A04_PWS.docx

Performance Work Statement WebET Student Transportation System

U.S. Department of the Interior Indian Affairs Office of Information Management Technology

Performance Work Statement

Version 0.1 January 27, 2022

Department of the Interior Indian Affairs Standard Operating Procedure [System] Month Day, Year

This Document Contains Controlled Unclassified Information (CUI)

This Document Contains Controlled Unclassified Information (CUI) Office of Information Management Technology 2 Revision History

Table of Contents

List of Tables

Performance Work Statement

This Document Contains Controlled Unclassified Information (CUI) Office of Information Management Technology iv

BACKGROUND

The Web Education Transportation (WebET) application is a component of the Web Indian Student Equalization Program (ISEP) application which has been in production since 2005. The WebET application is used yearly by the 53 Bureau of Indian Affairs (BIE) Federal Operated Schools and the 130 Tribally Controlled Schools under 25 CFR § 39.700. The WebET application is used yearly starting September 1 and ending December 1 of each year. The WebET application calculates grant funding allocations using 25 CFR § 39.710. The yearly reporting is a requirement under 25 CFR § 39.700 as yearly grant money for education transportation costs is dispersed based on the individual school reporting.

The WebET system is an Active Server Pages (ASP) 2.0 web application that leverages the power of an ASP based architecture utilizing the .NET framework and SQL Server. The application is presented to the user using BIE approved browsers (i.e., Internet Explorer, Chrome, and Edge) and utilizes a Microsoft SQL Server 2016 database back-end. There are two separate instances of the WebET webservers. The first WebET server instance (x.x.30.38) is the Federal end user's internal server operating in the BIE Albuquerque Data Center (ADC). The second WebET instance (x.x.127.133) is the external server operating in the BIE Common Protected Zone (CPZ) located in the Sioux Falls Data Center (SDC). There is a long-term solution project to replace the WebET application which will be based on the current WebET application.

This application resides on approved and authorized BIE technology platforms that exist in the Indian Affairs (IA) Data Center located in Albuquerque, New Mexico. The public WebET hosting server is running Internet Information Server (IIS) version 10, with ASP 2.0, operating on a Windows 2019 server. The backend database server is SQL Server 2016 running on a Windows 2019 server. The trust side WebET hosting server is running Internet Information Server (IIS) version 8.5, with ASP 2.0, operating on a Windows 2012R2 server. The backend database server is SQL Server 2016 running on a Windows 2016 server. The WebET application collects education transportation data from Federal Operated Schools and from Tribally Controlled Schools. The WebET external transportation data will be collected once a week from the application using manual download process and sent via BIE Exchange server to the Internal Federal WebET server for merging into consolidated reports which feeds into an internal BIE business process where the WebET reports drive the individual school grants.

Access controls are provided by the network, the application, and the SQL Server database.

OBJECTIVES

First, to reverse engineer the ASP 2.0 and Visual Basic Script WebET system.

Second, to reverse engineer the algorithm logic within the Excel Student Transportation Funding Tool.

Third, to create a technical description of the reverse engineered code from WebET and Excel Student Transportation Funding Tool to a single requirements document that is human readable.

PERIOD OF PERFORMANCE

Table 1: Period of Performance

SCOPE

Program and Project Management Support – Provide program and project management support services, including the development and tracking of project related documentation in alignment with Department of the Interior’s (DOI’s) Information Technology (IT) governance framework and OMB requirements, using a standard project management methodology.

Reverse Engineer Existing WebET Application – Reverse engineer existing WebET Application in plain English that can be interpreted for development of a requirements document.

Reverse Engineer Excel Student Transportation Funding Tool – Reverse Engineer Excel Student Transportation Funding Tool in plain English that can be interpreted for development of a requirements document.

Development of Requirements Document – Develop a requirements document outlining the technical requirements and code from previous WebET system/Excel Student Transportation Funding Tool to be incorporated into development of new seamless WebET system.

The contractor will work with DOI/BIE, which are engaged in providing program services across BIE. The OIMT lead will work with the BIE project manager and the Contracting Officer’s Representative (COR) to provide technical oversight for the activities and tasking to be performed by the contractor, and with establishing work priorities as set forth in this Performance Work Statement (PWS). DOI/BIE will work with the contractor’s on-site project manager to establish and clarify any questions and technical issues.

QUALIFICATIONS

The contractor must provide a dedicated project manager in support of the goals and objectives of the PWS, as required by the COR. The contractor oversees and manages compliance activities of program and project management teams, daily operations, and client/customer relationships, and has responsibility for the quality of deliverables, and develops, monitors, and reports on project objectives, budget, and schedule status and performance. The project manager is responsible for the technical, contractual, administrative, and financial aspects of the project(s) as assigned by the OIMT lead and BIE project manager. The project manager is also responsible for identifying, proposing resolutions for, and resolving project management issues in collaboration with applicable Federal staff.

SPECIFIC TASKS

The requirements for services include performing specific tasks in the following areas:

Program and Project Management Support.

Reverse Engineer Existing WebET Application.

Reverse Engineer Excel Student Transportation Funding Tool.

Develop Requirements Document.

Within the sub-sections, which follow, requirements that are more specific have been identified for the successful execution of these services.

Program and Project Management Support The contractor shall provide project management support including project planning, reporting, and management of the project’s progress using Microsoft Project 2016. This includes meeting with BIE program representatives and IT staff to review and discuss their program requirements and technical requirements. The objective is to reverse engineer our existing WebET application for use in a requirements document that can guide the development of a new WebET system.

Deliverables and work activities include:

Project outline and timeline, and project tracking ensuring that reverse engineering of WebET system remains on schedule using Microsoft Project 2016.

Requirements document.

Weekly status reports. The format will be commensurate and appropriate for the audience/recipient of the report.

Weekly status conference calls with contractor and Federal and invited guests using Microsoft Teams.

Reverse Engineer Existing WebET Application The current WebET system uses ASP 2.0 for the front-end web interface and VBA 5 and 6 with VB based stored procedures. It uses Microsoft SQL for the database and the SQL Server database is Active Directory aware and integrated. This ASP 2.0 and VBA 5 and 6 WebET system must be reversed engineered to create a new web-based system (using SQL Server or other database system) or adopt a Commercial Off The Shelf (COTS) system that allows for multiple user profiles or user interfaces (e.g., BIE School Staff User, ERC User, Program Manager User) which meets current standards for Windows 10 and Windows 11 compatibility with Microsoft Edge and Google Chrome web browsers, collects transportation data, certifies transportation data, retains historical data, calculates transportation funding distributions according to specific formula, can upload reporting forms, and has report generation and exporting capabilities.

Deliverables and work activities include:

Create pseudo-code for original WebET system in human readable English.

Reverse Engineer Excel Student Transportation Funding Tool The Excel Student Transportation Funding Tool is an 11 sheet Excel workbook designed to calculate funding distributions based on the Student Transportation Funding Formula. This application must be reversed engineered and pseudo-code must be written in human readable English to be used in a requirements document.

Deliverables and work activities include:

Create pseudo-code for original Excel Student Transportation Funding Tool in human readable English.

Merge Reverse Engineered WebET Application and Reverse Engineered Excel Student Transportation Funding Tool into Final Requirements Document A requirements document based on the pseudo-code derived from the original WebET system and Excel Student Transportation Funding Tool will be developed. This document will outline all the coding and technical requirements needed for the development of a new WebET system.

Deliverables and work activities include:

Development of a requirements document based on the pseudo-code derived from the original WebET and Excel Student Transportation Funding Tool that is in human readable English.

PLACE OF PERFORMANCE

The reverse engineering, pseudo code development, and requirements analysis efforts will be completed in a contractor facility in the United States of America.

TYPE OF CONTRACT

The government will award a labor-hour purchase order.

INSPECTION AND ACCEPTANCE OF DELIVERABLES

Final inspection and acceptance (as applicable) of all services and deliverables will be performed by the COR or designee, generally at the place of delivery. Such inspection and acceptance shall be a blanket acceptance criterion for all deliverables identified in this PWS unless otherwise specifically noted.

DOI will "Accept" or "Reject" each deliverable provided under this PWS by the contractor. DOI shall have thirty (30) days after receipt of any deliverable from the contractor to accept or reject the deliverable, or any portion thereof, and specify reasonable grounds for rejection with sufficient precision for the contractor to understand what modifications are necessary to make the deliverable acceptable to DOI. If DOI provides notice of rejection, the contractor shall have a reasonable length of time (no more than 15 days) from the date of notice of rejection to review and update the deliverable and submit to DOI a revised deliverable. If the contractor fails to deliver a revised deliverable, then such deliverable shall be "Rejected." If the contractor delivers a revised deliverable, DOI shall have fifteen (15) days after receipt of such revised deliverable to “Accept” or “Reject.” DOI shall provide written notice of a final rejection of the revised deliverable and to specify reasonable grounds for such rejection, which cannot be new grounds not previously specified unless such new grounds arise solely because of the revisions made to the original deliverable that DOI rejected. If DOI fails to provide written notice of final rejection as provided above, the revised deliverable shall be "Accepted."

GENERAL ACCEPTANCE CRITERIA

The specific acceptance criteria for each deliverable are detailed in the table below. In addition, the general criteria set forth below will be applied to each deliverable received from the contractor under this PWS. Any perceived conflict between specific acceptance criteria referenced in this PWS and the general criteria listed below shall be reported to the COR immediately.

Accuracy – Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity – Work Products shall be clear and concise. All diagrams shall be easy to understand and relevant to the supporting narrative.

Consistency to Requirements – All work products must satisfy the requirements of this PWS.

File Editing – All electronic files shall be editable by the Government using the standard IA software applications (e.g., Microsoft Word, MS Excel, MS Project, and Adobe).

Format – Work Products shall be submitted in a hard copy (when applicable) and in media mutually agreed upon prior to submission. Hard copy formats shall follow IA specified directives or manuals.

Timeliness – Deliverables shall be submitted on or before the due date specified or submitted in accordance with a later scheduled date mutually agreed to by the contractor and DOI as provided in the appropriate section herein (Refer to Deliverables Schedule).

SECURITY REQUIREMENTS

Contractor staffs are required to conform to DOI's security and privacy requirements as described below.

The Contractor shall comply with the Computer Security Act of 1987. All products and deliverables developed under this PWS shall comply with DOI Computer Security guidelines and the guidelines contained in OMB Circular A-130. All contract staff working in DOI office space and/or using the DOI ESN and computer systems to perform duties under this PWS will agree to and sign the DOI Rules of Behavior for Computer Use and a Non-disclosure Agreement. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the COR prior to the employee performing any work under any task order.

The Contractor will be responsible for ensuring compliance by its employees with the security regulations of DOI and other Government installations or contractor facilities where work is performed under this contract. This includes the safekeeping and displaying of a Government-provided photo ID badge for employees of the contractor and any subcontractors while these employees are in Federally owned or leased property as described under the Place of Performance. The contractor will ensure the security of all DOI property, building ID badges, key cards, and standard keys issued to contractor staff. For employees leaving the project permanently or for an extended period, the contractor will return all badges, property, key cards, parking placards, and keys the same day the employees leave the project. Contractor employees will not have access to DOI facilities, information systems, security items and products, and/or sensitive but unclassified information, until all Human Resources (HR) personnel security paperwork is completed and delivered to DOI. The cost for any investigations required under the contract will be borne by the Government.

Background Investigations: DOI is required under the Homeland Security Presidential Directive (HSPD) 12 “Policy for a Common Identification Standard for Federal Employees and Contractors” to perform a National Agency Check with Inquiries (NACI) for Contractors. The NACI is a brief form of background investigation that is conducted through the Office of Personnel Management. This investigation is for contractor staff assigned to this contract. Contractor staff will be required to provide two forms of acceptable identification, provide a current photograph, and to be fingerprinted. Successful clearance is required for an employee to continue working under this contract.

Per the Personal Identity Verification of Contractor Personnel clause of the Federal Acquisition Regulation (FAR 52.204-9):

The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), OMB guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a Federally controlled facility or access to a Federal information system.

The provisions of the Privacy Act of 1974 protect privacy portions of information disclosed during the performance of this task; therefore, all personnel assigned to this Contract are required to take proper precautions to protect the information from disclosure.

Contractors are required to sign nondisclosure agreements as a contingent part of their employment. They are also required to sign the DOI Rules of Behavior and complete security and privacy training before being granted access to a DOI computer system or network. Information security and role-based privacy training must be completed on an annual basis as a contractual employment requirement.

Federal Acquisition Regulation (FAR) 52.224-1, Privacy Act Notification (Apr 1984) FAR 52.224-2, Privacy Act (Apr 1984) FAR 52.224-3, Privacy Act Training (Jan 2017) FAR 52.239-1, Privacy or Security Safeguards (Aug 1996) Ownership – All products and deliverables developed under this PWS are the property of the U.S. Government and DOI.

Commitment to Protect Sensitive Information: The Contractor shall not release, publish, or disclose sensitive information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of sensitive information: 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records) Security Compliance – The Contractor shall ensure compliance with Federal, Department of the Interior, Office of Information Management Technology and security rules, regulations, and policies. As soon as a there is a breach, heard of or found by the OIMT Helpdesk the contractor shall report suspected computer security breaches to the Computer Incident Response Team (CIRT), COR and the Federal Task Lead. Each contractor is required to take the Federal Information Security Assessment (FISSA) before starting and annually thereafter. They are required to adhere to all of the laws, regulation, policies, directives and the Rules of Behavior defined within.

Required Security Training: All DOI employees and contractors must receive security awareness training prior to being given access to DOI systems and periodically thereafter as required by DOI security policies The contractor is responsible for ensuring all employees possess and maintain current IT security qualifications during the execution of this contract.

CONTRACTING OFFICER’S REPRESENTATIVE

The COR will be identified by a separate letter. The responsibilities of the COR are to monitor all technical aspects of the contract and assist in contract administration. The COR performs the following functions: assure the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the Contracting Officer and contractor of any deficiencies; and coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which will be sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

OIMT Information Systems Security Officer (ISSO)/BIE Federal Project Manager (PM) – The OIMT ISSO will work alongside the BIE Federal PM and will serve as the day-to-day decision-makers, technical leads, and Subject Matter Experts (SME), for the Government in their respective technical fields. The contractor assigned will receive work assignments from the BIE Federal PM and provide recommendations of work assignments. The COR will handle any contractual issues.

GENERAL LABOR SPECIFICATIONS

EMPLOYEE CONDUCT: Contractor employees shall present a professional appearance at all times and their conduct shall not reflect discredit upon the United States and or the U.S. Department of the Interior.

REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS: The Government may, at its sole discretion, direct the contractor to remove any contractor employee from U.S. Department of the Interior facilities for misconduct or security reasons. Removal does not relieve the contractor of the responsibility to continue providing the services required under any contract awarded. The Contracting Officer will provide the contractor with a written explanation to support any request to remove an employee.

CONFLICT OF INTEREST: The contractor shall not employ any person who is an employee of the United States Government if that employment would appear to cause a conflict of interest.

STAFFING PATTERN: The contractor shall provide a staffing pattern as part of the management approach showing which candidates are proposed for the particular task areas as defined in Part 6 of this PWS.

GOVERNMENT FURNISHED EQUIPMENT

As needed, government furnished equipment will be provided to contractor for reverse engineering efforts. Contractor must be capable of obtaining necessary security access to use Government networks.

PERFORMANCE REQUIREMENTS SUMMARY

Table 2: Performance Requirements Summary

DELIVERABLES SCHEDULE

Table 3: Deliverables Schedule

POINTS OF CONTACT

Table 4: Points of Contact

Deputy Bureau Director, Bureau of Indian Education 505-563-5235

Acting Deputy Associate Chief Information Officer, Bureau of Indian Education 703-648-5517

Senior Program Analyst, BIE School Operations, Bureau of Indian Education 505-239-9068

Finance Analyst, Phoenix Education Resource Center, Bureau of Indian Education 602-265-1592

Information Security Specialist 505-563-3910

Senior Project Manager 703-390-6735

Database Administrator, Goldbelt Hawk 505-563-5012

Application Specialist, Goldbelt Hawk 505-563-5208

Application Specialist, Goldbelt Hawk 505-563-5351

This Document Contains Controlled Unclassified Information (CUI) Office of Information Management Technology 4 image1.png image2.png image3.png image4.png image5.png