Attachment A Agile Development Scope of Work.pdf

1 | P a g e

STATEMENT OF WORK

DIGITAL DEVELOPMENT SERVICES

INVITATION TO QUALIFY (ITQ) CONTRACT

ITQ PURPOSE : The purpose of the Digital Development Services ITQ is to qualify responsible and responsive Contractors to perform digital service work for the Commonwealth of Pennsylvania’s executive agencies to ensure that digital experiences for Pennsylvanians are simple, seamless and secure.

This contract is for fixed price, deliverables-based Digital Development IT services projects. The Commonwealth, when it determines that it is in its best interest, reserves the right to create separate ITQs for specific projects. If separate ITQs are established for specific projects, all vendors will have to separately qualify for those ITQs if they are interested in quoting and participating in those specific projects.

The purchase of hardware, software, and staff augmentation services are NOT PERMITTED under this contract.

ISSUING OFFICE: This ITQ is managed and administered by the Commonwealth of Pennsylvania, Department of General Services (DGS), Bureau of Procurement.

CONTRACTOR QUALIFICATIONS: Contractors interested in becoming an ITQ Contractor must meet the following requirements. Failure to meet the below requirements will result in the application being rejected. Each Contractor that meets the minimum qualification will be awarded a contract. Award of a contract to a Contractor is not a guarantee of business.

• At the time of qualification, the Contractor will be required to submit Attachment B, Agile ITQ Rate Card. Any vendor with a fair and reasonable price, as determined by Attachment B may be considered a qualified vendor in terms of pricing. Contractors are responsible for justifying their sprint team size and pricing related to the objective outlined by the Agency Program Area requesting each scope of work under this ITQ and any resulting Request For Quotes (RFQ).

• A fair and reasonable price determination will reflect the GSA’s Government Cost Estimate for iterative development efforts and labor role and rate cards that are in line with the U.S. GSA (Calc: https://buy.gsa.gov/pricing/)

• Rate cards may be resubmitted annually for qualified Contractors, on the contract date, to ensure rates are increased with inflation, but not to exceed rates as reflected in the U.S. GSA calculator.

• At the time of qualification, the Contractor will be required to provide evidence from previous digital service projects that reflect the work of the service category(ies) below (see “Artifact Guidance”). The evidence should include a narrative of their ability to complete deliverables in a specified time, at a pre-determined quality. This information may not exceed two (2) pages, and two (2) pages of supporting artifacts, that are relevant to the commodity codes the Contractor is applying for (please see below). In addition, the contractor may also provide a brief narrative on their experience on how they managed budget constraints and tradeoff decisions not to exceed one (1) page.

• Contractors are required to complete Attachment C, Digital Maturity Assessment and provide evidence, not to exceed 500 characters per scoring category, for their chosen rating.

Failure to complete Attachment C will result in rejection, The content of the assessment—such as a low https://buy.gsa.gov/pricing/

2 | P a g e self-rating in certain areas—will not be used as grounds for rejection from being awarded a contract on the ITQ but will be used to help the Commonwealth better understand the vendor's capabilities and alignment with Agency Program Area needs at the RFQ level.

• At the time of application, Contracts will be required to complete Attachment D, Enterprise Platforms to indicate any enterprise platforms that they are certified to work on for Agency Program Area reference.

CONTRACTOR RESPONSIBILITY: The selected contractor is responsible for performing 100% of the work for any scopes of work issued under this contract. Subcontracting is not permissible.

SERVICE CATEGORIES: Contractors will need to choose the appropriate service category(ies) to qualify for this contract. Contractors will select the appropriate category(ies) under the Business Details section of the qualification process. The Commonwealth may add additional service category(ies) as the need arises. The table below lists the description of each service category.

SERVICE

CATEGORIES

DESCRIPTION OF SERVICE CATEGORY

81110000-ITQ-532-

Digital Service Discovery

Includes, but is not limited to, the performance of initial research and analysis activities required to identify and define user needs and system requirements for digital service projects. Services include stakeholder interviews, user research, competitive analysis, persona identification, business process mapping, and initial prototyping to outline feasible solutions and strategic goals. It also covers the development of a project roadmap, including scope definition, resource estimation, and prioritization of features. This phase ensures a solid foundation for subsequent design, development, and deployment phases.

Artifact Guidance: At the time of qualification, Offerors may supply a excerpt from a Discovery Report that may include findings from stakeholder interviews, user research data, competitive analysis, or an initial prototyping summary.

81110000-ITQ-533

Digital Service Design

Comprehensive research and discovery activities are conducted to inform the creation of wireframe mockups and interactive prototypes using industry-standard design tools like Figma. This service emphasizes human-centered design, user experience, and visual aesthetics while ensuring compliance with current accessibility and usability standards.

User acceptance testing is conducted to validate design decisions through feedback and iterative design. Final deliverables typically include detailed design specifications, content creation, documentation, personas, and journey mapping artifacts, paired with design assets to support development and deployment.

Artifact Guidance: At the time of qualification, Offerors may provide findings and artifacts in a presentation format that summarizes problem statements, research insights, and describes how these elements culminated in the design solutions and the included design artifacts.

Offerors may supply an excerpt Design specification document that may encapsulate wireframes, interactive prototypes, user testing feedback, and/or final design assets, demonstrating their adherence to UX principles and accessibility standards.

3 | P a g e

81110000-ITQ-534-

Digital Service Development

Includes, but is not limited to, all activities related to the coding, configuring, and building of digital services based on approved design specifications. It covers front-end and back-end development, database setup, and integration with existing systems to create fully functional digital solutions. Developers adhere to coding standards and best practices to ensure scalability and maintainability. The code is developed in a collaborative environment to foster innovation and efficiency. This may include integrations with emerging technologies for which the Commonwealth has a software license agreement.

Artifact Guidance: At the time of qualification, Offerors may provide a link to their codebase, or an excerpt from a Code Review Report, featuring samples of front-end and back-end code, database schemas, and documentation of integration points, highlighting adherence to coding standards (including performance improvement and security checkpoints) and collaborative development practices.

81110000-ITQ-535-

Digital Service Quality Assurance and Testing

Includes but is not limited to the systematic verification processes to ensure that digital services meet the required quality standards before deployment. It includes a comprehensive suite of testing methods such as unit testing, integration testing, system testing, and user acceptance testing (UAT). Quality assurance also covers performance, security, and accessibility testing to verify that the service is robust, efficient, secure, and conforms to Web Content Accessibility Guidelines (WCAG) 2.2 AA standards (or the latest Version of Web Content Accessibility Guidelines). Documentation of test cases and outcomes, along with continuous feedback loops, ensures thorough coverage and resolution of all identified issues.

Artifact Guidance: At the time of qualification, Offerors may provide an excerpt from a Testing Plan or Test Plan Report, detailing methodologies used (unit, integration, system, UAT), along with documented test cases, outcomes, and resolutions of identified issues, ensuring all quality standards are met.

81110000-ITQ-536-

Digital Service Accessibility Remediation

Includes by not limited to the services designed to ensure digital materials, content, including videos, PDFs, and other print media comply with accessibility standard before deployment and following identification of remediation. It includes conducting thorough audits using a blend of automated tools with manual testing to ensure all digital content meets or exceeds Web Content Accessibility Guidelines 2.2 AA standards (or the latest Version of Web Content Accessibility Guidelines), the performance of specialized testing for video content to include captions, audio description, and visual accessibility enhancements, the remediation of PDFs and other print materials for accessibility including screen reader compatibility and navigational ease and use. Remediation services may also include plain language content to ensure comprehensibility and accessibility for individuals with disabilities and limited English Proficiency.

Artifact Guidance: At the time of qualification, Offerors should provide samples from an Accessibility Audit Report, which includes methodologies used for testing, detailed findings, examples of remediation actions taken, and ongoing support strategies.

Additionally, examples of materials translated into plain language and other languages should be included to demonstrate the Offeror’s capability in making content universally accessible.

81110000-ITQ-

537- Digital Service DevSecOps

Includes, but is not limited to, the integration of development, security, and operations to streamline the lifecycle of digital services from conception to deployment. It includes setting up and maintaining continuous integration and continuous delivery (CI/CD) pipelines to automate the build, test, and deployment processes. Security is integrated at every phase of development to preemptively address vulnerabilities and compliance issues. The aim is to enhance collaboration among teams, shorten development cycles, and

4 | P a g e ensure high-quality, secure service delivery.

Artifact Guidance: At the time of qualification, Offerors can provide a DevSecOps Workflow Diagram that outlines their CI/CD pipeline, security integration points throughout the development phases, and evidence of streamlined operations to ensure efficient and secure service delivery. Artifacts may include examples of automated updates and security patches applied as part of the CI/CD process. Artifacts may also highlight how continuous monitoring and automated testing were applied to ensure high levels of security and operational efficiency.

81110000-ITQ-538 -

Digital Service Project Management

Includes, but is not limited to, the oversight and coordination of digital service projects from initiation through to completion. It includes the planning, scheduling, resourcing, and budgeting activities necessary to deliver projects on time, within scope, and on budget. Project managers ensure effective communication among all stakeholders, manage risks, and facilitate problem-solving and decision-making processes. The code also involves monitoring project progress and implementing agile methodologies to adapt to changes and deliver high-quality results efficiently.

Artifact Guidance: At the time of qualification, Offerors can provide a short narrative or artifacts related to Agile project management tools and approaches, which may include resource allocations, risk management strategies, and communication templates, reflecting their capability to manage digital projects effectively using Agile methodologies.

81110000-ITQ-539-

Digital Service Deployment

Includes, but is not limited to, all activities related to the rollout of digital services into a production environment. It includes the setup of hosting environments, configuration of servers, and deployment of code using automated deployment tools to ensure consistent and error-free launches. The process involves coordination between development, operations, and support teams to manage release schedules and minimize downtime. This code also covers post-deployment monitoring and performance optimization to ensure the service operates effectively in the live environment.

Artifact Guidance: At the time of qualification, Offerors can provide a deployment strategy blueprint, illustrating the setup of hosting environments, server configurations, and automated deployment processes, accompanied by a post-deployment performance report to demonstrate successful live environment operations.

81110000-ITQ-540-

Digital Service Upskilling and Capacity Building

Including but not limited to activities that enhance the Commonwealth's internal capabilities to effectively deliver and maintain digital services, including coaching and training, developing sustainable practices through knowledge transfer, process optimization, and cultural transformation, and delivery-based training where staff learn by doing—applying their new skills directly to on-the-job tasks. Additional services may include organizational readiness assessments, digital transformation workshops, change management strategies, and hands-on training in disciplines like agile coaching, DevOps, and user research.

Artifact Guidance: At the time of qualification, Offerors may provide capacity-building frameworks, training materials, or documented outcomes from past initiatives, including workshop curricula and change management playbooks that showcase before and after improvements in team capabilities and delivery practices.

5 | P a g e

81110000-ITQ-541-

Digital Service Data Analytics, Visualization and Engineering

Data Analytics includes, but is not limited to, analyzing administrative and other data using a variety of statistical and cognitive computing techniques with statistical programming languages; capturing and managing web analytics data; developing new metrics to apply to analytics dashboards.

Data Visualization includes, but is not limited to, visualizing data in business intelligence (BI) tools developing traditional and web-based data reports for technical and non-technical audiences; custom-developed visual representations of data and data analysis for data storytelling, interactive charts, graphs and maps, and accessible and inclusive presentation of data visualization with open source libraries.

Data Engineering includes, but is not limited to, building and maintaining data environments (e.g. “data lakes”), databases, data pipelines with tools; processing and manipulating large volumes of data to prepare it for analysis; ensuring data quality and security standards; administering extract, transform, load (ETL) servers and related databases.

REQUEST FOR QUOTES (RFQ) PROCEDURES: Commonwealth agencies will issue an RFQ to qualified Contractors, through the Commonwealth’s Custom Portal, powered by the JAGGAER system. For a scope of work less than $100,000, an Agency Program Area may choose any qualified contractor within a service category.

However, for each service category an Agency Program Area may not issue more than two Purchase Orders to the same aforementioned qualified contractor within a fiscal year. For the purposes of this Scope of Work, an Agency Program Area is defined as a separate operational entity having a separate Commonwealth of Pennsylvania "Fund Center" number assigned to them, as provided by the Office of Budget, and designated within the Commonwealth’s financial system of record.

For scopes of work over $100,000, an RFQ must be issued. Contractors will respond to the RFQ in the system. The requesting agencies may require the qualified Contractors to furnish, upon request, additional documentation in the RFQ. The qualified Contractors selected for the RFQ process will receive a Purchase Order (PO) and will supply the service to meet the specific requirements as indicated in the RFQ. Agency Program Areas may use this ITQ for a maximum of $2 million dollars annually.

Agencies will make a best value selection based upon the criteria set forth in the RFQ. Best Value refers to the process of selecting the quote which provides the greatest value to the Agency Program Area based on evaluating and comparing all pertinent criteria, including cost, so that the Contractor whose overall proposal best suits the Agency Program Area’s needs is selected for each individual project.

Quotes with costs that are not determined to be fair and reasonable may be considered non-responsive and not considered for award.

RFQ OPTIONAL SCORING METHODS

The Commonwealth, at its discretion, may ask multiple qualified Contractors to participate in a proof of concept or technology challenge for a pre-defined scope of work, not to exceed 4 weeks of time, in order to select a contractor for a subsequent scope of work. The initial proof of concept or technology challenge will be at the contractor’s expense. Every qualified Contractor shall be invited to participate.

6 | P a g e

PERFORMANCE STANDARDS:

Contracts may be reviewed by the Commonwealth for adherence to performance standards in the table below. Contractors not able to meet these criteria may be subject to contract termination.

Deliverable (as relevant)

Performance Standard(s) Acceptable Quality Level Method of Assessment

Tested Code Code delivered under the order must have substantial test code coverage and a clean code base Version-controlled, public repository of code comprising the product, which will remain in the government domain

Minimum of 90% test coverage of all code

Combination of manual review and automated testing

Accessibility Web Content Accessibility Guidelines

2.1 AA standards

0 errors reported using an automated scanner, and 0 errors reported in manual testing

Pa11y

Deployed Code must successfully build and deploy into staging environment

Successful build with a single command

Combination of manual review and automated testing

Documented All dependencies are listed and the licenses are documented. Major functionality in the software/source code is documented. Individual methods are documented inline using comments that permit the use of documentation-generation tools such as JSDoc. A system diagram is provided.. A system diagram is provided.

Combination of manual review and automated testing, if available

Manual review

Security OWASP Application Security Verification Standard 4.0, Level 2

Governance risk and compliance team

Code submitted must be free of medium- and high-level static and dynamic security vulnerabilities

Clean tests from a static testing SaaS (such as npm audit) and from OWASP ZAP, along with documentation explaining any false positives

User research Usability testing and other user research methods must be conducted at regular intervals throughout the development process (not just at the beginning or end)

Artifacts from usability testing and/or other research methods with end users are available at the end of every applicable sprint, in accordance with the vendor’s research plan

Manual review https://github.com/pa11y/pa11y http://usejsdoc.org/ https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://www.owasp.org/images/d/d4/OWASP_Application_Security_Verification_Standard_4.0-en.pdf https://docs.npmjs.com/cli/audit https://docs.npmjs.com/cli/audit https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project