The file's text, extracted by GovTribe without its formatting.
Attachment 4 IVV Statement of Work Template
STATE of ILLINOIS Request for Proposal Department of Healthcare and Family Services, Child Support Services (CSS) Child Support Automation and Innovation for Modernization (CS AIM) Independent Verification and Validation (IV&V) Vendor RFP
2024-55-061 / 25-478HFS-CHSUP-B-45281
G.4. IVV Statement of Work Template (Office of Child Support Services)
STATEMENT OF WORK
Independent Verification and Validation (IV&V) Services
TABLE OF CONTENTS
| 1. | Introduction | 2 |
| 2. | Federal Role In And Perspective On IV&V | 2 |
| 3. | Frequency of IV&V Services | 3 |
| 4. | Conflict of Interest Exclusion | 4 |
| 5. | Contractor Capability | 4 |
| 6. | Key Personnel | 6 |
| 7. | Scope of Services | 6 |
| 7.1 | IV&V Standards | 6 |
| 7.2 | IV&V Project Management | 7 |
| 7.3 | Planning Oversight | 8 |
| 7.4 | Project Management | 8 |
| 7.5 | Quality Management | 10 |
| 7.6 | Training | 11 |
| 7.7 | Requirements Management | 12 |
| 7.8 | Operating Environment | 13 |
| 7.9 | Development Environment | 13 |
| 7.10 | Software Development | 14 |
| 7.11 | System And Acceptance Testing | 15 |
| 7.12 | Data Management | 16 |
| 7.13 | Operations Oversight | 16 |
| 8. | Deliverables | 17 |
| 8.1 | Description of IV&V Contract Deliverables | 17 |
| 9. | IV&V Format and Content Reporting Requirements | 22 |
| 10. | State Furnished Items | 23 |
| 11. | Travel | 24 |
| 12. | Points of Contact | 24 |
| 13. | Contract Period | 24 |
| 14. | Definition of Terms | 24 |
Introduction Software Verification and Validation (V&V) is a systems engineering discipline helping a development organization build quality into the application software during the software life cycle. Validation is concerned with checking that the software meets the user's needs, and Verification is concerned with checking that the system is well-engineered.
The definition of activities included under software V&V is necessarily quite broad, and includes both technical and management-based activities. The Federal approach to V&V differs somewhat from the international standard for software V&V, namely that found in the Institute of Electrical and Electronic Engineers (IEEE) Standard for Software Verification and Validation (IEEE Std 1012-2004). Contrary to the international standard, Federal V&V does not require a continuous on-site presence or extensive testing, nor does it perform actual quality assurance activities or other remediations. It instead imposes periodic reviews of software development projects that include site visits employing various industry standards to conduct artifact analysis with interviews of a project’s team and stakeholder in order to fashion a comprehensive “snapshot” of a project’s management and technical processes at work at a given point-in-time.
Another distinction the reader will note is in the inclusion of the word “Independent” in front of Verification and Validation (V&V). In other words, Independent V&V is the set of verification and validation activities performed by an agency not under the control of the organization that is developing the software. IV&V services must be provided and managed by an organization that is technically and managerially independent of the subject software development project. This independence takes two mandatory forms. First, technical independence requires that the IV&V services provider not organizationally be or have been, nor use personnel who are or were, involved in the software development or implementation effort, or for that matter participated in the project’s initial planning and/or subsequent design. Such technical independence helps ensure every IV&V review report is free of personal or professional bias, posturing, or goldplating. Secondly, managerial independence is required of the IV&V services provider to ensure that the IV&V effort is vested in an organization departmentally and hierarchically separate from the software development and program management organizations. Such managerial independence helps ensure that the IV&V service provider is able to deliver to both State and Federal executive leadership and management, findings and recommendations of an IV&V review without restriction, fear of retaliation, or coercion (e.g., reports being subject to prior review or approval from the development group before release to outside entities, such as the Federal government.)
This procurement document defines the IV&V services required by [insert State Organization Name] in support of the [insert Project Name] automation effort. .
Federal Role In and Perspective on IV&V For Federal purposes, the scope of IV&V has been expanded to include planning, management, and other programmatic activities in conformance with the term’s usage in Federal regulations at 45 CFR 307.15(b)(10).
As previously stated, offerors to this solicitation need to be aware that the requirements of IV&V on the State's project do not necessarily conform to industry standard practices for verification and validation as defined in the IEEE Standard for Software Verification and Validation (IEEE Std 1012-2004). The Federal requirements for IV&V are, in fact, a subset of the full V&V standard defined by the IEEE Std 1012-2004. The IEEE standard describes software V&V processes as generally determining if development products of a given activity conform to the requirements of that activity, and if the software satisfies the intended use and user needs. In other words, the IEEE standard answers the dual question, “… did we build the product right, and did we build the right product?” As defined in the IEEE standards, V&V processes include activities such as assessment, analysis, measurement, inspection, and testing of software products and processes. These IV&V processes further include assessing software in the context of the system, including the operational environment, hardware, interfacing software, operators, and users. The IEEE standard seeks to assure that software V&V is performed in parallel with software development, not intermittently or at the conclusion of the software development.
However, the Federal requirements for IV&V on State automation projects are limited in their scope from the industry standard IEEE definition for V&V in two key regards:
1. IV&V of the project is not considered to be an integral process within the larger development project. Rather, it is considered to be an adjunct activity that does not fall within the managerial oversight or control of the day-to-day operation of the project’s management structure, including any and all of its "umbrella" agencies. The IV&V Service Provider must maintain organizational independence and autonomy from the project’s organization, and therefore has a reduced role from that normally associated with full IV&V services. In some respects, the IV&V Service Provider can be viewed as performing a “Technology Audit.”
2. The IV&V Service Provider shall provide its detailed, structured reports of findings of deficiencies and recommendations for their remediation to the cognizant Federal Office at the same time as they are presented to the State. This reporting process, in accordance with Federal regulations, includes not only final report issuance, but all draft report submissions as well.
Frequency of IV&V Services The frequency of IV&V oversight services under this procurement, resulting in a report of findings and recommendations has been determined to be Semi-Annual. Any offeror whose proposal suggests a constant presence on or within the [insert Project name] will likely find their costs unnecessarily higher than those of an offeror who proposes to accomplish the same mission (from IV&V review initiation to final report delivery and presentation) within the otherwise defined, periodic timeframe of semi-annual. For purposes of this solicitation, we believe the offeror's periodic IV&V reviews should each take no longer than an eight to ten-week timeframe from initiation through to final report delivery and presentation. Further, though an offeror may indeed find need of multiple disciplines in the conduct of each periodic IV&V review, great care should be taken in the formulation of its overall project work plan and proposal not to propose unnecessary layers of management and contract oversight. From the State’s perspective, excessive management staffing in an offer’s IV&V review team is neither desirable nor appropriate, and should be avoided.
Conflict of Interest Exclusion Any contractor (and its subcontractors) serving in the role of IV&V Service Contractor/Provider to the State [insert Project name] Project is prohibited from soliciting, proposing, or being awarded any project management, quality assurance, software design, development, or other manner of planning, design, development, or implementation phase activity on the subject [insert Project name] Project for which these IV&V services are being procured. This exclusion likewise extends to any other project within the Department that may interact with or otherwise provide services to the subject [insert Project name] Project or to the Department during the full term of this contract. This exclusion is executed in accordance with Federal regulations at 45 CFR Part 307.15(b)(10)(ii), which require that this IV&V effort, "... be conducted by an entity that is independent from the State (unless the State receives an exception from OCSE)." For purposes of clarity, OCSE has defined “the State” in the above regulatory citation as being a State’s IT project, the IV-D agency itself, and the IV-D agency’s umbrella agency or Department. The primary purpose of this exclusion is to ensure the IV&V Service Provider does not find itself involved with any real or perceived conflicts of interest. Such conflicts of interest could be alleged were the IV&V Service Provider found to be reviewing work products, deliverables, and/or processes for which they currently are or were responsible to plan, design, develop, implement, or operate. Therefore, these exclusions seek to ensure the credibility of the IV&V Service Provider, or in the words of an old colloquialism, to prevent, “the fox watching the hen house.” All exceptions to this conflict of interest exclusion will require Federal OCSE written approval prior to any exception being granted to the IV&V Service Provider.
Contractor Capability The offeror must have a demonstrated ability to perform the following activities, which are the same as those stated in Federal regulations at 45 CFR Part 307.15:
a. Develop a project work plan. The plan must be provided directly to the cognizant Federal Office at the same time it is given to the State.
b. Review and make recommendations on both the management of the [insert Project name] Project, both State and vendor, and the technical aspects of the [insert Project name] Project. The results of this analysis must be provided directly to the cognizant Federal Office at the same time it is given to the State.
c. Consult with all stakeholders and assess the user involvement and buy-in regarding system functionality and the system's ability to meet program needs.
d. Conduct an analysis of past [insert Project name] Project performance (schedule, budget) sufficient to identify and make recommendations for improvement.
e. Provide a risk management assessment and capacity planning services.
f. Develop performance metrics which allow tracking of [insert Project name] Project completion against milestones set by the State.
g. The offeror must also possess the corporate knowledge and experience demonstrating the following capabilities and capacities:
h. Develop a project management plan, including recommendations for: adequate staff; staff skills, positions and abilities; equipment resources; training and facilities; and functional responsibility and authority within a structured project organization.
i. Analyze [insert Project name] Project management; evaluate [insert Project name] Project progress, resources, budget, schedules, work flow and reporting.
j. Review and analyze [insert Project name] Project management planning documents.
k. Review and analyze [insert Project name] Project software development documents.
l. Review and monitor development processes to ensure they are being documented, carried out, and analyzed for improvement.
m. Assess the [insert Project name] Project’s Configuration Management (CM) function/ organization by reviewing CM reports and making recommendations regarding appropriate processes and tools to manage system changes.
n. Perform a detailed review of [insert Project name] Project deliverables for accuracy, completeness, and adherence to contractual and functional requirements.
o. Perform a detailed review of the system documentation (Requirements, Design, Training, Test, and Management Plans, etc.) for accuracy and completeness.
p. Perform a detailed review of the software architecture for feasibility, consistency, and adherence to industry standards.
q. Inventory and review the application software for completeness and adherence to programming standards for the [insert Project name] Project.
r. Analyze application, network, hardware and software operating platform performance characteristics relative to expected/anticipated/contractually guaranteed results and industry standards/expectations.
s. Review the process for tracking of business and technical requirements to their source and review the process established during the planning phase for requirements traceability throughout the subsequent development/implementation phase. Review the traceability of system requirements to design, code, test, and training.
t. Assess and recommend improvement, as needed, to assure maintenance of a data center, including data center input to the [insert Project name] Project regarding operational and maintenance performance of the application.
u. Assess and recommend improvement, as needed, to assure software testing is being performed adequately through review of test plans or other documentation and through direct observation of testing where appropriate, including participation in and coordination of peer reviews.
v. Assess and recommend improvement, as needed, to assure appropriate user and developer training is planned and carried out.
w. Review system hardware and software configuration and report on any compatibility and obsolescence issues.
x. Review and analyze system capacity studies.
Key Personnel Each proposal for IV&V services must include a resume with the experience and skills of the key personnel proposed for the IV&V Service Provider contract. For purposes of this solicitation, all contractor staff supplying services to this IV&V contract are key personnel. In addition to providing resumes for all key personnel, each proposal for IV&V services must also specify by name, the position descriptions, titles, and areas of responsibility of the IV&V personnel who actually will work on the [insert Project name] Project.
The contractor and the State agree that the key personnel are critical to the performance of the contract and, therefore, the State has the right of refusal for any personnel replacements, substitutions, or reassignments of duties of key personnel assigned to the IV&V services contract. The State will also be notified, in writing, of any requests for changes to the personnel assigned to the IV&V contract tasks. Likewise, after contract award, the IV&V provider shall secure written approval from the State prior to making any changes to key personnel. In all instances, qualifications for suggested staff changes should be comparable with those being replaced. Finally, all offerors to this solicitation must be aware that the State must submit key personnel information to the cognizant Federal Office for their review and approval of those contractor’s key personnel to this contract prior to contract award, and that all subsequent personnel changes may require prior Federal review and approval, and that these approvals are in addition to any State approvals.
Scope of Services Using pre-defined checklists and similar tools founded on industry standards, the IV&V Service Provider staff will interview and observe [insert Project name] Project Management staff, CSE Program staff, the [insert Project name] Project Development Contractor staff (including any sub-contractors), observe project meetings and activities to understand the processes, procedures, and tools used in the CSE Program and [insert Project name] Project environments, and review and analyze for adherence to accepted, contractually-defined industry standards, all applicable and available documentation. As a result of these interactions and reviews of the applicable [insert Project name] Project documentation, the IV&V Service Provider will produce a structured, exception-based quarterly assessment report that objectively illustrates the strengths and weaknesses of the Project. The IV&V Service Provider will also provide recommendations for correcting the weaknesses that the assessment reports identify.
To ensure the independence of the IV&V effort, all deliverables will be submitted concurrently to OCSE when a copy is transmitted to the cognizant State Contract Manager. This includes all work plans, review checklists, Deliverables Observation Review (DOR) reports, and draft and final Quarterly Review (QR) reports. Final documents will likewise be delivered to OCSE by the IV&V Service Provider at the same time that they are submitted to the Department and agency.
IV&V Standards Applicable tasks and activities will be performed in accordance with the Institute of Electrical and Electronics Engineers (IEEE) Standard 1012-2004. The IV&V Service Provider will also use all other applicable, lifecycle-appropriate IEEE Standards (e.g., 12207 Software Life Cycle Process; 703 Software QA Plans; 1074 Developing Software Project Lifecycle Process; 828 Configuration Management Plans; and, 830 Requirement Specifications, etc., to name a few) in assessing the State’s [insert Project name] Project. Further, the IV&V Service Provider will employ the Capability Maturity Model Integrated (CMMI), and the Project Management Institute’s Project Management Body of Knowledge (PMBOK) Third Edition, and the PMBOK - Government Extension, as additional standards by which to assess the [insert Project name] Project. Offerors to this contract must clearly and thoroughly describe in their technical response, their approach to using, at a minimum, these three industry standards (CMMI, PMBOK, IEEE) Where an offeror has a similar, corresponding, but different set of minimum standards than those cited above, the offeror will be expected to cross-reference or otherwise map how their own standards meet the same level of detail and scope of review as the industry standards for IV&V cited herein (e.g., CMMI, PMBOK and IEEE.) Failure to do provide this cross-referencing of standards in the offeror’s proposal will be deemed as being non-responsive to this solicitation for purposes of evaluation of the offeror’s proposal.
IV&V services will be performed periodically, through performance of semi-annual IV&V reviews, as part of a larger oversight role of the day-to-day operations and management of the [insert Project name] Project by State and Federal entities. To support the IV&V Service Provider in this role in a timely manner, the IV&V Service Provider shall have complete access to [insert Project name] Project documents, facilities, and staff during normal business hours as required to carry out their oversight role. The IV&V Service Provider shall have access to all key staff on site at the [insert Project name] Project location(s) daily, as needed to observe meetings, review deliverables and documentation, conduct interviews, etc., in order to ensure a high level of integrity and confidence in the IV&V Service Provider’s [insert Project name] Project oversight and monitoring.
The following section contains lists of individual IV&V activities. All activities in Sections 7.2 through 7.13 are mandatory IV&V activities and considered part of this solicitation. The checked activities should be costed and scheduled in the offeror’s IV&V Project Management Plan and reported on in the Initial and Periodic IV&V Reports.
IV&V Project Management
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| IV&V Management Plan |
| IM-1 |
| As the first deliverable the IV&V provider shall develop an IV&V Management Plan. This plan shall describe the activities, personnel, schedule, standards, and methodology for conducting the IV&V reviews. (see Deliverables for more details) |
| Conduct Initial Review |
| IM-2 |
| Prepare and deliver an Initial IV&V report on the required activities. Report on status of each activity. (see Deliverables for more details) |
| Conduct Periodic Review(s) |
| IM-3 |
| Prepare and deliver a Follow-up IV&V report on the required activities. Report on status of each activity and progress since the previous report. (see Deliverables for more details) |
| Management Briefing |
| IM-4 |
| Prepare and deliver a formal presentation(s) on the status of the IV&V project. Presented as required, with at least ten (10) business days notice. No more than once a month. (see Deliverables for more details) |
Planning Oversight
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| Procurement |
| PO-1 |
| Verify the procurement strategy supports State and Federal project objectives. |
| Procurement |
| PO-2 |
| Review and make recommendations on the solicitation documents relative to their ability to adequately inform potential vendors about project objectives, requirements, risks, etc. |
| Procurement |
| PO-3 |
| Verify the evaluation criteria are consistent with project objectives and evaluation processes are consistently applied; verify all evaluation criteria is metrics based and clearly articulated within the solicitation documents. |
| Procurement |
| PO-4 |
| Verify that the obligations of the vendor, sub-contractors and external staff (terms, conditions, statement of work, requirements, technical standards, performance standards, development milestones, acceptance criteria, delivery dates, etc.) are clearly defined. This includes verifying that performance metrics have been included that will allow tracking of project performance and progress against criteria set by the State. |
| Procurement |
| PO-5 |
| Verify the final contract for the vendor team states that the vendor will participate in the IV&V process, being cooperative for coordination and communication of information. |
| Feasibility Study |
| PO-6 |
| Perform ongoing assessment and review of State methodologies used for the feasibility study, verifying it was objective, reasonable, measurable, repeatable, consistent, accurate and verifiable. |
| Feasibility Study |
| PO-7 |
| Review and evaluate the PAPD(U)/IAPD(U) documents. |
| Feasibility Study |
| PO-8 |
| Review and evaluate the Cost Benefit Analysis to assess its reasonableness. |
Project Management
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| Project Sponsorship |
| PM-1 |
| Assess and recommend improvement, as needed, to assure continuous executive stakeholder buy-in, participation, support and commitment, and that open pathways of communication exist among all stakeholders. |
| Project Sponsorship |
| PM-2 |
| Verify that executive sponsorship has bought-in to all changes which impact project objectives, cost, or schedule. |
| Management Assessment |
| PM-3 |
| Verify and assess project management and organization, verify that lines of reporting and responsibility provide adequate technical and managerial oversight of the project. |
| Management Assessment |
| PM-4 |
| Evaluate project progress, resources, budget, schedules, work flow, and reporting. |
| Management Assessment |
| PM-5 |
| Assess coordination, communication and management to verify agencies and departments are not working independently of one another and following the communication plan. |
| Project Management |
| PM-6 |
| Verify that a Project Management Plan is created and being followed. Evaluate the project management plans and procedures to verify that they are developed, communicated, implemented, monitored and complete. |
| Project Management |
| PM-7 |
| Evaluate project reporting plan and actual project reports to verify project status is accurately traced using project metrics. |
| Project Management |
| PM-8 |
| Verify milestones and completion dates are planned, monitored, and met. |
| Project Management |
| PM-9 |
| Verify the existence and institutionalization of an appropriate project issue tracking mechanism that documents issues as they arise, enables communication of issues to proper stakeholders, documents a mitigation strategy as appropriate, and tracks the issue to closure. This should include but is not limited to technical and development efforts. |
| Project Management |
| PM-10 |
| Evaluate the system’s planned life-cycle development methodology or methodologies (waterfall, evolutionary spiral, rapid prototyping, incremental, etc.) to see if they are appropriate for the system being developed. |
Business Process Reengineering
| PM-12 |
| Evaluate the project’s ability and plans to redesign business systems to achieve improvements in critical measures of performance, such as cost, quality, service, and speed. |
Business Process Reengineering
| PM-13 |
| Verify that the reengineering plan has the strategy, management backing, resources, skills and incentives necessary for effective change. |
Business Process Reengineering
| PM-14 |
| Verify that resistance to change is anticipated and prepared for by using principles of change management at each step (such as excellent communication, participation, incentives) and having the appropriate leadership (executive pressure, vision, and actions) throughout the reengineering process. |
| Risk Management |
| PM-15 |
| Verify that a Project Risk Management Plan is created and being followed. Evaluate the projects risk management plans and procedures to verify that risks are identified and quantified and that mitigation plans are developed, communicated, implemented, monitored, and complete. |
| Change Management |
| PM-16 |
| Verify that a Change Management Plan is created and being followed. Evaluate the change management plans and procedures to verify they are developed, communicated, implemented, monitored, and complete; and that resistance to change is anticipated and prepared for. |
| Communication Management |
| PM-17 |
| Verify that a Communication Plan is created and being followed. Evaluate the communication plans and strategies to verify they support communications and work product sharing between all project stakeholders; and assess if communication plans and strategies are effective, implemented, monitored and complete. |
| Configuration Management |
| PM-18 |
| Review and evaluate the configuration management (CM) plans and procedures associated with the development process. |
| Configuration Management |
| PM-19 |
| Verify that all critical development documents, including but not limited to requirements, design, code and JCL are maintained under an appropriate level of control. |
| Configuration Management |
| PM-20 |
| Verify that the processes and tools are in place to identify code versions and to rebuild system configurations from source code. |
| Configuration Management |
| PM-21 |
| Verify that appropriate source and object libraries are maintained for training, test, and production and that formal sign-off procedures are in place for approving deliverables. |
| Configuration Management |
| PM-22 |
| Verify that appropriate processes and tools are in place to manage system changes, including formal logging of change requests and the review, prioritization and timely scheduling of maintenance actions. |
| Configuration Management |
| PM-23 |
| Verify that mechanisms are in place to prevent unauthorized changes being made to the system and to prevent authorized changes from being made to the wrong version. |
| Configuration Management |
| PM-24 |
| Review the use of CM information (such as the number and type of corrective maintenance actions over time) in project management. |
Project Estimating and Scheduling
| PM-25 |
| Evaluate and make recommendations on the estimating and scheduling process of the project to ensure that the project budget and resources are adequate for the work-breakdown structure and schedule. |
Project Estimating and Scheduling
| PM-26 |
| Review schedules to verify that adequate time and resources are assigned for planning, development, review, testing and rework. |
Project Estimating and Scheduling
| PM-27 |
| Examine historical data to determine if the project/department has been able to accurately estimate the time, labor and cost of software development efforts. |
Project Personnel
| PM-28 |
| Examine the job assignments, skills, training and experience of the personnel involved in program development to verify that they are adequate for the development task. |
Project Personnel
| PM-29 |
| Evaluate the State’s hiring plan for the project to verify that adequate human resources will be available for development and maintenance. |
Project Personnel
| PM-30 |
| Evaluate the State’s personnel policies to verify that staff turnover will be minimized. |
Project Organization
| PM-31 |
| Verify that lines of reporting and responsibility provide adequate technical and managerial oversight of the project. |
Project Organization
| PM-32 |
| Verify that the project’s organizational structure supports training, process definition, independent Quality Assurance, Configuration Management, product evaluation, and any other functions critical for the projects success. |
Subcontractors and External Staff
| PM-33 |
| Evaluate the use of sub-contractors or other external sources of project staff (such as IS staff from another State organization) in project development. |
Subcontractors and External Staff
| PM-34 |
| Verify that the obligations of sub-contractors and external staff (terms, conditions, statement of work, requirements, standards, development milestones, acceptance criteria, delivery dates, etc.) are clearly defined. |
Subcontractors and External Staff
| PM-35 |
| Verify that the subcontractors’ software development methodology and product standards are compatible with the system’s standards and environment. |
Subcontractors and External Staff
| PM-36 |
| Verify that the subcontractor has and maintains the required skills, personnel, plans, resources, procedures and standards to meet their commitment. This will include examining the feasibility of any offsite support of the project |
Subcontractors and External Staff
| PM-37 |
| Verify that any proprietary tools used by subcontractors do not restrict the future maintainability, portability, and reusability of the system. |
State Oversight
| PM-38 |
| Verify that State oversight is provided in the form of periodic status reviews and technical interchanges. |
State Oversight
| PM-39 |
| Verify that the State has defined the technical and managerial inputs the subcontractor needs (reviews, approvals, requirements and interface clarifications, etc.) and has the resources to supply them on schedule. |
State Oversight
| PM-40 |
| Verify that State staff has the ultimate responsibility for monitoring project cost and schedule. |
Quality Management
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
Quality Assurance
| QA-1 |
| Evaluate and make recommendations on the project’s Quality Assurance plans, procedures and organization. |
Quality Assurance
| QA-2 |
| Verify that QA has an appropriate level of independence from project management. |
Quality Assurance
| QA-3 |
| Verify that the QA organization monitors the fidelity of all defined processes in all phases of the project. |
Quality Assurance
| QA-4 |
| Verify that the quality of all products produced by the project is monitored by formal reviews and sign-offs. |
Quality Assurance
| QA-5 |
| Verify that project self-evaluations are performed and that measures are continually taken to improve the process. |
Quality Assurance
| QA-6 |
| Monitor the performance of the QA contractor by reviewing its processes and reports and performing spot checks of system documentation; assess findings and performance of the processes and reports. |
Quality Assurance
| QA-7 |
| Verify that QA has an appropriate level of independence; evaluate and make recommendations on the project’s Quality Assurance plans, procedures and organization. |
| Quality Assurance |
| QA-8 |
| Verify that the QA vendor provides periodic assessment of the CMM activities of the project and that the project takes action to reach and maintain CMM Level __. |
| Quality Assurance |
| QA-9 |
| Evaluate if appropriate mechanisms are in place for project self-evaluation and process improvement. |
| Process Definition and Product Standards |
| QA-10 |
| Review and make recommendations on all defined processes and product standards associated with the system development. |
| Process Definition and Product Standards |
| QA-11 |
| Verify that all major development processes are defined and that the defined and approved processes and standards are followed in development. |
| Process Definition and Product Standards |
| QA-12 |
| Verify that the processes and standards are compatible with each other and with the system development methodology. |
| Process Definition and Product Standards |
| QA-13 |
| Verify that all process definitions and standards are complete, clear, up-to-date, consistent in format, and easily available to project personnel |
Training
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| User Training and Documentation |
| TR-1 |
| Review and make recommendations on the training provided to system users. Verify sufficient knowledge transfer for maintenance and operation of the new system. |
| User Training and Documentation |
| TR-2 |
| Verify that training for users is instructor-led and hands-on and is directly related to the business process and required job skills. |
| User Training and Documentation |
| TR-3 |
| Verify that user-friendly training materials and help desk services are easily available to all users. |
| User Training and Documentation |
| TR-4 |
| Verify that all necessary policy and process and documentation is easily available to users. |
| User Training and Documentation |
| TR-5 |
| Verify that all training is given on-time and is evaluated and monitored for effectiveness, with additional training provided as needed. |
| Developer Training and Documentation |
| TR-6 |
| Review and make recommendations on the training provided to system developers. |
| Developer Training and Documentation |
| TR-7 |
| Verify that developer training is technically adequate, appropriate for the development phase, and available at appropriate times. |
| Developer Training and Documentation |
| TR-8 |
| Verify that all necessary policy, process and standards documentation is easily available to developers. |
| Developer Training and Documentation |
| TR-9 |
| Verify that all training is given on-time and is evaluated and monitored for effectiveness, with additional training provided as needed. |
Requirements Management
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| Requirements Management |
| RM-1 |
| Evaluate and make recommendations on the project’s process and procedures for managing requirements. |
| Requirements Management |
| RM-2 |
| Verify that system requirements are well-defined, understood and documented. |
| Requirements Management |
| RM-3 |
| Evaluate the allocation of system requirements to hardware and software requirements. |
| Requirements Management |
| RM-4 |
| Verify that software requirements can be traced through design, code and test phases to verify that the system performs as intended and contains no unnecessary software elements. |
| Requirements Management |
| RM-5 |
| Verify that requirements are under formal configuration control. |
| Security Requirements |
| RM-6 |
| Evaluate and make recommendations on project policies and procedures for ensuring that the system is secure and that the privacy of client data is maintained. |
| Security Requirements |
| RM-7 |
| Evaluate the projects restrictions on system and data access. |
| Security Requirements |
| RM-8 |
| Evaluate the projects security and risk analysis. |
| Security Requirements |
| RM-9 |
| Verify that processes and equipment are in place to back up client and project data and files and archive them safely at appropriate intervals. |
| Requirements Analysis |
| RM-10 |
| Verify that an analysis of client, State and federal needs and objectives has been performed to verify that requirements of the system are well understood, well defined, and satisfy federal regulations. |
| Requirements Analysis |
| RM-11 |
| Verify that all stakeholders have been consulted to the desired functionality of the system, and that users have been involved in prototyping of the user interface. |
| Requirements Analysis |
| RM-12 |
| Verify that all stakeholders have bought-in to all changes which impact project objectives, cost, or schedule. |
| Requirements Analysis |
| RM-13 |
| Verify that performance requirements (e.g. timing, response time and throughput) satisfy user needs |
| Requirements Analysis |
| RM-14 |
| Verify that user’s maintenance requirements for the system are completely specified |
Interface Requirements
| RM-15 |
| Verify that all system interfaces are exactly described, by medium and by function, including input/output control codes. data format, polarity, range, units, and frequency. |
| Requirements Analysis |
| RM-16 |
| Verify those approved interface documents are available and that appropriate relationships (such as interface working groups) are in place with all agencies and organizations supporting the interfaces. |
Requirements Allocation and Specification
| RM-17 |
| Verify that all system requirements have been allocated to a either a software or hardware subsystem. |
| RM-18 |
| Verify that requirements specifications have been developed for all hardware and software subsystems in a sufficient level of detail to ensure successful implementation. |
Reverse Engineering
| RM-19 |
| If a legacy system or a transfer system is or will be used in development, Verify that a well defined plan and process for reengineering the system is in place and is followed. The process, depending on the goals of the reuse/transfer, may include reverse engineering, code translation, re-documentation, restructuring, normalization, and re-targeting. |
Operating Environment
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
System Hardware
| OE-1 |
| Evaluate new and existing system hardware configurations to determine if their performance is adequate to meet existing and proposed system requirements. |
System Hardware
| OE-2 |
| Determine if hardware is compatible with the State’s existing processing environment, if it is maintainable, and if it is easily upgradeable. This evaluation will include, but is not limited to CPUs and other processors, memory, network connections and bandwidth, communication controllers, telecommunications systems (LAN/WAN), terminals, printers and storage devices. |
System Hardware
| OE-3 |
| Evaluate current and projected vendor support of the hardware, as well as the State’s hardware configuration management plans and procedures. |
System Software
| OE-4 |
| Evaluate new and existing system software to determine if its capabilities are adequate to meet existing and proposed system requirements. |
System Software
| OE-5 |
| Determine if the software is compatible with the State’s existing hardware and software environment, if it is maintainable, and if it is easily upgradeable. This evaluation will include, but is not limited to, operating systems, middleware, and network software including communications and file-sharing protocols. |
System Software
| OE-6 |
| Current and projected vendor support of the software will also be evaluated, as well as the States software acquisition plans and procedures. |
Database Software
| OE-7 |
| Evaluate new and existing database products to determine if their capabilities are adequate to meet existing and proposed system requirements. |
Database Software
| OE-8 |
| Determine if the database’s data format is easily convertible to other formats, if it supports the addition of new data items, if it is scaleable, if it is easily refreshable and if it is compatible with the State’s existing hardware and software, including any on-line transaction processing (OLTP) environment. |
Database Software
| OE-9 |
| Evaluate any current and projected vendor support of the software, as well as the State’s software acquisition plans and procedures. |
| System Capacity |
| OE-10 |
| Evaluate the existing processing capacity of the system and verify that it is adequate for current statewide needs for both batch and on-line processing. |
| System Capacity |
| OE-11 |
| Evaluate the historic availability and reliability of the system including the frequency and criticality of system failure. |
| System Capacity |
| OE-12 |
| Evaluate the results of any volume testing or stress testing. |
| System Capacity |
| OE-13 |
| Evaluate any existing measurement and capacity planning program and will evaluate the system’s capacity to support future growth. |
| System Capacity |
| OE-14 |
| Make recommendations on changes in processing hardware, storage, network systems, operating systems, COTS software, and software design to meet future growth and improve system performance. |
Development Environment
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
Development Hardware
| DE-1 |
| Evaluate new and existing development hardware configurations to determine if their performance is adequate to meet the needs of system development. |
Development Hardware
| DE-2 |
| Determine if hardware is maintainable, easily upgradeable, and compatible with the State’s existing development and processing environment. This evaluation will include, but is not limited to CPUs and other processors, memory, network connections and bandwidth, communication controllers, telecommunications systems (LAN/WAN), terminals, printers and storage devices. |
Development Hardware
| DE-3 |
| Current and projected vendor support of the hardware will also be evaluated, as well as the State’s hardware configuration management plans and procedures. |
Development Software
| DE-4 |
| Evaluate new and existing development software to determine if its capabilities are adequate to meet system development requirements. |
Development Software
| DE-5 |
| Determine if the software is maintainable, easily upgradeable, and compatible with the State’s existing hardware and software environment. |
Development Software
| DE-6 |
| Evaluate the environment as a whole to see if it shows a degree of integration compatible with good development. This evaluation will include, but is not limited to, operating systems, network software, CASE tools, project management software, configuration management software, compilers, cross-compilers, linkers, loaders, debuggers, editors, and reporting software. |
Development Software
| DE-7 |
| Language and compiler selection will be evaluated with regard to portability and reusability (ANSI standard language, non-standard extensions, etc.) |
Development Software
| DE-8 |
| Current and projected vendor support of the software will also be evaluated, as well as the States software acquisition plans and procedures. |
Software Development
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| High-Level Design |
| SD-1 |
| Evaluate and make recommendations on existing high level design products to verify the design is workable, efficient, and satisfies all system and system interface requirements. |
| High-Level Design |
| SD-2 |
| Evaluated the design products for adherence to the project design methodology and standards. |
| High-Level Design |
| SD-3 |
| Evaluate the design and analysis process used to develop the design and make recommendations for improvements. Evaluate design standards, methodology and CASE tools used will be evaluated and make recommendations. |
| High-Level Design |
| SD-4 |
| Verify that design requirements can be traced back to system requirements. |
| High-Level Design |
| SD-5 |
| Verify that all design products are under configuration control and formally approved before detailed design begins. |
Detailed Design
| SD-6 |
| Evaluate and make recommendations on existing detailed design products to verify that the design is workable, efficient, and satisfies all high level design requirements. |
Detailed Design
| SD-7 |
| The design products will also be evaluated for adherence to the project design methodology and standards. |
Detailed Design
| SD-8 |
| The design and analysis process used to develop the design will be evaluated and recommendations for improvements made. |
Detailed Design
| SD-9 |
| Design standards, methodology and CASE tools used will be evaluated and recommendations made. |
Detailed Design
| SD-10 |
| Verify that design requirements can be traced back to system requirements and high level design. |
Detailed Design
| SD-11 |
| Verify that all design products are under configuration control and formally approved before coding begins. |
Job Control
| SD-12 |
| Perform an evaluation and make recommendations on existing job control and on the process for designing job control. |
Job Control
| SD-13 |
| Evaluate the system’s division between batch and on-line processing with regard to system performance and data integrity. |
Job Control
| SD-14 |
| Evaluate batch jobs for appropriate scheduling, timing and internal and external dependencies. |
Job Control
| SD-15 |
| Evaluate the appropriate use of OS scheduling software. |
Job Control
| SD-16 |
| Verify that job control language scripts are under an appropriate level of configuration control. |
Code
| SD-17 |
| Evaluate and make recommendations on the standards and process currently in place for code development. |
Code
| SD-18 |
| Evaluate the existing code base for portability and maintainability, taking software metrics including but not limited to modularity, complexity and source and object size. |
Code
| SD-19 |
| Code documentation will be evaluated for quality, completeness (including maintenance history) and accessibility. |
Code
| SD-20 |
| Evaluate the coding standards and guidelines and the projects compliance with these standards and guidelines. This evaluation will include, but is not limited to, structure, documentation, modularity, naming conventions and format. |
Code
| SD-21 |
| Verify that developed code is kept under appropriate configuration control and is easily accessible by developers. |
Code
| SD-22 |
| Evaluate the project’s use of software metrics in management and quality assurance. |
Unit Test
| SD-23 |
| Evaluate the plans, requirements, environment, tools, and procedures used for unit testing system modules. |
Unit Test
| SD-24 |
| Evaluate the level of test automation, interactive testing and interactive debugging available in the test environment. |
Unit Test
| SD-25 |
| Verify that an appropriate level of test coverage is achieved by the test process, that test results are verified, that the correct code configuration has been tested, and that the tests are appropriately documented. |
System And Acceptance Testing
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
System Integration Test
| ST-1 |
| Evaluate the plans, requirements, environment, tools, and procedures used for integration testing of system modules. |
System Integration Test
| ST-2 |
| Evaluate the level of automation and the availability of the system test environment. |
System Integration Test
| ST-3 |
| Verify that an appropriate level of test coverage is achieved by the test process, that test results are verified, that the correct code configuration has been tested, and that the tests are appropriately documented, including formal logging of errors found in testing. |
System Integration Test
| ST-4 |
| Verify that the test organization has an appropriate level of independence from the development organization. |
Pilot Test
| ST-5 |
| Evaluate the plans, requirements, environment, tools, and procedures for pilot testing the system. |
Pilot Test
| ST-6 |
| Verify that a sufficient number and type of case scenarios are used to ensure comprehensive but manageable testing and that tests are run in a realistic, real-time environment. |
Pilot Test
| ST-7 |
| Verify that test scripts are complete, with step-by-step procedures, required pre-existing events or triggers, and expected results. |
Pilot Test
| ST-8 |
| Verify that test results are verified, that the correct code configuration has been used, and that the tests runs are appropriately documented, including formal logging of errors found in testing. |
Pilot Test
| ST-9 |
| Verify that the test organization has an appropriate level of independence from the development organization. |
| Interface Testing |
| ST-10 |
| Evaluate interface testing plans and procedures for compliance with industry standards. |
Acceptance and Turnover
| ST-11 |
| Acceptance procedures and acceptance criteria for each product must be defined, reviewed, and approved prior to test and the results of the test must be documented. Acceptance procedures must also address the process by which any software product that does not pass acceptance testing will be corrected. |
Acceptance and Turnover
| ST-12 |
| Verify that appropriate acceptance testing based on the defined acceptance criteria is performed satisfactorily before acceptance of software products. |
Acceptance and Turnover
| ST-13 |
| Verify that the acceptance test organization has an appropriate level of independence from the subcontractor. |
Acceptance and Turnover
| ST-14 |
| Verify that training in using the contractor-supplied software is be on-going throughout the development process, especially If the software is to be turned over to State staff for operation. |
Acceptance and Turnover
| ST-15 |
| Review and evaluate implementation plan. |
Data Management
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
Data Conversion
| DM-1 |
| Evaluate the State’s existing and proposed plans, procedures and software for data conversion. |
Data Conversion
| DM-2 |
| Verify that procedures are in place and are being followed to review the completed data for completeness and accuracy and to perform data clean-up as required. |
Data Conversion
| DM-3 |
| Determine conversion error rates and if the error rates are manageable. |
Data Conversion
| DM-4 |
| Make recommendations on making the conversion process more efficient and on maintaining the integrity of data during the conversion. |
Database Design
| DM-5 |
| Evaluate new and existing database designs to determine if they meet existing and proposed system requirements. |
Database Design
| DM-6 |
| Recommend improvements to existing designs to improve data integrity and system performance. |
Database Design
| DM-7 |
| Evaluate the design for maintainability, scalability, refreshability, concurrence, normalization (where appropriate) and any other factors affecting performance and data integrity. |
Database Design
| DM-8 |
| Evaluate the project’s process for administering the database, including backup, recovery, performance analysis and control of data item creation. |
Operations Oversight
| TASK ITEM |
| TASK # |
| TASK DESCRIPTION |
| Operational Change Tracking |
| OO-1 |
| Evaluate statewide system’s change request and defect tracking processes. |
| OO-2 |
| Evaluate implementation of the process activities and request volumes to determine if processes are effective and are being followed. |
| Customer & User Operational Satisfaction |
| OO-3 |
| Evaluate user satisfaction with system to determine areas for improvement |
| Operational Goals |
| OO-4 |
| Evaluate impact of system on program goals and performance standards. |
| Operational Documentation |
| OO-5 |
| Evaluate operational plans and processes. |
| Operational Processes and Activity |
| OO-6 |
| Evaluate implementation of the process activities including backup, disaster recovery and day-to-day operations to verify the processes are being followed. |
Deliverables The following table identifies the anticipated deliverables.
This is the start of the file's text. The full file is on GovTribe.