Attachment 1B - FEC Disclosure Suite.pdf

Attachment 1B - FEC Disclosure Suite Contracting Requirements

FEC Disclosure Suite

Introduction

This document defines contract requirement for Federal Election Committee’s Disclosure Suite Application.

The requirement includes maintaining, upgrading, migrating, or re-architect/re-programing the application, based on the requests from legislation divisions, and/or from security mandates.

Application Overview

Disclosure Suite contains several applications serve on the areas of Administrative Fines, Debt Settlements, Calendar Management, Information Management, NonFilers, RAD Reports, Track Committees.

This is internal applications but it is mission-critical for FEC.

URL is http://disclosuresuite.fec.gov:8080/FECApp

1. Administrative Fines

The application is used by the Office of Compliance for all functions related to the Administrative Fine Program (AFP), which assesses civil money penalties for late or non-filed reports. The primary users are the Compliance Branch within the Reports Analysis Division (RAD) and Office of Administrative Review (OAR). The application is used to identify committees that should be considered for inclusion in the Administrative Fine Program. The application allows batches of cases to proceed through the multiple stages of the AFP. It also serves as a case management system and is the sole data entry point for all AFP matters. The application also houses numerous financial and statistical reports.

Administrative Fines is a component of the Disclosure application and it has seven sections that are defined below:

o 31-5 Report List – This report identifies committees that could potentially be included in the administrative fine program for failure to file or timely file regularly scheduled reports. The report also tracks and manages the cases through all stages of the administrative fines process. Key functions of the 31-5 Report List are electronic submission of case data to the Commission’s Secretary Office for vote certificates and sending data to the RAD Modules for emailing RTB/FD letters.

o 48-Hour Notice Entry – This portion allows members of the Compliance Branch to track and manage filers that fail to file or timely file 48 Hour Notices of contributions.

http://disclosuresuite.fec.gov:8080/FECApp o AF Case Search – This portion allows members of RAD to search and track admin fine cases using the committee ID number and AF number.

o Challenge Queue- This report identifies any challenges to administrative fines that haven’t been closed.

o Management and Production Reports- These reports include financial and statistical reports which track the payment status of cases, productivity, and provide summary data to analyze trends.

o R-Index- This program allows members of RAD to search for a committee’s compliance history and compiles a report of the committee’s filings and correspondence with the Commission.

o O-Index- This is the same as the r-index, but it excludes performance tracking information. It is shared with other divisions in the agency for referable matters.

2. Debt Settlements

The program is used to record and track debt settlements with companies, corporations, or LLCs that are disclosed on FEC Form 8 filed by Committees.

The application is used by the Compliance Branch to record and track Debt Settlements disclosed on FEC Form 8 that are filed by registered committees. A Debt Settlement Plan is used by committees to settle debts for less than the amount owed. Debt Settlement Plans are placed on the public record, and the Compliance Branch follows criteria laid out in the RAD Review and Referral Procedures for approving, rejecting, or possibly referring the plans. Within the program the Compliance Branch enters in creditor information disclosed on a Form 8 to compare against plans submitted by other committees in the past.

3. Information Management

The Information Management system fulfills many of the functions described in our previous response to the SMTP Gateway request: Prior Notice distribution, Post-Election Reminder emails (Losergrams), the Inforder order tracking and inventory management system, new committee emails, newsletter mailings and other ad hoc informational mailings.

The Information Division uses the Disclosure Suite to:

o Send and track prior notice emails informing political committees of upcoming reporting deadlines:, o Send post-election instructional messages to unsuccessful candidates;

o Generate and send automated informational emails to newly-registered committees;

o Process publication orders and track inventory;

o Send ad hoc informational emails to various segments of the regulated community;

and o Via a separate module, manage the Commission calendar on FEC.gov.

4. NonFilers http://fec.gov/

The Non-Filer program is used by the Compliance Branch, which is part of the Reports Analysis Division (RAD), to identify and track candidates that have not filed timely or properly.

The Non Filer Report is a component of the Disclosure application and it has four main sections that are defined below:

o Ballot Verification Report - The program allows members of the RAD team to verify the accuracy of candidates listed on the ballot for a specific election.

o Non Filer Search - This report allows RAD members to search for filers included in the Non Filer program. This is not a critical section of the program as we typically can use other methods to obtain this information.

o Non Filer Report - This report identifies committees that may have failed to timely file required regularly scheduled reports with complete coverage dates. RAD members use this program to send letters to these filers, identify committees to be published for failure to file, and track their responses.

o Non Filer 3L Report - This report identifies committees that may have failed to timely file required lobbyist bundling reports on Form 3L. RAD members use this program to send letters to these filers and track their responses.

o Non Filer IE Report - This report identifies filers that may have failed to timely file quarterly reports due to correspond with 24/48 Hour Independent Expenditure reports. RAD members use this program to send letters to these filers and track their responses.

o NF Stats - This report lists stats for all Non Filers per calendar year.

o Data Verification Reports - This program allows RAD members to identify candidates and committees that have not filed properly. This includes the Disavowal Report, Candidate Status Update Report, RQ-5 Report, Filing Frequency Alert Report, and Unlinked Candidate/Committee Report that allows RAD members to identify and correct errors in data that would impact the correct operation of Non- Filer and Administrative Fine Programs.

o Election Tables - This program allows RAD members to identify reports and filings that are required for elections as well as search for those requirements.

5. RAD Reports

RAD Reports is a component of the Disclosure application. RAD Reports has four main functions: review tools, administrative termination, management reports for tracking performance, and File Room management.

RAD Reports is a component of the Disclosure application and it has four main sections that are defined below:

o Management Reports – These reports allow managers in the Reports Analysis Division (RAD) to track employee performance per established policies and procedures. It also has reports that provide statistics for RAD that highlight the volume of work completed.

o Administrative Termination- The report identifies committees who are potentially eligible for Administrative Termination per the established policies and procedures.

o File Room Management – This portion allows members of RAD to check out paper documents from the RAD File Room. It also allows members of the File Room to track those files that have been checked out.

o Miscellaneous Reports – This portion consists of a number of reports and tools that aid RAD members in reviewing reports and documents filed with the FEC. These tools are essential in ensuring that committees are following the rules laid out in the Federal Election Campaign Act (FECA). Examples include the MC Update, which provides RAD analysts with information that determines whether certain committees have met the criteria for multicandidate status (qualification). Another example is Code Check, which ensure that certain transactions disclosed on FEC reports were accurately coded, which is needed for additional tools that check whether committees made or received excessive contributions.

6. Track Committees

This system contains all federal state election dates relied upon for campaign finance reporting purposes (primary, runoff, general, caucus/convention, special elections), the candidates on the ballot in each election, and the corresponding election results for each election (“winners” and actual vote totals obtained from official state sources). The system is integrated with the Reports Analysis Division’s Non-Filer Program, the Information Division’s Prior Notice information system, and FEC website calendars.

The information in this system is used by several other offices and existing FEC applications. This system contains all federal state election dates relied upon for campaign finance reporting purposes (primary, runoff, general, caucus/convention, special elections), the candidates on the ballot in each election, and the corresponding election results for each election (actual vote totals obtained from official state sources). The system is integrated with the Reports Analysis Division’s Non-Filer Program, the Information Division’s Prior Notice information system, and FEC website calendars.

Maintenance Specifications

As legislative, reporting forms, or other requirements can change, the FEC often makes unscheduled requests for data, data subsets, files from backup, changes, or enhancements to these systems. These requests are typically made on a “need it now” basis and may be critical.

The quoter must demonstrate that they have the resources and the flexibility to manage and perform these types of requests without impacting the application and system maintenance or other initiatives. These requests shall be included as part of normal maintenance efforts.

Architecture

Application is located on Amazon Cloud

Disclosure Suite is a three-tier application by design.

• Database tier:

Oracle Oracle stored procedure

• Application tier:

java on Apache Tomcat

• Web tier:

JSP, GTW

Application Server EC2 on Linux OS

Software The application utilizes below technologies/software:

• Java

• Oracle stored procedure

• Informatica

• Crystal report

Development and Deployment Approach

Application may be required

• to fix bugs and errors discovered by business users or by automated tools, such as security scans,

• to add/modify features from existing features that requested by business users,

• to update the software to remain compatible with evolving environments, such as new OS versions, or third-party APIs,

• to optimize the performance to improve the speed and efficiency of the application to enhance user experience.

In any above cases, Contractor should meet below requirements:

• Best practice with SDLC and Agility.

• Issue Tracking:

o Use Jira and GitHub to track Issues.

o In each ticket, define severity, priority, and record resolution.

• Code Quality o Code must adherence to coding standards (e.g., Clean Code, PEP 8) and a minimum code coverage 80% percentage for automated tests.

o Code must pass functional tested by contractors on development environments.

• Code Deploy and pass Security Scan o CI/CD (currently in Jenkins) used for code compiling and pass SAST with zero critical security findings.

• Integration Test and UAT o Must conduct Integration test.

o Must conduct User Acceptance Test.

• Change Management: any production changes must o have UAT certified o Request RFC, along with deployment items, servers, impacts, deployment procedure, backup plan.

o RFC approved by CAB.

o In case of emergency fix and deployment, issue and deployment can be documented later than RFC emergency approve, but document must not omit.

• Documentation:

o Maintaining up-to-date documentation, including user manuals and technical documentation, for long-term support.

o Link maintenance requirements to original functional specs to understand the impact of changes as Traceability.

o Treat the maintenance specification as a living document that is updated alongside the software.

o All documents must be accessible by FEC COR and FEC Deputy CIO of Enterprise

Architecture

• Version Control:

o Application source code, sql statements, and any other scripts must use branching strategy to manage hotfixes and new releases.

Availability and Service Level Agreement (SLA)

• Availability o Application is running daily.

o Patch or other maintenance should be scheduled over weekend.

• SLA

o Critical bugs or Urgent issue must be acknowledged within 2 hours, and assign resource to fix it or find temporary workaround within 12 hours.

• Recoverability o Apart from monthly security patch over the weekend, the Maximum Tolerable Downtime (MTD) is 12 hours and Recovery Point Objectives (RPO) is 12 hours.

Compliance & Data Sovereignty

• FEC is following the principles/standards for SOC1, SOC2, SOC3, ISO 27001, ISO 27017,I SO 27018, ISO 9001, PCI, FedRAMP.

Guidance from our legal counsel: HIPAA does not apply to the FEC, since we are not a healthcare provider; however, the Rehabilitation Act and Title VII do apply to us and require federal agencies to protect the confidentiality of medical information.

• Data Classification is Public

• No end-to-end data encryption is required.

Application Security

• User authentication is required to access application

Monitoring

• The application has monitoring solution in AWS.

Backup and Restore

• Production databases and application have daily snapshot and keep the snapshot for past 7 days.

Environment and Shared Responsibilities

• Application installed in individual desktop.

• FEC Helpdesk is responsible to patch desktop in monthly basis.

• Any code changes on application must be fully tested in contractor’s development desktop. The script or package for the change will be distributed by FEC Helpdesk to all analysts desktop.

Technical Support

The Channels for reporting maintenance issues is, in general, go through FEC help desk or via automated monitoring alerts, however, it should not prevent receiving reports directly from FEC internal business users.