Sustainment (Time and Materials)

ID Requirement Performance Criteria T-02-01 Document Management

The Contractor shall prepare and maintain all system documentation describing software and hardware configuration management, software development process, software testing process, system interfaces, user guides, training materials, computer based training videos, and any other documentation as required by DoD and Army guidance.

Per the Offeror’s Technical Approach and included in the C&A package.

Per CJSI 3170 and PSOW

T-02-02 Secure Software Design, Development and Testing

The Contractor shall apply an agile and DevOps approach to design, development, and testing of TAMIS to ensure the rapid delivery of high quality software is aligned with customer needs. Emphasis shall be on the demonstration of clear and definable improvements in the confidentiality, integrity, availability, supportability, reliability, maintainability, and performance of the item and system in the cloud. Design concepts shall include provisions for continuous technological improvement utilizing the latest cloud technologies that maximize cross-platform opportunities available from emerging technological advances in the commercial market place. Any commercial products and processes proposed for implementation shall be thoroughly evaluated using an Analysis of Alternatives (AoA) to provide the Government with recommendations and justification for which commercial solutions are appropriate to implement.

The contractor shall support standard development languages including XML, HTML5, CSS3 and JavaScript, and the VisualStudio IDE. The contractor shall also support mobile frameworks for iOS, Android and Windows 10 Mobile platforms in order to enable key TAMIS functions such as requesting munitions, viewing munitions status and calculating requirements in native code-based apps. Enable browser based report viewing on mobile devices. DoD policy and technology will guide TAMIS mobile development and implementation.

The Contractor software development procedures will include at a minimum, static code and dynamic or binary application analysis. The Contractor shall have their software reviewed for security flaws, in binary format (i.e. compiled or byte code format), by an independent organization that

Approach

Achieve total contract cost reduction (ODCs and labor) IAW technical approach DRAFT specializes in application security, at their expense, prior to delivery to the Government.

The existing independent review is conducted via Software as a Service (SaaS) from Veracode. At a minimum, the review shall cover common software vulnerabilities. The review shall include a combination of static analysis of the binary code and dynamic web application vulnerability scanning.

Additionally, the review may include manual penetration testing. All development will utilize the government furnished HP Fortify static code analyzer (or other government approved product or service) prior to releasing updates into production. The Contractor shall certify all delivered code is free of known defects prior to implementation.

The Contractor shall conduct a software risk analysis after each major TAMIS enhancement. The analysis shall produce a vulnerability rating similar to the NIST recommended CVSS (Common Vulnerability Scoring System). All TAMIS improvements, updates, and modifications shall be aligned with the DoD Security Technical Implementation Guide (STIGs) for the appropriate delivered component.

T-02-03 Database and Application Administration

The Contractor shall perform tasks relating to the setup, maintenance, and routine administration of TAMIS SQL database definitions and data for all TAMIS environments. These tasks shall include deploying the TAMIS database servers in a highly available and scalable configuration in the cloud, setup and maintenance of the TAMIS database management system, user accounts, table spaces, indices, triggers, views, and stored procedures. The Contractor shall automate routine maintenance and operational activities in executable scripts, which shall be adequately documented and tested. The database shall be appropriately.

The Contractor shall document the relational schema in terms of tables, columns, relationships, primary and foreign keys, indices, and table constraints. normalized for the intended purpose of the data and contain complete audit trail information.

Per the Offeror’s Technical Approach and IAW the appropriate DISA STIG

T-02-04 System Integration and Testing

The Contractor shall integrate and interface new equipment and prepare required documents in accordance with applicable government instructions and industry best practices. The Contractor shall prepare integration and test plans for database, system/network, and web server hardware and software upgrades that may be required during the contract period. Plans shall document all requirements for integration and testing, support services, instrumentation, and logistics support if required.

T-02-05 Application Maintenance and Sustainment

The contractor shall continue to utilize the .NET framework and continue using the Microsoft Team Foundation Server (TFS) and 11 MSDN GFE licenses. The Contractor shall update, maintain and support all TAMIS web sites. This shall include all HTML and JavaScript source documents, scripts, Java code, data validation scripts, and any other

Per the Offeror’s Technical Approach

Per DoDI 8510.01 and AR 25-2 components that may become part of the overall TAMIS web-based application.

T-02-06 Hardware/Software Development

The Contractor shall configure and deploy new hardware and software as older hardware is phased out for all TAMIS environments.

The Contractor shall conduct appropriate testing to ensure the new hardware and/or software is tested, operational and secured.

The Contractor shall document the software test description, plan and results. The Contractor shall ensure that new hardware and/or software is installed with minimal disruption to the end user. The Contractor shall develop implementation procedures that document and provides details of the deployment process of new hardware and/or software to all TAMIS environments.

T-02-07 Change Control and Configuration

The Contractor shall develop and maintain a configuration control/management plan that continually regulates the change control processes. At a minimum this shall include maintaining a list of all defects and proposed changes reported by the user community. The Contractor shall annotate the disposition and conduct a Security Impact Analysis of each defect or proposed change reported by the user community. The Contractor shall estimate the time associated with the repair of the defect or implementation of the proposed change. The Contractor shall identify any impacts the defect and its repair may have on other elements of the system and report on the status of the baseline and scheduled changes to the baseline. The Contractor shall provide an updated Configuration Status Accounting Information Report to the TAMIS Program Manager as part of the monthly report or as necessary to maintain sufficient configuration control of TAMIS.

Per the Offeror’s Technical Approach and included in the Contractor's Progress

Report

T-02-08 Release Management

The Contractor shall refine, document and maintain a testing and release management process that ensures the most efficient use of resources with the least impact on the customer. The release management process must include publishing updates, Per the Offeror’s Technical Approach and included in the Contractor's Progress

Report modifications, and bug fixes to a cloud environment. Updates, modifications, and bug fixes are defined below:

• UPDATE: A change to an existing function such as DA making a change in procedure that was already functioning.

• MODIFICATION: The addition of new functionality, a process or procedure or view not previously utilized.

• BUG FIX: A correction to a function not working correctly or displaying something incorrectly on the screen.

The Contractor shall maintain the external TAMIS test site http://UAT.tamis.org where TAMIS users and designated testers can view and comment on upcoming TAMIS modifications prior to implementation.

T-02-09 System Interfaces

The Contractor shall establish, document, and maintain interfaces with new and evolving information systems to include the Standard Army Ammunition System-Modernized (SAAS-MOD), Global Combat Support System (GCSS-A), Logistics Modernization Program (LMP), supply and asset visibility systems, research and development systems, procurement, training and requirements systems and the Marine Corps Ordnance System as well as other Services’ systems as requirements emerge.

The Contractor shall maintain, support and modify as required TAMIS web services library where designated system developers may review, select and test TAMIS (WSDL files) Web Services Description Language.

T-02-10 Munitions Reporting

The Contractor shall apply its deep understanding of munitions management to build and administer useful reports. In order for munitions queries to trigger decisions, they must be presented in an intuitive way --http://uat.tamis.org/ in graphical forms, grids, scorecards or a combination. Reports must be descriptive, visually appealing and accessible to discrete sections of the TAMIS hierarchy. Continue development and tuning of the TAMIS statistical reporting capability and develop an enhanced ad-hoc user report capability.

Reports must be configured and viewable for mobile users using either personally owned devices or Government provided devices.

T-02-11 System Enhancements

The Contractor shall maintain the existing TAMIS engineering model built around Microsoft Team Foundation Server and its various components. The Contractor shall review and follow the existing Master Project Schedule and recommend adjustments, where appropriate, after contract award. Several enhancements, modifications and updates are currently programmed. Sample enhancement listed below:

Develop a cross-platform TAMIS mobile strategy, deploy and manage a TAMIS mobile capability that enables requesting, reporting and managing munitions on any capable mobile device while maintaining mobile authentication and identity validation. This may include the building and deploying a TAMIS app or apps to an Army, DISA or other approved DoD apps store.

The contractor shall establish a flexible life-cycle support architecture for TAMIS mobile that includes a concept of operations and covers the entire life cycle of the apps.

The contractor shall provide an advanced natural language search/query capability that includes the ability recall saved searches, to search by unit, document number, problem/incident report, or key word.

Maintain, update and publish DA PAM 350- 38 with Government provided updates in TAMIS annually.

Develop, implement and manage a munitions requirements Program Objective Memorandum (POM) capability in TAMIS so that future year requirements are calculated, managed and governed using the existing TAMIS interface

The contractor shall implement and maintain an up-to-date, ad-hoc business intelligence capability that more effectively enables munitions analytics on the desktop and mobile devices.

Improving munitions management over the period of performance requires an agile management approach that focuses on continuous process improvement as well as improving system performance. The examples cited above and the existing project schedule is not all-inclusive

Per World Wide Web Consortium http://www.w3.org/standards Accomplished during the base year

Apply expert knowledge to improve system performance and enhance munitions management functions.

2.6 Cybersecurity Support (Time and Materials)

As cybersecurity is a major focus area for all of DoD, the contractor must have demonstrated experience performing all of the tasks under Task 3 – Cybersecurity Support for cloud environments of similar size and complexity. The contractor shall perform the following tasks for all TAMIS environments to maintain the system’s confidentiality, integrity, and availability. All security requirements cover all aspects of the software delivered, including third party components, services, and code libraries.

ID Requirement Performance Criteria

T-03-01 Cybersecurity Documentation and eMASS Support

The Contractor shall develop, maintain, and review the TAMIS Assessment and Authorization (A&A) package in the Enterprise Mission Assurance Support Service (eMASS) system to maintain the Authorization to Operate (ATO) of the TAMIS system IAW DoD and Army rules, regulations, and standards. The Contractor shall develop, maintain, and update all Cybersecurity documentation required for all TAMIS environments to remain compliant which includes all documentation of the TAMIS system architecture (DoDAF diagrams, Network Diagrams, Hardware/ Software/ Firmware Lists, and other related content).

Per the Offeror’s Technical

T-03-02 Annual RMF Self- Assessment and Continuous Monitoring

The Contractor shall perform an official RMF Self-Assessment annually reporting the status of security controls in eMASS.

The contractor shall manage the TAMIS Plan of Action and Milestones (POA&M) in eMASS ensuring mitigation and remediation actions are implemented in a timely manner.

Additionally, the Contractor shall conduct continuous risk assessments by applying appropriate federal guidelines to determine risks associated with potential changes to the TAMIS system. The application of risk management shall include the continuous monitoring and weekly reporting of the TAMIS security posture while in operation.

Per the Offeror’s Technical weekly reporting

T-03-03 STIGs, Scans, and Analysis

The contractor shall assist in designing, analyzing, and assessing network architectures to ensure the network and network devices are of sufficient cybersecurity resiliency to meet the system's operational requirements. The Contractor shall conduct initial and continual assessments to detect Information System (IS) and network vulnerabilities using approved tools, tactics, and techniques to facilitate the risk management process and to ensure compliance with the DoD, Army, and TAMIS network management, configuration management, and security policies and procedures. All TAMIS systems, networks, and devices shall be assessed periodically, including, but not limited to, scanning for vulnerabilities, poor security practices, noncompliance, backdoor connections, missing patches and unauthorized network connections.

Upon contract award, and annually, the Contractor shall complete and/or update each applicable DoD Security Technical Implementation Guide (STIG) Checklist for the appropriate system components. The Contractor shall perform quarterly Security Content Automation Protocol (SCAP) scans, monthly Assured Compliance Assessment Solution (ACAS) scans, and monthly static and dynamic code scans.

The Contractor shall analyze the results of these scans and provide a Scan Analysis Report to the TAMIS Program Manager as part of the monthly report or as necessary to maintain the security posture of TAMIS. The Contractor shall implement mitigating or remediation actions approved by the Government. The periodicity, approved tools, and process of the security STIGs, scans and analyses is subject to change as DoD, Army, and HQDA requirements evolve.

Per the Offeror’s

Approach.

IAW with DoD, Army, and HQDA policy

T-03-04 Security Management

The Contractor shall track all security issues uncovered during the security review and the entire life cycle, whether a requirements, design, implementation, testing, deployment, or operational issue.

The risk associated with each security issue will be evaluated, Per the Offeror’s Technical and Software Acceptance documented, and reported to the Government as soon as possible after discovery. The Contractor will appropriately protect information regarding security issues and associated documentation to help limit the likelihood that vulnerabilities in operational Government software are exposed.

The Government and Contractor shall create a mutually agreed upon remediation roadmap to resolve security issues that are identified. Contractor shall make all commercially feasible efforts to fix all high level issues prior to delivery to Government. The software shall not be considered accepted until the independent review is complete and all security issues have been assigned to a mutually agreed upon remediation roadmap.

After acceptance, if security issues are discovered or reasonably suspected, the Contractor shall assist the Government in performing an investigation to determine the nature of the issue.

The Contractor shall use all commercially reasonable efforts consistent with sound software development practices, taking into account the severity of the risk, to resolve all security issues as quickly as possible.

T-03-05 Information Assurance Vulnerability Management

(IAVM)

The contractor shall ensure secure configuration to include all pertinent patches and fixes by routinely reviewing vendor sites, bulletins, and notifications and proactively updating systems with fixes, patches, definitions, service packs, or implementation of vulnerability mitigation strategies. The Contractor shall ensure applicable security patches are applied in accordance with the Army’s Information Assurance Vulnerability Management (IAVM) program. The Contractor shall document and report weekly on the status of the TAMIS IAVM program including Information Assurance Vulnerability Alerts (IAVAs) that are declined, accepted, and implemented.

Per the Offeror’s Technical Approach

Weekly

T-03-06 Akamai and DISA Global Content Delivery System

(GCDS)

Administration

The Contractor shall provide highly capable personnel with a deep understanding of Army applications deployed in the cloud to administer the TAMIS Akamai and DISA Global Content Delivery System (GCDS) connections, identifying the most appropriate security, caching, and storage strategies for TAMIS commercial internet and NIPRNet traffic optimization.

As DoD and Army cybersecurity requirements change, the Contractor shall work with Akamai and GCDS to evolve the TAMIS system to ensure continual compliance.

Per the Offeror’s Technical Approach

T-03-07 Cloud Cybersecurity

The Contractor shall provide highly capable personnel with a deep understanding of Army applications deployed in the cloud to be the primary interface with the CSSP. The

Per the

Service Provider

(CSSP)

Management

Contractor shall be responsible for properly installing, configuring, and deploying the security tools provided by the CSSP to the TAMIS cloud environment. The Contractor shall be the primary liaison with the CSSP to ensure stable connectivity for cloud hosted systems, perform joint troubleshooting when necessary, respond to security incidents, and continue to evolve the TAMIS system as DoD and Army requirements change.

T-03-08 Cloud Access Point (CAP)/Internet Access Point

(IAP)

Management

The Contractor shall provide highly capable personnel with a deep understanding of Army applications deployed in the cloud to be the primary interface with the CAP/IAP Management Office. The contractor shall be responsible for working with CAP/IAP technical personnel to ensure stable connectivity for cloud hosted systems, perform joint troubleshooting when necessary, and continue to evolve the TAMIS system as DoD and Army requirements change.

Technical Approach

T-03-09 Cybersecurity Technical Requirements

The contractor shall implement all technical, procedural, and documentation focused security controls IAW DoD and Army rules, regulations, and policies to ensure the confidentiality, integrity, and availability of TAMIS environments. The contractor shall assist in the identification and development of cybersecurity methodologies and engineering efforts utilizing scientific methods in accordance with best practices, policies, and guidance to develop material solutions that will fill capability gaps within the cybersecurity discipline.

The Contractor shall ensure that all TAMIS sensitive data whether at rest or in transit is encrypted using government approved encryption standards. The Contractor shall ensure that the TAMIS system is deployed using a Secure System Architecture in a highly available, scalable configuration in the cloud. The Contractor shall ensure that TAMIS properly identifies and authorizes individual access to the system. The Contractor shall ensure full backups are performed weekly and incremental backups of TAMIS are performed daily.

Per the Offeror’s

2.7 Task 4– Training and User Support Service (Firm Fixed Price)

ID Requirement Performance Criteria

T-04-01 Provide

TAMIS

Training Site

The Contractor shall manage, administer and maintain a separate TAMIS training web site. All technical requirements identified in Task 2 and Task 3 apply to the TAMIS training site.

Per the Offeror’s Technical Approach

T-04-02 User Training

The Contractor shall provide training and user support as required by command ammunition managers and the HQDA Munitions Management Office. The Contractor shall provide:

operator training, ammunition manager training, ammunition supply point training and requirements training. The Contractor shall, update maintain and develop training material for the targeted munitions audiences.

The Contractor shall develop and administer regular and frequent training sessions at its facilities and at military facilities. The Contractor will provide facilities (at no additional cost) sufficient to train 20 military/civilians per class. User training shall include the preparation of training materials and the conduct of classes. The Contractor shall use Army Distance Leaning Facilities and DoD collaboration services as much as possible to deliver training across the Army, National Guard and Army Reserve. Training shall be targeted to the user based on the user’s functional position.

All scheduled training and class statistics shall be documented in the monthly Contractor Status Report. Length of required training sessions varies from one to four days. Classes generally range in size from ten to twenty participants. For each training class, up to two Contractor personnel may be required.

Training sessions will be coordinated through DAMO-TRA and with individual training ammunition managers prior to scheduling online using the TAMIS class manager utility. The Contractor shall provide this on-site training at facilities agreed to by the command and the Munitions Management Office.

Travel costs shall not exceed DA approved travel funding contained in the Travel CLIN.

T-04-04

HQDA

Munitions Council Support

The Contractor shall provide administrative and technical support to HQDA Munitions Management Office sponsored conferences, councils and weapon system reviews IAW the TAMIS battle rhythm.

Per TAMIS Battle Rhythm

T-04-05 CONUS Help Desk

The Contractor shall designate and provide a CONUS based multi-Tier Customer Support structure that includes a Tier 0 (self-help), Tier 1 and Tier 2 type support through a Service Desk using the existing internal TAMIS capabilities to manage tickets. The help desk shall be located at the contractor site in the National Capital Region (primary site). The Contractor shall maintain telephonic help desk and munitions support for all users and offer an afterhours contact number for emergency issues. The Contractor’s CONUS Service Desk and all inbound End User contact channels shall be available (min) M-F 10 hrs per day, with the exception of Government holidays.

The Contractor shall keep End Users informed regarding status of their ticket, incident, problem, or Service Request through

(1) voice response to phone calls, (2) email responses to email inquiries, (3) web chat responses to web chat inquiries, or (4) through the TAMIS self-serve access to status information. The Contractor shall verify closure of Tickets with the affected End User verbally by phone or in writing via email. A maximum of three (3) attempts to reach End Users for confirmation shall be made and must be made during business hours.

The Contractor shall maintain and improve the Tier 0 self-help capability through the TAMIS customer support module.

Customer support module shall provide an improved Frequently Asked Questions (FAQs), user guides, Knowledge Documents, and access to TAMIS support tools. Tier 0 requires no direct contact between an End User and a Customer Service Representative.

The Contractor shall designate and organize a Tier 1, first level problem assistance and resolution delivered via telephone, e‐ mail, web chat, or other online communication. The Contractor shall provide Help Desk support to respond to TAMIS application issues, provides training and user instructions. The Contractor shall attempt to resolve incidents and munitions inquiries on the first call, seeking to achieve an 80% first contact resolution rate for the first 6 months and 85% First Contact Resolution for months 7 and beyond. Activities include: how to perform munitions functions in TAMIS, providing configuration assistance for new users, password assistance, user rights assistance, recording discrepancies and problems with munitions authorizations, troubleshooting minor issues, responding to forecasts problems, electronic requests issues, and problems with eSTRAC requirements calculations.

Technical Approach.

Respond to approx 500 calls/ contacts per month. 90% are typically tier 1. Maintain 0730-1730 hours of support in

CONUS.

The Contractor shall designate and organize a Tier 2, second level non‐dispatched advanced problem assistance and resolution for incidents that cannot be resolved quickly and efficiently by Tier 1 delivered via telephone, e‐mail, web chat, or other online communication.

T-04-06

OCONUS

Support

The Contractor shall provide TAMIS support via Help Desk and at the locations below. Additional locations may be added.

The Contractor will maintain telephonic help desk and munitions support for all users and offer an afterhours contact number for emergency issues.

The Contractor shall apply its deep understanding of munitions management at OCONUS US Army facilities. Site staffing and hours of operation and support duration are subject to sudden change based on mission requirements. TAMIS support shall be provided through e-mail, phone support, deskside or at any other agreed upon location. Phone and on-site support shall be extended during deployments or contingency operations to meet mission requirements. In addition to providing munitions expertise, on-site OCONUS support respond to Tier 1 TAMIS issues.

Additional locations may be added. Site staffing and hours of operation and support duration are subject to sudden change based on mission requirements. TAMIS support shall be provided through e-mail, phone support, deskside or at any other agreed upon location. CONUS email questions shall be acknowledged within 6 hours of submission, excluding weekends. CONUS phone support shall be available during normal business hours. Phone and on-site support shall be extended during deployments or contingency operations to meet mission requirements. In addition to providing munitions expertise, on-site OCONUS support respond to Tier 1 TAMIS issues. Current support requirements are listed below:

• Korea (one munitions functional expert)

• Kuwait (one munitions functional expert)

• Afghanistan (one munitions functional expert, base year only)

• Additional sites or a change in an existing site or duration may be needed to meet mission requirements.

Technical Approach. .

OCONUS

hours of operation and location are governed by supported command.

T-04-06 The Contractor shall designate and provide a CONUS based multi-Tier Customer Support structure that includes a Tier 0 (self help), Tier 1 and Tier 2 type support through a Service Desk using the existing internal TAMIS capabilities to manage tickets.

The Contractor’s CONUS Service Desk and all inbound End User contact channels shall be available (min) M-F 10 hrs per day, with the exception of Government holidays.

Tier 2 support is only provided from Contractor’s primary facility in NCR. On-site OCONUS munitions experts provide Tier 1 direct support to specific units/command and refer unresolved TAMIS issues to the CONUS help desk.

Per the Offeror’s Technical Approach

T-04-07 The Contractor shall maintain and improve the Tier 0 self-help capability through the TAMIS customer support module.

Customer support module shall provide an improved Frequently Asked Questions (FAQs), user guides, Knowledge Documents, and access to TAMIS support tools. Tier 0 requires no direct contact between an End User and a Customer Service Representative.

Per the Offeror’s Technical Approach

T-04-08 The Contractor shall designate and organize a Tier 1, first level problem assistance and resolution delivered via telephone, e‐ mail, web chat, or other online communication.

The Contractor shall attempt to resolve incidents and munitions inquiries on the first call, seeking to achieve an 80% first contact resolution rate for the first 6 months and 85% First Contact Resolution for months 7 and beyond.

Per the Offeror’s Technical Approach

80% First Contact Resolution for the first 6 months and 85% First Contact Resolution for months 7 and beyond

T-04-09 The Contractor shall designate and organize a Tier 2, second level non‐dispatched advanced problem assistance and resolution for incidents that cannot be resolved quickly and efficiently by Tier 1 delivered via telephone, e‐mail, web chat, or other online communication.

Per the Offeror’s Technical

T-04-10 The Contractor shall address all End User incidents, inquiries, and service requests including, but not limited to, troubleshooting use of TAMIS End User incidents and problems, responding to “how-to” questions, explanation of features and functions, authentication and access, account set-up/modify/delete, password reset, and general technical assistance.

Per the Offeror’s Technical Approach

T-04-11 The Contractor shall keep End Users informed regarding status of their ticket, incident, problem, or Service Request through

(1) voice response to phone calls, (2) email responses to email inquiries, (3) web chat responses to web chat inquiries, or (4) through the TAMIS self-serve access to status information.

Per the Offeror’s Technical Approach

T-04-12 The Contractor shall verify closure of Tickets with the affected End User verbally by phone or in writing via email.

A maximum of three (3) attempts to reach End Users for confirmation shall be made and must be made during business hours.

T-04-12 Ammunition Forecasting and Requirements Calculations Support

The Contractor shall apply its deep understanding of munitions management to compute STRAC and Combat Load requirements for TAMIS. The contractor shall support HQDA and CASCOM with Combat Load requirements for all the SRCs provided in FMSWeb OTOE (TOE) data. The SRC/TOE/OTOE data are templates for Army UICs, used to create MTOE documents.

Per the Offeror’s

Support in, Korea, Kuwait and any other OCONUS location is subject to cost sharing with each command. Should the command discontinue support, it will be terminated upon the conclusion of the designated term unless circumstances merit immediate termination.

Housing allowance is provided under this contract in Korea. Housing and local transportation is provided under this contract in Kuwait. Housing may or may not be provided in new locations.

Agreements are subject to change but generally follow U.S. State Department guidelines.

3. Administrative

3.1 Travel

The primary Contractor site must be in the National Capital Region, not more than 40 miles from the Pentagon. Additional places of performance include Korea, Afghanistan, and Kuwait, where the Contractor will be provided a site to work by the government. The Contractor may be required to travel into potentially hostile areas to conduct mission support. Sites may be added, deleted or changed based on mission requirements.

The Contractor shall perform periodic travel between various worldwide sites to conduct TAMIS training and to participate in planning conferences and project reviews. Willingness to travel to hostile sites may be required in order to conduct training or provide support. Travel outside the local area shall not be scheduled without prior approval from the TAMIS COR.

Reimbursement for travel is in accordance with the Federal Travel Regulations (FTR). The not-to-exceed amounts listed are the government’s maximum obligation and no travel shall be undertaken which would cause the total travel costs to exceed these amounts. The government may authorize amounts greater than the FTR when government rates cannot be obtained.

3.2 Antiterrorism and Security Operations

All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR within 10 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://atlevel1.dtic.mil/at.

All contractor employees, to include subcontractor employees shall complete OPSEC training and IT certification within 30 calendar days after contract start date. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR within 10 calendar days after completion of training by all employees and subcontractor personnel. Training is available at the following website: https://atc.us.army.mil/iastar/index.php

3.3 Access and General Protection/Security Policy and Procedures.

Facility clearance is required at the time of contract award.

Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Contractors shall implement adequate security measures and report cyber incidents involving controlled technical information. Adequate security is defined as “protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.” Controlled technical information includes “technical data, computer software, and any other technical information covered by DOD Directive 5230.24

DRAFT

https://atlevel1.dtic.mil/at https://atc.us.army.mil/iastar/index.php

4. Personnel Requirements, Skills and Qualifications All personnel in designated positions shall be certified IAW the DoD Cyber Workforce Management Program (DoDD 8140.01, Cyberspace Workforce Management and DoD 8570.01-M, Information Assurance Workforce Improvement Program). All personnel must have the appropriate baseline security certification and Computing Environment (CE) certification at time of proposal submission.

4.1 Key Personnel

The Government requires Contractor‐supplied personnel to be qualified, and where appropriate, certified for the position and role for which they are proposed. The Government requires nine (9) specific Key Personnel be assigned and named in the Offeror’s proposal. The Key Personnel are essential to the work performed. Excepting situations where the Key Person is no longer employed by the Contractor, or in case of a catastrophic event (e.g., illness, accident, or death,) the Contractor shall not substitute or divert Key Personnel without written consent of the Contracting Officer’s Representative (COR). In the event that a change in Key Personnel is caused by an individual’s sudden illness, death, or termination of employment, the Contractor shall promptly notify the COR and provide the information required.

Diversion of key personnel after contract award for any reason other than…