040ADV-24-R-0051.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF 4

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER

040ADV-24-R-0051

6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

06/24/2024 14:00

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: 0 % FOR:

SMALL BUSINESS WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

11. DELIVERY FOR FOB DESTINA-

12. DISCOUNT TERMS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

SMALL BUSINESS PROGRAM

EDWOSB

8 (A)

13b. RATING

NAICS:

SIZE STANDARD:

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO

See Schedule

CODE 16. ADMINISTERED BY CODE

Same As Issuing Office

17a. CONTRACTOR/

OFFEROR

CODE FACILITY

CODE

18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

OFFER BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF. OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

36. PAYMENT

COMPLETE PARTIAL FINAL

37. CHECK NUMBER

PARTIAL FINAL

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

040ADV-24-R-0051

Contents

SECTION - B – SUPPLIES/SERVICES AND PRICE

B.2 REQUIRED SERVICES

B.3.2 - Option Period 1 Contract Line Item (FFP & LH Surge CLINS) Contract Line Item (FFP & LH Surge CLINS) Contract Line Item (FFP & LH Surge CLINS) B.3.6 – SURGE CLIN(s) LANGUAGE:

SECTION C - DESCRIPTION/STATEMENT OF WORK

C.2 Contractor Tasks and Specifications C.2.1 - Task 1 –Support

C.3. LABOR CATEGORIES AND ROLE-BASED SPECIFICATIONS

C.3.1 - System Administrator Responsibilities:

GovInfo Infrastructure Components and Technologies:

Experience:

C.3.2 – Site Reliability Engineer Responsibilities:

GovInfo Build, Source Code Management, and Testing Components and Technologies:

Experience:

GovInfo Application Security Engineer Components and Technologies:

Experience:

C.3 Government Furnished Equipment C.4 Post Award Conference Section E – Inspection and Acceptance E.2 Responsible Officials E.3 Scope of Inspection E.4 Basis of Acceptance E.5 General Acceptance Criteria E.6 Inspection and Approval of Written Deliverables E.6.2 Approval of Written Deliverables SECTION F – Deliveries or Performance F.2 Performance Measures F.3 Place of Performance and Hours of Work F.4 Deliverables:

Section G – Contract Management Contracting Officer (CO) Contract Specialist (CS) Contracting Officer’s Authority G.2 Contracting Officer’s Representative (COR) G.3 Invoice Submission Section H – Special Requirements H.2 Compliance with Section 508 of the Rehabilitation Act of 1973 H.3 Key Personnel

040ADV-24-R-0051

H.4 Supervision of Contractor’s Employees H.5 Removal of Contractor Personnel H.6 Organizational Conflict of Interest (OCI) H.7 Contractor Personnel Security and Suitability Requirement H.8 Wants Warrants Investigation H.9 Observance of Legal Holidays / Federal Non-Work Days H.10 Inclement Weather H.11 Government Delays H.12 U.S. Government Publishing Office Non-Disclosure Agreement Section I – Contract Clauses 52.212-5, Contract Terms and Conditions Required to Implement Statutes and Executive Orders – Commercial Items (May 2002) I.2. MMAR Clauses Incorporated by Full Text 52.217-8 Option to Extend Services (Nov 1999) Evaluation of Option to Extend Services MMAR 52.217-8 52.217-9 Option to Extend the Term of the Contract (MMAR - Mar 2000) 52.227-18 Rights in Data-Existing Works (Dec 2007) 52.227-22 Major System-Minimum Rights (Jun 1987) 52.227-23 Rights to Proposal Data (Technical) (Jun 1987) 52.232-18 Availability of Funds (Apr 1984)

52.233 Service of Protest (Aug 1996)

Disputes (GPO Clause June 2008) 52.243-1 Changes—Fixed-Price (Aug 1987) 52.245-2 Government Property (Fixed-Price Contracts) (Dec 1989) Section J – Attachments L.1.2 Questions or Clarifications L.1.3 Proposal Content General Format Instructions Technical Proposal and Past Performance (Volume I) Price Proposal (Volume II) Section M – Evaluations:

M.1.1 Evaluation Adjectival Approach Rating Descriptions M.1.2 Evaluation Factors and Ranking Evaluation Factor 1: Technical Capability Sub-Factor 1A: Personnel and Staffing Plan Sub-Factor 1B: Relevant Knowledge and Experience Sub-Factor 1C: Management Approach Factor 2: Past Performance Factor 3: Price Proposal The Offeror’s price proposal shall consist of the following:

SYSTEM ADMINISTRATION AND SUPPORT

SECTION - B – SUPPLIES/SERVICES AND PRICE

B.1 ITEMS BEING ACQUIRED

This requirement is intended to provide System Administration and Support, Services and Information Technology (IT) Solutions for the Government Publishing Office’s GovInfo Program.

The contractor(s) shall furnish solutions, personnel, and services and otherwise do all items necessary for, or incident to, performance of these requirements in accordance with the statement of work (SOW) provided in Section C.

B.2 REQUIRED SERVICES

The Government Publishing Office intends to issue a Firm Fixed Price contract for support services and Information Technology solutions for the GovInfo Program. The work shall be provided in accordance with the Statement of Work (SOW) and with the terms and conditions set forth herein.

B.3 PRICING SCHEDULE & (CLINs)

B.3.1 - Base Period:

CLIN Description

Support:

0001 Support (Task 1, Firm Fixed Price)

9999 Surge (Labor Hours, NTE Hours for all labor Categories is 320 hours)

Contract Line Item (FFP & LH Surge CLINS)

Labor Category

Quantity Firm Fixed Price for Task

Surge CLIN:

Labor Hours

Hourly Rates for Surge

CLINS

Total Price Surge

System Administrator 2 NTE 160hrs $

Site Reliability Engineer

NTE 80hrs $

Application and System Security Engineer

NTE 80hrs $

TOTALS 4

TOTAL PRICE BASE PERIOD CLIN(s): $

B.3.2 - Option Period 1

1001 Support (Task 1, Firm Fixed Price)

9999 Surge (NTE Hours for all labor Categories is 320 hours)

Price for Task

Surge CLIN:

Labor Hours

Hourly Rates for Surge

CLINS

Total Price Surge

System Administrator 2 NTE 160hrs $

Site Reliability Engineer

NTE 80hrs $

Application and System Security Engineer

NTE 80hrs $

TOTAL PRICE OPTION PERIOD 1 CLINs: $

B.3.3 - Option Period 2:

2001 Support (Task 1, Firm Fixed Price)

9999 Surge (NTE Hours for all labor Categories is 320 hours)

Price for Task

Surge CLIN:

Labor Hours

Hourly Rates for Surge

CLINS

Total Price Surge

System Administrator 2 NTE 160hrs $

Site Reliability Engineer

NTE 80hrs $

Application and System Security Engineer

NTE 80hrs $

TOTAL PRICE OPTION PERIOD 2 CLINs: $

B.3.4 - Option Period 3:

3001 Support (Task 1, Firm Fixed Price)

9999 Surge (NTE Hours for all labor Categories is 320 hours)

Price for Task

Surge CLIN:

Labor Hours

Hourly Rates for Surge

CLINS

Total Price Surge

System Administrator 2 NTE 160hrs $

Site Reliability Engineer

NTE 80hrs $

Application and System Security Engineer

NTE 80hrs $

TOTAL PRICE OPTION PERIOD 3 CLIN(s): $

B.3.5 - Option Period 4:

4001 Support (Task 1, Firm Fixed Price)

9999 Surge (NTE Hours for all labor Categories is 320 hours)

Price for Task

Surge CLIN:

Labor Hours

Hourly Rates for Surge

CLINS

Total Price Surge

System Administrator 2 NTE 160hrs $

Site Reliability Engineer

NTE 80hrs $

Application and System Security Engineer

NTE 80hrs $

TOTAL PRICE OPTION PERIOD 4 CLIN(s): $

B.3.6 – SURGE CLIN(s) LANGUAGE:

CLIN-9999, (Surge CLIN) task is intended to be exercised for support outside of normal business hours (e.g., weeknights, weekends, or holidays), as required by GPO. This will be a Labor Hours type task. The table below outlines the total maximum of hours for each labor category, per year, for the Surge Task:

Labor Category Not To Exceed Hours (NTE) Tasks Being Performed

Site Reliability Engineer 80-Hours, (LH) Tasks under section C.2.2

System Administrator 160-Hours, (LH) Tasks under section C.2.1

Application and System Security Engineer

80- Hours, (LH) Tasks under section C.2.3

In accordance with MMAR PART 17.202-90 - the Government may require surge support during the base or any option period, and surge modifications will be in-scope to provide increased support for the defined task areas of this SOW. Surge support is OPTIONAL and is not a guarantee. If the Government determines that an increased quantity of support is required for the task areas defined/illustrated under the above referenced table, the Government reserves the right to exercise the Surge Option unilaterally. The Contracting Officer will provide written notice to the Contractor at in a reasonable time prior to any unilateral exercise of the Surge Option. Surge support will be provided at the same labor rates proposed and found fair and reasonable at time of contract/task order award for the applicable ordering period. No overtime or Holiday pay will be allowed under any of the Surge CLINS.

The System Administrator Labor Category may be asked to perform the following activities:

• Scheduled Maintenance Activities

• Production Release Support

• Emergency Security Support

• Critical Functionality Support

The Application and System Security Engineer Category may be asked to perform the following activities:

• Troubleshooting and support to prevent or respond to a compromised or potentially compromised system

• Support to fix critical vulnerabilities

The Site Reliability Engineer may be asked to perform the following activities:

• Support testing, builds, and deployments after hours

• Critical Functionality Support

SECTION C - DESCRIPTION/STATEMENT OF WORK

C.1 Background, Scope, and General Requirements

GovInfo is a content management system, preservation repository, and public website that manages, preserves, and provides free online access to current and historical information from the legislative, executive, and judicial branches of the United States Federal Government today and into the future. Please refer to the System Architecture document at https://www.govinfo.gov/media/GovInfo_Architecture_v7.pdf and the GovInfo Components and Technologies document https://www.govinfo.gov/media/GovInfo_Components_and_Technologies.pdf for additional technical information along with the GovInfo About pages at https://www.govinfo.gov/about for a user-focused description of the public access website.

The mission of the GovInfo program (“Program”) is to provide the knowledge, tools, and processes to manage, preserve, and provide access to electronic Federal Government information. The vision of the Program is to operate an effective software development program that delivers value for stakeholders. Program values include the following:

• Agility – Adapting and Adjusting to Change

• Reliability – Consistently Delivering Results

• Collaboration – Working Together to Achieve Our Goals

• Innovation – Implementing New Solutions

FY24-28 Strategic Goals for the Program include the following:

• Deliver Results for Stakeholders.

• Continuously Improve the User Experience

• Support the System and Our Users

• Refine Our Software Development Processes

• Evaluate and Implement Innovative Technologies

• Commit to Preservation and Assessment

• Perform Program Management Functions

In addition to performing operational support tasks, GPO undertakes key efforts for each strategic goal based upon agency priority and identified stakeholder need. A few examples that demonstrate the breadth of historical key efforts for the Program include developing the GovInfo website and replacing the FDsys website, replacing the legacy search engine with Solr, upgrading the Documentum Content Server and WebTop, migrating to GitLab and Jenkins, providing access to Bill Status XML Bulk Data, performing a hardware refresh at the Production and Continuity of Operations instances, providing public access to the Digitized Serial Set and Congressionally https://www.govinfo.gov/media/GovInfo_Architecture_v7.pdf https://www.govinfo.gov/media/GovInfo_Components_and_Technologies.pdf https://www.govinfo.gov/about

Mandated Reports, and performing bug fixes and enhancements based on user feedback and stakeholder need.

To implement key efforts, the Program release cycle typically includes four planned quarterly releases each fiscal year. Each release includes planning, development, integration, and testing activities that are performed during sprints in the Integration, Quality Assurance, and Stage environments followed by one week of activities to deploy to the Production and Continuity of Operations environments. Interim deployments are performed on an as-needed basis, and the Program envisions moving to a more rapid release cycle. Operational support tasks to monitor the system and provide corrective and adaptive maintenance are performed each day.

The Program is currently composed of multiple virtual teams that perform GovInfo development and support activities. Teams generally employ either agile Scrum or Kanban practices based on the scope of work to be performed by each team. Generally, and as applicable for each team, the role of Product Owner is performed by GPO personnel and the rest of the team is comprised of contracted development and support team members.

C.2 Contractor Tasks and Specifications

The sections below include tasks to support the custom code, commercial off the shelf (COTS) software, and open-source technologies that comprise the GovInfo Infrastructure services, as defined in the GovInfo Components and Technologies document https://www.govinfo.gov/media/GovInfo_Components_and_Technologies.pdf.

C.2.1 - Task 1 –Support

The contractor shall provide support services in the specified roles in Section C.3, including corrective or adaptive maintenance tasks for existing components and technologies.

The GovInfo Program requires development and support activities as specified in Section C.3.

Contractors shall employ Agile practices and frameworks (e.g., Scrum, Kanban) based on the scope of work to be performed by each team, and as directed by GPO. Generally, and as applicable for each team, the roles of Product Owner and ScrumMaster are performed by GPO personnel and rest of the team is comprised of contracted development and support team members.

https://www.govinfo.gov/media/GovInfo_Components_and_Technologies.pdf

C.3. LABOR CATEGORIES AND ROLE-BASED SPECIFICATIONS

The following section outlines the type and number of personnel required for successful performance of tasks. The following role-based specifications outline the responsibilities, technological competencies, experience, and education for each of the labor category that provides IT solutions for the GovInfo Program.

Contractor teaming agreements are welcomed.

Labor Category – System Administration and Support

Quantity

System Administrators 2 Site Reliability Engineer 1 Application and System Security Engineer 1

C.3.1 - System Administrator

System Administrators are primarily responsible for hardware, application, and system administration support for all instances of GovInfo.

Responsibilities:

• Work as a member of the Infrastructure Team or other cross-functional teams as needed to support the GovInfo Program, and as necessary, provide off-hours support to ensure continued availability and functionality of the system. NOTE: The System Administrator position may be asked to support either 2nd or 3rd shift upon the request of the COR, and System Administrators may be asked to rotate through being on-call on weekends and holidays to ensure system availability. One System Administrator may be asked to perform the duties of a Lead System Administrator for internal and external team coordination and architecture updates.

• As a Red Hat Certified System Administrator (RHCSA) or Red Hat Certified Engineer (RHCE), serve as the Red Hat Enterprise Linux (RHEL) expert for GPO’s GovInfo by implementing, administering, and maintaining the GovInfo Linux servers to support day-to-day operations including Red Hat Satellite Server administration and the application of patches and security updates.

• Support and maintain the GovInfo environments including Production, COOP, Stage, QA, Integration, Utilities, Experimental, and Sandbox or successor environments.

• Support the development and implementation of GovInfo functionality and hardware refresh cycles including installation of new or modified hardware, operating systems, configurations, and software applications.

• Manage GovInfo accounts, network rights, and access to systems and equipment; and ensure the rigorous application of information security policies, principles, and practices in the delivery of expert GovInfo system administration functions.

• Develop and document GovInfo system administration standard operating procedures and maintain systems configurations.

• Install and maintain infrastructure-supporting services and applications, including monitoring, documentation, updates, and availability. This includes but is not limited to:

identity management, analytics applications, mail, antivirus, backup, and log management.

• Resolve GovInfo hardware-software interface and interoperability issues and ensure GovInfo availability, functionality, integrity, and efficiency.

• Configure and administer the GovInfo Apache Web servers.

• Implement security procedures and tools including configuring and updating systems to ensure security against intrusion and resolve security vulnerabilities.

• Serve as a RHEL subject matter expert by collaborating with development and management to meet infrastructure requirements for GovInfo environments.

• Maintain the GovInfo open-source code repository and implement configuration management, orchestration, data aggregation, and monitoring solutions for GovInfo.

• Administer custom scripts and applications for GovInfo to manage system resources including performance, capacity, availability, serviceability, and recoverability by administering centralized custom logging, monitoring, and alerting services.

• Work with GPO network personnel to ensure network availability and access for both internal and external GovInfo usage including monitoring internal and external traffic.

• Serve as a subject matter expert in designing and implementing virtualization of GovInfo environments.

• Provide expertise and overall management of critical system automation and service orchestration activities through the use of Ansible or successor technologies.

• Manage centralized user credentials and 2FA through the use of Identity Management (IdM).

• Experience using version control software for issue management and code/documentation repositories with gitlab, Azure DevOps, or successor technologies.

• Perform Build Master / Software Quality Engineer tasks when staff are unavailable or as needed.

• Remedy issues identified through IT Security scanning and penetration testing.

• If an intrusion by an unauthorized party is detected, or a security incident is detected, the contractor will notify the GPO Computer Security Incident Response Team (GPO CSIRT) via email at: itsecgp@gpo.gov.

• Ensure system passes GPO CIS-CAT OS and server scans, network and application scans (or any internal or external vulnerability or penetration detection tools as coordinated by GPO IT) with no High or Medium Risk issues present. These scans will be executed using GPO tools with the report output being provided to the contractor for resolution action on any High or Medium issues detected.

• Lead infrastructure initiatives and provide technical expertise in designing infrastructure and storage solutions for GovInfo based on expert knowledge of current industry best practices and available technologies.

• Work in conjunction with GovInfo teams to provide infrastructure support for Repository, Search, Processor, Database, and Web components and functionality including during system installation, patching, upgrade, testing, deployment, and COOP failover/failback activities.

• Create automated tests to support all applicable levels of the test pyramid.

GovInfo Infrastructure Components and Technologies:

The following is a high-level list of GovInfo components and technologies that apply to the specific responsibilities of the System Administrator:

• NetApp Filers, DataONTAP, SnapMirror, Flexclone, Cluster-Mode, RAID-DP

• HP Gen10+ Synergy Blades, Synergy Frames, and monitoring, or successor hardware mailto:itsecgp@gpo.gov

• Enterprise Linux, current and future versions, including security-focused versions

• OS package and license management tools

• Apache Web Server

• Open source application servers and servlet containers (e.g. Tomcat, Jboss)

• Virtualization/container tools including VMware, vSphere, Docker, Kubernetes

• AWS or Azure Federal Cloud (possible future but will require re-architecting major components)

• Hardware and software load balancers, networking, DNS, common enterprise network hardware

• Common open source products for analyzing data in real time, common open source monitoring tools, common open sources administration automation tools (e.g. Splunk, Prometheus, Ansible)

• GNU/Linux, Shell Scripts, NFS

• Load testing, Apache Jmeter

• Java-based applications

• Application Performance Management (APM) such as AppDynamics or New Relic (possible future)

• SSL, HTTPS, standard COTS AV with AV API interface, and EV Certificates

• Account Management Tools such as Active Directory, LDAP 3 Compliant Application Directories, identity management

• FTP, SFTP, SSH

• SMTP Penetration Testing, Vulnerability Prevention, DDOS Mitigation, CIS-CAT, Cloudflare

Experience:

• Relevant experience with GovInfo technologies referenced in the section above.

• 7 years’ experience as a Red Hat Certified System Administrator (RHCSA) or Red Hat

Certified Engineer (RHCE) implementing, administering, and maintaining servers including

• Installing new or modified existing hardware, operating systems, configurations, and software applications.

• Applying patches and security updates.

• Managing accounts, network rights, and access to systems and equipment.

• Resolving hardware-software interface and interoperability issues.

• Manage system resources including performance, capacity, availability, serviceability, and recoverability.

• Experience leading infrastructure initiatives and providing technical expertise in designing infrastructure and storage solutions.

• Experience with traditional waterfall and agile software development lifecycle methodologies including Scrum and Kanban.

• Experiencing authoring, editing, and maintaining design documentation, standard operating procedures, and system configuration documentation.

• Knowledge of GovInfo content, metadata, and architecture.

• Knowledge of Federal legislative, regulatory, and judicial processes and publications.

• Knowledge of ISO 14721 OAIS and ISO 16363 TDR.

• Must be able to fluently communicate in the English language, in writing and orally.

• Experience with DevOps, test driven development, and test automation for all levels of the test pyramid.

C.3.2 – Site Reliability Engineer The role of Site Reliability Engineer (SRE) is a senior engineering and technical role that is focused on influencing, shaping, and managing the systems and processes that are relied upon for building and deploying the GovInfo application and constituent parts.

Responsibilities:

• Work as a member of the team to support the GovInfo Program, and as necessary, provide off-hours support to ensure continued availability and functionality of the system.

• Serve as the build and SCM expert for GPO's GovInfo by overseeing the build process through automated scripts (e.g. Maven, Jenkins), dependency management (e.g. Nexus), environment configurations (e.g. Ansible), and source code management (e.g. Azure DevOps, GitLab).

• Coordinate with the GPO IT Configuration Management Branch to manage the GovInfo source code repository and source code management tools.

• Perform builds and deployments at specified intervals to all environments.

• Create and update automated deployment scripts as necessary.

• Provide oversight for and resolution of issues related to source code management processes such as for example, branching, merges, merge requests, and merge conflicts.

• Develop templates and automated hooks to enable best practices within the SCM, build, and testing ecosystem (e.g. commit messages, code review approvals, code quality reviews)

• Serve as the automated testing expert for GovInfo by developing and enhancing an automated test framework and creating automated test cases to support development across all components.

• Coordinate with the GovInfo Test Manager and Test Team to perform System Integration Testing in the Stage environment and coordinate with the Development Team and Program staff members to perform automated testing in Integration and QA environments.

• Coordinate with Development Teams and Infrastructure Team to perform performance testing and monitor application performance as needed across environments.

• Develop and document GovInfo build, source code management, dependency management, code quality management, environment configurations, and automated testing standard operating procedures and configurations.

• Work in conjunction with GovInfo teams to provide build, source code management, automated testing, deployment, and operational support for all GovInfo components including Infrastructure, Search, Processor, Repository, and Web components and functionality including process documentation and during system testing, deployments, and COOP failover/failback activities.

• Create automated tests to support all applicable levels of the test pyramid.

• Provide technical input to stakeholders and GovInfo team members to ensure new functionality and enhancements to existing functionality are built to align with GovInfo' s architecture.

• Monitor, evaluate, recommend, and implement components, technologies, and upgrades to ensure the GovInfo Program in implementing the technologies that are most appropriate and secure to carry out its mission.

GovInfo Build, Source Code Management, and Testing Components and Technologies:

The following is a high-level list of GovInfo components and technologies that apply to the specific responsibilities of the SRE:

• Git, GitLab EE, GitLab/TFS Integration, Azure DevOps, common and standard open source software build automation tools and IDEs, common open source administration automation tools including Jenkins, Maven, Nexus Artifact Repository, Ansible, and Eclipse

• Trello

• Apache Jmeter

• Current and future supported versions of Selenium, TestingNG, mnit

• Custom Applications in Java EE, current supported versions and future versions

• Unix, Shell Scripts

• Enterprise Linux, current and future versions, including security-focused versions

• OWASP

Experience:

• Relevant experience build, source code management, and testing technologies, including

Eclipse, Maven, Nexus Artifact Repository, GitLab, Azure DevOps, Jenkins, and Ansible.

• 2 years of experience working in a continuous integration environment including

• Demonstrated experience working with GIT source code management tools.

• Demonstrated experience creating test cases using automated test frameworks and tools, such as Cucumber and JBehave.

• Demonstrated experience managing a continuous integration and delivery application.

• Demonstrated experience creating and managing deployment scripts.

• 7 years of relevant experience architecting, building, maintaining, troubleshooting, and enhancing Java EE custom applications and services.

• Relevant experience leading software engineering efforts or software development teams.

• Experience with test driven development.

• Experience with traditional waterfall and agile software development lifecycle methodologies including Scrum and Kanban.

• Experiencing authoring, editing, and maintaining design documentation, standard operating procedures, and configuration documentation.

• Knowledge of GovInfo content, metadata, and architecture.

• Knowledge of Federal legislative, regulatory, and judicial processes and publications.

• Knowledge of ISO 14721 OAIS and ISO 16363 TDR.

• Must be able to fluently communicate in the English language, in writing and orally.

C.3.3 – Application and System Security EngineerThe Application and Systems Security Engineer is a multifaceted role that combines the strengths and responsibilities of an Application Security Engineer, a Systems Security Engineer, and an overall Penetration Tester and security vulnerability expert. As an Application and Systems Security Engineer, this role will work with the GovInfo Program teams and GPO IT and IT Security staff to continuously identify and mitigate security issues, as well as coordinate across teams to provide suitable evidence and documentation for security related activities. In the event of a cyberattack or other form of IT security related vulnerability identification, the Application and Systems Security Engineer will lead efforts to identify issues/breaches and bring the vulnerability to resolution.

Responsibilities:

• Work as a member of the Infrastructure Team or other cross-functional teams as needed to support the GovInfo Program, and as necessary, provide off-hours support to ensure continued security availability and mitigation of high priority / identified vulnerabilities within the system.

• Manage GovInfo system security, including serving as responsible official for virus/malware incidents and coordination of responses with IT&S to correct any security events or intrusions.

• Takes steps to reduce the likelihood of security incidents and compromises of malware outbreaks through software testing.

• Plan, design and implement software and associated processes to reduce and prevent cyber threats.

• Perform internal and external vulnerability tests and threat assessments as directed by PST management, including non-destructive penetration testing, through the use of industry standard tools including but not limited to Kali Linux.

• Perform scans of code dependencies (i.e. OWASP) and provide output into appropriate channels for developer triage, analysis, and mitigation.

• Management of Risk Management Framework software, including documentation, updates, and artifact collection.

• Assembly, reporting, and monitoring of security vulnerabilities/CVEs through issue management system such as gitlab, Azure DevOps, or successor technologies.

• Liaison for coordinated audits and penetration testing with IG’s office and in coordination with IT&S.

• Performs password complexity checks within PST for federal and contracted staff to ensure compliance with security standards.

• Ability to prepare and deliver security briefings for senior staff at GPO and Congressional staff as required

• Develops security documentation for GovInfo consistent with GPO policies and directives and ensures the system meets security assessment and operational requirements in accordance with security and intrusion standards associated with GPO and Federal information systems security protocols, including but not limited to ISO 27001, NIST 800- 53 and related activities, system security plans and any required documentation for IT Security in reference to preparing an Authority to Operate. This includes management of the Risk Management Framework and the implementation and collection of the appropriate security controls

• Support and maintain security related activities across the GovInfo environments including Production, COOP, Stage, QA, Integration, Utilities, Experimental, and Sandbox or successor environments.

• Ensure the rigorous application of information security policies, principles, and practices in the delivery of GovInfo features with security implications.

• Develop and document FDsys system security standard operating procedures and maintain any related security settings and systems configurations.

• Implement security procedures and tools including configuring and updating systems to ensure security against intrusion and resolve security vulnerabilities.

• Remedy issues identified through IT Security scanning and penetration testing.

• If an intrusion by an unauthorized party is detected, or a security incident is detected, the contractor will notify the GPO Computer Security Incident Response Team (GPO CSIRT) via email at: itsecgp@gpo.gov.

• Ensure system passes GPO CIS-CAT OS and server scans, McAfee Vulnerability Manager (MVM) system scan and McAfee Secure network and application scan (or any internal or external vulnerability or penetration detection tools as coordinated by GPO IT) with no High or Medium Risk issues present. GPO will execute these scans using GPO tools with the report output being provided to the contractor for resolution action on any High or Medium issues detected.

• Work in conjunction with GovInfo teams to provide security support and vulnerability mitigation for Systems, Repository, Search, Processor, Database, and Web components and functionality including during system installation, patching, upgrade, testing, deployment, security scanning, and COOP failover/failback activities.

• Ensure public and internal applications, APIs, and services are designed, developed, implemented, and monitored in accordance with applicable security controls related to NIST 800-53, ISO 27001, and GPO IT Security policies.

• Provide evidence and construct deliverables, documentation, and reports to support all security activities, scans, vulnerabilities, mitigations, and identified IT Security initiatives and standards.

• Coordinate and perform quality assurance activities, applying security best practices for code development.

mailto:itsecgp@gpo.gov

• Work with Software Quality Engineer to ensure that dependency libraries are monitored for critical vulnerabilities (CVE), and perform analysis if CVEs are identified.

• Participate in source code reviews to provide security control reviews and architecture recommendations.

• Design and automate penetration testing across environments to identify and resolve vulnerabilities.

• Perform regular internal and external penetration testing for system and application security controls to resolve potential security vulnerabilities in preparation for regular formal GPO IT Security scans and penetration tests.

• Coordinate with GovInfo developers and system administrators on identified security vulnerabilities for mitigation and resolution.

• Analyze security risks and provide mitigation activities and security controls to resolve any identified security risks across GovInfo systems, applications, and environments.

• Support security related requirements for auditing, logging, and review of regular security-focused reports and logs.

• Develop incident response plans and coordinate playbooks for system and application security threats in conjunction with GovInfo team members and IT Security.

• Maintain and support application security toolsets for scanning, review, and analysis of existing or potential security vulnerabilities, and provide guidance on resolution.

• Ensure servers are configured and hardened in accordance with the CIS benchmark requirements.

• Create automated tests to support all applicable levels of the test pyramid.

GovInfo Application Security Engineer Components and Technologies:

The following is a high-level list of GovInfo components and technologies that apply to the specific responsibilities of the Application and System Security Engineer:

• Knowledge of application security as it relates to technologies utilized in GovInfo, including but not limited to:

o Documentum o Solr o Spring o Drupal o Apache

• Security-focused toolsets, such as but not limited to:

o nikto o Wireshark o Metasploit o Burp Suite o Kali Linux

• Enterprise Linux, current and future versions, including security-focused versions

• Apache Web Server

• Virtualization/container tools including VMware, ESXi Hypervisor, Vsphere

• AWS or Azure Federal Cloud

• Hardware Load Balancer, iRules, networking, DNS, common enterprise network hardware

• Common open source products for analyzing data in real time, common open source monitoring tools, common open sources administration automation tools (e.g. ELK, Zabbix, Ansible), BackupPC, UptimeRobot

• Unix, Shell Scripts, NFS

• Load testing, Apache Jmeter

• Java HotSpot VM

• Application Performance Management (APM) such as AppDynamics or New Relic (possible future)

• SSL, HTTPS, standard COTS AV with AV API interface, and EV Certificates

• Account Management Tools such as Active Directory, LDAP 3 Compliant Application Directories, identity management

• FTP, SFTP, SSH

• SMTP Mail Relay

• WebDav Server

• Penetration Testing, Vulnerability Prevention, DDOS Mitigation, CIS-CAT, CloudFlare

Experience:

• Relevant experience with GovInfo technologies referenced in the section above.

• 5 years' experience as an Information Systems Security Engineering Professional (CISSP-

ISSEP)

• Experience leading application and system security initiatives and providing technical expertise in designing secure public-facing and internal-facing services and APIs.

• Experience with traditional waterfall and agile software development lifecycle methodologies including Scrum and Kanban.

• Experiencing authoring, editing, and maintaining design documentation, standard operating procedures, and system configuration documentation.

• Experience and training in maintaining ISO 27001 certification.

• Knowledge of GovInfo content, metadata, and architecture.

• Knowledge of Federal legislative, regulatory, and judicial processes and publications.

• Knowledge of ISO 14721 OAIS and ISO 16363 TDR.

• Must be able to fluently communicate in the English language, in writing and orally.

C.3 Government Furnished Equipment

GPO will provide laptop computers, power adapters and/or docking stations, GPO network account, VPN access, and associated software to permit remote access. At the discretion of GPO, additional technology may be provided to contractors. Upon provision by GPO, it will be considered Government Furnished Equipment.

Contractor shall provide a method for each contractor to receive and use approved second factor authentication (2FA) tokens for the purpose of 2FA access to GovInfo systems in accordance with GPO IT Security policies. An example is using a non-GPO issued mobile device that has an approved authenticator application (e.g., Google Authenticator, Microsoft Authenticator). A non- GPO issued mobile device for 2FA is not Government Furnished Equipment.

The Contractor shall use Government furnished equipment, information, data, and documents only for the performance of work under this contract. The Contractor shall be responsible for returning all Government furnished equipment, information, data, and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished equipment, information, data, and documents to outside parties without prior and explicit consent of the Contracting Officer.

Contractors shall not take Government Furnished Equipment outside of the United States without prior approval from GPO.

C.4 Post Award Conference

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 7 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract. The Post Award Conference will be held via teleconference.

(End of Section)

Section E – Inspection and Acceptance

E.1 Notice Listing Contract Clauses Incorporated by Reference

The following Contract clauses pertinent to this section are hereby incorporated by reference (by Citation, Number, Title, and Date) in accordance with the clause at MMAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE in Section I of this Contract. Full text of the clauses is available at https://www.gpo.gov.

Number Title Date

52.246-4 Inspection of Services Fixed Price Aug 96 52.246-2 Inspection of Supplies Fixed Price Aug 96

E.2 Responsible Officials

Inspection and acceptance of services and supplies required by the contract will be made by the cognizant COR. Acceptance of services and supplies by the cognizant COR must form the basis for payments to the contractor and will form the basis of the contractor’s permanent performance record with regard to this contract.

E.3 Scope of Inspection

All deliverables will be inspected for content, completeness, accuracy, and conformance with contract requirements by the COR. The scope and nature of this inspection will be sufficiently comprehensive to ensure the completeness, quality, and adequacy of all deliverables.

E.4 Basis of Acceptance

E.4.1 The basis for acceptance shall be compliance with the requirements and relevant terms and conditions of set forth in the contract. Deliverable items rejected shall be corrected in accordance with the applicable clauses.

E.4.1.1 If the Government finds that a draft or final deliverable contains spelling errors, grammatical errors, or improper format, or otherwise does not conform to the requirements stated within this contract, the document may be immediately rejected without further review and returned to the contractor for correction and resubmission. If the contractor requires additional Government guidance to produce an acceptable draft, the contractor shall arrange a meeting with the COR.

E.4.1.2 All of the Government's comments on deliverables must either be incorporated in the succeeding version of the deliverable, or the contractor must demonstrate to the Government's satisfaction why such comments should not be incorporated.

https://www.gpo.gov/

E.4.1.3 Deliverables will be accepted when all discrepancies, errors, or other deficiencies identified in writing by the Government have been corrected.

E.5 General Acceptance Criteria

E.5.1 General quality measures, as set forth below, will be applied to each work product received from the Contractor under this contract.

• Accuracy: Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity: Work Products shall be clear and concise. Any/all diagrams/excel spreadsheets shall be easy to understand and be relevant to the supporting narrative.

• Consistency to Requirements: All work products must satisfy the requirements of this

Statement of Work.

• File Editing: All text and diagrammatic files shall be editable by the Government.

• Format: All reports and document deliverables are to be submitted in English, in electronic copy (in MS Office), with tables, data and calculations in MS Excel. The electronic copy must be in a format as indicated in the Deliverables Table.

E.6 Inspection and Approval of Written Deliverables

E.6.1 Delivery of Written Deliverables

E.6.1.1 All monthly reports and deliverables shall be submitted in accordance with the delivery requirements in Section F of this solicitation.

E.6.2 Approval of Written Deliverables

E.6.2.1 Unless otherwise specified in the contract, or by mutual agreement in writing, the GPO will have ten (10) business days to determine if written deliverables are satisfactory. Any deficiencies shall be corrected by the Contractor and incorporated into the final deliverable for resubmission to the GPO within three (3) business days after notification.

SECTION F – Deliveries or Performance

F.1 Period of Performance

Base Period: August 1, 2024 through July 31, 2025 Option Year 1: August 1, 2025 through July 31, 2026 Option Year 2: August 1, 2026 through July 31, 2027 Option Year 3: August 1, 2027 through July 31, 2028 Option Year 4: August 1, 2028 through July 31, 2029

F.2 Performance Measures The Government will evaluate the contractor’s performance under the resultant award using the method of surveillance specified in the attached Quality Assurance Surveillance Plan (QASP). See attachment I.

F.3 Place of Performance and Hours of Work Contractors on the GovInfo program telework. Contractors are required to work within the United States. Contractors may be required to perform work onsite at the U.S. Government Publishing Office (732 North Capitol Street, NW, Washington DC 20401). Telework is at the discretion of the Government.

Normal workdays are Monday through Friday except U.S. Federal Holidays. Contractors are expected to work at least eight (8) hours per day, 40 hours per week or equivalent (e.g., AWS 5- 4/9), unless other arrangements are approved by the COR. Planned and unplanned leave must be communicated to the COR as early as possible, and the vendor must ensure other contractors continue to perform required tasks on schedule and at the same level of quality. Alternative work schedule (AWS 5-4/9) is at the discretion of the Government.

Unless other arrangements have been approved by the COR, the following items apply.

Core hours of work for the GovInfo program are from 9:00 AM Eastern to 3:00 PM Eastern.

Contractors are expected to be available and working during core hours, with flexibility for remaining or additional hours to meet program needs and fulfill contract requirements.

Contractors may start as early as 6:00 AM Eastern but not later than 9:00 AM Eastern. To meet program needs and fulfill contract requirements, meetings may occasionally have a start time that is outside of core hours.

Contractors will occasionally be required to perform tasks on weekends and outside of core business hours to meet program needs and fulfill contract requirements to ensure continued availability, security, and functionality of the GovInfo system and its data (e.g., system deployments, emergency restoration of down services, troubleshoot failed content packages that are critical for the Federal legislative or regulatory process, occasional planned weekend maintenance tasks). Tasks must be performed under the same CLIN pricing (Support or Surge) with no increase to contract cost.

F.4 Deliverables:

Deliverables will be inspected and accepted or rejected by the COR. Deliverable review will be executed by the COR and GovInfo program team members in accordance with the Quality Assurance Surveillance Plan (QASP), and feedback will be provided to the Contractor.

Deliverables Due Dates Description Deliver To

Post Award Conference

Within 7 business days after contract award

Conference after award. COR, Program Manager, GPO Program Staff

Updates to Code and Configuration Repositories

Ongoing with every applicable sprint

Version-controlled code (i.e.

Ansible and other configurations) checked into source code management tools

COR, Program Manager, GPO Program Staff

(e.g., GitLab, Azure DevOps).

Code, configurations, and dependencies delivered under the contract must have a clean code base, be properly styled, be functional, be free of medium, high, and critical level security vulnerabilities and must successfully run and deployed to the appropriate integration, QA, stage, production, COOP, or successor environments.

Configurations includes updates to support code and environment changes and patches in all applicable environments.

Documentation and Issue Tracking

Ongoing with applicable sprint

Create and update issues within GPO’s source code management tools (e.g., GitLab, Azure DevOps) and update GPO’s enterprise issue trackers. Also includes issues that track End-Of-Life or End-Of- Support technologies and dependencies, maintenance issues, and security issues.

COR, Program Manager, GPO Program Staff

Update issues within the GovInfo Program’s issue management tools (e.g., Trello, GitLab, Azure DevOps).

Provide and update documentation regarding standard operating procedures for system administration, storage management, security management, and build services.

Infrastructure as Code

Ongoing with applicable sprint

Create, update, and document processes using infrastructure as code (i.e. Ansible or other approved IaC solutions) as a best practice for tasks, include system administration, storage management, identity management, security administration, or build processes where applicable.

COR, Program Manager, GPO Program Staff

Technology Timeline

Quarterly Lifecycle dates and refresh timelines for GovInfo hardware and technologies, with the goal of planning future replacements.