Amendment 1_75P00120R00052_0001.pdf

(x)

75P00120R00052 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

DAM

Bethesda MD 20814 8th Floor 7700 Wisconsin Avenue

DHHS/PSC/AMS/DAM

03/11/20200001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

02/27/2020

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to:

1. Provide and incorporate the answers to the Contractor questions in response to

RFP#75P00120R00052.

2. Provide and incorporate the changes made to the solicitation as highlighted in the attached.

3. Extend the proposal submission date to March 23, 2020 by 11:00 AM ET.

All other terms and conditions remain the same.

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

WENDY C. CRUZ

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

# Question Document Title Identify Section Identify Page #

Response

1 Task Order #1 states the current hours as limited to Monday – Friday 5:00 AM ET to 11:00 PM ET and Saturday & Sunday 9:00 AM ET to 9:00 PM ET. Is it the goal of PMS to move the availability of the PMS services to a 24/7 model?

J.1 Task Order C.2 3 PSC/PMS reserves the right to change the hours that the system is available as needed.

2 Can the government provide additional details of the webservices that have been developed including the technology adopted?

J.1 Task Order C.3.2.6 (m) 15 Web services are developed and provided on a case by case basis for PMS customers. Industry standard technologies can be used including REST and JSON, where applicable.

3 Is this referring to system administration and support for MS SharePoint?

If not can the government clarify the level and kind of support being referred to here?

J.1 Task Order C.3.2.6 (r) 16 PMS currently uses SharePoint as a document repository, but will entertain recommendations for improving this functionality with alternative solutions. The vendor will provide system administration services for the software.

4 Does the government have existing monitoring tools in place or is the government expecting the offeror to recommend?

J.1 Task Order C.3.2.6 (x) 16 The government does not understand the question as it pertains to the requirement.

5 Does the current incumbent contractor have a transition out plan? Will awarded contractor have access to that information during a 60 day transition period?

J.1 Task Order C.3.5 23 The transition plan will be finalized after award and coordinated between the incoming and outgoing vendors.

6 What is the typical volume of help desk tickets that PMS receives? J.1 Task Order C.3.5.3 (f) 24 There is no "typical" volume, and can fluctuate, usually during periods where new functionality is rolled out to the user community.

7 Under the IT Service Responsibility there is mention of a tables but there doesn't appear to be in tables listed.

J.1 Task Order C.4 IT Service Responsibility

24-25 This section was included in error and has been deleted from the requirement.

8 The Government requests a transition-in plan as part of the task order technical approach but doesn't request a transition-out plan as described in Task Order #1; is it the Government's intent that a transition-out plan should be submitted post award?

J.1 Task Order C.4.1.1 Transition Management

Roles & Responsibilities

25 The transition plan will be finalized after award and coordinated between the incoming and outgoing vendors.

9 Who is the current contractor(s) providing support for the PMS Applications, if there are multiple contractors, please provide the names of the contractors and through which contacting vehicle(s) they are contracted with PMS?

J.1 Task Order #1.pdf C.3.5 Transition 23 The current vendor is Digital Management Inc. (DMI). The current contract number is GS06F0673Z/HHSP233201500247G.

10 Are all the titles listed under the section are Key Personnel? J.1 Task Order #1.pdf C.6 352.242-70 Key Personnel

31 Key personnel will be those contractor staff that are expected to work from the government site. At this time, the number of key personnel is limited to five individuals. Labor categories are included in Task Order 1.

11 Can contractors propose additional Key Personnel not listed? J.1 Task Order #1.pdf C.6 352.242-70 Key Personnel

31 Key personnel will be those contractor staff that are expected to work from the government site. At this time, the number of key personnel is limited to five individuals.

12 The key personnel role titles in the Task order 1 do not map to the labor categories listed in the overall IDIQ is it the Government's intent that the contractor replace those titles in the sample task order with the personnel labor categories listed in the IDIQ or should the contractor replace the labor categories in the IDIQ with the titles listed in the sample task order?

J.1 Task Order and

RFP_75P00120R00052_B

ase

J.1 C.6 and Factor 2 in

RFP_75P00120R0

0052_Base and

L.10.2

pg. 31 in J.1 C.6 and pgs.

78-

80/87-

Refer to the revisions made to the solicitation to align the labor categories.

Questions N Answers_PMS_RFP75P00120R00052 Amendment #1 1 of 4

Response

13 Both the Task Order and the RFP request a transition plan, with the RFP requiring and eight (8) week transition-in plan. Is there currently a contractor supporting the scope of work outlined in Task Order #1? If so who?

RFP#5P00120R00052 Factor 3 Technical

Approach & Instructions

77 Please refer to Question #9.

14 Can you please identify the names of the commercial-off-the-shelf products, (COTS) and what they are used for?

RFP#75P00120R00052 C.1.4.1 PMS

Overview

7 TOAD for querying the Oracle databases.

Serena for change management.

MicroStrategy for data analytics.

15 Can you please identify the names of the custom developed programs and what functions they perform and what programming languages they were developed in?

RFP#75P00120R00052 C.1.4.1 PMS

Overview

7 There are several custom developed programs that are included, mostly created in PL/SQL and JAVA. Much of the functionality of PMS is based on these custom programs.

16 Can you please identify the names of the data analytics solutions and what functions they perform and what programming languages they were developed in?

RFP#75P00120R00052 C.1.4.1 PMS

Overview

7 At this time, PMS is exploring MicroStrategy, but is open to looking at other options. To-date, PMS is exploring grants-related data for use in cost models and grant payment distributions. It is the intent of the PMS service to expand this.

17 The second bullet after the introduction "The FMP PMS Management structure consists of" defines "Payment Management Services (PMS)".

However, the next bullet and section C.1.3 both define "Payment Management Services (Services)". Are these references all the same?

RFP#75P00120R00052 C.1.4.2 7 PMS is used to identify the Payment Management System as well as the Payment Management Services. In the latter case, "the Service" is used to differentiate.

18 Does the government have a cloud platform of choice that the migration needs to happen to?

RFP#75P00120R00052 C.2 8 The cloud solution has not yet been chosen.

19 Is there any existing data analytics that is being done for PMS? if so can the government share details of technologies being employed?

RFP#75P00120R00052 C.2 8 See response to Question 16. To date, PMS has used MicroStrategy in its COTS offering.

20 Item d) says "Provide Earned Value Management reports on all enhancements, upgrades and implementation of new programs."

However, task orders can be fixed price, where EVMS reporting is generally not used. Can we assume that EVMS reporting is only for Time and Material task orders?

RFP#75P00120R00052 C.2.1.7 10 Yes, at the direction of the COR.

21 The section states "With the exception of emergency and /or off-hours support, Key Personnel shall perform all services on-site unless specific approval is provided by the CO, COR, or their designated representative.

Contractor staff will be required to use government issued computers for work performance related to this contract. Contractor will need to provide accommodations to all remaining personnel not identified as Key Personnel. Each individual assigned to a Task Order will be required to pass a background investigation and upon a favorable adjudication will be issued a government smart card in accordance with HSPD-12 directives and provisions." Can we assume "accommodations" means "office space"? Will non-key personnel be issued government computers? If so, how will they connect these computers offsite? If not, how will they perform their tasks? [Note: Section H.13 appears to confirm issuance of government equipment and VPN access]

RFP#75P00120R00052 C.8 18 Accommodations means office space. As noted, GFE (laptops) will be provided for all vendor contractor staff and will connect via VPN to the HHS network. Email addresses (.gov) will also be provided.

Questions N Answers_PMS_RFP75P00120R00052 Amendment #1 2 of 4

Response

22 Task Order #1 response requires, " The Quoter shall provide a staffing matrix demonstrating which employees will be responsible for tasks across the systems mentioned in the task order. The Quoter shall also provide a staffing chart depicting the proposed level of effort for the task order and labor mix." Is it the intent of the Government that all staff in the chart be considered key personnel?

RFP#75P00120R00052 Factor 2 77 and

Key personnel will be those contractor staff that are expected to work from the government site. At this time, the number of key personnel is limited to five individuals.

23 Resumes for all key personnel are required are the 6 labor categories identified in Factor 2 the minimum list of key personnel?

RFP#75P00120R00052 Factor 2 Staffing Plan/Personnel Requirements

87 Key personnel will be those contractor staff that are expected to work from the government site. At this time, the number of key personnel is limited to five individuals.

24 If there is an incumbent contractor for Task Order #1, is there an expectation that Quoters should include a retention plan for incumbent personnel?

RFP#75P00120R00052 Factor 3 Technical

Approach & Instructions

77 There is no expectation from the government. Submission of one is at the contractor's discretion.

25 Is it acceptable to submit the business volume in excel format? RFP#75P00120R00052 L.10 77-78 Yes, it is acceptable for pricing related data/tables. However, other data required, Financial Capacity and Commitments should be submitted in PDF or word format.

26 Is there a requirement that all contractor staff be US citizens? RFP#75P00120R00052 L.10.2 Proposal Bidding

Assumptions

78 Contractor staff will be required to obtain Public Trust security clearances up to Tier 4, MBI Level 6.

27 Please confirm that there are no Key Personnel required at the IDIQ Level?

RFP#75P00120R00052 L.10.2 Proposal Bidding

Assumptions

78 Key Personnel are not required at the IDIQ level. Each Task Order will identify the Key Personnel. Task Order #1 identifies 5 key personnel.

28 When we went to the link provided in the RFP we are informed that this page doesn’t exist. Can the government please provide an updated link or remove this requirement?

RFP#75P00120R00052 L.10.6 82 The link is working correctly.

29 This solicitation requires a substantial response in order to fully address the IDIQ and task order requirements, as well as solidify the identification of key personnel. Yet the response time is limited to two weeks. We typically see a 30-day response time for these types of solicitations in order to provide potential new teams adequate time to finalize an approach, team, and articulate their value proposition in a well-written proposal. Is there a particular reason for the short turn-around, and would the government consider a 30-day response time? As written it would be very difficult for any vendor to respond competitively unless they had the incumbent contractor on their team.

RFP#75P00120R00052 L.7 74 The proposal submission date has been extended to 3/23/2020 by

11AM ET.

30 Tables and call out boxes do they need to be double spaced? RFP#75P00120R00052 L.9 75 No 31 For consistency shouldn’t Volume I Other Required Information be called

Factor 4?

RFP#75P00120R00052 L.9 section 1 table 76 Refer to revised solicitation.

32 Can the government please confirm Volume III title (Business Proposal or Price Proposal)?

RFP#75P00120R00052 L.9, L.10, M.7 75, 77,

& 92

This has been revised to reflect, Business Volume.

33 Is there an incumbent contractor? Can you provide the contractor’s name and contract number?

RFP#75P00120R00052 N/A N/A The current vendor is Digital Management Inc. (DMI). The current contract number is GS06F0673Z.

Questions N Answers_PMS_RFP75P00120R00052 Amendment #1 3 of 4

Response

34 How many contractor FTE are supporting PMS today? RFP#75P00120R00052 NA NA We currently have 14 contractor staff providing support for O&M.

Please also refer to the Government's estimated level of effort in Section L.10.2 for Task Order 1.

35 This is huge undertaking and like to request an extension to the submission date

RFP#75P00120R00052 NA NA Refer to response to Question 29.

36 A few labor categories listed on Page 87-89 of the RFP were not part of the Proposal Bidding Assumptions on page 72-80. Should we include these labor categories in our staffing plan?

RFP#75P00120R00052 72-80 To assist Offerors in the preparation of their proposals, the Government provided bidding assumptions. Offeror’s are expected to make an independent assessment of the resources required to perform the tasks described in Attachment J.1 Task Order #1.

Offerors should use their own judgment based on their experience and approach to completion of this project to propose the price appropriate for the requirement.

37 What is the governments email size limitation? RFP#75P00120R00052 Maximum File size 20MB.

38 The period of performance in the SF-1449 states "05/04/2020 to

05/03/2021". Section F.2 Period of Performance indicates that is the Base Period. Should the SF1449 indicate the option periods as well?

SF1449 1 Option Periods will be reflected at award.

39 Will the government consider a FedRAMP Moderate solution to meet its requirements?

RFP#75P00120R00052 No

40 Will the Government consider a RedRAMP Moderate solution with the provision of being FedRAMP high upon delivery of the solution?

RFP#75P00120R00052 Must be FedRamp HIGH prior to June 2021

41 Should the technical approach cover future task orders described on page 8?

RFP#75P00120R00052 Refer to Sections L through M for the proposal submissions instructions to include content.

Questions N Answers_PMS_RFP75P00120R00052 Amendment #1 4 of 4

RFP#75P00120R00052_0001 Page 3 of 95

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

The purpose of this contract is to support the Payment Management System (PMS) application, infrastructure and assist with the development of solutions to address mandated and customer-requested changes.

B.2 TYPE OF CONTRACT

This is a single-award Indefinite Delivery Indefinite Quantity (IDIQ) type contract.

B.3 TYPE OF ORDERS (IDIQ)

Task orders issued under this IDIQ contract may be: firm fixed-priced orders, time and material orders or labor hour orders.

B.4 MINIMUM AND MAXIMUM QUANTITIES (IDIQ)

During the contract period, the Government shall place orders totaling a minimum of $2,000,000.00. This reflects the contract minimum for the entire period of performance, including any options. The contract maximum for the entire period of performance, including any options, shall be for the placement of orders totaling a maximum of $19,840,000.00.

B.5 CONTRACT LINE ITEM PRICING (IDIQ)

The price for each task order will be based on the negotiated unit prices listed below and estimated level of effort, or firm fixed price amount, to be determined at the time of task order award.

The Contractor will be reimbursed in accordance with pricing section of each task order for satisfactory performance of the work.

Time and Material/Labor Hour Orders The Contractor shall not exceed the maximum, fully loaded hourly rates (inclusive of wages, indirect costs such as fringe, overhead, general and administrative expenses, any other indirect costs for labor, and profit) for each category listed below.

Fully Loaded Labor Rate Labor Category Year 1 Year 2 Year 3 Year 4 Year 5

RFP#75P00120R00052_0001 Page 4 of 95

Material (Non-Labor) Indirect Cost Rates - Pursuant to the General Provisions of this contract pursuant to FAR 52.212-4; Alt. I, the following fixed indirect rate to be applied against Materials is established:

No Material Costs are allowable under the IDIQ.

Firm Fixed Price Orders Firm Fixed Price orders shall comply with the labor rate maximums for each category listed below. A payment schedule for Firm Fixed Price orders will be negotiated for individual task orders.

Labor Category

Year 1 Year 2 Year 3 Year 4 Year 5

RFP#75P00120R00052_0001 Page 5 of 95

SECTION C - Description/Specifications/Statement of Work

TITLE: Indefinite Delivery Indefinite Quantity (IDIQ) for Systems Support Services: Payment Management System (PMS)

C.1 PROGRAM DESCRIPTION AND BACKGROUND

C.1.1 Purpose of the Contract

This is a single-award Indefinite Delivery/Indefinite Quantity (IDIQ) contract which sets forth the conditions and clauses under which future acquisitions between the parties shall be governed.

This contract will be used as a means to efficiently and effectively support the Payment Management System (PMS) application, infrastructure and assist with the development of solutions to address mandated and customer-requested changes.

C.1.2 Agency Mission

The mission of PSC/Payment Management Services is to deliver the best value in grant payment services under a shared service approach, ensuring acquisition activities and general performance objectives are completed cost effectively in support of the needs and goals of PSC customers and PSC leadership.

C.1.3 Introduction

The Department of Health and Human Services (DHHS), Program Support Center (PSC), Financial Management Portfolio (FMP), Payment Management Services (Services) is responsible for operations support, maintenance, and enhancements to the Payment Management System (PMS).

The Contractor shall support PMS and the Service as they manage, and report on the thousands of grant payments that the PSC/FMP/Payment Management Services is required to monitor by legislative mandate.

C.1.4 Background

The Payment Management Services within the Program Support Center (PSC) has over 30 years of experience providing grant and grant-like payments, cash management, and grant accounting support services to Federal Agencies. PSC uses a custom-developed PMS that provides awarding Agencies and Grant recipients the tools to manage grant payment requests and disbursement reporting activities. The PMS has been selected by the Chief Financial Officers Council - by authority of Office of Management & Budget (OMB) - as one of two non-Department of Defense (DoD) grants payment systems for use by the entire Federal Government. PMS leverages efficient business processes, state-of-the-art information technology, E-Government initiatives and business expertise to build a critical link in the operation of Federal Financial assistance programs. PMS is a full service centralized grants payment and cash management system. The system is fully automated to receive payment requests, edit them for accuracy and content, transmit the payment to either the Federal

RFP#75P00120R00052_0001 Page 6 of 95

Reserve Bank or the U.S. Treasury for deposit into the grantee's bank account, and record the payment transactions and corresponding disbursements to the appropriate account(s).

The function of the PMS is to provide world-class grants payment and cash management services to HHS and other Federal and non-Federal entities. The PMS serves as a fiscal intermediary between awarding agencies and the recipients of grants and contracts. The PMS objectives are to provide:

Central standardized process for Federal grant payments

An efficient cash management of grant funds

On-line access to grant recipients for funds requests, grant account information, and the Federal Financial Report (FFR) SF-425

On-line access to awarding agencies for grant recipient account, payment, and financial information

Operational efficiencies through economies of scale.

Reports to Treasury, Federal Accounting Systems, and other Federal systems requiring reporting data

The PMS currently processes approximately $547 billion annually in Federal grant and grant like payments. The PMS customers include a wide variety of grant and grant-like recipient organizations totaling over 30,000 payee accounts. PMS is a FISMA HIGH system that currently disburses funds to approximately 131 countries throughout the world.

Currently, PMS availability is limited to Monday – Friday 5:00 AM ET to 11:00 PM ET and Saturday & Sunday 9:00 AM ET to 9:00 PM ET; however, off-hours support will be required for various reasons (i.e. enhancement implementation, address unexpected system issues, emergencies, system security requirements, etc.) as well as any necessity to increase the system’s hours of availability.

C.1.4.1 PMS Overview

The primary functionality of the PMS consists of the following elements:

Recording award authorizations that are initiated by the grant awarding agencies

Processing grant recipient requests for funds

Reporting

RFP#75P00120R00052_0001 Page 7 of 95

The PMS currently runs on servers and limited mainframes housed at the National Institute of Health (NIH). The physical maintenance of these machines is not within the scope of this Statement of Work, however various components of the operating system administration is within the scope of this Statement of Work. The PMS is not a single application, but is made up of various web pages, web based applications, workflows, databases, UNIX and Windows based servers, specially configured routers, virtual private networks (VPNs), file servers, commercial-off-the-shelf products (COTS) and custom developed programs, and data analytics solutions.

The objectives of the PMS are to provide a central point for grant and program payments;

efficient cash management; capability for recipients to request funds on-line; on-line access to payment and disbursement information by awarding agencies & delegates, and to obtain operating efficiencies through economies of scale.

C.1.4.2 Organizational Structure/Stakeholders

The FMP PMS Management structure consists of

A Government Contract Officer’s Representative (COR) who shall be responsible for the overall success of the PMS project, ensuring adequate coordination among the various management components.

Financial Management Portfolio (FMP), which is responsible for providing a full range of financial reporting and accounting services that meet strict Federal financial management system requirements and applicable Federal accounting and transaction standards. FMP is comprised of the Office of the Director and three Divisions: Accounting Services (AS); Cost Allocation Services (CAS); and the Payment Management Services (PMS). FMP also interacts regularly with the other PSC portfolios.

The Payment Management Services (Services) maintains responsibility for all grant payment responsibilities and is the primary user and stakeholder of the PMS. The Services serves as the financial intermediary between awarding agencies and grant recipients. The Services uses the PMS to perform and document payment-related grant activities for HHS and other federal agency clients. The PMS application is used to process grant payments for the majority of federal grantees. Some of the services offered include:

Next-day payments through the Automated Clearing House electronic network for financial transactions in the United States.

Cash management services that support the Cash Management Improvement Act

Professional grant account support services including helpdesk, training, reporting, and audit support.

RFP#75P00120R00052_0001 Page 8 of 95

A Change Control Board (CCB) which shall serve as the primary authority for reviewing and approving (or disapproving) those changes to the software or requirements that affect PMS

Compliance with Treasury oversight and requirements under delegated disbursing authority

C.2. SCOPE OF IDIQ

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified), and otherwise do all the things necessary for or incident to the performance of the work as set forth in each task order.

The services contemplated under this contract will be identified in each Task Order, the first of which addresses “Operations & Maintenance (O&M)” and related activities. Any subsequent Task Order will be awarded as necessary and will identify the combination of services required.

Potential future Task Orders may include (but are not limited to):

1. Work required to maintain compliance with new policy or regulatory changes issued by the Federal government, or the Department of Health and Human Services

2. The migration of the PMS application to a cloud-based platform

3. Expanding the use of data analytics

4. The implementation of Robotic Process Automation (RPA)

5. Expanding the use of WebServices technology

6. The implementation of enhanced cybersecurity monitoring tools and technology

See Section H.1 for subsequent task order procedures.

C.2.1 Project Management

C.2.1.1 The contractor shall establish Project Management standards that shall be delivered throughout the period of performance of the contract for all services. These standards consist of the following:

C.2.1.2 Project management standards and industry /government leading practices shall be expected of all tasks performed by the contractor.

Due to the FISMA HIGH rating of the PMS application, a proposed Project Manager with an existing certified Six Sigma Green Belt (or higher) and/or Project Management Professional (PMP) is preferred.

C.2.1.3 The contractor shall be required to develop and adhere to a Project Management Plan that incorporates policies, standards and concepts to the delivery of all the services and operations under this Statement of Work. The contractor shall incorporate industry and government leading practices

RFP#75P00120R00052_0001 Page 9 of 95 to develop and adopt a project management model that the contractor shall use throughout the period of performance. The Project Management Plan shall include but is not limited to a Scope Management Plan, a Quality Management Plan, a Communication Management Plan, and a Risk Management Plan. The Project Management Plan shall be routinely reviewed and tasks will be prioritized by the Federal PMS team.

C.2.1.4 The contractor shall be required to adopt and adhere to HHS’s Enterprise Performance Life Cycle (EPLC) plan which incorporates policies, standards and concepts, which shall apply to all software development and coding activities delivered under this Statement of Work.

The Department of Health and Human Services (HHS) Enterprise Performance Life Cycle (EPLC) is a framework to enhance Information Technology (IT) governance through rigorous application of sound investment and project management principles and industry’s best practices. The HHS EPLC provides the context for the HHS IT governance process and describes interdependencies between its project management, investment management, and capital planning components.

The goals of the EPLC framework are to:

Provide a coherent and effective methodology to guide HHS IT investment and project management to ensure that enterprise needs are met.

Promote the effective and consistent use of investment and project management principles and industry best practices to consistently deliver IT capabilities that provide maximum support to HHS business needs within approved cost and schedule baselines.

Enhance the HHS IT governance process by effectively integrating IT investment planning, execution, management, and oversight.

Ensure Critical Partner and stakeholder functions are performed throughout the life cycle of investments to include timely, effective multi-disciplinary reviews of IT investments and reports on them to the HHS IT Governance Bodies for their assessment of investments within the context of the HHS enterprise-wide IT portfolio.

C.2.1.5 The contractor shall be required to develop and adhere to an Information Technology Service Management plan which incorporates policies, standards and concepts which shall apply a customer-centered focus to the delivery of the information technology services and operations under this Statement of Work. The contractor shall incorporate industry and government leading best practices to develop and adopt a service delivery model, which the contractor shall use throughout the period of performance.

C.2.1.6 The contractor shall conduct an assessment of the existing PMS change control process including the existing change control board and provide recommendations regarding the change

RFP#75P00120R00052_0001 Page 10 of 95 control process. Recommendations shall include any industry and governmental leading best practices as well as operational and process efficiency opportunities. Upon review and acceptance of any recommendations the contractor shall implement such changes.

C.2.1.7 The contractor shall submit a detailed Project Work Plan (PWP) of their technical approach of how they shall accomplish the support for the work being described within the Task Order. The Plan is to be developed using Microsoft Project, however, the PSC may change the project management software in use if PSC standards change. The contractor shall have 90 days to convert if the standards change. The PWP shall follow the steps below:

a) The PWP shall show all the components scheduled with major milestones and target dates.

b) Incorporate Communications Plan into PWP to assist HHS Leadership to prepare stakeholders for the expected change with regard to new programs, enhanced functionality etc. and identify resulting impact on process owners’ roles and responsibilities.

c) Periodic updates of the PWP as requested and coordinated with the COR.

d) Provide Earned Value Management reports on all enhancements, upgrades and implementation of new programs.

C.2.1.8 The contractor shall provide a written weekly status report to the COR and conduct a weekly status meeting with the COR and/or the Information Systems Branch Chief or his/her designee(s). This status report shall include at a minimum: a review of activities completed in the previous week, the activities scheduled for the previous week but not completed, the activities scheduled for the coming week, any identification of issues, risk assessments along with recommended solutions, and contractor staff availability (e.g. scheduled leave) over the coming 60 days. The COR may include any other personnel (governmental or non-governmental) in the weekly status report and meeting as per their discretion. The COR may request additional details as necessary to monitor and track progress and resources. The contractor shall take meeting minutes during the weekly status report and provide them to the COR.

C.2.1.9 Other contractors may be performing other PSC/PMS support services in areas associated with the requirements of this contract.

The Government shall facilitate initial contact between the contractor and other contractors. The contractor shall provide all further required coordination with other contractor personnel for any component specified in this contract that relates to or impacts any other contracted work.

It is expected that other PSC, FMP or Payment Management Services contractors may at times review work performed under individual Task Orders awarded under this IDIQ, and provide advice and consultation to facilitate the successful implementation of a specific project.

RFP#75P00120R00052_0001 Page 11 of 95

C.2.2 General Assumptions

C.2.2.1 The contractor shall utilize all existing PSC/FMP systems, tools, standards and processes for systems documentation, configuration management, change management, code version control and migration.

C.2.2.2 The contractor shall be responsible for transferring PMS application functionality knowledge to the PMS users especially around new releases and /or at the time of new hires as per the direction of the COR. This includes the development and maintenance of training material. The contractor shall provide ongoing training workshops to new and current users regarding system configuration and procedures as requested with supporting documentation. Similarly, the contractor shall be required to provide training and / or knowledge transfer workshops to PSC personnel (upon COR’s request) to optimize processes and procedures for running and troubleshooting the applications.

C.2.2.3 The contractor shall plan, schedule and conduct the weekly Change Control Board (CCB) meeting. This includes preparing and publishing the meeting agenda, taking meeting minutes, documenting action items, recording votes, and distributing all related communications.

C.2.2.4 The contractor shall maintain the Services written Standard Operating Procedures (SOP).

These SOP includes the daily processes as well as the month-end, quarter-end and year-end processes.

C.3 INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

REQUIREMENTS

Information Security is applicable to this solicitation and the following information is provided to assist in proposal preparation.

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including subcontractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational and technical safeguards needed to protect the confidentiality, integrity and availability of a Federal information system and its information.

The Statement of Work (SOW) requires the successful offeror to (1) develop, (2) have the ability to access information from, or (3) host and/or maintain a Federal information system(s). Pursuant to Federal and HHS Information Security Program Policies the following requirements apply:

RFP#75P00120R00052_0001 Page 12 of 95

Reference: Federal Information Security Management Act of 2002 (FISMA), Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002);

http://csrc.nist.gov/policies/FISMA-final.pdf

(a) Information Type

[X] Administrative, Management and Support Information:

[X] Mission Based Information:

(b) Security Categories and Levels

Confidentiality Level: [ ] Low [ ] Moderate [X] High

Integrity Level: [ ] Low [ ] Moderate [X] High

Availability Level: [ ] Low [ ] Moderate [X] High

Overall Level: [ ] Low [ ] Moderate [X] High

(c) Position Sensitivity Designations

Prior to award, the Government will determine the position sensitivity designation for each contractor (including subcontractor) employee that the successful offeror proposes for work under the contract. For proposal preparation purposes, the following designations apply:

[X] Level 6: Public Trust - High Risk (Requires Suitability Determination with a BI). Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI).

[ ] Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non Sensitive (Requires Suitability Determination with an NACI). Contractor employees assigned to a Level 1 position are subject to a National Agency Check and Inquiry Investigation (NACI).

Upon award, the contractor will be required to develop and submit a roster of all staff (including subcontractor staff) working under the contract who; have the ability to access information from, or host and/or maintain a federal information system(s). The Government will determine and notify the Contractor of the appropriate level of suitability investigation required for each staff

RFP#75P00120R00052_0001 Page 13 of 95 member. An electronic template, “Roster of Employees Requiring Suitability Investigations,” is available for contractor use at: http://ais.nci.nih.gov/forms/Suitability-roster.xls

Upon receipt of the Government’s notification of applicable Suitability Investigations required, the contractor shall complete and submit the required forms within 30 days of the notification.

Contractor/subcontractor employees who have met investigative requirements within the past five years may only require an updated or upgraded investigation.

(d) Information Security Training

HHS policy requires contractors/subcontractors receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements.

The successful offeror will be responsible for assuring that each contractor/subcontractor employee has completed the HHS Computer Security Awareness Training course and any other security training required by the Department prior to performing any contract work, and thereafter completing the HHS-specified fiscal year refresher course as required during the period of performance of the contract. The successful offeror shall maintain a listing of all individuals who have completed this training and shall submit this listing to the Project Officer.

Additional security training requirements commensurate with the position may be required as defined in NIST Special Publication 800-16, Information Technology Security Training Requirements (http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf). This document provides information about information security training that may be useful to potential offerors.

(e) Rules of Behavior

The contractor/subcontractor employees shall comply with the HHS Information Technology General Rules of Behavior

(f) Personnel Security Responsibilities

Contractor personnel will comply with the federal Standards of Conducts and Ethical behavior when executing duties under the terms of this award. Contractor personnel will comply with successful completion of all required training. The contractor shall provide the required documentation identified by the Department and/or sub-agency in advance of any contractor/subcontractor employee that terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

(g) Commitment to Protect Non-Public Departmental Information Systems and Data

RFP#75P00120R00052_0001 Page 14 of 95

(1) Contractor Agreement

The Contractor and its subcontractors performing under this SOW shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

-18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

-18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

-Public Law 96-511 (Paperwork Reduction Act)

(2) Contractor-Employee Non-Disclosure Agreements

Each contractor/subcontractor employee who may have access to non-public Department information under this contract shall complete the Commitment to Protect Non-Public Information - Contractor Agreement. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under the contract.

(h) NIST SP 800-26 Self-Assessment Questionnaire

The contractor shall annually update and re-submit its Self-Assessment Questionnaire required by NIST Draft SP 800-26, Revision 1, Guide for Information Security Program Assessments and System Reporting Form. [Reference questionnaire format to be used in http://csrc.nist.gov/publications/drafts/Draft-sp800-26Rev1.pdf. See Appendix B for format.

Subcontracts: The contractor’s annual update to its Self-Assessment Questionnaire shall include similar information for any subcontractor that performs under the SOW to (1) develop a Federal information system(s) at the contractor’s/subcontractor’s facility, or (2) host and/or maintain a Federal information system(s) at the contractor’s/subcontractor’s facility.

The annual update shall be submitted [For option contracts: no later than the completion date of the period of performance/for all other contracts: indicate due date as determined by the Project Officer/Contracting Officer].

(i) References

(1) Federal Information Security Management Act of 2002 (FISMA), Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002);

http://csrc.nist.gov/policies/FISMA-final.pdf

(2) HHS Personnel Security/Suitability Handbook: http://www.hhs.gov/ohr/manual/pssh.pdf

(3) NIST Special Publication 800-16, Information Technology Security Training Requirements:

RFP#75P00120R00052_0001 Page 15 of 95 http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf Appendix A-D:

http://csrc.nist.gov/publications/nistpubs/800-16/AppendixA-D.pdf

(5) NIST SP 800-18, Guide for Developing Security Plans for Information Technology Systems: http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

(6) NIST SP 800-26, Revision 1, Computer Security:

http://csrc.nist.gov/publications/drafts/Draft-sp800-26Rev1.pdf

(7) NIST SP 800-53, Revision 4, Recommended Security Controls for Federal Information Systems:

http://csrc.nist.gov/publications/nistpubs/index.html

(8) NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I: http://csrc.nist.gov/publications/nistpubs/800-60/SP800-60V1-final.pdf;

Volume II, Appendices to Guide For Mapping Types of Information and Information Systems To Security Categories, Appendix C at http://csrc.nist.gov/publications/nistpubs/800-60/SP800- 60V2-final.pdf and Appendix D at http://csrc.nist.gov/publications/nistpubs/800-60/SP800- 60V2-final.pdf.

(9) NIST SP 800-64, Security Considerations in the Information System Development Life Cycle:

http://csrc.nist.gov/publications/nistpubs/800-64/NIST-SP800-64.pdf

(10) FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

(11) FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

C.4 Article H: Access to HHS electronic mail

All contractor staff that have access to and use of HHS electronic mail (e-mail) must identify themselves as contractors on all outgoing e-mail messages, including those that are sent in reply or are forwarded to another user. To best comply with this requirement, the contractor staff shall set up an e-mail signature ("AutoSignature") or an electronic business card ("V-card") on each contractor employee's computer system and/or Personal Digital Assistant (PDA) that will automatically display "Contractor" in the signature area of all e-mails sent.

RFP#75P00120R00052_0001 Page 16 of 95

C.5 Confidential Treatment of Sensitive Information

The contractor shall guarantee strict confidentiality and nondisclosure of the information/data that it is provided by the Government during the performance of the contract. The Government has determined that the information/data that the contractor will be provided during the performance of the contract is of a sensitive nature.

Disclosure of the information/data, in whole or in part, by the contractor can only be made after the Contractor receives prior written approval from the Contracting Officer. Whenever the contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer.

C.6 Performance Metrics

The contract will contain the following performance standards and expectations:

Performance Standards

Quality Expectations

Completeness All submissions will be complete and compliant with all applicable regulations.

Accuracy All information submitted will be accurate.

Effectiveness All deliverables must contribute to the overall success of the contract.

Timeliness All deliverables will be on time and within Schedule.

Cost All work will be performed within the funding limit provided in contract.

Detailed Performance Metrics will be developed for each individual Task Order.

C.7 Acronyms:

ACH – Automated Clearing House ADA – Anti-Deficiency Act ARRA – American Recovery and Reinvestment Act AS – Accounting Services (PSC) BTO – Business Technology Officer CAS – Cost Allocation Services (PSC) C&A – Certification and Accreditation CCB – Change Control Board CFO – Chief Financial Officer CGI – Common Gateway Interface CO – Contracting Officer

RFP#75P00120R00052_0001 Page 17 of 95

COR – Contracting Officer’s Technical Representative COOP – Continuity of Operations COTS – Commercial Off The Shelf CIP – Critical Infrastructure Planning CIT – Center for Information Technology DHHS – Department of Health and Human Services DISA – Defense Information Systems Agency DMZ – A buffer zone that separates the internal network from the Internet EA – Enterprise Architecture EVM – Earned Value Management FAADS – Federal Assistance Award Data Source FARS – Financial Analysis and Reporting System FFATA – Federal Funding Accountability and Transparency Act FFMIA – Federal Financial Management Improvement FFR – Federal Financial Report FIPS – Federal Information Processing Standards FISMA – Federal Information Security Management Act FMFIA – Federal Managers Financial Integrity Act FMS – Financial Management Service FTP – File Transfer Protocol GRMA – Government Management Reform Act IGE – Independence Government Estimate IPIA – Improper Payments Information Act ISSO – Information Systems Security Officer HTML – Hyper-text Markup Language NAIC – National Agency Check and Inquiry NIH – National Institutes of Health NIST – National Institute of Standards and Technology O&M – Operations & Maintenance OCI – Organizational Conflict of Interest OLAP – On-Line Analytical Processing OMB – Office of Management and Budget PMP – Project Management Professional PMS – Payment Management System PO – Project Officer POA&M – Plan of Action and Milestones PSC – Program Support Center PPA – Prompt Payment Act PPIRS – Past Performance Information Retrieval System PWP – Project Work Plan RDBMS – Relational Database Management System SAB – Systems Accounting Branch SAS – Statement on Auditing Standards SCR – System Change Requests SDLC – Systems Development Life Cycle Services – Payment Management Services (PSC)

RFP#75P00120R00052_0001 Page 18 of 95

SF 1199 form – Direct Deposit Sign-Up Form SME – Subject Matter Experts SPS – Secure Payment System SSA – Source Selection Authority SSEB – Source Selection Evaluation Board ST&E – Security Testing Evaluation…