Merit Gov requirements report

Prepared for plan start 2026-11-20 from attachment_j1_help_desk_pws.md, sample_sow.docx.

The short version

• 37 contractor obligations found in 2 documents: 13 requirements, 9 deliverables, 4 reporting items, 9 security items, 2 prohibitions. 3 Government responsibilities listed separately.
• 6 deliverables due in the next 30 days (by 2026-12-20). First up: Weekly ticket aging report on 2026-11-27.
• Compliance frameworks named: ATO, FISMA, FedRAMP, NIST SP 800-171, NIST SP 800-53, NIST SP 800-88, Section 508, WCAG; plus 4 FAR/DFARS clauses cited.
• Redacted 15 pieces of personal information (1 Social Security number, 3 email addresses, 3 phone numbers, 1 date of birth, 2 street addresses, 5 names). Keep pii_map_KEEP_PRIVATE.csv out of AI tools, email and shared drives.
• Schedule: 50% of finished tasks were on time (2 of 4); 1 open task past due (worst: T-021, 5 days late).

Obligations found

Every sentence that commits the contractor (shall, must, will provide/deliver/submit/maintain/ensure/perform/support, is required to, responsible for) is one row in obligations.csv. 15 obligations mention a deliverable (deliver, submit, report, plan, document).

Type	Count
Requirement	13
Deliverable	9
Reporting	4
Security	9
Prohibition	2
Government responsibility (not your task)	3

Deliverables due in the next 30 days (through 2026-12-20)

Due	Task	Deliverable	Owner	Rule	Source
2026-11-27	T-005	Weekly ticket aging report	Project manager	Weekly	attachment_j1_help_desk_pws.md PWS 2.3 Reporting
2026-11-27	T-032	Weekly Ticket Metrics	Project manager	Weekly	sample_sow.docx 4. Deliverables
2026-12-05	T-010	Transition-In Plan	Project manager	within 15 calendar days after award	sample_sow.docx 3.1.2
2026-12-18	T-030	Project Management Plan	Project manager	Within 20 business days after award	sample_sow.docx 4. Deliverables
2026-12-20	T-016	Monthly Service Desk Report	Project manager	Monthly; no later than the 10th business day of each month	sample_sow.docx 3.2 Service Desk Support
2026-12-20	T-031	Monthly Status Report	Project manager	Monthly	sample_sow.docx 4. Deliverables

Dates count from 2026-11-20 as the award/start date. Business days skip weekends but not federal holidays. Recurring items show their first occurrence.

Draft work plan

37 tasks in work_plan.csv, one per contractor obligation, grouped into phases. A deliverable is linked to up to 3 earlier tasks in its section, and anything 'after approval of' another deliverable is linked to that deliverable's task.

Phase	Tasks	Main owners
Transition-in	4	Project manager (3), ISSO / security lead (1)
Delivery	21	ISSO / security lead (8), Service desk lead (7), Data engineer (2)
Reporting	10	Project manager (9), ISSO / security lead (1)
Closeout	2	ISSO / security lead (1), Project manager (1)

Transition-in:

Task	What to do	Owner	Due	Depends on
T-009	Conduct a kickoff meeting with the COR within 10 business days after contract award	Project manager	2026-12-04	-
T-010	Submit a Transition-In Plan within 15 calendar days after award	Project manager	2026-12-05	T-009
T-011	Complete onboarding of all key personnel, including background investigation forms, within thirty (30) days of...	ISSO / security lead	2026-12-20	-
T-030	Deliver Project Management Plan	Project manager	2026-12-18	-

Delivery:

Task	What to do	Owner	Due	Depends on
T-001	Maintain an average speed to answer of 60 seconds or less for all help desk calls	Service desk lead	-	-
T-002	Staff the help desk with at least four Tier 1 analysts during core hours	Service desk lead	-	-
T-003	Maintain the help desk knowledge base	Service desk lead	-	-
T-007	Retain ticket records for three years in accordance with NARA guidance	Service desk lead	-	-
T-008	Do not store FEA records on personal devices	Project manager	-	-
T-012	Provide Tier 1 and Tier 2 help desk support from 7:00 a.m. to 7:00 p.m. Eastern Time, Monday through Friday	Service desk lead	-	-
T-013	Respond to priority 1 incidents within 1 hour of notification	Service desk lead	within 1 hour of notification	-
T-014	Resolve 80 percent of Tier 1 tickets on first contact	Service desk lead	-	-
T-015	Do not disclose ticket data containing personally identifiable information to any third party	ISSO / security lead	-	-
T-017	Host the FEA case management application in a FedRAMP Moderate authorized cloud environment	ISSO / security lead	-	-
T-018	Maintain 99.9 percent availability for all production hosting infrastructure, excluding scheduled maintenance windows	Cloud engineer	-	-
T-019	Perform database backups daily and test restoration quarterly	Data engineer	2026-11-21	-
T-020	Comply with FISMA and implement security controls in accordance with NIST SP 800-53 Rev. 5 at the moderate baseline	ISSO / security lead	-	-
T-021	Deliver a System Security Plan (SSP) within 45 days after contract award to support the Authority to Operate (ATO)	ISSO / security lead	2027-01-04	T-020
T-023	Ensure all contractor personnel complete annual security awareness training	ISSO / security lead	2027-11-20	-
T-024	Report all suspected security incidents to the FEA Security Operations Center within 1 hour of discovery	ISSO / security lead	within 1 hour of discovery	-
T-025	Ensure contractor systems that process controlled unclassified information meet NIST SP 800-171 and DFARS...	ISSO / security lead	-	-
T-026	Keep this record in a locked file	ISSO / security lead	-	-
T-027	Ensure all software and electronic content delivered under this SOW conform to Section 508 of the Rehabilitation Act...	Accessibility lead	-	-
T-028	Develop and deliver end-user training on the new case management application to up to 300 FEA staff	Training lead	-	-
T-029	Migrate legacy case records from the on-premises database to the cloud environment no later than March 31, 2027	Data engineer	2027-03-31	-

Reporting:

Task	What to do	Owner	Due	Depends on
T-004	Deliver a knowledge base quality review annually	Project manager	2027-11-20	T-003
T-005	Provide a weekly ticket aging report, delivered each Monday	Project manager	2026-11-27	-
T-006	Provide a customer satisfaction survey summary within 5 business days after the end of each quarter	Project manager	2027-02-18	T-005
T-016	Submit a Monthly Service Desk Report no later than the 10th business day of each month	Project manager	2026-12-20	T-013 T-014 T-015
T-022	Submit a Plan of Action and Milestones (POA&M) update quarterly	ISSO / security lead	2027-02-18	T-020 T-021
T-031	Deliver Monthly Status Report	Project manager	2026-12-20	T-030
T-032	Deliver Weekly Ticket Metrics	Project manager	2026-11-27	T-030 T-031
T-033	Attend a weekly status meeting with the COR	Project manager	2026-11-27	-
T-034	Provide a quarterly program review briefing to FEA leadership	Project manager	2027-02-18	T-033
T-035	Provide an annual customer satisfaction survey summary	Project manager	2027-11-20	T-033 T-034

Closeout:

Task	What to do	Owner	Due	Depends on
T-036	Submit a Transition-Out Plan no later than 90 calendar days before the end of the period of performance	Project manager	2027-07-02	-
T-037	Return all Government-furnished equipment and sanitize all Government data in accordance with NIST SP 800-88 within...	ISSO / security lead	within 30 days after contract completion	-

Response times and event-driven deadlines

These have a deadline tied to an event (an incident, a request, the end of the contract) rather than a calendar date. Build them into your procedures and alerts.

Task	What to do	Deadline rule	Owner
T-013	Respond to priority 1 incidents within 1 hour of notification	within 1 hour of notification	Service desk lead
T-024	Report all suspected security incidents to the FEA Security Operations Center within 1 hour of discovery	within 1 hour of discovery	ISSO / security lead
T-037	Return all Government-furnished equipment and sanitize all Government data in accordance with NIST SP 800-88 within...	within 30 days after contract completion	ISSO / security lead

Compliance frameworks and clauses

Framework or clause	Obligations	Obligation IDs	Paragraphs mentioning
ATO	1	OBL-021	1
DFARS 252.204-7012	1	OBL-025	2
FISMA	1	OBL-020	1
FedRAMP	1	OBL-017	1
NIST SP 800-171	1	OBL-025	1
NIST SP 800-53	1	OBL-020	1
NIST SP 800-88	1	OBL-037	1
Section 508	1	OBL-027	1
WCAG	1	OBL-027	1
FAR 52.204-21	0		1
FAR 52.224-3	0		1
FAR 52.239-1	0		1

A framework can be named in a clause list without any obligation sentence pointing at it; those show 0 obligations but still apply.

What the Government has committed to

Not your tasks, but your schedule may depend on them. Track them and raise delays with the COR in writing.

ID	Section	Commitment	Due
GOV-001	PWS 2.4 Definitions	The Government will provide office space for two on-site analysts at [ADDRESS-1].	-
GOV-002	5. Government Responsibilities	The Government shall provide the contractor with remote access to the FEA network and necessary system accounts within 10 business days after award.	2026-12-04
GOV-003	5. Government Responsibilities	The COR will provide written comments on each deliverable within 10 business days of receipt.	within 10 business days of receipt

Personal information redacted

Type	Distinct items	Times redacted
Social Security numbers	1	1
Email addresses	3	3
Phone numbers	3	3
Dates of birth	1	1
Street addresses	2	2
Personal names	5	5

pii_map_KEEP_PRIVATE.csv links every token back to the real value. Do not paste it into ChatGPT, Claude or any other AI tool, do not email it, and do not store it next to the redacted copies. Share the files in redacted/ instead.

We look for SSNs (###-##-####), email addresses, US phone numbers, dates of birth next to DOB or date of birth, street addresses, and names after Mr./Ms./Mrs./Dr. or after POC:, Contracting Officer:, COR: or Name:. Names written any other way are not caught: skim the redacted copy before sharing it.

Schedule variance

8 tracker rows read, 7 matched to the work plan; 50% of finished tasks on time (2 of 4); late finishes averaged 3.5 days; 1 open task past due.

Task	Tracker title	Status	Due	Days late
T-021	System Security Plan	In Progress	2026-11-15	5

Finished late:

Task	Tracker title	Due	Completed	Days late
T-010	T-010 Submit Transition-In Plan	2026-10-16	2026-10-20	4
T-011	Complete onboarding of key personnel and background investigation forms	2026-10-31	2026-11-03	3

1 tracker row did not match any work plan task (see variance.csv). Put the T-### task ID in the title or a label to match exactly.

30 work plan tasks have no matching tracker item: T-001 T-002 T-003 T-004 T-005 T-006 T-007 T-008 T-012 T-013 T-014 T-015 T-017 T-018 T-019 T-020 T-022 T-023 T-024 T-025 T-026 T-027 T-028 T-030 T-031 T-032 T-034 T-035 T-036 T-037. Each one is an obligation nobody is tracking yet.

What we read

File	Type	Paragraphs and table rows	Sentences	Obligations	Government items
attachment_j1_help_desk_pws.md	Markdown	10	14	8	1
sample_sow.docx	Word	37	38	29	2

• Period of performance found: 2026-10-01 to 2027-09-30; used for 'days before the end of the period of performance' deadlines.
• jira_export.csv: 8 task rows read, 1 exact duplicate row(s) dropped, 1 row(s) had a date we could not read (treated as blank)

Limits

Obligations are found by keywords, not by reading for meaning: check conditional or cross-referenced requirements in the source, and treat the work plan, owners and dates as a first draft. Dates assume 2026-11-20 is the award/start date. Legacy .doc and PDF files are not read; save them as .docx.