ATTACHMENT_2--FY19-24_OMNIBUS_INITIAL_TASK_ORDER_0001--WORK_STATEMENT_(AMENDED_FBO_VERSION)--06-04-2019.docx

FOUO

ATTACHMENT 2 – WORK STATEMENT

FOR

Initial Task Order

Contents

Objective

The Omnibus contractor shall provide application development, integration, operational support for test, staging and production environments. The objective of this tasking identified in this Task Description is to provide the PITC with operations and maintenance of existing applications and the development and implementation of new applications that serve the needs of the Executive Office of the President. The applications must be remain secure from threats and vulnerabilities and the application’s data must be captured, preserved/retained, and retrievable to conform to policies/guidelines in the federal records acts, as applicable.

Problem Definition

Presidential Information Technology Community (PITC) seeks support for several application platforms both on premise and externally hosted. This requires monitoring and management of applications that identify health of applications, service disruptions, vulnerabilities within the application, access and privileges, capacity planning, trending analysis, license management, and data integrity.

The contractor shall be responsible for the management, operations and maintenance of existing enterprise applications and capabilities, within the context of:

· Planning and development of new applications

· Engineering effort for application capacity sizing, specification recommendations, shared services such as application virtualization and optimization services such as caching

· Generation and maintenance of application workflows

· Analysis and recommendations on versions and compliance of both enterprise and departmental applications

· Manage the security and records compliance of the application

· Functional capability and testing of applications

· Transition of applications and services from Service Design to Service Operations

· Monitoring application health

· Management of application access, authorization and accountability

· Application account management for users, control and privileges

· Role-based and single sign-on accessibility

· Break-fix and production support activities within Service Operations

· Proper decommissioning practices of application systems, platforms and data contents

Task Goals

Presidential Information Technology Community (PITC) seeks expertise and knowledge in program management, application development, testing environment, operation and management (O&M) support, and training to support the Executive Office of the President (EOP). This Task Order will ensure that the EOP’s Applications are:

· Secure

· High-availability

· Reliable

· Records compliant

· User-friendly

· Adaptable

Tasks

CLIN 0001: Application Project/Program Management and Product Management

Contractor will provide Project Management support, to manage outlined tasking for the capabilities listed below. The contractor shall oversee and manage the statuses of all defined projects outlined in this task order. The contractor shall support all project-level activity to ensure all goals are met. For this task order, the Project management support will be an onsite activity. The contractor shall work with Government Product Owners and Stakeholders to set priorities and manage work appropriately. Products and services that do not meet Government standards must be brought into compliance prior to implementation. The contractor shall be knowledgeable of market conditions, remain current on industry trends and updates relevant to the platform being used. The contractor shall use that knowledge to continue to enhance the strategic roadmap of the outlined product or services in this task.

CLIN 0002: Application Development/Engineering, Design, and Integration

The contractor shall develop, engineer and deploy in support of ongoing required maintenance for the capabilities outlined below. All development shall be based on the entire system development lifecycle which includes: requirement analysis, design, development, documentation, test, implement and sustainment of applications and their infrastructures.

For the capabilities referenced below, the contractor shall:

· Implement solutions to support third party integrations by way of a service oriented architecture (SOA)

· Facilitate, configure, and maintain a highly-available, clustered architecture through collaboration with other partners

· Configure solutions for use with single sign-on capabilities

· Maintain compliance with organizational data retention, security, design, and engineering standards

· Implement solutions to support geographically-dispersed clients, including, but not limited to, mobile capabilities

· Solutions must perform equally on agency-supported Windows and MacOS platforms, and across organizationally-supported browsers.

For this task order, the contractor shall implement solutions using an agile methodology. The contractor shall keep current with industry trends, including the use of localized services, content delivery networks, and cloud services.

The contractor is responsible for attaining and maintaining proper certification levels as defined by government. This may include, but is not limited to, the Department of Defense (DoD) 8140 Compliant (formerly DoD 8570) standard.

The contractor shall provide certification and accreditation activities; such as working with the Government to scan new data service environments to obtain Authority to Operate (ATO). The Contractor shall ensure work products are compliant with all applicable Federal IT security laws and regulations, as well as Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and Department of Homeland Security (DHS) security and control requirements for certification and accreditation (C&A).

These capabilities include:

· Development, integration, user acceptance testing (UAT), and production environments in support of application maintenance requirements

· User permission management, including single sign-on and community memberships

· Ensure uptime, full mission capability, access management, and accessibility of supported applications

· Salesforce (Cloud hosted)

· Development, integration, UAT, and production environments in support of

· User permission management, including single sign-on and community memberships

· Management of multiple Salesforce Orgs and sites

· Manage and update standard and custom objects and related fields

· Create and manage the Apex codes (i.e. triggers, classes)

· Create, manage and update Visualforce pages

· Conduct Application and Tab management

· Manage and develop custom metadata types

· Utilize Process builder for process management

· Utilize Lightning Experience for generating new capabilities

· Utilize the Einstein Analytics

· Leverage data sharing through MuleSoft Runtime and PCE environments

· Salesforce Target Architecture The contractor shall be responsible for reviewing existing Salesforce org configurations, existing target architecture plans, proposing changes to current or target architecture based on industry best practices, and implementing an accepted target architecture. The contractor is responsible for the migration of approximately 30 to 40 codependent Salesforce applications to the target architecture. The migration shall include an upgrade of each app from Salesforce Classic to Lightning Experience.

The contractor is responsible for establishing and maintaining interoperability capabilities between Salesforce and other system architectural components, both within and external to the enterprise, by way of MuleSoft PCE and runtimes.

The contractor is responsible for timely development and delivery of system architecture, technical, operational, and end user documentation in support of any and all solutions implementations. The contractor shall provide end user training to the Applications Management Group and, as appropriate, end users.

All developed code, configuration, documentation, requirements, user stories, and other related artifacts are to be centrally maintained in a government approved repository. All artifacts, org metadata, application metadata, and application data is to be maintained in compliance with the Presidential Records Act of 1978.

The contractor is responsible for the establishment, management, and maintenance of development, integration, user acceptance testing, production, and any other required environments in support of this effort. The government strongly encourages using Agile methodology.

The scope of responsibilities include:

· Requirements analysis

· System architecture

· Application architecture

· Application development

· Application configuration

· System configuration

· Documentation

· Training

· Facilitation of user acceptance testing

· Functional and usability testing, including Section 508 compliance

· .NET (On premise)

· Develop and manage the Database schema

· Utilize C# source code incorporating Dynamic Link Libraries (DLLs), as required, to build new capabilities

· Develop HTML pages, cascading stylesheets, and related technologies

· Leverage JavaScript and related technologies to develop .NET applications

· Design and build utilizing Web services and service oriented architecture

· Configure Internet Information Services (IIS) in creating new applications

· SharePoint (On premise)

· Create List and document libraries

· Create Site and site collections

· Create SharePoint and web part pages

· Develop custom forms (i.e. Visual Studio, SharePoint Designer, InfoPath)

· Develop Nintex Workflows

· Configure SharePoint elements using out of the box, front-end facing capabilities, such as SharePoint Designer, Visual Studio, or related technologies

· ServiceNow (On premise)

· Development of custom fields, screens, and workflows

· Integration of ServiceNow with secondary ticketing platforms, to include Jira

· Configuration management, to include management of hardware, software, and resources

· Jira (On premise)

· Development of custom fields, screens, and workflows

· Configuration management, to include management of hardware, software, and resources

· Confluence (On premise)

· Creation spaces and pages for new initiatives

The government strongly encourages Agile methodology. The government reserves the right to prohibit the use of specific technologies. The contractor shall consider out-of-the-box, configuration-first approaches to solution implementation prior to proposing developed or procured solutions.

CLIN 0003: Application Administration, Operations, and Support

In this role, the contractor shall monitor, maintain, support upgrades, enhancements, break-fix, troubleshoot, and all modifications to production and development environments.

These services include changes and modifications to applications to provide additional service capacity, add features to software, reductions of operational risk, replace obsolete hardware, refresh equipment, or consolidate services.

In performance of these services, the contractor shall:

· Conduct data and system administration, analysis, testing/troubleshooting, tuning, and application programming activities

· Real-time system monitoring of the applications, the contractor shall provide a method to display monitoring data

· Perform preventive maintenance and repairs for applications

· Make changes to applications to increase efficiency, lower costs, and decrease operational risk

· Manage and document the configuration of the current architecture and planned architecture changes utilizing existing procedures and processes

· Ensure that no sustaining engineering change causes an overall system architecture modification or a degradation of service

· Development, integration, user acceptance testing (UAT), and production environments in support of application maintenance requirements

· User permission management, including single sign-on and community memberships

· Ensure uptime, full mission capability, access management, and accessibility of supported applications

· Provide critical incident management. A Critical Incident includes any event which disrupts, or which could disrupt, a service. Critical Incident Management is the comprehensive approach to preventing, preparing for, and responding to events effectively and efficiently

· Centrally manage, monitor, coordinate and communicate status of application performance

· Assess incident severity, host incident resolution conference calls, and coordinate necessary resources that are both internal to the contract and external to the contract (other providers, vendors and/or manufacturers)

· Manage and communicate the overall operating posture and incident status on a regular basis in accordance with the deliverables

· Standardize incident status and reporting mechanism (Application Dashboard)

The Contractor shall provide database and application administration all on premise applications, consisting of:

· Microsoft SQL Server

· Oracle

· MySQL

· Apache

This task order seeks operations support of the following applications platforms:

· Salesforce (Cloud hosted)

· Manage the Org and site

· Manage Applications and Tabs

· Manage the Einstein Analytics for analysis and trending

· Support the MuleSoft Runtime and PCE environments

· .NET (On premise)

· Manage the Database schemas and access

· Manage and maintain the source code and incorporated DLLs

· Manage HTML pages, cascading stylesheets, and related technologies

· Support the JavaScript and related technologies

· Monitor and support Web services and service oriented architecture

· Monitor and manage IIS configuration

· Manage the Crystal Reports

· SharePoint (On premise)

· Manage List and document library

· Manage Site and site collections

· Collaborate with Farm Administrators

· Manage SharePoint pages and web part pages

· Manage and update Nintex Workflows

· Manage SharePoint elements using out of the box, front-end facing capabilities, SharePoint Designer, Visual Studio, or related technologies

· The contractor is responsible for all capabilities that are made available through the following methods:

· Web front end

· SharePoint Designer

· Microsoft Visual Studio

· Nintex Workflows

· InfoPath Designer

· Third party integrated solutions

There are several SharePoint applications that require operations and maintenance:

· Records management

· Intranet site

· Internal contact directory

· Historical asset tracking

· Inventory management

· Scheduling application

· Transportation services

· Additional service fulfillment applications as needed

The contractor is expected to establish and maintain separate SharePoint 2013 farms for development and integration environments. All code and configuration is to be maintained through a revision control environment of the government’s choosing. The contractor is responsible for providing engineering, operational, architectural, and user documentation for any and all software development and configurations.

In addition, EOP components maintain site collections, mostly with basic document libraries and lists. In limited cases, Nintex Workflows are in use at these site collections. The contractor shall be responsible for the operations and maintenance of these sites and site collections, as well.

The scope of work defined by “operations and maintenance” includes, but may not be limited to:

· Creation of new sites, site collections, lists, document libraries, document sets, and pages

· Configuration management of existing sites, site collections, lists, document libraries, document sets, and pages

· Permissions management, including custom permissions, of sites, site collections, lists, document libraries, document sets, and pages

· Implementation of Nintex Workflows

· Data extraction in support of data lifecycle management capabilities

· Providing one-on-one user training in new and existing features to Application Management Group or end customers

· Quality assurance testing and review of all implemented functionality

· Scanning of paper documents

· Uploading of scanned documents into SharePoint repositories

· Development and configuration of data management capabilities within SharePoint repositories

· Development and configuration of content security capabilities within SharePoint repositories

· Development and configuration of robust, highly-available console-, form-, or web-applications in support of document management and upload to SharePoint repositories

· Development, integration, and configuration of content compression solutions in preparation of upload to SharePoint repositories

· Development and configuration of custom views, web pages, workflows, document libraries, document sets, lists, sites, and site collections in support of the records management application

· Installation, configuration, and maintenance of network- and USB-attached scanner devices The government strongly encourages Agile methodology for this task order, and prohibits the use of SharePoint Designer Workflows, except where SharePoint Designer or other workflows are already in existence and are not being replaced. The contractor shall consider out-of-the-box configuration as the preferred approach to all solution implementations. In the event that configuration approaches are not technically feasible, the contractor shall seek to implement solutions using the least complex approach technically feasible.

· ServiceNow (On premise)

· Manage custom fields, screens, and workflows

· Manage the integration of ServiceNow with secondary ticketing platforms, to include Jira

· Configuration management, to include management of hardware, software, and resources

· Jira (On premise)

· Manage custom fields, screens, and workflows

· Configuration management, to include management of hardware, software, and resources

· Manage the integration of Jira with secondary ticketing platforms, to include ServiceNow

· Confluence (On premise)

· Configuration management, to include management of hardware, software, and resources

· Manage spaces

· MicroPact Entellitrak (On premise)

· Manage the administration of at least two instances of Entellitrak

· Configuration management, to include management of hardware, software, and resources

· Administration of this application requires a TS/SCI clearance

The Contractor shall implement patches and updates to applications, data, and databases. The Contractor shall support application interfaces with other cloud-based or on premise systems. User access shall be managed with the intent to optimize licensing strategy for the Government. Knowledge-based documentation shall be provided to the Government which defines access management, usability, troubleshooting, and day-to-day maintenance for all new and enhanced applications.

The Contractor shall provide Tier 2 and Tier 3 support for production applications. The contractor shall provide database administration (DBA) and Extract, Transform and Load (ETL) operational services. Contractor shall adhere to the government provided trouble ticketing process to track and manage all incidents assigned to them. The contractor shall escalate to Tier 4 vendors, as applicable for incident and problem resolution. Contractor shall propose service level metrics related to escalation and resolution of incidents within Tier 2 and 3.

The Contractor is responsible for maintaining a secure application environment according to Government specifications to include, but not limited to, the Authority to Operate or FEDRamp certifications. The Contractor shall provide all supporting documentation needed to gain an Authority to Operate for developed applications. Such environments are required for development, integration, staging, and production, and are maintained in coordination with other organizational partners.

The Contractor shall develop and provide up-to-date key performance indicators in a centralized, government-approved format. The Contractor shall advise and provide recommendations of how new manufacturer-driven updates of the platform will impact software development and application support initiatives. When issues arise, the Contractor shall work with the Government to craft solutions to resolve bug fixes or other performance problems. The Contractor shall use a centralized bug and issue tracking system designated and hosted by the Government and will provide weekly reporting and metrics on the issues tracked and resolved.

The contractor is responsible for application decommissioning process and tasks, when another solution has been deployed as a replacement or no longer needed by Government.

The Contractor shall perform application-related work required for any Presidential Transition, in accordance with the government’s data lifecycle management strategy. The Contractor shall support the ability to transfer all Presidential records/data to NARA in an electronic format that NARA approves of as part of the Government data lifecycle management strategy. Contractor shall ensure and certify to the Government that data migrated between application instances is complete and accurate in accordance with Presidential Records Act, Federal Records Act and any other applicable federal law. At all times, contractor shall maintain proper information governance in the instance e-discovery is required.

The contractor shall maintain and update any training content, such as new procedures or workflows, for the EOP applications.

CLIN 0004: Quality Assurance and Testing (Reoccurring)

The contractor shall maintain compliance with Section 508 of the Rehabilitation Act of 1973, and organizational quality and design standards. Additionally, the contractor is responsible for the establishment and maintenance of the appropriate testing and integration environments.

The contractor shall use automated testing capabilities to ensure regression and unit tests are completed continually, and in a timely manner, against the full suite of applications within our service catalog. The contractor is responsible for the generation and execution of tests, test suites, and test cases, and for the consumption, analysis, and dissemination of test results to the appropriate parties. The contractor shall provide guidance to government as relates to the prioritization of defect resolution, including impact assessments of identified defects.

The contractor shall collaborate with other agency partners for user acceptance testing, vulnerability scans, and stress and load testing.

The contractor shall ensure all applications maintain interoperability with other third-party solutions.

Technology testing shall be in both a physical and virtual laboratory, for a variety of operating system platforms, software, applications, and network infrastructure in a secure environment. Examples of services include Test Automation, Performance Testing, and Functionality Testing.

Optional CLIN 0005: Quality Assurance and Testing (Completion)

The contractor shall provide test automation tools for the Quality Assurance/Quality Control (QA/QC) test environment. These tools shall provide regression testing for various PITC applications. The contractor shall provide recommendations on which tools and products the government should procure. Once the tools are procured, the contractor shall install, configure and implement in the PITC environment and shall create documentation for the PITC-specific installation guide and user manuals. The documentation shall outline how testing simulations and testing scenarios would work within the tools and products.

The PITC development and the Quality Assurance (QA)/Quality Control (QC) team will use the contractor’s implemented tool to perform automation testing and analyze test results for EOP custom applications. The tool will work on platforms and frameworks supported by the EOP to include but not limited to Windows, macOS, Salesforce, SharePoint, and Mobile Technologies (e.g., iOS).

Technology testing shall be conducted in both a physical and virtual laboratory, to ensure expected performance for internally-developed and maintained services, externally-developed and maintained services, and integration points between internal and external services, across a variety of technologies. These technologies include, but are not limited to, applications and websites delivered on SharePoint, Salesforce, .NET, WordPress, ServiceNow, Jira, and iOS; business intelligence and data analytics delivered through Microsoft SQL Server and Salesforce’s Einstein platform; and middleware platforms including internally-developed APIs and MuleSoft.

The contractor shall implement, centralize, and maintain automated testing capabilities and disseminate results to the proper stakeholders in accordance with organizational requirements, to validate performance and functionality across systems.

Optional CLIN 0006: Quality Application Licenses and Subscription

The contractor shall manage the user access and software licenses for the quality assurance and testing tools and products with the intent to optimize the licensing strategy. Contractor shall advise Government on best practices and most efficient strategies to reduce costs (i.e., annual or perpetual licenses). Contractor shall provide knowledge-based documentation which defines user access to the quality assurance and testing tools and products. The contractor shall track the end-of-life of the product and all patches and updates that pertain to the licenses of the tools and products.

Staffing Requirement Table 1 Key Personnel

Must have PMP certification and 5 years of application development experience.

Eg. Certifications in Salesforce, SharePoint, ServiceNow, .NET, ITIL Service transition, operations.