Attachment 1 - IPPS-A Army Military Payroll PWS - DRAFT - 27 OCT 2023.pdf

CUI

Integrated Personnel and Pay System – Army

(IPPS-A)

Army Military Payroll

Performance Work Statement (PWS)

DRAFT

W91CRB-24-R-0003

October 27, 2023

Prepared by:

IPPS-A Product Manager (PdM) Future Capabilities Office

IPPS-A AMP PWS - DRAFT CUI

October 27, 2023 ii

THIS PAGE INTENTIONALLY LEFT BLANK 14

October 27, 2023 iii

Table of Contents 17

1.0 Introduction ......................................................................................................... 1 18

1.1 Description of Services ...................................................................................... 1 19

1.2 IPPS-A Description ............................................................................................. 3 20

1.2.1 Background .............................................................................................. 3 21

1.2.2 IPPS-A Overarching Objectives ............................................................... 4 22

1.2.3 Army Military Payroll Description .............................................................. 5 23

1.3 Scope ................................................................................................................... 6 24

1.4 Period of Performance ....................................................................................... 7 25

1.5 Contract Type ..................................................................................................... 7 26

1.6 Contract Structure .............................................................................................. 7 27

1.7 General Information Requirements ................................................................... 8 28

1.7.1 Quality Control and Assurance ................................................................. 8 29

1.7.2 Recognized Federal Holidays................................................................... 9 30

1.7.3 Hours of Operation ................................................................................... 9 31

1.7.4 Place of Performance ............................................................................... 9 32

1.7.5 Security Requirements ........................................................................... 10 33

1.7.6 Earned Value Management System (EVMS) ......................................... 14 34

1.7.7 Contracting Officer’s Representative (COR) .......................................... 15 35

1.7.8 Agile Qualifications ................................................................................. 15 36

1.7.9 Key Personnel ........................................................................................ 15 37

1.7.10 Contractor Key Personnel Replacement ................................................ 19 38

1.7.11 Identification of Contractor Employees ................................................... 19 39

1.7.12 Contractor Travel .................................................................................... 19 40

1.7.13 Other Direct Costs (ODCs) ..................................................................... 19 41

1.7.14 Organizational Conflict of Interest (OCI) ................................................. 20 42

1.7.15 Government Rights ................................................................................ 20 43

1.7.16 Contractor Manpower Reporting ............................................................ 21 44

2.0 Reference Materials .......................................................................................... 21 45

3.0 Government Furnished Property (GFP), Items, and Services ...................... 21 46

3.1 Equipment (GFE), Facilities, and Supplies ..................................................... 21 47

3.2 Hardware, Software, and Technology Services and Materials ..................... 22 48

4.0 Contractor Furnished Items ............................................................................. 22 49

October 27, 2023 iv

5.0 Performance Requirements – Specific Tasks ................................................ 23 50

5.1 Task 1: Program Management ........................................................................ 23 51

5.2 Task 2: Solution Configuration, Development, and Test ............................. 27 52

5.3 Task 3: Solution Integration ........................................................................... 34 53

5.4 Task 4: Release and Deployment .................................................................... 36 54

5.5 Task 5: Government Software Reuse Integration .......................................... 37 55

5.6 Task 6: Training Material Development .......................................................... 37 56

5.7 Task 7: Capability Support Transition ............................................................ 38 57

5.8 Task 8: Training Delivery [OPTIONAL] ........................................................... 39 58

6.0 Deliverables ...................................................................................................... 40 59

6.1 Deliverable Procedures .................................................................................... 40 60

6.2 Deliverables Schedule ..................................................................................... 41 61

Appendix A: Reference Materials .......................................................................... 46 62

Appendix B: List of References ............................................................................. 54 63

List of Figures 66

Figure 1. AMP Notional Capability Groupings ................................................................. 5 67

Figure 2. Notional 12-week PI ......................................................................................... 5 68

Figure 3. Business Process Mapping to Notional AMP Capability Groups ...................... 6 69

List of Tables 72

Table 1. AMP CLIN Structure .......................................................................................... 7 73

Table 2. PWS References ............................................................................................. 54 74

October 27, 2023 1

1.0 Introduction 77

This is a non-personal services contract to obtain Contractor services to develop an 78 Army Military Payroll (AMP) solution using the Oracle PeopleSoft Global Payroll 79 application. The Army launched the Integrated Personnel and Pay System – Army 80 (IPPS-A) Increment II (Inc II) production baseline for Human Resources (HR) 81 processing in December 2022 utilizing PeopleSoft Human Capital Management (HCM). 82 The new AMP capability will be integrated with the IPPS-A production baseline. 83

Development will consider (1) Agile execution combined with Development, Security, 84 and Operations (DevSecOps) for all activities / tasks to allow for Continuous Integration 85 / Continuous Delivery (CI/CD) and compliance with the Continuous Risk Management 86 Framework (cRMF), (2) task automation to reduce / eliminate manual effort, and (3) 87 innovation and creativity in problem-solving. 88

For this contract, Agile execution is defined as a group of software methods (e.g., 89 Scrum, Kanban, SAFe®) based on iterative and incremental development and 90 deployment of software capabilities for end users, where requirements and solutions 91 evolve through collaboration between cross-functional teams. These teams include the 92 Government and Contractor communities working across parallel environments where 93 capabilities are implemented, and production system capability support is ongoing. 94

Contractors will apply and perform Agile execution in varying degrees to all aspects of 95 the program life cycle across and within key activities. These activities include 96 requirements analysis, elicitation, elaboration, and decomposition; architecture; design; 97 development, implementation; test; integration; training material development; and 98 deployment, in addition to support functions such as program management (planning, 99 reporting), configuration management, change control, release management, quality 100 assurance, and cybersecurity. 101

The Government will not exercise any supervision or control over the service providers 102 performing the services herein. Such service providers shall be accountable solely to 103 the Contractor who, in turn, is responsible to the Government. 104

1.1 Description of Services 105

The Contractor will provide all personnel, supervision, and other items and non-personal 106 services necessary (except for those specified as Government Furnished in Section 3 of 107 this document) to perform the IPPS-A AMP services, as defined in this Performance 108 Work Statement (PWS). 109

Agile and DevSecOps methodologies will apply for incremental and value-added 110 delivery from requirements analysis / elaboration and business process reengineering 111 (BPR), through architecture, design, development, implementation, and testing, to 112 integration with the IPPS-A production baseline with minimum cybersecurity 113 vulnerabilities. 114

Integration with the IPPS-A production baseline will be performed with the IPPS-A 115 Capability Support Team. The IPPS-A Capability Support Team is responsible for the 116 integration, baseline testing, cybersecurity compliance, release, and deployment of 117

October 27, 2023 2 functionality into the IPPS-A production baseline for operational use. The Contractor 118 will be required to synchronize tasks and associated activities with the IPPS-A 119 Capability Support Team and participate in agile teams, where applicable, to ensure 120 smooth integration of AMP functionality into the IPPS-A production baseline. 121

The Government will provide the development environment(s) to support Contractor 122 development activities. Each environment will contain the IPPS-A baseline and 123 associated software applications and tools (see Reference 001 - IPPS-A Software 124 Baseline Applications and Tools.xls). The Government will not restrict the Contractor to 125 only using these applications and tools. The Contractor may implement additional 126 applications and tools, with justification and Government approval, within the 127 Government environments. Additional applications and tools that the Contractor 128 implements must align with the IPPS-A applications and tools so when the AMP 129 software is promoted to the IPPS-A integration environment, the IPPS-A tools will 130 function properly with the AMP software. The Government will give the Contractor 131 access as to the IPPS-A applications and tools at the level necessary to perform the 132 required work. The Contractor will give the Government access to all applications and 133 tools within the environments used by the Contractor to allow Government visibility into 134 all components. 135

The IPPS-A Program Management Office (PMO) does not currently have an 136 established DevSecOps pipeline. The Contractor is required to align with the IPPS-A 137 environments and processes in place and as they progress to a DevSecOps pipeline. 138

The Government will provide the Integration environment and associated tools to 139 support the integration and test of the AMP functionality into the IPPS-A production 140 baseline for release. The IPPS-A Capability Support Team will administer and maintain 141 the Integration environment, will ensure the currency of the IPPS-A baseline, tools, and 142 test data in that environment based on an agreed upon cadence, and will support the 143 Contractor activities in that environment, such as incremental testing and cybersecurity 144 scans. Likewise, the Contractor will support the IPPS-A Capability Support Team 145 baseline activities in that environment to ensure readiness of the AMP functionality for 146 release. 147

The IPPS-A PMO is using the Scaled Agile Framework (SAFe®) for program office 148 operations. The AMP developer will integrate efforts (e.g., activities and tools) with the 149 Government for Agile Release Train (ART) workflow in support of agile planning and 150 continuous product delivery. The AMP developer will apply an agile development 151 framework within their Agile Teams and will synchronize their effort with the 152 Government ART workflow. The Contractor’s agile framework will define interactions 153 between key roles such as Business Owners, Solution Architects, Release Train 154 Engineers, Product Owners, Scrum Masters, and Team Coaches. These interaction 155 definitions will ensure clear delineation of roles and responsibilities to ensure continuous 156 alignment of program roadmaps and transparency in execution activities and reporting. 157

For this PWS, where addressed as part of capability development and delivery, 158 “release” is defined as moving capability to integration environment followed by the 159 production environment; and “deploy” is defined as users having access to the new 160 capability in the production environment. 161

October 27, 2023 3

1.2 IPPS-A Description 162

1.2.1 Background 163

IPPS-A Inc II is both a Defense Business System and a National Security System 164 (categorized as "Sensitive Activities") based on operational requirements on the Non-165 secure Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol 166 Router Network (SIPRNet). IPPS-A is under the Milestone Decision Authority (MDA) of 167 the Army Acquisition Executive (AAE). It is managed by the Army Program Executive 168 Office Enterprise Information Systems (PEO EIS), Project Manager (PM) IPPS-A, 169 located in Arlington, VA 22202. PEO EIS develops, acquires, and deploys tactical and 170 management Information Technology (IT) systems and products and is a Systems 171 Acquisition, Development, and Integration Center of Excellence. 172

The IPPS-A Inc II mission is to develop and deliver a single, integrated, multi-173 component HR and Army Military Payroll system that streamlines Army HR, enhances 174 the efficiency and accuracy of Army Personnel and Pay procedures, and supports 175 Soldiers and their families. 176

IPPS-A Inc II is being developed and deployed incrementally in a series of software 177 releases to the Total U.S. Army Force (Active Army, Army National Guard, and Army 178 Reserves). A major software release was completed in January 2023, providing Military 179 HR capabilities, and bringing the Total U.S. Army Force into a single authoritative 180 system. This software release serves as the IPPS-A production baseline and is in the 181 Capability Support phase. 182

The IPPS-A production baseline primarily uses Oracle PeopleSoft Enterprise Resource 183 Planning (ERP) Commercial-Off-The-Shelf (COTS) software to deliver the functionality, 184 consisting of the following applications: 185

PeopleSoft HCM 9.2 186

PeopleSoft HCM 9.2 Peoplesoft Update Manager (PUM) Image 32 (or higher) 187

PeopleSoft Customer Relationship Management (CRM) 9.2 PUM Image 16 (or 188 higher) 189

PeopleSoft Enterprise Learning Management (ELM) 9.2 PUM Image 17 (or 190 higher) 191

PeopleSoft Tools version 8.58 (or higher) 192

Oracle database 19c version 12.2.0.3 (or higher) 193

Additional Oracle products, along with Ab Initio, OBIEE Stonebranch, Apache Kafka 194 Confluent, and Cameo software products comprise the baseline. See Reference 001 195 (Reference 001 - IPPS-A Software Baseline Applications and Tools.xlsx) for a complete 196 list of IPPS-A software products. 197

The IPPS-A solution and all its environments are currently hosted on-premises with the 198 Defense Information Systems Agency (DISA). See Reference 002 (Reference 002 - 199 IPPS-A Technical Environment Designs.pdf) for a description of the IPPS-A hardware. 200

October 27, 2023 4

1.2.2 IPPS-A Overarching Objectives 201

Overall IPPS-A program objectives include: 202

Provide incremental releases based on Agile execution and DevSecOps using 203 automated CI/CD pipelines where possible, aligned with the IPPS-A production 204 baseline architecture and processes 205

Use Agile development methods, where functional and technical development 206 team members and the Army collaborate daily 207

Provide preventive and corrective cybersecurity and information assurance to not 208 only meet cRMF compliance requirements but to provide robust and innovative 209 defense of soldier data 210

Provide complete visibility of the Total Force in one system for over 1 million 211 Soldiers 212

Enable the Army to better manage the talents of the Total Force based on their 213 Knowledge, Skills, and Behaviors (KSBs) to optimize Soldiers’ contributions to 214 Army Readiness 215

Deliver full audit compliance for pay, benefits, and HCM transactions per the 216 Federal Information Systems Control Audit Manual (FISCAM) and National 217 Institute of Standards and Technology (NIST) guidelines. 218

Improve Soldiers’ lives by reducing pay and personnel errors and providing full 219 transparency of actions 220

Subsume applicable legacy systems and eliminate interfaces 221

Reduce point-to-point interfaces 222

Execute HR Transformation, Army Military Payroll Transition and Business 223 Process Reengineering in conjunction with fielding IPPS-A to create a 21st 224 century Talent Management system and a HR data-rich environment 225

Use modern data architecture best practices to improve accessibility, increase 226 high data velocity, increase data throughput for low latency and reduce reliance 227 on any single technology or vendor 228

Allow for future Machine Language and Artificial Intelligence utilization 229

Comply with the seven data-centric Department of Defense (DoD) Data Strategy 230 VAULTIS goals, i.e., making data (1) Visible, (2) Accessible, (3) Understandable, 231

(4) Linked, (5) Trustworthy, (6) Interoperable, and (7) Secure 232

Apply Human Centered Design techniques to improve the user experience 233

Improve Return on Investment and lower total cost of ownership 234

The objective of this contract is to develop an AMP solution using the Oracle PeopleSoft 235 Global Payroll application, which will be integrated with the IPPS-A production baseline. 236

October 27, 2023 5

1.2.3 Army Military Payroll Description 237

For planning purposes, Army Military Payroll capabilities have been notionally grouped 238 into five (5) main development and release categories as depicted in Figure 1. 239

Figure 1. AMP Notional Capability Groupings 241

Using these groups, the Government has developed a notional Planning Interval (PI) 242 Model to depict the sequencing and evolution of functionality across a series of 12-week 243 PIs (see Reference 003 (Reference 003 - IPPS-A AMP PI Notional Plan and PI 1 - 3 (24 244 OCT 2023).pdf). Figure 2 provides a depiction of a notional 12-week PI. 245

Figure 2. Notional 12-week PI 247

October 27, 2023 6

As part of the IPPS-A baseline development effort, the following payroll capabilities 248 have been implemented and are included in the production baseline: 249

22 pay triggers for absences, jobs, benefits, special pay requests, … 250

4500+ Pay business rules 251

178 Pay elements defined in PeopleSoft Global Pay 252

369 total Pay elements defined 253

90 Pay scenarios 254

Figure 3 depicts the alignment of capabilities to business process maps. The accounting 255 integration capabilities listed below are linked to maps and requirements that reflect 256 IPPS-A operating as a financial feeder system rather than serving as a subledger. The 257 Army is reviewing this approach and may shift to a subledger approach. 258

Figure 3. Business Process Mapping to Notional AMP Capability Groups 260

For a complete of the AMP Requirements, see Reference 004 (Reference 004 - 261 IPPS-A Functional Requirements List.xls). 262

For a description of the AMP Business Process Maps, Format Identifiers (FID) 263 Transaction Identification Numbers (TINs), Interfaces, and Pay Elements, see 264 Reference 005 (Reference 005 - IPPS-A AMP Business Process Maps - Interfaces - 265 Pay Data.zip). 266

1.3 Scope 267

The Army requires the following services, and the Contractor shall deliver an AMP 268 solution as follows: (1) design, configure, build, and test, (2) integrate and test the AMP 269 solution with the IPPS-A production baseline, (3) develop AMP training material, (4) 270 support AMP release and deployment activities, and (5) transition AMP functionality to 271 capability support. 272

October 27, 2023 7

These services will be acquired across the following tasks: 273

Task 1: Program Management 274

Task 2: Solution Configuration, Development, and Test 275

Task 3: Solution Integration 276

Task 4: Release and Deployment Support 277

Task 5: Government Software Reuse Integration 278

Task 6: Training Material Development 279

Task 7: Capability Support Transition 280

Task 8: Training Delivery [OPTIONAL} 281

1.4 Period of Performance 282

The period of performance is as follows: one 6-month Base Period and up to thirty-three 283

(33) 12-week Optional Planning Interval (PI) Periods for a total contract period of 284 performance up to seven (7) years. The Base Period begins on the designated date 285 defined at contract award. Optional PI Periods begin when exercised by the 286 Government in concert with the Program Roadmap maintained by the Contractor and 287 concurred with by the Government. Contractor performance will be monitored, and 288 results will be reviewed when deciding to exercise an Optional PI Period. 289

1.5 Contract Type 290

This is a Hybrid contract including Firm Fixed Price (FFP), Cost Plus Fixed Fee (CPFF) 291 Level of Effort (LOE), CPFF Completion, and Cost Reimbursable (no fee) line items for 292 Travel and Other Direct Costs (ODCs). 293

1.6 Contract Structure 294

The contract structure is depicted in Table 1. 295

Table 1. AMP CLIN Structure 296

CLIN # Description Scope Period of

Performance APPN CLIN Type and TBD

Task 1: Program Management Program Planning and Reporting Program Management (Cost, Schedule, Performance, Quality) Transition In

Contract Duration;

6-month periods

RDTE CPFF LOE

through

PI OPTIONAL CLIN

Task 2: Solution Configuration, Development, and Test Task 3: Solution Integration Task 4: Release and Deployment Task 5: Government Software

Reuse Integration Task 6: Training Material

Development

Planning Interval (PI) Planning Sprint Execution Code Delivery Baseline Integration Baseline Release Planning Release Readiness Deployment Readiness Post Deployment Support Reuse Analysis Reusable Code Integration Training Planning and Management Training Material Development

12-week period RDTE CPFF LOE and/or

CPFF

Completion

October 27, 2023 8

CLIN # Description Scope Period of

Performance APPN CLIN Type and TBD

SURGE PI OPTIONAL CLIN

Task 2: Solution Configuration, Development, and Test Task 3: Solution Integration Task 4: Release and Deployment Task 5: Government Software

Reuse Integration Task 6: Training Material

Development

Planning Interval (PI) Planning Sprint Execution Code Delivery Baseline Integration Baseline Release Planning Release Readiness Deployment Readiness Post Deployment Support Reuse Analysis Reusable Code Integration Training Planning and Management Training Material Development

Contract Duration;

6-month periods

RDTE CPFF

0036 Task 7: Capability Support Transition

Transition Out Planning Transition Out Implementation

Last 120 Days of Contract

RDTE FFP

0037 Task 8: Training Delivery

[OPTIONAL]

Training Preparation Training Delivery to End Users

6 months prior to Production Release until Complete

RDTE FFP

and TBD

Licenses Additional Development Tool Licenses

Contract Duration;

6-month periods

RDTE FFP

0039 and

TBD

Travel Actual Travel Costs Contract Duration;

6-month periods

RDTE CR

and TBD

Other Direct Costs (ODCs) Actual ODCs Contract Duration;

6-month periods

RDTE CR

0041 Contractor Manpower Reporting Manpower Reports Contract Duration Not Separately Priced

0042 Contract Data Requirements List

(CDRL)

Required Documentation Contract Duration Not Separately Priced

1.7 General Information Requirements 297

1.7.1 Quality Control and Assurance 298

The Contractor will maintain an effective quality control program to ensure services are 299 performed as agreed to in the contract. This will include the following: 300

Updating and implementing procedures to identify, prevent, and ensure the non-301 recurrence of defective services, to include products and software 302

Using programmatic and technical metrics as quality measures to assess 303 performance, progress, speed, cybersecurity, and quality of the product team, 304 leveraging automated tools to the maximum extent practicable 305

The Government will evaluate the Contractor’s performance in accordance with the 306 IPPS-A AMP Quality Assurance Surveillance Plan (QASP) (see Attachment 1). The 307 QASP describes the performance levels the Contractor must achieve to satisfy the 308 contract performance requirements. The Contractor shall meet the threshold 309 requirements outlined in the QASP. The Contractor shall report performance against 310 the metrics outlined in the QASP during program reviews per the cadence established 311 between the Government and Contractor. The report must show the current and 312 previous two months. If the Contractor fails to meet any QASP metric, the Government 313 will notify the Contractor through the Contracting Officer and will require corrective 314 action within five (5) business days of receipt of the official notice by the Contracting 315 Officer describing their plan to meet the QASP metric. If the Contractor is unable to 316

October 27, 2023 9 meet the threshold requirement, the Government may decide to not award subsequent 317 options to the Contractor. 318

1.7.2 Recognized Federal Holidays 319

New Year’s Day 320

Martin Luther King Jr.’s Birthday 321

Presidents Day 322

Memorial Day 323

Juneteenth National Independence Day 324

Independence Day 325

Labor Day 326

Columbus Day 327

Veteran’s Day 328

Thanksgiving Day 329

Christmas Day 330

1.7.3 Hours of Operation 331

The Contractor shall be responsible for conducting normal operations between the 332 hours of 8am to 5pm Monday thru Friday, core hours being 9am to 3pm Monday 333 through Friday except for Federal Holidays, Government closure due to local or national 334 emergencies, administrative closings, or similar Government directed facility closings. 335 Contractor personnel identified as key personnel and/or leads shall be available 336 between the hours of 8am to 5pm Monday thru Friday. 337

1.7.4 Place of Performance 338

All activities requiring Government participation (e.g., planning, demonstrations, 339 reviews) will take place at the IPPS-A PMO facility, currently located at the Polk 340 Building, 2521 South Clark Street, Arlington, VA 22202, unless otherwise determined 341 based on the specific activity. For activities conducted at the IPPS-A PMO facility, the 342 Government will provide hotel-type space for Contractor use. The Contractor facility 343 may also be used for key events. Key events will be coordinated in advance to include 344 associated logistics. 345

All work related to Sensitive Activities (SA) will be performed at the designated IPPS-A 346 PMO secure area approved for classified discussion and work. The IPPS-A PMO 347 secure area is currently located at the Polk Building, 2521 South Clark Street, Arlington, 348

VA 22202. 349

Travel between the Contractor facilities and Government facilities will not be reimbursed 350 as a travel expense. 351

Temporary duty (TDY) travel to other designated locations will be required to attend 352 meetings, demonstrations, and data centers. 353

October 27, 2023 10

The number of TDY trips is unknown. The Contractor will not be reimbursed for travel to 354 and from their normal place of business within the Continental United States (CONUS) 355 (Convenience Travel). For performance of this contract, outside the local area is defined 356 as greater than 50 miles from the IPPS-A PMO facility. Travel will be reimbursed as 357 actual costs incurred in accordance with Joint Travel Regulations (JTR). All necessary 358 travel shall be approved in advance by the Contracting Officer’s Representative (COR). 359

Contractor personnel will be subject to all travel regulations in effect at the time of the 360 anticipated travel. Contractors are not authorized city pair (i.e., Government discount) 361 air fares. 362

1.7.5 Security Requirements 363

The DD254 is provided as Attachment 3. The security classification guidance for 364 classified information requirements is in accordance with the attached DD254. 365

The Contractor will possess and maintain a Facility Clearance Level of SECRET from 366 the Defense Counterintelligence Security Agency (DCSA). 367

Contractor personnel performing work under this contract will have a valid active 368 SECRET security level clearance. 369

The Contractor will ensure the protection of Classified Information, Controlled 370 Unclassified Information (CUI), Personal Identifiable Information (PII) or Privacy Act 371 Data, Controlled Technical Information (CTI) [as required], and Critical Program 372 Information (CPI) [as required]. 373

The Contractor will ensure the aforementioned information is properly safeguarded in 374 accordance with the applicable requirements to protect adequately against unauthorized 375 disclosure. 376

The Contractor will review DoD, DA, and PEO EIS specific instructions, security 377 policies, procedures, training, and other requirements stipulated in the National 378 Industrial Security Program (NISP) and National Industrial Security Program Operating 379 Manual (NISPOM), and any supplements thereto are applicable, to include, the Federal 380 Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement 381 (DFARS), data usage agreements and memoranda of agreement, and security 382 provisions and/or clauses. 383

1.7.5.1 Authorities and Scope 384

This paragraph addresses contractor access to, or possession of, collateral (non-SCI) 385 classified information, CUI, PII, CTI or CPI in connection with the performance of this 386 contract. However, it is also applicable to safeguarding the same information in 387 connection with all aspects of pre-award activity, including preparation of bids and 388 proposals and pre-award negotiations, and all aspects of post-award activity. Moreover, 389 the requirements are equally applicable to the safeguarding of the same information not 390 released or disclosed under a procurement contract, agreements or programs 391 participated in by a firm, organization, or individual on a voluntary or grant basis. 392

October 27, 2023 11

For the purposes of this contract, unless otherwise specified, the term “access” will be 393 used to denote any of the aforementioned categories of information released to 394 industry. Additionally, the term Requiring Activity (RA) applies to any element requiring 395 Contractor access. 396

All functional Security, Force Protection, Antiterrorism, Operations Security (OPSEC), 397 Cybersecurity and Counterintelligence requirements, policies, and procedures identified 398 in this PWS are applicable to all of DoD and Army (military, civilian and Contractor) 399 personnel performing services on this contract. This includes IPPS-A integrated portfolio 400 efforts, other integrated ERP program efforts that support the implementation of the 401 AMP solution or where the Army and / or PEO EIS, as the Cognizant Security Office 402 (CSO), is required to implement security procedures, program protection planning, 403 additional required training identified through updated policy, or exercise security and/or 404 protection duties. This also includes all Executive Orders, policies, laws, statutes, as 405 promulgated in DoD and DA Directives, Regulations, Instructions and Manuals as 406 provided in the following references. 407

1.7.5.2 Security Requirements for Overseas Travel 408

For travel requirements/restrictions to any foreign country, see the Foreign Clearance 409 Guide (FCG) at the following website for applicable information: 410 https://www.fcg.pentagon.mil/fcg.cfm 411

1.7.5.3 Physical Security 412

The Contractor will be responsible for safeguarding all Government equipment, 413 information and property provided for Contractor use. At the close of each work period, 414 Government facilities, equipment, and materials shall be secured. 415

1.7.5.4 Disclosure of Information 416

The Contractor will not release to anyone outside the Contractor's organization any 417 classified information, regardless of medium (e.g., film, tape, document, etc.), pertaining 418 to any part of this contract or any program related to this contract, unless: (1) The COR 419 has given prior written approval by the cognizant classified information owner and (2) 420 the cognizant classified information owner has approved its release as part of contract 421 performance. 422

Classified information will not be authorized for release regardless of medium (e.g., film, 423 tape, document), for any part of this contract or any program related to this contract. All 424 unclassified information or CUI regardless of medium (e.g., film, tape, document), 425 pertaining to any part of this contract or any program related to this contract, shall be 426 reviewed and approved for release through standard Army processes before it is 427 provided to the public, including via posting to publicly accessible websites. 428

Request for approval will identify the specific information to be released, the medium to 429 be used, and the purpose for the release. The Contractor will submit its request to the 430 COR at least forty-five (45) days before the proposed date for the release. The 431 Contractor shall include a similar requirement in each subcontract under this contract. 432 Subcontractors will submit requests for authorization to release through the prime 433

October 27, 2023 12

Contractor to the COR. The Contractor's procedures for protecting against unauthorized 434 disclosure of information shall not require DoD employees or Armed Forces (AF) 435 members to relinquish control of their work product, whether classified or not, to the 436 Contractor. 437

1.7.5.5 Visiting Facilities 438

Pursuant to Section 808 of Public Law (P.L.) 102-190 (DFARS 204.402), DoD 439 employees or members of the AF who are assigned to or visiting a Contractor facility 440 and are engaged in oversight of an acquisition program will retain control of their work 441 product. Classified work products of DoD employees or members of the AF will be 442 handled in accordance with DoD 5220.22-M. Contractor procedures for protecting 443 against unauthorized disclosure of information will not require DoD employees or 444 members of the AF to relinquish control of their work products, whether classified or not, 445 to a Contractor. If a visit to a Contractor facility will require access to classified 446 information, the visitors must give the Contractor advance written notice. 447

1.7.5.6 Key Control 448

The Contractor will establish and implement methods of making sure all keys / key 449 cards issued to the Contractor by the Government are not lost or misplaced and are not 450 used by unauthorized persons. NOTE: All references to keys include key cards. No 451 keys issued to the Contractor by the Government will be duplicated. The Contractor will 452 develop procedures covering key control that will be included in the Quality Control Plan 453 (QCP). Such procedures will include turn-in of any issued keys by personnel who no 454 longer require access to locked areas. The Contractor will immediately report any 455 occurrences of lost or duplicate keys/key cards to the COR. 456

a. In the event keys, other than master keys, are lost or duplicated, the Contractor 457 will, upon the direction of the COR, re-key or replace the affected lock or locks; 458 however, the Government, at its option, may replace the affected lock or locks or 459 perform re-keying. When the replacement of locks or re-keying is performed by 460 the Government, the total cost of re-keying or the replacement of the lock or 461 locks will be deducted by the Government from the monthly payment due the 462 Contractor. In the event a master key is lost or duplicated, all locks and keys for 463 that system will be replaced by the Government and the total cost will be 464 deducted by the Government from the monthly payment due the Contractor. 465

b. The Contractor will prohibit Government issued keys by any persons other than 466 the Contractor’s employees. The Contractor will prohibit the opening of locked 467 areas by Contractor employees to permit entrance of persons other than 468 Contractor employees engaged in the performance of assigned work in those 469 areas, or personnel authorized entrance by the COR. 470

1.7.5.7 Lock Combinations 471

The Contractor will establish and implement methods of ensuring that all lock 472 combinations are not revealed to unauthorized persons. These procedures shall be 473 included in the Contractor’s QCP. 474

October 27, 2023 13

1.7.5.8 Security Education Training and Awareness (SETA) 475

All DA SETA requirements identified in this SOO are applicable to all of DoD and Army 476 (military, civilian and Contractor) personnel performing services on the IPPS-A contract 477 and IPPS-A integrated portfolio efforts in accordance with DoDM 5220.22, DoDM 478

5200.01 Volume 1-3, DoDI 5200.48, Army Regulation (AR) 350-1, AR 380-12, AR 25-2, 479 and DA Pamphlet (PAM) 25-2-6. 480

1.7.5.9 Special Qualifications 481

Contractor personnel performing work under this contract will have the appropriate 482 personnel security investigation (PSI) completed and favorably adjudicated by the DoD 483 CAF; and granted eligibility for access to classified information. 484

The Contractor will be responsible for ensuring that employees providing cybersecurity 485 services possess and maintain current Information Assurance Technician (IAT) Level I 486 (COMPTIA A+ CE) or II (COMPTIA Security + CE) professional certification per Army 487 and DoD regulation at the time of contract award, and during the execution of the 488 contract. 489

The Contractor will ensure the following: 490

a. All employees complete Cybersecurity Awareness training annually, as outlined 491 by the DA PAM 25-2-6, “Cybersecurity Training and Certification Program”, April 492 8, 2019. Employees will also complete additional relevant security trainings, i.e., 493 Privacy Information Handling, as required by the Government. 494

b. All DA Contractor personnel who have access to Federally-controlled information 495 systems are assigned to an Automated Data Processing (ADP) Position 496 Category which is designated at one of three ADP levels, positions which are 497 designated at one of three information technology (IT) levels, each requiring a 498 certain level of investigation and clearance, as follows (see A Release 3 80-5, 499 Appendix K for position descriptions): 500

1) ADP-I for an IT position requiring a Single Scope Background 501 Investigation (SSBI) or SSBI equivalent; 502

2) ADP-II for an IT position requiring a National Agency Check with Law and 503 Credit (NACLC equivalent); and 504

3) ADP-III for an IT position requiring a National Agency Check with Inquiries 505 (NACI) or equivalent. 506

4) Previously completed security investigations may be accepted by the 507 Government in lieu of new investigations if determined by the PEO EIS 508 security office to be essentially equivalent in scope to the TO 509 requirements. The length of time elapsed since the previous investigation 510 will also be considered in determining whether a new investigation is 511 warranted. To assist the Government in making this determination, the 512 Contractor must provide the following information to the respective PEO 513 EIS security office immediately upon receipt of the TO. This information 514 must be provided for each Contractor employee who will perform work on 515

October 27, 2023 14 a PEO EIS system and will require access to Federally-controlled 516 information systems: 517

Full name, with middle name, as applicable, with social security 518 number 519

Citizenship status with date and place of birth 520 Proof of the individual’s favorable adjudicated background 521 investigation or NACI, consisting of identification of the type of 522 investigation performed, date of the favorable adjudication, and 523 name of the agency the performed the investigation 524

Company name, address, phone, and fax numbers with email 525 address 526

Location of on-site workstation or phone number if off-site; and 527 Order or contract number and expiration date; and name of the 528

Contracting Officer. The Contracting Officer will ensure that the 529 Contractor is notified as soon as a determination is made by the 530 assigned or cognizant PEO EIS security office regarding 531 acceptance of the previous investigation and clearance level. 532

5) If a new investigation is deemed necessary, the Contractor and 533 Contracting Officer will be notified by the respective PEO EIS security 534 office after appropriate checks in the DoD databases have been made. 535

6) If the Contractor employee requires access to classified information and 536 currently does not have the appropriate clearance level and/or an active 537 security clearance, the PEO-EIS security office will relay this information 538 to the Contractor and Contracting Officer for further action. 539

7) The Contracting Officer will ensure that the respective PEO EIS security 540 office initiates the investigation for the required clearance level(s) of the 541 Contractor personnel. 542

8) It is the Contractor’s responsibility to ensure that adequate information is 543 provided, and that each Contractor employee completes the appropriate 544 paperwork, as required either by the Contracting Officer and the PEO EIS 545 security office, to begin the investigation process for the required 546 clearance level. 547

1.7.6 Earned Value Management System (EVMS) 548

In the performance of the contract, for all cost-based CLINs, the Contractor will use an 549 Earned Value Management System (EVMS) that has been determined by the Cognizant 550 Federal Agency to be compliant with the EVMS guidelines specified in the Electronic 551 Industries Alliance (EIA)-748 Standard, Industry Guidelines for Earned Value 552 Management Systems (current version at the time of award) to manage the contract. 553 The EVMS will comply with the criteria in the DFARS 252.234-7001, 7002 and DFARS 554 252.242-7005. The Contractor’s EVMS will: 555

a. Plan the scope of work required for the contract, through its completion 556

b. Assign authority and responsibility 557

c. Integrate cost, schedule, and technical parameters of the work 558

October 27, 2023 15

d. Measure performance objectively, using Earned Value Management (EVM) 559 measurements 560

e. Measure actual costs 561

f. Analyze variance from the plan and identify risks 562

g. Summarize and report performance data 563

h. Forecast milestone achievement and TO completion events 564

i. Forecast final contract costs and incorporate baseline revisions 565

1.7.7 Contracting Officer’s Representative (COR) 566

The COR will be identified by separate letter. The COR monitors all technical aspects of 567 the contract and assists in administration. The COR is authorized to perform the 568 following functions: assure that the Contractor performs the technical requirements of 569 the contract; perform inspections necessary in connection with performance; maintain 570 written and oral communications with the Contractor concerning technical aspects of the 571 contract; issue written interpretations of technical requirements, including Government 572 drawings, designs, specifications; monitor Contractor's performance and notify both the 573 Contracting Officer and Contractor of any deficiencies; coordinate availability of 574 Government furnished property; and provide site entry of Contractor personnel. A letter 575 of designation issued to the COR, a copy of which is sent to the Contractor, states the 576 responsibilities and limitations of the COR, especially regarding changes in cost or 577 price, and estimates or changes in delivery dates. The COR is not authorized to 578 change any of the terms and conditions of the resulting contract. 579

1.7.8 Agile Qualifications 580

The Contractor shall ensure personnel performing work under this contract have the 581 necessary Agile certifications and/or experience to perform their assigned role to deliver 582 functionality in compliance with the Contractor’s agile methodology, leveraging best 583 practices of Agile software development. 584

1.7.9 Key Personnel 585

Key personnel are those people considered essential to successful Contractor 586 performance. All key personnel must be on board at contract award. The Contractor will 587 not replace any personnel designated as key personnel without providing written notice 588 to the Contracting Officer and COR at least 48 hours upon Contractor receipt of a 589 voluntary notice or Contractor decision to replace personnel. The notice will provide a 590 detailed explanation of the circumstances necessitating the substitution. Qualifications 591 of substitute key personnel shall be equal to, or greater than, those of the person(s) 592 being replaced. 593

The Contractor will fill the following Key Personnel positions for the purposes of this 594 contract. 595

1.7.9.1 Program Manager (PM) 596

The Contractor will assign an individual to serve as a Program Manager (PM) for this effort. 597 This individual will be the single point of contact for the Government Task Monitor (GTM) and 598 COR. The PM will be responsible for the performance of the work. The name of this person 599

October 27, 2023 16 and an alternate, who will act for the Contractor when the PM is absent, will be designated in 600 writing to the Contracting Officer. The Contractor PM and alternate will have full authority to act 601 for the Contractor on all matters relating to daily operation of this contract. The Contractor PM 602 or alternate will be available in accordance with paragraph 1.7. 3 Monday through Friday 603 except Federal holidays or when the Government facility is closed for administrative reasons. 604

The PM will have the following experience and qualifications: 605

a. 10 or more years of acquired knowledge in planning, directing, and managing 606 projects/operations in an organization similar in size to this acquisition with at least 607 managing two major software development implementations, to include agile 608 development 609

b. 10 or more years of acquired knowledge and supervision of employees of various labor 610 categories and skills in efforts similar in size and scope as this acquisition 611

c. 10 or more years of acquired knowledge of industry accepted standards and best 612 practices related to Project Management 613

d. Proven track record on delivering on time and within budget for with large/complex 614 projects 615

e. 8 or more years of experience managing the entire agile software development lifecycle, 616 including frequent production delivery 617

f. 5 or more years of experience with researching and fielding new and innovative 618 technology 619

g. 10 or more years of hardware and software procurement experience 620

h. 15 or more years of program management experience 621

i. 10 or more years of program management experience in Federal, DoD, Army, or 622

Intelligence Community (IC) 623

j. 10 or more years of IT experience in the Federal, DoD, Army, or IC 624

k. Project Management Professional Certification required 625

l. Agile Project Manager Certification required 626

m. Agile Product Owner Certification preferred 627

n. Bachelor’s degree in an IT related field, or equivalent experience (minimum 18 years) 628

1.7.9.2 PeopleSoft Global Payroll Systems Architect 629

The PeopleSoft Global Payroll System Architect will have the following experience and 630 qualifications: 631

a. Proven experience of at least one full implementation experience with PeopleSoft 632 Global Payroll working with multiple teams composed of technical and functional 633 analysts 634

b. 8 or more years of configuring business rules, and performing Configuration, Design 635 and Development of PeopleSoft HR and Global Payroll 636

c. Understanding of PeopleSoft Global Payroll Business Processes and how it integrates 637 with HR, Time & Labor, PeopleSoft Financial Supply Chain Management (FSCM), and 638 external general ledger systems 639

d. 10 or more years of development experience with PeopleTools (e.g., Application 640 Designer, Component Interface, Application Engine, Integration Broker), and SQL 641

October 27, 2023 17

e. 3 or more years of experience of configuration, design and development of PeopleSoft 642 Payroll Rules Engine and Processing Framework 643

f. 5 or more years of experience translating Functional and Technical Requirements for 644 implementation in a defense business system 645

g. 5 ore more years of experience interacting and presenting work to senior leadership 646

h. 5 or more years of experience effectively analyze and demonstrate business processing 647 reengineering of legacy Business Processes in favor of PeopleSoft delivered capability 648

i. 3 or more years of experience working with Federal, or DoD/Military HR/Pay rules and 649 requirements (e.g., Title 10, 32, etc.) is desired; Army relevant experience is preferred 650

j. 3 or more years of experience with General Fund Enterprise Business System (GFEBS) 651 accounting and U.S. Treasury disbursement is desired 652

k. 5 or more years of experience with data modeling tools such as IBM System Architect, 653

CAMEO, ARIS, and MagicDraw 654

l. 5 or more years of experience with DoD Architecture Framework is desired 655

m. 3 or more years of experience with modern software development tools such as: 656

GITLAB, SonarQube, HP ALM suite, and the Atlassian Suite is desired 657

n. BS in Computer Science, information systems or a related technical degree plus 10 658 years’ relevant experience with PeopleSoft HCM 9.2 implementation experience.