Attachment_2_TO1_SOW_OM.pdf

Food and Drug Administration (FDA)

Human Foods Program (HFP) Maintaining Operations of the Food Applications Regulatory Management (FARM) System

Task Order #1 – Operations and Maintenance (O&M)

Task Order #1 (O&M) STATEMENT OF WORK (SOW)FOR FOOD APPLICATIONS

REGULATORY MANAGEMENT (FARM) & IT INTERFACING SYSTEMS

SOLICTATION #75F40126R00042

1. BACKGROUND

a. Introduction

The Human Foods Program (HFP) oversees all FDA activities related to food safety and nutrition, organized in a single group working under the Deputy Commissioner of Human Foods. The mission of the HFP is to ensure that food is a source of wellness for all U.S. consumers, and our day-to-day activities are focused at protecting and promoting the health and wellness of all people through science-based approaches to prevent foodborne illness, reduce diet related chronic disease, and ensure chemicals in food are safe.

The HFP’s Food Applications Regulatory Management (FARM) system currently supports the work of staff across HFP that includes OFCSDSI, HFP-OFCSDSI-OPMA, HFP-OFCSDSI-ODSP, HFP-OFCSDSI-OPMAS, HFP- OFCSDSI-Innovative Staff, NCE-ONFL, OCS-OCAC, and Center for Veterinary Medicine (CVM)’s Ingredient Safety Team, Division of Animal Feeds. FARM was initiated in 1995 to support premarket and post market safety reviews of petitions and notifications received from the regulated industry. The System also supports correspondence and Electronic Freedom of Information (EFOI) requests and archiving HFP historical files. FARM is the primary system available to HFP reviewers to access and review industry submissions and conduct analysis with regards to chemical, toxicological, and environmental analysis and other issues, regarding specific ingredients. For the Office of Food Chemical Safety, Dietary Supplements, and Innovation (OFCSDSI), the submissions/petitions include the following: Food Additive Petitions (FAPs), Color Additive Petitions (CAPs),Generally Recognized as Safe notices (GRNs), Food Contact Notifications (FCNs), Biotechnology Consultations (BNFs), New Protein Consultations (NPCs),Infant Formula Notifications (IFNs), Notifications for Food Allergens (NFAs), Petitions for Food Allergens (PFAs), Citizen Petitions (CZPs), Cell Culture Consultation (CCC) and Cell Culture Ingredients

(CCI).

For the OFCSDSI-ODSP, the submissions/petitions include the following: New Dietary Ingredient Notifications (NDIs) and Structure Function Claims (SFCs). For the Nutrition Center of Excellence - Office Nutrition, Food Labeling and (NCE-ONFL), the submissions/petitions include the following: Citizen Petitions (CZPs) and Health Claims (HC). In addition to providing information technology support to the scientific review of submissions, the FARM System is used to support critical regulatory functions for processing and documenting agency actions pertaining to pre-submission meetings, correspondences and requests for information sent to OFCSDFI, OFCSDFI-ODSP, NCE-ONFL and OCS-OCAC such as:

Prenotification Consultations, Prepetition Consultations, Freedom of Information Act (FOIA) responses, Correspondence to OCS-OCAC, and Inquiries/Correspondence for NCE-ONFL. The FARM System provides information management tools for Agency reviewers and is the key enabler of the electronic document review process and expedites the ingredient safety review process and subsequent safety decision-making effort to maximize productivity. Currently, FARM has 26 workflows.

Table 1. Recent submission data stored in the FARM system (2016 to 2025)

Submission Type

2016 2017 2018 2019 2020 2021 2022 2023 2024 2025

BNF 5 6 6 6 4 5 9 6 2 6

COR 126 98 103 31 18 180 357 427 442 275

FCN 113 122 97 79 82 4 74 67 76 77

EFOIA / FOI 207 205 232 280 235 266 234 264 316 276

GRN 73 64 85 72 86 58 82 49 52 53

GNF 33 35 33 21 37 28 28 24 13

GMT 0 1 0 1 0 0 0 0 1

NDI 0 0 0 2 65 57 56 51 71 85

PETITION 8 5 6 3 6 6 5 7 12 6

PNC 187 174 174 157 131 143 151 157 160 182

NPC 1 0 0 0 0 0 1 0 1 0

IFN 18 30 29 20 44 49 24 23 36

PMR 3 5 3 5 6 3 3 15 9

CZP -OFCSDFI

(CZP)

15 0 0 1 4 0 5 0 4

OCZ-

OFCSDFI-

ODSP (OCZ)

0 0 0 0 0 0 0

COR-

OFCSDFI-

ODSP

(CORDS)

167 459 180 272 366 168 58

SFC-OFCSDFI-

ODSP

44 1432 1634 1482 1861 2542 2409

TOR 2 5 6 2 1 0 2

FALCPA 39 72 0 66 2 0 0

GBFP 105 8 72 110 78 100 82

GRAS 6 4 95 110 77 76 67

2. TECHNICAL BACKGROUND

The technology stack supporting the current FARM Version 13.x is identified in Table 2. FARM reengineering was a multiphase initiative designed to modernize the system architecture while ensuring operational continuity.

Although the FARM System is fully operational in a production environment, the Agency requires ongoing operations, maintenance, and enhancement support for FARM Version 13.x and subsequent releases. These activities include system operations, defect remediation, performance optimization, and incremental functional enhancements.

The FARM system and its associated interface components are deployed across multiple hosting environments:

• FDA GovCloud – Cloud-based infrastructure supporting core FARM system operations.

• Appian Cloud Environments – Platform-as-a-Service (PaaS) environments hosting key FARM components, primarily workflow automation and reporting capabilities.

• FDA On-Premises Infrastructure (Ashburn Data Center – ADC) – Internal data center infrastructure supporting its integrations, and data management functions.

This distributed architecture supports secure processing of regulatory data, scalability, and operational resilience across cloud and on-premises environments.

HFP has incrementally enhanced and modernized the FARM System to its current configuration, FARM 13.x, an integrated platform supporting comprehensive regulatory management functions. Key system capabilities include:

• Online submission functionality enabling electronic submission of regulatory documents with bi-directional notifications.

• Data and content management for organizing, storing, and maintaining regulatory information and documentation.

• Search and retrieval functionality providing efficient access to stored records.

• Workflow management to automate and track regulatory review processes.

• Account management for user authentication, access controls, and permissions administration.

• Reporting and analytics capabilities to generate regulatory reports and analytical outputs.

• Forms management to create, maintain, and process regulatory forms.

• Indexing and cataloging activities to organize content and enhance searchability and retrieval.

This integrated framework enables streamlined regulatory processing, improved data governance, and enhanced operational efficiency while supporting ongoing modernization efforts.

Exhibit 1 - FARM Features

While the FARM System is currently in full production and requires on-going operations and enhancements, the Agency is also planning technology upgrades, a consolidation of FARM workflows to streamline and integrate existing workflows to improve efficiency and reduce redundancy including those in Cloud data management, (including master data management and content management), federated search and retrieval across multiple data sources, and information reporting/notification.

Table 2. Current FARM System technology stack FARM Component / Software FARM Component Software Version

Input/PDF Forms Management Adobe Experience Manager (AEM) 6.5 Application Server Oracle WebLogic 14C (14.1.2.0), Java jdk-21_linux-x64 jdk-21.0.8 Java JDK/JRE Java JDK version 21.0.8 2025-07-15 LTS Java J2EE Jakarta EE 11 Spring Boot 2.7.18 Log4j 2.25.3 Apache PDF Box 2.0.4 Hibernate 5.6.15. Final (FARM Web); 5.6.15. Final (FARM API) Jersey 2.35 Single Sign On (SSO) Oracle SSO 14c DB Storage Oracle RDS 19c (Version 19.18.0.0.0) Search Apache Solr 9.10.1 (Zookeeper 3.9.4) Content Management System Documentum 24.4 Appian/Workflow Appian 25.4

FARM Web Application UI PrimeFaces 11.0.0 Business Object Reports SAP BusinessObjects BI Platform 4.3 Sp4 Patch3 Electronic Submissions MOVEit/file transfer version 14.1 COSM Internet UI Management Angular 17.3.12, JWT 0.7.0, Angular Material 17.3.10, Bootstrap 5.3.8, Prime NG 17.18.15 Apache Kafka 2.13-4.1.0 Kafdrop 4.2.1 Swagger 5.17.14

3. OBJECTIVES and SCOPE

The objectives of this task order include full Operations and Maintenance support services and maintaining the availability, reliability, and security of the current FARM System.

The scope of this task order is to continue to support and maintain the technical development, operations and management for the FARM System, through ongoing operations and maintenance support of the current FARM 13.x capability while new system features and enhancements are being developed to deliver the next version.

a. Operations and Maintenance (O&M)

The O&M support services include FARM infrastructure administration, support services for scheduled/unscheduled reporting, infrastructure platform/software patches; issue identification, tracking, analysis, and resolution; release management; configuration management; change incorporation; custom code (Forms, Java, Scripts, Workflow, etc.); testing and documentation;

maintenance of tools, specialized configurations, customizations and process automation such as scripts, templates, and workflows; performance tuning and monitoring; system administration; help desk; user training on premise or in a virtual environment for FDA employees, and virtually for Centralized Online Submission Module (COSM) users; data call and user account administration.

The FARM System’s Operations and Maintenance (O&M) activities focus on routine operations and maintenance support necessary to maintain the availability, reliability, and security of the FARM System components distributed in various environments, those can be at FDA premises, Ashburn Data Center, and FDA Cloud environment.

b. General Tasks

1. Task 1 – Project Management

2. Task 2 – Operations of the FARM System

3. Task 3 – Maintenance and Database Support for the FARM System

4. Task 4 – Release Management and Testing Support

5. Task 5 – User Production (FARM Helpdesk)

6. Task 6 – Transition-In Support (OPTIONAL TASK)

7. Task 7 – Transition-Out Support (OPTIONAL TASK)

4. DESCRIPTION OF TASKS

4.1. TASK 1 – PROJECT MANAGEMENT

a. Overall Project Management Oversight

The Contractor shall provide comprehensive project management oversight to monitor and control scope, schedule, quality, and cost throughout the Task Order duration. The Contractor Project Manager (PM) shall:

• Provide task order, resource, and risk management

• Ensure compliance with FDA IT procedures and policies

• Follow IT-related management activities including release management, software and hardware version upgrades, change control, configuration management, and IT investment management

• Ensure technical compatibility with FDA's technical environment, 508 compliance, and reduction of IT security risks

• Perform all Enterprise Performance Life Cycle (EPLC) activities and produce required documentation and software deliverables

b. Kick-off Meeting

The Contractor shall host a kick-off meeting within ten (10) working days of task order start to discuss their approach to meeting the SOW requirements.

c. Project Management Plan (PMP)

The Contractor shall prepare a comprehensive PMP describing:

• Technical approach and organizational resources with specific roles

• Communication approach and quality control

• Risk management and deliverable management

• Work Breakdown Structure (WBS) - three levels

• Project schedule and management controls (meetings, meeting minutes, and reports)

• Delivery dates and number of new features/releases

Deliverable Timeline:

• Draft PMP: Within 15 days of task order start

• Final PMP: Within 30 days of task order start (for Contracting Officers Representative (COR) approval)

• WBS: Finalized within 30 days of task order start

• WBS updates: Weekly (minimum) for COR approval

Project Schedule Requirements:

• Developed per Project Management Institute (PMI) standard practices

• Include all deliverables, EPLC milestones and stage gates, technical metrics, tasks, and predecessors

• Include work elements performed by both FDA personnel and contractors

• Include COR-identified dependencies with external resources

• Updated as required by FDA COR and/or FDA Project Manager

d. Reporting and Documentation

• Weekly Reports o The Contractor PM shall submit by noon on Thursday:

Weekly Narrative Report including:

• Summary accomplishments table

• Ongoing activities table (including processing of incoming submissions)

• Tickets worked/working on or tasks performed/to be worked

• Hours spent on each ticket and task

• Match to project schedule tasks o Schedule Update

• Monthly Reports o The Contractor PM shall provide by the 10th of each month (for the previous month):

Monthly Progress Report including:

• Deliverables and milestones for previous month and next reporting period (as described in PMP)

• Project schedule status showing planned vs. actual activities

• Earned value, cost and schedule variance

• Completed tickets, ticket status or tasks performed

• Hours spent on each ticket and task

• Detailed accounting of all funds received and disbursed

• All invoices to date

• Activities corresponding to cost incurred

Invoice Submission: By the 15th of each month for the previous month

• Annual Report o The Contractor shall provide a final annual report inclusive of the period of performance including:

Review of all deliverables, accomplishments, and statuses Overview of work completed, in progress (percentages), and planned for each task Progress on deliverables against the project plan Identification of problem areas with recommended remedial actions Action items for the following period Identified risks and mitigation plans Current or anticipated problems with scheduled activities

Accounting for deliverables Task Order financial reports (total hours and amount billed for the invoice period) Lessons Learned

• Proactive Communication o The Contractor shall proactively inform the COR of any issues, problems, and recommendations with clearly defined actions, assigned completion dates, and timely communication.

e. EPLC Support and Documentation

• Project Process Agreement (PPA)

• Sign FDA EPLC Project Process Agreement within one month after Task Order start

• Ensure COR-approved Release PPA outlines detailed list of EPLC artifacts/deliverables per current FDA EPLC process for each lifecycle phase

• Required EPLC Artifacts (New or Updated Versions) o Project Schedule o Project Management Plan o System Requirements Specifications o System Design Document o Data Model o Release Test Plan o Test Cases (unit, performance test, and user acceptance tests) o Requirements Traceability Matrix o Test Report o Version Description Document (including documentation for FARM system institutional version, software versioning and revision control system, and other applicable FDA tracking systems) o User Manuals o System Run Book o Training Documentation (voice and/or written) o Security Documentation

• SharePoint Repository Management o The Contractor shall:

Prepare a plan to update and save documents in the FARM SharePoint repository with defined project metadata elements Present plan to COR and Project Manager for review and approval Archive previous release documentation

Update current documentation repositories with all updated documents Format for easy search and document retrieval Organize repositories (may include: project management, requirement and design, implementation, infrastructure, EPLC documentation, security documentation, data call, etc.)

f. Release Management

• The Contractor shall:

o Document underlying software components o Follow release management as described in sections 4.2.3 o Document details of all changes made to the FARM System following the software change management process in EPLC documentation o Track all changes to FARM System development coding using FDA's GitLab (software versioning and revision control system) o Track related documents using SharePoint or required repository

g. Configuration Management o Conduct configuration management per FDA configuration management procedures o Ensure version control of all EPLC project documents, application code, and database components o Document changes in code, test scripts, and test results in FDA's GitLab, SharePoint, ALM, etc.

o Use FDA tracking systems including JIRA/ServiceNow for Change Requests and

Application Lifecycle Management (ALM) for test cases

h. Change Control o Ensure all changes in code, configuration, and documentation are approved by the COR o Follow Project Change Control Board processes for approval o Facilitate change control to obtain COR approval o Ensure all changes, upgrades, and releases align with FDA procedures for release and change management

i. Communications Management

• The Contractor PM shall:

o Submit a communication plan to the COR addressing the recommended process between contractor staff, Task Order COR, FARM Integrated Project Team (IPT), FDA third-party teams, and FARM users o Develop a Responsible, Accountable, Consulted and Informed (RACI) matrix o Ensure the communication plan provides contact information including roles and responsibilities, staff changes, and progress meeting schedules o Facilitate the Change Control Board

j. FDA Data Calls

• The Contractor PM shall:

o Respond to COR-provided FARM data calls o Provide documentation in support of the FARM System o Ensure data call responses include all new initiatives described in SOW aligned with FDA strategic goals and capabilities o Communicate risks and benefits of any data call introducing new initiatives that may affect the FARM System

k. Meetings

• The Contractor shall participate in and support:

o Regular status meetings o Technical and process improvement meetings (quarterly or as requested by

COR/designated Project Manager) o Monthly individual Change Control Board (CCB) meetings o Ad hoc meetings addressing system performance, outages, backup and recovery, collaboration with HFP stakeholders, or special reports

• Participation Requirements:

o Lead discussions o Participate in discussions o Contribute questions and answers o Raise issues, risks, and concerns o Develop and give presentations o Engage in active oral and written communications o Prepare meeting agendas, meeting minutes, issues, risks, and action items

Table 3. Meeting activities, occurrences and location during the period of performance.

4.2. Operations and Maintenance (O&M)

4.2.1. TASK 2 – Operations of the FARM System

The FARM system is classified by FDA security as 'Mission Critical' with 24/7 operational requirements, excluding planned maintenance windows. The Contractor shall execute all technical upgrades, refreshes, and modifications as directed, required, or mandated by the FDA.

• Operations Support, System Monitoring and Incident Response Requirements o The Contractor shall provide responsive and proactive operations support, including:

Collaborating with Data Center Contractors and Cloud Environment providers to identify and resolve FARM system outages and performance issues;

Monitoring FARM system components continuously outside of scheduled maintenance windows;

Notifying the FARM Integrated Project Team of system status and confirming all components are operational.

• Incident Response Requirements:

o Normal Business Hours (8:00 AM - 6:00 PM, Monday-Friday): Engage and begin troubleshooting within 15 minutes of notification of any FARM system outages or performance issues;

o Outside Normal Business Hours: Acknowledge receipt of notification, engage, and begin troubleshooting within 30 minutes for 24/7 systems, and follow the Information Systems Contingency Plan (ISCP) for FARM and standard operating procedures for user notification;

o Notify the FDA COR or designated Project Manager and downstream systems' business and/or system owners of identified problems within 15 minutes during normal business hours, or 30 minutes outside normal business hours.

Meeting/ Activity Description Typical Location(s) Estimated Occurrences

Status meetings Status of current activities defined and performed under the O&M task order

FDA/HFP,

College Park, MD

Weekly

Technical and process improvement meetings

Discussion of current technical issues

FDA/HFP

College Park, MD weekly as needed

Configuration Management Board meeting

Discussion of change requests FDA/HFP College Park, MD

Monthly

Ad hoc meetings Discussion of current technical issues

FDA/HFP

College Park, MD

As needed (see above)

• IT Consolidation and Modernization Support:

o The Contractor shall support IT system operations by:

Actively participating in coordination efforts with FDA IT consolidation initiatives, including HALO, MARS, Elsa team, and Cloud environment teams

Providing technical expertise and system-specific information to support consolidation planning and implementation activities

Ensuring FARM system compatibility and integration requirements are communicated to relevant FDA modernization teams

Adapting operational procedures and documentation to align with FDA's IT consolidation strategies and timelines

Coordinating with consolidation initiative teams to minimize disruption to FARM system operations during transition activities

• Documentation and Knowledge Management:

Develop and maintain comprehensive operation and administrative manuals documenting all FARM processes Include procedures for standard system requirements and FARM-specific operating instructions Update all manuals with each maintenance release to ensure current and accurate documentation Ensure all documentation is properly organized and accessible to authorized personnel

• Security and Compliance Activities:

o The Contractor shall:

o Prepare for and participate in mandated Security Scans and Continuity of Operations (COOP)

Information Systems Contingency Plan (ISCP) Exercise events requiring Contractor support o Follow Enterprise Data Masking and Subsetting Solution (EDMSS) guidelines to ensure FARM system compliance with HHS directives o Ensure sensitive production data is masked to prevent compromises of confidentiality in the event of loss, misuse, unauthorized access, or modification

• Disaster Recovery and Business Continuity:

o The Contractor shall maintain and update as appropriate:

Disaster recovery plans Administrator processes, including log file analysis procedures Processes to detect problems early and mitigate them before significant adverse effects occur

• IT Capacity Planning and Infrastructure Management:

Monitor data storage growth by requesting monthly reports from appropriate

Data Center or Cloud contractors Take proactive action to ensure sufficient table and storage space for anticipated growth Upgrade or replace infrastructure to increase scalability of system servers

(failover or server clusters) to meet high availability requirements Validate backup procedures for FARM data stored at FDA Data Centers or Cloud environments Make recommended changes to backup procedures and document and communicate these to FDA Data Centers or Cloud environments when appropriate

Coordinate infrastructure planning with IT consolidation initiative teams to ensure alignment with FDA's modernization roadmap

• Data Call Responses:

o The Contractor shall provide input and responses to FDA/ODT IT data call requests as needed, which may include but are not limited to:

Hardware inventories and forecasts Technology inventory and forecasts System specifications Interfacing systems documentation Project status updates IT consolidation initiative impact assessments

• Annual Performance Analysis:

o The Contractor shall conduct an annual operational analysis of the FARM system using:

Performance metrics Customer survey data

The Contractor shall provide a comprehensive report of the analysis as part of the post-implementation review, including findings and conclusions. Deliverables shall include:

• Updated operation and administrative manuals (with each maintenance release)

• Incident response logs and notifications

• System validation reports following patching activities

• User administration logs and status reports (as requested)

• Monthly storage growth monitoring reports

• RQST-IT technology approval documentation (as needed)

• FDA/ODT IT data call responses (as needed)

• Annual operational analysis report with performance metrics and customer survey data

• IT consolidation coordination documentation and impact assessments (as needed)

• Integration and compatibility reports for HALO, MARS, Elsa team, and Cloud environment initiatives (as needed)

4.2.2. TASK 3 – Maintenance and Database Support for the

FARM System

The Contractor shall support enhancements and change requests for existing FARM platform modules and collaborate with DBAs and system engineers at FDA Data Centers and Cloud environments to provide system configuration and administration support. The FARM System will undergo one major release and up to four O&M releases annually. Each release shall include HFP Management-approved enhancements such as:

• Business operations features and functions

• GUI changes

• Source data system additions/updates to master data repositories

• Master data provisioning to downstream systems

• Data entities and field additions

• Data upload/supply script development and implementation

• Performance Tuning and Optimization, Workflow and Application Maintenance:

o The Contractor shall conduct biannual performance tuning to ensure optimal server capacity, speed, and network performance, and perform minor enhancements (development requiring less than 200 hours) including:

Data model evaluation for indices and data accommodation Hardware platform and operating system statistics analysis Network performance assessment (speed and capacity) Custom application code evaluation (Forms, Java, PL/SQL, API, Workflow) Creation of recommendations and best practices documentation Implementation of approved recommendations for new infrastructure, including cloud or container-as-a-service (CaaS) solutions Maintenance and support all FARM workflow applications and reports in the Cloud environment, including:

Bug fixes for existing workflows Biannual performance tuning reports with recommendations and implementation documentation

• Database Administration and Support:

o Provide database administration information to FDA Data Centers and Cloud personnel o Recommend database performance improvements and O&M procedures (parameter configuration, index development, disk array configuration, performance tuning) o Monitor and ensure execution of regular Oracle backups and recoveries per FDA standards o Maintain user administration and role management o Support audit trails per FARM Security Plan and Security Assessment Report (SAR) o Maintain and support FARM system metadata and documents for accessing, searching, reviewing, and reporting submission information

• Submission Processing, Automation and Defect Resolution:

o Provide recommendations and implement fully electronic submission processes to automate notifications and reduce manual work in processing, indexing, and corrections o Electronically document all substance information update requests and system corrections, including source tracking (STARI, CERES/TRAM, G-SRS) for audit purposes o Maintain and support ingestion types and processing, including web-based online submission capability via COSM or FDA integrated Online submissions such as the ESG-based submissions o Support all current and new Adobe forms and online fillable submission forms o Support agency-wide IT system consolidation efforts, including evaluation, demonstrations, documentation, and development of recommendations.

o Updated workflow diagrams and documentation for bug fixes and minor enhancements o Database administration reports and backup verification logs o User administration and audit trail documentation o Annual architecture and operational analysis reports o Updated plan of actions and milestones o Contingency and disaster recovery test results o System integration documentation and support records o IT consolidation evaluation reports and recommendations

4.2.3. TASK 4 – Release Management and Testing Support

The Contractor shall work with HFP and ODT to support the development and deployment of system releases to the appropriate data center and Cloud environments. The FDA categorizes releases as Initial, Major, Minor, or Emergency/Patch. These release types are defined as:

• Initial Release: Scheduled first release of a new system.

• Major Release: Scheduled release to include technology upgrades and defect corrections.

• Minor Release: Scheduled release to include defect corrections and/or minor enhancements, including software changes necessary to support system or Commercial-Off-Shelf (COTS) patches.

• Emergency Release: Release to correct one or more problems within the FARM system that is negatively impacting functionality and requires prompt resolution. Emergency Releases are added to the project schedule as needed upon approval by the CCB.

• It is anticipated that the FARM program will have scheduled releases as explained in Section 4.2.3, Emergency releases or non-emergency releases may be identified by the Business Owner and the IT Project Manager as required. The Contractor shall perform the following activities related to Release Development and Management:

o Prepare and present level of effort estimates, root cause analysis, and technical evaluation for defects and minor enhancements as requested by the CCB. The technical evaluation should include analysis of related impacts (if any) to systems that interface with the one that is being modified. Support the CCB to obtain approvals for each defect resolution and enhancement to be included in a release, and to determine the overall content of each release.

o Plan and support User Acceptance Testing and obtain user approval for each defect resolution and minor enhancement at least 2 business days prior to the scheduled release date.

o Submit and track release requests for Development, Test, Pre-Production, and Production environments following FDA procedures for submission of infrastructure change requests, tickets, using JIRA, Service Now etc.

o Coordinate and prepare input to stakeholder notifications.

o Create all required deployment artifacts including, but not limited to release notes, software builds, scripts, VDDs, deployment plans, Run book and updated Target State Diagram (TSD).

o Provide data center and Cloud environment contractors with production releases which are normally scheduled outside of normal business hours as needed. Production releases are sometimes required to continue into the weekend and there could be multiple releases scheduled for the same day. Deployment of production releases includes validation that the implementation was completed, and the software is working as intended in the production environment.

o Ensure that the code and/or other configuration items are labeled and tagged with the software release version and all required information is packaged together correctly.

o If releases are planned or extended on the weekends, the Contractor shall work through the weekend to ensure the successful deployment of the application.

o Identify the root cause of any defects identified during the execution of releases and propose a plan to promptly resolve those defects. Any such defects determined to result from Contractor error shall be fixed at no additional cost to the government.

o Share information and provide full access to code, constructs, databases, and documentation while delivering integrated, cohesive business and technology services.

Properly label all artifacts in a manner that does not restrict the government's access and conveys the government's ownership of the intellectual property.

o Consult with data center and Cloud personnel, where the development and test environments are housed, regarding release packages, software updates, application-specific knowledge transfer, Target State Diagram, firewall rules documents and troubleshooting as required.

• Testing Support o The Contractor shall provide testing support for FARM platform, application modules, data repositories and workflows in support of releases and resolution of related issues.

Follow established FDA and industry best practices to ensure that any changes to the

FARM platform and data repositories, application servers and related databases are implemented to increase system functionality while maintaining system stability, availability, security, and data integrity.

For each change as a part of FDA EPLC compliance, create and implement a test plan and allow for independent validation of the plan. The testing methodology shall identify key functions to be tested employing use cases that can objectively measure the success of the system change. The test plan shall include a list of assumptions and limitations. At a minimum, applications shall handle valid data and valid boundary conditions plus error conditions and other anticipated data and navigation exceptions. The applications will error check for all data and navigation errors per the FDA's business requirements. Make available all documentation generated in the conduct of these tests.

Fully test all deliverables to ensure they function as required and do not adversely affect any other parts of the application or database and are consistent with other parts of the application in appearance and function. Development, unit, and end-to-end tests include functionality, regression, integration, performance, Section 508, and load tests.

Ensure that the product delivered for User Acceptance Testing (UAT) functions as documented in the Change Request or Problem Report for future resolution, and is free from typographical errors, grammatical errors and navigational problems. All aspects of all changes shall be tested and verified before delivery for UAT. Provide documentation of the testing conducted as requested by the FDA COR. Sample test plans for UAT may be requested. The COR will determine the adjudication of failures or determination of whether the software meets requirements during UAT.

Track all production and test defects with a defect tracking application and report in a format approved by the COR.

Note that HHS requires every information system to be authorized to operate through the Security Authorization (SA) process. The SA process includes annual assessments of security controls, assessments when significant change to the information system occurs and/or assessments during the development phase of new systems. If a new system is developed, FARM will require these Security Authorizations before DME work can be deployed to the production environment.

Take the necessary steps to receive an Authority to Operate (ATO) for this development activity.

Identify end-users for the UAT effort and follow all guidance set forth in the EPLC requirements and business components.

4.2.4. TASK 5 – User Production Support (FARM Helpdesk)

The Contractor shall provide comprehensive multi-tier user support (Tier 1, 2, and 3) for the FARM platform, including data repositories, interfaces, workflow, and content management systems.

• Support Tier Definitions:

o Tier 1 Support: Triage, analysis, and immediate assistance for requests received via phone, email, JIRA, ServiceNow, and other designated channels.

o Tier 2 Support: Desk-side assistance providing in-depth analysis and assignment to appropriate technical staff.

o Tier 3 Support: Advanced debugging, troubleshooting, and escalation or coordination with external entities.

• Specific Tasks and Deliverables:

1. User Account and Access Management

• Create, maintain, and resolve user accounts, roles, and permissions

• Provide administrative support for user access issues

• Document all account-related activities in FDA-established tracking systems

2. Ticket Management and Resolution

• Login change requests, log the LOE and expected time of resolution

• Resolve trouble tickets and user service requests received through FDA user support systems

• Achieve resolution rates consistent with historical performance (e.g., 481 tickets resolved out of 583 created over a six-month period)

• For requests submitted via email or phone, direct users to enter requests into the FDA issue tracking system (such as Jira)

• When users lack access or cannot enter requests themselves, create tickets on their behalf and facilitate new user account creation

• Document, track, and resolve all user support issues using FDA-established tracking tools

• Log estimated and actual level of effort for each ticket and issue in FDA tracking systems

3. Communication and Coordination

• Communicate directly with users, FDA help desk, and other required FDA personnel regarding ticket status and resolution

• Provide regular status updates on all open tickets to end users

• For high and urgent priority tickets (or as requested by FDA), provide status updates to the COR and appropriate FDA Project Manager

• Support issues, incidents, and tickets transferred from business representatives, IT

Project Manager, and/or FDA help desk

• Follow established FDA change management procedures to vet through the FARM

Configuration/Change Management Board

4. Training and User Guidance

• Provide one-on-one guidance and virtual training for COSM users as needed

• Deliver training in formats accessible to users with varying technical skill levels

5. Response Time Compliance

• Adhere to response time requirements for different urgency levels on the FARM production system as outlined in the attached table (reference the urgency level table for specific timeframes)

Performance Metrics:

The Contractor's performance will be measured by:

• Ticket resolution rates and timeframes

• Adherence to response time requirements by urgency level

• Accuracy of effort logging and documentation

• User satisfaction with support services

• Compliance with FDA change management procedures

The table below outlines the response time for different levels of urgency (on the FARM production system).

Table 4: User Production Support (FARM Helpdesk) Matrix

Urgency

Level

Description

Initial Response

Time (Normal Business Hours)

Initial Response Time

(Off – shift)

Resolution Goal

Urgent/ Emergency (“Show Stopper”)

System crash or loss of data. The end user not able to perform critical business processes

Major business or user impact

15 minute during normal business hours

Within 30 minutes of start of next business day

Less than three hours (or by mutually agreed deadline)

High Major loss of functionality without a workaround. The end user not able to perform semi-critical business process

Significant business process or user impact

Within one hour during normal business hours

Within two hours of start of next business day

Within one business day or by required deadline

Normal/ Medium

Loss of non-critical functionality and an available workaround.

Does not significantly interfere with the business process

Within one business day

Within five business days or by required deadline

Low Issue with minimal impact; Within 2 business days

Within 2 business days

As negotiated

Urgency

Level

Description

Initial Response

Time (Normal Business Hours)

Initial Response Time

(Off – shift)

Resolution Goal application defect that is a minor concern to the client

Does not significantly interfere with the business process between COR and Contractor Manager

Information Requests (data calls)

Request for documentation or informational requests

Issues do not have a business process impact

Within five business days (or by mutually agreed deadline)

4.2.5. TASK 6 – Transition-In Support (OPTIONAL TASK)

The Contractor shall provide Transition-In support to ensure an orderly transition from the incumbent to the successor Contractor, minimizing disruption to current systems and operations. Working with the incumbent Contractor and the COR, the successor Contractor shall develop a plan to assume ongoing work as required in Task Orders released under this IDIQ.

• Representative activities include:

o Develop a Transition-In plan o Participating in Transition-In meetings o Conduct and coordinate all onboarding activities with the Government, including obtaining secure badging for team personnel o Ensure key personnel are available to work with Government and incumbent Contractor

Subject Matter Experts (SMEs) immediately after IDIQ Task Order awards o Engage in regularly scheduled meetings with the Government and incumbent Contractor

4.2.6. Task 7 – Transition-Out Support (OPTIONAL TASK)

The Contractor shall facilitate the transition of contracted FARM related activities and services to the Federal Government or to a follow-on Contractor at the end of the contract period of performance.

Representative activities under this task area may include:

• Provide the FDA with current versions of all systems and user documentation;

• Provide FDA all licensing and renewal information, asset management records, software documentation, and training materials;

• Provide FDA with a current inventory of all Government-owned assets used by the Contractor along with full support in the reconciliation of this inventory;

• Provide FDA with current versions of all CONOPS, operational procedures, standard operating procedures, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor;

• Provide “shadowing” and other knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor;

• Provide full source code sets (not COTS source code) with configuration management information; and,

• Provide up to date EPLC and program/project management documents.

5. DELIVERABLES

A summary of deliverables by task area, due date and estimated frequency are listed in below. For the details of the deliverables please refer to each task area Task 1 through 6 under section 4.

Tasks Task Order Deliverables (details provided under each task for

O&M)

Due date Estimated Quantity

Task 1

Kick-off meeting in person meeting

Within 10 business days of task order start, held at College Park

Task 1 Project Management Plan (MS word/MS Project/PDF)

Draft 15 calendar days after task order start Final 30 calendar days after task order start

Task 1 Weekly Narrative Reports and WBS update

By Thursday of each week

Task 1 Monthly Status Reports By the 10th of each month for the previous month

Task 1 Annual Report

Within 12 months of task order start; Final annual report inclusive of the period of performance, deliverables, accomplishments and statuses

Task 1 EPLC Documentation

Per the project management schedule and determined by final EPLC Project Process

One Per release

O&M)

Due date Estimated Quantity

Agreement (PPA) during the period of performance

Task 1 FARM Change Control Board meeting scheduled CCB meeting once a month and minutes within one week of the meeting

Task 1 Ad Hoc Meetings Minutes within one day As needed Task 1 Weekly meetings Meeting with COR and FARM Team to review the project progress, technology upgrade, monthly metrics, and manage risks and issues, and provide meeting minutes after meeting

Task 1 Responding to FDA data calls regular base data call and ad-hoc data calls as needed Task 1 Update and restructure FARM

SharePoint repository Within 3 months of task order start 1

Task 2 Operatio n

Monitoring and supporting during working hours

Working day and off hours as needed Daily Except weekends and federal holidays as agreed

Task 2 Operatio ns

Upgrade system software and hardware servers, as needed

Within 11 months of task order start per FDA request

Task 2 Operatio n

Report: Operational analysis including post-implementation review and conclusions

Within 10 months of task order start 1

Task 3 Support all FARM Releases Within 11 months of task order start 4

Task 3 Performance tuning documentation (evaluation, recommendation and implementation)

Within 3 months of task order start; biannually 1

Task 3 GitLab Within 11 months of task order start Every update

Task 3 Generate additional management-approved, ad-hoc and standardized

Within 4 months of task order start 40

O&M)

Due date Estimated Quantity time and user efficiency performance-related reports

Task 3 Annual architecture review and updated report

Within 6 months of task order start 1

Task 3 Annual FARM contingency and disaster recovery plan test report

Within 3 months of task order start 1

Task 3 Report on the Functional system assessments (user satisfaction surveys)

Within 10 months of task order start 1

Task 3 Daily monitor and periodic tune-up reports

Work days As needed with changes

Task 3 Database upgrade/migration plans, processes and procedures

Within 3 months of task order start 1

Task 3 Database documentation Within 3 months of task order start 1 Task 4 Quarterly Release Within each quarter after task order start 4 Task 4 Major Release Within 11 months after task order start 1 Task 4 Release Documentations Per release 1 Task 4 Testing (unit, UAT, performance, 508) and TSD, VDD Per release 1

Task 5 Monitor JIRA tickets Workdays daily Task 5 User Production Support (FARM

Helpdesk) and COSM users virtual training

SLA per (FARM Helpdesk) Matrix (Table 4) daily

Task 6/7 Transition in/out plan and all FARM related documentation

Within 11 months after task order start 1

6. TASK ORDER (TO) TYPE

Firm-Fixed Price (FFP)

7. KEY PERSONEL

The key personnel specified in the Task Orders are essential to work performance. At least 30 calendar days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result the employee leaving the Contractor), the Contractor shall notify the Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to permit evaluation by the Government of the impact on performance under this contract. The Contractor shall not divert or otherwise replace any key personnel without the written consent of the Contracting Officer.

The Government may modify the contract to add or delete key personnel at the request of the Contractor or Government.

The Contractor shall propose the following personnel as key personnel:

IT Project Manager Level III, PMI certified PMP o An IT Project Manager Level III is a senior-level position responsible for the overall management and successful delivery of large-scale, complex information technology projects.

IT Business Analyst Level III o An IT Business Analyst III is a senior-level role responsible for bridging the gap between business needs and technology solutions within an organization. They work independently, often taking on leadership or supervisory responsibilities, including overseeing other business analysts or projects.

Database Specialist Level III, Certified DBA o A Senior Database Specialist is a highly experienced and skilled professional responsible for managing and maintaining an organization's databases. They possess deep expertise in database design, development, security, backup, recovery, and performance optimization.

Software Engineer Level II o A Software Engineer II is a mid-level professional in software development. They analyze, design, develop, and implement software solutions, working on both new applications and modifications to existing ones. They participate in all phases of the software development lifecycle (EPLC) and collaborate with teams to ensure software meets rigorous standards.

Applications Programmer - Level III (Appian), Certified o An Applications Programmer III (Appian) is a senior-level professional responsible for designing, developing, implementing, and maintaining complex business process management (BPM) applications using the Appian low-code platform. This role requires extensive expertise in Appian development, a strong understanding of software engineering principles, and the ability to lead and mentor less experienced developers. This professional will administer Appian instance.

8. PLACE OF PERFORMANCE

University Station 4300 River Road College Park, MD 20740

9. PERIOD OF PERFORMANCE

The anticipated Period of Performance (POP) is for one (1) Base Period and four (4) Option Periods. The anticipated dates are as follows:

Base: September 29, 2026 – September 28, 2027.

Option Period 1: September 29, 2027 – September 28, 2028.

Option Period 2: September 29, 2028 – September 28, 2029.

Option Period 3: September 29, 2029 – September 28, 2030.

Option Period 4: September 29, 2030 – September 28, 2031.

10. GOVERNMENT FURNISHED PROPERTY (GFP) / GOVERNMENT FURNISHED

INFORMATION (GFI)

• Laptop and working space for each resource

• FARM system documentation - FARM documents are provided in SharePoint

• EPLC Project Management Plan guide

• EPLC Project Management Plan template

• FDA data standardization vision

• List of EPLC critical partners and current EPLC template documentation

• FDA Application Development Technology and Process Standards

• Current HFP Workflows

– Food Additive Petitions and Color Additive Petitions (FAPs and CAPs).

– Generally Recognized As Safe notices (GRNs),

– Food Contact Notifications (FCNs),

– Biotechnology Consultations (BNFs),

– New Protein Consultations (NPCs),

– Infant Formula Notifications (INF),

– Food Allergen Labeling and Consumer Protection Act notifications and petitions (FALNs and

FALPs),

– Post Market Review Workflow

– Post Market Monitoring workflow

– IF TRACK workflow

– Cell Culture Consultation Workflow

– GRAS-Biotech-FALCPA-PreSubmission Workflow

– Pre-Petition Consultation workflow

– PNC workflow

– TOR workflow

– OFAS GBFP workflow

– ODSP Citizen Petition workflow

– ODSP Correspondence workflow

– ODSP NDI workflow

– ODSP SFC workflow

• For the Office Dietary Supplement Programs (ODSP), these submissions/petitions include:

– New Dietary Ingredient 75 Day Notices (NDI),

– Infant Formula tracking submissions,

– Structure Function Claims.

• In addition to providing information technology support to the scientific review of submissions to OFAS, ODSP, and ONFL the FARM System supports…