WMT_PWS_New Requirement.pdf

DHA PWS Template V13 November 16, 2021

Department of Defense Defense Health Agency

Performance Work Statement

Web and Mobile Services Development and Sustainment

Defenese Health Agency (DHA), J-6

Solution Delivery Division (SDD), Web and Mobile Technology (WMT) Program Management Office (PMO)

Solicitation Number:

Version:

Date:

NOTE TO OUR CUSTOMERS: THIS TEMPLATE MUST BE TAILORED BY

INCLUDING YOUR UNIQUE REQUIREMENTS (SEE PART 5), QUANTITIES FOR

WORKLOAD, SPECIFIC SURVEILLANCE TECHNIQUES, ETC. ANY QUESTIONS

REGARDING THIS TEMPLATE SHOULD BE ADDRESSED WITH YOUR ASSIGNED

ACQUISITION TEAM. GENERAL INFORMATION IS PRESENTED IN BLUE

ITALICS WITH PARENTHESIS BORDERS, WHILE FILL-IN GUIDANCE IS

PRESENTED IN BLUE WITH BLACK BRACKET BORDERS. PLEASE DELETE ALL

BLUE ITALICS AND BLUE NON-ITALICS WHEN FINALIZING THE PWS.

TEMPLATE PWS WILL BE USED FOR DEFENSE HEALTH AGENCY (DHA) D AND

R SERVICE REQUIREMENTS WHEN EXECUTED BY DHA CONTRACTING

OFFICERS (CO).

THIS INSTRUCTIONAL BLOCK SHOULD BE DELETED PRIOR TO FINALIZING

YOUR PWS.

PART 1

1.0 GENERAL INFORMATION

This award provides for the services, material, and equipment for web design, web development, web sustainment, web migration/transition and necessary support (to include information assurance compliance and risk mitigation, governance plan, policy and procedure, quality assurance, capacity planning guidance, configuration management plan, features and functions guide, user management, product documentation, applications integration guide, Commercial off the Shelf (COTS) product implementation guide, code access security, and Service catalogue, UI/UX/UL, Enterprise Content Management (ECM) in accordance with Department of Defense (DoD) standards) for Office of the Assistant Secretary of Defense (Health Affairs (HA), Defense Health Agency (DHA), and Military Health System (MHS) Public, Restricted and Internal websites and web applications, as well as Mobile Applications and Progressive Web Applications (PWAs). In addition The Contractor shall be the primary point of contact for customer support services for all web-related and mobile-related development and sustainment provided by SDD WMT to the MHS community. The Contractor will be engaged as requested by the WMT Program Management Office.

1.1 This is a non-personal services contract to provide Web and Mobile Services Development and Sustainment.

1.2 Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Web and Mobile development and management as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this PWS.

1.3 Background:

The MHS is responsible for providing quality healthcare to active duty members and retired military personnel, and their families. Sharing information and implementing useful advanced technology capabilities are essential to the successful delivery of quality healthcare and the optimization of MHS resources. MHS web services and web applications provide resources that all MHS customers and supported organizations may utilize for data sharing and operations while maintaining data integrity and ensuring information is exchanged securely. PEO Medical Systems /CIO (J6) is the technical manager for health care information systems and networks. It is J6’s responsibility to provide an advanced and robust Information Technology (IT) environment that supports a wide variety of business processes within the MHS business areas. The web services infrastructure provides access to systems and office automation tools and data sharing websites used in the day-to-day operations and delivery of health care related information to all MHS Supported partners and beneficiaries.

J6 fulfills its responsibility by operating and maintaining a sophisticated and secure web computing environment, systems and dashboard/portals that hosts critical enterprise computing applications and functionality for Office Automation, Multi-Media Collaboration, Internet, Extranet, Electronic Communication Collaboration and Electronic Commerce. These capabilities are essential to the mission of the MHS and its ability to effectively interact and communicate with external Government, Military, Civilian, and commercial organizations.

Within Health Information Technology (HIT), the Solution Delivery Division (SDD) Web and Mobile Technology (WMT) PMO is responsible for providing leadership, governance, processes, standardization, and efficiencies in internet, intranet, extranet, mobile, and social media capabilities, resulting in the identification, capture, dissemination, and availability of knowledge to improve MHS performance and reduce operating and infrastructure costs.

1.4 Objectives: The objective of this contract is to provide web and mobile application development and management support to the MHS as identified within the scope of this PWS.

Examples of this support include:

• Provide a web and mobile development, sustainment, migration and support team that can produce consistent, available, and reliable software design, development, and related support utilizing ITIL and Information Technologies Service Management (ITSM) best practices for continual service improvement;

• Effectively design and develop websites and mobile apps responsive to customer requirements; develop, deploy, operate, and modernize Assistant Secretary of Defense (HA) and DHA websites; optimize functionality and the user experience; and assist WMT in executing development-related projects as determined by the WMT governance process;

• Provide project management, business analysis, network security, and systems engineering as required in support of WMT; and

• Provide support to database applications, operating within Windows based Client/Server environments; support will include design, engineering, implementation, testing, integration and maintenance of database web applications.

This PWS includes, but is not limited to, the following ongoing efforts and tasks in support of these objectives:

• Create high quality and relevant mobile, web, and 3D applications using proven and advanced technologies

• Manage and support mobile, web, and 3D systems to include Web Servers, Wired and Wireless Networks, and Applications

• Create and/or support various Database Management Systems such as SQL, MongoDB Postgres, and NoSQL

• Develop high quality user-centered graphic design for applications

• Develop professional quality videos and other media support for applications, marketing and other initiatives and promotional work

• Research, implement, and support new technologies in the areas of mobile, web, Cloud services APIs, Programing APIs and 3D

• Web System Engineering Services

• Disaster Recovery and Continuity of Operations Plan (COOP)

• Information Technology security support activities

• Integration and consolidation of websites from other DHA entities that had been separately maintained and hosted

• Collaborative Software Implementation design, development and support

• SDD WMT web analytics, application performance metrics, system performance metrics, and dashboards

• SharePoint development and sustainment

1.5 Scope: The scope of this PWS includes services necessary to design, develop, modify, upgrade, test, implement, troubleshoot, support, sustain, maintain security, train, provide system and database administration, conduct change management practices, and/or provide administrative support for all modules within each supported product. Specific services are identified in Section 5, and may vary supported products. This award provides for the services, material, and equipment for mobile application development, web design, web development, and necessary support (to include testing, information assurance compliance and risk mitigation in accordance with DoD standards) for MHS Internet, Intranet, and Extranet websites, web applications, and mobile applications. In addition The Contractor shall be the primary point of contact for customer support services for all web-related development and sustainment provided by SDD WMT to the MHS community. The Contractor will be engaged as requested by designated WMT Program Managers for new development efforts. The Contractor will utilixe SAFe

Services include providing Tier I/ Tier II/ Tier III consultation and customer support for implementation, troubleshooting, and management for the products described in this PWS, supporting possible hosting migration(s) when needed, and product decommissioning activities where applicable.

Tier I: Provide necessary support and resources to operate customer support functions. This may include remote access for information provision, tools, techniques and procedures to assist information systems users at all levels, and customer problem reporting/resolution services.

Tier II: Provide necessary support and resources to operate customer support functions, which may include customer training, change management (i.e. when there are upgrades/enhancements, train the customers via telephone), resolution management, and elevation of calls to Tier III for closure.

Tier III: Provide complex issue resolution requiring a higher level of technical knowledge.

Services include but not limited to:

1.5.1 Public Web: The Contractor shall provide qualified personnel to support public website products and interface software. The Contractor shall provide personnel with skillsets necessary to produce platform upgrades, application version hot fixes and updates, interface version updates, support data pull requests/reports and sustain the application, as required. The public web products include but not limited to health.mil, TRICARE.mil, DHA sites hosted by the Defense Media Activity (DMA), other DHA/non-DHA sites as determined by the government.

1.5.2 Restricted Web: The Contractor shall provide qualified personnel to support restricted website products and interface software. The Contractor shall provide personnel with skillsets necessary to produce platform upgrades, application version hot fixes and updates, interface version updates, support data pull requests/reports and sustain the application, as required. The restricted web products include but not limited to Tricare Retail Refund WebSite (TRRWS), Assistance Reporting Tool (ART), DoD Suicide Event Reporting (DoDSER), Inquiry Tracking, Records Management Storage Tracking (RMST), World Class Facilities Toolkit (WCFT), Real Property System Standards (RPSS).

1.5.3 Internal Web: The Contractor shall provide qualified personnel to support restricted website products and interface software. The Contractor shall provide personnel with skillsets necessary to produce platform upgrades, application version hot fixes and updates, interface version updates, support data pull requests/reports and sustain the application, as required. The public web products include, but not limited to:

• DHA Enterprise SharePoint o Inside DHA, Army Medicine Portal (AMP) o Navy Medicine Portal (NMP) o Air Force Medicine Portal (AFMP) o FACTS o Legal Efficiency Automation Platform (LEAP) o Other Lines of Business (OLB) o Military Treatment Facilities (MTF) SharePoint sites

• MED365

o SharePoint Online

1.5.4 Mobile Applications: The Contractor shall provide qualified personnel to support mobile products and interface software. The Contractor shall provide personnel with skillsets necessary to produce platform upgrades, application version hot fixes and updates, interface version updates, support data pull requests/reports and sustain the application, as required. The mobile products include but not limited to native android, native iOS and progressive web applications (PWA)s.

1.5.5 Mobile Enterprise Platform (MEP): The Contractor shall provide qualified personnel to create & support a Modular Enterprise Platform (MEP) that includes both a Mobile Enterprise Component (MEC) and a Web Enterprise Component (WEC). MEC is tailored for mobile devices & the WEC is tailored for websites. The MEP is cloud-based, and The Contractor shall provide personnel with skillsets in architecting and delivering cloud-based solutions. This should include skillsets necessary to produce platform upgrades, application version hot fixes and updates, interface version updates, data pull requests/reports and best practices for application sustainment, as required. The Contractor shall provide personnel with skillsets necessary to support Azure, AWS, and AWSgov Cloud, GitHub Actions, and Jenkins. The Contractor shall provide personnel with skillsets in automating containerized microservices deployment using CI/CD pipelines. The mobile enterprise platform products include but not limited to support for:

• DHA Software Development Toolkit (SDK)

• Web services o Micro-services architectural principles and patterns o Service discovery and registration mechanisms o Inter-service communication patterns (e.g., REST, gRPC, messaging) o Distributed tracing and monitoring for micro-services o Event-driven architectures and message queues (e.g., Apache Kafka,)

• Application Programming Interfaces o Designing and developing RESTful APIs o API design principles and best practices (e.g., REST, OpenAPI Specification) o API gateway technologies (e.g., Amazon API Gateway, Kong, Apigee) o API authentication and authorization mechanisms (e.g., OAuth, JWT) o API versioning and deprecation strategies o API testing and documentation tools (e.g., Postman, Swagger) o API performance monitoring and optimization o GraphQL and its ecosystem

• Blockchain wallets

• Serverless functions

• Containerization o Containerization concepts and benefits o Container technologies such as Docker o Container orchestration platforms like Kubernetes and Docker Swarm o Container registries (e.g., Docker Hub, AWS ECR, Google Container Registry) o Container networking and storage o Container security best practices and tools o Container monitoring and logging solutions

1.5.6 Adherence to the Scaled Agile Framework (SAFe): The Contractor shall provide a team of resources with a blend of expertise and experience in the Scaled Agile Framework (SAFe). The team shall have a proven track record of implementing and adhering to SAFe principles and industry best practices, as well as commercial standards. The team shall have experience in implementing SAFe at an enterprise level, including experience with SAFe Portfolio, Program, and Team levels. The team shall be able to provide training, coaching, and mentoring to the client's staff as needed to ensure successful adoption of SAFe. The team shall also have experience in using SAFe tools and artifacts, such as the Program Increment (PI) Planning, System Demo, and Inspect and Adapt events. The team shall also be able to provide guidance on how to integrate SAFe with other methodologies and frameworks as needed.

1.5.7 Artificial Intelligence (AI) Tools & Large Language Models (LLMs) Integration: The Contractor may be expected to effectively integrate AI tools and Large Language Models (LLMs) in accordance with government regulations and with government approval.

1.5.8 Integration of Artificial Intelligence Tools into the Software Development Lifecycle:

The Contractor will be responsible for a complete overhaul of the existing software development lifecycle (SDLC) processes of the WMT software system, with the goal of integrating artificial intelligence (AI) tools for improved efficiency, accuracy, and overall quality.

1.5.9 DevSecOps Services and Requirements:

The contractor shall provide all necessary services to fully execute the DevSecOps model, including maturing the existing infrastructure, CI/CD pipeline, coding standards, security practices, non-functional requirements, documentation, and continuous monitoring and feedback.

The contractor shall also ensure compliance with industry best practices and relevant security standards and regulations.

1.6 Period of Performance (PoP):

Transition In: 7/1/25 – 7/31/25 Base: 8/1/25 – 7/31/26 Option Period 1: 8/1/26 – 7/31/27 Option Period 2: 8/1/27 – 7/31/28 Option Period 3: 8/1/28 – 7/31/29 Option Period 4: 8/1/29 – 6/30/30 Transition Out: 7/1/30 – 7/31/30

1.6.1 Transition: Transition-out period:

1.6.1.1 Transition-out period: The transition-out plan shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the contract. See Part 7, Technical Exhibit 1.

1.6.1.2.1 The Contractor shall comply with transition-out requirements of the DHA for contractors who have been issued a CAC or who generate “records”, as defined by DoD (records manual), including DoD-directed disposition of records, and others displayed on the In/Out (I/O) Processing Portal.

1.7 Administrative specifications

The work will be performed in Government furnished spaces in Falls Church, VA; San Antonio, TX; Aurora, CO; and Tacoma, WA. WMT will consider exceptions, though the Government cannot ensure availability of space apart from the locations mentioned. It is recommended that the majority of staff software engineers be located in Tacoma, WA. Other government offices so designated by the government, or The Contractor’s off-site facilities may be approved at the government’s discretion. Travel to other locations within the commuting area may be required by the mission.

1.7.1.1 Full time remote work may be authorized by the Contracting Officer Representative (COR) at the government’s discretion on a case by case basis. When approved, Contractor personnel must comply with responsiveness standards and specific deliverables that may be set by the government as long as standards and deliverables are applied equitably. Contractor personnel shall utilize the Virtual Private Network (VPN), use their Common Access Card (CAC) when performing remote work, and stay connected with teammates and government personnel through the use of the DoD-approved chat tool, such as Microsoft Teams. With remote work, periodic or occasional travel to the primary work site may be required at no additional expense to the government.

1.7.1.2 In accordance with (IAW) Federal Acquisition Regulation (FAR) 7.108, teleworking is allowed as permitted by the COR. Contractor must provide a copy of their company’s telework policy in advance, which must meet OPM guidelines for telework, and support the terms of this contract as determined by the CO. Contractor must have signed telework agreements in place for each contractor employee. Telework schedules, recurring or Ad Hoc, must be approved by COR or Project Manager before telework begins. Contractor personnel must comply with responsiveness standards and specific deliverables for telework periods that may be set by the government in order to ensure the privilege of teleworking is being utilized appropriately, as long as standards and deliverables are applied equitably. Contractor personnel shall utilize the Virtual Private Network (VPN), use their Common Access Card (CAC) when performing telework, and stay connected with teammates and government personnel through the use of the DoD-approved chat tool, such as Microsoft Teams. The government will not be responsible for any costs associated with travel related to performing telework under this contract.

1.7.2 Recognized Federal holidays:

The Contractor shall not be required to perform work on the following holidays, except at MTFs located around the world when required to do so by the Government.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: The Contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

Normal business operating hours are 7:30 am through 4:30 pm, local time of the employee’s assigned primary work site, Monday through Friday, with a 1 hour lunch break. Any variation to these standard operating hours must be established with the COR/PM on an individual basis.

Employees providing customer support in different time zones are expected to establish operating hours with the COR/PM that maximize their availability to customers. Flexibility of hours outside the established operating hours (e.g. to accommodate a particular project timeline, software upgrades, security patches, or unexpected system outages, etc.) is allowed only with advance approval of the COR/PM. For the purposes of availability and accountability, contractor personnel are expected to communicate any deviation, planned or unplanned, from their established operating hours prior to the occurrence when possible, or as soon as reasonable when not possible.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

On occasions such as natural disasters, pandemics, etc. or unplanned system outages, critical work timelines, etc., services may be required outside the normal duty hours. This work must be performed with approval of the COR/PM.

1.8 Contractor travel: Contractor travel outside of the local commuting area is not anticipated but may be required based on the need of the product supported. When required, travel may be within the Continental United States (CONUS) and/or Outside the Continental United States (OCONUS). Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of The Contractor. All travel and transportation shall utilize commercial sources and carriers. The Government will not pay for business class or first-class travel. Lodging and meals shall be reimbursed in accordance with regulations defined in FAR part 31 and the Joint Travel Regulations. Contractor shall be authorized travel expenses consistent with the cost principles and procedures in FAR Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR.

1.8.1 DHA Foreign Travel Requirements:

If OCONUS travel becomes necessary, The Contractor shall ensure that assigned participants allow sufficient lead-time to obtain valid passports, country clearances, and immunizations to support project activities. The Contractor shall travel using the lowest cost mode transportation commensurate with the mission requirements. When necessary to use air travel The Contractor shall use the tourist class/economy class. First class/business class tickets are not authorized. The Contractor shall comply with DHA Security foreign travel requirements, including but not limited to the filing of DHA Form 18, DoD Foreign Clearance Guide (FCG) found at, https://www.fcg.pentagon.mil/, for all travel outside the United States. The Contractor shall adhere to any specialized training requirements and country/theater clearance lead times as specified in the FCG and any associated Status of Forces Agreements. In the event The Contractor does not have .mil/.gov domain permissions they will be required to designate a person, subject to KO/COR approval, as an Executive Agent possessing DoD sponsorship to access the FCG via an APACS account (https://apacs.milcloud.mil) and able to access the FCG electronically for CONUS & OCONUS travel clearances.

The employee is required to comply with current DHA Security foreign travel reporting requirements during or upon return from foreign travel.

1.9 Other Direct Costs (ODC):

ODCs shall be billed on a cost-reimbursable basis. Costs are defined as the purchase price of materials or service plus related General and Administrative (G&A) charges or material and handling charges (M&H). G&A or M&H charges received by The Contractor are subject to periodic Government conducted Defense Contract Audit Agency (DCAA) audits and to adjustment as a result of the final contract closeout audit conducted by DCAA. Profit/fee on ODCs other than subcontracting is prohibited. When subcontracting is included as part of The Contractor’s technical approach a fixed profit/fee will be allowable, but shall not exceed the fixed fee contained in the final basic contract award. All ODCs shall be fully supported in compliance with all competition requirements of the FAR, specifically Part 31. All ODCs shall be reported in the Monthly Progress Report (MPR). ODCs will be identified by WMT and will consist of low quantities of domain names, servers, development equipment, hosting costs, travel, and software.

1.10 Quality

1.10.1 Quality Control (QC):

The government will evaluate The Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that The Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.10.2 The Contractor shall:

• Develop a single Quality Control Plan (QCP) that aligns to the QASP

• Consistently assess the state of compliance of the services with the schedule, quality, and performance requirements

• Take proactive steps to determine and implement improvements to the level of services delivered

• Provide personnel, tools, and processes to monitor, manage, and regulate performance and security and continuously optimize performance

• Provide a summary of QASP performance as part of Monthly Performance Progress

Report (MPPR)

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The Contractor shall return all CACs to the COR upon the departure of The Contractor(s).

1.11.2 Contractor onboarding and training. The Contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

(Government (DHA) requirements development staff must cut/paste onboarding checklist at https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf and embed most up-to-date form in Part 7, Section 7.1.2.)

1.11.2.3 The Contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4.

1.11.3 Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to The Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to The Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the

CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, The Contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due The Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due The Contractor.

1.11.4.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than The Contractor’s employees. The Contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in The Contractor’s

QCP.

1.12 Key personnel (Contractor): The Contractor shall provide personnel with the appropriate qualifications and credentials to perform the work at the highest level. The Contractor is required to provide the list of personnel designated to perform work under this contract with a copy of their resume for Key personnel that includes certifications, qualifications, and experience. Any certification and training required to maintain proficiency of contract employees throughout the period of performance is the responsibility of The Contractor. The Contractor shall provide Key personnel staffing at 95% or greater across the contract and ensure that no product ever is entirely unstaffed.

1.12.1 Program Manager (1 individual):

• Sufficient knowledge of the major applications and administrative tasks discussed in this PWS and the policies and operations of Department of Defense IT

• Possess Project Management Professional (PMP) certification

• Certified Scrum Master certification or Certified Scrum Product Owner certification

• ITIL 4 Certification

• DoD Healthcare IT experience preferred

• Minimum of 5 years of experience as a Program Manager, and have a full understanding of the Software Development Life Cycle

• Deep understanding of project management methodologies and best practices.

Should be able to manage complex programs with multiple work streams, and ensure that all projects are delivered on time, within budget, and with high quality.

• Able to lead and motivate teams of project managers, business analysts, and other stakeholders. Able to create a culture of collaboration and teamwork, and foster a sense of ownership and accountability among team members.

• Able to communicate effectively with stakeholders at all levels of the organization, including executives, project sponsors, and team members. Should be able to articulate program objectives, progress, and risks in a clear and concise manner.

• Experience managing budgets and financial resources. Should be able to develop financial models and forecasts, and ensure that all projects within the programs are delivered within budget.

• Change management skills: Experience managing organizational change, and be able to navigate complex political landscapes. They should be able to identify and mitigate risks associated with organizational change, and ensure that all stakeholders are engaged and informed throughout the change process.

• Demonstrated experience planning and managing multiple tasks

• Demonstrated experience for financial management of multiple projects

• Demonstrated technical management and supervisory experience

1.12.2 Senior Web Developer (1 individual):

• Expertise in web development technologies, such as HTML, CSS, JavaScript, and other web development languages and frameworks.

• Possess a deep understanding of web development standards and best practices, and be able to apply this knowledge to develop robust, scalable web applications, to include the Sitecore content management system.

• Proficiency in backend development: experience with server-side programming languages and frameworks. To include ASP.Net, ASP.Net MVC, C# and Java. Should be able to design and develop database schemas and work with backend frameworks such as Node.js or Django.

• Experience with front-end development frameworks such as React, Angular, or Vue.

Should be able to design and develop user interfaces that are both functional and visually appealing.

• Strong problem-solving skills: Should be able to identify and solve complex technical problems quickly and effectively. Should be able to troubleshoot issues and debug code efficiently.

• Leadership and mentoring skills: Should have strong leadership skills and be able to mentor and guide junior developers. Should be able to work effectively as part of a team and be able to communicate complex technical concepts to non-technical stakeholders.

• Demonstrated experience planning and managing multiple tasks

1.12.3 Senior Mobile Developer (1 individual):

• Proficient in programming languages such as Swift, Java, or Kotlin.

• Experience with mobile development frameworks such as React Native or Xamarin.

• Deep understanding of mobile development standards and best practices, and be able to apply this knowledge to develop robust, scalable mobile applications.

• Experience with designing mobile applications that adhere to mobile design patterns such as Material Design or Human Interface Guidelines.

• Able to design and develop user interfaces that are both functional and visually appealing.

• Able to identify and solve complex technical problems quickly and effectively.

• Able to troubleshoot issues and debug code efficiently.

• Experience with server-side programming languages such as PHP, Python, Ruby, or Java.

• Able to design and develop database schemas and work with backend frameworks such as Node.js or Django.

• Should have strong leadership skills and be able to mentor and guide junior developers.

• Able to work effectively as part of a team and be able to communicate complex technical concepts to non-technical stakeholders.

• Able to manage multiple projects and deadlines simultaneously.

• Should have experience with agile development methodologies and be able to lead project planning, estimation, and tracking efforts.

1.12.4 Senior SharePoint Developer (1 individual):

• Proficient in SharePoint development technologies, such as SharePoint Framework (SPFx), SharePoint Designer, SharePoint Add-ins, SharePoint REST API, and PowerShell.

• Deep understanding of SharePoint development standards and best practices, and be able to apply this knowledge to develop robust, scalable SharePoint solutions.

• Experience with SharePoint architecture and infrastructure, including SharePoint farm topology, service applications, web applications, and content databases.

• Able to design SharePoint solutions that are both performant and scalable.

• Be able to identify and solve complex technical problems quickly and effectively.

• Be able to troubleshoot issues and debug code efficiently.

• Experience with customizing SharePoint sites, lists, libraries, workflows, forms, and pages.

• Be able to develop custom SharePoint solutions that meet business requirements and adhere to SharePoint design principles.

• Should have strong leadership skills and be able to mentor and guide junior developers.

• Able to work effectively as part of a team and be able to communicate complex technical concepts to non-technical stakeholders.

• Able to manage multiple projects and deadlines simultaneously.

• Should have experience with agile development methodologies and be able to lead project planning, estimation, and tracking efforts.

1.12.5 Usability Manager (1 individual):

• Proficient in usability research methods such as user testing, surveys, card sorting, and heuristic evaluation.

• Have a deep understanding of the usability principles and best practices, and be able to apply this knowledge to improve the usability of digital products.

• Experience with UX design tools such as Sketch, Figma, Adobe XD, and InVisionMiro and Otter.ai.

• Able to create wireframes, prototypes, and mockups that effectively communicate design concepts and solutions.

• Able to identify and solve complex usability problems quickly and effectively.

• Able to apply creative problem-solving techniques to design user-friendly interfaces.

• Comprehensive knowledge of WCAG 2.1 and other Accessibility Standards.

• Able to design products that are accessible to users with disabilities.

• Possess strong leadership skills and be able to mentor and guide junior usability experts.

• Able to work effectively as part of a team and be able to communicate complex usability concepts to non-technical stakeholders.

• Able to manage multiple projects and deadlines simultaneously.

• Experience with agile development methodologies and be able to lead project planning, estimation, and tracking efforts.

• Hold a current professional UX Certification

1.12.6 Senior API Developer (1 individual):

• Proficient in API design principles, such as RESTful API design, API versioning, and API documentation.

• Possess a deep understanding of API best practices and be able to design APIs that are efficient, scalable, and easy to use.

• Proficient in programming languages such as Java, Python, or JavaScript, and have experience with API development frameworks such as Spring, Flask, or Node.js.

• Be able to write clean, maintainable code that adheres to industry standards and best practices.

• Experience with API security standards, such as OAuth 2.0, JWT, or API keys.

• Able to design APIs that are secure and protect user data from unauthorized access.

• Familiar with API testing tools and techniques, such as unit testing, integration testing, and API mocking.

• Able to write automated tests that ensure API functionality and performance.

• Possess strong leadership skills and be able to mentor and guide junior developers.

• Should be able to work effectively as part of a team and be able to communicate complex technical concepts to non-technical stakeholders.

• Be able to manage multiple projects and deadlines simultaneously.

• Experience with agile development methodologies and be able to lead project planning, estimation, and tracking efforts.

1.12.7 Mobile Enterprise Platform, Team Lead (1 individual):

• Strong background in software development, web technologies, and database design, with several years of experience in the field.

• Proficient in programming languages such as Java, Python, C#, or PHP, and have experience with web development frameworks such as Spring, Django, ASP.NET, or Laravel.

• Able to write clean, maintainable code that adheres to industry standards and best practices.

• Experience with database design principles, such as normalization, indexing, and data modeling.

• Proficient in SQL and have experience with database management systems such as MongoDB, PostgreSQL, or Microsoft SQL Server.

• Familiar with web technologies such as HTML, CSS, JavaScript, and jQuery.

• Able to create responsive and interactive user interfaces that provide an engaging user experience.

• Knowledge of web security principles, such as cross-site scripting (XSS), cross-site request forgery (CSRF), and SQL injection.

• Able to design and develop web applications that are secure and protect user data from unauthorized access.

• Familiar with web services and APIs, such as RESTful APIs or SOAP.

• Able to consume and integrate with external APIs to extend the functionality of their applications.

• Able to manage multiple projects and deadlines simultaneously.

• Experience with agile development methodologies and be able to lead project planning, estimation, and tracking efforts.

1.12.8 Cloud Solution Architect (1 individual):

• Experience as a Cloud Solution Architect with expertise in Azure, AWS, and AWSgov Cloud.

• Proficient in Node.js, Python, Angular, DevSecOps, GitHub Actions, and Jenkins.

• Experience in automating containerized microservices deployment using CI/CD pipelines.

• Strong background in security designs, requirements, testing, and risk mitigation.

• Proficient in DevOps tools and practices, including Docker, Kubernetes, Jenkins, and

AWS services.

• Experience in architecting and delivering cloud-based solutions.

1.13 Data rights:

The Government has unlimited rights to all data and documents/materials produced in the course of developing, deploying, training, using and supporting DHA under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by The Contractor without written permission from the Contracting Officer. All modifications to GOTS or COTS software, middleware, hardware, or source code will be the sole property of the Government. The Contractor will be required to negotiate agreements with commercial system vendors relating to non-disclosure of vendor-proprietary information. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Deliver all technical data (TD), computer software (CS), and computer software documentation (CSD) generated in the performance of this contract pursuant to DFARS 252.227-7027.

Additionally, deliver all commercial and non-commercial TD, CS, and CSD not generated in performance of this contract necessary, as determined by the Government at its sole discretion, to operate and sustain the system throughout its lifecycle.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of The Contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that The Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with The Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to The Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with The Contractor to review The Contractor's performance.

At these meetings the CO will apprise The Contractor of how the government views The Contractor's performance and The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.14.5 Monthly Performance Progress Report (MPPR): The Contractor shall prepare and submit the MPPR to the COR within 5 business days of the end of each month. The MPPR shall provide a listing of the weekly hours for each CLIN and a labor burn rate as of the end of each month. The MPPR shall also outline other deliverables submitted, problems encountered, and schedule deviations as well as other content The Contractor feels is prudent to report.

1.14.6 Lessons Learned: Contractor shall identify and communicate to the Government the lessons learned, along with changes planned, in response to lessons learned during the execution of this contract. A written report shall be provided with the Lessons Learned Meeting (including the agenda and meeting minutes) to be held quarterly. The purpose of these meetings is to imbed changes recommended by Contractor and the COR to continue quality enhancement and adherence to cost and schedule for the balance of the contract.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The Contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel.

Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The Contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when The Contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The Contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule…