FSM_PPBE_Draft_PWS_RFI__70FA3019I00000007.pdf

Federal Emergency Management Agency (FEMA) Financial Systems Modernization (FSM) Program

PERFORMANCE WORK STATEMENT (PWS)

Planning, Programming, Budget, and Execution (PPBE) System

September 2019

PPBE Software - PWS

PPBE Software PWS August 2019 Page 2 of 75

TABLE OF CONTENTS

1 GENERAL INFORMATION

1.1 Background

1.2 PPBE Overview

1.2.1 Planning Phase

1.2.2 Programming Phase

1.2.3 Budgeting Phase

1.2.4 Execution Phase

1.2.5 FEMA’s PPBE Framework

1.2.6 FEMA’s PPBE Calendar

1.3 Scope

1.3.1 Implementation Timeline

1.4 References

1.4.1 Applicable Authorities:

1.4.2 Applicable References:

1.4.3 Information Security Laws, Regulations, Standards, and Guidance

2 SPECIFIC TASKS AND DELIVERABLES

2.1 Task 1 – Software Subscription

2.1.1 Software Subscription

2.1.2 Hardware/Infrastructure

2.1.3 Environments and Hosting

2.2 Task 2 – Implementation Services

2.2.1 Project Management

2.2.2 Functional Support

2.2.3 Testing Support

2.2.4 Training Support

2.2.5 Technical Support

2.2.6 Data Conversion

2.2.7 Cut-Over Support

2.2.8 Post-Production Support

2.3 Task 3 – Operations & Maintenance (O&M)

2.3.1 Software Patching Support

2.3.2 Help Desk Support

PPBE Software PWS August 2019 Page 3 of 75

2.3.3 Functional Support

2.3.4 Technical Support

3 DELIVERABLES

4 PERFORMANCE MEASURES

5 PERIOD OF PERFORMANCE

6 PLACE OF PERFORMANCE

7 CONTRACTOR PERSONNEL

7.1 Qualified Personnel

7.1.1 Project Management Experience

7.1.2 Implementation Experience

7.1.3 Subject Matter Experience

7.2 Key Personnel

7.3 Employee Identification

7.3.1 Visiting Government Facilities

7.3.2 Working On-Site at Government Facilities

7.4 Employee Conduct

7.5 Removing Employees for Misconduct or Security Reasons

8 HOURS OF OPERATION

9 TRAVEL

10 TASK ORDER POST AWARD CONFERENCE

11 PROGRESS REPORTS

12 PROGRESS MEETINGS

13 PAYMENT SCHEDULE

14 APPENDICES

APPENDIX A – DHS FINANCIAL MANAGEMENT SYSTEMS STANDARD (FMSS)

APPENDIX B – FEMA PPBE FUNCTIONAL REQUIREMENTS

APPENDIX C – FEMA PPBE NON-FUNCTIONAL REQUIREMENTS

APPENDIX D – SECTION 508 REQUIREMENTS

APPENDIX E - RECORDS MANAGEMENT OBLIGATIONS

APPENDIX F - ENTERPRISE ARCHITECTURE

APPENDIX G - PRIVACY

PPBE Software PWS August 2019 Page 4 of 75

1 GENERAL INFORMATION

The Federal Emergency Management Agency (FEMA) requires a Budgeting system that supports the Planning, Programming, Budgeting, and Execution (PPBE) framework. FEMA seeks Software as a Service (SaaS) which has the capability to import financial execution data to modernize our existing manual processes. The high-level goals of this system are intended to improve the speed and accuracy of producing multi-year funding plans, planning and fiscal guidance, required documents, tracking progress, measuring results and comprehensive reporting to ensure overall accountability throughout the PPBE process.

1.1 BACKGROUND

The FEMA mission is to support our citizens and first responders to ensure that as a nation we work together to build, sustain, and improve our capability to prepare for, protect against, respond to, recover from, and mitigate all hazards. The DHS Financial Accountability Act of 2004 established policies for the PPBE system. The system enables large multiple-mission government organizations to effectively plan for, request, and execute public funds. Currently, FEMA Office of the Chief Financial Officer (OCFO) uses commercial software (e.g. Microsoft Excel) and other business systems such as Spend Plan Reporting & Integration Tool (SPRINT) and Integrated Financial Management Information System (WebIFMIS), to perform the Planning, Programming, Budgeting and Execution functions for the Agency. The objective is to license a vendor COTS solution leveraging a SaaS (Software as a Service) model hosted on a FedRAMP certified cloud-based platform and an integrator with expertise to deliver the FEMA required capabilities.

1.2 PPBE OVERVIEW

DHS Directive Number 101-01 establishes PPBE as the system through which the DHS allocates resources among its constituent organizations and programs. The FEMA PPBE system aligns with DHS’s decision-making processes and meets the Office of Management and budget’s (OMB) requirement that agencies maintain a “comprehensive system that integrates analysis, planning, evaluation, and budgeting” to facilitate efficient and effective use of resources to advance an agency’s mission, goals outcomes, and objectives1. FEMA leadership utilizes PPBE to link strategic direction, resource allocation, and identification of performance measures and targets, as well as to monitor execution of strategy and adjust during regular reviews to maximize mission achievement. Based on this directive, FEMA uses PPBE as a framework for resource allocation decision making and to articulate program priorities. PPBE is a cyclic annual system consisting of four sequential but sometimes overlapping phases as follows:

1.2.1 Planning Phase

The Planning Phase initiates the new cycle of the PPBE system each year. The objective of the planning phase is to identify and communicate resource planning priorities to guide development of resource plans and conduct the analytic activities necessary to prepare for the subsequent Program and Budget Review (PBR) and to identify potential issues for further study during future cycles within the Future Years Homeland Security Program (FYHSP). FEMA’s strategic and annual planning efforts articulate long-term strategic goals, identify performance goals, and determine annual priorities to advance the Agency’s

1 Office of Management and Budget, Circular No. A-11: Preparation, Submission and Execution of the Budget (June 2019). Section 31.1, page 1 of Section 31. Retrieved September 14, 2019 from OMB website:

https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf

PPBE Software PWS August 2019 Page 5 of 75 strategic direction. The final outputs of the Planning phase are the FEMA Strategic Plan and an annual memorandum conveying planning guidance.

1.2.1.1 Strategic Planning

Strategic Planning involves development of the FEMA Strategic Plan, defining FEMA’s strategic goals and objectives and what should be done to achieve them. FEMA Components may develop strategic plans to articulate how they will achieve mission success and implement responsibilities under the FEMA Strategic Plan.

1.2.1.2 Annual Planning

Annual Planning assesses how best to accomplish the FEMA Strategic Plan’s long-term goals through resource decisions within the PPBE cycle’s five year planning horizon. Involves annual review and adjustment of the Agency’s priorities. Results in an annual memorandum from the FEMA Administrator conveying planning guidance to inform decision-making in the subsequent phases. FEMA Components develop annual plans that provide strategic context for informing their resource planning by defining priorities and identifying what must be resourced.

1.2.1.3 Performance

Performance is integral to defining FEMA’s strategic direction. Includes establishment and subsequent review and adjustment of the Agency’s performance goals. FEMA Components develop performance metrics to support and link to the agency-wide metrics to facilitate evaluation of progress.

1.2.2 Programming Phase

Programming Phase follows the planning phase. The objective of the programming phase is to translate resource planning priorities into specific resource allocation decisions articulated over a five-year period consistent with Secretarial and Administrator direction and the missions and goals of the FEMA Strategic Plan. Programming is initiated with the analysis of the planning phase products and ends with development of an integrated seven-year Resource Allocation Plan (RAP) to submit to DHS for decision-making leading to a final DHS Resource Allocation Decision (RAD).

1.2.2.1 Program Development

Program Development consists of the development and approval of the FEMA Resource Allocation Plan (RAP) for future years (FY+2 to FY+6). The RAP outlines future FEMA capabilities and capacities to achieve FEMA’s strategic goals and objectives, within fiscal guidelines. Includes program analysis and development of alternatives as necessary.

1.2.2.2 Program Review

Program Review is conducted through the Program & Budget Review (PRB) process to examine resource plans against strategic and mission resource needs and fiscal budgeting limitations. FEMA Components prepare resource and performance plans. Analysis of the Component submissions enables the Program and Budget Executive Panel to decide between agency-wide alternatives for significant resource needs and crosscutting issues that require strategic resource rebalancing.

PPBE Software PWS August 2019 Page 6 of 75

1.2.2.3 Performance

Performance establishes quantifiable measures and targets for gauging program outcomes to inform resource trade-off analysis and decisions. Emphasis for FEMA Components is on activity level measures to support justification of requirements and expected impacts.

1.2.3 Budgeting Phase

Budgeting Phase occurs concurrently with the programming phase. The objective of the budgeting phase is to develop a fully justified one-year budget submission for FEMA to the Department. The final output of the Budgeting Phase is the annual FEMA Congressional Justification. The enactment of an appropriation completes the Budgeting Phase. During the Budgeting Phase, FEMA translates the RAD into the detailed resource requests that will be included in FEMA’s annual budget submission and develops justification documents to support the President’s Budget request to Congress.

1.2.3.1 Budget Formulation

Budget Formulation involves translating the outputs of the Planning and Programming phases into specific, accurately priced priorities to be included in FEMA’s budget request to OMB and to Congress.

FEMA documents its resource requests in the Congressional Justification, which supports the President in meeting the legal requirement to submit a budget to Congress annually. Congress considers agency requests and uses the information included in the budget justification material to determine resource allocation among competing priorities. During the Budgeting phase, FEMA provides information to DHS, OMB, and Congress to facilitate review the Agency’s budget request.

1.2.3.2 Performance

Performance supports budgeting by helping to explain the value of resources in terms of impacts and accomplishments that can be measured and tracked. Performance measures are therefore an integral element of a well-prepared budget justification case.

1.2.4 Execution Phase

Execution Phase begins at the start of the fiscal year. The objective of the execution phase is to responsibly expend resources and to account for cost and performance to determine if programs perform FEMA missions in the most cost-effective manner while ensuring that FEMA satisfies statutory and regulatory responsibilities as well as delivers the products and services that have been planned, programmed, budgeted, and approved through the justification process while adhering to legal, administrative, and policy restrictions. At the same time, a strategic review is conducted to assess, using evidence, progress on implementation of the strategic plan, and the FEMA performance measure results are published in the Annual Performance Report. Strategic review, program evaluation, execution review and other analyses inform the subsequent planning phase.

1.2.4.1 Resource Management

Resource Management involves evaluation of strategic progress, assessing program requirements, and adherence to spend plans, and results in funding adjustments to correct resource imbalances. Includes administratively controlling funds; supplying financial information to FEMA managers; reporting actual results; assessing the applicability of those results to the preparation of future resource plans and decisions and managing completion of annual financial program closeout activities. Quarterly Resource

PPBE Software PWS August 2019 Page 7 of 75

Reviews provide a forum for FEMA senior leaders to regularly assess budget execution and performance and make resource decisions accordingly during the current fiscal year.

1.2.4.2 Performance Measurement and Program Evaluation

Performance Measurement and Program Evaluation consists of the responsible program managers ensuring that programs are being carried out as authorized and appropriated. Ensures mission performance and other reviews are incorporated in PPBE decisions for adjustments during the execution year, serving as critical feedback to inform the next Planning and Programming phases (i.e., feedback loop for the PPBE cycle).

1.2.5 FEMA’s PPBE Framework

FEMA’s PPBE Framework includes all the PPBE phases along with their corresponding purpose and decision documents as shown in Figure 1 below.

Figure 1 – FEMA’s PPBE Framework

1.2.6 FEMA’s PPBE Calendar

An example of FEMA’s PPBE calendar is shown in Figure 2 using the FY15 PPBE Calendar. The calendar is synched with the Department and Office of Management and Budget (OMB) and other external deadlines.

PPBE Software PWS August 2019 Page 8 of 75

Figure 2 – FY15 PPBE Calendar

1.3 SCOPE

The purpose of this Performance Work statement (PWS) is to acquire a Firm Fixed Price (FFP) contract for a Planning, Programming, Budget, and Execution (PPBE) SaaS Solution that shall provide approximately 300 FEMA resource personnel with consistent, accurate, and timely decision support data and tool to streamline major recurring processes and enhance stakeholder product delivery and reporting. FEMA is seeking the following full system development life cycle service support:

• PPBE SaaS Solution (Cloud-based & FedRamp Certified)

• Implementation Services

• Operations & Maintenance Services and Support

1.3.1 Implementation Timeline

FEMA intends for there to be four (4) implementation Phases for this PPBE project, with Contractor performance on each phase overlapping one another.

The implementation phases are summarized below:

• Phase 1 – Foundational resource system with Planning and Programming functionality and PPBE structure (RAP, PBR, and FDDs)

• Phase 2 – Budget and execution of operating plans, spend plans, execution data importing, and analysis forecasting tool functionality

PPBE Software PWS August 2019 Page 9 of 75

• Phase 3 – Performance management functionality

• Phase 4 – Financial statements

1.4 REFERENCES

1.4.1 Applicable Authorities:

• Public Law 108-330, DHS Financial Accountability Act, 14 Oct 04

• 44 U.S.C. 3506, Federal Agency Responsibilities

• Title 40, U.S.C., Section 11303, Performance-based and Results-based Management

• Title 40, U.S.C., Chapter 113, Responsibility for Acquisition of Information Technology

• Executive Order No. 12893, Principles for Federal Infrastructure Investments

• Executive Order No. 13450, Improving Government Program Performance

1.4.2 Applicable References:

• Department of Homeland Security (DHS) Management Directive (MD) 102- 01, Acquisition

Management Directive, January 20, 2010

• DHS MD 1330, Planning, Programming, Budgeting and Execution

• DHS MD 1400, Investment Review Process

• DHS MD 4200.1, IT Capital Planning and Investment Control (CPIC) and Portfolio Management

• DHS Capital Planning and Investment Control (CPIC) Guide, Version 7.1, August 2010

• DHS CFO Financial Management Policy Manual (FMPM), Chapter 2, Planning, Programming, Budgeting and Execution

• DHS Directive 101-01, PPBE, 14 Jul 16

• DHS PPBE Instruction 101-01-001, 15 Jul 16

• DHS 102-01-103-01 Systems Engineering Life Cycle (SELC) Guidebook

• DHS Sensitive Systems Policy Document 4300A (as revised), https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook

• Publications Annual Performance Report for Fiscal Years 2016 – 2018 (Sample), https://www.dhs.gov/publication/annual-performance-report-fiscal-years-2016-2018-0

• FEMA Directive 259-3, FEMA PPBE Cycle, 5 Jan 15

• FEMA Directive 259-2, Budget Standardization, 5 Apr 17

• FEMA PPBE Instruction 259-3-1, 30 Nov 16

• FEMA FD 143-4, Program Acquisition and Enterprise Service Acquisition Review Process, May 24,

• Office of Management and Budget (OMB), Circular A-11, Preparation, Submission and Execution of the Budget (July 2014)

• OMB, Circular A-123, Management’s Responsibility for Internal Controls (December 21, 2004)

• OMB Circular A–127, Financial Management Systems

• OMB Circular A–130, Management of Federal Information Resources

• OMB Circular A-136, Financial Reporting Requirements

• OMB Instructions, Instructions for the Planning, Budgeting, Acquisition and Management of Non-

IT Capital Assets

• OMB Capital Programming Guide https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook https://www.dhs.gov/publication/annual-performance-report-fiscal-years-2016-2018-0

PPBE Software PWS August 2019 Page 10 of 75

Note: Applicable authority and applicable reference documents will be made available upon request.

1.4.3 Information Security Laws, Regulations, Standards, and Guidance The PPBE SaaS solution offering must be compliant with the following mandated requirements:

Information Security Laws, Regulation, Standards and Guidance Primary Sources Overview Federal Information Security Management Act of 2002 (FISMA 2002) DHS 4300A and

DHS 4300B

Establishes the foundation of information security in the Federal government. As the primary legislation governing federal information security programs, FISMA builds upon earlier legislation through added emphasis on the management dimension of information security. FISMA delegates responsibility to develop detailed information security standards and guidelines for federal information systems, with the exception of national security systems, to NIST.

• FISMA designates OMB with the oversight of federal agencies’ information security implementation.

• FISMA provides a comprehensive framework for securing federal government information resources.

Federal Information Security Modernization Act of 2014 (FISMA 2014)

The FISMA 2014 updates the Federal Government’s cybersecurity practices by:

• Codifying Department of Homeland Security (DHS) authority to administer the implementation of information security policies for non-national security federal Executive Branch systems, including providing technical assistance and deploying technologies to such systems;

• Amending and clarifying the Office of Management and Budget (OMB) oversight authority over federal agency information security practices;

• Requiring OMB to amend or revise OMB A-130 to “eliminate inefficient and wasteful reporting.”

OMB Circular A-130 (Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources)

Establishes a minimum set of security controls to be included in federal information security programs, assigns federal agency responsibilities for the security of automated information, and links agency automated information security programs and agency management control systems. Security controls are the management, operational, and technical safeguards or countermeasures prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

Information Technology Management Supplements the information resources management

PPBE Software PWS August 2019 Page 11 of 75

Information Security Laws, Regulation, Standards and Guidance Primary Sources Overview Reform Act of 1996 (Clinger-Cohen Act) policies contained in the PRA by establishing a comprehensive approach for executive agencies to improve the acquisition and management of their information resources and:

• Focus on information resource planning to support their strategic missions;

• Implement a capital planning and investment control process that links to budget formulation and execution, and

• Rethink and restructure the way they do their work before investing in information systems.

Standards and Guidance Overview NIST Federal Information Process Standards

(FIPS)

Csrc.nist.gov/publications/fips/index.html

FIPS are developed in accordance with the FISMA. FIPS are approved by the Secretary of Commerce and are compulsory and binding for federal agencies. Since FISMA requires that federal agencies comply with these standards, agencies may not waive their use.

See the following recent and relevant FIPS:

• FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems

• FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems

• FIPS PUB 201-1, Personal Identify Verification (PIV) of Federal Employees and Contractors

NIST Special Publications 800 Series Cscr.nist.gov/publications/nistpubs/index.

Html

Guidance documents and recommendations are issued in the NIST Special Publication (SP) 800 series.

The special publication 800 series reports on ITL’s research, guidance, and outreach efforts in computer security, and it collaborative activities with industry, government, and academic organizations. Office of Management and Budget (OMB) policies (included OMB Memorandum, Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management) state that for other than national security program and systems, agencies must follow NIST standards and guidance. See the following relevant NIST Standards:

• NIST 800-37 – Guide for Applying the Risk Management Framework to Federal Information Systems

• NIST 800-53 – Defines the baseline security controls, which are chosen from FIPS 199 and FIPS 200

• NIST 800-171 – Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (SaaS)

PPBE Software PWS August 2019 Page 12 of 75

Information Security Laws, Regulation, Standards and Guidance Primary Sources Overview

• NIST 800-95 – Guide to securing web services Federal Risk and Authorization Management Program (FedRAMP)

FedRAMP is a result of the Cloud First policy issued in 2011 and OMB memo Security Authorization of Information Systems in Cloud Computing requiring the use of FedRAMP authorized cloud services by Federal agencies. FedRAMP is a centralized assessment program for Cloud Service Providers (CSPs) that mandate a security assessment be performed by a third-party assessment organization (3PAO) to provide Government cloud services (Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS)).

2 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

2.1 TASK 1 – SOFTWARE SUBSCRIPTION

The Contractor shall provide hosting services throughout all phases of the PPBE Program including integration & deployment, system cut-over and post production. The hosting services include:

2.1.1 Software Subscription

All software licensing required to meet the requirements outlined in the PWS (See Appendix B & C for detailed requirements). Vendors proposing shall have a FedRAMP Authorization at the time the vendor’s proposal is received by FEMA Contracting. If vendor’s proposal is received without a FedRAMP Authorization, then that vendor will be disqualified from competing.

Contractor shall deliver 100 initial licenses. Upon Authority to Operate (ATO) approval from FEMA, Contractor shall deliver 200 additional licenses for a total of 300 during the base period. One optional task is included for the purchase of additional user licenses. User licenses must be transferable between users and should not duplicate costs for users to have access in multiple environments. The licenses will be owned by FEMA and will be shared among FEMA’s customer user base.

Software Subscription Deliverables:

• Software Subscription Certificate

2.1.2 Hardware/Infrastructure

The Contractor shall provide all hardware and infrastructure required to host the PPBE SaaS solution.

Sample hardware and infrastructure items include, but are not limited to:

• Facilities (e.g., data center)

• Telecommunications

• Network operations

PPBE Software PWS August 2019 Page 13 of 75

• System administration

• Host-based intrusion detection

• Network-based intrusion detection

• Backup and recovery

• Monitoring of operating system, database, applications and network

• Support for installation of application patches and service-packs

• Physical database support and management

• User ID and password initial setups and resets

• System software patches and upgrades

• Hardware life cycle replacement

• Maintaining compliance with applicable federal standards

2.1.3 Environments and Hosting

The Contractor shall provide all required integrated implementation environments for all applications included in the PPBE SaaS solution and ensure that all environments can be promoted to one another (development to test and test to production). The Contractor shall not host any portion of the environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

At a minimum, Contractor shall provide the following environments:

• Production

• Development

• Testing

• Training

Environments and Hosting Deliverables:

• Service Level Agreement

2.2 TASK 2 – IMPLEMENTATION SERVICES

2.2.1 Project Management

The Contractor shall provide program management services throughout the lifecycle of the project.

Examples of services to be provided at a minimum include:

• Schedule Management

• Scope/Change Control Management

• Configuration Management

• Quality Management

• Organizational Change Management

• Strategic Communications

• Risk Management

The Contractor shall develop a project schedule to address implementation of the requirements identified in the PPBE Requirements List (Attachment A). The schedule shall identify at a minimum, in WBS format, the tasks to be completed, task duration, percent completed dependencies, critical path and milestones.

The project schedule shall be updated on a weekly basis throughout the project lifecycle.

PPBE Software PWS August 2019 Page 14 of 75

The Contractor shall participate in progress meetings with FEMA’s management and the Contracting Officer Representative (COR) to review and discuss the project.

Project Management Deliverables:

• Project Schedule

• Monthly Status Report

• Project Management Plan

• Quality Control Plan

• Transition Out Plan

2.2.2 Functional Support

The Contractor shall provide application configuration and shall provide a detailed solution design document to support and satisfy the requirements provided in the Appendix A and shall include functional specifications and business process flows.

Functional Support Deliverables:

• Requirements Traceability Matrix

• Solution Design Document

• Configuration Design Document

• “To Be” Process Flows

2.2.3 Testing Support

The Contractor shall develop, revise, maintain and publish an overall test strategy and test plan that shall govern the testing events required to successfully implement the PPBE solution. The test strategy shall encompass a mix of testing approaches, including:

Connectivity tests – testing activity designed to validate the continuity of network communications, accessibility, authentication and security controls. This testing activity will be performed by the contractor and will confirm that the PPBE SaaS solution can be accessed via the FEMA network.

Regression tests – tests that seek to identify new software issues, or regressions, in existing functional and non-functional areas of the system after enhancements, patches or configuration changes have be made to them. Regression testing will be performed by the contractor and will be in accordance with the government approved test plan.

User acceptance tests – testing conducted in conjunction with end users to determine if the documented requirements are met. User acceptance test events will be supported by the contractor using test scenarios and/or test scripts developed by the contractor.

Integration tests – demonstrates that the contractor configured PBBE solution satisfies all defined requirements and where individual units are combined and tested as a group versus the individual component. The contractor will perform integration testing for any interfaces developed as part of this effort and will be in accordance with the government approved test plan

PPBE Software PWS August 2019 Page 15 of 75

The test strategy and test plan shall include test objectives, assumptions, acceptance criteria, timeframes and responsibilities.

Testing Support Deliverables:

• Test Strategy

• Test Plan

• Test Scenarios

• Test Scripts

• Test Results Report

2.2.4 Training Support

The Contractor shall develop a Training Plan that outlines the objectives, needs, strategy and curriculum for training users on the PPBE solution. At a minimum the training plan will address the following:

• Target audience

• Training outline

• Training curriculum

• Proposed training delivery methods

• Materials, time, space requirements

• Training environment requirements

• Proposed schedules

• Training locations

The Contractor shall develop training materials and documentation to support end-user learning and deliver training that reflects common user interaction scenarios. Training delivery will address the unique implementation requirements of FEMA.

The Contractor shall be prepared to provide training in the following learning formats:

• Train-the-Trainer

• Instructor led classroom training (end user)

• Computer based training

• Live webinars

Training Support Deliverables:

• Training Plan

• Training Materials

• Training Delivery (Classroom, computer-based training, live webinars)

2.2.5 Technical Support

The Contractor shall develop and maintain technical specifications for all PBBE reports, interfaces, extensions and workflows. In addition, the Contractor shall provide technical support related to software updates to the PPBE solution, interfaces, reports and other processes to include the following:

• Application Database Management

• Software Enhancement Development

PPBE Software PWS August 2019 Page 16 of 75

• Report Development

• Software Upgrade Support

• Software Patch Analysis

• Interface Support

Technical Support Deliverables:

• Configuration Design Documentation

• IT Concept of Operations

• Technical Specifications

• Technical Release Notes

• Patch Analysis Report

2.2.6 Data Conversion

FEMA understands the level of effort required to convert data and is interested in converting only essential data required for the new system. FEMA will convert two years of historical execution data and current year data.

Data Conversion Deliverables:

• Data Conversion Plan

2.2.7 Cut-Over Support

The Contractor shall provide a plan that describes the transition from the development/test environment to the operational production environment, including transition of support activities from the implementation team to the operation and maintenance support team.

Cut-Over Support Deliverables:

• Cut-Over Plan

• Help Desk Plan

2.2.8 Post-Production Support

The Contractor shall provide post production support and knowledge transfer sessions to the operations and maintenance support team to ensure the seamless transition from implementation to production support. The Contractor shall also provide on-site end user support during the transition period to include issue troubleshooting and incident management.

Post-Production Support Deliverables:

• Knowledge Transfer Sessions

2.3 TASK 3 – OPERATIONS & MAINTENANCE (O&M)

The Contractor shall perform O&M support activities for the PPBE solution, including functional and technical support and security of the deployed solution. In addition, O&M support shall also include the following:

PPBE Software PWS August 2019 Page 17 of 75

2.3.1 Software Patching Support

The Contractor shall provide a process for software patching (changes to the software that are fixes and changes in a future software release that is needed prior to implementing the new release) and software release management that addresses when new software releases will be installed and a process to communicate the changes included in the software release to the end users.

2.3.2 Help Desk Support

The Contractor shall provide Tier 2 and Tier 3 help desk support. The primary driver of this work is responding to incidents logged by both agency and other support team members. Incidents will be logged by authorized agency users in FEMA’s approved incident management system. The breakout of the help desk support tiers is as follows:

• Tier 0 – Provided by the client and includes self-help.

• Tier 1 – Provided by FEMA staff and includes the capture of the issue in the incident management system and first level support.

• Tier 2 – Shared responsibility with the government and the Contractor

• Tier 3 – Contractor provided support implementing and resolving issues that require assistance from the software vendor.

FEMA staff will provide Tier 1 help desk support for the PPBE effort and the Contractor is not responsible for Tier 1 help desk support. If Tier 1 is unable to resolve the ticket, it is escalated to Tier 2.

The Contractor is responsible for supplemental Tier 2 support that includes providing guidance, training and support to the federal staff regarding production functionality. This is a shared responsibility with the government and the Contractor. The government will work collaboratively with the Contractor to prioritize incidents for resolution. The Contractor will be responsible for issue identification, analysis and resolution as part of the Tier 2 support and will be responsible for documenting the supporting information in the incident management system.

The following activities will be supported and completed by the Contractor:

• Work collaboratively with the federal level 2 support team to research and resolve issues.

• Capture and manage problem information in the incident support system

• Communicate with end users to obtain additional information related to the incident if the information provided is not sufficient.

• Assist in the development, implementation and update of service support processes to include service desk, incident management and problem management procedures.

• Communicate problem resolution with end users as part of knowledge transfer.

• Conduct requirements analysis and gap analysis between federal requirements and the

Commercial of the shelf solution.

• Work with the software vendor (Tier 3) for those issues that are elevated for correction or enhancement.

2.3.3 Functional Support

The Contractor shall provide functional support related to software updates to the PPBE solution, interfaces, reports and other processes to include the following:

PPBE Software PWS August 2019 Page 18 of 75

• Federally Mandated requirements

• Configuration Updates

• Updates to Functional Design Documentation

• Software Upgrades

• Desk Side Support

• Testing

• Training

2.3.4 Technical Support

The Contractor shall provide technical support related to software updates to the PPBE solution, interfaces, reports and other processes to include the following:

• Application Database Management

• Software Enhancement Development

• Report Development

• Software Upgrade Support

• Interface Support

Operations and Maintenance Deliverables:

• Service Level Agreement

3 DELIVERABLES

# Task Deliverable Due Date Frequency Format 1 2 Kick-Off Meeting 3 work days after award Once TBD

2 2 Project Schedule 10 work days after award

Updated monthly

MS Project

3 2 Monthly Status Reports 10th calendar day of each month

Monthly MS Word

4 2 Project Management Plan

Draft due XX Final due XX

Updated annually

MS Word

5 2 IT Security Plan Draft due XX Final due XX

Updated annually

MS Word

6 2 Quality Control Plan Draft due XX Final due XX

Updated annually

MS Word

7 2 Training Plan In accordance with approved project schedule

As requested MS Word

8 2 Test Strategy In accordance with approved project schedule

As requested MS Word

9 2 Test Plan In accordance with approved project schedule

As requested MS Word

10 2 Test Scenarios In accordance with As requested MS

PPBE Software PWS August 2019 Page 19 of 75

# Task Deliverable Due Date Frequency Format the approved project schedule

Excel/Word

11 2 Test Scripts In accordance with the approved project schedule

As requested MS Excel/Word

12 2 Test Results Report In accordance with the approved project schedule

5 days after each scheduled test event, in accordance with the approved project schedule

MS Word

13 2 Convert list of Requirements into a Requirements Traceability Matrix (RTM) and maintain the RTM

In accordance with the project schedule

As requested MS Excel

14 2 “To Be” Business Process Flows

In accordance with the project schedule

As requested Visio

15 1 Software Subscription Certificate

TBD TBD TBD

16 1 IT Concept of Operations TBD As requested MS Word 17 2 Help Desk Plan In accordance with approved project schedule

As requested MS Word

18 3 Service Level Agreement In accordance with approved project schedule

As requested MS Word

19 2 Configuration Management Plan

In accordance with the approved project schedule

As requested MS Word

20 2 Data Conversion Plan In accordance with the approved project schedule

As requested MS Word

21 2 Cut Over Plan In accordance with the approved project schedule

As Requested MS Word

22 2 Transition Plan In accordance with the approved project schedule

As requested MS Word

23 1 Transition Out Plan In accordance with the approved project schedule

As requested MS Word

PPBE Software PWS August 2019 Page 20 of 75

4 PERFORMANCE MEASURES

Performance Measures Standard Performance Threshold Method of Surveillance

The Contractor shall employ a management approach that is consistent with project management best practices, to include program oversight/management to track, manage, and report on the schedule and performance status of this effort.

The Contractor shall provide a management approach that meets the model index of Capability Maturity Model Integration Level 3.

Project deliverables are standardized and repeatable across the program.

100% Inspection by the COR’s review and feedback from appropriate government sources.

The Contractor shall prepare and submit task draft and final deliverables as dictated in the Deliverable section of the PWS.

The Contractor provides draft and final deliverables within the schedule specified, written and formatted as directed Deliverable section of the.

No more than 20% of all deliverables submitted for inspection/review shall be received late during the contract year.

100% Inspection by the COR’s review and feedback from appropriate government sources.

The Contractor shall prepare and submit weekly status reports as dictated in the Deliverable section of the

PWS.

The Contractor shall provide comprehensive weekly reports accurately reflecting progress, status, and any problems or issues encountered and recommend feasible resolutions.

No more than 10% of all reports submitted for inspection/review shall be in an untimely fashion.

100% Inspection by the COR’s review and feedback from appropriate government sources.

5 PERIOD OF PERFORMANCE

Base Year date of award – 12 months thereafter Option Period One 12 months after base period expires Option Period Two 12 months after option period one expires Option Period Three 12 months after option period two expires

6 PLACE OF PERFORMANCE

The primary place of performance will be FEMA headquarters, located at 500 C Street, SW, Washington

DC, 20472.

Resources may also be required to work out of the FEMA Winchester facility, located at 430 Market Street, Winchester, VA 22603.

Telework: As determined by the Contracting Officer’s Representative (COR), Contractor employees may be required to work at an alternate place of performance (e.g. the Contractor's facility or another approved location within the local travel area) in cases of unforeseen conditions or contingencies (e.g., government closure due to inclement weather, etc.).

PPBE Software PWS August 2019 Page 21 of 75

7 CONTRACTOR PERSONNEL

The Contractor shall advise and support the Government but shall not make final decisions or certification on behalf of the Government nor perform any inherently governmental functions. Contractor personnel shall clearly identify themselves as contractor employees in all interactions during contract performance.

It is the responsibility of the Contractor to propose qualified Contractor personnel to perform all requirements specified in this PWS.

7.1 QUALIFIED PERSONNEL

The Contractor shall provide qualified personnel to perform all requirements specified in this PWS.

Holistically, the personnel shall provide significant experience in all the areas aforementioned. The qualified personnel should have the necessary soft skills to be able to communicate (written and verbal) vital information to ensure success of the entire project management process. Personnel should be proficient with computer software such as Microsoft office, in particular Word, Excel, and Power Point.

The Contractor shall have proven experience in the following areas:

7.1.1 Project Management Experience

Project management experience, including the program manager, project manager(s) and all alternates.

At a minimum, these resources will be expected to hold and maintain a current Project Management Professional (PMP) certification or equivalent.

7.1.2 Implementation Experience

Implementation experience with the proposed PPBE software solution including past performance implementing the solution within the Federal government.

7.1.3 Subject Matter Experience

All task related Subject Matter Experts (SME(s)) shall have the necessary in-depth experience to successfully execute the requirements within this PWS. Upon submission of proposed personnel, a list of all current certifications per person will be required.

7.2 KEY PERSONNEL

Key personnel assigned to this requirement shall be qualified and have proven experience to meet all task as applicable to their assignment. The Government in this PWS is defining Key personnel as all individuals who will be supporting in a primary capacity, to include full and part-time personnel.

Before replacing any personnel (ALL are considered as ‘Key’) the Contractor shall notify the Contracting Officer (CO) and Contracting Officer Representative (COR) no less than 15 business days in advance, submit written justification for replacement, and provide the name, resume, and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise authorized by the Contracting Officer. The Contractor shall not replace Key Contractor personnel.

7.3 EMPLOYEE IDENTIFICATION

The Contractor shall comply with provisions of the SOW below.

PPBE Software PWS August 2019 Page 22 of 75

7.3.1 Visiting Government Facilities

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date.

Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

7.3.2 Working On-Site at Government Facilities

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.)

and display the Government issued badge in plain view above the waist at all times.

7.4 EMPLOYEE CONDUCT

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

7.5 REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

8 HOURS OF OPERATION

Contractor employees shall generally perform all work between the hours of 0600 and 1800 EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this PWS.

9 TRAVEL

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area (50 miles radius from place of performance) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

PPBE Software PWS August 2019 Page 23 of 75

10 TASK ORDER POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 3 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility, located at 500 C Street SW Washington DC 20472, or via teleconference.

11 PROGRESS REPORTS

The Contractor shall provide a progress report on a weekly basis to the Government Program Manager and COR via electronic mail. This report shall include a summary of all Contractor work performed, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

12 PROGRESS MEETINGS

The Contractor Project Manager shall be available to meet with the COR upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues.

These meetings are expected to take place at FEMA HQ location, but may also take place via teleconference.

13 PAYMENT SCHEDULE

A Payment Schedule, based on the Deliverables outlined in section 5 above, shall be provided as part of the proposal submission. The Government shall provide payment to the Contractor after delivery by the Contractor and acceptance by the Government, pursuant to the Delivery Terms. Payments shall only be made after the Government has inspected the Deliverable, the Contractor has corrected any deficiencies to the satisfaction of the Government, and the Government has provided final acceptance of the Deliverable.

14 APPENDICES

APPENDIX A – DHS FINANCIAL MANAGEMENT SYSTEMS STANDARD (FMSS)

The DHS FMSS provides the definition of the high-level requirements for the Enterprise Financial Management Systems. The table below defines the Budget Formulation to Execution (BF2E) taxonomies which FEMA used to develop requirements at level 1, 2, 3, and 4.

Level # DHS Business Process Area DHS Title Definition

Budget

Formulation to Execution

N/A

This business process encompasses the full lifecycle from budget formulation through final budget execution including all aspects of budget reporting. It focuses on collecting past year budget execution data, developing/submitting the proposed budget, and then distributing, tracking and controlling all funds authorized by statute, PPBE Software PWS August 2019 Page 24 of 75

Level # DHS Business Process Area DHS Title Definition law, offsetting collection, sanction, policy or regulation.

1.1 Budget

Formulation to Execution

Budget Formulation

This process includes the planning, preparation, and formulation of Components' budgets resulting from the management, analysis, and final creation of budget data in accordance with policy priorities and goals.

1.1.1 Budget

Formulation to Execution

Prior Year Data Collection

Includes activities associated with collecting prior year budget data (object class level, authority levels, allotments, etc.), actual spending amounts, and variances either at the line item or Program, Project, and Activities (PPA) level, and entering prior year data in the Office of Management and Budget (OMB) Max system and the Homeland Security database.

1.1.1.1 Budget

Formulation to Execution

Report obligations by program activity

OMB A-11 Process - includes object class codes Separate program activities into direct and reimbursable

1.1.1.2 Budget

Formulation to Execution

Report budgetary resources available for obligation

OMB A-11 Process - indicate budget authority type from approved budget authority; enter policy and baseline budgetary resources data (budgetary resources by policy budget authority [discretionary and mandatory], budgetary resources by baseline budget authority [discretionary and mandatory]); and enter policy and baseline outlay data (discretionary outlays;

mandatory outlays; outlays from new and prior authority)

1.1.1.3 Budget

Formulation to Execution

Report change in obligated balances

OMB Process for Combined Reporting - report new unpaid obligations and deduct gross outlays;

incorporate adjustments to unpaid obligations;

and incorporate adjustments to uncollected customer payments.

1.1.1.4 Budget

Formulation to Execution

Report net budget authority and outlays

Report mandatory and discretionary gross budget authority and outlays; report cash collections of offsetting collections; report changes in uncollected customer payments; report offsetting collections credited to expired accounts; report recoveries of…