Attachment 1 - Draft requirements IT support services FINAL.pdf

Attachment 1 IT Support Services Draft Requirements

Federal Election Commission Office of the Chief Information Officer Applications Branch

Section C – Statement of Work C.1 Introduction The FEC was created by Congress in 1974 to administer and enforce the Federal Election Campaign Act (FECA) - the law that governs the financing of federal elections. The duties of the FEC are to disclose campaign finance information, to enforce the provisions of the law such as the limits and prohibitions on contributions and to oversee the public funding of presidential elections.

The Applications Branch ensures agency employees have software and other technology that allows them to perform their day-to-day responsibilities administering and enforcing campaign finance law. The branch is responsible for developing and supporting analytic reporting tools that help staff perform their disclosure and compliance duties.

In addition, the branch supports systems that serve as the public’s primary source of campaign finance legal resources. In this way, the Applications Branch and OCIO serve a pivotal role in ensuring the FEC protects the integrity of the federal campaign finance process by supporting the agency's legal and compliance staff in their objectives of promoting compliance with and interpreting FECA and the related statutes and by ensuring that the public has access to reliable data describing how candidates raise and spend funds to support their campaigns.

C.2 Project Description C.2.1 IT Support Services Operate, maintain and update Application Branch applications and systems. Refer to Section C and the attachments listed in Section J.

C.2.2 Informatica Tool Expert Informatica tool expert (Informatica administrator) must have the required expertise to patch and upgrade the agency’s Informatica servers and maintain, modify and create new mappings.

C.3 Scope The contractor will be responsible for completing all tasks necessary for daily operations and application maintenance, updates, upgrades and security. All Java/Apache Tomcat and .Net applications have the latest software and security patches applied. All Application Branch applications are deployed in the FEC’s AWS cloud environment. As legislative, regulatory and policy requirements change, many of these applications must be regularly updated to meet the new specifications.

C.3.1 Searchable Legal Applications Application Technology SERS / FOSERS Java/Apache Tomcat/Oracle /PostgreSQL SERS / FORCES Java/Apache Tomcat/Oracle /PostgreSQL SERS / FRAPS Java/Apache Tomcat/Oracle /PostgreSQL AODES Java/Apache Tomcat/PostgreSQL SMUR Java/Apache Tomcat/PostgreSQL

See Attachment 1A. FEC Searchable Legal Systems

C.3.2 Disclosure Applications

Data Capture Java/Apache Tomcat/Oracle Entry Verification Processing Report Java/Apache Tomcat/Oracle Senate Paper Printing System .Net/Oracle Admin Fines Java/Apache Tomcat/Oracle Calendar Management Java/Apache Tomcat/Oracle Compliance Tracking Java/Apache Tomcat/Oracle Debt Settlements Java/Apache Tomcat/Oracle Information Management Java/Apache Tomcat/Oracle Non-Filers Java/Apache Tomcat/Oracle RAD Reports Java/Apache Tomcat/Oracle Track Committees Java/Apache Tomcat/Oracle Informatica COTS/Oracle Crystal Reports COTS

See Attachment 1B. FEC Disclosure Suite

C.3.3 Reports Analysis (RAD) Modules

RAD Modules .Net/Oracle FEC Email (SMTP) Java/Apache Tomcat/Oracle FEC Letter (SMTP) Java/Apache Tomcat/Oracle Informatica COTS/Oracle Crystal Reports COTS

See Attachment 1C. FEC RAD Modules

C.3.4 Crystal Reports The Disclosure Applications and RAD Modules use Crystal Reports to provide FEC business offices with various reports.

Application Technology Crystal Reports COTS

C.3.5 Informatica Informatica is used within the Disclosure Applications and RAD Modules as part of the managed services CLIN of this requirement.

The Informatica tool expert (Informatica administrator) CLIN of this requirement is for a resource with the required expertise to patch and upgrade the agency’s Informatica servers and maintain, modify and create new mappings.

Application Technology Informatica COTS

C.3.6 Database management The FEC uses a mix of Oracle and PostgreSQL to support our applications.

Application Technology Oracle COTS PostgreSQL Open source

C.4 Requirements C.4.1 General Performance The contractor will be required to use commercial, innovative, and/or state-of-the-art practices and techniques that best meet the government’s requirements. The contractor shall provide the necessary management, supervision, labor, and administrative support, for the accomplishment of services. The contractor shall plan, schedule, coordinate and ensure the full, effective, efficient, and economical performance of all services ordered under this contract. The contractor must designate a project manager as key personnel to attend all scheduled meetings.

C.4.2 Kick-off Meeting The contractor and COR will have an initial Kick-off Meeting to review the contractors’ technical approach associated with this FFP requirement, overall project schedule, and any other information that would be useful to FEC management.

C.4.3 Documentation The contractor shall maintain all documents of record indicating information and decisions throughout the course of this FFP contract.

C.4.4 Project Contact Directory The contractor will be required to submit a Project Contact Directory. This shall include project team member names, agency/company, role/responsibility, phone numbers, and emails. It must be updated regularly. The Project Contact Directory shall be submitted five business days after award.

C.4.5 Weekly Meetings When scheduled, the contractor’s key team members are required to call in to all scheduled meetings for this project. The COR or the Program Manager may call unscheduled meetings with four-hour notice to the contractor.

C.4.6. Monthly Meetings with Business Owners The contractor shall have a monthly planning and status meeting with the COR and business owners of the applications during which the status reports submitted under C.4.8 are presented.

C.4.7 Meeting Minutes The contractor will document all project meetings and other conferences. These documents/meeting minutes are due one (1) business day after the meeting or call is held (upon request).

C.4.8 Status Reports The contractor will submit status reports once every two weeks and upon request. Status reports are to be presented in typed form. Acceptable formats for electronic documents include all Microsoft formats (Word, Excel, Power Point, Project, Visio, etc.) and PDF. Reports shall be issued to the COR.

C.4.9 Tracking Work The FEC uses Jira to track work. The COR (Contracting Officer’s Representative) and contractor will work with the users to ensure that the Jira tickets are prioritized appropriately. The contractor will provide a level of effort for each ticket to help in this effort. This activity will be covered in bi-weekly status reports.

C.4.10 Maintain Applications Please refer to the attachments for a detailed description of the applications and environment as well as the type, volume and complexity of the work. The attachments provide an application overview, performance, environment, architecture and SLAs (if any).

C.4.10.1 Maintain Searchable Legal Applications The contractor must maintain the searchable legal applications and associated databases. The searchable legal applications are the main tool for the Office of the General Counsel - Policy Division to draft advisory opinions (AOs), Notices of Proposed Rulemaking, final rules, and similar documents interpreting the federal campaign finance law for the Commission to consider. The Policy Division also provides legal advice in response to legislative inquiries, legal reviews of all Commission publications, and training Commission staff regarding changes in the law. Please see the Attachment 2: MaintenanceSpec_SearchableLegalSystems.zip attachment for a more detailed breakdown of these applications. The following skillset is required to support these applications: Java, Apache Tomcat, Spring Framework, Angular, SQL development and performance optimization, Oracle, PostgreSQL, SecDevOps, Shell Scripts and AWS. Technical oversight will be provided by the COR and the FEC Deputy CIO of Enterprise Architecture.

The contractor must produce thorough software test plans, testing and test results and strictly follow production release management and procedures. Technical oversight is performed by the business users and OCIO Applications Branch.

The contractor must ensure all applications are up to date with patching. The contractor must resolve critical and high security tickets.

C.4.10.2 Maintain Disclosure Applications The contractor must maintain the disclosure applications. Candidates and political committees in federal elections must meet specific filing and reporting regulations. The Commission's databases are the repository for campaign finance data, statements of candidacy, and statements of organization. There is a suite of applications that pulls data from the Commission’s databases.

These applications provide Commission staff with tools for Administrative Fines, Compliance Tracking, and Data Capture. Please see the Attachment 3: MaintenanceSpec_DisclosureSuite.doc attachment for a more detailed breakdown of these applications. The following skillset is required to support these applications: Java, Apache Tomcat, SQL development and performance optimization, Oracle, PostgreSQL, Informatica, Crystal Reports, SecDevOps, Shell Scripts and AWS. Technical oversight will be provided by the COR and the FEC Deputy CIO of Enterprise Architecture.

The contractor must produce thorough software test plans, testing and test results and strictly follow production release management and procedure; Technical oversight is performed by the business users and OCIO Applications Branch.

The contractor must ensure all applications are up to date with patching. The contractor must resolve critical and high security tickets.

C.4.10.3 Maintain Reports Analysis (RAD) Modules The contractor must maintain the RAD Modules and associated databases. The RAD Modules serves as the main workload tool for three branches within the Reports Analysis Division

(RAD). The tool helps both RAD analysts and management track the reports and documents that need to be reviewed to ensure they comply with the FECA. Please see Attachment 4:

MaintenanceSpec_RADApplications.zip for a more detailed breakdown of this application. The following skillset is required to support these applications: Java, Apache Tomcat, SQL development and performance optimization, Oracle, PostgreSQL, Informatica, Crystal Reports, SecDevOps, Shell Scripts and AWS. Technical oversight will be provided by the COR and the FEC Deputy CIO of Enterprise Architecture.

The contractor must produce thorough software test plans, testing and test results and strictly follow production release management and procedure; Technical oversight is performed by the business users and OCIO Applications Branch.

The contractor must ensure all applications are up to date with patching and must resolve critical and high security tickets.

C.4.11 Desired Skills and Knowledge The contractor will provide the skillsets and expertise needed to fulfill the services described in this requirement. At a minimum the FEC will require the following skills: Java, Apache Tomcat, SQL development and performance optimization, Oracle, PostgreSQL, Informatica, Crystal Reports, SecDevOps, Shell Scripts, project management and quality assurance.

C.4.12 Unscheduled requests As legislative, reporting forms, or other requirements can change, the FEC often makes unscheduled requests for data, data subsets, files from backup, changes, or enhancements to these systems. These requests are typically made on a “need it now” basis and may be critical.

The quoter must demonstrate that they have the resources and the flexibility to manage and perform these types of requests without impacting the application and system maintenance or other initiatives. These requests shall be included as part of normal maintenance efforts.

C.4.13 Knowledge Transfer The contractor must provide knowledge transfer, technical coaching and advice to FEC technical staff.

C.4.14 Informatica Support For CLIN 0002 and optional CLINs 1002, 2002, 3002 and 4002, the contractor must provide an Informatica tool expert (Informatica administrator). This resource must have the required expertise to patch and upgrade the agency’s Informatica servers and maintain, modify and create new mappings.

C.4.15 Quality Assurance Surveillance Plan (QASP) The following chart sets forth the performance standards and quality levels the code and documentation provided by the contractor must meet, and the methods the FEC will use to assess the standard and quality levels of that code and documentation.

Deliverable Performance

Standard(s) Acceptable Quality Level Method of

Assessment Tested code Code delivered must have substantial test code coverage and a clean code base

Code goes through peer review before merge

Minimum of 85% test coverage of all code with meaningful tests as determined by the agency, such as test-driven development (TDD).

Tests are run as part of the CI/CD pipeline

At least one approving review before code changes are merged

Combination of manual review and automated testing

Properly styled code

Source code (including Application code, SQL Statement, and Scripts, must be written, formatted, and organized per the programing guidelines.

Source code must have 100% readability, maintainability, and consistency.

Peer Code review https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices https://www.obeythetestinggoat.com/book/appendix_IX_cheat_sheet.html#_general_testing_best_practices

Web Content Accessibility

Web Content Accessibility Guidelines 2.1 AA and section 508 standards

Less than 10 minimal errors and no major errors reported using an automated scanner and manual testing including but not limited to:

- Easily distinguishable/high contrast colors, type and interactive elements

- Functional keyboard/tab navigation

- All non-text content has a text alternative that serves the equivalent purpose

- Clear webpage title that describes their topic and function/purpose

Combination of manual review and automated testing through an automated tool such as Lighthouse, SiteImprove Accessibility checker, pa11y or Spectrum chrome plugin or other similarly comparable system.

Source Control Management

Source code (including application code, SQL statement, scripts) must be maintained in repository with proper versioning and branch strategy.

All codes must be checked-in to repository such as SVN, Git.

Developer must resolve any code conflicts prior to committing the code.

Peer code review

Code build and Deployment

Code must successfully build and deploy into development, staging, UAT, and production environments

Successfully build with a single command, using CI/CO pipeline.

Combination of manual review and automated testing

Documentation - Major functionality in the software/source code is documented.

All repeated processes have a written process.

- All dependencies are listed and the licenses are documented.

- Individual methods are documented inline using comments that permit the use of documentation-generation tools such as JSDoc.

- A system diagram is provided

- Database structure and team practices are documented

- Product-level decisions must be documented.

All documents must be maintained in Confluence and are reachable by the COR and the FEC Deputy CIO of Enterprise Architecture.

Manual review

Security OWASP Application Security Verification Standard 4.0

- Code submitted must be free of medium- and high-level static and dynamic security vulnerabilities

- FEC data security policies must be followed

Clean tests from:

- Dependencies are

Combination of manual review and automated testing http://cloud.gov/ http://cloud.gov/ http://cloud.gov/ http://cloud.gov/ http://cloud.gov/ http://cloud.gov/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ http://usejsdoc.org/ scanned with an automated tool such as Snyk and npm audit for vulnerabilities

- Static code analysis using bandit and passive scanning with a scanner such as OWASP ZAP along with documentation explaining any false positives

- No more than one major version behind on essential underlying technology

User Interface Design and usability

The UI should look like it’s part of a suite of FEC-branded products. The FEC pattern library must be used as a jumping off point and the family of icons, colors, interactions and typography must be employed as appropriate to ensure consistency across our suite of products and fit the new system

- Components must be reusable

- Clear user flow within the application

- Industry best practices for UI design for modern websites. UI considerations include proper alignment of elements, proper spacing, consistency in sizing, typography, color(s) throughout the product

- Clear user flow and information architecture

- Clear integration of user research and usability best practices

- Friendly, easily understood and actionable content.

UI look and feel must be reviewed and approved by business users.

This is a manual review.

Performance Application must be performant under high load

- Application must be responsive

- Architecture must be scalable

- Must apply load balancer on production websites

- Application performance

Combination of automated testing and manual review must be measured and monitored

Accepted features At the beginning of the sprint, the product owner must set priorities for which user stories will be worked on, represented by tickets with acceptance criteria to determine when they are complete. These tickets must be stored in Jira.

Delivered code meets the acceptance criteria for each user story

Manual review

User Acceptance Test (UAT)

All application changes must be tested by Business Users.

Help Business users to layout and document test scripts, provide support during UAT test.

UAT must be passed and certified with 100% score.

User manually test

Production Release

Production release must happen after UAT certified, unless there are emergency changes due to security ad hoc fix.

Release processes / Steps, along with rollback plan must be clearly documented and attached in RFC Ticket

Zero production issue due to production release.

If there is unexpected environment issue that caused production release failure, production rollback must be performed within defined downtime window.

Post-production verification must be performed.

Manual / User verify

C.4.16 Shared System Responsibilities with FEC The contractor will be responsible for managing the application layer in the development environment, including code deployment and table creation.

Once code is tested and passes QASP standards, the contactor must provide detailed instructions for deployment on the testing (UAT) and production servers. The deployment instructions must be sent to the DBA and/or System Administrator for UAT or production deployment.

The FEC is responsible for server level management including patching on development, UAT and production servers.

The contractor must participate in verification after server maintenance is completed by FEC DBA or System Administrator.

Attachments:

Attachment 1A – FEC Searchable Legal Systems Attachment 1B – FEC Disclosure Suite Attachment 1C – FEC RAD Modules