ITSS_ServiceDeliverySupport_Statement of Work.pdf

NOTICE ID: 70RSAT26RFI000006

DHS S&T OCIO Service Delivery Attachment 1 Statement of Work

**PROCUREMENT SENSITIVE**

Contents

1.0 GENERAL

1.1 BACKGROUND

1.2 SCOPE

2.0 SPECIFIC REQUIREMENTS

2.1 Function Area 1: OCIO’s Business Management Office (including Project Management Office (PMO) - (Time and Materials)

2.2 Function Area 2: Solutions Delivery (SD) - (Time and Materials)

3.0 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

3.2 Continuity of Support

3.3 Key Personnel

3.5 Employee Conduct

3.6 Removing Employees for Misconduct or Security Reasons

4.0 OTHER APPLICABLE CONDITIONS

4.1 Security

4.2 Access to DHS Facilities and Resources

4.3 Classified Information

4.5 Encryption

4.6 Critical IT System Duties and Responsibilities

4.7 Public Health Security and Bioterrorism Preparedness Response Act Requirements

4.8 Accessibility Requirements (Section 508) .......................................................... Error! Bookmark not defined.

4.9 System Design Compliance Requirements. ........................................................ Error! Bookmark not defined.

4.10 Term of the Contract

4.11 Place of Performance

4.12 Telework and Remote Work

4.13 Hours of Operation

4.14 Travel

4.15 Government-Furnished Property

4.16 Government-Furnished Information

4.17 Invoicing

4.18 Period of Performance

5.0 DELIVERABLES

U.S. Department of Homeland Security (DHS)

Science & Technology Directorate (S&T) Office of Chief Information Officer (OCIO)

Services Delivery Support (SDS)

Statement of Work (SOW)

1.0 GENERAL

The U.S. Department of Homeland Security Science & Technology(S&T) Directorate Office of Chief Information Officer (OCIO) focuses on providing the tools, technologies, and knowledge products for the nation’s Homeland Security Enterprise. S&T strives to enable effective, efficient, and secure operations across all homeland security missions by applying scientific, engineering, analytics, and innovative approaches to deliver timely solutions in support of DHS's mission.

The S&T OCIO supports S&T by providing the right people, technology, property, security, and processes.

S&T includes approximately 2,000 staff in Washington, D.C. and laboratories in New York, New Jersey, Maryland, Alabama and Florida. DHS S&T employs approximately 35 distinct Information Technology (IT) Systems with currently 2,500 endpoints and projects. By the end of this period of performance these numbers are anticipated to grow to 40 systems with approximately 4,000+ endpoints. These systems include multiple General Support Systems (or networks), three distinct Cloud-based deployments, a presence within two Federally Funded Research and Development Corporations and a number of standalone and experimental systems supporting Laboratory Operations.

DHS S&T OCIO requires professional technical support services to assist the organizations, missions, functions, and objectives enabling DHS S&T to integrate innovative technology into everyday use by the DHS operational components. DHS S&T requires IT support services for the Business Management and Project Management Office, including Governance, Enterprise Architecture, and Solutions Delivery utilizing modern and emerging technologies. This support is essential to maintain, enhance, and evolve the organization’s business processes, program and project management functions, and technology solutions. The Contractor shall provide expertise and services necessary to enable efficient operations, effective governance, and the successful delivery of innovative IT solutions.

1.1 BACKGROUND

DHS S&T OCIO consists of three (3) branches:

• Service Delivery

• Business Management Office / Project Management Office (BMO/PMO)

• Solutions Delivery (SD)

• Infrastructure and Technical Services

• Systems Engineering

• IT Operations and Maintenance (O&M)

• Information Assurance (IA), which includes:

• Information Systems Security Office (ISSO)

• Compliance

The scope of work is limited to the Service Delivery branch of S&T OCIO.

1.2 SCOPE

The scope of work includes work in the Service Delivery Function Areas including Business Management and Project Management Office (BMO/PMO) and Solutions Delivery (SD) as described below. Support for both Functional Areas may be for the S&T OCIO’s directly or may be provided in conjunction with S&T OCIO’s to S&T programs or laboratories. The areas of support for each are noted in the relevant section below.

2.0 SPECIFIC REQUIREMENTS

The Service Delivery requirements and tasks for this acquisition are provided in terms two (2) of the Service Delivery Function Areas:

1. Business Management and Project Management Office (BMO/PMO)

2. Solutions Delivery (SD)

2.1 Function Area 1: OCIO’s Business Management Office (including Project Management

Office (PMO) - (Time and Materials)

The Business Management Office (BMO) for the OCIO ensures the value of IT is communicated and realized across S&T. The BMO provides for efficient, effective, and timely delivery of IT solutions. The BMO supports achievement of the S&T mission by identifying, developing, implementing, and evaluating customer centric, efficient, and effective IT business practices throughout the S&T Directorate. The BMO oversees and directs the organization’s IT Governance and Regulatory Compliance services, as well as operating as the organizational change agent. This includes development and maintenance of policies and procedures, conducting regulatory compliance reviews, building acceptance strategies and sustainability plans, developing and deploying formalized architecture standards, and developing and monitoring outcome measures to improve IT business operations. As a subset of BMO services, the Contractor shall support the establishment of a Project Management Office (PMO), which may require designing PMO governance structures, defining roles and responsibilities, implementing portfolio, program, and project management methodologies and tools, developing reporting, communication and change management frameworks, and providing ongoing oversight and support to ensure effective project delivery and alignment with organizational objective

The Contractor shall provide support to the BMO for the OCIO. The Contractor shall ensure that support provided under this contract is provided in the most efficient and effective manner possible to include providing support and collaboration across Function Areas. This task includes the provision of project, logistical, and administrative support.

It is anticipated that all work under this Function Area will occur at S&T facilities in the National Capital Region (NCR). Additional details are specified in the Pricing Schedule. Travel to other S&T locations may be required.

Additional information on performance locations can be found in section 4.11 SOW.

This Function Area shall be awarded as a time and materials contract line-item number (CLIN). The Contractor shall meet the performance objectives listed below in the completion of the tasks detailed below.

The performance objectives listed below are associated with the BMO Function Area.

Performance Objective 1: The Contractor shall provide project, logistical, and administrative support to the BMO for the OCIO to provide for efficient, effective, and secure operations and timely delivery of solutions throughout S&T. The Contractor shall identify, develop, implement, and evaluate efficient and effective IT-specific business practices to be implemented with the OCIO Office and as they may affect other components across the Directorate.

Performance Objective 2: The Contractor shall ensure the efficient and effective management of projects of all sizes through intake, initiation, planning, monitoring (to include project management cost management and project related risk management), execution, and closeout while managing the constraints of cost, time, resources, scope and quality.

Performance Objective 3: The Contractor shall advise and support senior OCIO leadership/S&T executives on the development and maintenance of a formal organizational IT strategy, an enterprise architecture, portfolio management, regulatory and compliance processes, as well as regularly and recurrently supporting the analysis, evaluation, assessment, and preparation of recommendations for system improvements, optimization, development, and/or maintenance efforts.

Performance Objective 4: The Contractor will support IT Governance including IT governance framework, IT portfolio management, IT investment management, and IT organizational change management. This objective shall include defining and supporting the role of the OCIO’s Office as an organizational change agent that conducts regulatory compliance reviews, builds acceptance strategies, sustainability plans, and develops and deploys outcome measures to improve the business outcomes for the OCIO’s Office program performance which includes, but is not limited to, defined key performance indicators (KPIs), scorecard outcomes and measurement, external and internal audits and assessments, external and internal program controls and monitoring activities, and activities deemed central to the management of a OCIO.

Performance Object 5: The Contractor shall utilize and, where appropriate, integrate the following tools, platforms, and systems to provide project, logistical, and administrative support for the OCIO’s Office:

• Project Management Tools: The Contractor shall use [MS Project, Jira, or equivalent DHS-approved project management platforms] to plan, track, and report on project activities, milestones, and deliverables. All project schedules, status reports, and dashboards shall be maintained within these platforms.

• Collaboration and Communication Tools: The Contractor shall support collaboration using [Microsoft Teams, SharePoint, or other DHS-approved platforms] for document sharing, meeting coordination, and team communications.

• Service Management Systems: The Contractor shall utilize [ServiceNow or equivalent DHS-approved IT service management systems] for tracking service requests, incidents, and change management activities.

• Document and Records Management: All project documentation, records, and administrative materials shall be stored and managed in [SharePoint or other DHS-approved document management systems] in accordance with DHS records management policies.

• Reporting Tools: The Contractor shall prepare and submit all required reports using [Power BI, Tableau, or other DHS-approved reporting tools], ensuring data accuracy and timely delivery to the Contracting Officer’s Representative (COR) and OCIO.

The Contractor shall ensure that all tools and platforms used are compliant with DHS IT security standards, found at https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocio/ciso/CISO%20ALL%20Documents/DHS %20FY25%20Information%20Security%20Performance%20Plan%20(ISPP)%20v9.2%202-Final-26Sep24- 1.pdf#search=DHS%20IT%20security%20standards, and policies including but not limited to the DHS Policy Directive 4300A, the DHS Information Security Performance Plan (ISSP), the Federal Information Processing Standard Publication 199: Standards for Security Categorization of Federal Information and Information Systems, and other related DHS Policy Directives governing IT standards and systems.. The Contractor shall provide training and support to government staff as needed to facilitate effective use of these systems.

https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocio/ciso/CISO%20ALL%20Documents/DHS%20FY25%20Information%20Security%20Performance%20Plan%20(ISPP)%20v9.2%202-Final-26Sep24-1.pdf#search=DHS%20IT%20security%20standards https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocio/ciso/CISO%20ALL%20Documents/DHS%20FY25%20Information%20Security%20Performance%20Plan%20(ISPP)%20v9.2%202-Final-26Sep24-1.pdf#search=DHS%20IT%20security%20standards https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocio/ciso/CISO%20ALL%20Documents/DHS%20FY25%20Information%20Security%20Performance%20Plan%20(ISPP)%20v9.2%202-Final-26Sep24-1.pdf#search=DHS%20IT%20security%20standards

Performance Objective 6: The Contractor shall implement a continuous process improvement approach within the Project Management Function Area.

This shall include:

• Process Improvement: The Contractor shall regularly assess and review program and project management processes, methodologies, and tools to identify opportunities for increased efficiency, effectiveness, and alignment with organizational objectives. Recommendations for improvements shall be documented and presented to the COR and OCIO at least quarterly.

• Lessons Learned Documentation: The Contractor shall develop, maintain, and update a lessons learned repository for all major projects and programs managed under this contract. At the conclusion of each project or program phase, the Contractor shall facilitate lessons learned sessions with stakeholders, document key findings, and ensure that actionable recommendations are incorporated into future planning and execution activities.

• Knowledge Sharing: The Contractor shall share process improvement recommendations and lessons learned across all function areas managed by the PMO to promote best practices and organizational learning.

• Reporting: The Contractor shall provide quarterly reports summarizing process improvement activities, lessons learned, and the status of implementation of recommended changes.

All activities shall be conducted in accordance with recognized program and project management frameworks (e.g., Agile, COBIT) and DHS policies and standards.

Task 2.1.1. Program and Project Management. The Program and Project Management Function Area involves managing all other Function Areas as described in this scope of work. This Function Area includes management of projects of all sizes through intake, initiation, planning, monitoring, execution and closing while managing the constraints of cost, time, resources, scope and quality in keeping with recognized forms of IT project management using Agile and IT governance frameworks control objectives for information and related technologies (COBIT).

• Providing expert assistance to IT investments in each phase of the IT lifecycle process from ideation and intake through the operations and maintenance cycle and closeout.

• Supporting IT project planning, budgeting, project monitoring & reporting, risk and issue tracking, cost management, acceptance testing, and security assessments and all activities are conducted within a governance framework (Agile).

o Working directly with federal (S&T) clients, federal staff, and their stakeholders to ensure well defined and documented success criteria of projects.

• Acting as the primary liaison between the government agency (OCIO and S&T Directorate) and vendor contracting team.

• Applying Agile methodology for initiating, monitoring, managing, deploying projects, and maintaining documented project artifacts to support the Agile methodologies.

o Conducting Program Planning, Risk Assessments, and Program Reviews based on documented Key Performance Indicators (KPIs), scorecards, and other Federal and/or DHS mandated reporting tools to provide feedback to the OCIO Leadership, identify issues/risks within the OCIO program areas, and develop strategies to mitigate risks.

• Produce and publish professional-grade content and graphics: timelines, charts, and icons that illustrate the status of strategic plans, goals, annual strategic timelines, ongoing activities, progress reports, and milestones. All plans and graphics must be updated and reviewed quarterly, and all changes and modifications presented formally to the COR and OCIO.

• Applying Business Analysis Standards: All business analysis activities shall be conducted in accordance with recognized standards such as the Business Analysis Body of Knowledge (BABOK), and in alignment with DHS policies and procedures.

• Facilitating requirements gathering sessions with stakeholders, document functional and technical requirements, and ensure requirements are clear, complete, and traceable. Requirements shall be documented using DHS-approved templates and maintained in a centralized repository.

• Developing tracking mechanisms for S&T hardware and software licenses, which is to include a centralized software licensing inventory or repository, conducting activities mandated by the MEGABYTE (Making Electronic Government Accountable By Yielding Tangible Efficiencies) Act of 2016, and deployment and maintenance of an IT service catalog. Collectively, these activities include, but are not limited to, the creation/deployment of a repository, effective cost/financial monitoring activities, required cycles of inventory management, management of the S&T Technology Reference Model (TRM)and related business processes which may include creation, updates, and maintenance of said business process and policy documents in a centralized location.

o Develop framework and deploy solution for process/repository to ensure compliance with

MEGABYTE (software licensing) – develop and deploy inventory for monitoring software licensing and usage and (initial) manual process to maintain inventory.

o Develop framework for centralized software license management process to expand S&T-wide.

• Assessing existing business processes and workflows, identify gaps and inefficiencies, and provide recommendations for optimization. Process mapping and analysis shall be performed using industry-standard tools such as Microsoft Visio, Lucid chart, or DHS approved equivalent tools.

• Assist with drafting and maintaining the OCIO Tactical Communication Plan to provide direction for the consistent and customer-centric sharing of IT information with S&T employees. Primary areas to addressed in the plan will include but should not be limited to 1) Audiences to be addressed, 2) Delegation of responsibility, 3) Message standards, 4) Channels to be used, 5) Frequency of communications, 6) Communications matrix, and 7) Communication standards and guidelines which comply with DHS and S&T Guidelines and Standards.

• Ensuring the conduct of organizational communications, as outlined and scheduled in the OCIO Tactical Communications Plan. This includes tracking scheduled communication tasks to assure that they are appropriately assigned and carried out, as well as reporting communications activities in a monthly report.

Task 2.1.2. Enterprise Architecture (EA) alignment. The Contractor shall advise, support, and orchestrate support for the OCIO’s senior leadership team/S&T executives to develop, deploy, and maintain a formalized enterprise-wide IT strategy, enterprise architecture, IT portfolio and program management, and its alignment with an IT enterprise governance model/framework and the federal Technology Business Management playbook. The Contractor shall regularly and recurrently support analysis, evaluation and assessment, and preparation of recommendations for system improvements, optimization, development, and/or maintenance efforts. The Contractor shall apply DHS or other required federally mandated methodologies, standards, procedures, and best practices. The Contractor shall provide qualified enterprise architecture expertise which includes knowledge that would encompass an EA Analyst, with demonstrated experience in federal EA frameworks and DHS environments.

• Analyze the existing portfolio, present analyses, expand upon concepts of operations, create technology evaluation guidance or conducts initial short-listing, investment patterns, and maturity models based on DHS mandated or other federal government frameworks (FEAF, TOGAF, DoDAF etc.), system patterns and other foundation framework and program management dimensions that must align to the DHS mandates for enterprise architecture and security for all DHS components.

o Analysis should include the As-Is, Intermediate, and To-Be outlines for the enterprise-wide EA framework with time frames, milestones, and deliverables identified at each juncture.

o Analysis needs to incorporate, but is not limited to, EA areas such as: cybersecurity, business architecture, technology architecture, cloud architecture and cloud strategy, data architecture, SecDevOps, ZeroTrust, and other areas as defined in the DHS EA framework which should be foundational to the development, deployment, and maintenance of the S&T EA framework.

o Artifacts should include any and all project related artifacts, cost estimation requirements and budget requirements, Technology Business Management (TBM) related cost towers/pools/ requirements, and any and all architecture, network, or other related documentation or diagrams that would support the creation, development, deployment, and maintenance of an EA framework.

o The EA framework shall be maintained and updated in keeping with the OCIO IT Strategy goals and DHS mandated activities to revisit, change, update, or expand the framework.

o A formal change management process is required to be implemented for all EA framework updates, including documentation of changes and impact analysis.

o All EA activities must incorporate privacy impact assessments and must align with DHS security operations and standards.

o Annual reviews of emerging technologies must be conducted, and recommendations provided for potential adoption within the EA framework.

• Support Enterprise Architecture initiatives to ensure IT governance framework alignment with architecture framework, taxonomy, methodologies, best practices and targets, scorecards, and other documented key performance indicators in keeping with DHS mandated architecture measures and required compliance standards.

o The EA framework should include and address the following areas as well as any areas outlined in the DHS EA framework:

o The Application of the Architecture supports the Acquisition Programs’ life cycle by applying a proven methodology that enables:

Service Delivery: Architecture is the management best practice that provides a consistent view across people, processes, and technology to perform a wide spectrum of missions that meet our Nation’s needs.

Functional Integration: Architecture provides the context for functional integration to enable consistent planning and decision making.

Resource Optimization: Architecture continuously evolves to document an increasingly harmonized view of the organization for successful introduction of new technologies and operating paradigms.

Authoritative Reference: Architecture is the authoritative reference for the design, documentation, and implementation of systems and services, issues of ownership, management, resourcing, and performance goals.

• Ensure IT governance framework, processes, and practices are leveraged to enterprise architecture principles, and that standards are upheld, documented, assessed annually or on a mandated basis in keeping with DHS enterprise architecture requirements and in keeping with TBM requirements for EA.

• Maintain the Standards Management framework using the DHS EA management systems, mandated frameworks, mandated tools, while providing feedback and information as required and outlined by the DHS Chief Architect.

• Maintain the S&T EA alignment with the DHS EA, Office of Management and Budget (OMB)/ Government Accountability Office (GAO) criteria, and other Federal guidelines (as appropriate).

• Communicate S&T’s EA policies and processes to all S&T program offices and the OCIO’s Office on a quarterly basis through a seminar other means approved by the Contracting Officer’s Representative (COR).

• Advise the S&T OCIO on all EA and technology solutions, trends, issues, scorecard and other key performance indicators designed to highlight risks and areas requiring improvement while delivering information concerning the costs and financial requirements to support the EA framework in keeping with TBM methodologies specifically relating to EA.

• Maintain the S&T IT Approved Products list (hardware/software) and Technical Reference Model (TRM) and IT Services and Hardware Catalog.

• The Contractor shall submit a deliverable schedule for all EA artifacts, with quarterly reviews and formal approval by the COR and OCIO.

o Monthly EA performance reports, including KPIs, scorecard outcomes, risk assessments, and recommendations for improvement must be provided.

Task 2.1.3. IT Governance. The Contractor will support IT Governance on a recurring basis including IT portfolio management, investment management, and organizational change management.

The Contractor shall:

• Provide expert IT governance consultant services and documented recommendations providing the creation, deployment, and maintenance of a formal IT governance program grounded in industry best practices such as (but not limited to), COBIT, etc.

• Assess, design, and implement operational and organizational structural changes to existing IT investment board(s), where the objective is to appraise the breadth and scope of S&T’s IT portfolio, prioritize investments in new capabilities to support the S&T mission, provide more active oversight, create and report on performance metrics, locate and reduce duplication in the portfolio, and identify potential for efficiencies and cost savings in business operations.

• Author, publish and maintain an IT Governance SharePoint (or ServiceNow-based) webpage accessible to S&T employees as the primary resource for key stakeholders to use in accessing administrative documentation, plans, action items, schedules, meeting agendas and minutes, action items, membership diagrams and charts, decisions made, progress reports, and similar records.

• Communicate to the S&T workforce on major milestones and progress made within the IT governance program activities.

• Propose and assist in establishing a formal governance operating model for the S&T OCIO which could be leveraged across the Component. Identify a robust set of options for OCIO leadership based on industry-accepted operating models and/or frameworks. Provide a justification for the recommendations outlining the steps for creation and deployment and then maintaining an operating model with clearly defined measurements of success (i.e., KPIs, scorecards, and other defined criteria to measure success) while identifying and documenting risks before they rise to issue status.

• Collect, review, analyze, and report on IT investment budget data to conduct formal CPIC review and analyses. Map S&Ts IT investments to the TBM Taxonomy. Maintain policy, process, and procedures.

Work as a CPIC liaison with S&T staff and facilitate CPIC investment planning, budgeting, expenditure, and reporting activities throughout the year. Provide assessment and recommendation to incorporate DHS CPIC directives and required data points into a formalized business process to ensure IT systems requiring Unique Investment Identifiers UIIs are accurately tracked from inception to sunset as part of the CPIC process.

• Ensure the effective evaluation, selection, prioritization, and funding of competing IT investments and extract (measurable) business benefits to provide to senior leadership on a recurring basis in order to assist in the decision-making process focusing on accurately reporting each data point that is outlined in the DHS CPIC policy to ensure that S&T adheres to CPIC requirements, reporting and scorecards are monitored, and risks are identified and addressed and a risk management plan is in place to monitor IT investments.

• Educate the organization on the day-to-day execution of a strategic vision and execute a marketing / educational campaign to institutionalize the principles and plans being adopted.

• Improve clarity of roles and responsibilities, enhance the S&T OCIO’s Office visibility in the organization and stakeholders, and improve coordination and effectiveness internally within the S&T OCIO’s office, the S&T Directorate, and DHS.

• Expand the scope and role of the governance program to cover the IT lifecycle by implementing a continuous oversight/risk management monitoring program with built in controls to identify and mitigate risk, raise issues to leadership level for mitigation, and provide a defined risk management strategy.

• Facilitate governance meetings and developing meeting materials, supporting governance documentation, power point presentations for upcoming meetings. Draft the board’s charter documents to scope, structure, membership, and meeting details.

• Develop processes, decision trees, standard operating procedures, templates, policy documentation, and other supporting documentation for making formal IT governance decisions. Develop KPIs or other success defining criteria that are replicable and can be applied to program areas across the OCIO to better monitor and mitigate risks to decrease exposure to risk and other factors that negatively impact DHS scorecards which are used to measure program health and success. Serve in an organizational change management role for OCIO stakeholders by providing federal and contract staff frequent coaching on governance program policies, procedures, strategy, committees, and tools.

• Assist the S&T OCIO with the preparation of briefing materials and assist with hosting seminars and “Brown Bag” sessions on critical IT governance-related business matters to an S&T-wide audience.

• As part of the Communications Plan, perform outreach to S&T offices for the purpose of maturing technical governance and ensuring that all necessary parties are leveraging technical governance processes for decision-making.

• Develop and maintain S&T IT governance SharePoint or alternative for documentation.

• Support business units in defining a process, sharing best practices, templates, and training materials for compiling and submitting annual IT budget requests, including Resource Allocation Plan (RAP) and Spend Plans that follow the DHS Planning, Programing, Budgeting, and Execution (PPBE) process.

• Author an IT budget planning business process that is interconnected with the wider OCIO task areas including: program management: enterprise architecture, investment management, and strategic planning

• Perform financial analysis of complex budgeting data and perform cost-modeling.

• Implement an Earned Value Management (EVM) strategy to deliver consistency in how projects will be managed or measured for performance and earned value; and integrating the tenets of risk management and EVM into the scheduling process.

• Act as a liaison between the OCIO Office and business stakeholders.

• Respond to requests from end users, managers, developers, and team members for software provisioning.

• Review and make decision on approval or rejection for all BMO related help desk tickets in ServiceNow or any help desk ticketing software.

• Assist in preparing program activity reports, progress reports, standard operating procedures, documentation of support/service processes, education videos/webinars and/or other special reports for management and outside agencies.

• Support S&T Chief Data Officer (CDO) in the development, implementation, and maintenance of data governance frameworks, policies, and standards in accordance with DHS and federal requirements.

• Supporting the CDO and data governance councils in establishing data stewardship roles, responsibilities, and processes for data quality, metadata management, and data lifecycle management.

• Facilitate governance meetings, preparing meeting materials, and documenting decisions, action items, and progress reports.

• Provide guidance and best practices for data sharing, data privacy, and data protection across the OCIO and other business units.

• Support the integration of data governance principles into IT governance, investment management, and enterprise architecture activities.

• Monitor compliance with data governance policies and reporting on data quality, data usage, and data management metrics to senior leadership.

• Maintain a centralized knowledge repository (e.g., SharePoint or other DHS-approved platforms) for storing policies, procedures, templates, training materials, and other key documentation.

• Develop and implement processes for the regular collection, review, and update of knowledge assets to ensure relevance and accuracy.

• Facilitate knowledge sharing across the OCIO and with other directorate stakeholders through workshops, webinars, and collaborative sessions.

• Create and maintain a lessons learned log for major projects and governance activities, ensuring actionable insights are incorporated into future initiatives.

• Provide training and guidance to federal and Contractor staff on knowledge management practices, tools, and the use of the knowledge repository.

• Ensure all knowledge management activities comply with DHS records management and security policies.

Task 2.1.4. Regulatory Compliance. The Contractor shall manage, maintain and complete requirements for the Federal Information Technology Acquisition Reform Act (FITARA), Section 508, Paperwork Reduction Act (PRA), and Records Management programs. The Contractor shall distribute policy and program direction from DHS Head Quarters (HQ) and the Office of the Accessible Systems and Technology (OAST) office and any successor offices to OAST. The Contractor shall support individuals with disabilities in accordance with Section 508 requirements on their technology (software, hardware) or accommodation needs.

The Contractor shall:

For FITARA:

• Outline FITARA as a program – how FITARA-related items and authorities are to be maintained, ensuring all seven (7) FITARA areas are addressed (for the S&T OCIO and the Directorate as a whole).

o Assess current OCIO business processes, aligning processes to address each line item in the

FITARA scorecard to enhance FITARA program management and identifying areas of weakness or missing processes with a framework and schedule to address each critical area of the FITARA scorecard.

o Risk/Issue register – assess state of OCIO and identify risks/issues (prioritize critical).

o Establish OCIO methodology for responding to FITARA-related data calls/requests (OCIO inclusive).

o Develop and deploy process to centralize the management of software licenses, expanding to rest of S&T beyond OCIO (including project schedule).

o Implement FITARA requirement for a review process to cover IT investment portfolios

(increasing efficiency/effectiveness, identifying potential waste/duplication).

For Section 508:

• Provide appropriate educational activities and resources for Section 508 and to support the 508 / accessibility program area for the S&T OCIO and its role as liaison to the S&T Human Capital Office

(HCO).

• Create/tailor basic presentation and conduct recurring outreach training for the Section 508 program.

• Conduct internal and external website and Application Testing/Remediation, using testing software

(Accessibility Management Platform (AMP), Compliance Sheriff, ACMS, etc.) to assess Section 508 compliance and meet testing requirements as outlined in the DHS Trusted Tester Program. Provide feedback to customers on the Section 508 testing results and remediation options.

• Provide support to the S&T OCIO 508 PM to manage day-to-day requests including but not limited to reviews and assessments for approval for software and hardware requests that are dictated by both Sci- Tech and LAN-A ticketing systems and approval systems.

• Provide support to the S&T 508 PM to conduct quarterly program assessments, identify and mitigate risks and issues, report to DHS HQ and other federal entities on program health and program outreach.

For Paperwork Reduction Act (PRA):

• Improve the integrity, quality, and practical utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security.

• Provide appropriate educational activities and resources for PRA.

• Create and conduct outreach training for the PRA program.

• Foster S&T PRA submissions through the PRA process and coordinate PRA submissions from inception to publication and maintenance for ongoing submissions to ensure timely submission and response to customer inquiries and DHS HQ PRA reporting and program requirements.

• Conduct and support usability testing requirements as outlined by the DHS PRA team in the Burden Reduction Initiative and the DHS CX/UX working groups which the S&T OCIO vigorously supports via initiatives, individual support to programs to drive usability testing for each program office initiating the

PRA, and participation in working groups both within S&T and DHS.

For Records Management:

• Apply National Archives and Records Administration (NARA) and DHS methodologies, standards, procedures, and best practices to support the records management program at S&T.

• Program Development and Governance o Develop, implement, and maintain S&T Records Management Program, including policies, procedures, standards, and guidance in accordance with NARA, DHS, and federal regulations.

o Establish and support a Records Management Governance structure, including a Records

Management Officer, records liaisons in each office, and a cross-functional records management working group.

o Develop and maintain a Records Management Plan that defines roles, responsibilities, program objectives, and a schedule for periodic review and updates.

• Records Inventory and Classification o Conduct a comprehensive inventory of all records across S&T including paper and electronic records and maintain an up-to-date records inventory.

o Classify records according to NARA-approved schedules, DHS directives, and component-specific requirements.

o Develop and maintain file plans for each office, ensuring records are organized, accessible, and properly classified.

• Records Lifecycle Management o Implement systematic processes for the creation, maintenance, use, storage, and disposition of records throughout their lifecycle.

o Ensure records retention and disposition schedules are followed, including timely transfer to NARA or approved destruction in accordance with federal guidelines.

o Support the transition to electronic records management (ERM), including digitization of paper records and adoption of electronic recordkeeping systems.

• Compliance and Audit Support o Monitor and ensure ongoing compliance with NARA, DHS, and federal records management mandates.

o Prepare for and support internal and external records management audits, including maintaining audit-ready documentation and responding to audit findings.

o Track and report records management compliance metrics, risks, and issues to component leadership.

• Training and Outreach o Develop and deliver recurring records management training for all federal and Contractor staff, tailored to roles and responsibilities.

o Provide targeted training for records liaisons and managers on specialized topics (e.g., electronic records, sensitive information handling).

o Conduct outreach campaigns to raise awareness of records management policies, procedures, and best practices.

• Records Management Technology and Tools o Evaluate, recommend, and support the implementation of records management systems and tools, ensuring integration with existing component IT infrastructure.

o Maintain centralized, secure repositories for records inventories, file plans, retention schedules, and disposition documentation.

o Ensure all records management solutions meet DHS security, privacy, and accessibility requirements.

• Records Requests and Litigation Support o Support the processing of records requests, including FOIA, Privacy Act, and discovery/litigation holds, in coordination with legal and privacy offices.

o Ensure records are identified, preserved, and produced in accordance with applicable laws and directives.

• Continuous Improvement o Establish a process for regular review and improvement of records management policies, procedures, and technologies.

o Capture lessons learned and best practices, and incorporate feedback from audits, staff, and leadership into program enhancements.

• Reporting and Communication o Provide regular reports to component leadership on records management program status, compliance, risks, and improvement initiatives.

o Maintain open lines of communication with NARA, DHS HQ Records Management, and other relevant stakeholders.

• Deliverables:

o Component-wide Records Management Plan o Component-wide training plan o Records inventory and file plans for all offices o Training materials and completion reports o Records management compliance reports and metrics o Audit support documentation o Recommendations for technology solutions and process improvements

• OCIO Front Office and Administrative o Communicating with representatives across DHS and other federal agencies to ask questions, obtain information, and to determine actions needed to fulfill administrative duties. Report findings and information to federal and contract support personnel.

o Managing, assigning, and responding to DHS data calls; managing OCIO user accounts, the Global Address List, OCIO distribution lists, and call trees. Call trees shall be updated monthly or more frequently as staff changes occur.

o Routing documents for signature, liaise with DHS and S&T leadership support staff, and otherwise ensure the full functionality of the OCIO office. The Contractor shall not perform any inherently governmental functions pursuant to FAR 7.503.

• Performance Metrics and Continuous Improvement o Develop and maintain performance metrics, dashboards, and compliance scorecards for all regulatory programs (FITARA, Section 508, PRA, Records Management) and report progress to the OCIO and DHS HQ on a quarterly basis.

o Implement a continuous improvement process, including lessons learned and stakeholder feedback, to enhance compliance program effectiveness.

• Training and Awareness o Develop and deliver annual mandatory training for all staff on FITARA, Section 508, PRA, and

Records Management requirements. Training materials shall be updated regularly and tracked for completion.

Task 2.1.5 IT Project Delivery. The Contractor shall provide IT project delivery capabilities in the following areas: 1) cloud development and maintenance, 2) technology upgrades and improvements, 3) SharePoint Online and Power Platform subject matter expertise including troubleshooting, development, and migration solutions, 4) business data analysis and requirements gathering, 5) IT program management, 6) solutions architect, and 7) communication and outreach.

• The Contractor shall comply with all DHS standards and regulations including, but not limited to, those for development, performance, testing, project management, operations support, security, architecture, and 508 Accessibility.

The scope of the services required includes:

• Program and project management

• Cost estimation services

• Project-level financial reporting:

o To align to the vendor contract obligations and invoices to underlying defined projects.

o In accordance with DHS PPBE (Planning, Programming, Budgeting, and Execution) process and policy, whereby vendor shall research and report and ensure compliance with existing rules for a project based on the project’s dollar limits, scope of work, etc.

• Active engagement and facilitation of key project stakeholders

• Business Analysis and Requirements Management

• Knowledge management, communications, and graphics support

• Architecture support and alignment of proposed project architecture solutions to the S&T EA Framework

• Application design and development

• Integration with other databases and applications

• Analytics and reporting

• Testing

• Change Control and Release management

• Level II and III support

• User guides and system documentation

• Agile and Waterfall Software Development Processes

• Support for new and evolving technologies

• Conduct intake interviews with users to gather necessary requirements/administrative information.

• Participate in IT project planning and schedule development/maintenance activities

• Facilitate governance meetings and partner with customers and stakeholders to help facilitate the movement of their projects through the pipeline to completion.

• Specify required deliverables and acceptance process

• Provide weekly status reporting and KPIs/SLAs

• Provide Risk and Issue tracking and escalation

• Address resource allocation and surge support, if needed

• Require usability and accessibility testing and report status

Task 2.1.6 IT Financial and Budgetary Assistance. The Contractor shall assist OCIO staff in the performance of their responsibilities in managing its financial procedures and conducting day-to-day programming, budgeting and execution activities, as well as strategic planning, where such support does not constitute inherently governmental functions nor the administration or supervision of any government procurement activities. Such assistance will include working with the OCIO Management/Program Analyst on:

• Establishing and following a recurring annual cadence for the development of mandated Resource Allocation Planning (RAP) and Budgetary/Spend Plan documentation for submission to higher-level agency components.

• Delivery and enhancement of periodically recurring Budget Execution Reports.

• Preparation and presentation of cost allocation calculations for the purpose of distributing OCIO expenditures across multiple peer S&T components.

• Following the cost allocation analysis (above), preparation and management of Customer Coordination

Forms (CCFs) to serve as documented agreement from component representatives of their acceptance for payment.

• Periodic development of fiscal year spending projections for OCIO budget and what-if analyses.

• Provide cost/benefit studies, financial analysis, analysis of alternatives, return on investment, cost estimation, present value, and other analyses in support of capital planning and investment control (CPIC).

• Provide directed advisory and coaching support to OCIO staff and key stakeholders on CPIC and TBM processes and programmatic issues.

• Ongoing implementation of a TBM program, including the conduct of TBM compliance assessments and development of actionable recommendations for continued TBM maturity and alignment of IT investments to TBM costs to focus value between IT investments, EA framework, and financial controls (data from DHS financial systems).

• Support TBM and CPIC reporting including maintaining and enhancing the existing database to facilitate reporting and provide professional technical support services to assist OCIO in developing, loading, and maintaining in INVEST and One Number.

• Collecting detailed IT investments and resources from each S&T network to ensure that the S&T EA System and Federal Information Security Management Act (FISMA) Systems are accurately reflected in the current IT investments portfolio and are accurately aligned with S&T’s mission goals and objectives.

All criteria outlined in the DHS CPIC Policy and Guidance are collected for required data elements and data points. Success criteria is measured according to the DHS OCIO scorecards and assessments provided during program health assessments, feedback from the DHS CPIC group.

• Consulting with DHS HQ and other federal agencies on procedures, regulations, attendance at meetings, and in general, performance of task functions without instruction and maintain all S&T IT investments and their respective portfolios in keeping with processes and procedures as outlined in the DHS CPIC Policy and Guidance and all required data points and data elements are collected and documented within the respective systems used to track IT Investments.

• Developing, implementing, maintaining and providing status on implementation of operational and strategic recommendations as well as mechanisms to measure and report on the S&T IT Investment portfolio and data points that are required for outputs such as the IT budget exhibits, OCIO scorecards, and CPIC data points that are required for the investment reporting periods.

• Other financial and budgetary related activities may be assigned from time-to-time.

2.2 Function Area 2: Solutions Delivery (SD) - (Time and Materials)

The S&T OCIO is seeking advanced capabilities in end-to-end application development utilizing SharePoint Online and the full suite of Microsoft Power Platform tools, including Power Apps, Power Automate, Power BI (Business Intelligence), Dataverse, MS Teams, and ServiceNow. The ideal provider will have proven experience in designing, developing, deploying, and maintaining secure, scalable, and user-friendly applications.

Required expertise includes:

• Building both canvas and model-driven Power Apps.

• Developing automated workflows using Power Automate.

• Creating dashboards and analytic tools with Power BI to deliver actionable insights for decision-making.

• Structuring, validating, and governing relational data models in Dataverse.

• Integrating Power Platform applications in accordance with DHS IT and data security standards.

Respondents should demonstrate a high level of proficiency in these areas and provide examples of successful implementations.

It is anticipated that all work under this Function Area will occur at S&T facilities in the NCR. This Function

Area shall be awarded as a time and materials CLIN.

Task 2.5.1. Technical Expertise in SharePoint Online and Microsoft Power Platform.

• The Contractor shall have the knowledge and expertise to support S&T SharePoint Online environment.

• The Contractor shall be able to perform activities such as SharePoint design, data and application integration, web parts, data workflow, forms, web content management, data and share libraries, system integration and data connection, data ingestion and analysis, data tracking, and technical services.

• The Contractor shall have knowledge and expertise in designing, developing, deploying, and maintaining applications within the Microsoft Power Platform (Power Apps, Power Automate, Power BI, and Dataverse).

• Managing enterprise…