Atch_2_Operations_and_Maintenance_SOW.pdf

RFP Attachment 2

Task 1: Operations and Maintenance

1.0 Introduction

1.1 Background

The Imports and SIRCE investments currently manage the operations and maintenance of over 30 applications and components (see IDIQ Appendix A), including legacy applications and new services and components introduced to modernize and enhance the IT capabilities needed by ORA. Some of these functions are mission critical and must be operational 24 hours/day by 7 days/week. FDA (and various contractors) developed these systems over the last 15+ years using a variety of technologies. Imports and SIRCE Systems Operations and Maintenance (O&M) activities focus on routine operations and maintenance support necessary to maintain the availability, reliability, and security of ORA Systems.

Note that O&M for the systems supporting Criminal Investigations is not within the scope of this task order. Should O&M for those systems be required in the future, an additional Task will be issued.

The Contractor shall provide software services to ensure the ORA Imports and SIRCE applications are maintained and available to users within the FDA environment. ORA users depend on these systems, in many cases on a 24x7 basis, to conduct mission critical business processes, including review of goods offered for imports, inspection of regulated facilities, and management of recalls, that are necessary to protect the health and safety of consumers. Thus, the Contractor is expected to provide systems that function optimally whenever the hosting environment is operating as expected, and to minimize the length of any outage, planned or unplanned, to the extent possible.

The Contractor O&M team is responsible for the software for each application and for ensuring the successful configuration and implementation of that software. The Contractor shall provide all services necessary to conduct the operations described in this task order, while working collaboratively with other contractors and Government staff responsible for operations of the hosting environment, database management, and middleware administration. IDIQ Appendix A identifies the systems and components currently in the Imports and SIRCE Portfolio, which are to be supported in this task.

Additional systems may be added during the base or option years as new capabilities are established.

Certain systems and/or components are expected to be decommissioned over the course of the contract; other systems/components may be added. The Contractor shall work with the Office of Information Management and Technology (OIMT) and ORA to identify and support system retirement when systems are approved for decommissioning. Additionally, as new systems are added, the Contractor shall complete a transition process to accept the systems and then maintain, operate, and support them as part of the portfolio. The Government anticipates the level of effort necessary to support the portfolio to remain constant or be slightly reduced as the functionality will be replaced by new systems or components. Any additional support due to the implementation of new functionality is expected to be offset by reduced support needs due to system improvements.

The Contractor shall report directly to the O&M COR as well as work closely with the OIMT, ORA, and other technical staff. The Contractor O&M team shall be responsible for successfully planning and completing all work necessary to support the O&M objectives included the tasks below.

To become proficient in the Operations and Maintenance of these systems, the Contractor will need to acquire expertise on both the technical details of each system and the business processes that invoke the systems. This task provides for a transition period during which the Contractor shall undertake activities to gain the necessary knowledge. The Government expects that the Contractor will work closely with the incumbent contractor to transition responsibility for O&M without impact to the ongoing usage of the systems. At the end of the transition period, the Government expects that the Contractor can perform all O&M responsibilities independently.

1.2 Objectives

Due to the mission-critical usage of the ORA systems, the Government requires operation and maintenance activities to be performed with minimal interruption to service by a highly user-focused team. Key objectives of this task are to:

• Acquire a detailed understanding of the technical details of each system, the environment in which it operates, and the processes used for O&M.

• Gain knowledge of the ORA business processes that use the systems and the underlying business and software requirements.

• Ensure that ORA Imports and SIRCE applications are available and operate effectively to meet business needs on a 24x7 basis.

• Collaborate with data center and other contractor staff to maintain system operations for all environments through prompt troubleshooting and resolution of issues.

• Respond rapidly to tickets initiated by system users, through a Tier 3 Help Desk, to promote a high level of customer satisfaction and meet the expectations established in a Service Level Agreement (SLA).

• Complete system modifications that fix application problems caused by design, logic, or coding errors.

• Reduce the cost of O&M tasks through improved processes and the resolution of software and environmental issues.

• Recommend and implement improvements to minimize the need for system outages during maintenance (planned) and the occurrence of unplanned outages, and to reduce the time needed to recovery after such outages.

• Assess operational systems to provide recommendations for upgrades to maintain compatibility with current versions of Commercial Off The Shelf (COTS) products in use and to improve performance, maintainability and reliability.

• Resolve all system related security issues in accordance with the Plan of Action and Milestones (POAM) and Security Assessment Report (SAR).

2.0 Transition In

The Contractor shall plan and execute an orderly transition from the incumbent Contractor that will prepare the new team for taking on the responsibilities of maintaining and enhancing the existing systems and supporting new initiatives within the ORA Imports and SIRCE task orders. The incumbent Contractor shall be tasked with supporting the new team throughout the transition period, sharing responsibility for a successful transition. Both teams shall work collaboratively to meet the goal of completing the transition without loss of knowledge and without disrupting services.

The Contractor shall submit a high-level transition plan, including a draft schedule, as part of the proposal, identifying how they will meet the Government objectives and following the guidelines below.

Following award, the Contractor shall submit a detailed plan incorporating feedback received from the Government. The Government will convene a meeting between the incumbent and successor Contractors to review the plan and give direction as needed so the two teams will collaborate during the transition period.

The successor Contractor shall work with the incumbent Contractor during the transition-in timeframe.

The Government expects that, no later than the end of the fourth month, the successor Contractor shall be prepared to begin operations and assume responsibility for fully supporting the O&M. The incumbent Contractor will provide limited Subject Matter Expert (SME) support to the successor Contractor during the final 2-months of the incumbent’s transition-out timeframe. During those two months, Transition-In tasks will consist of those activities necessary to resolve any outstanding issues and complete the final transition status report.

The transition activities outlined in the plan shall be inclusive of all steps necessary to start up the contract and begin full operations. In addition to the tasks necessary for gaining the knowledge base, the Contractor shall address tasks including:

• Ensure that the appropriate staff are available to work immediately after the task order award and that additional staff are brought on-board in time to complete the transition activities.

• Conduct and coordinate all on-boarding activities with the Government and obtain secure badging for team personnel. This includes completing required training and clearance activities.

• Follow FDA procedures to complete account requests and other actions necessary for staff to obtain access to the systems and operating environments.

• Coordinate with FDA to ensure contractor facilities have adequate connectivity to FDA networks.

The successor Contractor shall receive access to documentation of the current systems and processes required for O&M and further system enhancement, including:

• System documentation updated as of the most recent release (e.g., system architecture, target state diagrams, server names, system accounts, firewall rule information, user guides, release documentation, design documentation, and run books).

• Outstanding Change Requests (defects and enhancements) captured in the appropriate configuration management tool.

• Source code updated in the appropriate configuration management tool including source code in test and development (e.g., database, application, services, web pages, and websites).

• Regular maintenance activities documented for all systems.

• Current life cycle process documentation related to all systems updated.

• Completed responses to data calls.

• Any available additional documentation requested.

The successor contractor will also have the opportunity to participate in briefings and information sessions to transfer knowledge from the incumbent. To prepare for these meetings, the successor Contractor shall review available documentation and prepare a list of questions in advance of each of the meetings. The successor Contractor shall propose additional steps to acquire knowledge of the systems, including, for example, shadowing incumbent staff and phased sharing of responsibilities. The successor Contractor shall ensure that their contractor team has a comprehensive understanding of the ORA business requirements, the IT systems supporting those needs, and FDA IT processes, by the end of the transition period.

During the transition-in task, the contractor shall also conduct management activities to maintain cost and schedule, communicate with stakeholders, and manage risk. The successor Contractor shall:

• Complete the updated Transition Plan.

• Prepare and maintain a comprehensive schedule of planned transition activities, with weekly updates.

• Conduct a kick-off meeting within 2 weeks of the start of the period of performance.

• Update the Program/Project Management and Software Development plans provided in the proposal based on Government feedback and knowledge gathered during the transition.

• Identify and manage risks to successful completion of the transition.

• Provide a weekly status report on transition activities.

• Hold a weekly status meeting with the COR and designated stakeholders.

• Develop readiness criteria to demonstrate that the team is ready to assume operations from the incumbent.

• Upon completion of the transition, prepare a final report including lessons-learned.

Once the contractor is prepared to assume responsibility for O&M, the Contractor shall conduct an operations readiness review to demonstrate that the successor team is prepared to assume responsibility for O&M. The successor Contractor may propose to assume responsibility after successful completion of a review, or may propose a phased approach with multiple phases, in which case the successor contractor should address how they will demonstrate that the team is ready for moving to each new phase. At a minimum, a final review must be held where the contractor will demonstrate that they have sufficient preparation to fully conduct all O&M activities.

2.1 Management Plan

The Contractor shall provide the initial draft Management Plan 10 days after award. Following the Government review, the Contractor shall provide a revised version of the Management Plan within 30 calendar days. The Contractor shall update and maintain the Management Plan throughout the life of the contract. The Management Plan provides the technical approach, organizational resources, deliverables, documentation, and management controls to be employed to meet the cost, performance, and schedule requirements throughout execution. At a minimum, the Management Plan shall address the following areas: Requirements Management, Change Control, Risk Management, Schedule Management, Cost Management, Quality Management, Communications, Staffing (including plans for Staff Training and Staff Retention), Project Organization, Performance Metrics, and Technical Metrics.

The Management Plan shall also address the process by which the Contractor will ensure systems are interoperable and integrated, including collaboration within the Contractor team and with other teams.

In addition, the Management Plan shall clearly distinguish the work done as part of this task from work done within the O&M and DME areas, and how staffing will be managed to support these areas. The Management Plan will demonstrate how the team will meet the need for integration within the program such that overall program goals are met while delivering working software and O&M services.

2.2 Software Development Plan

The Contractor shall provide the draft Software Development Plan as part of the Technical Proposal and provide the final version of the Software Development Plan 30 calendar days after the award. The Contractor shall update and maintain the Software Development Plan throughout the life of the contract. The Software Development Plan provides the technical approach to software development, including the specific techniques and standards to be used for development and testing; integration techniques (including configuration management) used to ensure the integrity of system builds; the number and type of reviews that are part of the development process; and the methods used to manage defect reports and analysis, including root cause analysis. At a minimum, the Software Development Plan shall address the following areas:

• The Software Development Life Cycle (SDLC) activities and methodologies that will be followed and how they align with the FDA EPLC and result in successful stage gate reviews.

• A software quality process to ensure all deliverables are free from defects and meet end user requirements.

• Approach for system configuration and release management.

For all development activities, the Contractor shall adhere to the approved Software Development Plan.

The Contractor shall only use FDA approved software, including all tools, libraries, frameworks, etc., and shall follow FDA processes to obtain approval for any proposed additions.

Table 1: Transition-In Deliverables

Deliverable Due Transition Plan Draft with Proposal, final two weeks after receiving Government feedback.

Management Plan See 2.1 Software Development Plan See 2.2 Detailed Transition Schedule 2 weeks after start of Task Order period of performance (PoP), updated weekly thereafter.

Status Report Weekly

Meeting Agenda and Materials (e.g., briefing presentation)

At least one business day prior to the meeting.

Meeting Minutes Within 2 business days after the meeting.

Questions for technical and system briefings At least one business day prior to the meeting.

Readiness Criteria Draft 30 days after start of Task Order PoP, final at least one week prior to each readiness review.

Final Transition Report Draft at least three weeks prior to the end of the

Task Order PoP, final at least 2 business days prior to the end of the Task Order PoP.

3.0 Operations and Maintenance (1 base year with 3 option years)

3.1 Scope

3.1.1 Operations Support

The Contractor shall ensure staff and resources provide support for ORA Imports and SIRCE Systems during the normal business hours (8 am to 9 pm Eastern Time, Monday-Friday) and shall provide on-call support 24 hours per day, 7 days per week for those systems in use outside of normal business hours.

The Contractor shall provide responsive and proactive operations support to include:

• Ensuring application software is functioning properly in all environments within the data centers. Collaborating with the data center teams to perform continuous monitoring of the systems to ensure the production environment is fully functional and performs as specified during the specified hours of use, including 24x7 operations for those systems and components so designated.

• Coordinating to proactively monitor system performance such that potential problems are identified and mitigated. This scope includes support for ORA Imports and SIRCE applications, services, databases, scheduled jobs and integration points as well as all related cron jobs, database scripts, etc. Currently, the O&M team receives reports using AppDynamics and maintains a set of scripts to provide monitoring of specific critical or problematic functions.

Additional reporting and monitoring tools may be made available over the life of the IDIQ.

• Working with FDA staff and data center contractors to identify and resolve system outages and performance issues. During normal business hours, the Contractor shall engage and begin troubleshooting within 15 minutes of being notified of any system outages and performance issues. Outside of normal business hours, the Contractor shall acknowledge, engage and begin troubleshooting within 30 minutes of receiving notification for the systems used 24x7, see Table 2: Service Level Agreements (SLA).

• Monitoring data storage growth by requesting monthly reports from the appropriate data center contractor and taking action to ensure sufficient table and storage space is available for anticipated growth.

• Ensuring systems are functioning properly after infrastructure activities such as Operating System and database software patching. ORA production system environments are normally patched outside of normal business hours. The Contractor shall conduct testing to demonstrate that the systems are functioning completely after patching and support troubleshooting to resolve any issues encountered. For Production systems, testing shall be initiated within 15 min of notification that the system has been restored, unless a longer time frame is communicated by the COR or the patching plan. An example of the patching schedule is attached for reference (IDIQ Appendix L).

• Supporting any additional change within the data centers and all necessary technology upgrades. Provide adequate support and regression testing after both scheduled and unscheduled outages to confirm the integrity and functionality of all supported systems. For Production systems, testing shall be initiated within 15 min of notification that the system has been restored, unless a longer time frame is communicated by the COR, or as soon as feasible for unscheduled outages. Communicating, troubleshooting, and/or remediating any issues identified.

• Verifying system functionality when a change is made to any of the systems that has an interface with an Imports or SIRCE system, through integrated testing in coordination with the interfacing system(s). Communicating, troubleshooting, and/or remediating any issues identified.

• Maintaining and updating system documentation as needed, for example due to patches and environment changes. In addition, supporting planning and testing activities related to the documentation and system operation, including Contingency Plan walkthroughs and system security demonstrations.

• Supporting FDA in communication of system capabilities to both internal and external audiences by preparing and maintaining briefing materials and conducting demonstrations as requested by the COR. Historically, such demonstrations are requested 4-6 times/year with a duration of approximately 1 hour each.

• Assisting with the preparation for and participating in any mandated Continuity of Operations (COOP) or National Level Exercise tests or events that require Contractor support. Historically, these efforts have not required contractor support beyond minor updates to COOP documents to reflect current system configurations and responsible personnel and participation in a 1-2 hour walkthrough.

• Providing ongoing technical and functional consultation and support activities to assist FDA in coordinating with other systems and staff.

3.1.2 User Support

The Contractor shall provide Tier 3 support to respond to tickets escalated from Tier 1 and 2 support teams. This technical support for the ORA Imports and SIRCE applications will require the contractor to triage, troubleshoot, respond to user calls, and resolve the issues identified. The Contractor shall pay special attention to meeting customer expectations through ongoing communication until the problem has been resolved to the customer’s satisfaction. Contractor performance will be measured against the Service Level Agreement (SLA) shown in the Table below. In this role, the Contractor shall be responsible for:

• Providing Tier 3 support to troubleshoot issues in response to user calls (usually routed through the Tier 1 or 2 help desk), and resolve issues identified. Resolution can include the development of workarounds, instruction to users, data corrections, or the documentation of bugs and system enhancements. In the past 12 months, Tier 3 support responded to an average of 400 tickets/month (see IDIQ Appendix E).

• Providing an initial response to tickets escalated to the Tier 3 support from the Tier 1 or Tier 2 help desk, conducting follow up to user reported issues, and providing status updates following the established SLA. The Contractor shall directly interact with users as needed throughout the investigation to resolve issues and ensure customer satisfaction.

• Completing work on tickets escalated to Tier 3 support to maintain an average backlog of “In progress” tickets of less than 50 with fewer than 3 tickets remaining in “in progress” status after 30 days. Tickets are defined as in progress until a resolution has been provided to the customer.

The average of tickets in progress over the last 180 days is approximately 25.

• Creating, maintaining, and fixing database and system user accounts, roles, and permissions.

• Responding to systems service requests and user questions.

• Performing approved data corrections.

• Providing regular status updates and communications, including trend data, regarding ticket processing.

Table 2: Service Level Agreements (SLA)

Priority Response Time Resolution Time Standard 1-Critical (High Impact and High Urgency)

15 min (Business Hours) 30 min (outside Business Hours)

3 hours 98% of tickets meet Response and Resolution goal

2-High (High Impact and Medium Urgency or Medium Impact and High Urgency)

30 min 3 calendar days, with updates to FDA and user every day.

90% of tickets meet Response and Resolution goal

3-Moderate (Default for problem reports)

4 hr (Business Hours) By 12 noon next business day (outside Business Hours)

5 business days 90% of tickets meet Response and Resolution goal

4-Low (Routine work requests)

1 Business Day 10 business days 90% of tickets meet Response and Resolution goal

Priority Number of Open Tickets Number of

Tickets >30 days old

Standard

All Less than 50 Less than 3 Exceeded no more than one week per quarter

• Response time is measured from the time the ticket is assigned to the contractor’s Service Now queue until the time the contractor changes the status to acknowledge receipt.

• Resolution Time is measured from the time a ticket is assigned to the contractor’s Service Now queue until the time the status is changed to a state of “Pending Customer” or “Resolved” or the ticket is assigned to another team’s queue.

• Count of tickets “Open” is reported once/week for the purposes of the SLA. Tickets that are pending customer response for > 1 business day or in other statuses beyond the O&M team’s responsibility will not count against this metric. For widespread issues (system outages), tickets may be closed by referencing a single “Master” ticket that tracks response to the issue.

3.1.3 Release Development and Management

The Contractor shall work with OIMT and ORA to support the development and deployment of system releases to the appropriate data center environments. Although the O&M development effort in this contract is limited to Minor and Emergency/Patch Releases, the O&M contractor shall perform all release management activities for those systems considered in O&M scope. In the past 12 months, 106 releases have been deployed into the Production environment. 74 of those releases contained some O&M content. The Contractor shall perform the following activities related to Release Development and Management:

• Preparing and presenting level of effort estimates and technical evaluation for defects and minor enhancements as requested by the Government. The technical evaluation should include analysis of related impacts (if any) to systems that interface with the one that is being modified.

Obtaining approvals for each defect and enhancement to be included in a release, and to determine the overall content of each release.

• Planning, developing, testing, and implementing maintenance and emergency releases to correct software defects and minor change request/enhancements. Conduct release management for Major and Initial Releases, where directed by the Government. Note that most releases will utilize automated deployment tools (currently Puppet) with support from the contractor and, where needed, data center staff. Also, note that production releases are normally scheduled outside of normal business hours as needed. Production releases are sometimes required to continue into the weekend and there could be multiple releases scheduled for the same day. Deployment of production releases includes validation that the implementation was completed and the software is working as intended in the production environment.

• Identifying and performing upgrades to COTS products, libraries, and tools used in ORA systems.

The Contractors shall be responsible for all activities necessary to evaluate new versions and the impact of the upgrade on the ORA systems, implementing code changes where needed as a result of the upgrade, and testing to assure functionality and performance are maintained. The Contractor shall also advise FDA on improvements that may result from new features available in upgraded software, and implement changes to utilize those features upon approval.

• Meeting all FDA standards for software development, including the Enterprise Performance Life Cycle (EPLC) (IDIQ Section 4.2), Enterprise Architecture (IDIQ Section 4.5), ORA Reference Architecture (a draft overview of the application architecture for new development is provided as IDIQ Appendix J, and Security (IDIQ Section 4.3).

• Planning and supporting User Acceptance Testing and obtaining user approval for each defect resolution and minor enhancement at least 2 business days prior to the scheduled release date.

• Submitting and tracking release requests for Development, Test, Pre-Production, and Production environments following FDA procedures for submission of infrastructure change requests, tickets, etc.

• Coordinating and preparing initial input to system related stakeholder notifications.

• Creating all required deployment artifacts including release notes, software builds, scripts, Version Description Documents (VDDs), and deployment plans.

• Implementing automation as directed by FDA including automated test, build, and deployment solutions using FDA-approved tools.

• Performing database refreshes as needed to maintain suitable data for testing.

• Maintaining Development, Test, and Preproduction software for all O&M systems, and coordinating with data center personnel to ensure the software is properly deployed, functioning, and up-to-date.

• Ensuring that the code and/or other configuration items are labeled and tagged following internal and FDA standards, with the software release version, and all required information is packaged and delivered together correctly.

• Maintaining the change request information in the change management tool in a timely manner.

• Collaborating with OIMT Division of Infrastructure and other FDA units to maintain fully functioning environments capable of supporting training conducted by ORA OTED. Support user training activities, including maintaining and updating all training and practice environments following patches and releases.

3.1.4 Database Administration Support

The Contractor shall provide database administration support for ORA Imports and SIRCE systems to develop and implement software releases, address issues in the database or with the data, and ensure the systems are functioning optimally. These tasks are frequently conducted in collaboration with the data center staff and other FDA contractors and Government staff. The activities include:

• Maintaining and enforcing standards, policies and procedures across databases and data marts, following all FDA mandates and establishing standard practices.

• Developing scripts and instructions to create and modify database schemas and structures.

Documentation shall be provided for all changes and FDA approval shall be received prior to execution of changes in the Production environment.

• Providing recommendations for database tuning and performance improvements.

• Performing logical and physical data modeling and design with each release (e.g., identify the logical/physical components, including tables, columns, definitions, referential integrity rules, keys, indexes and views). The Contractor shall provide the data models in the Erwin format, along with a data dictionary.

• Ensuring configuration consistency across all database environments.

• Supporting release requests for all environments.

• Creating, executing, and maintaining scripts, jobs and procedures.

• Supporting the migration and optimization of data as it is moved from the current environments to the new environments.

• Creating database upgrade/migration plans, processes and procedures, and performing testing to ensure the upgrade/migration is successful.

• Supporting the refresh of data in the non-Production environments to support development, test, and training activities, as well as the creation of data for these activities.

3.1.5 COTS, GOTS, Libraries, and Tool Administration Support

The Contractor shall provide support for the installation and configuration of all software used in the supported ORA Imports and SIRCE systems. The Contractor shall be responsible for providing staff with the necessary level of expertise regarding the different programming languages and software used by the systems. FDA’s objective is to ensure its systems are secure and maintainable. The Contractor shall conduct the following activities:

• Work with the data center staff and other contractor support personnel to perform the activities needed to ensure the software and tools function as intended and that system performance is maintained or improved during the period of performance.

• Establish and implement standards for the selection, configuration, and usage of software products in the ORA Imports and SIRCE systems.

• Develop and implement a plan to upgrade the Imports and SIRCE applications as needed to support the currently approved versions of supported software. This includes regular upgrades to core COTS, such as ORACLE databases. FDA requires all systems to upgrade when needed to maintain vendor support and meet security requirements.

• Provide recommendations for upgrades and replacements to older technology and implement the approved updates. FDA expects that all systems will be updated to keep technology up-to-date and to meet security requirements. This includes versions of software languages and libraries used by the systems, and any system changes necessary to maintain functionality after the upgrade.

3.1.6 Security Related Support

The Contractor shall provide support and expertise to ensure the ORA Imports and SIRCE systems continue to satisfy the requirements established for FDA systems, see IDIQ Section 4.3. The Contractor shall also perform the following Security-related activities as part of ongoing O&M:

• Respond to and coordinate with OIMT security to assess and ensure ORA Imports and SIRCE Systems meet FDA security standards.

• Participate in Annual Contingency Planning exercises, resolve any issues identified, and provide input to complete the annual Contingency Plan document and Business Impact Analysis.

• Participate in ongoing Security Assessments for each application, including providing support to achieve and maintain an Authority to Operate (ATO), and respond to and/or resolve security issues identified in POA&M and Security Assessment Report (SAR) documents.

• Provide support to OIMT Security for planning and tracking security activities (e.g., Certification and Accreditation, addressing POAMs, and assessment of security risks).

• Respond to and assist with resolving security breaches and issues related to any supported Systems. Note that no significant security issues beyond system patches have required support from the O&M contractor in the last year.

• Support testing of system and data backup and recovery as needed.

• Provide monthly lists of active user accounts for each system following guidance provided by

OIMT.

• Provide data for the semi-annual Imports and SIRCE systems User Access Review reports.

• Respond to ad-hoc data requests, such as audit information, to support review of security concerns.

3.1.7 System and Data Disposition

The Contractor shall work with OIMT and ORA to identify and support the retirement and consolidation of systems, components, technologies, tools, and data when they meet the appropriate disposition stage of the lifecycle. The Contractor shall perform the following activities:

• Plan, schedule and document disposition activities, and obtain the required approvals for execution.

• Disable and remove user access to the system, tool, data, or service.

• Support other contractors tasked with developing Imports and SIRCE components in the migration of data to replacement systems and integration with the new systems.

• Conduct data archiving in accordance with the ORA Records Management Plan. Ensure archiving is in accordance with FDA’s Records Retention schedule.

• Identify software and hardware components that need to be removed from necessary environments.

• Conduct clean-up of metadata and obsolete security roles and permissions.

• Verify system components have been archived and disposed of as documented in a Disposition

Plan.

3.1.8 User Education and Training

The Contractor shall provide support to maintain environments for training and for users to gain experience with ORA Imports and SIRCE systems as well as new features in those systems. FDA provides two environments for these activities, Practice and Training, and coordinates with OTED and the ORA IT staff to assist with preparing the environments for use when needed. Normally, the environments are to be kept up to date by installing any new releases or upgrades no later than 1-2 weeks after implementation in Production. In some cases, user training is also conducted in the Preproduction environment in coordination with the contractor. To support user education and training, the Contractor shall:

• Provide the ORA business owner and staff from OTED with information for all new functionalities and changes for each new release. ORA will assess the changes and determine the need for user training or modification to existing training materials. Historically, only minimal modifications are necessary for O&M releases.

• Create and deliver release notes, screen shots and other documentation, as well as provide system demonstrations as requested by the Business Owner or OTED.

• Coordinate with ORA and OIMT to keep training and practice environments up-to-date with the latest software releases and support the establishment of additional environments when needed.

• Update and refresh user accounts and data in the training and practice environments as needed to support training. Special data sets will be created when requested to support new training needs.

• Provide technical support during training and software demonstration sessions to resolve issues encountered and answer questions. User questions related to training outside of training sessions will be supported through the User Support (Section 2.1.2) process.

3.1.9 Maintenance of PREDICT Screening Rules

Maintenance of the PREDICT rule base is critical to ensuring highly effective screening of the import lines submitted to FDA. The enhanced capabilities of the Rules Studio enable FDA to create and manage many rules. For these cases, contractor support is generally limited to troubleshooting and addressing issues encountered with the Rules Studio software. Some rules, however, are still developed by the contractor using the Jess rules language. Support is also needed for troubleshooting and revisions to the rules built using Jess. For these activities, the Contractor shall be required to have knowledge of Jess and the software provided by NTELX. The Contractor shall conduct the following activities:

• Provide support to develop and maintain rules that will be utilized by PREDICT for screening of imported products. This support shall include creation of new rules and modifications to existing ones that are not readily created by the business using Rules Studio (approximately 2 rules/week for 801a screening).

• Participate in researching and troubleshooting of existing rules, and support ORA business in responding to questions. The support also involves interaction with business stakeholders to resolve problems with rule design or execution.

• Support adjustments to the weighting and scoring, such as modifications to threshold values.

3.1.10 Maintenance and Support of PREDICT Dynamic Targeting (PDT) The PDT system utilizes the Drools Business Rule Engine (BRE)-based NTELX nxAnalyzer software to evaluate user defined business rules on prior notices of human or animal food items submitted for import into the United States. Periodically NTELX releases an enhancement or a patch to update the Drools nxAnalyzer software. The PDT business rules are written in Drools code outside of the NTELX software and they often reference variable values and ranges stored in the database. Hence, maintenance and support of PDT requires the Contractor to have a good understanding and knowledge of the Drools-based nxAnalyzer as well as the Drools code of the screening rules. The Contractor shall:

• Support installation and integration with NTELX Drools nxAnalyzer releases and patches.

• Provide troubleshooting support for issues found in the nxAnalyzer baseline running in PDT.

• Provide support for any integration issues found by developers which may necessitate nxAnalyzer patch releases.

• Support minor adjustments to weighing and scoring data values and ranges used by the business rules.

• Support minor updates to business rules maintained outside of the NTELX nxAnalyzer.

4.0 Task Order Management

The Contractor shall conduct all activities necessary to manage the Task Order following project management best practices. These activities include managing cost, schedule, quality, risk, and communications with stakeholders. The Contractor shall identify a Task Order Lead (Key Personnel) with responsibility for management activities and a Technical Lead (Key Personnel) who will be responsible for technical coordination and serve as the point of contact for any system operational issues.

The Contractor shall recommend a management and organizational approach to deploy resources and meet the requirements outlined in the active task orders. To minimize overhead, the Contractor may propose to combine meetings and reporting requirements at a level that provides the necessary oversight and control. The Contractor shall provide a brief proposed management approach proposal that supplements the contract Management Plan by outlining the proposed grouping of objectives, the team structure that will be used to perform the work, and identifying the management staff and lines of responsibility. The COR will provide feedback on the proposed approach and approve the final approach.

Within 2 weeks of the Task Order start date, the Contractor shall schedule a Task Order Kick Off to present the team organization, introduce the team, and address key tasks, schedule, assumptions, constraints, and risks. The Contractor shall schedule an O&M status meeting at least once per week and provide input to the status reporting described in the IDIQ and the Program Management and Integration Task Order. The Contractor shall schedule additional business and technical meetings as required to meet the objectives of the Task Order.

5.0 General Requirements

The Contractor shall comply with the provisions in the IDIQ, including all EPLC, Security, Privacy, 508 Compliance, and Architecture requirements. The contractor shall support and perform all system development life cycle activities, documentation and deliverables as required. Unless specifically stated, all work requirements are inclusive of all activities to support implementation necessary to deliver support and functionality to end users. This includes the following activities:

1. The Contractor shall coordinate with the business representatives and OIMT to plan the activities described above and to track the execution of key tasks. Such coordination may include review and/or demonstrations of software components to promote understanding of O&M issues, bug fixes, or other proposed changes.

2. The Contractor shall support and work with business representatives, OIMT, other vendors, and various offices within ORA throughout the whole EPLC management process as needed to ensure successful implementation, maintenance of current performance and functionality, and to ensure that business needs are met.

3. The Contractor shall coordinate with teams developing DME releases to plan for and execute coordinated software releases where applicable. Releases may include both content developed within a DME task and content developed in this O&M task. Due to software interdependencies, the code developed by a DME team may also require code updates to be developed by the O&M team for a coordinated release.

4. The Contractor shall maintain existing code in an efficient manner without unnecessary introduction of changes that would deviate from the Reference Architecture. Where possible, the contractor shall use designated common components (e.g., auditing, error handling, data access) as appropriate and recommended integration mechanisms (e.g., API). Although ORA’s objective is that software shall comply with the ORA Reference Architecture, rigorous compliance for the software implemented in this task order may be prohibitively expensive.

Most bug fixes and minor enhancements to legacy systems shall be completed without change to the existing architecture.

5. This task includes, but is not limited to, modifications to any ORA systems in an ORA managed investment and coordination with the owners of systems in other Investments that are impacted by the enhancements, as well as with other ORA task orders.

6. The following position sensitivity designation and associated clearance and investigation requirement applies under this task order:

7. The Contractor shall ensure that all staff (Prime and Subcontractor) comply with the HHS criteria for the assigned position sensitivity designations prior to performing any work under this contract.

[X] Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation

(LBI).

6.0 O&M Deliverables

The contractor shall provide the following deliverables.

Deliverable/Artifact Frequency Due Date Project Process Agreement (PPA) Once for each release. Two weeks after release content is approved.

EPLC documentation as detailed in the PPA

Drafts as needed. Final deliverables at least 5 business days prior to the Stage Gate Review for each release.

As required by EPLC.

Successful Stage Gate Review (s)

(Go or Go with Conditions) as detailed in the PPA

At least once for each release. At least three business days prior to any release.

Project Schedule Weekly. Initial Draft 2 weeks after Task Order start with updates weekly.

Project Risks and Issues list As designated by the COR, not more than weekly.

Initial Draft 2 weeks after Task Order start with updates weekly with Status Meeting materials.

Status Meeting:

• Agenda

• Minutes from prior meeting

As designated by the COR, not more than weekly.

Agenda at least one business day prior to the meeting.

Meeting minutes no later than two business days following the meeting.

Status and Financial Reports Monthly. Included as a section in the IDIQ reports and financial reporting.

Note that EVM reporting is NOT required for this FFP task.

Complete and tested software source and executable code (Production ready)

Once for each Production Release (may be delivered in incremental releases to deliver functionality as completed).

No later than close of business day before the release.

Requirements Walkthroughs, software demonstrations, sprint reviews and demonstrations, UAT support meetings

Per project schedule Agenda at least one business day prior to the meeting.

Meeting minutes no later than two business

• Agenda

• Minutes days following the meeting.

• Deliverables shall be presented to the FDA COR on the dates specified in the Table.

• Documents shall be clearly written in plain English.

• Documents shall be complete and accurate.

• Documents shall be brief to meet the desired need.

Project Schedule updates and changes shall be first submitted by the Contractor to the COR for review and approval before incorporation into the schedule.

7.0 Contract Type

This Task Order will be Firm Fixed Price.

8.0 Period of Performance

(Estimated)

Base Year: August 2018 – August 2019 (Inclusive of transition in)

Option Year 1: August 2019 – August 2020

Option Year 2: August 2020 – August 2021

Option Year 3: August 2021 – August 2022