Attachment 1 - Draft requirements IT support services FINAL_Amendment 0002.docx

Attachment 1 IT Support Services Draft Requirements Federal Election Commission Office of the Chief Information Officer Applications Branch

Section C – Statement of Work C.1 Introduction The FEC was created by Congress in 1974 to administer and enforce the Federal Election Campaign Act (FECA) - the law that governs the financing of federal elections. The duties of the FEC are to disclose campaign finance information, to enforce the provisions of the law such as the limits and prohibitions on contributions and to oversee the public funding of presidential elections.

The Applications Branch ensures agency employees have software and other technology that allows them to perform their day-to-day responsibilities administering and enforcing campaign finance law. The branch is responsible for developing and supporting analytic reporting tools that help staff perform their disclosure and compliance duties.

In addition, the branch supports systems that serve as the public’s primary source of campaign finance legal resources. In this way, the Applications Branch and OCIO serve a pivotal role in ensuring the FEC protects the integrity of the federal campaign finance process by supporting the agency's legal and compliance staff in their objectives of promoting compliance with and interpreting FECA and the related statutes and by ensuring that the public has access to reliable data describing how candidates raise and spend funds to support their campaigns.

C.2 Project Description C.2.1 IT Support Services Operate, maintain and update Application Branch applications and systems. Refer to Section C and the attachments listed in Section J.

C.2.2 Informatica Tool Expert Informatica tool expert (Informatica administrator) must have the required expertise to patch and upgrade the agency’s Informatica servers and maintain, modify and create new mappings.

C.3 Scope The contractor will be responsible for completing all tasks necessary for daily operations and application maintenance, updates, upgrades and security. All Java/Apache Tomcat and .Net applications have the latest software and security patches applied. All Application Branch applications are deployed in the FEC’s AWS cloud environment. As legislative, regulatory and policy requirements change, many of these applications must be regularly updated to meet the new specifications.

The contractor will also be responsible for completing FECs Database tier migration from Amazon RDS to Amazon Aurora PostgreAQL (See Attachment 1A – FEC Searchable Legal Systems). This migration is currently underway and is expected to be completed by the end of 2026.

C.3.1 Searchable Legal Applications

See Attachment 1A. FEC Searchable Legal Systems

C.3.2 Disclosure Applications

See Attachment 1B. FEC Disclosure Suite

C.3.3 Reports Analysis (RAD) Modules

See Attachment 1C. FEC RAD Modules

C.3.4 Crystal Reports The Disclosure Applications and RAD Modules use Crystal Reports to provide FEC business offices with various reports.

C.3.5 Informatica Informatica is used within the Disclosure Applications and RAD Modules as part of the managed services CLIN of this requirement.

The Informatica tool expert (Informatica administrator) CLIN of this requirement is for a resource with the required expertise to patch and upgrade the agency’s Informatica servers and maintain, modify and create new mappings.

C.3.6 Database management The FEC uses a mix of Oracle and PostgreSQL to support our applications.

C.4 Requirements C.4.1 General Performance The contractor will be required to use commercial, innovative, and/or state-of-the-art practices and techniques that best meet the government’s requirements. The contractor shall provide the necessary management, supervision, labor, and administrative support, for the accomplishment of services. The contractor shall plan, schedule, coordinate and ensure the full, effective, efficient, and economical performance of all services ordered under this contract. The contractor must designate a project manager as key personnel to attend all scheduled meetings.

C.4.2 Kick-off Meeting The contractor and COR will have an initial Kick-off Meeting to review the contractors’ technical approach associated with this FFP requirement, overall project schedule, and any other information that would be useful to FEC management.

C.4.3 Documentation The contractor shall maintain all documents of record indicating information and decisions throughout the course of this FFP contract.

C.4.4 Project Contact Directory The contractor will be required to submit a Project Contact Directory. This shall include project team member names, agency/company, role/responsibility, phone numbers, and emails. It must be updated regularly. The Project Contact Directory shall be submitted five business days after award.

C.4.5 Weekly Meetings When scheduled, the contractor’s key team members are required to call in to all scheduled meetings for this project. The COR or the Program Manager may call unscheduled meetings with four-hour notice to the contractor.

C.4.6. Monthly Meetings with Business Owners The contractor shall have a monthly planning and status meeting with the COR and business owners of the applications during which the status reports submitted under C.4.8 are presented.

C.4.7 Meeting Minutes The contractor will document all project meetings and other conferences. These documents/meeting minutes are due one (1) business day after the meeting or call is held (upon request).

C.4.8 Status Reports The contractor will submit status reports once every two weeks and upon request. Status reports are to be presented in typed form. Acceptable formats for electronic documents include all Microsoft formats (Word, Excel, Power Point, Project, Visio, etc.) and PDF. Reports shall be issued to the COR.

C.4.9 Tracking Work The FEC uses Jira to track work. The COR (Contracting Officer’s Representative) and contractor will work with the users to ensure that the Jira tickets are prioritized appropriately. The contractor will provide a level of effort for each ticket to help in this effort. This activity will be covered in bi-weekly status reports.

C.4.10 Maintain Applications Please refer to the attachments for a detailed description of the applications and environment as well as the type, volume and complexity of the work. The attachments provide an application overview, performance, environment, architecture and SLAs (if any).

C.4.10.1 Maintain Searchable Legal Applications The contractor must maintain the searchable legal applications and associated databases. The searchable legal applications are the main tool for the Office of the General Counsel - Policy Division to draft advisory opinions (AOs), Notices of Proposed Rulemaking, final rules, and similar documents interpreting the federal campaign finance law for the Commission to consider. The Policy Division also provides legal advice in response to legislative inquiries, legal reviews of all Commission publications, and training Commission staff regarding changes in the law. Please see the Attachment 2: MaintenanceSpec_SearchableLegalSystems.zip attachment for a more detailed breakdown of these applications. The following skillset is required to support these applications: Java, Apache Tomcat, Spring Framework, Angular, SQL development and performance optimization, Oracle, PostgreSQL, SecDevOps, Shell Scripts and AWS. Technical oversight will be provided by the COR and the FEC Deputy CIO of Enterprise Architecture.

The contractor must produce thorough software test plans, testing and test results and strictly follow production release management and procedures. Technical oversight is performed by the business users and OCIO Applications Branch.

The contractor must ensure all applications are up to date with patching. The contractor must resolve critical and high security tickets.

C.4.10.2 Maintain Disclosure Applications The contractor must maintain the disclosure applications. Candidates and political committees in federal elections must meet specific filing and reporting regulations. The Commission's databases are the repository for campaign finance data, statements of candidacy, and statements of organization. There is a suite of applications that pulls data from the Commission’s databases. These applications provide Commission staff with tools for Administrative Fines, Compliance Tracking, and Data Capture. Please see the Attachment 3: MaintenanceSpec_DisclosureSuite.doc attachment for a more detailed breakdown of these applications. The following skillset is required to support these applications: Java, Apache Tomcat, SQL development and performance optimization, Oracle, PostgreSQL, Informatica, Crystal Reports, SecDevOps, Shell Scripts and AWS. Technical oversight will be provided by the COR and the FEC Deputy CIO of Enterprise Architecture.

The contractor must produce thorough software test plans, testing and test results and strictly follow production release management and procedure; Technical oversight is performed by the business users and OCIO Applications Branch.

The contractor must ensure all applications are up to date with patching. The contractor must resolve critical and high security tickets.

C.4.10.3 Maintain Reports Analysis (RAD) Modules The contractor must maintain the RAD Modules and associated databases. The RAD Modules serves as the main workload tool for three branches within the Reports Analysis Division (RAD). The tool helps both RAD analysts and management track the reports and documents that need to be reviewed to ensure they comply with the FECA. Please see Attachment 4: MaintenanceSpec_RADApplications.zip for a more detailed breakdown of this application. The following skillset is required to support these applications: Java, Apache Tomcat, SQL development and performance optimization, Oracle, PostgreSQL, Informatica, Crystal Reports, SecDevOps, Shell Scripts and AWS. Technical oversight will be provided by the COR and the FEC Deputy CIO of Enterprise Architecture.

The contractor must produce thorough software test plans, testing and test results and strictly follow production release management and procedure; Technical oversight is performed by the business users and OCIO Applications Branch.

The contractor must ensure all applications are up to date with patching and must resolve critical and high security tickets.

C.4.11 Desired Skills and Knowledge The contractor will provide the skillsets and expertise needed to fulfill the services described in this requirement. At a minimum the FEC will require the following skills: Java, Apache Tomcat, SQL development and performance optimization, Oracle, PostgreSQL, Informatica, Crystal Reports, SecDevOps, Shell Scripts, project management and quality assurance.

C.4.12 Unscheduled requests As legislative, reporting forms, or other requirements can change, the FEC often makes unscheduled requests for data, data subsets, files from backup, changes, or enhancements to these systems. These requests are typically made on a “need it now” basis and may be critical. The quoter must demonstrate that they have the resources and the flexibility to manage and perform these types of requests without impacting the application and system maintenance or other initiatives. These requests shall be included as part of normal maintenance efforts.

C.4.13 Knowledge Transfer The contractor must provide knowledge transfer, technical coaching and advice to FEC technical staff.

C.4.14 Informatica Support For CLIN 0002 and optional CLINs 1002, 2002, 3002 and 4002, the contractor must provide an Informatica tool expert (Informatica administrator). This resource must have the required expertise to patch and upgrade the agency’s Informatica servers and maintain, modify and create new mappings.

C.4.15 Quality Assurance Surveillance Plan (QASP) The following chart sets forth the performance standards and quality levels the code and documentation provided by the contractor must meet, and the methods the FEC will use to assess the standard and quality levels of that code and documentation.

Code goes through peer review before merge Minimum of 85% test coverage of all code with meaningful tests as determined by the agency, such as test-driven development (TDD).

Tests are run as part of the CI/CD pipeline

At least one approving review before code changes are merged Combination of manual review and automated testing

Source code must have 100% readability, maintainability, and consistency.

Peer Code review

- Easily distinguishable/high contrast colors, type and interactive elements

- Functional keyboard/tab navigation

- All non-text content has a text alternative that serves the equivalent purpose

- Clear webpage title that describes their topic and function/purpose Combination of manual review and automated testing through an automated tool such as Lighthouse, SiteImprove Accessibility checker, pa11y or Spectrum chrome plugin or other similarly comparable system.

Developer must resolve any code conflicts prior to committing the code.

Peer code review

Combination of manual review and automated testing

- All dependencies are listed and the licenses are documented.

- Individual methods are documented inline using comments that permit the use of documentation-generation tools such as JSDoc.

- A system diagram is provided

- Database structure and team practices are documented

- Product-level decisions must be documented.

- FEC data security policies must be followed

Clean tests from:

- Dependencies are scanned with an automated tool such as Snyk and npm audit for vulnerabilities

- Static code analysis using bandit and passive scanning with a scanner such as OWASP ZAP along with documentation explaining any false positives

- No more than one major version behind on essential underlying technology Combination of manual review and automated testing

- Components must be reusable

- Clear user flow within the application

- Industry best practices for UI design for modern websites. UI considerations include proper alignment of elements, proper spacing, consistency in sizing, typography, color(s) throughout the product

- Clear user flow and information architecture

- Clear integration of user research and usability best practices

- Friendly, easily understood and actionable content.

UI look and feel must be reviewed and approved by business users.

This is a manual review.

- Architecture must be scalable

- Must apply load balancer on production websites

- Application performance must be measured and monitored Combination of automated testing and manual review

UAT must be passed and certified with 100% score.

User manually test

Release processes / Steps, along with rollback plan must be clearly documented and attached in RFC Ticket Zero production issue due to production release.

If there is unexpected environment issue that caused production release failure, production rollback must be performed within defined downtime window.

Post-production verification must be performed.

Manual / User verify

C.4.16 Shared System Responsibilities with FEC The contractor will be responsible for managing the application layer in the development environment, including code deployment and table creation.

Once code is tested and passes QASP standards, the contactor must provide detailed instructions for deployment on the testing (UAT) and production servers. The deployment instructions must be sent to the DBA and/or System Administrator for UAT or production deployment.

The FEC is responsible for server level management including patching on development, UAT and production servers.

The contractor must participate in verification after server maintenance is completed by FEC DBA or System Administrator.

Attachments:

Attachment 1A – FEC Searchable Legal Systems Attachment 1B – FEC Disclosure Suite Attachment 1C – FEC RAD Modules