Attachment_2_Task_Order_1_SOW_revised.pdf

FARM Task Order Statement of Work for Operations & Maintenance

Food and Drug Administration (FDA)

Food Applications Regulatory Management (FARM) System Operations & Maintenance Task Order

Request for Quote #: 14‐223‐SOL‐00003

1. BACKGROUND

The Center for Food Safety and Applied Nutrition (CFSAN) is one of six product‐oriented centers at the FDA that are charged with advancing a portion of the Agency’s mission. CFSAN assures the safety of most foods and dietary supplements. CFSAN also regulates food additives and food labeling, including certain claims made about food products. In addition, it evaluates products that are used in food handling and storage, referred to as "food contact substances”. CFSAN provides services to consumers, domestic and foreign industry, and other outside groups. These services relate to field programs, agency administrative tasks, scientific analysis and support, policy, pre‐market safety review and authorizations, planning and handling of critical issues related to food and cosmetic products.

CFSAN uses the mission‐critical Food Applications Regulatory Management (FARM) System to perform its core responsibilities of reviewing pre‐market submissions for substances added to food under the Federal Food, Drug and

Cosmetic Act (FD&C Act) as well as submissions under the Food Allergen Labeling and Consumer Protection Act

(FALCPA). FARM is the primary system available to CFSAN reviewers to access and review industry submissions and conduct analysis with regards to chemical, toxicological, environmental, and other issues, regarding specific ingredients.

FARM is essential for the OFAS regulatory safety decisions. Specifically, this tool supports CFSAN’s Office of Food

Additive Safety (OFAS) and the Office of Nutrition, Labeling and Dietary Supplements (ONLDS) in their review of a wide variety of submissions and petitions submitted by regulated industry.

For OFAS these submissions/petitions include:

Generally Recognized As Safe Notices (GRNs), Food Contact Notifications (FCNs), Biotechnology Consultations (BNFs), New Protein Consultations (NPCs), Infant Formula Notifications (IFN), Food Allergen Labeling and Consumer Protection Act notifications and petitions (FALNs and FALPs), Food and Color Additive Petitions (FAPs and CAPs).

For ONLDS these submissions include:

New Dietary Ingredient 75 Day Notices (NDI), 30 Day Structure Function Label Notices.

In addition to providing information technology support to the scientific review of submissions to OFAS and ONLDS, the

FARM System supports critical required functions for OFAS, including:

Citizen Petition responses, Freedom of Information (FOIA) responses and

Correspondence, including with Congress.

CFSAN has iteratively upgraded the FARM system to its current configuration – version 5 (FARM V), an integrated system that supports content management, search/retrieval, workflows, reporting, forms management, and scanning activities

(performed under a separate contract).

While the FARM system is in full production at present, the Agency is seeking services for its on‐going Operations &

Maintenance.

1.1 Purpose

The purpose of this Task Order is to provide Operations and Maintenance (O&M) support for the FARM system.

1.2 Scope

The scope includes the full range of O&M support services including FARM database administration, support services for scheduled/unscheduled reporting, Oracle infrastructure platform; issue identification, tracking, analysis, and resolution; release management; configuration management; change incorporation; custom code (e.g., Forms, Business

Objects/ PL/SQL, Workflow, etc.); testing and documentation; change incorporation; maintenance of tools, specialized configurations, customizations and process automation such as scripts, templates, and workflows; performance tuning and monitoring; system administration; and user account administration.

FARM Systems Operations and Maintenance (O&M) activities focus on routine operations and maintenance support necessary to maintain the availability, reliability, and security of the FARM system.

2. REQUIREMENTS

The Contractor shall support and perform all EPLC lifecycle activities, documentation, hardware, and software deliverables required and defined in this document.

2.1 Transition‐In Support

The Contractor shall provide Transition‐In support in order to provide an orderly transition from the incumbent

Contractor to the successor Contractor. The successor Contractor shall work toward the Government’s goal of ensuring minimal disruption to the current system and operational activities.

Working with the incumbent Contractor and the COR, the successor Contractor shall develop a plan to take over on‐ going work from the incumbent Contractor as required in this Task Order.

Representative activities shall include:

Develop a Transition‐In plan, Participate in Transition‐In meetings, Conduct and coordinating all on‐boarding activities with the Government and obtaining secure badging for team personnel, Ensure staff identified as key personnel are available to work with Subject Matter, Experts (SME) from the

Government and the incumbent Contractor immediately after IDIQ Task Order awards, Engage in regularly scheduled meetings.

2.2 Project Management

The Contractor shall provide Task Order project management to ensure that the scope, schedule, and cost are controlled and consistent with the contract.

At a minimum, the contractor shall perform the following activities:

2.2.1 Kick‐off Meeting

The contractor shall host a “kick‐off meeting” within 10 working days of award. The purpose of the kickoff meeting is to introduce the contractor staff to the Government and discuss the contractor’s approach to meeting the requirements of the SOW.

2.2.2 Task Order Management Plan (TOMP)

The contractor shall prepare a Task Order Management Plan (TOMP) describing the technical approach, organizational resources, risk management and other management controls to be employed to meet the cost, performance and schedule requirements throughout task order execution. The TOMP shall be delivered within 30 days of award.

2.2.3 Reporting

The Contractor shall provide Monthly Status Reports to the COR, along with the invoices by the 15th of each month for the previous month. The reports shall include the following information:

Tasks worked, hours expended on tasks, and labor categories and labor rates used per task, Total hours and the amount billed for the invoice period, The cumulative hours and the cumulative amount billed for the period of performance, An overview of work completed, in progress, and planned for each task, Identification of problem areas with recommended remedial actions, Identification of risks and mitigation plans, Challenges and issues, Other direct costs, if applicable, Additionally, the Contractor shall submit a Weekly Narrative Report by the close of business on Friday. The

Weekly Narrative Report shall include tickets worked on or tasks performed, and hours expended on each ticket and task.

A final report 12 months after contract award.

In addition to progress reporting, the Contractor shall be proactive in informing the designated government Project

Manager and COR of any issues, problems and recommendations that should be addressed in order for the overall effective accomplishment of Task Order goals. Recommendations for actions, shall be clearly defined, assigned completion dates, and communicated to the responsible party and to the FDA.

2.2.4 Meetings

The Contractor shall participate in the meetings in different capacities such as leading discussions, participating in discussions, contributing questions and answers, raising issues, risks and concerns, developing and giving presentations, and other active oral and written communications. The Contractor shall prepare meeting agendas, minutes, issues, risks and action items.

The following are representative of the meeting types that the contractor can be expected to participate in the meetings and activities listed below.

Meeting/ Activity Description Typical Location(s) Estimated Occurrences

Ad‐hoc meetings Business and/or technical meetings requiring Contractor presence

4300 River Road, College Park, MD

Weekly

Technical and Process Improvement Meeting

Meeting to discuss existing issues and problems with the current technical environment, processes and procedures and propose solutions, periodic release meetings.

4300 River Road, College Park, MD

Quarterly, or as requested by the COR, or designated Project Manager

Individual CCB meetings

Individual Change Control Board (CCB) meetings.

4300 River Road, College Park, MD

Monthly

2.3 Operations Support

FDA security classifies FARM as a ‘Mission Critical’ system with a 24/7 operational requirement. The Contractor shall ensure staff and resources provide support for the FARM system during the normal business hours and shall also provide on‐call support 24 hours per day, 7 days per week for Data Center related activities, including emergency operations, which may be required outside of normal business hours, only as needed. The Contractor shall perform technical upgrades and refreshes as directed, required and/or mandated by the FDA.

The Contractor shall provide responsive and proactive operations support to include working with the Data Center

Contractors to identify and resolve FARM system outages and performance issues. During normal business hours (see above section), the Contractor shall engage and begin troubleshooting within 15 minutes of being notified of any FARM system outages and performance issues. Outside of normal business hours, the Contractor shall acknowledge, engage and begin troubleshooting within 30 minutes of receiving notification for the systems used 24/7 as described above.

The Contractor shall:

Notify the FDA COR, FDA IT Project Manager, and downstream systems’ business and/or system owners of problems identified by the Contractor; or inform the FDA COR, FDA IT Project Manager, and downstream systems’ business and/or system owners of problems that the Contractor has been notified of, within 15 minutes during normal business hours and 30 minutes outside of normal business hours;

Ensure all processes are documented properly in an operation/administrative manual(s). The Contractor shall maintain and update all FARM‐related manuals. The Contractor shall include procedures for typical systems requirements as well as FARM ‐specific operating instructions as required. Updates to the manuals will be expected with each maintenance release;

Collaborate with developers from other interfacing applications to resolve issues related to integration and performance, as directed by the COR;

FDA data center Contractor shall perform the patching of servers and software for CHDC and WODC environments. The FARM Contractor shall work collaboratively with the data center Contractor to troubleshoot issues that arise during patching and test FARM systems and repositories to ensure that the applications are working correctly, if required;

Validate the integrity and functionality of FARM systems and repositories after the completion of hardware and software patching performed by the Data Center Contractors;

Assist with the preparation for and participate in any mandated CONOPS and Information Systems Contingency Plan (ISCP) Exercise events that require Contractor support.

Maintain and update as appropriate, back‐up, disaster recovery, and administrators (Log File Analysis) processes;

Work with FDA to establish processes for early problem detection and work to mitigate them before they have a significant adverse effect on the FDA and community users;

Monitoring data storage growth by requesting monthly reports from the appropriate data center contractor and taking action to ensure sufficient table and storage space is available for anticipated growth;

Collaborate with other FDA components to upgrade or replace infrastructure per the lifecycle replacement plan, to reduce costs or meet application requirements;

Work with FDA to validate backup procedures for both development and production files and databases, make recommended changes and when appropriate document and communicate these procedures to the WODC and CHDC;

Respond to internal users and the help desk personnel with questions about data entry and the use of the system;

Manage user administration and access privileges (e.g., permission, access rights, roles, and accounts) for the FARM system and data repositories, and maintain a log and provide status reports to COR/Project Manager as requested;

2.3.1 ITIM Process and Maintenance Support

The Contractor shall provide details as required to address Information Technology Investment Management (ITIM) requests and create and submit these requests for approval of new technologies and tools. Prior to submitting these requests, the Contractor shall inform the COR and IT Project Manager.

The Contractor shall support enhancements and change requests for the existing modules of the FARM platform. Each quarterly O&M release shall include CFSAN Management‐approved enhancements for the FARM platform and all supporting data repositories. Examples of enhancements may include features and functions identified to support business operations, graphical user interface (GUI) changes, adding/updating source data system(s) to existing master data repositories, providing master data to additional downstream system(s), adding data entities and data fields, development and implementation of data upload/supply scripts, etc. The Contractor shall document the details of all changes made to the FARM system accordingly, and ensure that all changes to the FARM System are tracked using FDA’s

SVN (software versioning and a revision control system).

The Contractor shall perform the following maintenance activities to support the FARM platform, FARM and SIREN data repositories, defect corrections, workflow maintenance but not limited to:

Tune performance to ensure that the FARM system’s server capacity, speed, and network requirements function at optimum levels as defined in the technical specifications documents provided by the COR at the time of award. Specific tasks include:

Evaluation of data model to accommodate indices and data, Evaluation of hardware platform and operating system statistics, Evaluation of network performance (speed and capacity), Evaluation of database environment and performance statistics; optimization of documents within the database, Evaluation of current custom application code (Forms, Business Objects/ PL/SQL, Portal, Workflow, etc.), Creation of recommendations / best practices document; and

Implementation of recommendations and best practices as desired by the FDA.

Maintain and support Business Objects reporting capabilities to allow the end users to generate standardized document reports from the FARM System data. Specific tasks include but are not limited to:

Update the FARM Business Objects architecture plan by developing the capability of end users to generate additional management‐ approved, ad‐hoc and standardized time and user efficiency performance‐related reports using FARM System data, the FDA Substance Registration System (SRS) data, and CFSAN Thesaurus Management (TMS) data;

Update the FARM Business Objects ‘universes’ (semantic layer between users and database) in the FARM System environment based on the new data and workflows (e.g. NDI, BNF, NPC, FALP, IFN) to allow end users to generate ad‐hoc and standardized time and user efficiency performance‐related reports as defined by COR;

Perform system administration of the FARM Business Objects solution;

Maintain and support existing workflow packages for, but not limited to FAPs and CAPs, FCNs, BNF, NPC, FALNs and FALPs, IFN, NDI, Correspondence, Citizen Petitions and EFOIA;

Update Business Objects Weekly Reports & email reminders;

Perform Unit/System Testing for Work Flows & Business Objects Reports.

Maintain and support existing document management for FARM and SIREN for accessing, searching and reviewing FAPs and CAPs, FCNs, BNF, NPC, FALNs and FALPs, IFN, NDI, Correspondence, Citizen Petitions and EFOIA. Key profile data are captured for each submission and its supplements which are either scanned or received electronically. Specific tasks include but are not limited to: configure the FARM database to allow for uploading electronic media‐based submissions of FAPs and CAPs, FCNs, BNF, NPC, FALNs and FALPs, IFN, NDI, Correspondence, Citizen Petitions and EFOIA.

All of the maintenance and release enhancement work shall be performed in accordance with the FDA Enterprise

Performance Life Cycle (EPLC) processes and templates. EPLC tasks for the Operations and Maintenance of FARM are expected to include:

Update, review and finalize the post‐implementation review document;

Complete the Project Process Agreement (PPA), EPLC stage gates reviews and documentation for O&M releases, and coordinate with COR and FDA IT PM on all stage gate activities, following the FDA EPLC guidelines. CFSAN considers it extremely important to be proactive in completing all EPLC stage gate review artifacts and submitting them to the COR and the FDA IT PM prior to submission to the FDA Critical Partners for their review and approval. The Contractor shall participate in stage gate reviews, as directed by the COR and the FDA IT PM;

Conduct functional system assessments (such as user satisfaction surveys);

Conduct an annual architecture and operational analysis;

Migrate software along with respective data, files, and documents to the new platform approved by FDA and requested by COR;

Update and maintain the plan of actions and milestones;

Testing contingency and disaster recovery plans;

Update/finalize previous EPLC artifacts (as necessary).

For each option year of the FARM O&M contract, the Contractor shall provide enhancements with similar efforts as the base year enhancements for the FARM platform and the FARM and SIREN data repositories.

2.3.2 Emergency Maintenance Support

The Contractor shall support emergency requests for maintaining FARM platform and associated data repositories in

CHDC and WODC environments during weekend and off‐office hours. Response times, systems availability and performance standards shall be defined by the FARM COR.

2.3.3 Database Administration Support

The Contractor shall provide database administration support for the FARM platform and FARM and SIREN repositories in support of releases, resolution of related issues attributed to the database and any database upgrades. The

Contractor shall assist the CHDC personnel with database administration for the FARM databases. The Contractor shall:

Maintain and enforce standards, policies and procedures across databases per FDA standards;

Provide recommendations for database performance improvements and O&M responsibilities and procedures (e.g., parameter configuration, index development and implementation, disk array configuration, and performance tuning);

Create database upgrade/migration plans, processes and procedures in accordance with FDA/OIM approved procedures, collaborate with the FDA migration team and FARM IPT members, and execute the approved plans, processes and procedures;

Support maintenance of databases in development, test, pre‐production, and production environments;

Monitor and ensure execution of regular Oracle backups and recoveries as required per FDA standards;

Maintain the administration of Oracle and Appian FARM users and their roles;

Support audit trails in accordance with the FARM Security Plan;

Provide and maintain database documentation.

2.3.4 Release Management

The Contractor shall work with CFSAN and OIM to support the development and deployment of system releases to the appropriate Data Center environments. The FDA categorizes releases as Initial, Major, Minor, or Emergency/Patch.

These release types are defined as:

Initial Release: Scheduled first release of a new system, Major Release: Scheduled release to include major enhancements, and/or redesigns, technology upgrades, and defect corrections, Minor Release: Scheduled release to include defect corrections and/or minor enhancements, including software changes necessary to support system or Commercial‐Off‐the Shell (COTS) patches, Emergency Release: Release to correct one or more problems within the FARM system that is negatively impacting functionality and requires prompt resolution. Emergency Releases are added to the project schedule as needed upon approval by the COR.

It is anticipated that the FARM system will have quarterly scheduled software releases. Emergency releases or non‐ emergency releases may be identified by the COR and the IT Project Manager as required. The Contractor shall perform the following activities related to Release Development and Management:

Prepare and present level of effort estimates, root cause analysis, and technical evaluation for defects and minor enhancements as requested by the CCB. The technical evaluation should include analysis of related impacts (if any) to systems that interface with the one that is being modified. Support the CCB to obtain approvals for each defect resolution and enhancement to be included in a release, and to determine the overall content of each release;

Plan, develop, test, and implement all releases. Note that data center staff will perform most code deployment activities, with support from the Contractor;

Plan and support User Acceptance Testing (UAT) and obtain user approval for each defect resolution and minor enhancement at least 2 business days prior to the scheduled release date;

Submit and track release requests for Development, Test, Pre‐Production, and Production environments following FDA procedures for submission of infrastructure change requests, tickets, etc.;

Coordinate and prepare input to stakeholder notifications;

Create all required deployment artifacts including, but not limited to release notes, software builds, scripts, Version Description Documents (VDDs), deployment plans, Run book and updated Target State Diagram (TSD);

Work with Data Center Contractors to support production releases which are normally scheduled outside of normal business hours as needed. Production releases are sometimes required to continue into the weekend and there could be multiple releases scheduled for the same day. Deployment of production releases includes validation that the implementation was completed and the software is working as intended in the production environment;

Ensure that the code and/or other configuration items are labeled and tagged with the software release version and all required information is packaged together correctly;

If releases are planned or extended on the weekends, the Contractor shall work through the weekend to ensure the successful deployment of the application.

The Contractor shall document, track, and schedule releases using FDA established tools and processes.

The Contractor shall perform necessary planning, requirements analysis, design, development, testing and implementation for any defects introduced by the Contractor during the execution of these releases. The Contractor shall identify the root cause of any such defects and shall propose a plan to promptly resolve those defects. Any such defects determined to result from Contractor error shall be fixed at no additional cost to the government.

The Contractor shall share information and provide full access to code, constructs, databases, and documentation while delivering integrated, cohesive business and technology services. The Contractor shall properly label all artifacts in a manner that does not restrict the government’s access and conveys the government’s ownership of the intellectual property.

The Contractor shall perform pre‐production and production quality control functions (job submission, checking and corrections). The FARM O&M Contractor shall work with the Contractor Hosted Data Center (CHDC) Contractor to help maintain the pre‐production and production environments by providing, but not limited to, release packages, software updates, application‐specific knowledge transfer, run book, firewall rules documents, updated DPS (Diagnostic Policy

Service), Trouble Shooting Directory and troubleshooting as required.

The Contractor shall provide the White Oak Data Center (WODC) personnel, where the development and test environments are housed, release packages, software updates, application‐specific knowledge transfer, Trouble

Shooting Directory, Work Requests, firewall rules documents and troubleshooting as required.

2.3.5 Testing

The Contractor shall provide testing support for FARM platform, data repositories and workflows in support of releases and resolution of related issues.

The Contractor shall develop, test and document all products in accordance with FDA EPLC processes and templates;

The Contractor shall follow established FDA and industry best practices to ensure that any changes to the FARM platform and data repositories, application servers and related databases are implemented to increase system functionality while maintaining system stability, availability, security, and data integrity;

For each change as a part of FDA EPLC compliance, the Contractor shall create and implement a test plan and allow for independent validation of the plan in the pre‐production environment. The Contractor’s testing methodology shall identify key functions to be tested using use cases that can objectively measure the success of the system change. The testing plan shall include a list of assumptions and limitations. At a minimum, applications shall handle valid data and valid boundary conditions plus error conditions and other anticipated data and navigation exceptions. The applications will be error checked for all data and navigation errors per the FDA’s business requirements. The Contractor shall make available all documentation generated in the conduct of these tests.

The Contractor shall fully test all deliverables to ensure they function as required and do not adversely affect any other parts of the application or database, and are consistent with other parts of the application in appearance and function. Development, unit, and end‐to‐end tests include functionality, regression, integration, performance, section 508, and load tests.

The Contractor shall ensure that the product delivered for User Acceptance Test (UAT) functions properly, as documented in the Change Request or Problem Report, be free from typographical errors, grammatical errors and navigational problems. All aspects of all changes shall be tested and verified by the Contractor before it is delivered for UAT. The Contractor shall provide documentation of the testing conducted as requested by the FDA Project Officer. The Contractor may be requested to provide sample test plans for UAT. Adjudication of failures or determination of whether the software meets requirements during UAT will be determined by the FDA COR.

All production and test defects will be tracked with a defect tracking application and reported in an agreed upon format.

The Contractor should note that HHS requires every information system to be authorized to operate through the Security Authorization (SA) process. The SA process includes annual assessments of security controls, assessments when significant change to the information system occurs and/or assessments during the development phase of new systems. The Authority to Operate (ATO) process is facilitated by the Security Branch in the Office of Information Management (OIM), and fulfills requirements to ensure that information resources have adequate security to protect the confidentiality, integrity, and availability of information.

Projects begin the ATO process once they reach the appropriate phase of the Enterprise Performance Life Cycle (EPLC). The ATO process is part of the EPLC process, and should be completed as a component of that larger process. The Contractor shall take the necessary steps (e.g., documentation, meetings, and activities) to support this process;

UAT is a component of the EPLC requirements and details business components required for ‘sign off’ that the system meets the business/technical requirements. End‐users will be identified to support this effort. The Contractor shall follow all guidance set forth in the EPLC requirements and business components to complete UAT.

2.3.6 User Production Support (FARM Helpdesk)

The Contractor shall provide Tier 1, 2 and 3 user support for the FARM platform, data repositories, workflow and content management by performing the following activities:

Creating, maintaining and resolving system user accounts roles, and permissions and administrative support;

Help desk activities such as triage, including evaluation and assignment, troubleshooting, resolution and tracking tickets and issues, and responding to end users within timelines established by the COR/Project Managers.

Resolve critical defects and/or high priority change requests; provide weekly (or as requested) status reports, on all help desk issues to COR/Project Managers, using the FDA standard issue tracking system and reporting tool, currently known as JIRA;

Resolving trouble tickets and user service requests received through the FDA user support system. If a service request is submitted via email or phone call, the Contractor shall request that the requester enter the request into the FDA issue tracking system. In cases where the user does not have access or is unable to use the FDA tracking system, the Contractor shall enter a ticket on behalf of the user and request that an account be created for those users who do not have access to the tracking system. The Contractor shall document, track, resolve user support issues using FDA established tracking tools and communicate directly with the user, and, if necessary, the FDA help desk handled by the Employee Resources and Information Center (ERIC). The Contractor shall log the estimated level of effort and actual level of effort spent on each user support ticket and issues in FDA established tracking tools;

Providing regular status updates and communications regarding all open tickets to the user and, for high and urgent priority tickets (or other issues as requested), to FDA. The Contractor shall follow established FDA change management procedures to present the status of help desk tickets to the Change Control Board(CCB).

The table below outlines the response goals for service at different levels of urgency (for the FARM production system).

Table 1: User Production Support (FARM Helpdesk) Response Time Matrix

Urgency Level

Description

Initial Response

Time (Normal

Business Hours)

Initial

Response Time

(Off ‐ shift)

Resolution Goal

Urgent/

Emergency

(“Show

Stopper”)

System crash or loss of data.

The end user not able to perform critical business processes

Significant business or user impact

Within 15 minutes

Within 30 minutes of the next business day

Less than three hours (or by mutually agreed deadline)

High Major loss of functionality without a workaround. The end user not able to perform semi‐critical business process

Major business process or user impact

Within the same business day

Within one hour of start of next business day

Within one business day or by required deadline

Normal/

Medium

Loss of non‐critical functionality and an available workaround.

Does not significantly interfere with the business process

Within two business days

Within two business days

Within five business days or by required deadline

Low Issue with minimal impact.

Application defect that is a

Within 5 business days

Within 5 business days

As negotiated between COR minor concern to the client

Does not significantly interfere with the business process and Contractor manager

Information

Requests

(data calls)

Request for documentation or informational requests

Issues do not have a business process impact

Within one business day

Within one business day

Within five business(or by mutually agreed deadline)

2.4 Transition‐Out Support

As tasked, the Contractor shall facilitate the transition of contracted FARM related activities and services to the Federal

Government or to a follow‐on Contractor at the end of the contract period of performance.

Representative activities under this task area shall include:

Provide the FDA with current versions of all system and user documentation;

Provide FDA all licensing and renewal information, asset management records, software documentation, and training materials;

Provide FDA with a current inventory of all Government‐owned assets used by the Contractor along with full support in the reconciliation of this inventory;

Provide FDA with current versions of all concept of operations (CONOPS), operational procedures, standard operating procedures, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor;

Provide “shadowing” and other knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor;

Provide full source code sets (not COTS source code) with configuration management information; and

Provide up‐to‐date‐EPLC and program/project management documents.

3. DELIVERABLES

Deliverables are listed in the table below, but are not limited to:

Task Order Deliverables Due date Estimated

Quantity

Task Order Management Plan (TOMP) 15 days after contract award

Project Management Plan (Project Baseline Schedule, Risk Management Plan, Communication Plan, etc.)

3 weeks after contract award

Monthly Status Reports By the 15th of each month for the previous month

Monthly Task Order Management Review Meeting for the COR and

Contractor to review the financial status of the Call

Order, monthly metrics, and manage risks and issues.

Weekly Narrative Reports By the last day of each week

EPLC Documentation Determined by final EPLC

Project process agreement

(PPA)

Ongoing

Final Report 12 months after contract award

FARM‐related Standard Operating Procedure manuals As needed As needed

FARM CONOPS As needed As needed

FARM Operation Support Log files As needed As needed

FARM Maintenance Support files and related EPLC documentation (security plan, contingency plan

As needed As needed

FARM release notes, software builds, scripts, test documentation, VDDs, deployment plans, Run book and updated Target State Diagram (TSD), firewall rules documents, troubleshooting documentation

As needed As needed

4. KEY PERSONNEL

The key personnel specified in the Task Orders are considered to be essential to work performance. At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employee of the Contractor), the Contractor shall notify the

Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to permit evaluation by the Government of the impact on performance under this contract. The Contractor shall not divert or otherwise replace any key personnel without the written consent of the

Contracting Officer. The Government may modify the contract to add or delete key personnel at the request of the

Contractor or Government.

The Contractor shall propose the following personnel as key personnel:

Database Specialist/Data modeler (Senior), Database Specialist (Master), Certified DBA, Project Manager, PMI certified PMP, Systems Engineer, Certified Appian workflow developer.

5. Place of Performance

University Station

4300 River Road

College Park, MD 20740

6. Government Furnished Property (GFP)/Government Furnished Information (GFI)

Government Furnished Property/Government will provided with each task order. In general, the FDA will provide laptops, Personal Identity Verification (PIV) cards (badges) and appropriate network accounts.

7. Period of Performance

The period of performance is one year from the date of award.

8. Inspection and Acceptance

Task Deliverable/Service

Standards Performance

Indicators

Acceptable Quality Level (AQL)

Maintenance

Support

Documented performance evaluation, improvement and optimization recommendations

FARM System has to run at maximum documented efficiency level.

99% availability rate for all FARM system applications

Demonstrated Best Practices

Meets recommended upgrades

Database

Administration

Support

Documented performance evaluation results.

Documented performance improvement and optimization recommendations

FARM System has to run at maximum documented efficiency level.

Conduct DBA and other day‐to‐day administrative duties of the

FARM system.

90% of Major

Milestones met in accordance with agreed‐upon project plans.

Demonstrated Best Practices

Meets recommended upgrades

Release

Management

Documented release management plan and recommendations

FARM System release has to follow the release management plan and

FDA standards for software release

Best Practices

Recommendation/

Documentation

90% of Major

Milestones met in accordance with agreed‐upon project plans.

Demonstrated Best Practices

Meets recommended release.

For enhancements, documentation is updated to reflect changes within five (5) days of release.

Testing Testing will be accurate and complete and performed in accordance with agreed‐upon (or

FDA‐approved) test plans.

Modify and test software based on the Change

Request process.

Identify and prioritize new tasks versus “fixes” of existing programming

99% of acceptance testing will be successful on the first cycle; 99% may require 2 cycles if there are no changes in requirements.

99% of required customizations/enhancements operate as expected with no negative impact on system/application performance or customer experience.

Production

Support

The contractor shall maintain the FARM system applications.

Continuous maintenance of existing configuration management process and reporting

Administrator

Change Request process to gather and document

FARM user satisfaction, CMB review and approval of new enhancements infrastructure

Complete adherence to the CFSAN required security and password controls that are in place, including Federal

Information Security

Management Act

(FISMA), FDA Staff

Manual Guide 3250, NIST, and HHS guidelines, HL7 Standards for RPS.

On site production support of all FARM system applications user requested changes for the

FARM production system

Maintain existing configuration management process and reporting infrastructure.

Adhere to the

CFSAN required security and password controls that are in place, Including Federal

Information

Security

Management Act

(FISMA), FDA Staff

Manual Guide

3250, NIST, and

HHS guidelines, HL7 Standards for

RPS.

Adhere to the documentation and configuration management procedures set forth by FDA and

CFSAN when conducting all production support tasks.

Project

Management

Project management plan, associated reports, status reports and other related documentation.

Adherence to a project plan on a weekly basis in order to redefine task level of effort, timeframes and scope.

Delivery times, timeliness

‐ meeting milestones, deadlines or due dates, adherence to schedule.

Example: standard

Project Management software (MS Project)

Supplies necessary information needed for project tasking, cost management, technical and project oversight.

90% of Major

Milestones met in accordance with agreed‐upon project plans.

Complete, accurate, and timely submissions of reports on project status, project costs, and resources on a weekly basis.

Reporting Problem Reports Timely Problem Reports Supplies necessary information needed to correct system and users problems

Timely reporting of problems

2.4 Transition-Out Support