Specialty_Crops_Program_Modernization_Initiative_RFI.pdf

United States Department of Agriculture Agricultural Marketing Service

Specialty Crops Program Modernization Initiative

Replacement of Billings and Inspection Information System (BIIS), Fresh Electronic Inspections and Reporting System

(FEIRS) and Other Legacy Systems

Request for Information (RFI)

P a g e | 2

Specialty Crops Program Modernization Initiative – Request for Information (RFI)

Specialty Crops Program Modernization Initiative Request for Information (RFI)

Table of Contents

1. OBJECTIVE

2. BACKGROUND

3. SCOPE

4. REQUIRED FUNCTIONALITY

5. DEFINITIONS

6. ADDITIONAL DEFINITIONS

7. CHART OF SYSTEM

8. REQUIREMENTS

9. TASK/DELIVERABLES

10. TECHNICAL ENVIRONMENT

11. AGILE EXPERIENCE

12. CODE COMMENTING REQUIREMENTS

13. SECURITY REQUIREMENTS

14. SECURE CODING REQUIREMENTS

15. SYSTEM ACCESSIBIILITY TO THOSE WITH DISABLITIES

16. COMPLIANCE WITH INTERNET PROTOCOL v6.0 (IPv6)

17. OWNERSHIP OF SOURCE CODE

18. CONTRACTOR HOSTING REQUIREMENT

19. RECORDS REQUIREMENTS

20. THIN CLIENT CONFORMANCE

21. RFI FORMAT AND LIMITATIONS

22. APPENDICIES

P a g e | 3

1. OBJECTIVE

The purpose of this request for information (RFI) is to seek a software solution to support the inspection, grading, auditing, laboratory analysis, billing and productivity reporting activities of U.S. Department of Agriculture’s (USDA), Agricultural Marketing Service (AMS), Specialty Crops Program (SCP), Specialty Crops Inspection Division (SCI).

AMS’s SCP is interested in establishing a multi-year contract to obtain contractor services for the analysis, design, implementation, and development of a single software solution that replaces a number of legacy systems used to support the activities of SCI. These systems include SCI’s Billings and Inspection Information System (BIIS), Fresh Electronic Inspection and Reporting/Resource System (FEIRS) and other legacy systems.

It is expected that the Contractor will use a hybrid agile method approach to developing the solution for AMS SCP. AMS SCP is open to considering a customized, commercial-off-the-shelf (COTS), or hybrid solution.

This RFI is for informational purposes only and is not intended to commit the government to any course of action regarding this request. The responses to this RFI will be used to inform the government on the systems options available to help it meet its service delivery and billing needs.

2. BACKGROUND

New leadership at the USDA and within AMS have resulted in changing program strategies and policies. This provides SCP and SCI an opportunity to evaluate its portfolio of tools and systems used to provide vital services to the specialty crops industry. SCI’s key billing and certificate systems are aging, legacy systems that need modernization and replacement.

SCI provides a range of inspection, grading, auditing and laboratory analysis services under the authority of the Agricultural Marketing Act of 1946 to facilitate the efficient, fair marketing of America’s fresh, frozen, and processed fruits, vegetables, and other specialty crops.

In 2012, two formerly separate inspection programs were merged into a single organization, the SCI Division. The new organization was charged with supporting the global specialty crops market by collaborating with the agricultural community to provide trusted, impartial, prompt, and accurate quality assurance and food safety verification services. Services are voluntary except when mandated by a sales contract with a governmental entity, Federal marketing order or State requirement, and all services are provided on a user-fee basis.

SCI has approximately 700 personnel and partners with approximately 3,400 trained and certified State employees. SCI Federal staff are located at over 30 Federal receiving markets, about 370 processing facilities, 14 area offices, 6 sub-offices, and 30 inspection points across the country; as well as a training center in Fredericksburg, VA, and Headquarters staff in Washington, DC.

Approximately 95% of the Division’s budget is derived from user-fees paid for by customers within the specialty crops industry and other users of its services. These services include:

P a g e | 4

• Grading, inspection, and certification services;

• Voluntary audit-based services to verify good agricultural and manufacturing practices, Hazard Analysis Critical Control Point (HACCP), traceability, and food defense;

• Developing and maintaining U.S. grade standards, grading manuals, inspection aids, and color guides for standardized products, and commercial item descriptions for all commodities; and

• Conducting laboratory analysis of various agricultural commodities.

Together Federal and State employees inspect and certify more than 3 billion pounds of processed fruit and vegetable products and over 52 million pounds of fresh fruits and vegetables. These totals include more than 1 billion pounds of fresh and processed fruit and vegetable items for America’s domestic feeding programs (school lunch and others). SCI also conducts approximately 4,000 food safety audits annually to verify that fruits and vegetables are produced, packed, handled, processed, and stored as safely as possible to minimize risks of microbial food safety hazards.

SCI’s systems are aging, legacy billing, inspection, and certificate systems, including BIIS for processed products and FEIRS for fresh products. SCI uses a number of legacy, standalone solutions and database systems, including but not limited to audit, certificate generation, date grading, and raisin moisture databases.

As additional background, the FEIRS program allows Federal and some State graders to efficiently and accurately complete inspections, and gives customers legible, professional, nearly real-time inspection certificates. FEIRS is an automated business platform to support the provision of fresh inspection processes and provides functionality for the electronic reporting of grading, certification, and billing related to inspections of fresh specialty crops products. The system is comprised of inspection modules for all 86 commodities covered by the US grading standards.

As an aid to the grader within the FEIRS program, a complete set of references is available including the most up to date US grade standards, Official Visual Aids, and Inspection Instruction Handbooks; a billing process; and, access to a wide variety of reports summarizing certificates generated by field offices and inspectors. With approved access, anyone can view, print, or email a copy of the certificate accessible via a designated website.

This is an opportunity for SCP/SCI to modernize how it provides services to the specialty crops industry by implementing a holistic technology solution. With the Department’s emphasis on customer service, this is an opportunity to consider how SCI provides its services in the most cost-effective and satisfactory manner. For example,

• Utilizing a web-based solution, AMS may be able to offer customer specific data and analysis as a value-added service offering or a new business line.

• Information feeds to other databases within AMS and outside, will enhance the ability to collect and transmit data important to the produce industry such as inspection data for imports.

• Tracking progress of inspections will allow for more efficient inspector dispatch and routing.

P a g e | 5

3. SCOPE

AMS seeks a Contractor to provide options for a holistic application that supports its inspection, grading, auditing and laboratory analysis functions, including the collection and reporting of inspection, audit, certificate and billing data, among other functions.

The legacy components that support both BIIS and FEIRS will be replaced by this new IT solution.

In addition to the functionality that exists in the legacy licensing and billing programs, there is a need to integrate other commodities, databases and functionality from other tools into the systems solutions. For example, it is necessary to include support for processed products inspection and grading along with customized applications including date grading, a raisin moisture database and more.

4. REQUIRED FUNCTIONALITY

The new solution shall include the following mandatory capabilities or functionality in support for:

• A Federal Risk and Authorization Management Program (FedRAMP) certified Software as a

Service (SaaS) or commercial-off-the-shelf (COTS) application that is optimized for a cloud Platform as a Service (PaaS).

• A unified single HTML 5 compliant web-based solution offering a flexible data capture and reporting capability that integrates with an enterprise level database solution and supports industry standard database architecture.

• A responsive design that supports common mobile devices such as: laptops, tablets, smart phones, etc.

• A role-based solution that is easily administrated by AMS personnel.

• A single sign on architecture via USDA E-Authentication to determine user role and permissions with options for State Partner’s e-Authentication.

• A secure public facing portal where customers may access customer specific data including generating reports, data analysis functions, checking certificate status, initiating payment, and updating account/profile information. Customer outreach and polling will identify desired functionality.

• Integration with Pay.gov for direct electronic payment by the applicant either at the time of service or on a monthly invoicing schedule.

• Real time external reporting of relevant data to other AMS agencies (Marketing Orders and Agreements, Commodity Procurement, etc.). Additionally, integration with:

• International Trade Data System (ITDS) involving the electronic submission of data related to importation of certain types of fruits, vegetables and specialty crops.

• Automated Customs Entry Electronic System which allows the transfer of weights recorded at time of inspections versus declared imported weights to verify inspection requirement are met.

P a g e | 6

• Enterprise level reporting features. Report functionality shall include the ability to report at a minimum:

Service location and type, Product lot pass/fail, Certificate log and certificate Inspector census Inspector utilization/productivity, Service application information, Inspector rotation, Inspector pass/fail rates, etc., Certificate generation, Individual commodity data Revenue and cost analysis

• Reporting comprehensive revenue generation, forecasting and actuals for all division activities, accessible by field staff.

• Customer Relationship Management functionality that will allow for the collection and retrieval of customer centric data for any geographical location. Filtering applicant numbers by locality for ease of customer data retrieval.

• FedRAMP and Federal Information Security Management Act of 2002 (FISMA) compliance:

The security controls used to assess and authorize federal systems are contained in National Institute of Standards and Technology (NIST) Special Publication 800-53 (https://nvd.nist.gov/800-53)

• Usage of standardized certificate templates, audit or lab results and other standardized outputs.

• Inclusion of images into reports and certificate that the system generates. (Not as attachment but included in report/certificate itself)

• Acceptance of custom application inputs and outputs.

• Customer Relationship Management (CRM) functionality for managing customer pertinent information.

• Use of data visualization tools for internal data quality review of data sets.

• Best practices for protecting confidential or sensitive information.

• Backend auditing capabilities that capture data collection, manipulation, and reporting metrics to ensure data quality.

• The ability to assign, dispatch, and complete pending service requests.

• Standardized business rule engine offering a dynamic backend interface that allows flexible changes to be introduced without contractor interface.

• Integration over time, with other USDA systems including, but not limited to Web Time and

Attendance (WebTA), Concur travel system, and Financial Management Modernization Initiative (FMMI) financial system.

For SC personnel where internet connectivity is not available, the solution should offer:

• A distributed client would be needed to offer minimal functionality identified by the Product Owner to complete inspector’s duties. This client would be installed on AMS laptops. It would not be integrated with E-Authentication.

Standardization Initiative

SCI is working to improve and standardize business processes across the lines of business to ensure the implemented system is straightforward and seamless:

https://nvd.nist.gov/800-53

P a g e | 7

• Standardized certificate/report and other outputs and related terminology

• Standardized request for service forms across SCI and related terminology

• Decision point regarding individual input of data versus centralized billing input and customer services (a system that creates billing based on how the inspector enters the data into the system versus a system where a centralized group of billing technicians /customers service representative enters information into the system based on submitted data from staff and customers)

• Standardize and modernize how applicants may request service, ie. Web-based scheduling portal, text, email, phone, fax.

• Standardize billing and business operations between the fresh and processed inspection programs to create uniformity and efficiency between offices.

• Auditing, training, lab support services must also be included to ensure all lines of business follow a uniform process.

• Define state partners’ access rights and roles and responsibilities. In addition to Federal staff, AMS State partners require access to the inspection and other platforms.

• Standardize customer information forms, related terminology and how customers submit information to set up accounts and update account information.

• Standardize billing rules for both scheduled and unscheduled services; along with a need to bring the billing systems together.

• Ensure that all field employees are given access to all necessary systems per their role and ensure that they have the tools necessary to access systems.

• Administrative privileges to those in the supervisory chain to add, modify or delete user access.

5. DEFINITIONS

Abbreviation Definition

AMS Agricultural Marketing Service

BIIS Billings and Inspection Information System

CFR Code of Federal Regulations

CIO Chief Information Officer

COR Contracting Officer’s Representative

CMMI Capability Maturity Model Integration

COTS Commercial Off the Shelf

CRM Customer Relationship Management

CSV Comma Separated Value File

EVM Earned Value Management

FAR Federal Acquisition Regulations

FEDRAMP Federal Risk and Authorization Management Program

FEIRS Fresh Electronic Inspection and Reporting/Resource System

P a g e | 8

FFP Firm Fixed Price

FISMA Federal Information Security Management Act

FMMI Financial Management Modernization Initiative

GSA General Services Administration

IIS Microsoft Internet Information Server

IT Information Technology

ITS Information Technology Services

IP Internet Protocol

JAD Joint Application Design

MAP Management and Analysis Program

MBI Moderate Background Investigation

Marketing Orders and Agreements

Marketing agreements and orders are initiated by industry and approved by producers and the Secretary of Agriculture to help provide stable markets for dairy products, fruits, vegetables and specialty crops.

MOAD Marketing Orders & Agreements Division

NIST National Institute of Standards and Technology

NITC National Information Technology Center

OICs Officers-in-Charge

PAAS Platform as a Service

PM Project Manager

PPASB Performance, Planning, and Advisory Services Branch

SB Small Business

SCP Specialty Crops Program

Section 8e Section 8e of the Agricultural Marketing Act of 1937 As Amended provides that whenever certain commodities are regulated under Federal marketing orders, imports of those commodities are prohibited unless they meet the same or comparable grade, size, maturity requirements as those in effect for the domestically produced commodities.

SOW Statement of Work

SSRS SQL Server Reporting Service

TFS Microsoft Team Foundation Server

USDA United States Department of Agriculture

WAN Wide Area Network

WORKING DAYS Monday through Friday excluding Federal holidays.

P a g e | 9

WSG Web Style Guide

VPN Virtual Private Network

USDA U.S. Department of Agriculture

WebSCM SAP Web-based Supply Chain Management System

6. ADDITIONAL DEFINITIONS

Abbreviation Definition

CONTRACTOR A supplier or vendor having a contract to provide specific supplies or service to the government.

CONTRACTING

OFFICER

A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

CONTRACTING

OFFICER'S

REPRESENTATIVE

(COR)

An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

DEFECTIVE SERVICE A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE Anything that can be physically delivered but may include non-physical things such as Status Meetings.

KEY PERSONNEL Contractor personnel are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons listed in the proposal.

7. CHART OF SYSTEM

Systems Purpose Segment of SCI Division

FEIRS Certificate and Billing Fresh

BIIS Billing Processed SC-146 Certificate Processed SC-66 Certificate Processed

P a g e | 10

Incoming Raisin Database

Report to RAC about volume of raisins

Processed, specifically raisins

Date Grading Program

Processed, specifically dates

ITDS Compliance MOAD – connected to SCI Division work

WebTA Payroll All Concur Travel All FMMI Accounting All Payment Tracking

Billing Processed

Lotus Notes Audit reports and program management Plant surveys Plant system audits, QTV Program, Food Defense Audits Product grade reviews

Processed – Audits

Processed

Processed

Audit Database Audit program reports, program management, and certification website postings

Fresh - Audits, including commodity specific export check programs.

Processed – Plant Surveys, Food Defense Audits, etc

8. REQUIREMENTS

• Phase 1: AMS is currently undergoing a process to map our existing inspection, billing and other administrative functions as well as our customer interaction points such as requesting an inspection. This process includes the review of current application interfaces (including input forms, reports, etc.), observing existing data capture processes, and capturing new functionality required to support SCI’s lines of business. This information will be made available to the selected vendor to assist in application development. In addition, SCI will facilitate a customer needs assessment via a series of outreach sessions to determine desired functionality.

• Further, the Product Owner (PO) has the following responsibilities during Phase I: prioritizing user stories and product backlog, establishing and promoting the product vision to Contractor, monitoring progress against goals, and making decisions on product direction and implementation release points in conjunction with the Contractor. The PO and contractor’s primary focus of Phase 1 will be to create user stories and Product Backlog.

• Phase 2: As part of the agile development process, the Contractor shall design, develop, test, and implement the solution in incremental and iterative stages. The Contractor, working in close coordination with the PO, shall formulate and plan the Sprints using Prioritized Product Backlog from Phase 1. A test-driven agile development approach shall be used throughout the various iterations to validate the requirements and obtain user acceptance. User stories may be added to or deleted from the product backlog throughout Phase 2.

P a g e | 11

• Phase 3: The final phase will include user training, final end-user documentation, security control documentation to support application assessment and authorization (A&A). Training will be developed in close cooperation with SCI. The detailed requirements for FFP deliverables (number and location of training courses; A&A document and control testing templates, etc.) will be confirmed at the close of Phase 2 and the Contractor shall be allowed to update price proposals to reflect changes requested by the Government.

9. TASK/DELIVERABLES

Table 1: Phase 1 Tasks and Deliverables

PHASE 1 GOAL:

During Phase 1, With guidance from AMS IT and SCP, the PO and Contractor shall define and develop business requirements as user stories, data requirements, and a reasonably detailed system and database design specification. The Contractor shall hold multiple sessions to capture the user stories. The user stories shall be independent, negotiable, valuable, estimable, sized appropriate, and testable. The user stories shall be sufficiently decomposed to fit within 3-week sprints and prioritized by product owner. The tasks for Phase 1 are defined below.

No. Task Task Description Deliverables

User Story Workshops

Using the AMS mapping process as a base of knowledge, the Contractor shall elicit, analyze, and document the user stories to support the agile development. As part of this task, the Contractor will review the users’ business process, conduct interviews with project stakeholders including staff and customers, and ensure that the documented requirements clearly, completely, and correctly represent the users’ business needs. To capture the user stories, the contractor shall:

• Facilitate Joint Application Design (JAD) Sessions with the user community which could include staff, customers and other stakeholders.

Conduct interviews with Subject Matter Experts (SMEs) for existing applications. These interviews include the SMEs for BIIS, FEIRS, etc.

• Conduct interviews in Washington, DC, with the SCP Field Support Staff.

• Review current database definitions, including database structures, input, output and report formats

User Stories

P a g e | 12

• Review functionality that mimics new functionality the new system will use, the government will provide acceptable examples.

System and Data Requirements Analysis Services

The Contractor shall use the results of the AMS mapping process as well as the defined user stories to analyze and document the following:

performance requirements; business rules;

business workflow processes; inputs, processing, and output requirements; and audit data access requirements.

The Contractor shall provide an initial set of backlog items. The Contractor shall estimate the backlog list using relative effort-to-complete estimates and work with the Government to prioritize the stories to identify the “must haves,” “should haves,” “could haves,” and “won’t haves.”

The Contractor shall define the functional and non-functional application requirements.

The Contractor shall design a new database structure that supports the dynamic requirements of the application and ensures the new system is scalable and allows for modifications to support future business requirements. The Contractor shall develop data mapping diagrams to show the transformations of data required to support the new business process.

Product Backlog

Process Flows Model

Data Requirements Document

Functional and nonfunctional requirements

Project Management Specifications

The Contractor shall develop a project management plan that will be used to manage the project consistent with the Project Management Institute project management principles.

The Contractor shall develop a project schedule.

To provide as much historical consistency as possible with the new data sets, the Contractor shall develop a detailed migration document

Project Management Plan

Project Schedule

Detailed Database Migration Document

P a g e | 13 that describes the necessary extract, translate, and load process to migrate the data from existing data tables to the new relational database in accordance with the new database model.

Table 2: Phase 2: Tasks and Deliverables PHASE 2 Goal: The goal of this phase is to iteratively develop the new solution. Since an agile approach will be used for the development process, user stories may be implemented as essential, deferred for later releases, or deemed unnecessary. The user stories shall be implemented based on priority. Any update to user stories or design elements will be reviewed and approved by the product owner with input from the team. User stories that are added shall be placed in the appropriate place in the product backlog in TFS.

No. Task Task Description Deliverables 1 Design System design will be performed iteratively as part of each sprint. Designs may include, but are not limited to sketches on a whiteboard, detailed models, or other examples which describe the system requirements, operating environment, system and subsystem architecture, files and database design, input formats, output layouts, human-machine interfaces, detailed design, processing logic, and external interfaces.

Sketches, detailed models, prototypes

2 Application Development

The Contractor shall develop or configure specific open-sourced code to address each functional area using an agile approach.

A test-driven development (TDD) approach shall be used throughout the various iterations to validate the requirements and obtain user acceptance. The development shall be tested continuously.

The solution shall be developed incrementally throughout the various iterative development stages with the goal of deploying production releases. This includes, but is not limited to input screens, workflows, reports, custom reports, and interfaces for both internal and external users.

Source Code (deployable increments of software at the end of each sprint)

3 Testing Testing shall be performed iteratively during each sprint. Automated testing shall be performed to support the time boxed sprints.

Integration and Stress testing shall be performed throughout the migration.

Test Plan

Test Report (Test reports include the results of all tests performed including

P a g e | 14

Performance, Load, Security, Unit, System, Functional tests, etc.).

4 Implementation Application Administrator and End-User documentation shall be accurate and complete at the close of each sprint. User stories may or may not be implemented at the end of every sprint. When user stories are approved for production release, the Contractor shall develop a release plan.

Application Administrator and End User Documentation

Release Plan

5 Project Management

The Contractor shall develop a Government approved roadmap of potentially shippable releases in accordance with agile development methodologies.

The Contractor’s project manager (i.e., scrum master) shall coordinate and plan sprints in conjunction with the product owner. The project manager will coordinate sprint planning meetings that will include reviewing the product backlog with the product owner and identifying the stories, features, and tasks for the subsequent sprints.

As part of the sprint planning meeting the team will discuss the sprint objectives with the product owner and ask clarifying questions and remove ambiguity.

As part of each sprint planning meeting the Sprint Backlog will be groomed.

The Contractor’s project manager shall designate production release points using the release plan (as approved by product owner).

The Contractor’s project manager shall facilitate sprint retrospectives with the team at the end of each sprint. Improvement plans will be documented as outputs of the sprint retrospectives. The Contractor’s project manager shall provide the burn-down chart at the end of every sprint that reflects the work remaining to be done.

Sprint Backlog

Product Roadmap

Improvement Plans

Burn down Chart

6 Technical Debt Sprint

There shall be a 90-day warranty provided after the Contractor implements a new production release point to the Government.

Technical Debt Sprint

Test Results

P a g e | 15

Defects include issues found within the software, installation procedures, documentation, or other items relevant to the solution development. Outstanding defects that are discovered during the 90-day warranty period will be addressed by a technical debt sprint at no cost to the Government.

Test Summary Report

Table 3: Phase 3 Tasks and Deliverables PHASE 3 GOAL: Phase 3 will include user training, user documentation, and assessment and authorization (A&A) documentation No. Task Task Description Deliverables 1 User Training The Contractor shall conduct well planned training sessions on functionality, navigation, and maintenance of this solution. Training topics shall cover all reasonable components of this solution serving the Division.

User Training to identified user groups.

2 Assessment and Authorization Documentation

The Contractor shall complete USDA template documents that demonstrate the application’s security controls to comply with NIST 800-53.

A&A Documentation

3 System Documentation

The Contractor shall prepare a comprehensive, complete and descriptive End User Guide and Application Administrator Guide that covers technical operations and maintenance.

Application Administrator Guide

End User Guide

10. TECHNICAL ENVIRONMENT

The AMS Technical Environment Standards are defined in Appendix A.

11. AGILE EXPERIENCE

The Contractor must have proven successful experience using Agile on past projects. While SCRUM is preferred, the Contractor may demonstrate experience using other Agile practices (i.e.

using iterative and incremental development).

The Contractor shall provide individuals with the following skills:

• Agile development (preferably SCRUM methodology)

• Agile project management (the Contractors will be required to demonstrate past experience successfully managing Agile projects. It is preferred that the Contractor’s project manager have at least 5 years of proven Agile project management experience).

• Test Driven Development

• Refactoring

• Continuous Integration

• Analysis (experience writing user stories is required)

• Software quality assurance

P a g e | 16

• Configuration management

• Automated testing (including functional, load, performance, and regression).

• Information assurance

• Web services development and Service Oriented Architecture (SOA) design

• Graphical user interface design and construction

• Microsoft.Net development processes and tools/utilities

The Contractor shall provide individuals with proven skills and experience to provide the following key roles in the Agile software development effort:

• Scrum Master should be a Certified Scrum Professional or hold PMI-Agile Certified Practitioner (ACP) Certification and have at least 5 years proven experience successfully leading Agile projects. The required demonstrable experience shall not include experience on traditional waterfall projects. All 5 years shall be Agile project management experience.

• Developer is preferred to be a Certified Scrum Developer and should have at least 3-5 years proven experience in Extreme Programming (XP) on Agile projects. The Agile framework does not separate functions; therefore, all members of the technical team will function in the Developer role. The developers should have at least 3-5 years of experience in the following: Agile Analysis (e.g., capturing user stories), Design, Development, Agile Testing, Configuration Management, and Systems Architecture. The demonstrable 5 years of experience should be on Agile projects.

12. CODE COMMENTING REQUIREMENTS

The vendor shall comment on all code based on industry best practice. The comments should provide adequate details needed to understand the logical flow, behavior and purpose of the code that is written. At a minimum, code comments should describe the intent of the code; provide an algorithmic overview, and the logical flow of the code. Code comments should also identify who wrote the code, when the code was written, and if/when code updates are made the name of the developer who updated the code and the purpose for the updates. Please use these links for additional guidance for development in Microsoft Visual Studio (http://msdn.microsoft.com/en-us/library/xzysab5k.aspx and http://msdn.microsoft.com/en-us/library/ms172653.aspx).

13. SECURITY REQUIREMENTS

The Contractor shall be responsible for properly protecting all information used, gathered or developed as a result of work under this contract. The Contractor shall also protect all government data, equipment, etc. by treating information as sensitive. The contractor shall be responsible for the following:

• Prior to beginning work, all key personnel and any contractor personnel requiring access to AMS production IT information systems must be properly cleared, at a minimum, with an appropriate security clearance/investigation of a Federal Public Trust Moderate Background investigation (MBI).

• All contractor personnel shall complete annual USDA provided security and privacy training.

http://msdn.microsoft.com/en-us/library/xzysab5k.aspx http://msdn.microsoft.com/en-us/library/xzysab5k.aspx http://msdn.microsoft.com/en-us/library/ms172653.aspx

P a g e | 17

• All Contractor personnel shall sign a Non-Disclosure Agreement and a Rules of Behavior Agreement with AMS.

14. SECURE CODING REQUIREMENTS

The Contractor shall ensure the application is developed in a secure manner. AMS uses the IBM Rational AppScan tool (http://www.ibm.com/developerworks/rational/products/appscan) for determining vulnerabilities. The Contractor shall develop custom software that does not contain any High, Medium, or Low vulnerability including the vulnerabilities listed on this website:

(http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project). If there is a justifiable reason why any Medium or Low vulnerability is irresolvable, the contractor may submit a written justification to the AMS CIO requesting an exemption from this requirement. The justification shall include the reason why this exemption should be granted.

If any solution is developed using third party software the vendor shall ensure that all code vulnerabilities are addressed before delivering the solution to the government. Third party software without source code is exempt from this requirement. The contractor may submit a written justification to the AMS CIO requesting an exemption from this requirement. The justification shall include a reason why this exemption should be granted.

15. SYSTEM ACCESSIBIILITY TO THOSE WITH DISABLITIES

In accordance with Section 508 of the Rehabilitation Act of 1973, as amended, all systems procured on or after June 21, 2001, shall be 508 compliant. In addition, data shall be gathered during the JAD sessions (if applicable) that give due consideration to any special assistive accommodations to users with disabilities in accordance with Section 508 of the Rehabilitation Act as amended. The result of the assessment shall be incorporated in the written deliverables.

The Contractor shall be certain that all technology delivered complies with standards set forth in Section 508 of the Rehabilitation Act of 1973, as amended, particularly 36 CFR 1194.21-22. For more information, refer to www.section508.gov.

The system shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this RFI, the RFI shall take precedence.

Rehabilitation Act, Section 508 Accessibility Standards

1. 29 U.S.C. 794d (Rehabilitation Act as amended)

2. 36 CFR 1194 (508 Standards)

3. www.access-board.gov/sec508/508standards.htm (508 standards)

4. FAR 39.2 (Section 508)

5. USDA Standards, policies and procedures (Section 508)

In addition, all contract deliverables are subject to these 508 standards as applicable.

Regardless of format, all Web content or communications materials produced, including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information http://www.ouncelabs.com/ http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project http://www.section508.gov/ http://www.access-board.gov/sec508/508standards.htm%20(508

P a g e | 18 provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents above. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the RFI, shall be the responsibility of the contractor or consultant.

The following Section 508 provisions apply to the content or communications material identified in this RFI:

36 CFR Part 1194.21 a - l 36 CFR Part 1194.22 a - p 36 CFR Part 1194.31 a - f 36 CFR Part 1194.41 a – c

The contractor shall provide a completed Section 508 Product Assessment Template and the contractor shall state exactly how proposed EIT deliverable(s) meet or does not meet the applicable standards.

The following Section 508 provisions apply for software development material identified in this RFI or TO:

For software development, software applications, and operating systems the Contractor/Developer/Vendor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.21 (a – l) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

a. Information Technology – General Information http://www.ocio.usda.gov/508/index.html#resources

For web-based applications (intranet, internet information and applications, 16 rules), the Contractor shall comply with the standards, policies, and procedures below:

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.22 (a – p) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

a. Information Technology – General Information http://www.ocio.usda.gov/508/index.html#resources http://www.access-board.gov/sec508/508standards.htm http://www.ocio.usda.gov/508/index.html#resources http://www.access-board.gov/sec508/508standards.htm

P a g e | 19

For Telecommunication products the Contractor shall comply with the standards, policies, and procedures below:

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.23 (a – k) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For video and multimedia applications (including training), the Contractor shall comply with the standards, policies, and procedures below:

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.24 (a – e) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For self contained, closed products, the Contractor shall comply with the standards, policies, and procedures below:

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.25 (a – j) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

a. Information Technology – General Information http://www.access-board.gov/sec508/508standards.htm http://www.ocio.usda.gov/508/index.html#resources http://www.access-board.gov/sec508/508standards.htm

P a g e | 20

For Desktop and portable computers, the Contractor shall comply with the standards, policies, and procedures below:

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.26(a – d) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

a. Information Technology – General Information http://www.ocio.usda.gov/508/index.html#resources

All Electronic Information Technology that is subject to the 36 CFR 1194 standards will have a Section 508 acceptance test and Section 508 will be validated upon acceptance. All maintenance for Electronic Information Technology that requires upgrades, modifications, installations and purchases will adhere to the Section 508 Standards and 36 CFR 1194.

16. COMPLIANCE WITH INTERNET PROTOCOL v6.0 (IPv6)

Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products:

Specifically, any new IP product or system developed, acquired, or produced must:

• Interoperate with both IPv6 and IPv4 systems and products, and

• Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

• As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

• The Contractor shall provide technical support for both IPv4 and IPv6.

• Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

• Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

P a g e | 21

17. OWNERSHIP OF SOURCE CODE

Any proprietary software used in a solution for AMS shall include the source code. Vendors shall not deliver solutions that include compiled code for which source code is not provided to AMS or which the vendor claims are not the property of AMS without getting the government’s approval to do so in advance. This does not apply to commercially available software that is commonplace in the market. For specific COTS software used in this solution, FAR clauses 52.227-15 through 52.227-19 apply.

18. CONTRACTOR HOSTING REQUIREMENT

The contractor shall host the development environment at their own facility during this task order.

AMS will not reimburse the contractor for hosting costs, nor will it provide any government furnished equipment or reimburse the contractor for network or internet connections, power, or cooling costs for hosting at the contractor facilities. The contractor is not required to make this environment available to AMS to access unless it feels access would improve efficiency for supporting development. The development environment should be reasonably compatible with and configured to realistically represent the production hosting environment described in the Technical Environment that it will be deployed to. The contractor shall fully test the system according to the contract specifications in the contractor's environment prior to deployment in the AMS environment.

19. RECORDS REQUIREMENTS

Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33;

Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

• Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

• In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

• In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

• AMS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of AMS or destroyed except for in accordance with the provisions of the

P a g e | 22 agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to AMS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

• The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to AMS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

• The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and AMS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

• The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with AMS policy.

• The Contractor shall not create or maintain any records containing any non-public AMS information that are not specifically tied to or authorized by the contract.

• The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

• AMS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which AMS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

• Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take AMS-provided records management training.

The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

20. THIN CLIENT CONFORMANCE

Any user interfaces to this system shall be browser based. Corporate network user interfaces shall be browser based or thin client compatible without application code modifications.

P a g e | 23

21. RFI FORMAT AND LIMITATIONS

RFI respondents are required to provide the following information in addition to…