1.2.1-RFI_High Level Requirements SESS RFI Final.docx

Stabilization, Enhancements & Sustainment Support (SESS) Request for Information (RFI) – High Level Requirements The scope of this effort includes employing proven Agile Software Development techniques to deliver, maintain, and manage Immigration and Customs Enforcement (ICE) Homeland Security Investigation’s (HSI) Portfolio to include TECS Modernization (TECS Mod) systems functionality in support of HSI mission by identifying, investigating, tracking, and documenting offenses against Federal Law in the areas of border control, customs, trade, and immigration. As such, the Contractor provides enhancement and Operations and Maintenance support services for each of the following components in ICE HSI Portfolio using an Agile-driven approach:

· Solutions Integration

· Interfaces Support

· Data Warehouse Support

· Infrastructure Engineering and Configuration Management Support

· Security Engineering Support

· Digital Records Management Support

Task 1: Solutions Integration The Solution Integration task includes Program oversight of the execution of requirements analysis, code development, testing, configuration, deployment, administration, monitoring, and maintenance using agile methodologies for each of the identified HSI Portfolio components in this task order with an emphasis on insuring overall program communication, collaboration and integration among all of the Program’s operating components.

The Contractor provides integrated program management support, including personnel management, program reporting and cost management, technical risk and issue management, integrated scheduling, and technical oversight. The Contractor is also responsible for ensuring all code aligns with test-driven development and continuous integration best practices.

OBJECTIVES

Backward Compatibility The contractor ensures that backward compatibility with the integrated systems is maintained and any enhancements to the HSI Portfolio components do not impact the system functionality.

Operations & Maintenance Support (Tiers 2 & 3 Service Desk) The Contractor shall provide Tier 2 and 3 Operations and Maintenance Support for the specified HSI Portfolio components, in the tables below. Support days/hours of operations will be 365x24x7, with normal business hours defined as 8:00 am until 8:00 pm Eastern Time, excluding Government Holidays. Tier 1 Service Desk Support will continue to be provided by the ICE Service Desk.

The Program’s expected service levels for Tier 2 responsiveness are as follows:

Tier 2 Software Support

Tier 2 Software Support

Tier 2 Software Support

Tier 2 Software Support

placed in the Tier 2 queue for action to the time it appears as closed or referred, system, divided by the total number of tickets.

The Program’s expected service levels for Tier 3 responsiveness are as follows:

Tier 3 Software Support

Tier 3 Software Support

Tier 3 Software Support

Tier 3 Software Support

placed in the Tier 3 queue for action to the time it appears as closed or referred, system, divided by the total number of tickets.

Task 2: Interfaces Support This task supports the operations and maintenance of the Patriot Routing Interface and Messaging Environment (PRIME) Interface Hub and Law Enforcement Information Sharing System (LEISS). PRIME Interface Hub communicates with internal and external systems and LEISS communicates with external systems to accomplish all required data exchanges. This includes systems that are internal and external to ICE, to include but not limited to Department of Homeland Security (DHS), Customs and Border Protection (CBP), Department of Justice (DOJ), state and local.

In general, PRIME Interface Hub accepts incoming requests from the Investigative Case Management (ICM) software solution (which is outside the scope of this RFI) as well as other ICE consumers across both HSI and Enforcement and Removal Operations (ERO) with similar information sharing requirements. PRIME Interface Hub mediates incoming requests into subsequent requests for one or more external service providers. The general pattern implemented by the PRIME Interface Hub is to receive requests and quickly return a response that either provides acknowledgement that processing will proceed or that no backend sources can be selected to service the request. If the request is supported, the PRIME Interface Hub directs a source-specific request to one or more providers and sends correlated asynchronous result messages back to the consuming source system. Results are not held nor aggregated but delivered as soon as provided by the backend provider. PRIME Interface Hub also monitors ICE internal and external partners for critical business events and automatically provides consumer information when subscribed to events are detected.

LEISS accepts incoming requests from PRIME Interface Hub initiated by a source system to query external systems with specific information sharing requirements. LEISS mediates all incoming request for one or more external service providers. The general pattern implemented by the LEISS is to receive requests and quickly return a response that either provides acknowledgement that processing will proceed or that no backend sources can be selected to service the request. If the request is supported, the LEISS directs a source-specific request to one or more providers and sends correlated asynchronous result messages back to the consuming source system. Results are not held nor aggregated but delivered as soon as provided by the backend provider.

OBJECTIVES

Interoperability The contractor ensures that the PRIME Interface Hub and LEISS establish and maintain interfaces for data exchange with other systems & applications, operational areas across ICE, and their mission partners. The contractor maintains all existing and future functionality and interoperability with existing and future internal and external systems.

Task 3: Data Warehouse This task supports the analysis, reporting, and repository management of new and historical documents such as, but not limited to, (legacy) subject records, cases, case reports, investigative referrals, case hours, and enforcement statistics. The case information within the ICE HSI Data Warehouse includes some 20+ years of legacy data previously stored in legacy CBP TECS and the CBP Border Enforcement and Management Systems (BEMS) Data Warehouse (BDW), as well as CBP Legacy Seized Assets and Case Tracking System (SEACATS) data and the current ICE HSI Investigative Case Management (ICM) and accompanying data via a periodic feed (daily) from ICM. The ICE TECS Mod HSI Data Warehouse also acts as the repository of HSI investigative and case data made available to downstream applications for analytics and additional investigative purposes. As HSI continues to modernize its systems, the data warehouse will need to add additional data sources.

OBJECTIVES

The contractor provides the ability to ingest data from other data sources besides ICM into the Data Warehouse. The Contractor supports all aspects of the data ingest to ensure the data is successfully ingested and integrated into the Data Warehouse:

· Update existing database schema and structures, data marts, data sharing services and reports to integrate and share the data, as required

· Perform testing, including integration testing with data sharing partners as required

· Support enforcement of access control rules to data

· Add additional data sources as required

Task 4: Infrastructure Engineering and Configuration Management Support This task supports the Infrastructure Engineering and Configuration Management Support for the ICE TECS Mod Program, excluding the Software-as-a-Service (SaaS) ICM component hosted in Amazon Web Services (AWS) Cloud. The following depicts the existing ICE TECS Mod Physical Architecture, from an infrastructure view.

OBJECTIVES

Deliver Infrastructure as Code (IaC) The contractor provides the ability to use industry best practices and standards to provision Infrastructure as Code (IaC) that is scanned for code quality and tested, preferably through an automated process, such as DevSecOps. The contractor avoids manual configuration to minimize any impacts to the environment and enforce consistency. The contractor uses source code repositories for storing and versioning the IaC templates/definitions.

Support Configuration Management The contractor supports the Configuration Management to identify, control, report, audit and verify service assets and configuration items, including baselines, versions, constituent components, and their attributes and relationships. The contractor provides the ability to maintain information about Configuration Items (CIs) required to deliver an IT service, including their relationships using industry best practices, such as ITIL guidelines for Service Management.

Site Reliability Engineering (SRE) The contractor shall follow the Site Reliability Engineering (SRE) principles and practices that apply aspects of software engineering to IT infrastructure and operations. The contractor:

· Automates any repetitive process in a cost-effective way

· Avoids pursuing much more reliability than what’s strictly necessary

· Designs systems with a bias toward the reduction of risks to availability, latency, and efficiency

· Detects and quickly responds to changes through observability by unifying logs, metrics, and traces to help

Task 5: Security Engineering Support This task supports Security Engineering Support for the ICE TECS Mod Program. The Contractor provides qualified personnel to support the government lead in all aspects of system security engineering and to work with the Government Information System Security Officer (ISSO), on behalf of the Program, to define and document requirements for, and support installation and configuration of, all security components in the overall system physical architecture.

OBJECTIVES

Ensure Security Governance and Compliance The contractor must comply to applicable federal security standards and laws and ensures that appropriate measures and controls are applied to protect sensitive data and systems. The contractor must implement comprehensive logging and information sharing capabilities for analysis and early detection of threats, as described in OMB Memorandum M-21-31.

The contractor:

· Supports ‘Authorization/Access’ capability to applications and data based on the principle of least privilege

· Uses role-based and attribute-based access controls to control access to data and resources

· Protects all data by encrypting it in transit and at rest using approved encryption and transportation methods.

Adopt Zero Trust Security The contractor adopts zero trust cybersecurity principles to comply with the Executive Order (EO) 14028, "Improving the Nation's Cybersecurity", and more specifically that its architectures and patterns are conducive to recent OMB mandates for Zero Trust Security. The contractor enables central audit logging and follows the DHS CISA Zero Trust Maturity Model.

Use DevSecOps Practices The contractor uses DevSecOps practices to integrate security into every stage of the development and operations, from design, tooling, to automation to build and operate a more secure, resilient, and efficient system that can withstand the evolving security threats of the future. The contractor participates in the Agile Maturity Assessment conducted quarterly to review the team’s adoption and use of customized Agile and DevSecOps principles and practices to meet ICE requirements. and DevSecOps principles and practices to meet ICE requirements.

TASK 6: Digital Records Management Support This task supports the Digital Records Management Support for the ICE TECS Mod Program, hosted in Amazon Web Services (AWS) Cloud. The Digital Records Manager (DRM) is a media management repository that manages digital assets and streamlines upload and workflow processes for large volumes of digital media in various formats. It has a front-end User Interface (UI) where users can manage media such as, but not limited to, photos, audio, video, and documents. The following depicts the high level DRM architecture.

OBJECTIVES

The contractor ensures that the system performs within program specified service level agreements and can expand capacity as users are added and consumption increases. The contractor optimizes the storage with customized tagging/searching/filtering of digital media files as needed to enhance the performance. The contractor supports the program’s need to comply with the NARA guidance to store/manage/archive all information in electronic format.

Referenced Sources

Table 51 Referenced Sources

https://tech.gsa.gov/guides/dev_sec_ops_guide/

Acronyms and Abbreviations

Table 51 Acronyms and Abbreviations

image1.png image2.png