Attachment 1C - RAD Modules.pdf

Attachment 1C – FEC Reports Analysis (RAD) Modules Contracting Requirements

FEC RAD Modules

Introduction

This document defines contract requirement for Federal Election Committee’s RAD Module Application.

The requirement includes maintaining, upgrading, migrating, or re-architect/re-programing the application, based on the requests from legislation divisions, and/or from security mandates.

Application Overview

The RAD Modules serves as the main workload tool for three branches within the Reports Analysis Division (RAD). The RAD Modules system is the beginning and end point for RAD’s main function of reviewing campaign finance reports and documents. It helps both RAD analysts and management track the reports and documents that need to be reviewed to ensure they comply with the Federal Election Campaign Act (FECA).

RAD Modules applications are time sensitive and mission critical. It is critical for RAD to function on a day-to-day basis. Without the application RAD, analysts would not be able to determine which of their assigned reports are still awaiting review. Additionally, if calls from filers come into the division, it would impact the ability to log calls right away and it could also impact the level of customer support that is provided. If the application goes down it greatly impacts the productivity of RAD, specifically of the Authorized, Party/Non-Party, and Compliance Branches. The vast majority of work completed by RAD analysts would come to a standstill. There is not a statutory deadline that covers the review of reports, but the RAD Review and Referral Procedures is a Commission approved policy that sets out review thresholds and review/referral timeframes and RAD also has internal goals that would be impacted by any downtime.

The RAD Modules system has four main functions/sections. These include: 1) detailed information about committees and entities, 2) workload queues for reports and documents awaiting review, 3) letter generation and tracking, and 4) review tools and management reports. Below is a brief overview of these sections.

1. Detailed Committee and Entity Information – This portion of the Modules provides RAD team members with a more detailed view of a filer’s official information. It includes:

a. Committee Information – Provides RAD team members with the ability to see details such as committee type and designation, filing frequency, treasurer information, etc. The information is similar to what is available on fec.gov, but it provides a more detailed look at the information. For example, there is a historical chart showing the start and end date of every person who served as committee treasurer.

http://fec.gov/

b. Compliance Status – This portion lists any matters that have or could be referred to other FEC offices (ADRO, OGC, Audit, OAR). The list provides a referral number and status along with other relevant information.

c. R-Index/O-Index – These are two indices that display any reports or documents received from a filer. It also shows any notices or letters (including RFAIs) from the FEC that have been sent to the filer.

d. Communications Log – This portion is where RAD team members document any communication with a filer. All phone calls or meetings with filers are logged with a brief description including who participated and the date and time. RAD members can also view all past communication logs.

2. Dashboard and Workload Queue for Reports and Documents Awaiting Review (117) – The 117 portion of the Modules helps RAD analysts and management track reports and documents that need to be reviewed. The Dashboard also provides reminders and timelines for key RAD tasks.

a. 117 – This serves as the main workload queue for all RAD analysts. The main function performed by RAD analysts is reviewing FEC campaign finance reports and other related documents. The queue shows which reports and documents are still awaiting review. Each RAD analyst has their own 117 since they are all assigned committees and entities. RAD analysts that serve on the Party/Non-Party Branch are assigned 300-400 unauthorized committees. RAD analysts that serve on the Authorized Branch are assigned specific states, which means they review all House and Senate elections for a state. Additionally, they also are assigned presidential committees and other filers that are not considered registered committees.

b. Dashboard – This provides RAD analysts and managers with a number of reminders about key tasks that have to be done within set timeframes. These include reviewing Form 1s, termination reports, letter responses, and assigning new committees to analysts.

3. Letter Generation System (Module 4) – Serves as the creation and tracking tool for all letters that RAD sends to committees and entities that file with the FEC. Reviewing reports and documents filed with the FEC may result in identifying issues that appear to be a violation of the FECA. When this occurs, RAD analysts generate letters, often referred to as Requests for Additional Information (RFAIs). Module 4 allows analysts to create and track letters that are sent to committees. The tracking portion is crucial since it may later be used to refer a matter to another FEC office. This portion also includes letters that are sent by the Compliance Branch, specifically Administrative Fines, Administrative Termination and Non-Filer letters.

4. Review Tools and Management Reports – The last portion provides review tools that assist RAD analysts in reviewing reports. These tools include the PNP reports, which assist analysts in finding excessive contributions. Additionally, there are management reports that allow the RAD management team to track productivity.

Maintenance Specifications

As legislative, reporting forms, or other requirements can change, the FEC often makes unscheduled requests for data, data subsets, files from backup, changes, or enhancements to these systems. These requests are typically made on a “need it now” basis and may be critical.

The quoter must demonstrate that they have the resources and the flexibility to manage and perform these types of requests without impacting the application and system maintenance or other initiatives. These requests shall be included as part of normal maintenance efforts.

Architecture

Application is located on Amazon Cloud

Disclosure Suite is a three-tier application by design.

• Database tier:

Oracle Oracle stored procedure

• Application tier:

java on Apache Tomcat

• Web tier:

JSP

Application Server EC2 on Linux OS

Software The application utilizes below technologies/software:

• Java

• Oracle stored procedure

• Crystal Reports

Development and Deployment Approach

Application may be required

• to fix bugs and errors discovered by business users or by automated tools, such as security scans,

• to add/modify features from existing features that requested by business users,

• to update the software to remain compatible with evolving environments, such as new OS versions, or third-party APIs,

• to optimize the performance to improve the speed and efficiency of the application to enhance user experience.

In any above cases, Contractor should meet below requirements:

• Best practice with SDLC and Agility.

• Issue Tracking:

o Use Jira and GitHub to track Issues.

o In each ticket, define severity, priority, and record resolution.

• Code Quality o Code must adherence to coding standards (e.g., Clean Code, PEP 8) and a minimum code coverage 80% percentage for automated tests.

o Code must pass functional tested by contractors on development environments.

• Code Deploy and pass Security Scan o CI/CD (currently in Jenkins) used for code compiling and pass SAST with zero critical security findings.

• Integration Test and UAT o Must conduct Integration test with FECSerivies and FECDocQuery.

o Must conduct User Acceptance Test.

• Change Management: any production changes must o have UAT certified o Request RFC, along with deployment items, servers, impacts, deployment procedure, backup plan.

o RFC approved by CAB.

o In case of emergency fix and deployment, issue and deployment can be documented later than RFC emergency approve, but document must not omit.

• Documentation:

o Maintaining up-to-date documentation, including user manuals and technical documentation, for long-term support.

o Link maintenance requirements to original functional specs to understand the impact of changes as Traceability.

o Treat the maintenance specification as a living document that is updated alongside the software.

o All documents must be accessible by FEC COR and FEC Deputy CIO of Enterprise

Architecture

• Version Control:

o Application source code, sql statements, and any other scripts must use branching strategy to manage hotfixes and new releases.

Availability and Service Level Agreement (SLA)

• Availability o Application is running daily.

o Patch or other maintenance should be scheduled over weekend.

• SLA

o Critical bugs or Urgent issue must be acknowledged within 2 hours, and assign resource to fix it or find temporary workaround within 12 hours.

• Recoverability o Apart from monthly security patch over the weekend, the Maximum Tolerable

Downtime (MTD) is 12 hours and Recovery Point Objectives (RPO) is 12 hours.

Compliance & Data Sovereignty

• FEC is following the principles/standards for SOC1, SOC2, SOC3, ISO 27001, ISO 27017,I SO 27018, ISO 9001, PCI, FedRAMP.

Guidance from our legal counsel: HIPAA does not apply to the FEC, since we are not a healthcare provider; however, the Rehabilitation Act and Title VII do apply to us and require federal agencies to protect the confidentiality of medical information.

• Data Classification is Public

• No end-to-end data encryption is required.

Application Security

• User authentication is required to access application

Monitoring

• The application has monitoring solution in AWS.

Backup and Restore

• Production databases and application have daily snapshot and keep the snapshot for past 7 days.

Environment and Shared Responsibilities

• Application installed in individual desktop.

• FEC Helpdesk is responsible to patch desktop in monthly basis.

• Any code changes on application must be fully tested in contractor’s development desktop. The script or package for the change will be distributed by FEC Helpdesk to all analysts desktop.

Technical Support The Channels for reporting maintenance issues is, in general, go through FEC help desk or via automated monitoring alerts, however, it should not prevent receiving reports directly from FEC internal business users.

SMTP Gateway

Introduction

This document defines contract requirement for Federal Election Committee’s RAD and Information Division Modules/Disclosure Suite – SMTP Gateway

The requirement includes maintaining, upgrading, migrating, or re-architect/re-programing the application, based on the requests from legislation divisions, and/or from security mandates.

Application Overview

RAD and Information Division Modules/Disclosure Suite – SMTP Gateway, is not an application. Rather it is a backend utility for tracking emails related to the RAD Modules’ RFAI process and for notification emails sent to committees by the Information Division. RFAI stands for Requests for Additional Information, which are letters sent to committees and entities that file campaign finance reports and documents with the FEC. Additionally, the Information Division emails prior notices, post-election reminders (“losergrams”) and new committee registration information.

The process helps RAD track the emails to ensure delivery. Specifically, the utility tracks if emails have been sent successfully, bounced, and if they were opened.

The Information Division uses the Disclosure Suite to:

· Send and track prior notice emails informing political committees of upcoming reporting deadlines;

· Send post-election instructional messages to candidates;

· Generate and send automated informational emails to newly-registered committees;

The SMTP server is the email gateway through which all the RAD/Disclosure applications send email.

This utility is mission critical since RFAIs need to be emailed to committees. RFAIs are considered part of the public record for committees and entities. In some instances, RFAIs have a 35-day timeframe for filers to respond to the FEC, and any failure of the system could affect that timeframe. Additionally, any disruptions to sending RFAIs via email could result in filers not being notified in a timely fashion about potential violations on their reports.

This program facilitates several key Information Division functions, so any failure would have a significant impact on our operations.

Commission Directive 1 requires the Information Division to notify political committees of upcoming reporting deadlines within specific timeframes. A failure would cripple this effort, compromising committees’ understanding of upcoming reporting deadlines, and potentially result in administrative fines for filers. It would also adversely affect the Administrative Fine Program itself. The Office of Administrative Review, which processes administrative fine challenges, uses the application’s distribution log to verify that committees were successfully sent a prior notice.

While less important than the prior notices, the post-election emails sent to candidates provide instructions to help the unsuccessful campaigns fulfill their remaining obligations and terminate.

A failure of the automated new committee email system would delay receipt of committee identification numbers (FEC IDs) and other important compliance information, jeopardizing these filers ability to comply with filing requirements and other provisions of the law.

Maintenance Specifications

As legislative, reporting forms, or other requirements can change, the FEC often makes unscheduled requests for data, data subsets, files from backup, changes, or enhancements to these systems. These requests are typically made on a “need it now” basis and may be critical.

The quoter must demonstrate that they have the resources and the flexibility to manage and perform these types of requests without impacting the application and system maintenance or other initiatives. These requests shall be included as part of normal maintenance efforts.

Architecture

IBM Domino Server located in Microsoft Hyper-V SMTP Protocol Application is dependent on bNightly process, Disclosure Suite, Disclosure Database and LawManager.

Software Libraries:

The application utilizes below technologies/software:

• Java

• Oracle Client

• Crystal Report Libraries

• Acrobat

• EPPLUS libraries(Excel)

• ItextSharp

• Log4Net

• .NET 4.0

• O365 .NET Library for SMTP interaction

Development and Deployment Approach

Application may be required

• to fix bugs and errors discovered by business users or by automated tools, such as security scans,

• to add/modify features from existing features that requested by business users,

• to update the software to remain compatible with evolving environments, such as new OS versions, or third-party APIs,

• to optimize the performance to improve the speed and efficiency of the application to enhance user experience.

In any above cases, Contractor should meet below requirements:

• Best practice with SDLC and Agility.

• Issue Tracking:

o Use Jira and GitHub to track Issues.

o In each ticket, define severity, priority, and record resolution.

• Code Quality o Code must adherence to coding standards (e.g., Clean Code, PEP 8) and a minimum code coverage 80% percentage for automated tests.

o Code must pass functional tested by contractors on development environments.

• Code Deploy and pass Security Scan o CI/CD (currently in Jenkins) used for code compiling and pass SAST with zero critical security findings.

• Integration Test and UAT o Must conduct Integration test with FECSerivies and FECDocQuery.

o Must conduct User Acceptance Test.

• Change Management: any production changes must o have UAT certified o Request RFC, along with deployment items, servers, impacts, deployment procedure, backup plan.

o RFC approved by CAB.

o In case of emergency fix and deployment, issue and deployment can be documented later than RFC emergency approve, but document must not omit.

• Documentation:

o Maintaining up-to-date documentation, including user manuals and technical documentation, for long-term support.

o Link maintenance requirements to original functional specs to understand the impact of changes as Traceability.

o Treat the maintenance specification as a living document that is updated alongside the software.

o All documents must be accessible by FEC COR and FEC Deputy CIO of Enterprise

Architecture

• Version Control:

o Application source code, sql statements, and any other scripts must use branching strategy to manage hotfixes and new releases.

Availability and Service Level Agreement (SLA)

• Availability o Application is running daily.

o Patch or other maintenance should be scheduled over weekend.

• SLA

o Critical bugs or Urgent issue must be acknowledged within 2 hours, and assign resource to fix it or find temporary workaround within 12 hours.

• Recoverability o Apart from monthly security patch over the weekend, the Maximum Tolerable

Downtime (MTD) is 12 hours and Recovery Point Objectives (RPO) is 12 hours.

Compliance & Data Sovereignty

• FEC is following the principles/standards for SOC1, SOC2, SOC3, ISO 27001, ISO 27017,I SO 27018, ISO 9001, PCI, FedRAMP.

Guidance from our legal counsel: HIPAA does not apply to the FEC, since we are not a healthcare provider; however, the Rehabilitation Act and Title VII do apply to us and require federal agencies to protect the confidentiality of medical information.

• Data Classification is Public

• No end-to-end data encryption is required.

Application Security

• User authentication is required to access application

Monitoring

• Programmatic monitoring in place

Backup and Restore

• Donimo server holes 7 days’ data queue

Environment and Shared Responsibilities

• Application installed in individual desktop.

• FEC Helpdesk is responsible to patch desktop in monthly basis.

• Any code changes on application must be fully tested in contractor’s development desktop. The script or package for the change will be distributed by FEC Helpdesk to all analysts desktop.

Technical Support The Channels for reporting maintenance issues is, in general, go through FEC help desk or via automated monitoring alerts, however, it should not prevent receiving reports directly from FEC internal business users.