ATTACHMENT 1 - Amendment 1 - STATEMENT OF WORK.pdf

ATTACHMENT 1

WEBSITE SUPPORT AND HOSTING SERVICES STATEMENT OF WORK

1. Background

The Food and Drug Administration’s (FDA) websites are becoming increasingly scrutinized when it comes to protecting and advancing public health. The websites experience more than 350 million hits, 25 TB data transferred, and 6 million visitors per month. As such, the FDA public web site acts as the “front door” to the FDA for a substantial portion of the public.

The FDA public web site supports FDA’s mission in communicating to healthcare professionals and the public as effectively as possible. It is the key component in FDA’s Transparency and Open Government efforts. Importantly, the site also provides the public with many opportunities to interact with FDA. The FDA Intranet is the common internal web communications platform for informing FDA staff of organizational, policy and procedural information as it relates to staff as employees of the FDA. The intranet also acts as a portal for this information as well as providing staff access to the common tools and applications they need to use on a regular basis.

2. Purpose

The purpose of this contract is to obtain web content management, development, hosting, technical support and consulting services for all Food and Drug Administration (FDA) external and internal websites and web applications. The objective of obtaining these services is to further the agency’s goals of transparency by providing accurate, timely, useful information to consumers and partnering Government organizations through maintenance and enhancement of the FDA web presence. Additionally, the contractor will supply Web site hosting, Google Search Appliance and web caching services (Akamai or equivalent), including technical support associated with these functions and any other direct costs (ODCs) needed to support this function.

Activities that will achieve this objective include, but may not be limited to:

1. Provide project management support in managing planning, design, development, testing, and rollout of the web content management system upgrades and releases.

2. Providing technical expertise in fields such as web content management to assist in the maintenance of the FDA Intranet and Internet websites.

3. Supporting Agency implementation of web content management system by providing content management functional expertise.

4. Support agency enhancements and upgrades of content management system to end users of both the internet and intranet websites.

5. Support for Maintaining Content Management Daily Operations Procedures for both the intranet and internet implementations.

6. Support Change Management processes for the Web content management systems as well as web applications and tools in the agency.

7. Developing, testing, implementing, maintaining and enhancing applications to be deployed on the agency’s websites.

8. Maintaining, analyzing and enhancing applications currently in use on the agency’s websites.

9. Providing technical expertise in fields such as content management, personalization, dynamic search tools, and other consumer materials to assist in the creation and maintenance of website applications.

10. Supply Web site hosting, Google Search Appliance and web caching services (Akamai or equivalent) including technical support associated with these functions and any other direct costs needed to support this function.

11. Analyze existing website application functionality and information to recommend, develop, test, implement and maintain enhancements to the current website applications

12. Consulting with other existing contractors and external experts to coordinate the development, implementation, or maintenance of web applications.

13. Developing and maintaining enterprise-wide customer service applications, including but not limited to warning letters, data tables, recalls and FR calendar.

14. Support Change Management within FDA web community by developing communication materials such as power point presentations to be presented to senior management and staff as needed.

15. Researching best practices and offer recommendations to FDA’s Web Governance Team

16. Performing web content management system monitoring, performance assessment and testing of web content management system on an ongoing basis.

17. Providing subject matter expertise in website usability, accessibility and assistive technology and information architecture best practices.

18. Identify intranet, internet and content management system user interface usability enhancements.

3. Scope of Work

The scope of this work includes support in the following areas: Web Application Development, Web Content Management System Development, Web Caching Services, Web Search and Analytics, Regulatory and Enforcement Web Development and Maintenance for the Office of Regulatory Affairs, Web Development and Maintenance for the Center for Tobacco Products.

Support for web infrastructure of FDA including a Web Content Management System (WCMS) based on Oracle Universal Content Management (UCM) to enhance the agencies ability to manage web content effectively. The system supports both FDA’s public facing site along with it’s internal (Inside.FDA) site. The system has been customized to meet FDA business needs and other intranet applications which are mission critical. FDA utilizes Akamai web caching services to increase availability and performance of FDA Internet and Extranets web sites. This service provides FDA distributed site content caching from over 18,000 servers worldwide. FDA content is retrieved by Akamai directly from internet and extranet sites, and the public only receives responses from Akamai servers. Akamai servers are distributed world wide serving content from servers located in client regions, thus providing faster response times and best response network connections. FDA has control over setting cache time to live-based on-file type. Web caching reduces both bandwidth and server load on the origin web sites.

FDA uses Google search appliances to provide a sophisticated searching mechanism for the FDA web site which has the scalability to meet the demand of the overwhelming growth and popularity of the site. Currently, there are over 60 web applications hosted on the FDA Internet and Intranet sites. Due to the complexity of administration and maintenance of these databases and applications, ongoing database and application support and testing is required.

While each application is regression tested by the application owners/developers, this support also provides for load testing and code review on each application, providing help to developers in optimizing their application code and ensuring overall site performance. Before each application is deployed, the contractor will load test the application and perform security verification. In addition, guidance to developers is provided in preparing their applications for a high traffic Internet environment.

Operations and maintenance of FDA Internet and Intranet websites includes, but may not be limited to:

1. Web site hosting services for www.fda.gov, www.accessdata.fda.gov and secure FTP site.

2. Operations and maintenance of the FDA Internet and Intranet sites.

3. Akamai web caching services and support for FDA public websites including service, administration, customization, log collection and maintenance of web caching time-to-live configurations.

4. Analyses of web site traffic, web site performance and, efficiency of web servers and scripts. Administration and technical support for customization of web caching services including.

5. Search engine appliances and support including licensing, maintenance, customization, and management of Google search appliances and services.

6. Administration and maintenance of ColdFusion and JRun application servers.

7. Support and maintenance of Oracle RAC database servers and Microsoft SQL servers including database script maintenance, software patches for security and operational stability.

8. Oracle 10g UCM servers,

9. Software patches for security and operational stability. Evaluation of new software releases for upgrade and migration. Frequency of upgrades / migrations is typically one major per year per software platform where software platform (e.g., ColdFusion, Oracle UCM, Oracle database and Microsoft database).

10. Maintain documentation on systems and procedures, including diagrams documenting systems architecture.

Web Development and Maintenance support for the Office of Regulatory Affairs and the Center for Tobacco Products includes, but may not be limited to:

1. Document conversion from a variety of sources into HTML for posting to FDA internal or external websites.

2. Assistance with graphical design and/or layout of content presentation

3. Providing customizations for FDA’s Web Content Management system to support the business needs of the Office of Regulatory Affairs.

4. Providing application development support for web applications owned by

Center for Tobacco Products or Office of Regulatory Affairs.

All work performed, including deliverables, are subject to the ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS. Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the "Electronic and Information Technology Accessibility Standards" set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the "Access

Board") in 36 CFR Part 1194. The complete text of Section 508 Final Standards can be accessed at http://www.access-board.gov/.

The standards applicable to this requirement are listed below:

1194.21 Software applications and operating system

1194.22 Web-based intranet and internet information and applications.

1194.41 Information, documentation, and support.

4. Specific Tasks to be performed under this contract. Contract type is listed for each specific task.

4.1 Contract Transition Activities (Optional Item – Labor Hour) - The contractor shall work with the incumbent to migrate hosting services, caching services, search services, other ODCs, and service transitions to execute a smooth transition of services to FDA.

Web site hosting transition in particular is a major task of critical importance to FDA.

For the base year of this contract, this work will start two weeks (or sooner if possible) after award, which will begin a transition period from the existing contract performing this work. The transition period is estimated to last eight weeks.

4.2 Hosting Services (FFP)– The contractor shall provide hosting for FDA public web sites and infrastructure (Substitution of equivalent or better performing hardware allowed).

Hosting includes any operating system software and licensing.

4.2.1 Servers

1. Oracle UCM Production Clustered servers – 4 Servers: 32 – bit Microsoft

Windows Server 2003 Enterprise Edition R2, Dual Processor, Quad core Intel Xeon L5420, 4 GB Memory (Fully Buffered), Local Storage: 2 x 73 GB (10k RPM) 2.5” SAS Drives, RAID 1 and 3 x 73 GB (10k RPM) 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

2. Oracle RAC clustered database servers – 2 Servers: OS Version / License64 – bit Red Hat Enterprise Linux 4 ES, Hardware: Dual Processor, Quad core Intel Xeon L5420, 8 GB Memory (Fully Buffered), Local Storage:

2 x 73 GB (10k RPM) 2.5” SAS Drives, RAID 1 and 3 x 73 GB (10k RPM) 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection and HA Fiber HBA Connection, Managed Backups:

Weekly Full and Daily Differential, Cluster Solution: Red Hat Cluster Suite.

3. Oracle UCM Test Clustered Servers – 2 Servers: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 3 x 73 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s):

Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

4. Accessdata.fda.gov Production Servers (ColdFusion/JRun) – 3 Servers:

32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 3 x 300 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection, HA

Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

5. Accessdata.fda.gov Test Servers (ColdFusion/JRun) – 2 Servers: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 3 x 73 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

6. Microsoft SQL Database Production Server – 1 Server: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 4 x 73 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s):

Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

7. Microsoft SQL Database Test Server – 1 Server: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 4 x 73 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s):

Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

8. Secure FTP Server – 1 Server: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 2 GB Memory, Local Storage: 2 x 73 GB 3.5” SAS Drives, RAID 1, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential. HP StorageWorks MSA500 Dedicated Storage Unit, 3 x 300 GB SCSI Drive(s), RAID 5, redundant controllers, 512 MB battery-backed cache, redundant power supplies. Software: GlobalScape SFTP and HTTPS Add-on Module.

9. Staging Server – 1 Server: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 3 x 146 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

10. Web Analytics Server (Google Urchin) – 1 Server: 32 – bit Microsoft Windows Server 2003 Enterprise Edition R2, Dual Processor, Intel Xeon 3.2 GHz Processors, 4 GB Memory, Local Storage: 2 x 73 GB 2.5” SAS Drives, RAID 1 and 4 x 300 GB 2.5” SAS Drives, RAID 5, Redundant power supplies, 1000 Mbps redundant network connectivity, External Storage Connection(s): Private Backup Network Connection, HA Fiber HBA Connection, Managed Backup: Weekly Full and Daily Differential.

4.2.2 External Storage

1. Storage Area Network (SAN) SATA Storage 500GB

2. Network Attached Storage (NAS) 6 TB usable (Fiber Channel Drives) connected via 1 GBPS.

4.2.3 Network

1. Load Balancers (Redundant): Active/Passive Cisco CSS 11501 Load

Balancer, Redundant Devices Configured for Failover, 100 Mbps, SSL termination and can deliver 1,000 SSL transactions per second, Layer 4 / Layer 7 Load Balancing, Supports IP or Cookie-based Persistence, Fully Managed, Includes 24x7 Monitoring, Device Configuration and updates.

2. Firewalls (Redundant): Cisco PIX 515 Firewall, Active/Passive, Redundant Devices Configured for Failover, 100 Mbps Connectivity, 300 Mbps Aggregate and 130,000 Concurrent Connections, State full packet inspection, fully managed device, includes 24x7 Monitoring, rule changes.

3. Local Network: 1000 Mbps Cisco Catalyst Switches for Local Network Traffic.

4. IDS network appliance with minimum 80Mbps connectivity, state full pattern recognition, protocol analysis, traffic anomaly detection, and protocol anomaly detection, IP de-fragmentation, ICP streams reassembly, anti-IDS evasion protection, and de-obfuscation techniques. 24x7 monitoring and 1 hour replacement.

5. VPN Access – Minimum of 3 site-to-site VPN licenses, 3DES encryption, including software.

6. Port Monitoring – 24x7 port monitoring specified by COTR. Monitoring at 5 minute intervals, Unresponsive ports will be investigated and repaired immediately

7. Hosting Support: 24x7x365 Support, 1 Hour Hardware Replacement, dedicated lead systems engineer Managing Overall System Performance, Ambiron TrustWave vulnerability scan, port monitoring service, systems monitoring, application and performance monitoring, transaction monitoring.

Port Monitoring: Ping and TCP Port 80, 6 additional ports monitored (eg.

FTP, SSH, DNS, POP3, MS SQL) and 5 Minute Polling.

4.2.4 Other Features and Services

1. Centralized managed Back-up with Offsite Storage. Un-metered scheduled weekly full plus daily incremental, 12 week retention.

2. Bandwidth Aggregate 5.2 TB per month of outgoing transfers only. All incoming transfers free.

3. Co-location of Google 7007 production and hot back-up search appliance.

4. Customer Support - Unlimited 24x7x365 phone support. 24x7x365 support engineer availability, dedicated technical lead, dedicated account manager, network & security engineers, and backup & storage engineers. 1-hour hardware replacement on all servers and devices. Zero downtime network guarantee – 100% uptime. Zero downtime infrastructure (power and HVAC) guarantee – 100% uptime.

4.2.5 Software Licensing

1. Microsoft SQL server upgrade to latest version as needed. Current version 2005.

2. ColdFusion upgrade to latest version 12 licenses each year. Current version 9.

3. SSL Certificates for secure-ftp.fda.gov, www.accessdata.fda.gov, accessdata-preprod.fda.gov.

4. Oracle Universal Content Management 8 CPU licenses and first year of maintenance. FDA will assume software maintenance after first year.

4.2.6 Server Administration – Covers both servers hosted under this contract and other servers hosted by FDA or under other contracts supporting FDA web infrastructure within the FDA network. Perform system administration, troubleshooting, and

1. Servers supported but not hosted under this contract:

4.2.6.1.1 Web Application Servers

4.2.6.1.1.1 Intranet Application (ColdFusion) – 1 Development, 1 Test, 3 Pre-Production, 3 Production.

4.2.6.1.1.2 Internet Application (ColdFusion) – 1 Development, 1 Test.

4.2.6.1.2 Web Content Management Servers – 1 Development, 2 Test, 2

Pre-Production, 3 Production.

4.2.6.1.3 Oracle Database Instances – 2 Development, 2 Test, 2 Pre-

Production, 2 Production.

4.2.6.1.4 MS SQL Database Instances – 1 Development, 1 Test, 1 Pre-

Production, 1 Production.

2. Web Analytics and other Statistical Analyses – The contractor shall provide support for Web Analytics analysis including: Perform system administration, troubleshooting, and maintenance including application of software patches for security and operational stability of Urchin Web Analytics software. Perform an array of analyses to assess Web site traffic, Web server efficiency and script performance including weekly statistics for all FDA Internet Web sites. Attending meetings as directed by COTR and providing consulting services.

3. Web Application Systems – The contractor shall provide support and administration for web application server systems including JRun Java, ColdFusion, Microsoft SQL and Oracle RAC database servers. Perform system administration, troubleshooting, and maintenance including application of software patches for security and operational stability and updating database scripts. Additionally, the contractor shall perform user administration including adding, removing, and changing user accounts access. Prepare written standard operating procedures, hardware configurations, software configurations, and security plans. Provide input and updates to technical information on FDA Webmasters page. Evaluate new software releases for upgrade and procurement of and migration to new software releases when authorized by COTR. Analyze Web application performance written by FDA developers and their compatibility with the FDA Internet/Intranet environments including deployment and load testing of scripts in various application development environments.

4. Web Content Management System – The contractor shall provide support and administration for Oracle UCM web content management server and supporting databases for both the server and application layer of the development, test, and production environments.

5. Database Administration - The contractor shall perform maintenance, monitoring, support, and administration for databases including MS SQL server and Oracle configurations including:

4.2.6.5.1 Creation and configuration of new database schemas

4.2.6.5.2 Perform database migrations as needed

4.2.6.5.3 Provide database application development support including, but not limited to: data imports from various formats, creation of stored procedures, database replication, and general support of web based application developers.

4.2.6.5.4 Monitor and report on Longest Running Queries and Most Executed queries of the Oracle UCM Database once a month and on an ad hoc basis.

4.2.6.5.5 Monitor and report on optimization of Oracle UCM database Oracle Text indexes and verify they are being used correctly. Make recommendations for new database indexes to improving query performance.

4.2.6.5.6 Make recommendations on database tuning options based on the review of UCM database on a quarterly basis. After identifying options, the contractor shall implement the recommended changes after COTR approval.

4.3 Web Caching Services and Support (FFP)- Akamai Edge Suite Enterprise Services for fda.gov web site and other FDA managed domains or equivalent. The contractor shall provide and manage the contract web caching service, which includes the following features:

4.3.1 Content and Applications Delivery

1. Global Map

2. Whole Site, Streaming & Object Delivery

3. Secure Content Delivery (SSL)

4. Streaming Media up to 300 Kbps streaming encoding rate.

4.3.2 Edge Processing

1. Dynamic Content Assembly

2. Edge Transmissions using XSLT

3. Delta Encoding

4.3.3 Content Targeting – EdgeScape Pro Content Targeting

4.3.4 Enhanced Security

1. SSL Objects - SSL Certificates (production, pre-production and FDA extranet)

2. Site Shield for 4 sites (www.fda.gov, www.cfsan.fda.gov, www.accessdata.fda.gov & www.access.fda.gov)

4.3.5 Performance

1. SureRoute for Performance

2. Last Mile Accelerator

4.3.6 Management & Analysis

1. Content Control Utility

2. Advanced Cache Control

3. User Portal for self service (Configuration, monitoring, reporting, shelf help)

4. Whole Site Log Delivery

5. Real-Time Traffic Reporting

6. Historical Traffic Reporting

7. Alerts

8. API for automating content purge

4.3.7 Usage

1. 100 Mbps 95th percentile monthly

2. Net Storage capacity 30 GB

4.4 Search Services (Labor Hour)- The contractor shall work with Google to provide Google Search Appliances for the FDA Internet and Intranet with development appliances for each. This task includes the following search requirements:

4.4.1 The hardware, software, and licensing to index 5 million documents, and 5 million FDA intranet documents and development/ Host backup search appliances to conduct searches will be provided and maintained. Contractor will maintain search pages on the FDA web sites. The Google Search Appliance will obtain search queries from FDA via HTTP and request in XML format, process search queries using Google search engine, and return Result Sets to FDA via HTTP request in XML format.

4.4.2 Site Search statistics will be reported monthly or upon request by the FDA. Site search statistic reports will be developed utilizing the Google Search Appliance Administration Console.

4.4.3 The feature set will be equivalent or better than the current Google Search Appliance 7007.

4.4.4 The contractor shall manage Google Search Appliance collections and prepare new collections, as requested by the COTR. The contractor shall install and manage the script to interact with the Google Search Appliance.

4.4.5 Assist application developers with integrating the Google Search Appliance with Internet and Intranet applications using available Google Search Appliance API’s.

4.4.6 Implementing secure search within various environments and integration with COTS products for internal search results. Secured search should utilize FDA’s Single Sign On, and only display results a user can access too. Areas using this will include, document repositories and secure intranet website.

4.4.7 Assisting FDA in Search Engine Optimization efforts to assure users are able to find what they are looking for. This includes assisting in education efforts to our web staff, updating search result page to add additional functionality, and seeding keywords and synonyms.

4.5 Web Content Management System (WCMS) (Labor Hour) Development

4.5.1 Website Design - The contractor shall produce:

• website design and functions that meet all of the necessary website requirements collected during the team and stakeholder interviews

• provide ways to visually and functionally enhance the integration and responsiveness of the web pages in accordance with OMB and HHS web guidelines and best practices

• provide comments and suggestions on technical writing and overall readability of site pages

• develop web pages that are accessible to individuals with physical disabilities and other special needs.

The contractor is required to review design and development work products with the FDA and the FDA may comment and revise these work products throughout the design/development. In support of new or redesigned websites, the contractor shall prepare wireframe prototypes and interaction design schematics. The Contractor shall develop the interface designs (for example wireframes) and content workflow management based on updates to the Information Architecture.

Workflow management is the way to implement governance for the Intranet and Internet. The Contractor shall document the system design in a Design Specification.

The Contractor shall conduct a formal review of the Design Specification with the FDA project team. The purpose of this review is to affirm final agreement regarding the content of the Design Specification and to obtain Government approval. Upon successful completion of this review, the Design Specification shall be baselined.

The term “baselined” indicates that the document is the official Government approved version and shall be the version that the contractor works from. The Contractor shall be responsible for the maintenance/updating of the Design Specification baseline throughout the lifecycle of the contract. Following establishment of the baseline, changes to the Design Specification require FDA approval.

The process for obtaining FDA approval is as follows: the contractor can incorporate the proposed changes into the Design Specification. The FDA has one

(1) week from receipt of the requirements specification to review, comment and respond to the contractor on the proposed changes. The contractor has two (2) days from receipt of the FDA feedback to incorporate the FDA comments into the Design Specification. This revised version (including the FDA comments) of the Design Specification then becomes the new Baseline Design Specification. Any change that does occur must be documented through the project collaboration tool. In addition, the Contractor shall notify FDA if changes to the Design Specification will impact contract cost or schedule.

4.5.2 Oracle Universal Content Management System Customizations - The contractor shall provide customizations to the WCMS as defined by the COTR or designee to meet the requirements and specifications outlined. Currently, there are 2 sites within the content management system, with two distinct visual designs. At a minimum, the contractor will provide the following customizations:

1. Maintain and optimize metadata model in the WCMS.

2. Create/Modify Page Templates, Subtemplates, Region Templates, Region

Definitions, Element Definitions, Fragments, Scripts, Configurations, Cascading Style sheets

3. Create and maintain WCMS custom components by following best practices for customization in Oracle UCM. These customizations will add new functionality or extended existing functions to meet FDA’s need.

4. Create and maintain both internal and external website structures in the WCMS using Site Studio Designer and Oracle UCM.

5. Create and maintain WCMS Dynamic list, including the optimization of these modules for reuse.

6. Identify ways to adjust site coding to support visually impaired users and adhere to Section 508 guidelines.

4.5.3 WCMS Software Maintenance Support - The contractor for each Oracle UCM upgrade will perform impact assessment and code updates to custom components as needed, validation testing and implementation support as outlined below for all releases.

4.5.4 Validation Testing - The Contractor shall conduct a Validation Readiness Review (VRR) for all planned releases. The purpose of the VRR is to validate the design against the content management system components implemented with the Government. A separate VRR is required for each release. The project team shall determine the timing and number of releases will be required as the project planning progresses. The Contractor shall provide technical information to support FDA decisions to proceed with validation testing. The testing will also include load testing which verifies the package will support the performance requirements for the FDA websites. The Contractor shall present the following at the VRR:

1. Test plan to include schedule for conducting tests.

2. Unit and integration test results.

3. Outstanding Problems Report.

4. Test Log - For releases determined by FDA, following successful execution of each validation test, the Contractor shall deliver a Test Log. A separate Test Log shall be required for each release. The Test Log shall include:

5. Test summary.

6. Dates of testing activities.

7. Identification of test cases performed.

8. Test Plan Deviations.

9. Justification of test plan deviations.

10. Test results.

11. Identification of requirements successfully tested.

12. Problems Report.

4.5.5 Implementation Plan - The Contractor shall produce an Implementation plan which includes:

• Specific instructions and step-by-step procedures needed to load applications and databases.

• Specific instructions and step-by-step procedures needed to verify the load was installed properly.

• Roll back procedures.

4.5.6 Implementation Readiness Review (IRR) - The contractor is responsible for conducting an IRR after validation testing and prior to release of new or changed code into production. The purpose of the IRR is to ensure all prerequisites leading up to production implementation have been met; this includes, but is not limited to, implementation planning including data conversion needs, if appropriate, QA processes and integration needs/concerns. The Contractor shall present the following at the IRR:

• Test Log.

• Outstanding problem reports, including severity, level of effort and schedule to fix them.

• Documentation walkthrough.

• Implementation plan walkthrough.

• A review of the Training Plan.

4.5.7 Operations Documentation - The contractor shall develop and maintain daily operations documentation and standard operating procedures (SOPs). These documents include but may not be limited to:

• Procedures

• Guidelines

• Editorial style guidelines

• Web Request procedures

• Web Content Management guidelines

The contractor shall ensure all documentation and guidelines are in accordance with HHS and OMB guidelines.

4.6 Web Application Maintenance and Enhancements (FFP)– The applications listed below will be maintained or enhanced, as needed, to meet the requirements gathered in task 1 Web Governance, performance criteria in task 2 Web Content Management System Development, and programming language server upgrades. The contractor is responsible for maintaining the application code including versioning, testing, and creation of promotion packages and promotion forms. FDA Websites have many imbedded web applications, widgets and forms which add dynamic functionality to the sites. The application inventory includes Intranet widgets, Intranet applications, and

• Intranet Widgets and Applications

1. Widgets include: a personalized RSS Reader, bookmarks feature (My

Links), personalized weather forecast, FDA Notices which handles creation interface, Intranet display via RSS widget and email distribution.

2. Intranet applications that have been developed which need to be kept operational include: Move a ColdFusion application used to coordinate resources for large staff moves; A76 Clerical Time Tracking a ColdFusion application to report time and tasks by staff with summary reports.

• Internet Applications

1. FR Calendar - The Federal Register calendar ColdFusion application http://www.accessdata.fda.gov/scripts/oc/ohrms/index.cfm allows public users to search for FDA Federal Register documents. The application has both a backend administration component for entering the FR notices and the public facing interface for finding the content.

2. Warning Letters Application – The Warning Letters ColdFusion application allows public users to search and browse for FDA issued Warning Letters from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/default.

htm. The application leverages metadata on warning letter html pages and a Google Search Appliance to perform this functionality.

• Simple Dynamic Forms - This task also includes maintenance and creation of simple dynamic forms for all FDA websites.

1. Searchable Dataset Application is a ColdFusion application which allows FDA to manage simple datasets and display them to the public in a very usable format which allows browse and search of data. The design is dynamic so new datasets can be created and the front end display parameters are driven by the dataset metadata. The application enables content owners within FDA to add data through a secure, single application expediting posting public health datasets to the web. The application also has a feature for uploading tables of data directly.

Examples of datasets include:

1. FCS listings (FCN)

2. Biotech Notification

3. CEDI/ADI

4. EAFUS

5. Environmental

6. GRAS

7. Recycled

8. SCOGS

9. Phish Pharm

10. Product Firm Recalls

4.7 Project Management Support (FFP)

4.7.1 The contractor shall provide project management support. Program Management support includes the following areas:

• Integration Management

• Scope Management

• Time Management

• Cost Management

• Quality Management

• Human Resource Management

• Communications Management

• Risk Management

4.7.2 The contractor shall be responsible for maintaining the project management plan and schedule all website service related releases for the FDA intranet and internet (www.fda.gov) applications and web content management system. The schedule shall be kept up-to-date on a bi-weekly basis. Updates to the schedule must be reviewed and approved by the COTR before the schedule is updated and posted in the project collaboration area as part of the communications effort, the contractor shall participate in weekly Web Governance meetings and special sessions documenting discussions and integrating decisions into the project management plan. The contractor will ensure the project collaboration area and FDA intranet site are kept up to date with pertinent information to keep the user community informed.

4.7.3 Requirements Analysis - The contractor shall collect, document and validate the business, user and system requirements and manage the requirements throughout the contract. The contractor shall work with FDA project team and project stakeholders in order to obtain these requirements. The requirements will be used by the contractor to develop Website enhancements and new web applications for the FDA Intranet and Internet as well as the web content management system. The contractor shall document the requirements in a Requirements Specification for each system and ensure that the requirements are correct, complete, clear, consistent, testable, traceable, feasible, modular and design-independent. The contractor shall ensure that these requirements capture the required technical capabilities and constraints of the system being developed to meet the documented business needs.

1. The Contractor shall conduct a formal review of the Requirements Specification with the FDA project team. The purpose of this review is to affirm final agreement regarding the content of the Requirements Specification and to obtain Government approval. Upon successful completion of this review, the Requirements Specification shall be baselined.

The term “baselined” indicates that the document is the official Government approved version and should be the version that the contractor is working from.

4.7.4 The Contractor shall be responsible for maintenance/updating of the Requirements Specification baseline throughout the contract. Following establishment of the baseline, changes to the Requirements Specification will require FDA approval.

The process for obtaining FDA approval is as follows: the contractor can incorporate the proposed changes into the Requirements Specification. The FDA has one (1) week from receipt of the Requirements Specification to review, comment and respond to the contractor on the proposed changes. The contractor has two (2) days from receipt of the FDA feedback to incorporate the FDA comments into the Requirements Specification. This revised version (including the FDA comments) of the Requirements Specification then becomes the new baseline Requirements Specification. Any change that does occur must be documented through the project collaboration area. In addition, the Contractor shall notify FDA if changes to the Requirements Specification will impact contract cost or schedule.

4.7.5 Training - The contractor shall be responsible for developing and producing training materials and providing various types of training to personnel identified by the COTR. The contractor shall develop a training plan, PowerPoint talking slides, user guide documentation. The contractor shall provide training workshops when needed

4.7.6 Contractor shall be responsible for providing, facilitating, conducting, and recruiting for website usability studies, analysis and evaluation.

4.8 Web Development and Maintenance for the Center for Tobacco Products (Labor

Hour) The contractor shall assess Center for Tobacco Product (CTP) web application development needs based on program efforts and initiatives.

4.8.1 The contractor shall collect, document and validate the business, user and system requirements and manage the requirements throughout the contract. The contractor shall work with CTP project team and project stakeholders in order to obtain these requirements. The requirements will be used by the contractor to develop Website enhancements and new web applications for the FDA Intranet and Internet as well as the web content management system. The contractor shall document the requirements in a Requirements Specification for each system and ensure that the requirements are correct, complete, clear, consistent, testable, traceable, feasible, modular and design-independent. The contractor shall ensure that these requirements capture the required technical capabilities and constraints of the system being developed to meet the documented business needs.

4.8.2 Provide posting and coding support for day-to-day document upload to the Web content management system for both FDA’s Internet and Intranet sites. Estimated need of 5 to 10 hours per week. The contractor shall modify documents in order to make them fully 508 compliant.

4.8.3 Design, develop and maintain a flavored tobacco database application for securely storing and reporting public submissions based on a front end design using this form http://www.accessdata.fda.gov/scripts/email/TobaccoProducts/flavoredCigarettes.cf

m. To comply with GAO requirements and meet an agency mandate of prohibiting candy, fruit, and spice flavors as characterizing flavors in tobacco, FDA established the Cigarettes with Characterizing Flavors reporting form. To ensure effective analysis, reporting, and follow-up, the contractor shall develop a backend application. Specifically, the application should have the following features:

1. Collects the information from the form into a database.

2. Enables FDA to enter enforcement activities including actions taken, public follow-up, and closeout.

3. Has an FDA internal reporting component that organizes and sorts information by product type, brand, lot number, location, and other fields as presented on the form.

4. Export feature for violative products in XML format for content syndication.

4.9 Web Development and Maintenance for the Office of Regulatory Affairs (Labor

Hour) The contractor shall collect, document and validate the business, user and system requirements and manage the requirements throughout the contract. The contractor shall be required to conduct interviews with ORA stakeholder and project stakeholders in order to obtain these requirements. The requirements will be used by the contractor to develop Website enhancements and new web applications for the FDA Intranet, Internet, and web content management system. The contractor shall document the requirements in a Requirements Specification for each system and ensure that the requirements are correct, complete, clear, consistent, testable, traceable, feasible, modular and design-independent. The contractor shall ensure that these requirements capture the required technical capabilities and constraints of the system being developed to meet the documented business needs.

4.9.1 Provide posting, and coding support for day-to-day document upload to the Web content management system for both FDA’s Internet and Intranet sites. Estimated need based on current work load and experienced staff 8,000 to 9,000 hours per year with higher or lower work load at times depending on the number of regulatory actions generated in a given week. This content serves a mission critical communications function with such a geographically diverse organization. The current ORA business process involves the use of designated “Web Content Specialists” from each ORA component, who are responsible for gathering, reviewing, approving, and submitting for publication content and other materials for their respective organizations. An existing standard operating procedure prescribes procedures for posting content.

1. Documents shall be modified by the contractor before contribution to make them fully 508 compliant. While knowledge of html coding and web tools is not required to contribute to the FDA web content management system it is required to remediate many section 508 issues and to add custom page functionality. The source documents include:

• Regulations and enforcement actions and other program content such as warning letters, letters to industry, product recalls and press releases.

• Frequently Asked Questions

• PowerPoint presentations

4.9.2 Oracle Universal Content Management System Customizations to support enforcement and regulatory actions - The contractor shall provide customizations to the WCMS as defined by the COTR or designee to meet the requirements and specifications outlined. At a minimum, the contractor will provide the following customizations:

1. Maintain and optimize metadata model in the WCMS.

2. Create/Modify Page Templates, Sub templates, Region Templates, Region

Definitions, Element Definitions, Fragments, Scripts, Configurations, Cascading Style sheets

3. Create and maintain WCMS custom components by following best practices for customization in Oracle UCM. These customizations shall add new functionality or extended existing functions to meet FDA’s need.

4. Create and maintain both internal and external website structures in the WCMS using Site Studio Designer and Oracle UCM.

5. Create and maintain WCMS Dynamic list, including the optimization of these modules for reuse.

6. Identify ways to adjust site coding to support visually impaired users and adhere to Section 508 guidelines.

4.9.3 Internet Applications – This task includes the creation and maintenance of user applications in support of regulatory and enforcement activities. Typically, this task is very infrequent and requires little maintenance. User applications include:

1. - Unlawful Sales of Medical Products on the Internet (http://www.accessdata.fda.gov/scripts/oc/buyonline/buyonlineform.cfm) – This form submits information of potential illegal sales of human drugs, animal drugs, medical devices, biological products, foods, dietary supplements or cosmetics over the Web

2. - Report Suspected Criminal Activity (http://www.accessdata.fda.gov/scripts/email/oc/oci/contact.cfm) – This form submits report suspected criminal activity relating to FDA regulated products.

3. - Import Refusals (http://www.accessdata.fda.gov/scripts/ImportRefusals/ir_index.cfm) – This application provides Import Refusals involving FDA-regulated products.

4.9.4 Intranet Applications – This task also includes creation and maintenance of simple dynamic forms on FDA’s intranet in support of regulatory and enforcement activities as requested by ORA stakeholders.

4.10 Indefinite Delivery/Indefinite Quantity Tasks (IDIQ). This IDIQ task is established for requirements not contained within the FFP or Labor Hour tasks, but within scope of this contract. Task orders will be issues for IDIQ work will be issued in accordance with the procedures in Section 9. Task orders may be issued under this IDIQ requirement , include, but are not necessarily limited to the examples listed below:

4.10.1 Public Health Emergencies. The contractor shall perform web application deployment and maintenance and data imports in FDA’s Internet and Intranet environments to support FDA response to public health emergencies. In the past this has required development or repurposes of web applications used to present data to the public in a user friendly format and daily data imports. In addition, during these emergencies frequent updates are required to both applications and data. This task shall be performed on an as needed basis.

4.10.2 Content Load and Content Preparation Support. Provide content load and content preparation support through the WCMS to FDA Centers. This may include activities ranging form assisting with HTML and PDF files are accessible and compliant with Section 508 of the Rehabilitation Act, loading content into the WCMS, and/or assisting FDA Staff.

4.10.3 FDA Web Content Load Center for Biologics Evaluation and Research.

The contractor shall provide support of loading and performing quality assurance reviews of web content using the FDA Web content management system for Center for Biologics Evaluation and Research. The Web content management system (WCMS) is Oracle Universal Content Management system with the Site Studio WYSWYG interface. The FDA implementation has been customized to meet FDA requirements for usability. FDA conducts custom hands on WCMS training which will be offered to contract personnel. Work will be performed at the contractor’s facility unless requested to work in FDA facilities.

4.10.4 FDA Web Content Load Center for Drug Evaluation and Research. The contractor shall provide immediate support of loading and performing quality assurance reviews of web content using the FDA Web content management system for the Center for Drug Evaluation and Research. The Web content management system (WCMS) is Oracle Universal Content Management system with the Site Studio WYSWYG interface. The FDA implementation has been customized to meet FDA requirements for usability. FDA conducts custom hands on WCMS training which will be offered to contract personnel. Work will be performed at the contractor’s facility unless requested to work in FDA facilities.

5. Personnel Requirements

5.1 The Contractor is responsible for providing personnel with the management, technical and subject matter expertise required to accomplish the activities and prepare the deliverables identified in this Statement of Work.

5.2 The descriptions and qualifications for each labor category are included in Attachment 4 “Labor Categories”. Personnel that exceed the Government’s minimum requirements will become the applicable Government standard and will be the established standard for contract performance.

5.3 The key personnel specified in this order are considered to be essential to work performance.

At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employ of the Contractor), the Contractor shall notify the Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions…