Draft Attachment 1 - Performance Work Statement .pdf

DRAFT

Attachment 1 – Performance Work Statement

DEPARTMENT OF HOMELAND SECURITY (DHS)

PERFORMANCE WORK STATEMENT (PWS)

FOR

PROCUREMENT RECORDS MANAGEMENT MODERNIZATION (PRM2)

1.0 GENERAL

1.1 BACKGROUND

The U.S. Department of Homeland Security (DHS) is seeking an innovative solution to its electronic contract filing through the Procurement Records Management Modernization (PRM2) initiative. The current Electronic Contract Filing System (ECFS) was fully implemented at the Department of Homeland Security (DHS) in April 2020.

ECFS is a cloud based Federal Risk Authorization Management Program (FedRAMP) authorized Software as a Service (SaaS) solution used by all DHS procurement offices to support electronic contract file storage, workflow, document management, and records management.

ECFS functions as a contract storage system throughout the lifecycle of a contract and is the authoritative source of all contract files awarded after its go-live. ECFS supports the electronic management of contract files eliminating the need for paper files. ECFS is a Commercial-Off-The-Shelf (COTS) solution using eCASE Audit & Investigations Case Management Suite (currently eCASE version 11.2) from OPEXUS hosted by OPEXUS in their private cloud which holds a FedRAMP agency authorization by DHS and many other federal agencies. ECFS was selected and implemented to meet the requirements included in the Requirements Identification Matrix, see Appendix A. OPEXUS also provides services to DHS in support of ECFS. These services include Project Management, System Enhancements & Configuration Updates, Operations & Maintenance, IT Security, Help Desk, Training, and Transition Out.

ECFS is used by approximately 1800 contracting, policy, legal, and oversight personnel across the various DHS Components. The government anticipates the number of users to grow over time as adoption improves and functionalities are onboarded to the system. At a later date, the government may expand the system to store Contracting Officer Representative (COR) files. There are approximately 3,100 CORs assigned to contracts that would potentially need access.

The DHS Components use a variety of Contract Writing Systems (CWS) to obligate funds and generate their award documents. Some Components have their CWS metadata interfaced to ECFS through the DHS acquisition data warehouse, Enterprise Reporting Application (ERA). For more information on ERA, see Appendix B. These Components are referred to as “Integrated Components”. This automatically creates a virtual contract folder for the Contracting Officer (CO) or Contracting Specialist (CS) to which they can manually upload the award document and other contract artifacts. For

Integrated components, contract filling in ECFS begins in the pre-award phase with the requisition data flowing into ECFS creating the contract folder. Then when/if a solicitation is released tied to that requisition in the CWS, that data flows into ECFS updating the ECFS contract folder. Then when the award is made in the CWS additional award details flow into ECFS. The same ECFS folder is used throughout the contract’s lifecycle all the way to closeout and disposition. The ECFS search feature allows users to find the contract by any of the associated identifiers, i.e. requisition number, solicitation number, contract number, task order number, etc.

Other Components, Non-Integrated Components, are required to manually create their contract folders in ECFS. When the CO/CS is ready to file documents, they create the contract in ECFS and enter in the required metadata before they can begin filing.

DHS is also undergoing Federal Financial System Modernization and in doing so, some Components will change their CWS in the next few years. After “modernization”, OCPO will interface all CWS data into ERA so that every Component can be integrated in the future. The table below lists each Component using ECFS, the number of users, the current CWS, whether their data is integrated to ECFS, and their future CWS. DHS intends to have all Components to be Integrated

Component Current # of Acquisition Users

Current CWS Currently Integrated Future CWS

CBP 151 SAP No Will remain on SAP FEMA 255 PRISM Yes SAP FLETC 29 PRISM Yes TBD ICE 117 PRISM Yes SAP OPO 298 PRISM No SAP TSA 111 Oracle CLM No Will remain on Oracle CLM USCG 640 Oracle CLM No Will remain on Oracle CLM USCIS 103 PRISM Yes SAP USSS 55 Oracle CLM No Will remain on Oracle CLM

Contract artifacts are organized in the ECFS contract folder based on the DHS approved checklists according to the contract type. Refer to Appendix C for the DHS Combined Checklist which is the most often utilized checklist in ECFS. Once contract artifacts are uploaded into ECFS, the CO/CS can continue to edit the documents, route them for review/approval, sign, redact information, or finalize them. Reviewers can provide feedback and sign documents. All edited documents contain version tracking information and allow for previous versions to be viewed or reinstated. The contract is updated, as needed, throughout the contract lifecycle. When the contract is closed, and all documentation has been filed in ECFS the contract is locked for editing. Contracts are maintained and archived according to National Archives and Records Administration (NARA) & Federal Acquisition Regulation (FAR) requirements and dispositioned accordingly. Reports exist in ECFS to allow for management oversight to ensure all contracts are created in ECFS.

ECFS currently contains 98k contracts containing 2.9M artifacts utilizing of a total of 4T of data storage. However, this represents a subset of our potential capacity and does not reflect 100% compliance or full utilization, as some data and artifacts may remain unaccounted for or underutilized with the system. Current metrics show ECFS contains 98% of the expected contracts are filed but we are unable to determine the completeness of the files.

The following chart illustrates the approximate number of new awards created each year by Component.

Component # of new contracts and IAAs per year

CBP 1,982

FEMA 3,688

FLETC 833

ICE 955

OPO 1,296

TSA 504

USCG 10,071

USCIS 364

USSS 670

Total 20,363

1.2 OBJECTIVE

DHS intends to modernize its electronic contract filing through the Procurement Records Management (PRM2) initiative. PRM2 will replace ECFS with a solution that will enhance user experience, improve security compliance, and streamline contract management across its various components.

The PRM2 initiative aims to:

• Provide a secure, compliant solution for contract file storage, workflow automation, document management, and records management.

• Enhance contract management efficiency and improve user experience with a modern, intuitive interface.

• Ensure seamless integration with existing DHS tools, including Microsoft Office and DHS Contract Writing Systems (CWS) data.

• Ensure system scalability to support future growth in user numbers and data volumes.

1.3 SCOPE

DHS requires a COTS cloud-based SaaS solution to support virtual contract file storage, workflow, document management, and records management that meets and exceeds the existing ECFS requirements included in the appendix. Included in the appendix are user stories that are intended to provide a clear and concise representation of the desired user experience for PRM2.

The following capabilities are considered the Minimum Viable Product (MVP) for PRM2.

The majority of these capabilities are expected to be core functions of the solution, provided as standard features and requiring only minimum customization.

1. Regulatory and Policy Compliant Contract File Storage – A centralized web-based solution compliant with FISMA, FedRAMP Moderate, DHS 4300A, NARA Universal Electronic Records Management Requirements (ERM), Federal Acquisition Regulation (FAR), and Section 508 requirements. The solution must support DHS approved contract file checklists, ensuring contract files are structured and stored according to established regulations and policies. This capability should be included as part of the out-of-the-box solution and require little to no customization at go-live.

2. Automated Contract File Generation – Automatically generate contract folders and metadata for Integrated Components using ERA as the data source, reducing manual entry, and increasing efficiency. This capability is required for go-live.

3. User Experience Focused Interface – A clean, intuitive interface designed based on user research and feedback. The system should guide users through the document filing process, providing contextual help and smart recommendations for what documents to upload and where to upload them, reducing the cognitive load. This capability should be included as part of the out-of-the-box solution and require little to no customization at go-live.

4. Seamless Integration with Everyday Tools – Enable users to file contract documents directly from their most frequently used tools, such as email (Outlook) and Microsoft Office products (Word, Excel, PowerPoint). This capability should be included as part of the out-of-the-box solution and require little to no customization at go-live

5. Flexible Document Upload Options – Provide users with multiple, intuitive options to upload documents, including drag-and-drop and browse features. Ensure support for batch uploads and compatibility with all file types typically associated with contract files. This capability should be included as part of the out-of-the-box solution and require little to no customization at go-live.

6. Collaborative Document Editing with Version Control – Offer intuitive and seamless document editing capabilities within the system, supporting Microsoft Office and Adobe PDF files. Ensure version control is automatically maintained, with clear visibility of the document history. This capability should be included as part of the out-of-the-box solution and require little to no customization at go live.

7. Real-Time Compliance and Performance Dashboard – Equip users and management with a customizable dashboard that offers real-time visibility into contract compliance, highlighting the accuracy and timeliness of contract filing against FAR & Homeland Security Acquisition Manual (HSAM) requirements. The dashboard should include alerts and notifications for overdue actions (workflow tasks) or potential compliance risks. This capability is required 1 month after go-live.

8. Dynamic Contract and Document Routing – Facilitate the routing of contracts and individual documents to specified users or groups for review, approval, or feedback. Incorporate features that allow for collaborative comments, tracked changes, and audit logging of all reviewer inputs. This capability should be included as part of the out-of-the-box solution and require no customization at go live.

9. Secure Contract Extract and Sharing – Ensure users can securely extract and share contracts and associated documents via email or download while preserving the original file structure, upload timestamps, and last edit timestamps. This capability is required 2 months after go-live.

MVP Capabilities Included with Solution

Customization Expected

Delivery Timeline

Regulatory and Policy Compliant Contract File Storage

Y N At Go-live

Automated Contract File Generation N Y At Go-live User Experience Focused Interface Y N At Go-live Seamless Integration with Everyday Tools

Y N At Go-live

Flexible Document Upload Options Y N At Go-live Collaborative Document Editing with Version Control

Y N At Go-live

Real-Time Compliance and Performance Dashboard

N Y 1 Month after go-live

Dynamic Contract and Document Routing

Y N At Go-live

Secure Contract Extract and Sharing N Y 2 Months after go-live

The following capabilities are considered the Product Backlog for PRM2, and not required for go live. These capabilities are provided to demonstrate future enhancements and capabilities that DHS may seek from the solution during its lifecycle.

They do not comprise the full scope or detail of the Product Backlog. DHS expects that the Contractor will work closely with the PRM2 Product Owner to develop and prioritize a robust product backlog as the project progresses.

1. Expanded CWS Interface – Automatically generate contract folders and associated metadata for the DHS Components not currently integrated today, ensuring a unified and efficient contract management experience. This data will be integrated into ERA by DHS as Components modernize their CWSs so that ERA will be the data source.

2. Dedicated Contracting Officer Representative (COR) File Storage – Enable the storage of Contracting Officer Representative (COR) files separately from contract files, providing Program Office users with easy access while maintaining clear organization and security.

3. Seamless Interface with other DHS Systems – Establish interfaces with systems that generate contract documents or improve PRM2 security compliance. These systems and integrations will be defined as needed, but examples include signed award documents and requisitions as PDFs from a CWS and integration with DHS HR systems (ALM/TIE) to automatically deactivate user accounts for departed personnel in PRM2.

4. Fully Compliant Digital Signature Functionality – Implement a digital signature feature for documents routed for approval that adheres to the Federal PKI Playbook, ensuring secure and compliant electronic approvals.

5. Intelligent Automation and Data Management Tools – Incorporate AI-driven capabilities for data mining, redaction, and other prioritized functionalities to enhance contract management efficiency and protect sensitive information.

In addition to software, the solution should incorporate the following services:

1. Project Management – Plan, execute, and communicate effectively while managing risks, schedules, and costs according to plan.

2. Change Management – Continually assess the impact assessment to determine how the PRM2 will affect existing business processes, workflows, and user roles.

Develop a change management strategy to address user concerns and facilitates adoption.

3. Communication – Identify stakeholders and develop a communications plan.

4. Iterative Implementation & Configuration – Implement necessary components to meet DHS’ Minimum Viable Product (MVP) requirements. Configure solution to the DHS use case. Perform usability testing, to ensure the system meets the needs of the end-users. Collect and incorporate user feedback in systems’ configuration and deployment. Establish change control board and process to prioritize and implement Project Backlog.

5. Security – Work with DHS ISSOs to ensure compliance with DHS Cybersecurity requirements and DHS ATO and Interim ATO obtained timely. Implement security best practices throughout the development lifecycle.

6. Operations & Maintenance – Operate and maintain development, test, and production environments ensuring proper change control, patching, performance analysis, monitoring, and scanning.

7. Effective Training and Knowledge Transfer – Develop comprehensive training materials based on user needs and feedback. Conduct engaging and informative training sessions for end-users across DHS procurement offices. Provide easy-to-use system user guides and job aids. Ensure end-users are proficient in using the solution.

8. Transition – Enable transition of contract files from existing ECFS to new PRM2 efficiently and accurately. Provide support and resources to end-users during the transition.

9. Help Desk Support – Provide on-going Tier 1 support and resources to help end-users with questions or issues. Coordinate with Component Admins, where needed, to assist end-users with access and Component specific policy or process questions.

1.4 APPLICABLE DOCUMENTS

1.4.1 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this contract:

• DHS Enterprise Architecture

• DHS Acquisition Management Directive 102-01, which includes the DHS

Acquisition Instruction/Guidebook 102-01-001 and Appendix B Systems Engineering Lifecycle (SELC)

• DHS MD 102-01-0004, Agile Development and Delivery for Information Technology

• DHS Management Directive 140-01, Information Technology Security Services

• DHS Management Directive 4010.2 – Section 508 Program Management Office

& Electronic and Information Technology Accessibility

• DHS Management Directive 4300 Information Technology Systems Security

• DHS Management Directive 103-01 Enterprise Data Management Policy

• IEEE STD 829-1998: IEEE Standard for Software Test Documentation

• IEEE STD 830-1998: IEEE Recommended Practice for Software Requirements

Specifications

• IEEE STD 1233-1998: IEEE Guide for Developing System Requirements

Specifications

• NIST Special Publication 800-18 Revision 1: Guide for Developing Security Plans for Federal Information Systems

• NIST Special Publication 800-30 Revision 1: Guide for Conducting Risk

Assessments

• NIST Special Publication 800-37 Revision 1: Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach

• NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Federal Information Systems and Organizations.

• NIST Special Publication 800-116 Revision 1: Guidelines for the Use of PIV Credentials in Facility Access

• NIST Special Publication 800-144, Guidelines on Security and Privacy in Public Cloud Computing, dated December 2011

• OMB Memorandum 11-11-11 Continued Implementation of Homeland Security Presidential Directive (HSPD) 12– Policy for a Common Identification Standard for Federal Employees and Contractors

• CFR Title 36, Chapter XII, Subchapter B, Part 1236 for Electronic Records Management

• Section 508

• Federal Risk and Authorization Management Program (FedRAMP)

• NARA Universal Electronic Records Management Requirements, Version 3

• NARA General Record Schedules

• Federal Acquisition Regulation (FAR)

• Homeland Security Acquisition Regulation (HSAR)

• Homeland Security Acquisition Manual (HSAM)

• SNAP System Operating Procedures (SOP)

1.4.2 Appendices

The following documents provide more clarity on the requirements of this requirement.

• Appendix A – ECFS Requirements Identification Matrix

• Appendix B – Enterprise Reporting Application (ERA) Overview

• Appendix C – DHS Combined Checklist

• Appendix D – User Stories to Illustrate Desired User Experience

1.5 PERFORMANCE REQUIREMENTS SUMMARY

This contract includes a Performance Requirements Summary (PRS) at PWS 10.0. The PRS plays an integral role in the administration of the contract. In addition to any applicable inspection clauses or other related terms and conditions contained in the contract, the PRS shall serve as a primary tool for inspection and acceptance of services as facilitated by the Contracting Officer’s Representative (COR). Evaluation of the Contractor’s overall performance shall be in accordance with the performance standards set forth in the PRS, and will be conducted by the COR. The PRS constitutes a material aspect of the contract and will not be changed or otherwise modified without prior written approval of the Contracting Officer.

2.0 SPECIFIC REQUIREMENTS/TASKS

The Government may issue Task Orders under this BPA for the following Task Areas.

2.1 TASK 1: PROJECT MANAGEMENT

The Contractor shall perform project management overseeing the entire project lifecycle. This includes defining the project scope, developing a detailed project plan, managing project resources, monitoring progress, and ensuring the project is completed on time and within budget. Additionally, the project manager is responsible for managing risks, resolving issues, and communicating effectively with stakeholders, including the client, team members, and other project participants.

The contractor shall work with DHS to develop and maintain a Strategic Plan which outlines a comprehensive approach to the implementation of a PRM2. The plan addresses key aspects of the implementation, including:

• System Design - Define the system's architecture, functionalities, user interface, and interfaces. Detail how user experience principles will be incorporated to ensure design improves customer experience. These principles will be applied iteratively within an agile methodology framework, with regular feedback loops, user testing, and continuous improvement at each Sprint cycle, ensuring the final product aligns with user needs and expectations.

• Security Compliance - How the solution will obtain an interim ATO to allow for connection to DHS network and then full ATO to enable UAT and go live activities.

• Data Migration Plan - Develop a robust data migration strategy to ensure seamless transfer of data from ECFS that maximizes efficiency and minimizes the need for end-user validation of migrated data.

• Detail how data will be migrated from ECFS and validated prior to go live.

• Implementation Strategy - Determine how to phase in the implementation of the solution across the procurement community taking into consideration the number of users, business processes, and the functional requirements.

• User Training - Determine training plan to provide comprehensive training to end-users to maximize system adoption and utilization.

The Contractor shall identify, assess, and mitigate project risks to minimize their impact on the project's timeline, budget, and quality. This includes developing a Risk Management Plan, tracking identified risks, implementing mitigation strategies, and regularly reviewing and updating the risk register.

The Contractor shall develop and implement a Change Management Plan that details effective change management practices to minimize disruption and maximize user acceptance.

The Contractor shall establish and maintain a Quality Assurance Plan, conduct regular quality assurance reviews and testing, and implement corrective actions for identified quality issues.

The Contractor shall establish and maintain a Configuration Management Plan to identify, control, and document configuration items. The contractor shall perform configuration audits to ensure configuration integrity.

The contractor shall establish and track key performance indicators (KPIs) to measure project progress and success. The contractor shall report on KPIs in the monthly status reports.

2.2 TASK 2: SOFTWARE-AS-A-SERVICE (SAAS) COMMERCIAL OFF THE SHELF

(COTS) SOLUTION TO IOC IMPLEMENTATION

This task covers the procurement and management of software licenses required for the operation of the PRM2 system. It includes pro-rated licenses to support the transition phase during system implementation and full licenses for all users upon achieving Full Operational Capability (FOC). The contractor shall provide scalable licensing options to accommodate user growth and additional requirements over time. License activation must occur promptly within five business days of system IOC for transitional users, with full licenses operational immediately post-transition. This task ensures transparency, flexibility, and alignment with DHS’s operational and compliance needs.

The Contractor shall setup and maintain a development environment to support all configuration activities and initial development. The Contractor shall setup and maintain a testing environment to support all pre-production activities, user acceptance testing, and troubleshooting. This environment must be logically isolated from the end user but representative of the production environment. The Contractor shall provide an effective solution that utilizes industry standards and best practices to allow for testing and troubleshooting in a manner that is representative of the production environment. The solution shall be flexible to accommodate any future enhancements. The Contractor shall setup and maintain a production environment. The Contractor shall operate and maintain the production, pre-production/staging, and test/development environments of the system such that:

a. Change control processes are provided to secure the functionality of the environment without hindering the ability to efficiently add new functionality and/or update configuration settings.

b. Appropriate patch management and control for operating systems is provided that adheres to FISMA and FedRAMP standards.

c. Application software is maintained including installation of software defect corrections, database scripts and upgrades.

d. The system status (server hardware, software, and database) is monitored to proactively identify and resolve issues.

e. Identified issues are researched and mitigated.

f. Virus Protection is kept current.

g. Performance analysis and tuning, running software/database update scripts, indexing tables is accomplished to optimize system performance.

h. Contingency Plan testing is performed in accordance with security requirements.

i. The solution is reviewed and managed in a manner that ensures the application and associated environment complies with the requirements established in DHS

MD4300A.

The contractor shall provide a centralized solution that meets all regulatory compliance and delivers all MVP capabilities in this PWS while also accommodating the existing ECFS requirements identified in Appendix B – Requirements Traceability Matrix. The contractor shall deliver a System Design Document that includes:

• a solution overview

• illustration of hardware components and software components

• documentation on how the system will meet the requirements identified in this

PWS

• documentation on how business processes will be supported by the system

• data backups, redundancy methodology, and disaster recovery capability to prevent data loss due to hardware or software failure

• minimum desktop hardware and supporting software requirements

The Contractor shall deliver a System Configuration Document that documents specific configuration settings within the system. The Contractor shall develop/configure the solution in accordance with the System Design Document. The contractor shall include DHS technical representatives in the configuration efforts and demonstrate how the system is being configured to incorporate DHS business rules and practices.

The contractor shall deliver a Test Plan that includes tests that will demonstrate and verify the solution successfully satisfies the requirements listed in the PWS. The Test Plan shall cover functional and technical aspects of the system as they are documented in the System Design Document. The Contractor shall test the solution in accordance with the Test Plan. The contractor shall also deliver User Acceptance Test Procedures.

The Government will test the solution in accordance with the User Acceptance Test Procedures once connected to the DHS intranet. The Contractor shall be available to answer questions and monitor the testing process. The Contractor shall document the results of testing in a Test Report. The testing process shall not be considered complete, nor shall the initial operating capability be deemed achieved until the government has reviewed and formally accepted the test report and all associated deliverables confirming compliance with the specified requirements.

2.3 TASK 3: INTERIM AUTHORITY TO OPERATE (ATO) TO FULL

The requirements for this task include the initial setup and baseline configuration of the system to establish a stable operational environment that obtains an Interim ATO. This involves conducting comprehensive security assessments and compliance audits to ensure the system meets all necessary standards. Identified vulnerabilities must be addressed through remediation activities to mitigate risks and enhance security. Finally, all relevant security documentation must be prepared and submitted to obtain full ATO approval.

The Contractor shall:

a) Meet all security specifications to obtain an Authority to Operate (ATO) that complies with DHS MD4300A.

b) Meet all security requirements for a solution in a FedRAMP cloud hosted environment on an unclassified network.

c) Ensure the cloud hosted environment meets at a minimum, Moderate Security impact level.

d) Submit an IT Security Plan, which details the approach, methods, and safeguards the Contractor will utilize to comply with Government and DHS Information Technology security requirements.

e) Assist the PRM2 Information System Security Officer (ISSO) in the completion of applicable Security Authorization documentation required in order to obtain an Interim ATO.

f) Make all system configuration changes, software, or Operating System updates, and apply relevant security patches to the system as directed by the Authorizing Official (AO) or his representative.

g) Work with the Enterprise Architecture Information Repository (EAIR) Support team to ensure all software assets and technology products meet the standards of the DHS Technical Reference Model (TRM), systems, services, and data architecture elements

h) Work with the ISSO to modify or update the appropriate Security Authorization documentation as necessary during the certification testing process to reflect all system changes.

i) Assist the ECFS ISSO to obtain the accreditation approval of the system and Security Authorization documentation from the Action Officer or Action Officer Representative.

j) Assist the PRM2 Information System Security Officer (ISSO) in the completion of applicable Security Authorization documentation required in order to obtain a full

ATO.

k) Remediate all POA&Ms as necessary.

l) Ensure that system information security documents and accreditation are kept current throughout the period of performance.

2.4 TASK 4: USER ACCEPTANCE TESTING (UAT) AND PILOT

This task encompasses system implementation activities from initial operating capabilities (IOC) through user acceptance testing (UAT) and pilot deployment concluding at the achievement of full operational capability. The contractor shall implement the Solution in accordance with the Project Plan, System Design Document, and System Configuration Document.

The requirements for this task involve developing a comprehensive User Acceptance Testing (UAT) plan, including detailed test scripts to guide the evaluation process. A pilot deployment will then be conducted with selected users to assess the system's functionality and performance in a controlled environment. Feedback from these users will be gathered, analyzed, and used to implement necessary adjustments, ensuring the system meets user needs and operational requirements. Ensure seamless user experience that leverages automation to generate contract folders and metadata, using ERA as the data source. The solution should focus on reducing manual entry, minimizing errors, increasing user efficiency while providing a seamless and intuitive user experience.

2.5 TASK 5: DATA MIGRATION

The requirements for this task include assessing the readiness and mapping of data to ensure compatibility with the new system. A detailed migration strategy and schedule must be developed to guide the process. Test migrations will be performed to validate the accuracy and integrity of the data transfer, followed by a final migration, which will include thorough verification to confirm successful and complete data integration.

• Preparation and Planning:

o The Contractor shall develop a detailed data readiness report with clear mappings and compatibility details.

o Access a transparent migration strategy and schedule to plan and align team efforts.

• Test Migrations:

o Participate in test migration sessions to validate data accuracy and completeness.

o Compare migrated data with the original to ensure integrity and flag discrepancies.

o Review updates or resolutions for any identified issues during the test phase.

• Final Migration:

o Follow a comprehensive checklist provided before the final migration.

o Observe real-time progress and validation during the final data transfer.

o Verify successful completion with a post-migration confirmation report.

• Post-Migration:

o Access migrated data seamlessly in the new system without discrepancies.

o Utilize follow-up support to address any residual issues or concerns.

2.6 TASK 6: TRAINING AND KNOWLEDGE TRANSFER

Design a user-centric training program that equips users with the knowledge and confidence to navigate the new system proficiently. The program should address diverse learning styles, provide ongoing support, and foster user empowerment through accessible materials and regular virtual training sessions.

User Experience:

• Training materials include step-by-step guides, video tutorials, and visual aids, tailored to common tasks and workflows within the new solution.

• Regularly scheduled interactive virtual training sessions offer live instruction, real-time Q&A, and hands-on activities to engage participants.

• Training content is customized based on user roles, ensuring that each user learns the most relevant features and functions for their responsibilities.

• A library of on-demand training videos and downloadable Component Administrator Guide and User Role-based guides allows users to learn at their own pace and revisit materials as needed.

• Dedicated onboarding workshops help new users quickly get up to speed with essential system functions, using real-world scenarios to build practical skills.

• Regularly scheduled refresher courses and advanced topic sessions keep users updated on new features and best practices.

• A centralized knowledge base with FAQs, troubleshooting tips, and searchable guides ensures users can quickly find answers on their own.

• Users can track their progress through training modules and provide feedback to improve future training sessions.

2.7 TASK 7: HELP DESK AND SUPPORT SERVICES

The contractor shall provide help desk support for the solution between the hours of 8 AM and 6 PM EST. The Contractor shall provide a focused help desk experience that ensures prompt resolution of issues and compassionate support for users. The help desk personnel should prioritize efficiency, clarity, and empathy to alleviate user frustration and build trust. Help desk support shall be available through multiple channels, including phone, email, and chat. Users can choose the method that best suits their preference or urgency. Help desk are trained in active listening, patience, and clear communication to guide users through troubleshooting steps, even if they lack technical expertise. The Contractor shall respond to help desk tickets in person (non-system generated response) within 4 hours during regular business hours. A self-service portal/website offers step-by-step guides, FAQs, and troubleshooting resources for common issues, empowering users to resolve problems independently if they choose.

Specific activities to be performed by the help desk personnel include, but not limited to:

• Providing Tier I help desk services directly to the users through troubleshooting help desk tickets submitted in the OCPO help desk ticketing system (SNAP).

• Directly troubleshooting Tier II help desk tickets that are submitted by the Component Administrators or other DHS personnel.

• Updating, managing, and tracking help desk tickets.

• Providing weekly status updates on open, in progress, and resolved help desk tickets.

• Creating/updating step-by-step guides, FAQs, and troubleshooting resources for common issues for users to be posted on the self-service portal/website.

2.8 TASK 8: HELP DESK SURGE CAPABILITY (OPTIONAL)

• The contractor must have the capability to provide surge staffing to handle temporary increases in help desk inquiries, such as during high-demand periods (e.g., unexpected spikes in support needs).

• Surge staffing must be activated within [48 to 72 hours] upon from initial staffing adjustments as this timeline allows contractors to mobilize additional resources while still responding swiftly to increased demand.

• The contractor shall maintain performance standards during surge periods including a target of 90% of tickets resolved within 24 hours during peak demand.

2.9 TASK 9: OPERATIONS & MAINTENANCE (O&M)

The requirements for this task include conducting regular system health checks and applying necessary patches to ensure the system remains secure and up to date.

Ongoing performance monitoring must be performed to identify and address potential issues proactively, minimizing disruptions. Additionally, monthly maintenance reports should be generated and shared to provide insights into system status, updates, and any resolved or ongoing issues.

Users will receive timely notifications regarding scheduled system health checks and patching activities. These updates provide assurance that the system remains secure and up-to-date without requiring manual intervention, fostering confidence in the platform’s reliability and proactive maintenance approach.

Real-time dashboards will enable users to monitor key performance metrics and system statuses at a glance. Proactive alerts for potential issues, along with regular updates on resolution progress, ensure that users are informed and can trust the system’s performance and responsiveness.

Comprehensive monthly reports will summarize system health, completed updates, and resolved issues. These detailed reports provide users with a clear overview of the system’s status and maintenance activities, empowering them to stay informed and confident in the platform’s ongoing support and reliability.

2.10 TASK 10: NEW DEVELOPMENT/BACKLOG

The objective of this task is to enable ongoing development that introduces new features and enhancements to the system. These tasks do not include any of the Minimum Viable Product (MVP) functionalities. This involves gathering detailed requirements for new features to ensure they align with user needs and operational goals. The contractor is expected to adopt an Agile methodology to address and manage the new development backlog effectively. This approach involves iterative and incremental development cycles, enabling the prioritization of high-value features and timely delivery of functional outcomes.

The Contractor shall:

1. Collaborate on Backlog Prioritization: Work closely with the government Product Owner to review, refine, and prioritize backlog items based on mission-critical needs, user feedback, and organizational goals.

2. Deliver Incremental Outcomes: Organize the backlog into manageable sprints or iterations, focusing on delivering tangible, working features at the end of each cycle to maximize value and minimize delays.

3. Promote Transparency: Maintain visibility into backlog progress by using Agile tools and metrics (e.g., burndown charts, sprint reviews) to communicate updates and performance.

4. Incorporate Feedback: Continuously gather and incorporate stakeholder feedback to improve functionality and usability throughout the development process.

5. Ensure Outcome Delivery: The contractor will be measured by their ability to deliver outcomes aligned with backlog priorities, ensuring each feature meets user requirements and system objectives upon completion.

2.11 TASK 11: TRANSITION OUT (OPTIONAL)

The objective of this task is to enable transition of data from the system to a future system. The Contractor will be required to provide a Transition Plan that illustrates how the Contractor will provide a seamless transition between the incumbent and the successor. This plan will ensure minimal disruption of the Government’s activities and will be provided to the COR upon request.

3.0 CONTRACTOR PERSONNEL

3.1 QUALIFIED PERSONNEL

The Contractor shall provide qualified personnel with the necessary education, certifications, training, and experience to perform all tasks and responsibilities outlined in this contract. All proposed personnel must meet or exceed the qualifications specified herein and in the performance work statement (PWS). All personnel shall be able to read, write, speak, and understand English proficiently.

3.2 CONTINUITY OF SUPPORT

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 KEY PERSONNEL AND STAFFING REQUIREMENTS

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note: The Government may designate additional Contractor personnel as Key at the time of award. The following are key positions and preferred qualifications for staffing:

3.4 PROJECT MANAGER

The Contractor shall provide a dedicated Project Manager who shall be responsible for all Contractor work performed under this PWS. The Project Manager shall be a single point of contact for the Contracting Officer and the COR. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract.

3.4.1 The Project Manger should have substantial experience managing large-scale, complex projects. The Project Manger should have at a minimum a Bachelor’s degree and a Project Management Professional (PMP) certification, or equivalent, with the following experience.

• Total Project Management Experience: At least 10 years of project management experience, with a proven track record of successfully managing projects of similar size, scope, and complexity.

• Specific Experience in Government Projects: At least 5 years of experience managing government contracts or federal IT system implementations. This ensures familiarity with federal acquisition regulations (FAR), government reporting requirements, and cybersecurity compliance standards (e.g., NIST, FedRAMP).

• Experience with Comparable Budgets and Durations: At least 3 years managing projects with a budget of $10 million or more. Experience with multi-year implementations, including planning, deployment, and sustainment phases, is critical.

• Relevant Technical Experience: At least 2 years of experience in delivering cloud solutions.

3.4.2 The Project Manager shall be available to the COR via telephone between the hours of 8 AM to 5 PM EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 2 hours of notification.

3.5 ACQUISITION SUBJECT MATTER EXPERT (SME)

The Contractor shall provide an Acquisition Subject Matter Expert (SME) with acquisition expertise to serve as the Functional Lead under this PWS. The Acquisition SME should have a Bachelor’s degree and at least 5 years of 1102 experience. “1102” is the Government’s Contracting Officer and Contract Specialist job series. The Acquisition SME shall have an in-depth understanding of the contract filing process, the contract file lifecycle, and the documentation that constitutes the contract file. The Acquisition SME shall have experience providing business, technical, product, or related subject areas and experience providing strategic direction, documentation, and critical services to advance the project.

3.6 EMPLOYEE IDENTIFICATION

3.6.1 Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level, and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

3.6.2 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

3.7 EMPLOYEE CONDUCT

Contractor’s employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security. This applies to all subcontractors as well.

3.8 REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

4.0 OTHER APPLICABLE CONDITIONS

4.1 SECURITY

Contractor access to unclassified, but Security Sensitive Information may be required under this PWS. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

4.1.1 Requests for Exception to U.S. Citizenship Requirement

Special procedures apply for exception to the requirement that persons accessing DHS systems be U.S. citizens. Under normal circumstances, only U.S. citizens are allowed access to DHS systems and networks; but there is a need at times to grant access to foreign nationals. Access for foreign nationals is normally a long-term commitment, and exceptions to citizenship requirements are treated differently from security policy waivers. Exceptions to the U.S. citizenship requirement should be requested by completing a Foreign National Visitor Access Request, DHS Form 11052-1, which is available online or through the DHS Office of the Chief Security Officer (OCSO).

Components who have access may file their request via the Foreign National Vetting Management System (FNVMS), a part of the DHS OCSO Integrated Security Management System’s (ISMS). For further information regarding the citizenship exception process, contact the DHS OCSO

This Policy Directive and the DHS 4300A Sensitive Systems Handbook apply to all DHS employees, contractors, detailees, others working on behalf of DHS, and users of DHS information systems that collect, generate, process, store, display, transmit, or receive DHS information unless an approved waiver has been granted. This includes prototypes, telecommunications systems, and all systems in all phases of the Systems Engineering Life Cycle (SELC).

4.1.2 Post-Award Instructions Regarding Security Requirements for Non- Classified Contracts/Orders The procedures outlined below shall be followed for the DHS Office of the Chief Security Officer (OCSO), Personnel Security Division (PSD) to process background investigations, Entry on Duty determinations, and fitness determinations, as required, in a timely and efficient manner. Carefully read the security clauses in the contract.

Compliance with the security clauses in the contract is not optional. Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the contract, requiring access to sensitive information, shall undergo a position-sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through the DHS OCSO-HQS PSD. Prospective contractor employees shall complete and submit a combination of the below forms to the DHS OCSO-HQS PSD. The Standard Form (SF) 85 must be completed electronically through the Office of Personnel Management’s e-QIP SYSTEM. The SF-85 signature pages and other completed forms must be given to the OCSO-HQS PSD no less than thirty days before the start date of the contract or thirty (30) days prior to the requested entry on duty date, for all contractor employees whether a replacement, addition, subcontractor employee, or vendor. OCSO-HQS PSD does not process any requests until the contract has been awarded and released from epi to FPDS and ERA by extension.

a. Standard Form (SF) 85 Questionnaire for Public Trust Positions

i. SF-85P Certification

ii. SF-85P Authorization for Release of Medical Information

b. FD Form 258 Fingerprint Card (2 copies) or Identity Enrollment Services

c. DHS Form 11000-6 Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement

d. DHS Form 11000-9 Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit…