Atch_3_Program_Management_and_Integration_SOW_-_updated.pdf

SOL18-223-SOL-00017

Amendment 2

RFP Attachment 3

Task 2 – Program Management and Integration (Base + 3 Option Years)

1.0 Background

The Imports and SIRCE investments currently manage the development, enhancement, operations and maintenance of over 30 applications and components, including legacy applications and new services and components introduced to modernize and enhance the IT capabilities needed by ORA. Some of these functions are mission critical and must be operational 24 hours/day by 7 days/week. Imports and SIRCE systems interface with many other systems within FDA and ORA, as well as systems external to FDA, to access and to share data. Systems have been developed over the past 20 years by several different contractor teams, using different technologies. Currently systems are under development by four different contractors in the Imports and SIRCE Investment alone.

Thus, successful management of this contract will require both a comprehensive Program

Management effort and a dedicated integration effort. The Contractor shall manage at the

Program level to ensure work is planned and tracked in conjunction with the government and all participants, that risks and identified and managed, that communications with stakeholders are managed to clarify and broaden the understanding of the Program, that dependencies are identified, and that the Program is integrated both in management and across systems.

2.0 Program Management

The Contractor shall perform management activities for the overall contract. The Contractor shall manage cost, schedule, and quality on a day‐to‐day basis and shall follow best practices, e.g., the Project Management Body of Knowledge (PMBOK). The Contractor shall also perform those activities that ensure the efforts undertaken are performed in a coordinated and efficient manner, addressing interdependencies amongst projects and systems and with communication across teams, both Contractor and Government.

To manage the Program as a whole, the Contractor shall perform the management activities including, but are not limited to:

Create, manage, and control project schedules using a template provided by FDA to ensure a uniform and integrated schedule, providing input to the government Integrated

Master Schedule.

Create and maintain an Integrated Release Schedule that ensures release activities are coordinated and can be completed without conflict between releases, data center activities such as patching, or activities for other interdependent systems.

Perform program risk management, including identification, assessment, and mitigation of risks at the overall Program level. This shall include assessment of the impact of project/task order risks on the overall program and on other projects or tasks.

Create the required metrics and status reports, as detailed below.

Create and manage a Communications Plan to ensure adequate communication within the team and between the stakeholders.

Plan and manage program deliverables and track all contract and task order deliverables.

Plan and manage staff resources.

Maintain a Quality Assurance process to establish standards, processes, and procedures, and to maintain a high level of quality in all program deliverables and activities.

Respond to Data Calls to include coordination, analysis, tracking, data gathering, and reporting – Data calls often involve financial status, computer or hardware details, technical attributes of the systems, or security audits. Quick turn‐around time is often required for data calls. Historically, data calls have required a combined team average of

24 hours per month from the Contractor.

Participate in FDA Change Control Board(s) (CCB). The CCB activities include:

Review Change Control Requests (CCR); prioritize scope of work for each release, provide technical information for proposed change requests (e.g. technical feasibility, technical alternatives, level of effort (LOE) required to complete the change), and discuss issues/risks.

Provide overall Program Management (PM) support throughout the performance period using internal processes.

Collaborate with other contractors to integrate project schedules and plans for development, O&M, and transition of responsibilities when new systems are added to the

Imports and SIRCE portfolios.

As necessary, the Contractor shall work with the Government to reprioritize activities to refocus work efforts and support activities to address new or changing ORA Business and OIMT needs

(e.g., modifying release dates, the number of releases, or the scope of individual maintenance and/or emergency releases). The Contractor shall work with the Government to determine and document the appropriate level of EPLC deliverables and milestones to ensure a successful outcome for each system.

2.1 Management Plan

The Contractor shall provide the initial draft Management Plan as part of the Technical Proposal, as described in the IDIQ. Following the Government review, the Contractor shall provide a revised version of the Management Plan 30 calendar days after the award. The Contractor shall update and maintain the Management Plan throughout the life of the contract and shall deliver an updated plan annually or whenever a significant change occurs, as directed by the COR.

Changes to the Management Plan shall be subject to review and approval by the COR. Once approved, the updated Management Plan shall be enforced for implementation of the tasks.

2.2 Software Development Plan

The Contractor shall provide the draft Software Development Plan as part of the Technical

Proposal. The Contractor shall provide the final version of the Software Development Plan 30 calendar days after the award. The Contractor shall update and maintain the Software

Development Plan throughout the life of the contract. The Software Development Plan shall be followed throughout the contract. Any deviations from the Software Development Plan must be approved by the COR. The Contractor shall review the Software Development Plan at least annually and shall ensure all staff are trained to follow the plan. The Contractor may propose updates to the plan at any time, and any changes shall be implemented upon approval of the

COR.

The Software Development Plan provides the technical approach to software development, including the specific techniques and standards to be used for development and testing;

integration techniques (including configuration management) used to ensure the integrity of system builds; the number and type of reviews that are part of the development process; and the methods used to manage defect reports and analysis, including root cause analysis. At a minimum, the Software Development Plan shall address the following areas:

The Software Development Life Cycle (SDLC) activities and methodologies that will be followed and how they align with the FDA EPLC and result in successful stage gate reviews.

A software quality process to ensure all deliverables are free from defects and meet end user requirements.

Approach for system configuration and release management.

For all development activities, the Contractor shall adhere to the approved Software

Development Plan. The Contractor shall only use FDA approved software, including all tools, libraries, frameworks, etc., and shall follow FDA processes to obtain approval for any proposed additions.

2.3 Quality Assurance

The Contractor shall maintain the Quality Assurance Plan (QAP) that was submitted with the

Technical Proposal throughout the period of performance and shall implement the activities necessary to ensure deliverables and other work products meet the quality standards. At the

Program Management level, the Contractor shall establish standards, processes, and procedures for Quality Assurance and coordinate quality activities across the Program. The Contractor shall perform activities including training and reviews to ensure compliance with the Software

Development Plan and the FDA EPLC, including software code reviews and testing.

The Contractor shall provide code, draft deliverables, and Contractor quality review results upon request for government review and shall allow government participation in reviews.

2.4 Resource Management

The Contractor shall plan, organize, secure, and manage resources with appropriate knowledge and skills to perform ongoing activities. The management practices, organization, and leadership should ensure that the team has the depth and breadth of knowledge and the experience to support and enhance ORA’s systems and can work effectively with FDA technical and business staff to meet program goals.

2.4.1 Staffing

The Contractor shall recruit, hire, and manage staff that combine technical and communication skills, and are capable of supporting systems using a variety of technologies in a diverse environment. The Contractor shall supply staff that meet all FDA and HHS security requirements prior to the start of work, and shall ensure staff are trained and qualified for their technical areas. After the award, the Contractor shall perform the following staffing activities:

Recruit and hire qualified personnel, within a time‐frame that allows completion of the onboarding process prior to the date at which they are scheduled to begin work. Prior to hiring, the Contractor shall confirm that proposed staff have a level of knowledge and experience in their discipline appropriate to the labor category and have experience with the tools and coding languages used by the ORA systems.

Follow FDA onboarding and badging procedures and submit all necessary materials in a timely manner to ensure staff are badged promptly. Staff will not receive network access until these procedures are complete. Thus, unless approved by the COR, staff may not begin work until security and onboarding is complete.

Provide verification of completion of all mandatory FDA training including Annual

Security Awareness Training by all contractors assigned to this task. Completion of mandated training is a requirement for access to the FDA network.

Maintain and update the Resource Skills Matrix provided with the proposal. Update the

Resource Skills Matrix whenever there is a change due to new or departing resources;

updated skill set experience, or new certifications. The Contractor shall provide the updated Resource Skills Matrix to the COR annually or upon request.

Notify FDA immediately of any staff leaving or removed from the program, preferably in advance (as soon as the employee’s resignation has been accepted or the employee has been notified). The FDA badge and all government furnished equipment and other government materials or information shall be returned within 2 business days after departure.

The following position sensitivity designation and associated clearance and investigation requirement applies under this task order:

[X] Level 4: Public Trust ‐ Non-Sensitive (no National Security)/High Risk. Contractor employees assigned to a Level 4 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a

Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

The Contractor shall ensure that all staff (Prime and Subcontractor) comply with the HHS criteria for the assigned position sensitivity designations prior to performing any work under this contract.

2.4.2 Organization

The contractor shall establish and maintain an organizational structure that facilitates the performance of the tasks. The contractor shall provide an up to date Organization chart annually or whenever significant changes occur, as requested by the COR.

2.4.3 Key Personnel

The Project Manager shall be identified as Key Personnel for this Task. Additional key personnel shall include staff performing the following functions:

Test Lead

Lead Business Analyst

Lead Database Administrator

Software Engineering Lead

Lead Architect

The Contractor shall identify the individuals for these roles and the labor categories to which they are qualified and will be assigned. The Contractor shall ensure all Key Personnel are available at the start of each Task Order, and seek to maintain continuity of Key Personnel throughout the contract.

2.5 Meetings

The Contractor shall participate in meetings in different capacities such as leading discussions, contributing questions and answers, raising issues, presenting risks and concerns, developing and giving presentations, and other active oral and written communications. The Contractor shall prepare and track meeting agendas, minutes, notes, issues, risks and action items.

The Contractor shall be available, at a minimum, for the following meetings and group activities listed in Table 1 “Management Meetings and Activities” below. Additional meetings will be detailed in specific task orders. The Contractor shall provide agendas and meeting minutes for all meetings, where requested, in accordance with the timing specified in this section. To ensure productive meetings, key participants may need to attend some meetings in person.

Table 1: Management Meetings and Activities

Meeting Description Generate

Minutes

Frequency

(estimated)

Occurrences/ year

Monthly Task Order

Management Review

Meeting for the COR, Contractor, OIMT, and ORA to review the status of work being done under the various task orders, monthly metrics, and manage risks and issues.

Yes 12

Monthly Earned Value

Management Review

Meeting for the COR, Contractor, OIMT, and ORA to review the EVM data for the contract and associated task orders, discuss variances and necessary corrective actions, and manage risks and issues.

Yes 12

Technical and

Process

Improvement

Meeting

Quarterly Meeting to discuss existing issues and problems with the current technical environment, processes and procedures and propose solutions.

See Section 4.0 (Technical and Process

Improvement Support) for detailed information.

Yes 4

Management Weekly

Update

Weekly teleconference between the contractor and government program managers and other leads to address current program needs and issues, and to promote communication.

No 52

Demo System demonstrations to support communication regarding system capabilities and issues.

No 4

Ad Hoc Meeting Business and/or technical meetings requiring

Contractor presence.

No 50

2.6 Reporting

To minimize the work required for reporting, the Contractor may deliver a single Program Level report where applicable, in lieu of separate reports for each Task Order. However, the reports should be organized to clearly identify the work done under each Task Order, unless otherwise specified by the COR.

2.6.1 Monthly Status Report

The Contractor shall submit a Monthly Status Report, including the following types of information for each task defined for the program:

Activities

Accomplishments

Status of Deliverables which will include date due and date delivered

Milestones

Issues

Risks

Mitigation Plans

Planned Activities for the next reporting period

Routine Maintenance Activities

In the Status report, the Contractor shall include all Task Orders issued as well as any overarching program level activities. The COR or their designated representative can add to or change the information identified in the monthly status report at any time to meet ORA Business and OIMT needs. The Government will coordinate with the contractor to ensure any changes do not substantially increase the effort required to prepare the report. The Contractor shall abide by a template or format agreed to or supplied by the COR as well as the due date.

2.6.2 Monthly Metrics Report

The Contractor shall establish and track monthly and cumulative metrics by system and by release. The Contractor shall submit a Monthly Metrics Report to include the following metrics:

Release Content

List of enhancements by software release (application) completed in the prior month.

List of defects by software release (application) completed in the prior month.

List of enhancements by software release (application) currently planned for all upcoming releases for which content has been planned.

List of defects by software release (application) currently planned for all upcoming releases for which content has been planned.

Enhancements Metrics / Information

Number of enhancements implemented each month, by system.

Number of open enhancement requests for each system, by state (e.g., In Development, In Test).

Number of open enhancement requests for each system, by date the enhancement request was created.

Defects Metrics / Information

Number of defects resolved each month, by system.

Number of open defects for each system, by state (e.g., In Development, In Test).

Number of open defects for each system, by date the defect record was created.

List of defects identified in the reporting period, including the SDLC phase in which the defect was identified and the priority assigned.

Support Requests (Help Desk) Metrics (for O&M Tasking)

Number of Support Requests by state (e.g., Working, Pending Customer) in an open state weekly for the last 6 months.

Number of Support Requests by system created and resolved for the month and cumulative for the year.

Number of Support Requests by system reported by initial priority.

Number of Support Requests reported by Support Request type (e.g., data correction, user support, ad‐hoc query/report, estimation request) by system.

Average and maximum time to resolution for Support Requests, by system.

Average and maximum time to response for by Priority Support Requests with control charts.

List of all support requests open longer than 30 days, with status.

Data Call Metrics

Number of Data Call Requests for the month.

Level of effort hours per Data Call.

System Availability Metrics (for O&M Tasking)

Production restart requests per month by system.

System Downtime (unplanned) hours per incident listed by system.

Additional QASP Metrics

Additional metrics identified in the QASP, as directed by the COR with concurrence by the contractor.

The Contractor shall perform and report trend analyses on tracked metrics on a monthly basis.

The COR or their designated representative will work with the Contractor to refine these metrics to meet ORA Business and OIMT needs. The Contractor shall abide by a template or format agreed to or supplied by the COR as well as the due date.

2.6.3 Monthly Financial Reports

The Contractor shall create and provide Monthly Financial Reports which support the ORA

Investment Structure. The Monthly Financial Reports shall include financial information for each task requiring EVM reporting and shall contain data for the current month and cumulative to date for the task.

The Contractor shall deliver a Contract Performance Report (CPR) using standard Format 1

(WBS) and 5 (Variance/Problem Areas). The CPR includes current period data as well as cumulative to date data, with explanations for any variances above the set threshold. The

Contractor shall produce either separate reports for each task or combine the reports into a single document with separate data for each required task.

Within 30 days of the start of each Task Order, the Contractor shall provide a Task Mapping

Matrix that identifies the assignment of staff to different cost accounts and projects. The report shall contain:

Contactor/Sub‐Contractor Company Name

Resource Name

Resource Labor Category

% Time Allocated to each release or task/project area (may be estimated within reasonable limits)

The Contractor shall provide support to assist with the management of ORA IT Investment

Structure related to the execution of this program. In some cases, the Government will ask the

Contractor to report actual costs for different subprojects within a task order; these subprojects may not exactly match the cost breakdown used for EVM reporting. The COR will identify these requirements where necessary, for example to support reporting to Congress. As part of this support, the Contractor shall be required to:

Rectify financial information and statements.

Create and/or verify ad‐hoc reports based on ORA IT investments.

Communicate and coordinate with the FDA Capital Planning and Investment Control

(CPIC) Team to ensure information needed for the CPIC process is provided to the Team is acceptable and understandable.

The Contractor shall deliver the Monthly Financial Reports by the 9th calendar day of each month. The Contractor shall not re‐baseline without direct approval of the COR. The Contractor shall abide by a template or format agreed to or supplied by the COR as well as the due date for financial reporting. The detail and format required for this report can be adjusted at any time by the COR.

2.6.4 Program Management Reports

The Contractor shall contribute input and/or supply data to create and submit additional reports as directed by the COR. These additional reports shall include, but are not limited to the following:

Program Dashboard – Summarizing current system lifecycle status at a high level and presented at the Monthly Task Order Management Review.

Contractor GFE Inventory Report – The Contractor shall prepare and provide the COR or their designee an inventory of GFE, excluding office supplies. At a minimum, the report shall include the following: serial numbers, FDA property codes, model numbers, item description, person assigned to, and location. The Contractor shall ensure that Contractor

GFE Inventory will be updated when resources are added or removed from the project.

Project and Schedules ‐ The Contractor shall create and maintain resource-loaded schedules for each task, utilizing Microsoft Project, using a template or format provided by the government. The schedules shall identify dependencies, including dependencies on tasks in other contractor tasks and government activities. The Contractor shall update and submit the schedules to the government weekly with updates on the status (% complete, actual or forecast start and end dates) for each task. Any proposed changes to the tasks (e.g., delete or add tasks or change planned dates) shall be submitted to the COR for approval as a potential re-baseline. The contractor shall coordinate the integration between interdependent tasks on different projects and develop a master integrated release schedule to manage deployment resources and business needs.

Imports and SIRCE systems software licenses inventory, to document the licenses and software versions used in operational systems and development activities.

3.0 Integration

The Contractor shall manage all required activities to ensure alignment with multiple schedules and requirements across ORA Systems and projects as well other interfacing non‐ORA systems and projects. This could also involve alignment with Government directives that impact ORA

Business. The work includes the following activities:

Provide technical input and support to FDA efforts to establish and implement a standard architecture through participation at planning sessions, conducting research, and supporting governance processes. Provide expertise on software architecture and technologies for ORA-wide initiatives to plan for and guide development efforts.

Negotiate and resolve multi-discipline and multi-system stakeholder requirements.

Maintain and coordinate interfaces between Imports, SIRCE, and OCI systems as well as those with ORA systems, applications and components managed under other investments.

Interfaces will include systems outside of FDA as well as external systems, including the interface with Customs and Border Protection.

Coordinate with other projects sharing COTS tools, components developed by Imports and SIRCE projects, and external components used by these systems.

Ensure project Schedule alignment within ORA and other FDA centers.

Collaborate to troubleshoot system development and operational issues.

Identify and propose solutions to cross-system and cross-team interdependency issues.

In addition, the Contractor shall establish and implement standards, processes, and procedures to ensure integration within the team. Activities include:

Develop and maintain standards such as coding and design standards

Develop and maintain program plans such as Master Test Plans and Communication

Plans

Establish Standard Operating Procedures

Train staff on Program Specific processes

Conduct Program Level reviews to ensure all teams are functioning in an integrated and coordinated manner, such as Risk Review and Engineering Review boards.

4.0 Technical and Process Improvement Support

The Contractor shall implement an ongoing process for recommending improvements to systems and processes, leveraging corporate experience and knowledge of industry trends and best practices. The Contractor shall perform following activities include, but are not limited to:

Define a proactive approach to identify and document technical and process improvements.

Identify and document solutions to technical issues and problems.

Conduct quarterly meetings with the COR, ORA, and OIMT to discuss and review the identified technical and process improvements.

Conduct prototypes to demonstrate potential solutions (with government approval).

Upon the Government approval, recommended improvements will be assigned to the appropriate task order for implementation.

5.0 Program Management and Integration Deliverables

The Contractor shall create the deliverables outlined in Table 2 “Management Deliverables”:

Table 2: Management Deliverables

Deliverable Reference Frequency Tracking

Number

Management Plan Section 2.1 Draft provided as part of Technical Proposal.

Final provided 30 calendar days after award.

TOM 1

Review and update as indicated by the COR.

Software

Development Plan

Section 2.2 Draft provided as part of Technical Proposal.

Final provided 30 calendar days after award.

Review and update as indicated by the COR.

TOM 2

Quality Assurance

Plan (QAP)

Section 2.3 Draft provided as part of Technical Proposal.

Updates as necessary to address deliverable and service quality.

TOM 3

Quality Assurance

Surveillance Plan

(QASP)

Section 2.3 Draft provided as part of Technical Proposal.

Review and update as indicated by the COR.

TOM 4

Resource Skills

Matrix

Section

Error!

Reference source not found.

Draft provided as part of Technical Proposal.

First update is required three months after award.

Subsequent updates due annually or as directed by the COR.

TOM 5

Status Report Section

2.6.1

Monthly, by the 15 th calendar day following the month being reported.

TOM 6

Metrics Report Section

2.6.2

Monthly, by the 15 th calendar day following the month being reported.

TOM 7

Financial Reports Section

2.6.3

Monthly, by the 9 th calendar day following the month being reported.

TOM 8

Management

Dashboard

Section

2.6.4

Monthly, as directed by the COR. TOM 9

Contractor GFE

Inventory Report

Section

2.6.4

Quarterly, as directed by the COR. TOM 10

Task Schedules Section

2.6.4

Weekly, as directed by the COR. TOM 11

Release Schedule Section

2.6.4

Weekly, as directed by the COR. TOM 12

Technical and

Process

Improvement

Report

Section 4.0 Quarterly, as directed by the COR. TOM 13

Meeting Agendas Section 2.5 At least one business day prior to the meeting. TOM 14

Meeting Minutes Section 2.5 Within 2 business days after the meeting. TOM 15

Responses to Data

Calls

N/A As required and directed by the COR. TOM 16

6.0 General Requirements

The Contractor shall comply with the provisions in the IDIQ (indefinite delivery/indefinite quantity), including all EPLC, Security, Privacy, 508 Compliance, and Architecture requirements.

7.0 Task Order Type

This Task Order will be Firm Fixed Price.

8.0 Period of Performance

(Estimated)

Base Year: 12 Months

Option Year 1: 12 Months

Option Year 2: 12 Months

Option Year 3: 12 Months