Attachment J-001-A - Senate Web Development Guide.pdf

Senate Web Development Guide

Contents

Purpose of this Guide Compliance and Future Updates Content Management System Base Builds SAA Requirements Approved CMS Plugins Custom Code Capture of External IP Addresses Launching a Senate Website Website User Accounts User Data Collection Website Analytics Social Media Integration Responsibilities

Purpose of this Guide

This document provides an overview of the Senate environment, a description of available/permitted resources, and guidelines for the successful creation and launch of contractually compliant, high-quality Senate websites.

The content of this document, in its entirety, will be accessible to awarded Contractors on an internal SAA site. Awarded Contractors shall only refer to the internal SAA site for development guidelines and no longer refer to this document.

Compliance and Future Updates

The requirements herein are subject to revision post-award. Awarded Contractors will be provided with a link to an internal SAA site that hosts the most current requirements.

Although the SAA will make every effort to inform the Contractors of significant changes, it is exclusively the Contractor’s responsibility to review the latest requirements, particularly when submitting a proposal for a task order, as well as during the website design and development engagement.

Contractors must refer and adhere to the most current guidelines when executing any labor for a Senate website.

Content Management System Base Builds

Upon Contractor request, the SAA will provide WordPress development/testing and production sites that include approved plugins, and other configurations required to build a Senate website.

SAA Requirements

Approved CMS Plugins

The provided CMS is pre-configured with all plugins approved for use in the Senate. All functionality for the Senate website must be provided using the following approved plugins:

The SAA will purchase and maintain licenses for paid versions of plugins; thus, Contractors should never charge an office for the development or use of a plugin. Contractors must use SAA-provided plugin licenses for websites hosted on the Senate network.

Additional plugins may be recommended to the SAA for an evaluation and security review of the plugin.

Depending on the nature and complexity of the recommended plugin, the SAA may require up to six months to complete the review and render a final decision.

The SAA will update plugins for Senate office websites regularly and will continuously monitor for security concerns. Out-of-cycle updates will be applied as needed.

Custom Code

Custom code can only be used when a function cannot already be performed by WordPress or an approved plugin. Custom code can only be done using child themes.

Contractors must provide a justification to the SAA explaining the specific functionality that cannot be performed by WordPress or approved plugins. The SAA will review the request and, if approved, the SAA will inform the office of the implications of using custom code. Any custom code written must have in-line documentation.

All coding used in website design should conform with Open Worldwide Application Security Project (OWASP) coding practices. The contractor should be aware and take steps to address the issues detailed in the OWASP Top 10. The contractor shall be responsible for remediation of any identified security flaws and the timeline for resolving issues will be based on the criticality as defined in by the U.S. Sergeant at Arms SOPS for Cybersecurity.

Contractors are prohibited from embedding any code, widget, JavaScript, API call, etc. from any third-party platforms. Additionally, iFrames to servers or websites outside of the Senate network are not allowed and cannot be used on Senate websites.

Capture of External IP Addresses

The constituent external IP address must be included in every web form submission. SAA will add the Akamai (CDN) True-Client IP code (see below) to the base WordPress templates. Note: the Contact Form 7 WordPress Plugin has been tested utilizing the following tag <IP>remote-ip</IP>. When using an alternative web form plugin/module, Contractors will be required to utilize the remote-ip tag and test the output in conjunction with EPS. Contractors must schedule a test with EPS within 3 days of website launch. The test will consist of EPS submitting an entry for every web form on the site. The Contractor will need to send EPS a copy of the submission for EPS verification of external IP address capture.

if (!empty($_SERVER ['HTTP_TRUE_CLIENT_IP'])) {

$_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_TRUE_CLIENT_IP"];

Launching a Senate Website

Contractors must submit a request to launch a Senate website. An email request must be sent to the SAA at least two weeks prior to the requested launch date to ensure the SAA has time to perform backend functions.

1. Any development must take place within the Senate environment. The site needs to be functionally operational on the development/testing tier at least one week prior to the requested launch date.

2. Content additions on the development/testing tier site will be locked down 24 hours prior to launch and can no longer be changed until after the site is launched. If changes need to be done to resolve issues the launch day will be postponed accordingly.

3. Forty-eight (48) hours prior to launch, the SAA will begin testing deployment to the production environment and the Contractor will be responsible to resolve any issues immediately in order to keep the launch schedule.

4. The production site will be visible inside the Senate & via VPN for the office’s final review.

5. Once the office signs off on the site, it will be made live externally to the general public.

6. Once the site is made live externally, the Contractor must conduct coordinated testing of each web form submission with: 1) the office for mail sent directly to an office mailbox, and 2) with the CSS Contractor for mail delivered directly to the office CSS application. In order simulate an actual constituent web form submission, the tester conducting the test must be off the Senate network/

VPN.

7. The Senate will not launch a site the day before a weekend or federal holiday.

Website User Accounts

When the Contractor creates production website user accounts for the office, the Contractor is responsible for creating the same accounts in the testing environment as well. This is to prevent the user accounts from being overwritten in the database each time the Contractor migrates data between the development/testing and the production tier.

NOTE: The Senate SMW account must remain on all Senate development/testing & production websites for website maintenance and security.

User Data Collection

All website correspondence form data must be transmitted via secure email to either a specified Office recipient or the Office’s constituent service system (“CSS”). Task Order proposal requests (“TOPRs”) will include relevant documentation when integration with the Office’s CSS is required. Contractors are forbidden from transmitting or capturing any information about website users in any other manner.

For security reasons and to prevent caching of Personally Identifiable Information (PII), Contractors are NOT to create preview/printable options for submission forms. Forms cannot be saved to the database or as a temp file with a GET command since the Senate’s CDN (Akamai) caches GET unique URI’s which could be exposed to subsequent users of the web form.

All web forms must include CAPTCHA.

Website Analytics

Adobe Analytics is the only approved Senate analytics tool and required for all Senate websites. Adobe Analytics provides detailed tracking of website statistics, by excluding search engines, web crawlers, and other robot traffic. This is accomplished by including unique JavaScript tagging code on each page of the website content, typically in the footer or near the bottom of each page. The JavaScript tagging code will be supplied by the SAA to each Contractor, office or committee.

Social Media Integration

Privacy Concerns

All postings to the Senate web site must abide by the U.S. Senate Internet Services Usage Rules and Policies, https://www.Senate.gov/usage/internetpolicy.htm, adopted by the Committee on Rules and Administration, all postings to the Senate web site must abide by the Senate Privacy Policy, https://www.senate.gov/general/privacy.htm.

It is critical that a user’s privacy is never compromised as a result of interacting with a Senate website. To protect constituent privacy and prevent them from being the targets of political advertising, Contractors shall not embed any code, widget, iFrame, JavaScript, API call, etc. from any unapproved third-party platforms.

In addition, Contractors shall not embed links to unapproved Office social media sites or other unapproved websites that might track or collect data from constituents. Offices should not promote any “official” social media accounts they have established on unapproved third-party social media platforms.

The SAA has specific arrangements in place with certain social media platforms under which these platforms have agreed not to track Senate.gov visitors or any users who have arrived on their platform from a Senate.gov website.

Approved social media platforms

At the time of this guide’s publication, the approved social media platforms are:

1. Instagram

2. LinkedIn

3. YouTube

4. Facebook

5. Scribd

6. X

7. Eventbrite

Requesting other integrations

While a Contractor should never recommend to Offices that they integrate with or promote an unapproved social media network, occasionally an Office may request such an integration themselves. In such a case, Contractors should ask the Office to contact the COR and describe the integration they desire. The COR will consider the request in consultation with the Rules Committee and decide whether or not to issue a one-time dispensation for that Office’s specific use-case. The COR will inform the Contractor and the Office of the final decision.

https://www.senate.gov/usage/internetpolicy.htm https://www.senate.gov/usage/internetpolicy.htm https://www.senate.gov/usage/internetpolicy.htm https://www.senate.gov/general/privacy.htm https://www.senate.gov/general/privacy.htm https://www.senate.gov/general/privacy.htm https://www.senate.gov/general/privacy.htm

Note: Approval to implement an unapproved social media platform for a single Office use case shall not be misconstrued as permission to install the unapproved feature in the future. Each Office request must receive approval before Contractors may install the feature on a new website.

Responsibilities

Senate Contractors: Design, development, and support activities as listed under the respective contract.

SAA: Backend maintenance, core, and plugin/module updates are to be performed only by the SAA.

Senate Offices: All content production and modifications will be the responsibility of the Senate office/committee personnel.

Responsibilities