J.1 Task Order #1.pdf

J.1 Task Order #1 Page 1 of 62

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

The purpose of this contract is to efficiently and effectively support the operations, maintenance, modernization, and enhancement of the Payment Management System (PMS) application, infrastructure and associated financial management processes to support accurate, timely and complete processing of the Services Grant Payment activities/programs.

B.2 TYPE OF ORDER

This is a Firm Fixed Price Task Order.

B.3 SEVERABLE SERVICES

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

B.4 CONSIDERATION AND PAYMENT (Fixed Price – Severable Services)

In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid a fixed price for each CLIN (if exercised). If the options are exercised, funding will be obligated by modification to the contract. The base period and option periods are priced as follows:

Contract Period Fixed Price CLIN 1 Base Period CLIN 2 Option Period 1 CLIN 3 Option Period 2 CLIN 4 Option Period 3 CLIN 5 Option Period 4 CLIN 6 Option Period 5 TOTAL Potential Value inclusive of all CLINS

Payment shall be made upon the delivery and acceptance of the services required in accordance with the following payment schedule:

Payment Schedule to be proposed by contractor.

J.1 Task Order #1 Page 2 of 62

SECTION C - STATEMENT OF WORK

TITLE: Operations Support, Maintenance, and Enhancements (OSME) to the Payment Management System (PMS)

C.1. Introduction

The Department of Health and Human Services (DHHS), Program Support Center (PSC), Financial Management Portfolio (FMP), Payment Management Services (Services) is responsible for operations support, maintenance, and enhancements to the Payment Management System (PMS).

The Contractor shall support PMS and the Service as they manage, and report on the thousands of grant payments that the PSC/FMP/Payment Management Services is required to monitor by legislative mandate.

C.1.1 Background

The Payment Management Services within the Program Support Center (PSC) has over 30 years of experience providing grant and grant-like payments, cash management, and grant accounting support services to Federal Agencies. PSC uses a custom-developed PMS that provides awarding Agencies and Grant recipients the tools to manage grant payment requests and disbursement reporting activities. The PMS has been selected by the Chief Financial Officers Council - by authority of Office of Management & Budget (OMB) - as one of two non-Department of Defense (DoD) grants payment systems for use by the entire Federal Government. PMS leverages efficient business processes, state-of-the-art information technology, E-Government initiatives and business expertise to build a critical link in the operation of Federal Financial assistance programs. PMS is a full service centralized grants payment and cash management system. The system is fully automated to receive payment requests, edit them for accuracy and content, transmit the payment to either the Federal Reserve Bank or the U.S. Treasury for deposit into the grantee's bank account, and record the payment transactions and corresponding disbursements to the appropriate account(s).

The function of the PMS is to provide world-class grants payment and cash management services to HHS and other Federal and non-Federal entities. The PMS serves as a fiscal intermediary between awarding agencies and the recipients of grants and contracts. The PMS objectives are to provide:

Central standardized process for Federal grant payments

An efficient cash management of grant funds

On-line access to grant recipients for funds requests, grant account information, and the Federal Financial Report (FFR) SF-425

On-line access to awarding agencies for grant recipient account, payment, and financial information

J.1 Task Order #1 Page 3 of 62

Operational efficiencies through economies of scale.

Reports to Treasury, Federal Accounting Systems, and other Federal systems requiring reporting data

The PMS currently processes approximately $547 billion annually in Federal grant and grant like payments. The PMS customers include a wide variety of grant and grant-like recipient organizations totaling over 30,000 payee accounts. PMS is a FISMA HIGH system that currently disburses funds to approximately 131 countries throughout the world.

C.2. Purpose

The Purpose of this acquisition is to efficiently and effectively support the operations, maintenance, modernization, and enhancement of the PMS application, infrastructure and associated financial management processes to support accurate, timely and complete processing of the Services Grant Payment activities/programs. The Contractor shall provide the services as specified in each specific component below, and as prioritized by the Federal PMS team and the Contracting Officer’s Representative (COR).

The contractor shall provide all project management, functional and technical services to maintain and support the system including daily transaction processing, the reporting components, and day-to-day operations; ensure legislative compliance; carry out enhancements in support of the financial management of the agency programs; and ensure the security of the PMS. Currently PMS availability is limited to Monday – Friday 5:00 AM ET to 11:00 PM ET and Saturday & Sunday 9:00 AM ET to 9:00 PM ET; however, off-hours support will be required for various reasons (i.e. enhancement implementation, address unexpected system issues, emergencies, system security requirements, etc.) as well as any necessity to increase the system’s hours of availability.

C.2.1 Agency Mission

The mission of PSC/Payment Management Services to deliver the best value in grant payment services under a shared service approach, ensuring acquisition activities and general performance objectives are completed cost effectively in support of the needs and goals of PSC customers and PSC leadership.

C.2.2 Scope

PMS Overview

The primary functionality of the PMS consists of the following elements:

Recording award authorizations that are initiated by the grant awarding agencies

Processing grant recipient requests for funds

J.1 Task Order #1 Page 4 of 62

Reporting

The PMS currently runs on servers and limited mainframes housed at the National Institute of Health (NIH). The physical maintenance of these machines is not within the scope of this Statement of Work, however various components of the operating system administration is within the scope of this Statement of Work as outlined in section C.2.2., below. The PMS is not a single application, but is made up of various web pages, web based applications, workflows, databases, UNIX and Windows based servers, specially configured routers, virtual private networks (VPNs), file servers, commercial-off-the-shelf products (COTS) and custom developed programs, and data analytics solutions.

The objectives of the PMS are to provide a central point for grant and program payments;

efficient cash management; capability for recipients to request funds on-line; on-line access to payment and disbursement information by awarding agencies & delegates, and to obtain operating efficiencies through economies of scale.

Various organizations work together so that PMS can make payments to recipients. These organizations and their responsibilities are summarized below.

Awarding agencies are responsible for:

Registering recipients (PSC currently performs this function for cross serviced agencies)

Issuing award notices

Transmitting authorization data to PMS

Monitoring programs and grants

Closing out awards

Reconciling their accounting records to PMS

Recipients are responsible for:

Executing grants

Maintaining minimum federal cash on hand

Reporting cash disbursements through PMS

Maintaining their own accounting records

Filing expenditure reports with awarding agencies

The Payment Management Services personnel are responsible for:

Extracting payment requests from the PMS and transferring the data to the Federal Reserve System

Managing cash flow to recipients

Performing recipient account management

Maintaining recipient liaison

Reporting disbursement data to awarding agencies

Debt collection

J.1 Task Order #1 Page 5 of 62

Maintaining system controls in compliance with appropriate policy, rules, regulation, and laws

The Department of Treasury is responsible for:

Establishing cash management policies

Operate the Treasury Secure Payment System (SPS)

Delivering funds to recipients

The Federal Reserve Banks are responsible for:

Making direct deposits to recipients bank accounts

Operating the Fedline Advantage System

The recipient’s financial institution is responsible for:

Receiving wire and ACH payments for credit to recipients accounts

Maintain recipient bank accounts

Current approximate data and account volumes (as of Jan 2019) are summarized below for reference:

Number of active PSC users 52 Number of active non-PSC users (i.e. grantee & grantor users)

25274

Number of grantors 1936 Number of grantees 23338 Average number of new grantees per quarter JAN_MAR_2018 - 914

APR_JUN_2018 - 1126

JUL_SEP_2018 - 1562

OCT_DEC_2018 - 1773

Number of inbound interfaces 33 Number of outbound interfaces 235 Number of open grants administered 200248 Average number of grant payments per week 12/31/2018 - 4506

01/07/2019 - 8227 01/14/2019 - 8818 01/21/2019 - 7600 01/28/2019 - 7934

Average number of 1199s per week 115 Average number of 272’s per quarter JAN_MAR_2018 - 25334

APR_JUN_2018 - 25043

JUL_SEP_2018 - 25234

OCT_DEC_2018 - 24921

Number of custom code components Modernization Application components - 839 DB code components/Oracle packages – 5801 Unix code Components

J.1 Task Order #1 Page 6 of 62

SQL scripts : 144 shell scripts : 104 image files : 164 HTML and CSS files : 536

Number of physical servers Windows – 7 virtual servers Solaris – 13 servers

Number of PMS instances 13 Number of major enhancements for FY’18 14

Number of minor enhancements for FY’18 22 Number of bug fixes for FY’18 0

Organizational Structure/Stakeholders

The FMS PMS Management structure consists of

A Government Contract Officer’s Representative (COR) who shall be responsible for the overall success of the PMS project, ensuring adequate coordination among the various management components.

Financial Management Portfolio (FMP), which is responsible for providing a full range of financial reporting and accounting services that meet strict Federal financial management system requirements and applicable Federal accounting and transaction standards. FMP is comprised of the Office of the Director and three Divisions: Accounting Services (AS); Cost Allocation Services (CAS); and the Payment Management Services (PMS). FMP also interacts regularly with the other PSC portfolios.

The Payment Management Services (Services) maintains responsibility for all grant payment responsibilities and is the primary user and stakeholder of the PMS. The Services serves as the financial intermediary between awarding agencies and grant recipients. The Services uses the PMS to perform and document payment-related grant activities for HHS and other federal agency clients. The PMS application is used to process grant payments for the majority of federal grantees. Some of the services offered include:

Next-day payments through the Automated Clearing House electronic network for financial transactions in the United States.

Cash management services that support the Cash Management Improvement Act

Professional grant account support services including helpdesk, training, reporting, and audit support.

A Change Control Board (CCB) which shall serve as the primary authority for reviewing and approving (or disapproving) those changes to the software or requirements that affect PMS

J.1 Task Order #1 Page 7 of 62

Compliance with Treasury oversight and requirements under delegated disbursing authority

C.3. Contract Tasks

The effort is comprised of several Tasks, which are listed in this Section and includes Operations & Maintenance (O&M) and related activities as described in the following Sub-Tasks C.3.1, C.3.2, C.3.3, C.3.4 and C.3.5

C.3.1 Project Management

C.3.1.1 The contractor shall establish Project Management standards that shall be delivered throughout the period of performance of the contract for all services. These standards consist of the following:

C.3.1.2 The contractor shall provide project management services regarding the delivery of the services within the Statement of Work. Project management standards and industry /government leading practices shall be expected of all tasks performed by the contractor. The Project Management component of this Statement of Work includes initial project management activities once on-boarded, and establishment of and adherence to project management standards throughout the period of performance.

Due to the FISMA HIGH rating of the PMS application, a proposed Project Manager with an existing certified Six Sigma Green Belt (or higher) and/or Project Management Professional (PMP) is preferred.

C.3.1.3 The contractor shall be required to develop and adhere to a Project Management Plan that incorporates policies, standards and concepts to the delivery of all the services and operations under this Statement of Work. The contractor shall incorporate industry and government leading practices to develop and adopt a project management model that the contractor shall use throughout the period of performance. The Project Management Plan shall include but is not limited to a Scope Management Plan, a Quality Management Plan, a Communication Management Plan, and a Risk Management Plan. The Project Management Plan shall be routinely reviewed and tasks will be prioritized by the Federal PMS team.

C.3.1.4 The contractor shall be required to adopt and adhere to HHS’s Enterprise Performance Life Cycle (EPLC) plan which incorporates policies, standards and concepts, which shall apply to all software development and coding activities delivered under this Statement of Work.

The Department of Health and Human Services (HHS) Enterprise Performance Life Cycle (EPLC) is a framework to enhance Information Technology (IT) governance through rigorous application of sound investment and project management principles and industry’s

J.1 Task Order #1 Page 8 of 62 best practices. The HHS EPLC provides the context for the HHS IT governance process and describes interdependencies between its project management, investment management, and capital planning components.

The goals of the EPLC framework are to:

Provide a coherent and effective methodology to guide HHS IT investment and project management to ensure that enterprise needs are met.

Promote the effective and consistent use of investment and project management principles and industry best practices to consistently deliver IT capabilities that provide maximum support to HHS business needs within approved cost and schedule baselines.

Enhance the HHS IT governance process by effectively integrating IT investment planning, execution, management, and oversight.

Ensure Critical Partner and stakeholder functions are performed throughout the life cycle of investments to include timely, effective multi-disciplinary reviews of IT investments and reports on them to the HHS IT Governance Bodies for their assessment of investments within the context of the HHS enterprise-wide IT portfolio.

C.3.1.5 The contractor shall be required to develop and adhere to an Information Technology Service Management plan which incorporates policies, standards and concepts which shall apply a customer-centered focus to the delivery of the information technology services and operations under this Statement of Work. The contractor shall incorporate industry and government leading best practices to develop and adopt a service delivery model, which the contractor shall use throughout the period of performance.

C.3.1.6 The contractor shall conduct an assessment of the existing PMS change control process including the existing change control board and provide recommendations regarding the change control process. Recommendations shall include any industry and governmental leading best practices as well as operational and process efficiency opportunities. Upon review and acceptance of any recommendations the contractor shall implement such changes.

C.3.1.7 The contractor shall submit a detailed Project Work Plan (PWP) of their technical approach of how they shall accomplish the support for Operations, Maintenance, Modernization, as well as Basic Enhancements. The Plan is to be developed using Microsoft Project, however, the PSC may change the project management software in use if PSC standards change. The contractor shall have 90 days to convert if the standards change. The PWP shall follow the steps below:

J.1 Task Order #1 Page 9 of 62

a) The PWP shall show all the components scheduled with major milestones and target dates.

b) Incorporate Communications Plan into PWP to assist HHS Leadership to prepare stakeholders for the expected change with regard to new programs, enhanced functionality etc. and identify resulting impact on process owners’ roles and responsibilities.

c) Periodic updates of the PWP.

d) Provide Earned Value Management reports on all enhancements, upgrades and implementation of new programs.

C.3.1.8 The contractor shall prepare a comprehensive Communication Plan that will be inclusive of system notices, system changes, and system updates. The Communication Plan shall include: a stakeholders/audience analysis; identify communication events, formats, and timing; and provide an overall framework for communication throughout the period of performance. Additionally the Communication Plan shall include a schedule and format for Status Reports and Status Meetings.

The contractor shall participate in user meetings upon the request of the COR or Service Director.

C.3.1.9 The contractor shall prepare a comprehensive Quality Assurance Plan to be considered completed once approved and accepted by the COR. The Quality Assurance Plan shall assure the software development and control processes described in the Project Management Plan are correctly carried out and that the project's procedures and standards are followed. Products are monitored for conformance to standards and processes are monitored for conformance to procedures. Review of the Management Plan shall ensure that appropriate approval points are built into these processes.

C.3.1.10 The contractor shall provide a written weekly status report to the COR and conduct a weekly status meeting with the COR and/or the Information Systems Branch Chief or his/her designee(s). This status report shall include at a minimum: a review of activities completed in the previous week, the activities scheduled for the previous week but not completed, the activities scheduled for the coming week, any identification of issues, risk assessments along with recommended solutions, and contractor staff availability (e.g. scheduled leave) over the coming 60 days. The COR may include any other personnel (governmental or non-governmental) in the weekly status report and meeting as per their discretion. The COR may request additional details as necessary to monitor and track progress and resources. The contractor shall take meeting minutes during the weekly status report and provide them to the COR.

C.3.1.11 The contractor shall provide a monthly Earned Value Management (EVM) report covering all activities to the COR. The EVM report shall include Earned Value calculations, a comparison to actual costs and planned costs; these shall be used in the determination of project performance and

J.1 Task Order #1 Page 10 of 62 prediction of future performance trends. The report shall also include actionable recommendations based on the EVM analysis.

C.3.1.12 Other contractors may be performing other PSC/PMS support services in areas associated with the requirements of this contract.

The Government shall facilitate initial contact between the contractor and other contractors. The contractor shall provide all further required coordination with other contractor personnel for any component specified in this contract that relates to or impacts any other contracted work.

It is expected that other PSC, FMP or Payment Management Services contractors may at times review work performed under this contract and provide advice and consultation to facilitate the successful implementation of a specific project.

C.3.1.13 The contractor shall participate in any PMS modernization and/or enhancement initiatives undertaken by HHS, PSC, FMP, and the Service. This includes but is not limited to:

a) Maintaining project management support for all services under this component of the Statement of Work during any phase or component of any PMS modernization/enhancement initiatives.

b) Participating in any meetings, workshops, work groups or working sessions related to PMS modernization/enhancement initiatives.

c) Participating in and /or attending any training related to PMS modernization/ enhancement initiatives.

d) Providing all project management services under this component regardless of any changes to the PMS that may result from any PMS modernization/enhancement initiatives.

The contractor shall not be required to serve as the primary implementer or integrator for any PMS modernization initiatives under this component (i.e. C.2.1.) of this Statement of Work.

C.3.2 Operations and Maintenance Support

A major component of this Statement of Work shall be the normal Operations and Maintenance Support of the Payment Management System and supporting finance, reporting and business processes. The contractor shall provide all functional and technical services to maintain and support the system including the reporting components, and day-to-day operations. The contractor shall provide Operations and Maintenance support services of

J.1 Task Order #1 Page 11 of 62 both a functional and technical nature. These services include Information Technology services, Business Analysis services, accounting services, and Financial Management services. The contractor shall provide staff that have in-depth experience in these areas and shall serve as Subject Matter Experts in all aspects of Operations and Maintenance support of the Payment Management System.

C.3.2.1 As stated above in section C.3.1., the contractor shall adhere to project management, EPLC, IT Service Management, EVM and status reporting standards throughout the delivery of all services throughout the period of performance.

C.3.2.2 The contractor shall provide daily operational support to internal and external PMS users and stakeholders. This support includes but is not limited to:

a) Responding to requests and questions

b) Troubleshooting and resolving functional and technical errors, problems or requests

c) Maintenance of Standard Operating Procedures

d) Processing of PMS transactions

e) Processing, validating and troubleshooting of inbound and outbound interfaces

f) Validating and or reconciling of system generated files

g) Supporting PSC cybersecurity-related activities, including vulnerability and threat identification, and maintaining a historical log of all findings resulting from the system security activities being supported

C.3.2.3 The contractor shall be responsible for maintaining the integrity and accuracy of the data stream between the PMS and other systems including HHS accounting systems, grant awarding agency-specific systems and any other external systems. This shall include but is not limited to; file transmission validation, timely reconciliation, reporting, exception handling, and data recovery based on PMS unscheduled down time.

C.3.2.4 The contractor shall provide PMS application functional support services including functionality analysis, business process analysis, participation in testing, etc. to support the development, maintenance, and operation of the PMS. These functional support services include but are not limited to:

a) Serving as the application functional subject matter experts. The government recognizes that since a number of components of PMS have been developed in-house, the contractor staff may not have specific detailed PMS functional knowledge

J.1 Task Order #1 Page 12 of 62 at the outset of the delivery of services. However, based on the knowledge transfer component outlined in section C.3.5 below, the contractor shall develop detailed PMS functional knowledge and shall serve as PMS functional SMEs throughout the period of performance.

b) Providing analyses and recommendations regarding PMS functionality.

c) Participating in and providing input to any functionality analysis performed regarding

PMS.

d) Provide expertise during implementation/stabilization of new system functionality.

e) Maintain PMS Functionality within current industry standard practices. Any foreseeable changes need to notify PMS management staff well in advance.

f) Ensuring PMS Functionality is compatible with past, present, and future web browsers.

g) PMS Functionality is accessible from mobile devices.

C.3.2.5 The contractor shall provide PMS application technical support services including analysis, development, testing, and implementation of software to support the development, maintenance, and operation of the PMS. These technical support services include but are not limited to:

a) Serving as the application technical subject matter experts. The government recognizes that since a number of components of PMS have been developed in-house, the contractor staff may not have specific detailed PMS technical knowledge at the outset of the delivery of services. However, based on the knowledge transfer component outlined in section C.3.5 above, the contractor shall develop detailed technical knowledge and shall serve as PMS technical SMEs throughout the period of performance.

b) The contractor shall engage in all of the software change activities required for the operation and enhancement of the PMS utilizing established project management standards identified above in section C.3.1.

c) The contractor shall be responsible for all development and coding efforts for the PMS related to any enhancements, bug fixes, troubleshooting, system changes, reporting and reconciliation.

d) The contractor shall provide documentation, analyses, and recommendations to the COR and /or other parties regarding all enhancements bug fixes, troubleshooting, system changes, reporting and reconciliation.

e) For all development and coding efforts, the contractor shall be responsible for all related analysis, design, build, test, deployment, and documentation activities.

f) The contractor shall participate in all meetings that are necessary to determine the nature and solutions to operational problems when requested by the Government.

J.1 Task Order #1 Page 13 of 62

g) The contractor shall deliver soft copies, electronic media, appropriate notes, test results, and all levels of documentation related to all development and coding efforts for the PMS to the COR or designee in a format that compatible with existing PSC documentation, change control and configuration management tracking systems.

h) The contractor shall provide off-hours support for any emergency operational issues related to the availability or integrity of the PMS application within one hour of issue discovery.

i) The contractor shall provide off-hours support for any system enhancement or other implementation effort as these activities cannot be performed during hours of availability.

j) The contractor shall support the HHS Enterprise Architecture (EA) program. The Department’s EA program complies with Federal EA standards, and collaborates with other pertinent government-wide initiatives.

To meet the requirements of the OMB A-130 (Management of Federal Information Resources) requirements and the HHS EA, the contractor may be required to provide the following:

Document the relationships among business and management processes and information technology

Ensure alignment of the requirements for information systems with the processes that support the agency's missions

Ensure adequate interoperability, redundancy, and security of information systems

Support and enforce the application and maintenance of a collection of standards (including technical, business process, service, and data standards) by which the agency evaluates and acquires new systems

C.3.2.6 The contractor shall be responsible for establishing and maintaining the infrastructure necessary to ensure the secure operation of the PMS.

a) The contractor shall participate directly with the PMS hosting facility (currently NIH/CIT) in all engineering aspects of the general maintenance and performance tuning of all PMS related servers, databases, applications, and web server components. This shall include operational support and monitoring, database capacity planning, configuration management, security patch support, and system-level problem troubleshooting and repair. It is expected that all UNIX system level configuration modifications (database installs, patches, upgrades, and resource usage, etc.) be carried out by CIT as directed by the Payment Management Services and as recommended by the contractor. It is expected that all operating system (such as Microsoft Windows) level configuration modifications (database installs, patches, upgrades, and resource usage) be carried out by the contractor as directed by the Service.

J.1 Task Order #1 Page 14 of 62

b) The contractor shall provide Systems Administration and engineering aspects of the general maintenance and performance tuning for servers, firewall maintenance, failover support, and data replication for the Customer Service Area (CSA2) currently at NIH in Bethesda, as well as in the designated Disaster Recovery (DR) site(s).

c) The contractor shall develop and support the scripts that are necessary to control the online, batch, backup processes, and other operation support activities for the PMS.

d) The contractor shall interact with the CIT Oracle system administrators regarding the resolution of Oracle errors generated by PMS, the establishment of database monitoring parameters, configuration management to the PMS processors, and the Oracle web listener parameters.

e) The contractor shall participate in all engineering aspects of the general maintenance of application Windows and UNIX files and directories of the PMS hosted machines and the monitoring of PMS hosted machines. This shall include basic operational support and monitoring, application capacity planning and system-level problem troubleshooting and repair. It is expected that all root privilege activities be addressed by CIT as directed by PSC and as recommended by the contractor.

f) The contractor shall establish procedures to capture system related activity related to each of the database instances in the form of logs and audit files. The contractor shall review these system generated files for abnormalities and bring them to the attention of the Government COR.

g) The contractor shall support and maintain all other environments and database instances such as disaster recovery environments, backup systems, test databases, pre-production, and training database with regard to refresh and backup as necessary.

h) The contractor shall support the several different levels of auditing that occurs within the PMS infrastructure. These levels of auditing include RDBMS auditing, listener service auditing, application auditing, and logging whenever database maintenance activity occurs.

i) The contractor shall participate in fulfilling the information requests for various audits and reviews the PMS must comply with. These include, but are not limited to, the SSAE 16 audit (aka SOC 1), A-123 reviews, DISA Data Base STIG, Authority to Operate (ATO), and System Test and Evaluation (ST&E). Plan of Action and Milestones (POAM) are the more notable mechanism for tracking resolution to weaknesses and findings.. The contractor shall meet the documentation requests for data, procedures, documentation, or test results as requested by the auditors and reviewers performing

J.1 Task Order #1 Page 15 of 62 these activities by extracting existing document, updating data extracts, or through the preparation of documents where they do not exist.

j) The contractor shall participate in all disaster planning, execution of disaster tests and implementation of remediation efforts.

k) The contractor shall participate in penetration testing and other cybersecurity scans, and collaborate with external organizations supporting PSC cybersecurity-related activities.

This may include external vendors, HHS OCIO, the PSC Office of the Director, and the PMS Federal team.

l) The contractor shall review and support the file transfer procedures that are used to move files in and out of the PMS secure environment. The majority of the files being exchanged with agency systems utilize the DropBox Server which the contractor shall support. Several agencies, utilize the NIH/CIT Titan Mainframe processor for the exchange of files. The contractor shall be responsible for maintaining the processes operating on the Titan processor also.

m) PMS has recently implemented WebServices as a means of improving its services portfolio and meeting its customers’ needs. It is anticipated that this service offering, although rather new to PMS, will be significantly enhanced and broadened over the near future. The contractor shall assist the Service by providing expertise to most effectively apply this technology to additional areas of the PMS environment.

n) The contractor shall address all other application tool-related areas that are required to support the PMS. This shall include any support necessary to facilitate issue resolution.

This also includes, but is not limited to, version upgrades, new tools sets, and system auditing support.

o) The contractor shall support the maintenance and operations of procedures and various tool sets such as UNIX scripts, scripts, and desktop software such as Toad. Support shall also be provided for use of external data sets used by the PMS to include USP files, CCR, FIPS, CFDA, etc.

p) The contractor shall perform Logical and Physical data model documentation and maintenance as they pertain to object definitions, PMS changes, and database sizing, based on existing models previously developed. The contractor shall be responsible for the configuration management of logical and physical data models. Contractor shall create and maintain system diagrams of database(s), database relationship diagrams (e.g.

E-R diagrams) of PMS in a logical manner. These documents are to be kept up to date as directed by the COR.

J.1 Task Order #1 Page 16 of 62

q) The contractor shall participate with the NIH/CIT and provide expert support in the analysis leading to a replacement of the PMS processors, testing, and the conversion to the new platform.

r) The contractor shall provide support to Microsoft SharePoint. This product is being used to organize and support all Services documentation including response regarding the operation, policy, and procedures of the PMS.

s) The contractor shall be required to utilize SharePoint in the development of documents to satisfy the audit and reviews described above and shall use the product to support work flow processes where approvals are required prior to proceeding to next steps.

t) The contractor shall be expected to support the processes, documentation, and software that comprise the latest legislative requirements such as: the DATA Act (to include USASpending);

u) The contractor shall provide daily audit logs for review.

v) The contractor shall provide diagrams and procedures to support the conversion to any new processing platform.

w) The contractor shall be responsible for activity supporting the integration of the Payment Management Services network with the requirements of the PMS application and application security.

x) The contractor shall be responsible for activity monitoring/supporting/updating the several layers of security infrastructure that generally consists of:

Firewall hardware and software;

RSA Secure Servers with tokens;

Multiple DMZs;

VPN servers;

Intrusion detection hardware and software;

Virus, Malware administration processor

Periodic system scans – credentialed and un-credentialed, including logging

Periodic penetration testing and logging

y) Additional servers are installed to support the Services web page, the configuration management process, data archive, file servers, and a processor for On-Line Analytical Processing (OLAP). The contractor shall be responsible for providing an environment in which the PMS web page operates in a secure manner. The contractor shall maintain all

J.1 Task Order #1 Page 17 of 62 hardware, keep operating system and software versions current, provide backup and recovery services and ensure all parts work together that supports the integrity of the webpage. The contractor shall perform web page updates as necessary.

z) The contractor shall be responsible for providing an environment in which the PMS operates in a secure manner. This responsibility shall include activities such as maintaining and configuring the PMS and CIT firewalls consistent with the application needs; the establishment of network configuration layers that is consistent with the access requirements and data sensitivity of the PMS; establishment of virus scans; and the review of firewall logs to determine penetration attempts; the establishment of two factor authentication through the PMS environment; the management of the authorization and authentication through the RSA servers and software; building, maintenance and tuning of the Services virtual private networks (VPN) shall be required to minimize risk from users who require access to the PMS databases outside of the application.

aa) The contractor shall perform the duties necessary to design, engineer, and maintain the communications infrastructure necessary that shall allow PMS users to connect to the application in a secure manner.

C.3.2.7 The contractor shall utilize all existing PSC/FMP systems, tools, standards and processes for systems documentation, configuration management, change management, code version control and migration.

C.3.2.8 The contractor shall provide services in the development and maintenance of the PMS web page as well as the web page Content Management System. This system allows non-technical staff to change the text portion of the PMS web page without knowledge of specific coding, such as HTML.

The following technologies to support the Services Web page:

a) HTML Authoring. HTML 2.0, 3.0 and other extensions; e.g., tables, frames, server-push/client-pull, server-side includes

b) CGI Scripting. Perl, C, and UNIX shell scripts.

c) Graphic Design Capability. Graphics applications and techniques e.g. Photoshop, Fractal Painter, 3D Modeling

d) Internet Awareness. Internet technology is required, such as download time/bandwidth, content driven pages, graphics vs. text, browser compatibility.

e) Internet Protocols. Service ports, name servers, Email, USENET, HTTPS, s FTP, UNIX, etc.

J.1 Task Order #1 Page 18 of 62

C.3.2.9 The contractor shall provide security-consulting services to insure the PMS Security Architecture evolves to incorporate the latest technologies and security requirements, and to be able to respond to the evolving threats. This ongoing review and monitoring of the Security Architecture must be consistent with the PMS designation of a Level 3 (FISMA “HIGH”) System, which disburses over $2 billion a day.

C.3.2.10 The contractor shall be responsible for performing a number of activities so that the COOP laptops, located with the Payment Management Services, are secure and operate in a manner to allow the Services staff and contractors to support the Payment Management System. These activities include - but are not limited to - the following:

a) Anti-virus Management – ensure that the most recent anti-virus software is installed and maintained on each COOP laptop/devices.

b) Patch Management – ensure that all software loaded on the laptop is current, the licenses are current, and all security patches are maintained as current.

c) Spyware/malware prevention – ensures that appropriate software to remove spyware and other malicious software is loaded and maintained as current.

d) Account Maintenance – all software running on the laptop shall have current licenses.

The contractor shall perform the administrative duties to inform the Services of the requirements and details to insure timely procurement of licenses.

e) File Maintenance – the contractor shall provide software to provide backup and restore capabilities at the desktop.

f) Hardware Support – the contractor shall perform hardware support with regard to the allocation of desktop equipment within the Services and ensure the equipment is connected properly to the networks that are needed to support the user functions. For those hardware issues that cannot be resolved, the contractor shall assist with information so that the Payment Management Services can acquire the necessary services.

g) Software Support – the contractor shall assist the Services staff with problems related to the MS Office Suite and coordinate issues with the HHS OCIO/ITIO support team.

C.3.2.11 The contractor shall be responsible for transferring PMS application functionality knowledge to the PMS users especially around new releases and /or at the time of new hires as per the direction of the COR. This includes the development and maintenance of training material. The contractor shall provide ongoing training workshops to new and current users regarding system configuration and procedures as requested with supporting documentation. Similarly, the contractor shall be required to provide training and / or knowledge transfer workshops to PSC personnel (on COR’s request) to optimize processes and procedures for running and troubleshooting the applications.

C.3.2.12 The contractor shall maintain / update the documentation and facilitate the activities pertaining to the system Authority to Operate (ATO) including but not limited to the following:

J.1 Task Order #1 Page 19 of 62

a) Risk Assessment Plan/Risk-based Decisions

b) System Security Plan

c) Security Controls Assessment (SCA) a/k/a Security Testing Evaluation (ST&E)

d) Plan of Action & Milestones (POAM)

e) IT Contingency Plan/Business Continuity Plan

Additionally, the PMS has an extensive set of documentation that describes the security that protects the system. A critical part of this mix is the Authority to Operate (ATO) and the Project Matrix (Critical Infrastructure Planning) CIP infrastructure report. The contractor shall be aware of the content of these and all supporting infrastructure / security documentation and shall maintain it in the event of changes. Update of the changes shall also be provided by the federal staff to the PSC Business Technology Officer (BTO) and Information Systems Security Officer (ISSO) and System Owner (SO).

C.3.2.13 The contractor shall be responsible for the maintenance of multiple PMS environments for use in development, testing, and training activities. The contractor shall ensure that all environments are synchronized with the latest patches, bug fixes and versions of all software and hardware components. The contractor shall ensure that any new bug fixes and or software changes undergo testing in multiple environments to ensure that all code is stable and fulfils the intended requirements prior to implementation in the Production System. At a minimum, the contractor shall maintain Production, Development, Test, and Training environments. Additional environments may be necessary based on business or IT development needs.

C.3.2.14 The contractor shall be responsible for participating in any Payment Management Services or PSC Continuity of Operations (COOP) Tests, Training and Exercises (TT&E). Additionally the contractor shall participate in any remediation efforts based COOP TT&E findings. Furthermore, in the event of any disruption to normal operations, the contractor shall execute all duties assigned under the COOP plan. Such activities may include but are not limited to performing duties at alternate work locations, re-prioritization of work assignments, suspension of services for non-mission essential functions, serving as a backup or secondary resource for performing mission essential functions.

C.3.2.15 The contractor shall participate in any PMS modernization initiatives undertaken by HHS, PSC, FMP and the Services. This includes but is not limited to:

a) Maintaining operations and maintenance functional and technical support for all services under this component of the Statement of Work during any phase or component of PMS modernization initiatives.

b) Providing PMS functional or technical support and input to any PMS modernization initiatives.

J.1 Task Order #1 Page 20 of 62

c) Participating in any meetings, workshops, work groups or working sessions related to PMS modernization initiatives.

d) Participating in and / or attending any training related to PMS modernization initiatives.

e) Providing all Operations and Maintenance Support services under this component regardless of any changes to the PMS that may result from any PMS modernization initiatives.

C.3.2.16 The contractor shall plan, schedule and conduct the weekly Change Control Board (CCB) meeting. This includes preparing and publishing the meeting agenda, taking meeting minutes, documenting action items, recording votes, and distributing all related communications.

C.3.2.17 The contractor shall maintain the Services written Standard Operating Procedures (SOP).

These SOP includes the daily processes as well as the month-end, quarter-end and year-end processes.

C.3.2.18 The contractor shall provide technical support services to maintain the automated testing environment for PMS. The Services test tool system includes established automated test procedures, a test tool system and documentation. The contractor shall develop and execute test procedures to support the automated testing of PMS. The contractor shall design, program, and perform testing of the testing sub-systems. The contractor shall provide system and regression testing for all System Change Requests (SCRs). The contractor shall provide training to FMS staff on the use of the Test Tool.

C.3.2.19 The contractor shall provide Tier 3 Support to include providing technical support for issues that involve a system problem and/or require administrative access, special technical skills, or system changes to resolve. Tier 3 support performs detailed root cause analysis and initiates software changes if necessary to resolve issues.

C.3.3 Operational Reporting, Financial Reporting and Financial Management

The contractor shall provide management reporting, operational reporting, systems reporting, and financial reporting services. These reporting services consist of establishing and adhering to report development standards, developing reports, and generating reports.

C.3.3.1 The contractor shall be required to develop report development standards which adhere to the overall EPLC plan and incorporates policies, standards and concepts which shall apply to all reporting activities delivered under this Statement of Work. The contractor shall incorporate industry and government leading practices to develop and adopt report development standards which the contractor shall use throughout the period of performance.

C.3.3.2 The contractor shall develop and generate management reports

J.1 Task Order #1 Page 21 of 62

a) Project status reports

b) Executive reporting dashboards

C.3.3.3 The contractor shall develop and generate operations reports

a) Generation of existing reports

Operation performance reports

Systems performance reports

Intrusion reports

b) Development of new and existing reports to include tools such as the Oracle’s Application Express (APEX)

c) Ad-hoc reporting

C.3.3.4 The contractor shall develop and generate financial reports

a) Generation of existing reports

b) Development of new reports

c) Ad-hoc reporting

C.3.3.5 The contractor shall provide advice and recommendations regarding PMS reporting capabilities, standards, development and tools.

C.3.4 Systems Security, Internal Controls and Compliance

The contractor shall provide systems security, internal controls and compliance advisory services to the Payment Management Services regarding Federal internal controls related statutes, laws, Executive Orders and regulations that will ensure all certifications and Authority to Operate. In performing this component, the contractor shall:

C.3.4.1 The contractor shall conduct an annual assessment and report on the effectiveness of existing internal controls and financial reporting. The contractor shall provide assistance in developing any corrective action plans to implement necessary mitigation controls to address identified findings.

C.3.4.2 The contractor shall provide advice and guidance on effective controls and accountability for all information systems and financial transaction.

J.1 Task Order #1 Page 22 of 62

C.3.4.3 The contractor shall provide documentation and training support to the Services staff as necessary for systems security, internal controls and compliance activities, requirements and initiatives.

C.3.4.4 The contractor shall analyze any audit findings, conclusions, and recommendations.

Formulate recommendations and alternatives for corrective actions related to business processes, accounting, financial management, internal and management controls, and other HHS directives.

C.3.4.5 The contractor shall assist in the implementation of corrective actions, and provide assessments of the impact of mitigation alternatives based on any audit findings.

C.3.4.6 The contractor shall…