Attachment B - FDA Enterprise IT Application Development (EAD) BPA SOW Excerpt.pdf

Food and Drug Administration (FDA) Office of Digital Transformation (ODT)

- DRAFT -

Enterprise IT Application Development (EAD)

Blanket Purchase Agreement Statement of Work (SOW)

April 30, 2024

Table of Contents 1 General Information

1.1 FDA Background

2 BPA Objectives

2.1 BPA Purpose/Goals

2.2 BPA Governance

3 BPA Scope

3.1 Program, Project, and Contract Management

3.1.1 Program Management

3.1.2 Program and Project Management Support

3.1.3 Risk Management

3.1.4 Quality Assurance Plan

3.1.5 Governance Operations and Program Management Support

3.1.6 Testing

3.1.7 Develop and Document Program Level Technical Standards and Methods

3.1.8 Documentation

3.1.9 Data Calls

3.1.10 Business Analysis Support

3.2 Business Process Engineering

3.2.1 Business Process Modeling

3.2.2 Business Process Transformation

3.2.3 Organizational Change Management

3.2.4 Strategic Communication Support

3.2.5 Concept Development and Strategic Planning

3.2.6 Policy, Process and Procedure Improvements

3.2.7 Business Tools Support

3.3 Enterprise Architecture Services

3.3.1 Enterprise Architecture Activities

3.3.2 Chief Technology Officer (CTO) Support

3.3.3 Solution Architecture (SA) Support

3.3.4 Business Continuity and Recovery (BCAR)

3.4 Development, Modernization and Enhancements (DME) Support

3.4.1 Development, Modernization and Enhancements (DME) Lifecycle Support

3.4.2 IT Solution Support

3.4.3 Requirements Analysis Phase Support

3.4.4 Design Phase Support

3.4.5 Development Phase Support

3.4.6 Configuration and Change Management Support

3.4.7 Human Centered Design

3.4.8 Database Design and Architecture

3.4.9 Lean Product Management and Development

3.4.10 COTS Configuration and System Development Support

3.4.11 Infrastructure Modernization Support

3.4.12 Testing and Automated Testing Support

3.4.13 Systems Integration and Engineering Services

3.4.14 CaaS Infrastructure Support

3.4.15 Development/Security/Operations (DevSecOps) Engineering Support

3.4.16 Endpoint Engineering Services

3.4.17 Data Services and Governance

3.4.18 Microservices Development

3.4.19 API Development and Management

3.4.20 Statistical Analysis

3.5 Cloud Services

3.5.1 Cloud Engineering and Provisioning

3.5.2 Cloud Migration Support and Services

3.5.3 Utilization of Cloud Service Provider (CSP) Migration Rebates and Support

3.5.4 Cloud FinOps Support

3.6 Data Services

3.6.1 Data Analytics Services

3.6.2 Database Development, Modernization and Enhancements (DME) Support

3.6.3 Database Engineering, Operations and Maintenance Support

3.6.4 Database Administration Support

3.6.5 Data Migration Support

3.6.6 Business Intelligence Discoveries and Reporting

3.6.7 Self-Service Data Visualization

3.6.8 Identity and Access Management, Administration, New Development and Production Support

Tasks

3.6.9 Transparent Data Encryption

3.6.10 Data Curation Services

3.6.11 Search Activities

3.6.12 Regulatory Operations

3.6.13 Data and Platform Engineering Services

3.6.14 Scientific, Regulatory, and Health Data Services

3.6.15 Data Science, Modeling, and Analysis Support

3.6.16 SME Data Standards Support

3.7 Operations and Maintenance (O&M) and Support Services

3.7.1 O&M Activities

3.7.2 Troubleshooting

3.7.3 CaaS Operations and Maintenance Support

3.7.4 COTS Configuration and System Operations and Maintenance Support

3.7.5 Corrective and Preventive Maintenance

3.7.6 Software Patches and Release Management

3.7.7 O&M Testing and Automated Testing

3.7.8 System Administration Support

3.7.9 O&M Cost Reduction

3.8 IT Consulting Services and Subject Matter Expertise

3.8.1 MedDRA and VedDDRA Support

3.9 Innovation Services

3.9.1 Proof of Concept/Prototyping/Pilot Services

3.9.2 High Performance Computing (HPC)

3.9.3 HR, Budget, Financial, and Acquisition Innovation Services

3.9.4 FDA Innovation Lab Services

3.9.5 Emerging Technologies, Tools, Practices, Process and Techniques

3.9.6 Automation

3.9.7 Mobile Application Design, Development and Support

3.10 Artificial Intelligence/Machine Learning

3.10.1 Predictive Analytics and Modeling

3.10.2 Robotic Process Automation (RPA)

3.10.3 Intelligent Models

3.10.4 Automated Analytics

3.11 Cybersecurity Support Services

3.11.1 Zero Trust Support

3.11.2 Cybersecurity Tools Implementation and Maintenance Support

3.11.3 Cybersecurity Authorization Support Services

3.12 Testing and Independent Validation and Verification (IV&V) Support Services

3.12.1 Application Software Testing for IV&V

3.13 Quality Assurance

3.13.1 Quality Control Plan

3.13.2 Quality Assurance Surveillance Plan (QASP)

3.13.3 Performance Requirement Summary (PRS)

3.14 Strategic Planning

3.14.1 Organizational Assessment

3.14.2 New Business Model Development

3.14.3 IT Strategic Planning

3.15 Change Control and Release Management Support Services

3.16 Training Support Services

3.16.1 Training Maintenance

3.16.2 Training Redesign

3.17 Transition Activities

3.17.1 Transition-In

3.17.2 Transition-Out

3.18 Technical Support

3.19 System Disposition and Close out Services

3.20 Exclusion and out of scope from the BPA scope

4 Deliverables 5 Technology Standards, IT Constraints, and Guidelines

5.1 FDA Application Development Constraints and Assumptions

5.2 Software Development Lifecycle Standards

5.3 Personnel

5.4 Long Distance Travel

5.5 Training

6 Period of Performance 7 Ordering Terms and Procedures

7.1 Order Level Materials (OLM)

7.2 BPA Review

7.3 Limitation on Government’s Obligation

7.4 Contract Type/Labor Schedule

8 Place of Performance 9 Hours of Operation and Closings 10 Government-Furnished Information/Equipment (GFI/GFE) 11 Environmental 12 Organizational Conflict of Interest (COI) 13 Non-Personal Services 14 Security 15 Travel 16 FDA Security and Privacy Requirements

16.1 Inappropriate Use of FDA Systems

17 Attachments

1 General Information The Department of Health and Human Services (HHS) U.S. Food and Drug Administration (FDA) is looking to enter into Multiple-Award Blanket Purchase Agreements (BPAs) against General Services Administration (GSA) MAS Schedule 54151S Information Technology Professional Services, and/or 54151HEAL, and Order-Level Materials (OLM) with Contractors to obtain Information Technology Application development professional services. FDA will issue Task Order priced as firm fixed price, time and materials, labor hour type, or any combination thereof against this BPA, which will have a five (5) year period of performance. The list of acronym definitions used in this BPA Statement of Work is provided in Attachment 11 – FDA EAD SOW Acronym List.

1.1 FDA Background

The FDA, an agency within HHS, is responsible for protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and by ensuring the safety of our nation's food supply, cosmetics, and products that emit radiation. The FDA also has responsibility for regulating the manufacturing, marketing, and distribution of tobacco products to protect the public health and to reduce tobacco use by minors. The FDA is responsible for the oversight of more than $2.8 trillion in consumption of food, medical products, and tobacco. The FDA-regulated products account for about 20 cents of every dollar spent by U.S. consumers and regulates about 78 percent of the U.S. food supply. The FDA is responsible for advancing the public health by helping to speed innovations that make medical products more effective, safer, and more affordable and by helping the public get the accurate, science-based information they need to use medical products and foods to maintain and improve their health.

The FDA also plays a significant role in the Nation's counter terrorism capability. The FDA fulfills this responsibility by ensuring the security of the food supply and by fostering development of medical products to respond to deliberate and naturally emerging public health threats.

The 21st Century Cures Act (Cures Act), signed into law on December 13, 2016, is designed to help accelerate medical product development and bring new innovations and advances to patients who need them faster and more efficiently. The law builds on FDA's ongoing work to incorporate the perspectives of patients into the development of drugs, biological products, and devices in FDA's decision-making process. The Cures Act authorized $500 million over 9 years to help FDA cover the cost of implementing the law.

The FDA is composed of multiple Centers and Offices. Each Center/Office at FDA has a specific mission and the Information Technology (IT) systems strategically and efficiently support each Center's and Office's mission critical work. The FDA CIO’s office, The Office of Digital Transformation (ODT), scope of responsibility includes providing support for IT to support the FDA mission and Business that includes modernization, strategic, governance, operational, and oversight of enterprise IT landscape. In the execution of these responsibilities, the ODT supports the agency’s mission and executes planned and unplanned priorities and to achieve goals outlined in the FDA Modernization Action Plans (e.g. Technology Modernization Action Plan (TMAP), Data Modernization Action Plan (DMAP), Enterprise

Modernization Action Plan, Leadership Modernization Action Plan, and Cybersecurity Modernization Action Plan (CMAP) etc. see https://www.fda.gov/about-fda/office-digital-transformation/odt-reports. The FDA Chief Information Officer (CIO) released FDA IT Strategic plan in 2023 https://www.fda.gov/about-fda/office-digital-transformation/fda-information-technology-strategy-fy-2024-fy-2027 and the FDA Information Technology (IT) Operating Plan. The FDA has adopted the Technology Business Management (TBM) model aligned to FDA’s digital information strategy. TBM information is provided in Attachment 1

– TBM Layers and Diagrams.

The FDA CIO established the following goals and objectives to expedite digital modernization:

1) Create a shared OneFDA ecosystem

2) Strengthen IT Infrastructure

3) Modernize Enterprise Services and Capabilities

4) Share Data for Mission Outcome

5) Adopt AI and Mission-Driven Innovations

6) Cultivate Talent and Leadership

The purpose of this FDA Enterprise IT Application Development BPA is to establish an enterprise-wide contracting vehicle for modernizing the FDA IT landscape and implement the OneFDA goal along with other goals listed above. This BPA is being structured such that Full Time Employees (FTEs) and Contractor resources are interactive, collaborative, multi-functional, agile, and scalable. The IT systems developed under this BPA will strategically and efficiently support each Center's and Office's mission critical work.

2 BPA Objectives Through this BPA, the Government seeks to achieve the following objectives:

1) Establish a strategic acquisition vehicle used for all IT application development across

FDA.

2) Establish centralized governance and oversight to meet the HHS and FDA CIO Information Technology Acquisition Review (ITAR) and Federal Information Technology Acquisitions and Reform Act (FITARA) objectives.

3) Accelerate and support Business process transformation to develop/implement innovative enterprise business solutions to achieve OneFDA vision.

4) Improve compliance with OMB directive of Category management and Spend Under Management initiative.

5) Improve alignment with OMB directive of enterprise architecture.

6) Improve Socio-economic goals alignments.

7) Improve efficiencies and cost reduction through economies of scale.

8) Reduce the overall Operations and Maintenance (O&M) expenditures by an average of

5% via improved efficiency and innovation each year during the life of the contract.

9) Establish enterprise IT development standards, tools, technologies, processes, deployment, and reports to control siloed development and practices.

10) Deploy cutting edge technology, solutions, and services to improve efficiencies and user experience.

https://www.fda.gov/about-fda/office-digital-transformation/odt-reports https://www.fda.gov/about-fda/office-digital-transformation/odt-reports https://www.fda.gov/about-fda/office-digital-transformation/fda-information-technology-strategy-fy-2024-fy-2027 https://www.fda.gov/about-fda/office-digital-transformation/fda-information-technology-strategy-fy-2024-fy-2027 https://www.fda.gov/media/177127/download?attachment https://www.fda.gov/media/177127/download?attachment

11) Accelerate implementation of hybrid Cloud-based systems and solutions.

12) Enhancement of system integration, consolidation, standardization, usability, and data flow to down-stream systems enabling the FDA to utilize resources, processes, and systems to achieve a seamless integration of FDA projects.

13) Obtain services to develop, integrate, consolidate, and maintain enterprise solution for the financial management, Human resource management, acquisition management, businesses processes, and customer services using innovative technology, project management, administration, and change management techniques.

14) Increase access to resources that are trained and equipped to guide the appropriate application of tools and techniques to assist FDA leadership in more effectively and efficiently completing high profile projects, managing programs, and improving the culture of the teams.

15) Increase use of evidence-based, data-driven, and risk-based decision making, including facts and benchmarks to scope the opportunity and measure results.

2.1 BPA Purpose/Goals

The purpose of this BPA is to establish an enterprise-wide contracting vehicle for modernizing IT systems. The major goals are:

• Expand sharing of FDA-wide buying data, leading to better-informed business decisions.

• Maximize FDA’s shared purchasing power, allowing FDA to leverage volume discounts.

• Help FDA operate more efficiently by reducing administrative costs and contract duplication.

This BPA will encompass all IT development enterprise-wide and provide an acquisition vehicle to be used by all FDA Centers and Offices providing efficiencies for the Office of Grants and Acquisition Services (OAGS) within the FDA thus resulting in cost savings from fees resulting from using other Agency's vehicles. The Enterprise IT BPA will provide Lifecycle Development and Management Support for FDA IT Systems to acquire the full range of technical and management services to develop, maintain, and enhance existing and future FDA IT systems to fulfill the mission of the FDA Centers and Offices.

2.2 BPA Governance

Contractor personnel shall properly notify and obtain approval from the BPA Government Contracting Officer (CO) and the BPA Contracting Officer’s Representative (COR) regarding contractual and administrative processes, procedures, policies, formats, briefings, vendor management, and enterprise architecture matters. Contractor personnel shall seek technical guidance and direction from his/her assigned BPA Order COR and Technical lead, regarding daily operations (i.e. Task Areas).

3 BPA Scope

The scope of this contract is to acquire the full range of business transformation, technical, and management services necessary to develop, maintain and enhance existing and to-be-determined FDA IT solutions in support of all FDA programs. The scope of work includes providing support to the business transformation initiatives as key change management strategies aimed to OneFDA vision to align People, Process and Technology of the FDA business and user communities to be more closely linked with the strategy and vision for protecting the public health of the nation. Contractors under this BPA will provide IT application development services support to all Centers and Offices within the FDA and support of the regulatory and public health goals and objectives of each Center/Office.

The Contractor shall work within established FDA guidelines, constraints, and standards.

Please refer to Attachment 2 – Application Development Standards and Attachment 8 – FDA Application Development Constraints and Assumptions and other attachments. The FDA list of Technologies is provided in Attachment 5. All applicable software activities performed under this contract shall be in accordance with FDA’s EPLC policies, processes, and templates, which includes agile methodologies. An explanation of the FDA’s implementation of the EPLC can be found in Attachment 3– EPLC Agile Methodology Overview for Contractors. The standard language shall be applicable for all Orders against this BPA as per Attachment 10 – FDA Standard Language for IT Procurements. The Prime Contractors shall be Capability Maturity Model Integration (CMMI) CMMI-DEV (Development) V3.0 and/or CMMI-SVC (Services) V3.0 Maturity Level 3 Certified for this

BPA.

Under this BPA, FDA will issue individual Call Orders to provide IT Application Development Lifecycle Support for the FDA IT portfolio of systems. Representative tasks to be performed by the Contractor for awarded Orders are included in the following task areas below:

3.1 Program, Project, and Contract Management

The Contractor shall support the program and project level management and administrative services necessary to support the execution of the Contractor’s approach to the technical activities performed under the contract and to report status to the COR or COR designee.

Program Management and Project Management support include the effort to plan, structure, coordinate, schedule, manage, communicate, report, and steward all respective work activities throughout the BPA period of performance as per FDA EPLC and PMBOK best practices. The Contractor shall work with the BPA Contracting Officer (CO), Contract Specialist (CS), and the BPA COR to establish governance, oversight, tracking, and reporting mechanism at the BPA level for standard processes, reporting, formats, and policies across all the Orders to ensure compliance with enterprise IT strategic plan, enterprise architecture, FDA Vendor Management Program, TBM, project intake processes, CPIC, software licensing, Cloud standardization, and security and also to ensure that tasks stay on track and that milestones are met as per respective orders issued against the BPA. The Contractor shall use enterprise tools and systems for tracking, monitoring, and reporting as directed by BPA

COR.

3.1.1 Program Management

At the BPA-level, the Contractor is required to provide Program Management, to include but not limited to:

• The management approach, organizational structure, organizational resources, management controls, and reporting to be used to meet the BPA requirements throughout the BPA ordering period.

• Standard processes, reporting, briefing, formats, tools, and policies across all Orders

• Support FDA Vendor Management program and reporting

• Provide BPA level program plan, risks/issues, communication plan, QASP, release plans, financial etc.

3.1.2 Program and Project Management Support

For the Orders released under this contract, the Contractor shall provide Order level program management to establish control, management, monitoring and notification mechanisms across the projects within the program to ensure the individual Orders stay on track to meet the important milestones and performance measures within the awarded task.

3.1.2.1 Project Management Plan

The Contractor shall create a Project Management Plan for each Task Order, update as necessary and provide the Project Management Plan 30 calendar days after the award.

The Software Development Plan provides the technical approach to software development and shall be followed throughout the contract. Any deviations from the Project Management Plan must be approved by the COR. The Contractor shall ensure all staff are trained to follow the plan. The Contractor may propose updates to the plan at any time, and any changes shall be implemented upon approval of the COR.

3.1.3 Risk Management

The Contractor shall identify and report for resolution to the Government any risks/issues that prevent the Contractor from performing the work activities at BPA level and in any individual BPA order. The Contractor shall document and report the risks and opportunities within a risk registry and risk management plan.

3.1.4 Quality Assurance Plan

The Contractor shall create a Quality Assurance Plan (QAP) per each Task Order, update as necessary and provide the Quality Assurance Plan 30 calendar days after the award.

The Contractor shall implement the activities necessary to ensure deliverables and other work products meet the quality standards. At the BPA level, the Contractor shall establish standards, processes, and procedures for Quality Assurance and coordinate quality activities across the BPA.

3.1.5 Governance Operations and Program Management Support

The Contractor shall support and coordinate overall operations of business process governance to ensure there are processes, policies, and overall governance to address gaps and measure progress of governance implementation. The Contractor shall support but not limited to reviews of new requests, portfolio operations, board meetings, and program management operations and support running large, strategic initiatives.

3.1.6 Testing

The Contractor shall support new development, customization, and enhancements, by planning and executing formal testing activities required by FDA’s EPLC. The Contractor shall ensure that testing is designed and executed to confirm that the code developed meets requirement and design specifications. Representative activities include, but are not limited to:

• Develop test plans (to include test strategy, test environments, test scenarios, and test cases) and test procedures/scripts.

• Document test results of all categories of testing

• Ensure scripts meet requirements of Section 508

• Document results from performing security, backup and recovery, and technical performance testing.

• Develop, conduct, and support automated testing.

• Document results of UAT, smoke testing, unit testing, load testing

• Conduct technical system testing to verify that technical parameters are met create a

QASP per each Task Order, update as necessary and provide.

3.1.7 Develop and Document Program Level Technical Standards and Methods In addition to project planning, the Contractor shall assist in developing, implementing and maintaining technical standards and methodologies to support FDA Program level management oversight at BPA level. IT Standards applicable to the projects include adherence to the FDA’s EPLC, congruence with emerging standards, applicable federal security and privacy regulations and directives, compliance with emerging data standards, and other capital investment management and reporting requirements. Program level standards and methods include but not limited to:

• Change Management.

• Integrated Scheduling, Service and Investment Roadmaps.

• Program Artifact Configuration Management.

• Service Oriented Architecture and Target State Architecture

• Application development standards

• Code review standards

• Cloud services and FinOps.

• Mobile Computing.

• Traceability to cost modeling and fee for service.

• Other Program Level standards and methodologies as adopted by FDA

3.1.8 Documentation

The Contractor shall use FDA supplied templates which will be provided on each individual Order as applicable. If an FDA template does not exist, the Contractor may be tasked with drafting a template for approval by the BPA COR. The Contractor shall maintain all the contract documents on specific FDA collaboration tools as directed by the BPA COR.

3.1.9 Data Calls

The Contractor shall respond to data calls that may originate from FDA, HHS, OMB, Government Accountability Office (GAO) and others as directed by the BPA COR and Order COR. Data Calls have varying complexity, from one-page answers to a single question to 25+ page complex spreadsheets.

3.1.10 Business Analysis Support

The Contractor shall determine and document the end state of the user systems and will use it as the guide for all efforts. This end state shall be aligned with FDA enterprise policies, guidance, and initiatives. The Contractor shall collect, document, and validate the business, user and system requirements and manage the requirements throughout the Period of Performance of the Orders. The Contractor shall work with the FDA project teams and project stakeholders in order to obtain these requirements. The requirements shall be considered validated only upon approval by the COR, or designed COR.

3.2 Business Process Engineering

For the Orders released under this contract, the Contractor shall provide Order level business process reengineering/engineering (BPR) support to analyze workflows and processes within and between business functions in order to optimize the end-to-end business processes and eliminate redundant tasks and improve performance of overall processes. The Contractor shall employ the use of IT to automate and integrate processes that are identified to be reengineered using the following processes:

• Process Discovery: Discovery and documentation of existing processes using process mining tools.

• Process Validation: Validate To-Be processes with stakeholders ensuring accuracy, efficiency, and viability.

• Process Modeling: Leveraging BPMN 2.0 framework to define the processes accurately representing the sequence of activities, rules, data and events.

• Process automation: Design develop to-be processes

• Service catalog integration: Work closely with the larger team to ensure alignment with the TBM model, map processes back into the service catalog, ensure seamless integration of the automated processes into the service catalog.

3.2.1 Business Process Modeling

The Contractor shall provide support for optimization of workflows by creation of data-driven visual representations of key business processes. Models shall be developed by identification of areas to model which require improvement, choosing a model type, documenting the steps and goals of the business process with the Order program, creation of the model, process design, execution/implementation of the model, optimization of the model, and monitoring.

3.2.1.1 As-Is and To-Be Business Processing Modeling

The Contractor shall provide the business models for the as-is processes and the to-be process models for analysis and decision making on the future implementation of business process models.

The Contractor shall provide As-is and To-be process maps, pictorial representations of the sequence of activities that comprise the process and provides the description of what activities are being performed, who (role based) does or is involved in the activity, which information is needed or produced (artifacts that are input or produced by the activity), where the activity is performed if applicable, when/ temporal aspects of the activity, decision points, and enabling technical system(s). The To-be process map, a pictorial representation of re-thinking / re-imagining that shall describe how the activities shall be performed and shall include the same general elements contained in the As-is process map. Additionally, measures shall be defined for inputs, process, outputs, technology, initial outcomes and public health outcomes for each core process.

3.2.1.2 Gap Analysis

The Contractor shall provide Gap Analysis support to assess the performance of current business processes (As-Is) by reviewing the current state with the ideal future state (To- Be) in order to determine how to reengineer processes to achieve future goals and outcomes. The Contractor shall perform Gap Analysis and shall include the following elements, at a minimum, unless otherwise specified in the individual Order: description of current state for each applicable subarea; description of the desired state; identification whether gaps exist between the current state and future state; description of the gap;

factors contributing to the gap; and specific potential actions to eliminate the gap; risk mitigation strategies to address risks that typically have impact on the achieving the desired state.

3.2.2 Business Process Transformation

The Contractor shall provide support for the business process transformation initiative of FDA to modernize, consolidate, and simplify current business processes and develop new human-centric designed enterprise business processes to bring efficiency and better user experience.

3.2.3 Organizational Change Management

The Contractor shall assist FDA with innovative change management procedures, tools, techniques, outreach, and meetings to create and sustain a culture of high-performance.

The Contractor shall support implementation of new processes, including documentation of desired to-be state to include impact analysis, development of tools and job aids to ensure consistent service delivery across FDA Centers and Offices. The Contractor shall research and recommend new tools or techniques that could be useful in meeting FDA’s mission and business needs.

3.2.4 Strategic Communication Support

The Contractor shall provide activities to support communication objectives, core messages, and target audiences, including:

• Develop a Communication Plan with anchored narrative for consistency (for internal and external stakeholders).

• Designing and implementing social media campaigns, emails, blogs, newsletters or video communications.

• Designing and implementing internet sites to support public educations and outreach activities.

3.2.5 Concept Development and Strategic Planning

The Contractor shall support business/IT concept development and strategic planning services that support FDA’s efforts to efficiently utilize resources, processes, and systems to achieve outcomes that advance FDA’s mission to protect and promote the public health. The Contractor shall identify strengths and weaknesses in the FDA’s strategic planning processes and help FDA to implement new efficient business/IT models and strategies.

3.2.6 Policy, Process and Procedure Improvements

The Contractor shall provide ongoing reviews of existing Business/IT policies, processes, and procedures to identify areas where improvements can be made as well as recommend changes that will benefit the quality, efficiency and/or effectiveness of the FDA’s processes/functions. The Contractor shall research, plan, collect, analyze, and make recommendations on possible changes to FDA Business/IT policies, processes, and procedures.

3.2.7 Business Tools Support

The Contractor shall provide business tool support to configure/leverage/maintain the features available for use in the product, whether acquired in house or commercially (e.g COTS products) and enhance the presentation layer of a product that is in use at FDA for business processes.

3.3 Enterprise Architecture Services

Enterprise architecture is vital in guiding digital transformation efforts within FDA. It provides a detailed overview of the internal systems, processes, and data flows, enabling Centers/Offices to identify improvement areas and innovation opportunities.

3.3.1 Enterprise Architecture Activities

The Contractor shall provide the full range of enterprise architecture support services in order to formulate the integrated, end-to-end automated systems that provide enhanced IT capabilities necessary to support FDA business and mission processes and mandates of Office of Management and Budget (OMB), Health and Human Services (HHS) and General Accountability Office (GAO).

The EA activities include but are not limited to:

• EA Program Planning

• Current State (a.k.a. “As-is”) Architecture Modeling

• Current State Architecture Reporting

• IT System Roadmaps

• Reference Architectures

• Target Architecture

3.3.2 Chief Technology Officer (CTO) Support

A mission priority for the CTO (Chief Technology Officer) is to examine and employ pioneering concepts, tools and technologies to support the Agency’s mission of promoting and protecting America’s public health and to achieve goals outlined in the FDA’s Technology Action Plans (e.g. Technology Modernization Action Plan, Data Modernization Action Plan, Enterprise Modernization Action Plan, etc.)

The CTO is frequently asked to assist Centers and Agency leadership (CIO, Principal Deputy, Chief Scientist, Commissioner etc.) by providing IT related consulting on business needs, plans and challenges and how IT solutions and FDA’s web and cloud-based IT systems can support and solve these needs, plans and challenges. The Contractor shall support activities such as requirements gathering, analysis, market research, subject-matter consulting, planning, estimating, creation of plans and presentations or other deliverables that the CIO will use to advise leadership or business stakeholders.

3.3.3 Solution Architecture (SA) Support

The Contractor shall create technology strategies and roadmaps for a variety of IT priority areas for the FDA, provide recommendations for technology modernization based on business and IT Strategies. The Contractors shall develop roadmaps for multi-year strategic plans and whitepapers with salient characteristics and considerations for recommended/preferred solutions. The Contractor shall implement and support FDA Enterprise Architecture Support Tools to include deployment and configuration of the tool, integration with other applications such as ServiceNow, and provide administration, operations and maintenance of the new tool.

3.3.4 Business Continuity and Recovery (BCAR)

The Contractor shall provide Business Continuity and Recovery (BCAR) support with Disaster Recovery (DR), COOP planning, and infrastructure operations and transformation experience to help define the strategies, plan and action items the BCAR Team will work on with the center business to enhance the posture.

3.4 Development, Modernization and Enhancements (DME) Support Development, Modernization & Enhancement (DME) includes projects and activities leading to new IT assets/systems, as well as projects and activities that change or modify existing IT assets to substantively improve capability or performance, implement legislative or regulatory requirements, or meet an agency leadership request. DME activity may occur at any time during a program’s life cycle. DME includes introduction of new or modified functionality or scope that requires the re-engineering and/or enhancement of an existing system, the re-platforming of a system to a new technical architecture, or the development of a new system.

3.4.1 Development, Modernization and Enhancements (DME) Lifecycle Support

The Contractor shall provide a complete range of system development, modernization and customization life-cycle support services necessary to develop, modernize and enhance

FDA systems, applications, or services using FDA approved software and hardware. See Attachment 2 - Application Development Standards, and Attachment 5 – FDA List of Technologies.

All IT solution development activities will be, at a minimum, in accordance with FDA’s EPLC policies, processes, and templates found in Attachment 3 - EPLC Agile Methodology Overview for Contractors. The activities will follow Agile methodologies based on the system being developed. The Contractor shall maintain the system documentation and expected to support and participate in the System Security Annual Review for the FDA system and maintain ATO for Systems.

The Contractor shall practice rigorous requirements management, project management, change control management and testing during DME efforts to ensure:

• Deployment of high-quality code that accurately meets the requirements.

• Successful automated releases without introduction of unexpected problems

• Minimal need for emergency/corrective maintenance

• Minimal need to fix the same issue multiple times

• Maximum value out of limited IT budget resources

3.4.2 IT Solution Support

The Contractor shall provide various levels of engineering, quality management, and investment management services to ensure a strategically planned and stable growth for the FDA services. Subject Matter Expertise requirements may span any FDA IT domain.

The Contractor shall provide assistance to the Government while working with other prime Contractors to ensure that computer software operated on behalf of the Government is fully functional and operates correctly on systems configured in accordance with government policy regarding configuration requirements.

3.4.3 Requirements Analysis Phase Support

The Contractor shall provide requirements elicitation by gathering, identifying, and documenting the FDA’s business and functional requirements necessary to enhance and configure the tasks delineated in each BPA Order.

3.4.4 Design Phase Support

The Contractor shall design IT solutions based on the System Requirements Specification (SRS) detailed in the requirements analysis phase.

The Contractor shall develop System Design Documentation to document all design configurations developed for each system release.

3.4.5 Development Phase Support

The Contractor shall develop and enhance FDA IT systems and tools as well as their external interfaces to FDA Enterprise and Center Systems and applications. The Contractor shall develop, support and evolve designs, customizations and process automation such as interfaces, templates, scripts, workflows, interfaces to permit reviewer access to analytics/tools, and reports. The Contractor shall ensure all software developed shall maintain existing database integrity, error handling, and graceful termination of execution for unexpected problems and not adversely impact other applications running in the production environment. The Contractor shall ensure deliverable products shall be validated and tested to ensure that they meet applicable/specified standards, policy, business requirements. The Contractor shall support the development of all application system and module configurations, scripts, code, and other EPLC deliverables required by the EPLC phase.

3.4.6 Configuration and Change Management Support

The Contractor shall oversee performance of Configuration Management (CM) and Change Management to establish and maintain the integrity of Application Change Requests (CRs) throughout the Application software development lifecycle. The Contractor shall identify and manage system baselines and identifying CRs for application releases. The Contractor shall ensure system customizations and configuration is compatible with and supports future software maintenance patches and upgrades. Coordinate release deployment with application development and infrastructure teams to reduce risks to FDA and Application users, such as scheduling Application releases around FDA data center maintenance patching weekends to avoid deployment risks, and document release notes to communicate to application users the scope and impacts of new releases. The Contractor shall identify release scope and coordinate with application development team to ensure compliance with the IMS and document CRs to be included in application releases in JIRA.

3.4.7 Human Centered Design

The Contractor shall provide effective design solutions that provides an approach to creating an engineered framework that develops a solution to a problem/application involving the human perspective.

3.4.8 Database Design and Architecture

The Contractor shall provide develop and implement database designs and architectures.

The architecture will dictate how data is stored, organized, and retrieved and will be an efficient and effective solution. The Contractor shall follow a structured approach to architecture and development of the database, develop the conceptual vs. Logical vs.

Physical Entity Relationship diagrams.

3.4.9 Lean Product Management and Development

The Contractor shall provide application solutions that minimize waste and optimize efficiency at every stage in the development process, and delivering value, and providing continuous improvement for the development. The Contractor shall utilize low-code or no-code platforms and architecture.

3.4.10 COTS Configuration and System Development Support

The Contractor shall provide support for the installation and configuration of all software used in the supported FDA systems to include Government Off the Shelf (GOTS), Commercial of the Shelf (COTS), Libraries and Tool Configuration, Development and Administration Support. The Contractor shall use COTS and/or GOTS products over developing IT solutions inhouse as much as possible. The Contractor shall be responsible for providing staff with the necessary level of expertise regarding the different programming languages and software used by the systems. FDA’s objective is to ensure its systems are secure and maintainable.

The Contractor shall conduct the following activities:

• Perform cost benefit analysis and/or alternatives analysis for moving on-premise COTS/GOTS/applications, software, or systems to the cloud.

• Installation of cloud COTS/GOTS/applications or systems to include configuration, migration, and support for the COTS/GOTS/applications, software, or systems migrated to the cloud.

• Establish and implement standards for the selection, configuration, and usage of software products in the supported FDA systems.

• Work with the data center staff and other Contractor support personnel to perform the activities needed to ensure the software and tools function as intended and that system performance is maintained or improved during the period of performance.

• Establish and implement standards for the selection, configuration, and usage of software products in the supported FDA systems.

• Develop and implement a plan to upgrade the FDA applications as needed to support the currently approved versions of supported software. This includes regular upgrades to core COTS, such as ORACLE databases. FDA requires all systems to upgrade when needed to maintain vendor support and meet security requirements.

• Provide recommendations for upgrades and replacements to older technology and implement the approved updates. FDA expects that all systems will be updated to keep technology up-to-date and to meet security requirements. This includes versions of software languages and libraries used by the systems, and any system changes necessary to maintain functionality after the upgrade. The Contractor shall maintain systems to the latest or N-1 version of the software.

3.4.11 Infrastructure Modernization Support

The Contractor shall provide various levels of engineering, quality management, and infrastructure modernization support services for FDA applications, systems and tools.

The Contractor shall support the FDA cybersecurity program by assisting in preventing, detecting, and mitigating external and internal cyber threats, vulnerabilities, and risks to the FDA networks, systems and applications to ensure confidentiality, integrity, and availability to FDA.

The Contractor shall work in conjunction with the FDA Data Center Contractor to design, deploy, and configure new solutions that will be deployed in the FDA Data Centers, or throughout the FDA Enterprise Network. The Contractor shall be responsible for all new Data Center/Enterprise solutions deployed and shall provide documentation for the transition to the Data Center Contractor using the transition documents provided for the

Orders. The Contractor shall design, engineer, develop deployment configurations, and assist in the installation and provisioning of FDA networks and systems.

While individual orders will detail specific requirements, the representative tasks shall include but are not limited to:

• Provide technical recommendation for enterprise compute and storage enhancements based upon documentation provided by FDA to support various application workloads that are supported by FDA infrastructure.

• Provide design and engineering best practices for authentication (PKI, SAML, AD, etc.) API management, microservices deployment for new applications

• Design, engineer, develop deployment configurations, and assist in the installation and provisioning of any new VOIP software and hardware components and Unified Communication (UC) software located within the FDA MAN and all FDA field locations. The Contractor will provide research, engineering, and architecture best practices for potential new/fundamental alterations to the UC solutions and VOIP within FDA as directed by the identified FDA FTE resource.

• Design, engineer, develop deployment configurations, and assist in the installation and provisioning of any new Local Area Network (LAN), Wide Area Network (WAN), and Metro Area Network (MAN) components (e.g. routers, switches, WAN accelerators, access points, Network Access Control (NAC) devices, repeaters, Wireless Intrusion Detection System (WIDS)/ Wireless Intrusion Prevention System (WIPS) sensors, NAC sensors, firewalls, Identity Service Engine (ISE) appliances) to be deployed within the FDA MAN and all FDA field locations (including international sites)

• Design, engineer, develop deployment configurations, and assist in the installation and provisioning of any new WLAN infrastructure components (e.g. access points, repeaters, controllers, switches, WIDS/WIPS sensors).

• Design, engineer, develop deployment configurations, and assist in the installation and provisioning of any new network components (e.g. core backbone, distribution, access layer devices, load balancers, routers, switches, WAN accelerators, VPN concentrators, access points, Network Access Control (NAC) devices, repeaters, Dense Wave Division Multiplexing (DWDM), and WIDS/ WIPSsensors)

• Provide technical recommendation for enterprise network enhancements based upon documentation provided by FDA, which would include traffic flow diagrams, design diagrams, closet layout diagrams, spare part inventories, network topology diagrams that depict layer 2 and layer 3 switching, layer 3 diagrams that illustrate routing protocols, Open Shortest Path First (OSPF) area boundaries, Border Gateway Protocol (BGP) autonomous systems, Virtual Route Forward (VRF) and other layer 3 routing configurations, layer 2 diagrams illustrating LAN and Virtual Local Area Network (VLAN) trunks, Spanning Tree, Root Bridge Assignment, Hot Stand-by Routing Protocol (HSRP) Primary/Secondary Configurations and any other layer 2 link state configurations.

• The Contractor shall provide analysis of alternatives documentation and support as directed by the COR on each individual Order.

3.4.12 Testing and Automated Testing Support

The Contractor shall provide testing by performing the following:

• Performing unit, system, regression, smoke, performance and integration testing of the applications, tools, automated workflows and interfaces in compliance with the Master Test Plan.

• Facilitating and coordinate user acceptance testing.

• Conducting performance/stress testing.

• Conducting 508 compliance and requirements testing.

• Testing the applications after each data center migration, outage, maintenance for operating system upgrades, system upgrades, database upgrades, etc. to ensure the application is operational before business hours begin.

• Development of Automated testing scripts and performing automated testing

• Configuration and setting up automated testing tools and scripts and reporting results

3.4.13 Systems Integration and Engineering Services

The Contractor shall provide integration and systems engineering services. The Contractor shall focus on the development and deployment of integrated information systems that reflect the introduction of a SOA orientation using DevSecOps, CaaS/Docker, Cloud, CI/CD, and/or microservices; and, moreover, places an emphasis on the recommended acquisition and re-use of existing components—be they FDA components, HHS components, or components acquired from any other source.

• The Contractor shall support Containers-as-a-Service (CaaS) environments to include managing and deployment of containerized applications and clusters, including Docker platform containers.

• The Contractor shall upgrade and patch the CaaS ecosystem technologies to latest versions approved by the FDA PM and COR and in compliance with FDA security requirements.

• The Contractor shall provide high availability and scalability to support the current and projected number of FDA applications using containers and their workloads.

Perform capacity planning and analysis to determine the compute and storage requirements for application workloads in the pipeline. The capacity planning shall factor in the large number of applications seeking to use containers to move to the cloud.

• The Contract shall coordinate data sharing and reuse efforts with enterprise system/application owners and/or other Contractors.

3.4.14 CaaS Infrastructure Support

The Contractor shall provide support for the CaaS enterprise infrastructure/architecture that spans across FDA’s on-premise and cloud environments by performing the following activities:

• Maintain the FDA CaaS infrastructure/architecture to ensure it is designed and implemented.

• Provide high availability and scalability to support the current and projected number of FDA applications using containers and their workloads. Perform capacity planning and analysis to determine the compute and storage requirements for application workloads in the pipeline. The capacity planning shall factor in the large number of applications seeking to use containers to move to the cloud.

• Satisfy FDA, security, and cloud governance policies, rules, and requirements. Ensure container security and integrity across CaaS on-premise and cloud environments.

When necessary, leverage third party tools and/or AWS native products to enforce security policies throughout the container delivery chain.

• Integrate seamlessly with third party CaaS monitoring, logging, security, networking and volume/storage management technologies and tools. Automate the promotion/duplication/mirroring of container images, deployment artifacts, and source code across CaaS environments.

• Upgrade and patch the CaaS ecosystem technologies to latest versions approved by the FDA PM and COR and in compliance with FDA security requirements.

3.4.15 Development/Security/Operations (DevSecOps) Engineering Support

The Contractor shall engineer, update, and transition a DevSecOps Pipeline…