Attachment IV - Template for Task Order I 3.4.22 - Tracked Changes.pdf

ATTACHMENT IV

TEMPLATE for SAMPLE TASK ORDER I

Task Order I: Solution Provision and Initial Support Services

Problem Statement: Provide to DHS a solution with licenses (application, software, hardware, credential, derived, identity, etc.), and maintenance for the Identity Enrollment System (IES) and

Credential Issuance and Management System (CMS) to support hardware and peripherals supporting

IES/CMS services at 540 DHS Credential Facilities with Enrollment and Issuance Workstations

(EIWS) and 1000 Credential Light Activation Stations deployed domestically and overseas and supports 400,000 employees, contractors and foreign service nationals, using professional services to assist the Government to document and integrate with two DHS Identity, Credential, and Access

Management (ICAM) investments, the 1) DHS Integrated Security Management System (ISMS) and

2) DHS Enterprise Identity Management System (eIDMS).”

I. Task Order Title [Propose a short title and/or general description of your understanding of items to be acquired.]

II. Introduction [Provide a short description of the requirements to be acquired.]

III. Background [From the Request for Proposal, provide your understanding of the Department specific background, how the requirement evolved; relationship to other projects; why work is needed, the outcomes of any research conducted to determine the viability and cost of different options for an IES and CMS solution. Summarize information which is essential for your understanding of the work and ensure technical information is understandable to potential readers of different disciplines.]

IV. Objectives [Provide a concise overview of your understanding of the Department goals and expectations as a result of this task order. It does not need to include a description of deliverables or requirements since these will be included in the “Specific Requirements” section below. Include the desired end result and your understanding of the expectations or goals.]

V. Scope [Describe general scope of the work to be acquired. Include a brief description of: size of the anticipated effort; summary of actions to be perform; results expected; and/or special areas of interest.]

VI. Requirements [Provide a performance-based narrative of the specific tasks, services and/or deliverables that will make up the SOW. Number the tasks sequentially, e.g. Task 1 and narrative, Task 2 and narrative, etc.]

For example:

Task 1 - Program and Project Management Support

Task 2 - Core Solution Deployment Requirements

Task 3 - Enrollment, Issuance and Self-Service Workstations Requirements

Task 4 - Training and User Support Requirements

VII. CONSTRAINTS

[In any and known, use this section to list laws, rules, regulations, standards, technology limitations and other constraints that the service and/or contractor must adhere to or work under.]

VIII. PERIOD OF PERFORMANCE

[Indicate your understanding that the period of performance for this task order shall be one (1) year from Date of Award.]

IX. SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this task order that, by definition, are deemed

ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendix A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this task order have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and

Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible

Systems and Technology Program, dated November 20, 2018, or any successor publication.

X. Section 508 Requirements for Technology Services When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

1. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

2. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content

(i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including

WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web

Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester

3. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this task order.

https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/trusted-tester

XI. Section 508 Deliverables Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

1. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

2. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an

Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product

Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

3. Other Section 508 Documentation: The following documentation shall be provided upon request for ICT items offered through this contract:

o Documentation of features provided to help achieve accessibility and usability for people with disabilities.

o Documentation on how to configure and install the ICT Item to support accessibility.

o Documentation of core functions that cannot be accessed by persons with disabilities.

o Documentation of remediation plans to address non-conformance to the Section

508 standards

XII. DHS ENTERPRISE ARCHITECTURE COMPLIANCE

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures.

Specifically, the contractor shall comply with the following Homeland Security (HLS) EA requirements:

• All developed solutions and requirements shall be compliant with the HLS EA principles.

• All IT hardware and software shall be compliant with the HLS EA Technical Reference Model

(TRM) Standards and Products Profile; all products are subject to DHS Enterprise

Architectural approval. No products may be utilized in any production environment that is not included in the HLS EA TRM Standards and Products Profile.

• Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise

Architecture Information Repository.

• Development of data assets, information exchanges and data standards will comply with the

DHS Data Management Policy MD 103-01 and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

https://www.itic.org/policy/accessibility/vpat

• Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government

Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special

Publication 500-267) and the corresponding declarations of conformance defined in the

USGv6 Test Program.

XIII. Government Furnished Resources The Government will provide the workspace, equipment, hosting environment and supplies necessary to perform the onsite portion of Contractor services required in this contract, unless specifically stated otherwise in this task order. The Contractor shall use Government furnished facilities, property, equipment and supplies only for the performance of work under this contract and shall be responsible for returning all Government furnished facilities, property, and equipment in good working condition, subject to normal wear and tear.

The Contractor shall use Government furnished information, data and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release

Government furnished information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

XIV. Milestones and Deliverables

[From the Request for Proposal, provide your understanding of the Department’s schedule of milestones that will be used to monitor timely progress on the task order. Indicate number of days in calendar days unless otherwise noted. Include performance measures shall include routine elements such as specific project deliverables and all objectives and desired outcomes.]

For example:

ITEM DELIVERABLE/EVENT DUE BY DISTRIBUTION

1 Project Status Updates - meetings via teleconference or face-to-face or status updates via email.

Close of business each week

COR/System

Owner

2 Monthly Status Report - Including functional activity progress and cost and performance status

15th of each month

COR/System

Owner

System: Build-Design-Deploy -O&M Material

3 Bill of Materials – for all necessary software, hardware, license, consumables and GFE / GFS dependences;

preliminary design approval constitutes the ability to purchase the BOM.

10 days post award

COR/System

Owner/Tech-POC

4 CONOPS - which includes the approach for integrating the solution with DHS systems, processes and data, as well IOC, FOC and future enhancements

30 days post award

5 System Design Document (both preliminary and critical design documents) – including system, sub-system, software, ports, protocols, network, dependencies, virtual, database, application, use cases, data flow, hardware, cloud and security design

Preliminary design at 30 days post award

Critical Design

90 days post award

6 System Test Plan and Results – with test cases in accordance with the RTM

45 days post

7 Systems Management Plan – to include the schedule, process, and roles for the installation, testing, configuration, pilot, production and Operations and

Maintenance sustainment of the System

45 days post

8 System Security Plan and necessary artifacts to achieve

ATO for a HHH system in accordance with DHS 4300a

120 days post

9 Installation and Configuration guides sufficient to re-constitute the solution from bare metal to current operational state

10 Interface Control document for each interface sufficient to re-create the connection

Training and User Support Material

11 Train-the-Trainer Curriculum 60 days post

12 Train-the-Trainer Sessions Three (3) sessions must be conducted

NLT 90 days after Task

Order Award

13 Certification Curriculum 120 days post

14 Operations and Maintenance manuals – sufficient to operate and maintain the solution.

15 Training and user guides – deliver user, administrative, development, and security training and guides sufficient for the government or contractor to install, configure, maintain, update, and manage the solution.

Solution and Services

15 1st EIWS Delivered 180 days or less of award

1st PIV Card Issued 180 days or less

Production IOC Deployment 270 days or less

16 Operations & Maintenance Services Date of Award