A02 Attach1A_FBG-PWS_DRAFT.pdf

PERFORMANCE WORK STATEMENT

Operations, Maintenance, and Enhancements Food Buying Guide (FBG) Interactive Web Tool and FBG Mobile App

U.S. Department of Agriculture, Food and Nutrition Service

February 2022

Version 1.0

National Office – Braddock Place 1320 Braddock Place

Alexandria, VA 22314

This document has been reviewed for Section 508 compliance as of 7/20/21.

i

TABLE OF CONTENTS

1. PURPOSE

2. BACKGROUND

3. SCOPE

3.1 Agile Development Methodology

3.1.1 Backlog Management and Estimation

3.1.2 Sprint 4

3.1.3 Sprint Review/Demonstrations

3.1.4 Metrics and Reporting

3.2 Security

3.3 Compliance with Applicable Laws, Regulations, and Standards

3.4 General IT Security and Privacy Requirements

3.5 Required Development Practices

3.5.1 Standards

3.5.2 Development Practices

3.5.3 Security Practices

3.5.4 Performance and Monitoring Practices

3.5.5 Cloud Practices

3.6 Quality Assurance and Configuration Management

3.7 Data Rights

4. PERFORMANCE AND TASKS

4.1 Task A - Project Management Support

4.1.1 Project Manager Support

4.1.2 Contractor Responsibility with Project Documentation

4.1.3 Onboarding / Offboarding / Required Training

4.1.4 Escalation

4.2 Task B - System Development/Enhancements

4.2.1 Requirements and Design

4.2.2 Development/Enhancement and Testing

4.2.3 Pre-Deployment

4.2.4 Deployment

4.3 Task C - Transition Support

ii

4.4 Task D - Operation and Maintenance (O&M) Support

4.4.1 Operation and Maintenance (O&M) Tasks/Activities

4.4.2 System Monitoring and Support

4.4.3 Data Mining

4.4.4 Database Administrator Activities

4.4.5 Data Governance

4.4.6 Data Architecture

4.4.7 Production Database Change Requests

4.4.8 Configuration Releases (Patching)

5. SECTION 508 – ACCESSIBILITY OF INFORMATION AND COMMUNICATIONS

TECHNOLOGY

5.1 Section 508 Accessibility Standards

5.1.1 Web-based Applications

5.1.2 Video and Multimedia Applications

5.1.3 WCAG 2.0 Compliance

5.1.4 Non-Compliance

5.2 ICT Accessibility Requirements Statement per the Revised Section 508 of the Rehabilitation Act

5.2.1 IT Accessibility Requirements

6. INTELLECTUAL PROPERTY AND KNOWLEDGE TRANSFER

6.1 Knowledge Transfer

6.2 Recording and Disclosure of Contract Intellectual Property

6.3 Cooperation with other Service Providers

6.4 Email

7. APPLICABLE DIRECTIVES

7.1 Industry Standards

7.2 Other Federal Government and USDA Requirements

7.3 Compliance with Internet Protocol Version 6 (IPv6)

8. PERIOD OF PERFORMANCE

9. KEY PERSONNEL REQUIREMENTS

iii

9.1 Senior Project Manager

9.2 Senior Developer

9.3 Mobile App Developer

10. DELIVERABLES

10.1 Documentation Submitted with the Proposal

10.2 Progress Reports, Program Reviews and Status Reports

10.2.1 Progress Reports

10.2.2 Program Review

10.2.3 Weekly Status Reports

10.3 Fully Commented Source Code Delivery

10.4 Programmatic Deliverables

10.5 Continual Maintenance Deliverables

11. CONSTRAINTS

12. BILLING

12.1 Submission of Invoices

13. PLACE OF PERFORMANCE

14. PERFORMANCE METRICS

APPENDICES

List of Tables Table 1 – Vulnerability Response Time Table 2 - Programmatic Deliverables Table 3 - Continual Maintenance Deliverables Table 4 - Performance Metrics Table 5 – Appendices iv

ACRONYM LIST

REFERENCE DEFINITION

A&A Assessment and Authorization ACR Accessibility Conformance Report AQL Acceptable Quality Level ATO Authority to Operate BOD Binding Operational Directive CCB Change Control Board CCR Centralized Code Repository CDM Continuous Diagnostics and Mitigation CEC Client Experience Center (CEC) CER Change Enhancement Request CFR Code of Federal Regulations CM Configuration Management CMD Contracts Management Division CMMI Capability Maturity Model Integration CO Contracting Officer

COBIT Control Objectives for Information and Related Technology

COOP Continuity of Operations Plan COR Contracting Officer’s Representative COTS Commercial off-the-shelf CPIC Capital Planning and Investment Control C-SCRM Cyber Supply Chain Risk Management CSP Certified Scrum Practitioner CUI Controlled but Unclassified DBA Database Administrator v

REFERENCE DEFINITION

Dev Development DHS Department of Homeland Security DISC Digital Infrastructure Services Center (DISC) DUNS Data Universal Numbering System EIT Electronic and Information Technology FAR Federal Acquisition Regulation FBG Food Buying Guide for Child Nutrition Programs FIPS Federal Information Processing Standards FISMA Federal Information Security Modernization Act FMS Financial Management Service FNS Food and Nutrition Service GFE Government Furnished Equipment HRBAC Hybrid Role Based Access Controls

HSTS Hypertext Transfer Protocol (HTTP) Strict Transport Security

HTTP Hypertext Transfer Protocol HTTPS Hypertext Transfer Protocol Secure ICT Information and Communications Technology IEEE Institute of Electrical and Electronics Engineers IMS Integrated Master Schedule IP Intellectual Property IPP Invoice Processing Platform IPT Integrated Project Team ISO International Organization for Standardization ISO Information Security Office IT Information Technology ITI Information Technology Industry vi

ITIL Information Technology Infrastructure Library

Jira Jira is a proprietary issue-tracking and project management tool, developed by Atlassian.

LOE Level of Effort MBI Moderate Risk Background Investigation MS Microsoft NIST National Institute of Standards and Technology NLT No Later Than ODC Other Direct Cost OIT Office of Information Technology OMB Office of Management and Budget OS Operating system PII Personally Identifiable Information PL Public Law PM Project Manager PMD Portfolio Management Division

PMI-ACP Project Management Institute’s Agile Certified Practitioner

PMP Project Management Plan POA&M Plan of Action and Milestones PPA Project Process Agreement PWS Performance Work Statement QA Quality Assurance SAR Supplemental Accessibility Conformance Report SDD System Design Document SDLC Systems Development Lifecycle SEI Software Engineering Institute SIEM Security Information and Event Management vii

SLA Service Level Agreement SME Subject matter expert SORN System of Record Notice SQL Structured Query Language SRS System Requirements Specification STIG Security technical implementation guide TBD to be determined TFS Team Foundation Server U.S.C. United Stated Code UAT User Acceptance Test(ing) USDA United States Department of Agriculture VDD Version Description Document VPAT Voluntary Product Accessibility Template

1. PURPOSE

The Food and Nutrition Service (FNS) administers the nutrition assistance programs of the United States Department of Agriculture (USDA). The mission of FNS is to work with partners to provide food and nutrition education to people in need in a way that inspires public confidence and supports American agriculture. Among these programs are the Child Nutrition Programs (CNP), including the National School Lunch Program (NSLP), Afterschool Snack Program, School Breakfast Program (SBP), Summer Food Service Program (SFSP), and the Child and Adult Care Food Program (CACFP). Administered by State agencies, the Child Nutrition Programs help fight hunger and obesity by reimbursing organizations such as schools, childcare centers, and after-school programs for providing nutritionally balanced meals and snacks to children at low or no cost. USDA established Team Nutrition as a comprehensive nutrition education initiative in 1995. The goal of Team Nutrition is to support the Child Nutrition Programs through training and technical assistance for CN program operators, State agencies, and other stakeholders.

FNS has a responsibility to ensure that Child Nutrition Program (CNP) operators have the requisite knowledge and tools needed to plan, purchase, prepare, and serve nourishing meals that meet Federal meal pattern requirements while meeting their operational needs. FNS seeks a qualified Contractor to provide Operations, Maintenance, and Enhancement support on the Food Buying Guide for Child Nutrition Programs (FBG) Interactive Web Tool and FBG Mobile App, as well as their components, including the Recipe Analysis Workbook, Product Formulation Statement Workbook, FBG Calculator, the Exhibit A Grains Tool, and the downloadable and printable FBG publication.

2. BACKGROUND

The USDA Food Buying Guide (FBG) is an essential tool used to assist in: 1) purchasing the right amount of food and purchasing it most economically, and 2) determining the specific contribution each food makes toward the Federal meal pattern requirements to ensure that meals served in CNPs meet program requirements for reimbursement. In addition, with yield data for more than 2,100 food items, this guide can provide ideas for adding new foods or new forms of familiar foods to menus served in CNPs.

The FBG is widely used by School Nutrition Professionals such as Directors, Supervisors, Managers, School Menu Planners, School Food Authorities (SFA), Local Education Agencies (LEAs), and others participating in the National School Lunch Program and School Breakfast Program. It is also used by Program Operators in the Child and Adult Care Food Program as well as the Summer Food Service Program.

https://foodbuyingguide.fns.usda.gov/ https://foodbuyingguide.fns.usda.gov/ https://www.fns.usda.gov/tn/food-buying-guide-mobile-app

3. SCOPE

This PWS describes in detail the contractor support and services required for FBG Interactive Web Tool and Mobile App, including project management; communications and stakeholder engagement;

requirements/user story management; system design, system and reports development, testing, security, and implementation; continuous system monitoring; and user support.

The scope for this effort encompasses all technical and management support required to provide comprehensive Operations, Maintenance, and Enhancement (OM&E) support to sustain the operation of the FBG Interactive Web Tool and FBG Mobile App (including all features (electronic hard copy, Recipe Analysis Workbook (RAW), Product Formulation Statement (PFS) Workbook, FBG Calculator, Exhibit A Grains Tool) and enhancements). The web tool shall be sustained at Digital Infrastructure Service Center (DISC), and the mobile app shall be sustained on all platforms (iOS, Android). The FBG Web Tool is accessible through FNS’ website, with a login e- authentication; the FBG Mobile App is available to download for free from each of the provider play stores and can be accessed with a login e-authentication. The web/mobile application is used by an audience that varies widely in technical resources and knowledge and shall be intuitive to use and be accessible to food manufacturers and Child Nutrition Program Professionals such as: Directors, Supervisors, Managers, Menu Planners, School Food Authorities (SFA), Local Education Agency (LEA), Program Operators and others who develop menus and purchase foods for meal production.

The contractor shall be required to go through initial training to understand the Food Buying Guide, what it is and how it is used by program operators, as well as all the mathematical calculations involved for all of FBG’s features (RAW, PFS Workbook, FBG Calculator, Exhibit A Grains Tool).

The contractor shall follow the Agile Development Methodology and other requirements and guidance below. Specifically, the following subsections provide information for Agile Development Methodology, Security, Quality Assurance and Configuration Management, SDLC Oversight, IT Policies and Procedures Support; Compliance with Applicable Laws, Regulations and Standards; General IT Security and Privacy Requirements and Data Rights.

3.1 Agile Development Methodology

The contractor shall utilize an Agile Software Development methodology, Scrum preferred, and the associated industry leading practices and automated tools to keep historic records of all Sprint-related activities. The contractor shall develop and propose a Product Roadmap for this development project in which Sprints do not exceed 4-weeks in duration, provides for quarterly software releases, and utilizes automated tools that maintain, generate, and track the Product Backlog, Sprint Backlog, Velocity Charts, Burndown Charts, Bugs/Issues, and Risks for the life of the project.

The contractor shall provide access an Agile Scrum automated issue tracking tool (such as JIRA) that all contractor team members will have access to. A read-only permission will be granted to FNS personnel;

however, it is agreed that the requirement as stated in the approved Product Backlog takes precedence over the requirement as stated in the automated issue-tracking tool. The contractor shall ensure that the requirement is developed to meet all requirements of the product backlog. The Agile Scrum automated issue tracking tool shall include:

a. Issues;

b. Level of Effort (LOE);

c. User Stories;

d. Acceptance Criteria;

e. Story Points;

f. Product Backlog;

g. Sprint Backlog

h. Velocity Charts;

i. Burn Down Charts;

j. Risks;

k. Test/Cases Scripts;

l. Test Results; and

m. Linkage between associated sub tasks

3.1.1 Backlog Management and Estimation

The contractor shall provide story point / level of effort (LOE) estimations in the product backlog on an ongoing basis to ensure a minimum of 1.5 to 2 sprints worth of change requests/users stories have been estimated at any given time based on the COR’s prioritization. Requirements/user stories may be refined adaptively over the course of the effort to continuously meet specified user needs. User needs will be prioritized based on business value and technical dependencies and maintained in the automated tracking tool.

The contractor shall work with the COR to develop, enhance, and manage user stories based on the Product Backlog. Decisions to add, delete, or modify user stories will involve the integrated project team;

however, all decisions will be approved by the COR. The contractor shall deliver the design, development, and testing in defined sprints that produce demonstrable “interim deliveries” of production ready code. These deliveries of capabilities may or may not be implemented in the production environment.

For the benefit of both FNS and the contractor all requirements shall be groomed as user stories and put into the backlog. The living backlog represents all requirements past, present, and future of FBG Web Tool and Mobile App. The contractor shall work with the FNS Project Team to develop, enhance, and manage user stories based on the backlog. Decisions to add, delete, or modify user stories shall involve the integrated project team; however, all decisions will be approved by the COR.

Maintenance and ownership of the Product Backlog shall remain with the COR. It is the responsibility of the contractor to ensure any user stories moved into their automated tracking tool fully represent the expected outcome of the user story as presented in the FBG Product Backlog at the time the requirements were finalized and agreed to.

3.1.2 Sprint

The contractor shall deliver the software design, development, and testing in 2–4-week sprints that produce discernible, incremental progress deliveries and COR-approved production ready software. COR expect these deliveries of capabilities shall be implemented in the production environment. The overall time required to deliver production ready software is dependent on release planning, complexity of features, themes, and epics, based on a fixed time cycle, with variances in the number of features developed. The contractor shall use continuous integration best practice techniques in developing software solutions. The contractor shall ensure adequate delivery in both cases. All deliveries shall adhere to FNS Office of Information Technology (OIT) SDLC guidelines.

The overall time required to deliver production-ready deliverables is dependent on the release planning, complexity of features, themes, and epics, based on a fixed time cycle, with variances in the number of features developed.

The contractor shall follow the FNS Systems Development Lifecycle (SDLC) and shall follow all FNS procedures for moving the system into the User Acceptance Testing (UAT) and production environments.

The contractor shall also be responsible for implementing the final code into the backup environment.

The contractor shall ensure the following:

• Clearly identify the following at the beginning of the release:

o An estimated plan of the number of sprints per release, and o Minimum number of Story Points allotted per sprint.

• Story Points LOE Estimates for all user stories are planned for the next release one month prior to the beginning of the last sprint in the previous release to allow for requirements identification.

• Clearly defined plan to handle situations where a sprint accomplishes less than the allotted user points assigned and/or planned user stories are not completed within the assigned sprint.

• The overall time required to deliver production-ready deliverables depends on the release planning, complexity of features, themes, and epics, but also may be based on a fixed time cycle, with variances in the number of features developed.

• Requirements shall be identified, agreed to between the COR and the contractor, and approved for a release in a planning meeting prior to the production deployment of the previous release. For example, requirements for release 3 shall be approved in the last sprint of release 2, although they may be identified earlier.

• Any bugs found during sprint testing or UAT testing, if related to current release development, shall be addressed prior to the production release. Any bugs reported by users that impact the productive usability of the tool shall be addressed as specified in the service level agreement. All bugs shall be prioritized within the backlog as described in 3.1.1.

Because of the chosen methodology, this does not limit the contractor to completing only the identified requirements; additional user stories may be completed. Requirements more than one sprint in the future may also be reprioritized by the COR and the contractor shall notify the COR of the schedule impact within three (3) business days. For example, the COR requests during sprint 1 that a requirement identified for sprint 3 be changed. Within three (3) business days the contractor shall inform the COR of any changes that must be made to accommodate the request.

Any changes requested by the COR must be made prior to the final sprint in a release. For example, if there are four sprints in a release, changes can only be requested by the COR for the current release in Sprints 1 and 2. No requests can be made during Sprint 3 due to the fact that there is only one sprint left in the current release. The terms of this paragraph do not change the contractor’s responsibility for fulfilling the requirements of their Service Level Agreement with FNS regarding the FBG Web Tool and Mobile App.

3.1.3 Sprint Review/Demonstrations

The contractor shall conduct a Sprint Review for all items that have been completed (developed and tested) at the end of each Sprint and discuss user stories that were identified for the Sprint and not completed. Each completed user story is presented to the COR, and the COR either accepts or rejects the changes. User stories that are accepted by the COR are staged for release. Any items that are rejected by the COR or not completed are placed back into the Product Backlog for future analysis and prioritization.

The contractor shall provide a demonstration for all user stories in a given release prior to the beginning of User Acceptance Testing (UAT).

3.1.4 Metrics and Reporting

The contractor shall maintain status and traceability metadata information for each system / application change in the FBG Agile tracking tool to include the following at a minimum:

• Status

• Sprint

• Release

• Test Case(s)

• Epics/Themes

• Design artifacts (if applicable)

• Story Point / LOE estimation

• Acceptance Criteria

The contractor shall configure the FBG Agile tracking tool to provide agile metrics that focus on the delivery of software to include the following at a minimum:

• Sprint Burndown

• Release Burndown

• Velocity

• Control Chart

• Sprint Report

• Cumulative Flow Diagram

Contractor shall provide the COR an end-of-Sprint report at the end of each Sprint detailing the user stories that were addressed in a format approved by the COR.

3.2 Security

The scope of this contract includes any activities necessary to actively monitor system security, prevent security incidents, respond to security incidents, or to remediate security vulnerabilities within the platform. Security includes responsibility for safeguarding data transferred to and from the platform and shall adhere to NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organization (see Appendix E), as well as physical security and access controls to the platform. All traffic will use secure transfer protocol and encryption (e.g., HTTPS, with HSTS) and comply with the latest directive where applicable. (E.g., Binding Operational Directive 18-01 (BOD 18-01) (see Appendix F) and Office of Management and Budget Memorandum-15-13 (OMB M-15-13) (see Appendix G).

3.3 Compliance with Applicable Laws, Regulations, and Standards

• Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA) as applicable.

• FIPS and NIST Special Publications. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the development, operations, and protection of information systems and sensitive information and data.

• USDA and FNS Policies and Procedures. The contractor and all of its respective subcontractors shall comply with all USDA and FNS security and privacy policies and standards in effect at the time of the award of the contract, as well any requirements added during the contract.

• Privacy Act. As prescribed in the FAR 24.104, as the contract involves the design, development, and/or operation of a system of records on individuals, the contractor must implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act” in coordination with FNS. In addition, the contractor is responsible for training of individuals supporting FNS in accordance with FAR clause 24.301, “Privacy Training.”

• Telecommunications and Video Surveillance Services or Equipment. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the FAR clause 52.204.24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment and FAR clause 52.204-25 - Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

3.4 General IT Security and Privacy Requirements

• Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. The contractor shall consider all information about the system, gathered, or created under this contract as Controlled but Unclassified (CUI) information.

This information will be gathered, created, and stored only on the FNS network using FNS Government Furnished Equipment (GFE). The contractor shall use of any information that is subject to the Privacy Act in full accordance with all rules of conduct as applicable to Privacy Act Information.

• Deliverables. The deliverables in this contract are sensitive and are not shareable with any other organization without prior approval from the FNS CO.

• Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Each contractor or employee of the contractor to whom information may be made available or disclosed shall be notified in writing by the contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

• Non-Disclosure Agreement. Each individual who has access to FNS or USDA facilities under this contract shall execute a Non-Disclosure Agreement before accessing FNS or USDA facilities under this contract.

• Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall establish appropriate administrative, technical, and physical safeguards to properly protect the security and confidentiality of this information, data, and/or equipment.

• Use of PII. The contractor shall not use any Personally Identifiable Information (PII), E-mail Groups, Lists, or contract information for any purpose other than those activities necessary to the performance of this contract.

• Cyber Supply Chain Risk Management (C-SCRM). The contractor shall implement strategies to manage both every day and exceptional risks along the supply chain based on continuous risk assessment with the objective of reducing vulnerability and ensuring continuity. The contractor shall meet C-SCRM requirements identified in Appendix I – USDA C-SCRM Contract Language.

3.5 Required Development Practices

In addition to the Agile Development Methodology noted above, the contractor shall adhere to the practices outlined in the below subsections when developing capabilities to be assessed through independent scanning and testing of implemented security controls.

3.5.1 Standards

The contractor shall ensure compliance with the applicable NIST 800-53 controls, and USDA policies for Safeguarding Sensitive but Unclassified Information (NIST SP 800-171, also referred to as CUI). The contractor shall provide IT security support for configuration management, change request process, and the evaluation of technical designs during the engineering process.

3.5.2 Development Practices

1. If the contractor must perform changes to code, they must develop and deliver the software components and documentation to address functional and system requirement changes, ensure approval of the technical design, and meet end-to-end performance requirements. The contractor shall conduct unit testing prior to delivery to any UAT environment.

2. Code Review/Testing: The contractor shall perform code review to discover and resolve defects before it is tested. The contractor shall utilize automated secure code test/analysis tools (as provided by the government) and make the results of such testing available for review and approval by the government with delivery of each release.

3. Minimize Attack Surface Area: The contractor shall document new features, new code, and all configuration changes; assess and clearly document the impact on current level of risks i.e., whether the new features increase or decrease the risk.

4. Source Code: The contractor shall digitally sign all applicable source code; ensure digitally signed source code by the designated development authority; and allow only signed code to execute on FNS or designated hosting facility. Further, all source code delivered must be placed into the FNS Enterprise Team Foundation Server (TFS) Centralized Code Repository (CCR).

5. Mobile Code: The contractor shall digitally sign all mobile code; ensure digitally signed mobile code by the designated USDA FNS authority; and allow only signed code to execute on the FBG.

6. Personal Identifying Information: The FBG Web Tool and Mobile App may provide access to data that may contain Personal Identifying Information (PII) data on CNP program operators and stakeholders. As a result, the ability to mask and scramble PII data on all environments (e.g., Development, Pre-Production, Production, etc.) and use new unique identifiers in lieu of PII data to support business needs are considered within the scope of security for this contract.

7. The contractor shall deliver the software code to include executables, scripts, source code, configuration files, test scripts, and any commercial off-the-shelf (COTS) products with associated license keys and documentation to the FNS Enterprise TFS CCR at every release.

8. The contractor shall utilize the designated FNS-provided repository to preserve the code base and conduct a walkthrough with the government prior to delivery of the release code baseline. The contractor shall be responsible for maintaining (hardware, software, and associated documentation) and utilizing the FNS provided development environment consistent with the FNS architecture framework.

9. The contractor shall ensure that the software development efforts (up to code freeze to support software delivery) are void of any deficiencies associated with performance/integration, don’t break non-related functionality, and addresses applicable security vulnerabilities.

10. The contractor shall utilize FNS approved software to evaluate the quality of the code delivered during the integration process. Code must undergo quality review prior to being introduced into the FBG codebases. This quality review must include static code analysis and automated unit testing. Code shall be analyzed to 1) identify and track quality issues; 2) provide the data to monitor development performance; 3) measure quality and adherence to architectural and coding standards; 4) provide metrics for development strategy; 5) scanning for vulnerabilities; 6) ensuring Section 508 compliance; 7) measuring cyclomatic complexity (with target </=10); and

8) compatibility with FNS standard operating system (OS) and browser configurations. During development, the contractor shall incorporate the use of a tool(s) into their internal development processes to include but not limited to; 1) developer feedback; 2) peer reviews; and 3) internal milestone reviews. If code does not comply, it is unacceptable for delivery.

3.5.3 Security Practices

1. Separation of Duties: The contractor shall design, build, and maintain segregation of duties into their roles, environments, and applications. The contractor shall design applications to recognize conflicts between individual duties. Privileged account holders must act in accordance with FNS Rules of Behavior outlined in the FNS-702 Handbook.

2. Identification/Authentication/Authorization/Accountability: The contractor shall design and develop procedures for Identity Management utilizing USDA standard Identification and Authentication infrastructure, processes, and policies. The contractor shall also implement Hybrid Role Based Access Controls (HRBAC) and segregation of duties via these procedures.

3. Secure Coding Standards: The contractor shall follow USDA Secure Coding Standards in development of any code.

4. Data Encryption: The contractor shall implement security mechanisms that are FIPS 140- 2 compliant to support Preservation of Information and System Confidentiality, Integrity, and Non- Repudiation. Where encryption is required, as specified by FNS, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140.

5. Secure Configurations: The contractor shall not deploy applications with default (i.e., "out of the box") security configurations. The contractor shall secure the application configuration and change all default passwords and all default settings. The contractor shall apply FNS-approved secure baseline configurations to all IT components of the system. Secure configuration settings must be defined, implemented, and maintained in accordance with NIST, USDA, and FNS requirements, to include NIST Special Publications 800-70 and 800-53 (current Revisions).

6. Principle of Least Privilege: The contractor shall apply the principle of least privilege in performing their processes. The contractor shall develop applications consistent with this principle and allow for fine-grained access privileges.

7. Fail Securely: The contractor shall design and develop applications to fail securely. Applications shall not be exploitable in failure conditions.

8. Security Issues Mitigation: The contractor shall remediate all security issues identified during the certification, authorization, or other risk assessment processes within a mutually agreed upon timeframe.

The contractor shall also, as part of solution development and updates:

1. Provide a description of the functional properties of the security and privacy controls employed by the system, for inclusion in the associated Authorization Package documentation. Per Office of Management and Budget (OMB) Circular A-130, the Authorization Package includes the information system security plan, privacy plan, security and privacy control assessment, and any associated plans of action and milestones (POA&M).

2. Provide design and implementation information for the security controls to be employed that includes: all external system interfaces, high- and low-level design, source code and hardware schematics, and design and implementation information at a level commensurate with that specified in the FNS SDLC and consistent with all NIST controls applicable to the FNS information resources displayed, processed, stored, or transmitted.

3. Identify early in the system development life cycle the functions, ports, protocols, and services intended for FNS use.

4. Provide administrator documentation for the information system that describes: (1) secure configuration, installation, and operation of the system, component, or service; (2) effective use and maintenance of security functions/mechanisms; and (3) known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.

5. Provide user documentation for the information system that describes: (1) user-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms; (2) methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and (3) user responsibilities in maintaining the security of the system, component, or service.

3.5.4 Performance and Monitoring Practices

1. Logging/Monitoring: The contractor shall implement functionality in the applications that sends security-related and other relevant alerts to the FNS logging/monitoring infrastructure in accordance with USDA Cybersecurity policy.

2. Performance Monitoring: The contractor shall enable applications and application infrastructure to generate events and alerts as specified by the FNS; shall support the capture and analysis of the application alerts and events; and shall support the integration of these alerts and events with the FNS-provided mechanisms. FNS utilizes Splunk for managing monitoring logs.

3. The contractor shall configure the application and supporting IT components per FNS direction, to forward designated audit logs to the FNS Security Information and Event Management (SIEM) tools for monitoring operational activities.

3.5.5 Cloud Practices

Using Cloud Services: Should the selected solution employ the use of a Cloud, the contractor shall provide a solution that meets all FedRAMP (Appendix C), USDA, and FNS security requirements. FNS OIT will determine the appropriate hosting environment based upon the requirements, the security rating and proposed design.

3.6 Quality Assurance and Configuration Management

Hardware or software configuration changes shall be in accordance with the FNS standards and the FNS Continuous Diagnostics and Mitigation (CDM) Program. The FNS Change Control Board (CCB) shall approve any request for change prior to any development activity occurring for that change and shall define the security and functional requirements for the requested change.

The contractor shall fully document all development and changes to the production system as outlined in Appendix A, FNS Agile Systems Development Lifecycle Guide. The contractor shall ensure that all code is version controlled and has successfully passed an independent code review prior to any production release. The contractor shall make available documented evidence of independent code reviews to the government upon request. Coding support shall include ensuring that configuration management (CM) processes and procedures are adhered to and in place for the continued development of the system. CM shall include code control in all the system environments, which may include the development (Dev), QA, pre-production/user acceptance testing (UAT), production, and disaster recovery environments. Any changes to CM practices must first receive written approval from the COR. The COR will then seek consultation with the appropriate USDA entity (i.e., Information Security Office (ISO), FNS OIT, etc.).

QA tasks also include testing the application, finding and reporting bugs in the code, preparation of test cases, and preparation of test plans. The vendor must select, as part of their proposal process, automated testing tools that they will utilize with a preference towards tools specified in the FNS Approved Software List (Appendix J). For non-open source software, provide licensing charges as an Other Direct Cost (ODC) in the proposal. Where applicable, the contractor shall ensure the successful transfer of data/information from the source destination to its final resting place. The contractor shall also be responsible for all data validation and any required data cleansing resulting from user activities such as import/export, data conversion, data migration, manual data entry, etc. that corrupted the system. QA tasks also include coordination of various levels of testing (such as application testing, functionality verification, load testing, independent QA testing, and thorough regression testing) during releases and patch or other server upgrades. It shall also include the creation of bi-directional traceability between new requirements/user stories and test cases. CM tasks include plan development and updates, configuration identification, configuration change control, and baseline management.

When applicable, the contractor shall also be responsible for providing the code for implementation in the User Acceptance Test (UAT) environment and providing support to FNS and the hosting site for integration and implementation into the production environment. FNS may provide a production mirror site for contractor-led testing prior to production release, if necessary.

The contractor shall ensure that all changes to the production system are fully documented in all the relevant design documents. The contractor shall ensure that all code is version controlled and has successfully passed an independent code review prior to any production release; documented evidence of independent code reviews shall be made available to the government upon request. Coding support will include ensuring that CM process and procedures are adhered to and in place for the continued development of the system. CM will include code control in both system environments, which may include the UAT/pre-production, production, and disaster recovery environments.

The contractor shall complete a quality and control (QC) check prior to providing deliverables for FNS review. These QC checks will include ensuring all edits requested by FNS are successfully included in the tool, database, user manuals, and other deliverables, as well as ensuring all deliverables are free of misspellings and grammatical errors prior to providing to FNS for review.

Testing or review of major functionalities associated with the FBG Web Tool and Mobile App and related content completed by the contractor shall be incorporated into the contract schedule to allow for a minimum of three (3) business days for Sprint UAT and three (3) business days for Release UAT for FNS review and comment. This applies to initial drafts and final review of deliverables after FNS feedback has been incorporated.

Deliverables such as weekly reports, monthly reports, and meeting minutes shall allow for a minimum of three (3) business days for FNS review and comment. Final weekly reports, monthly reports, and meeting minutes shall be delivered within two (2) business days of FNS review reflecting all changes requested.

Other deliverables such as Service Level Agreement (SLA), Project Management Plan (PMP), project schedule, or other deliverable not otherwise accounted for in this paragraph shall allow for a minimum of five (5) business days for FNS review and comment. Final deliverables shall be delivered within three (3) business days of FNS review reflecting all changes requested.

The contractor shall provide detailed test plans and test cases for COR to use during UAT. The contractor shall ensure that all database changes are coordinated and approved by the COR.

3.7 Data Rights

The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, user stories, UAT, documentation, etc. produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

4. PERFORMANCE AND TASKS

The contractor shall work directly with the COR to accomplish the tasks within the Performance Work Statement (PWS). The following detailed tasks together constitute this PWS:

• Task A – Project Management Support

• Task B – System Development/Enhancements

• Task C – Transition Support

• Task D – Operation and Maintenance

4.1 Task A - Project Management Support

The Government seeks a subject matter expert with Program Management capability that establishes and maintains program management practices throughout the period of performance. Program Management practices shall provide visibility into the contractors’ organization and techniques used in managing the Program, specifically subcontractor and data management. Documentation shall be readily available to Government representative(s) upon request.

The contractor shall provide the planning, direction, coordination, and control necessary to effectively and efficiently accomplish all design, development, implementation, operations, and reporting activities in accordance with the contract, and in alignment with USDA FNS SDLC processes and procedures. Project Management Support involves oversight tasks performed by the project manager to ensure the design, development, testing and deployment tasks are executed successfully and with quality, using the Capability Maturity Model Integration (CMMI), International Organization for Standardization (ISO), or other Industry Standard Quality Assurance practices by the team on a consistent basis. Key components of this task include ensuring appropriate communication channels are established and maintained with the FNS OIT, the COR, Business Owners, other members of the integrated project team and stakeholders through the use of routine status reports, real-time updates, and virtual/physical ad hoc and regularly scheduled meetings.

The contractor shall maintain a Project schedule that shall include all significant events, and a Project Planning Milestone Chart that depicts major tasks and events from start to completion of the contract. The contractor shall notify the Government in writing within one (1) business day of any anticipated or projected work stoppages or delays that will impact schedules. The contractor shall not implement any decisions that will affect work or schedules without the consent of the COR. When the FNS National Office closes due to inclement weather, FNS expects that the contractor shall carry out normal development, sustainment, and user support tasks. Notification of these stoppages can occur through documented weekly reports.

The contractor shall utilize PartnerWeb and Microsoft Teams as a system for management of all data required under this contract. The contractor, in developing information that will be furnished to the Government, shall make the maximum use of existing FBG data, and provide maximum use of technical information. Electronic databases or applications will be used to store, track, share, transmit or display information pertaining to this contract.

The contractor shall utilize the established Microsoft Teams for FBG project for reviews or draft deliverables. The contractor shall utilize PartnerWeb to upload final deliverables. All finalized deliverables required under this task order shall be uploaded to PartnerWeb within two (2) business days of approval by the COR. PartnerWeb is considered the repository for invoicing purposes and no invoice shall be approved until all required deliverables have been uploaded to PartnerWeb. This does not limit the ability of the contractor to utilize their own document repository for interim deliverables.

4.1.1 Project Manager Support

The contractor Project Manager (PM) shall ensure the timely accomplishment and quality completion of all related project tasks and delivery of all contract deliverables, At a minimum, the contractor PM shall provide both weekly and monthly status reports which shall describe the status/progress of Tasks B through D including project schedule, problems encountered and known risks, along with proposed solutions and impacts.

The contractor PM shall provide oversight for the FBG Web Tool and Mobile App, Project Management Support, and Information Technology (IT) System Development best practices, methods, and tools in compliance with USDA/FNS OIT policies and protocols, including the FNS Agile Systems Development Lifecycle Guide (SDLC) (Appendix A).

The contractor PM shall:

• Provide daily project leadership and guidance to the contractor team.

• Participate in all Integrated Project Team (IPT) meetings, including additional scheduled FNS stakeholder meetings with the contractor team.

• Develop and maintain a detailed project management plan (PMP), which includes the risk management plan.

• Accountable for the entire project lifecycle, including roadmap planning and release planning/management.

• Develop and maintain a detailed project schedule.

• Develop and maintain weekly progress reporting.

• Develop and maintain monthly progress reporting.

• Host weekly and monthly status meetings (as needed) with the integrated project team, inclusive of additional FNS stakeholders and the contractor team.

• Meetings shall be held via Microsoft Teams and be recorded. Team members who do not consent to being recorded shall provide suitable notes to a team member attending such meeting in lieu of their attendance.

• Recordings of the meetings shall be provided to all parties within three business days. The recording of meetings does not alleviate the contractor of the responsibility to provide meeting minutes required (see 4.1.2 below). The purpose of the meeting recordings is to support meeting minutes provided and shall not take precedence above the performance work statement or product backlog. Any changes discussed during recorded meetings shall not be considered final until put in writing with concurrence by the contracting officer.

• Coordinate and/or attend technical interchange meetings.

• Establish appropriate communication channels between the various project stakeholders, provides routine status reports (weekly and monthly), and conducts meetings with FNS and COR to keep them updated on all project activities and any risks/issues.

• Capture and release to the IPT meeting minutes and action items (i.e., during formal interactions with the COR, project team (to includes, Information Security Office (ISO), OIT), internal/external agencies, etc.), and tracking action items to completion.

• Resolve cross-functional issues at the project-level.

• Anticipate stakeholder needs and works with the COR to successfully manage changes in project scope, schedule, budget, and personnel.

• Manage project scope and reporting issues, escalating matters to the COR when necessary.

• Ensure successful execution of tasks and with quality (using CMMI level II, SDLC, and other quality assurance (QA) best practices) by the team on a consistent basis.

• Create and manage the Project Risk and Issue Registers.

• Provide documentation of the detailed project plan and technical documentation, in accordance with FNS OIT Agile SDLC, instructions, policies, and protocols.

• Manage project deliverables according to the project plan and roadmap milestones.

• Capture, monitor, and review team productivity to drive continuous improvements and high-quality performance.

• Work closely with the COR and other identified stakeholders to ensure the project milestones and deliverables meets business, functional and non-functional requirements expressed as user stories, as well as user expectations.

• Provide updates to the Continuity of Operations Plan (COOP), if required.

• Provide information needed for Assessment and Authorization (A&As) and information security solutions. This includes coordinating remediation of vulnerabilities, updating security documentation, and participating in continuity of operation exercises.

4.1.2 Contractor Responsibility with Project Documentation

To effectively manage the project, the contractor shall work with various stakeholders, and identify, document, and lead recurring meetings.