Attach 9- Task 7 Enterprise Architecture.pdf

Information Technology Support Services (ITSS)

Task Statement of Work

(TSOW 7)

Enterprise Architecture (EA) and Change Management (CM)

22 November 2022

Enterprise Services Center 6500 South MacArthur Boulevard

Oklahoma City, OK 73125

December 8, 2022

Table of Contents

1.0 Introduction and Overview

2.0 Background

3.0 Description of Work

4.0 Definitions/Acronyms

5.0 Performance Outcome(s)/Deliverable(s)

5.1 Outcome No. 1: Alignment of IT strategy and planning with company's business goals. 8

5.2 Outcome No. 2: Direct/Indirect participation in long-term strategic planning . Error!

Bookmark not defined.

5.3 Outcome No. 3: Management of the risks associated with information and IT assets through appropriate ...................................................... Error! Bookmark not defined.

5.4 Outcome 4: Research, analyze, design, propose, and deliver solutions that are appropriate for the ................................................................... Error! Bookmark not defined.

5.5. Outcome 5. Formulate, create and maintain meaningful dashboards from the Change Management systems.................................................. Error! Bookmark not defined.

6.0 Reference Documents

7.0 TPWS Support Requirements

8.0 Place of Performance

9.0 Work Schedule

10.0 Training

11.0 Travel

12.0 Privacy and Security Requirements

13.0 Government Furnished Property

14.0 Government Surveillance - Inspection and Acceptance Criteria

15.0 Technical Exhibits: Performance Requirements Summary

Task Statement of Work (TSOW) Enterprise Architecture/Change Management

Engineering & Implementation Section

Task Reference : TSOW 7 – Enterprise Architecture & Change Management Type: Labor Hour (2 years) Firm Fixed Price

1.0 Introduction and Overview

The Engineering and Implementation Section consists of the Architecture and Design Unit and the Implementation and OPS Transition Unit. The mission of the Engineering and Implementation Section is to provide ESC technical solutions to business needs at an enterprise-wide level. The team is responsible for providing enterprise-wide strategic direction for IT initiatives to include opportunities and risks.

The Architecture & Design team makes up the Technical Review Board (TRB) for ESC and is responsible for evaluating proposed ESC Information Technology Business Cases based on the established criteria associated with the Office of Management and Budget Exhibit 300 requirements.

The Implementation and OPS Transition Unit, or the Change Management Unit, is responsible for providing ESC with enterprise-wide Change Management guidance, direction, and oversight. This is accomplished through the publication of high level Change Management standards and processes, chairing Change Control Boards (CCB), evaluating changes for conflicts with other actions and providing conflict resolution. The Change Management Unit will monitor change actions to determine if there are issues which will impact the successful completion of changes and assist with mitigation.

2.0 Background

The ESC organizations had a re-organization in 2013, from which new organizations were developed. The Implementation and OPS Transition Unit is one of the new organizations and was developed to provide enterprise wide strategic direction and configuration management to ESC processes and projects. The Enterprise Architect team was developed to provide enterprise wide strategic direction for the technical infrastructure for ESC.

3.0 Description of Work

The objective of this task is to furnish support to assist the team in accordance with the specified requirements and projects. The support can be from developing a solution for cloud computing to developing a new release management process in accordance with industry standards. The Engineering and Implementation Section provides these services, solution, and processes which allows ESC the policies and procedures necessary to improve business performance, delivery of products and services, and gain efficiencies and improvements. The systems design for architecture documents required by ESC includes but is not limited to cloud computing, research from internal and external technical resources, understanding of customer requirements and the ability to produce highly skilled documents outlining the most effective long term solution for ESC. The teams coordinate all endeavors with the ESC Project Management Office (PMO) on all projects.

A compulsory understanding of the unique challenges that the Cloud introduces is an on-going requirement of this task. In addition, a working knowledge of process improvement by defining workflows, value streams, and process metrics is required.

Further experience with configuration management systems such as, but not limited to:

• Remedy Atrium Configuration Management Database (CMDB)

• Experience working with an ITIL based ITSM life cycle

• ITIL Foundation Certification v3

• BMC Remedy/Atrium

• Configuration Management Database (CMDB) Change Management

• Service Catalog

• Service Desk

• Incident Management

• Release Management

• Service Delivery

Infrastructure architect(s) are to provide designs for enterprise infrastructure that is scalable, adaptable and aligns with the agencies vision and strategy and considers changing business needs while driving innovation and value through all assigned enterprise projects. Also Direct/indirect involvement in application of policies, standards and guidelines that direct the selection, development, implementation and use of Information Technology within the enterprise is required.

Management of the risks associated with information and IT assets through appropriate standards and security policies is critical throughout ESC. Contractor direct and/or indirect involvement in application of policies, standards, and guidelines that direct the selection, development, implementation, and use of information technology within the enterprise is adhered to. Contractors will be required to stay current on new technologies and associated vulnerabilities while applying current knowledge of agency mandates, policies and guidance.

All proposed solutions will integrate mandated security early and throughout the development of the proposals.

Contractors will collect and analyze change practices within the various systems of the enterprise and provide cutting edge recommendations based on the collected information.

Assist in implementing and improving tooling, technologies and processes to support the automation and configuration of builds, deployments, testing and infrastructure. This effort is to support the development of our mission critical software track builds and installer components for both desktop and web-based deployments. Contractor may function as the technical liaison between development, software quality assurance, project management, configuration management, and technical support teams. Contractor will also lead the effort to resolve issues, implement solutions, provide guidance to members of the product team, and evolve the technical agility of the domain.

Contractor will be responsible for research, analyze, design, propose, and deliver solutions that are appropriate for the business and technology strategies and provide the most efficient and secure IT environment possible. Coaching and mentoring technical staff, solution architects, identifies talent and ability for others to become architects are requirements of this task order.

Contractors will collect and analyze change practices within the various systems of the enterprise and provide cutting edge recommendations based on the collected information.

They will also assist in implementing and improving tooling, technologies, and processes to support the automation and configuration of builds, deployments, testing and infrastructure.

This effort is to support the development of our software system(s).

Contractors will work with team and be responsible to track builds and installs of components for both desktop and web-based deployments. Contractors may function as the technical liaison between development, software quality assurance, project management, configuration management and technical support, as necessary. Also will lead the effort to resolve issues, implement solutions, provide guidance to members of the product team and evolve the technical agility of the domain.

Contractor will produce implementation guides and end-user guides for capabilities;

provides field, data definition, and data flow documentation and formats technical publications from pamphlets, technical drawings, and consultations with technical personnel and other available resources. They will also be active participant on the CCB.

This requires the ability to analyze requirements of project to determine types of publications needed as well as being responsible for preparing reports, responses, and briefings targeted to a wide range of audiences. In addition, contractor will be responsible for preparation, review, revision, and maintenance of technical documents including software and systems engineering, system operations, testing, and user documentation

4.0 Definitions/Acronyms

CCB – Configuration Control Board

COR – Contracting Officer Representative

ESC – Enterprise Services Center

GSA – General Services Administration

ISS – Information System Security

IT – Information Technology

ITIL – Information Technology Infrastructure Library

ITSM – Information Technology Service Management

PWS – Performance Work Statement

SLA – Service Level Agreement

SOP – Standard Operating Procedure

SOW – Statement of Work

TRB – Technical Review Board

TSOW – Task Order Statement of Work

5.0 Performance Outcome(s)/Deliverable(s)

5.1 Intake: The EA team supports the ESC Intake Management Program Management Package (PMP) process for internal and external customers by providing the technical solution to an initial business case for work by the ESC teams and for Level-of-Effort evaluation and pricing.

5.2 Enabler - SAFe ART: During the SAFe Planning event, team support or solution requests are identified and placed in the SAFe team and EA backlogs with the mutually agreed deliverable and iteration for the planned work to be completed.

5.3 Enabler - Roadmap & Architecture Design: The EA team is responsible for creating and maintaining ESC technical roadmaps showing the current and future state of applications and products.

5.4 Enabler - Software Waiver: The EA team receives software requests for products not already approved for use within ESC or on the AIT Roadmap. EAs review these requests and provide analysis and a recommendation.

5.5 Enabler - Intake: After an item exits the Intake process it is worked by the ART team.

At this point, the EA team provides clarification and guidance on implementing the technical solution provided during the Intake process as needed.

5.6 Enabler - Technical Debt: The EA team uses these enablers to identify and provide solutions to resolve specific technical debt items.

6.0 Reference Documents

• Information and documentation from the Federal Aviation Administration

Acquisition System Toolset

• (FAST) website - http://fast.faa.gov/

• FAA Order 1370.91 – ISS Patch Management

• FAA Order 1370.82 – ISS Program Policy

• FAA Order 1370.92 – Password and PIN Management

• Federal Enterprise Architecture Framework

• Security Guidance

FAA Branding Requirements:

https://employees.faa.gov/tools_resources/web/requirements/templates_branding/.

NIST SP 800-95 Guide to Secure Web Services (as amended) NIST SP 800-44 version 2 Guidelines on Securing Public Web Servers (as amended)

MITRE, CWE and CERT Secure Coding Standards:

http://resources.sei.cmu.edu/library/results.cfm?as_q=inmeta:gsataxonomyoutput~Se cure%20Coding Open Web Application Security Project (OWASP) code compliance https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_Checklist

CERT

https://www.securecoding.cert.org/confluence/display/seccode/SEI+CERT+Coding+ Standards https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Codi ng+Practices

7.0 TSOW Support Requirements

Contractor must provide on-site task lead functions to include:

a. Coordinating with the COR on task issues/concerns;

b. Performing work on the task;

c. Providing OJT to new contract employees;

d. Managing and assigning work to contract employees;

e. Managing contract employees leave, schedules, timecards, etc.

The skill level positions required on this task order are in the following table. Although this is a team effort, the table includes the TSOW outcome that describes the tasks these positions are primarily assigned to. Contractor may use their equivalent positions, if contract positions do not have the exact same title as in the table. FAA does not provide training to contractor personnel or have an unnecessary learning curve. One of the positions must serve as the on-site task lead functions listed below:

Outcome Labor Category Quantity 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Information Engineer IV 4 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Information Engineer III 1 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Systems Architect III 2 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Technical Writer II 2 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Functional Analyst II 1 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Functional Analyst II 1 5.1, 5.2, 5.3, 5.4, 5.5, 5.6 Office Automation Specialist IV 0

8.0 Place of Performance

Unless otherwise agreed to by both parties, all work is to be performed on site at the FAA/MMAC in Oklahoma City, OK. Exact location is

Federal Aviation Administration

Enterprise Services Center (ESC) Mike Monroney Aeronautical Center Engineering and Implementation Section (AMK-211) 6500 S. MacArthur Blvd Oklahoma City, OK 73125

As part of this effort, the Contractor may be working and attending meetings at government facilities and field facilities. The Contractor may be granted ingress and egress to FAA facilities at all times during normal working hours to obtain information necessary for performance of the contract.

While Contractor personnel are at the government site, they are required to comply with all rules and regulations in effect at that site. Contractor personnel will comply with rules and regulations governing employee conduct with respect to health and safety, not only as they relate to themselves, but also to other government employees or agents of the Government.

The Contractor will also exercise proper care of all property at the government site regardless of whether title to such rests with the Government or not.

9.0 Work Schedule

The contractor will work and have access to the Government's ADP facilities during normal duty hours (0600-1800), Monday through Friday, and any other times approved by the COR, for the purpose of meeting deadlines or increased workload.

The task requirements are variable and unpredictable, and may require other than normal periods of work. The contractor personnel may be required to work flexible workdays, including weekends. In this case, the normal work will may exceed (40) hours. All hours worked in excess of (40) hours during a calendar week will be considered premium hours.

The contractor will incur no cost for the use of Governments facilities throughout the duration of the task, providing that the contractor's use of those facilities are directly associated with task accomplishment.

Contractor personnel are expected to work 5 days, 40-hour workweeks, with the exception of part-time personnel. The five workdays will not include weekends unless deemed necessary by the Government and coordinated with the COR in advance. Examples of such exceptions may include weekend travel to a meeting or data collection site. The needs of the Government will always take precedent over flexible work arrangements. It is expected that work will primarily take place during normal Government working hours, however, some data collection activities or simulations may require alternative hours (such as second shift) or longer hours due to facility availability, project deadlines, or nature of data collected.

These situations must be coordinated between the Task Lead in advance. Telework is permitted with approval from the COR.

10.0 Training

Contractor personnel may be required to attend training classes at the work site or at other facilities. There is required online training the contractor will be required to do each year.

Contractor is responsible for ensuring their employees receive training associated with this task order. The contractor will ensure all staff are trained in SAFe 4.0 or higher.

11.0 Travel

Contract personnel may be required to travel on assigned projects as technical representatives of the Engineering and Implementation Section. Any and all travel will be coordinated and approved by the COR in advance.

All requirements for travel that apply to federal employees will apply to contractors under this statement of work.

Travel is reimbursed in accordance with the Federal Travel Regulations (FTR).

12.0 Privacy and Security Requirements

Contractor will comply with all applicable DOT, FAA, and local security directives while performing work under this contract. The Government will require all persons working in this task order to provide personal background data on Government furnished forms to appropriate FAA security organizations for initiation of the appropriate personnel security investigations. All personnel on this task are required to have a moderate risk security level as designated by Office of Personnel Management (OPM) definitions.

Information and data made available to the Contractor by the Government for the performance or administration of this effort will be used only for those purposes and not used in any other way without the express written permission of the Contracting Officer.

Additionally, the Contractor will protect the confidentiality of all data, associated analyses, and reports that are not public information. Contractor personnel must not divulge or release data or information developed or obtained in the performance of this effort until made public by the Government, except to authorized Government personnel upon express written approval of the Contracting Officer. All documentation will comply with the DOT memorandum ACP-300-99-001, “Safeguarding and Control of Sensitive Security Information (SSI)”. This will include SSI marking and handling of all material and destruction of unused data.

13.0 Government Furnished Property

Reference PWS 6.3 for Government Furnished Property (GFP) consideration.The Government will provide desk space and user ID/password access.

All equipment used for daily work activities will be furnished by the ESC/FAA. Access to the facility and buildings will be provided by ESC/FAA. Key cards will be used to access appropriate buildings. Keys and key cards will be used to access office space. All key cards, keys, and other access tools will be signed for by the contract employees.

14.0 Government Surveillance - Inspection and Acceptance Criteria The Government will evaluate the contractor’s performance on this task in accordance with the Technical Exhibits provided in Section 15.0 below.

The Exhibits are focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

15.0 Technical Exhibits: Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Task Deliverable(s) Applicable Standard(s)

Performance Schedule / Requirement (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

TSOW 5.1.1.

Alignment of IT strategy and planning with company's business goals

Services will be provided on an on-going basis

5.1.1 Documents are routinely updated.

TSOW 5.2.1, 5.2.2., 5.2.3

Direct/Indirect participation in long-term strategic planning

Services will be provided as needed

5.2.3 Documents are reviewed for clarity and

mission accomplishment

TSOW 5.3.1, 5.3.2, 5.3.3

Management of the risks associated with information and IT assets through appropriate standards and security policies

Security policies and guidance is addressed throughout the development process

5.3.1, 5.3.2, 5.3.3 On-going adherance to security goals is apparent.

TSOW 5.4.1, 5.4.2, 5.4.3

Research, analyze, design, propose, and deliver solutions that are appropriate for the business and technology strategies and provide the most efficient and secure IT environment possible

Services will be

TSOW 5.4.1, 5.4.2, 5.4.3 Documents are reviewed for clarity and mission accomplishment

TSOW 5.6.1

Documentation of software documentation and implementation guides

Services will be

TSOW 5.6.1 Documents are reviewed for accuracy and delivered timely