1b_SOW_7-1-15.docx

Pay.Gov Application Programming and Analytical Services April 24, 2014

PERFORMANCE-BASED STATEMENT OF WORK

Pay.Gov Application Programming and Analytical Services

1.0 BACKGROUND

The Bureau of Engraving & Printing (Bureau/BEP) is the largest producer of security documents in the United States. The BEP prints billions of Federal Reserve notes for delivery to the Federal Reserve System each year. These notes are produced at the Bureau’s Washington, DC and Fort Worth, Texas manufacturing facilities. In addition to U.S. currency, the BEP produces several other security documents such as portions of the U.S. Passports, materials for Homeland Security, military identification cards and Immigration and Naturalization certificates.

The Bureau CIO Directorate provides management support for all of the automated systems required to support the Bureau’s manufacturing operations and the activities that support them. These systems include enterprise-wide financial management, manufacturing, and production support systems, as well as, localized systems that relates to or support the Bureau’s operations.

1.1 OBJECTIVES

This SOW identifies specific IT services and the associated level of these services, the contractor will be required to provide, to support the Bureau’s current and future use of the Pay.Gov credit card Transactions processing system used by BEP’s eCommerce website. Bureau’s eCommerce website, launched in November 30, 2009 uses Network Solutions Pay.gov payment gateway. Network Solutions introduced Pay.gov payment gateway in their release 7.8 on October 22, 2009.

Pay.gov is a secure government-wide collection portal. The Pay.gov Payment Gateway allows government agencies to collect payments over the internet. The application is web based allowing customers to access their accounts from any computer with Internet access. Pay.gov provides a suite of services allowing agencies to obtain and process collections in an efficient and timely manner. The Pay.gov application consists of four services: Collections (credit card), Forms, Billing, and Reporting.

Pay.gov introduced a new communications interface called Trusted Collection Services (TCS) in 2008 as a part of the Pay.gov 4.0 release. TCS is providing agencies with a secure way to connect to Pay.gov using 128‐bit SSL encryption, certificate‐based authentication, and Web services. The initial implementation of TCS consists of three server‐to‐server interfaces:

· TCS Single: TCS Single will allow an agency application to send a single non‐interactive collection to Pay.gov for immediate processing.

· TCS Single Query: This service will allow an agency application to query Pay.gov on an ad hoc basis for the details and results of a single collections transaction.

· TCS Date Query: This service will allow an agency application to query Pay.gov on an ad hoc basis for the results of one or more collections transactions which occurred during a specified twenty‐four hour window.

Current API was built at Network Solutions to communicate with pay.gov and uses the TCS Single server-to-server interface. The contractor shall be responsible for performing work that: supports the BEP’s use of Pay.Gov on our Network Solutions hosted platform using their proprietary application interface to Pay.Gov. The contractor shall provide these services in accordance with what is described in this statement of work.

1.2 Line Items

1.3 REFERENCES

Trusted Collection Services Technical Reference Manual, February 8, 2014

1.3 ACRONYMS AND DEFINITIONS

BEP – Bureau of Engraving and Printing COR – Contracting Officer Representative ECF – Eastern Currency Facility IT – Information Technology OES – Office of Enterprise Solutions PM – Project Manager RFC – Request for Changes SOW – Statement of Work WCF – Western Currency Facility API – Application Programming Interface QA- Quality Assurance

2.0 SCOPE

The contractor shall provide:

2.1. Two Pay.gov API updates/year and QA testing.

2.2. Regression testing of the Pay.gov interface when changes are made to their core software. This will take place approximately 4 times per year.

3.0 STATEMENT OF WORK

The contractor shall be responsible for performing work that: supports the BEP’s use of Pay.Gov as a payment gateway which uses following TCS key technologies:

· Service Oriented Architecture (SOA).

· Web services - described by a Web Services Definition Language (WSDL) file and one or more related XML Schema Document (XSD) files.

· Certificate-based authentication - Pay.gov TCS uses security certificates issued by the Data Access Control Division (DACD) of the Bureau of Public Debt, in cooperation with the U.S. Treasury Financial Management Service, to identify and authenticate agency application servers, as well as granting access to specific TCS web services.

3.1 Contractor shall update two Pay.gov Application Programming Interface (API) updates per year and perform pertaining Quality Assurance (QA) testing on the following:

· Update on Web Services Definition Language (WSDL) file and

· One or more related XML Schema Document (XSD) files.

3.2 TCS Data Validation

Contractor shall perform regression testing of the Pay.gov interface when changes are made to their core software. This is will take place approximately 4 times per year. Contractor shall perform following TCS Data Validation on Plastic Card Transactions and validate against “Agency Message to Pay.gov” and “Pay.gov Response to Agency” message pair.

· Plastic Card Authorization

· Plastic Card Manual Authorization

· Plastic Card Sale

· Plastic Card Force with Pay.gov Tracking ID

· Plastic Card Force without Pay.gov Tracking ID

· Plastic Card Refund with Pay.gov Tracking ID

· Plastic Card Refund without Pay.gov Tracking ID

· Plastic Card Cancel

3.3 TCS Security Certificates

· Contractor shall coordinate with BEP designated “Agency Security Contact” to obtain TCS Security Certificates to access both pay.gov Production and QA environment issued by the information security (IS) group at the Federal Reserve Bank of Cleveland.

· Contractor shall request the pay.gov interface access for Trusted Collection Services via the designated agency security contact.

· Contractor shall retrieve and export the Security Certificates both for Production and QA environment.

3.4 System-Level TCS Error Messages

Contractor shall document System-Level TCS Error Messages and coordinate with pay.gov to resolve the error messages

4.0 DELIVERABLES AND PERFORMANCE STANDARD

5.0 GENERAL INFORMATION

5.1 STATUS REPORTING AND MEETING

The Contractor’s Project Manager (CPM) is required each month to produce and submit electronically to the COR a status report on all current projects and assignments. In addition, CPM will meet, on as needed and/or regular basis, with COR, PM and other BEP representatives to discuss project initiations, deadlines and other activities of the Contractor staff.

5.2 TRAINING

Contractors will be required to complete all required and mandated security and IT specific training, as requested by BEP. The training should be completed during normal business hours. Contractors will be allowed to take BEP/CIO/IT-related courses at BEP contracted company expenses during normal business hours.

5.3 BADGES

All on-site contractors will be required to obtain badges through the BEP security office. Badges must be displayed at all times while on the premises.

5.4 COTS Software

BEP/CIO will furnish all necessary COTS application, software and licenses.

5.5 DATA RIGHTS

Data Rights: The Government will maintain ownership and “unlimited rights to all applications, source codes, and data generated in the performance of and at the end of the task. “Unlimited rights” means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

5.6 PARKING

The Bureau will not be responsible, and does not provide for, parking for the Contractor Personnel.

5.7 GOVERNMENT-FURNISHED RESOURCES

The BEP will provide all technical and ISS manuals, workspace, desk, chairs, telephones and desktop PCs, with BEP approved software, for all contractor personnel. In addition, the Government will provide all consumable office supplies deemed necessary for the performance of this contract, i.e. paper, pencils, note pad, paper clips, stapler, etc.

5.8 OTHER DIRECT COST

No Other Direct Cost. Travel is not necessary for this task order.

5.9 TASK ORDER/CONTRACT TRANSITION

The incumbent Contractor shall cooperate fully to the extent required to permit an orderly changeover and maintain mission continuity. The incumbent contractor shall furnish sufficient orientation, training, and equipment/systems familiarization required by any follow-on Contractor. All official files, manuals, charts, records, drawing, software development, source codes, deliverables, and other official documentation created or obtained during the performance of this SOW are the property of the Government and shall remain on site for use by the Government or follow-on Contractor at the time of Task Order expiration, termination, or during any period of suspension of this Task Order.

5.10 CONTRACT TYPE AND INVOICING

This is a Firm Fixed Price (FFP) contract. The contractor shall invoice BEP quarterly.

6.0 SECURITY REQUIREMENTS

6.1 Personnel Security Clearance.

Contractor and subcontractor employee shall be subject to background investigations, conducted by the BEP Office of Personnel Security, before assigned to perform any BEP work. The Contractor shall furnish the COR with all documents required for the security clearance process for each person who will be authorized to have access to the Bureau, but do not currently have an active security clearance from BEP security office, for work under any resultant contract within five (5) working days after contract award.

6.2 The BEP reserves the right to deny access to its facilities following adjudicative guidelines set forth in Executive order 10450 and applicable supplemental directive, to any individual about which are as adverse suitability determination is made. Failure to submit the required security packet or to truthfully answer all questions contained in security packets shall constitute grounds for denial of access clearance.

6.3 The selected Contractor shall not provide access to employees, or subcontractor employees, until written access clearance is provided by the Personnel Security Branch, Office of Security, BEP. Contractors and subcontractors are responsible for reporting all changes concerning their employees, which may affect the suitability of their employees for access to the BEP or placement in any of these positions including additions, or deletions, to the COR within ten (10) workdays of the occurrence of the change.

6.4 The COR shall maintain a current listing of access requirements and will provide that information to the Personnel Security Branch, Office of Security, BEP. The Personnel Security Branch will inform the COR of all access denials. Denial of access to the BEP does not preclude employment of the individual concerned, by the Contractor, in any capacity not associated with the contract.

6.5 BEP shall perform the first background check no cost to the Contractor. The cost of any subsequent background checks made necessary because of the failure of the first applicant shall be borne by the Contractor.

6.6 Cyber Security

All Cyber security work shall be done in conjunction with the BEP Office of Critical Infrastructure and IT Security. The contractor shall comply with all aspects of the BEP and the Department of the Treasury IT security program, and NIST FIPS and Special Publications. NIST documents and guidance are available at http://csrc.nist.gov/publications, Systems developed, delivered, or maintained by the contractor must meet the NIST FIPS 200 minimum security requirements.

6.6.1 The United States Government Configuration Baseline (USGCB)

For all work done under this contract, the contractor shall certify applications are fully functional and operate correctly as intended on systems using the USGCB.

6.7 SPECIAL PROVISION FOR SECURITY CLEARANCES AND COMMENCEMENT OF WORK

6.7.1 The COR shall provide the Contractor the required BEP security clearance forms prior to entering BEP.

6.7.2 The Contractor shall return completed forms for personnel that are to perform directly under this contract to the COR not later than 10 business days after receipt of the forms. The period of time for background clearances to be completed is estimated to be between 30 to 60 Government business days.

6.7.3 The Contractor shall be issued a Notice to Proceed by the Contracting Officer, when all proposed personnel have been cleared. Within 24 hours after receipt of the notice to proceed, the Contractor shall coordinate with the COR to schedule appointments to have Building Security Badges made for its personnel. The Contractor shall upon receipt of a notice to proceed from Contracting Officer, commerce work at the beginning of the day shift, not later than 72 hours after receipt of the notice to proceed. Therefore, the Contractor’s transition period shall begin and continue for 45 calendar days thereafter. The period of performance for the contract shall not begin until the first day the Contractor personnel report for work.

7.0 PERFORMANCE LOCATION/ PERIOD OF PERFORMANCE

7.1 Place of Performance

7.1.1 Most, if not all, of the work performed under the scope of this contract may be performed offsite at a contractor facility as agreed by the vendor and COR/PM.

Work may be performed at the Bureau of Engraving and Printing’s Washington DC facility located at 14th and C Streets, SW, Washington DC 20228

Period of Performance: This statement of work will have an effective period of five years one base and four option years from the date of contract award.

Hours of Work: Business work hours are be 6:00am to 6:00pm Monday to Friday, Eastern Standard Time (EST). The contractor shall not be granted access to the BEP facility on federal holidays unless otherwise agreed upon prior to the holiday. Contractor staff may be required to work additional hours to meet critical deadlines. Contractor will notify the COR of any need to work beyond the normal workday to make prior arrangements for the building and work area.

Departures: In the events that a contractor staff member leaves the current contract, The Contractor Project Manager is required to reassign personnel to take over the projects or tasks until an approved replacement is found, if applicable. The COR and the PM must be notified 2 weeks prior to the contractor’s departure. The Contractor Project Manager is required to sustain personnel with the expertise to continue business as usual for all projects or tasks.

8.0 SKILL EXPERIENCE REQUIREMENT

8.1 Contractor Project Manager

The Contractor Project Manager shall possess a minimum of 3 years supervisory experience, in a lead or management role. This individual shall demonstrate the ability to lead and manage technical oriented projects and personnel. The Project Manager duties are such that another staff member with the stated supervisory experience can easily assume them. The Contractor shall determine which position shall assume the Project Manager duties. The Project Manager duties will include but may not be limited to the following:

· Point of Contact responsible for the day to day coordination of all work activities and questions for projects by the contract staff under guidelines of the statement of work;

· Ensure Contractor performance under the contract is in compliance with the terms and conditions of the contract as well as the guidelines provided by the COR

· Initiate, maintain, and certify Contractor time and attendance records,

· Set up additional procedures for contractor staff, with COR’s approval;

· The COR must be advised of any changes to the Contractor’s staff work schedule prior to implementation.

· For major development project, the Contractor Program manager may be required to facilitate coordination, and obtain concurrence among affected stakeholders by acting as project leader.

9.0 POINTS OF CONTACT

This contract will be administered by the Contracting Officer’s Representative (COR):

Mohammed Kamal Information Technology Specialist, BEP

(202) 874-1966 Mohammed.Kamal@bep.gov

10.0 SECTION 508 ACCESSIBILITY STANDARDS

IR1052.239-9008 Section 508 Information, Documentation and Support (SEP 2006)

In accordance with 36 CFR 1194, Subpart D, the electronic information technology (EIT) products and product support services furnished in performance of this contract shall be documented to indicate the current conformance level with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards. At no time during the performance of the award shall the level of conformance go below the level of conformance in place at the time of award. At no additional cost, the contractor shall provide information, documentation, and support relative to the supplies and services as described in Section J, Attachment [Fill in]. The contractor shall maintain this detailed listing of compliant products for the full contract term, including forms of extensions, and shall ensure that it is current within five calendar days after award and within three calendar days of changes in products being utilized as follows:

(a) Product support documentation provided to end-users shall be made available in alternate formats upon request, at no additional charge.

(b) End-users shall have access to a description of the accessibility and compatibility features of products in alternate formats or alternate methods upon request, at no additional charge.

(c) Support services for products shall accommodate the communication needs of end-users with disabilities.

(End of clause)

IR1052.239-9009 Section 508 Conformance (SEP 2006)

Each electronic and information technology (EIT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR 1194 at the level of conformance specified in Section J, Attachment [FILL IN].

The following technical standards have been determined to be applicable to this contract:

_x _ 1194.21, Software applications and operating systems.

_ x_(a) _ x_(b) _ x_(c) _ x_(d) _ x_(e) _ x_(f) _ x_(g) _ x_(h) _ x_(i) _ x_(j) _ x_(k) _ x_(l)

_x_ 1194.22, Web-based intranet and internet information and applications.

_x_(a) _x_(b) _x_(c) _x_(d) _x_(e) _x_(f) _x_(g) _x_(h) _x_(i) _x_(j) _x_(k) _x_(l) _x_(m) _x_(n) _x_(o) _x_(p)

___ 1194.23, Telecommunications products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j) __(k) - __(k:1) __(k:2) __(k:3) __(k:4)

___ 1194.24, Video and multimedia products.

__(a) __(b) __(c) __(d) __(e)

___ 1194.25, Self contained, closed products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j)

___ 1194.26, Desktop and portable computers.

__(a) __(b) __(c) __(d)

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR 1194.31) apply to this contract.

_X_ (a) At least one mode of operations and information retrieval that does not require user vision shall be provided, or support for assistive technology used by people who are blind or visually impaired shall be provided.

_X_ (b) At least one mode of operation and information retrieval that does not require visual acuity greater than 20/70 shall be provided in audio and enlarged print output working together or independently, or support for assistive technology used by people who are visually impaired shall be provided.

_X_ (c) At least one mode of operation and information retrieval that does not require user hearing shall be provided, or support for assistive technology used by people who are deaf or hard of hearing shall be provided.

_X_ (d) Where audio information is important for the use of a product, at least one mode of operation and information retrieval shall be provided in an enhanced auditory fashion, or support for assistive hearing devices shall be provided.

_X_ (e) At least one mode of operation and information retrieval that does not require speech shall be provided, or support for assistive technology used by people with disabilities shall be provided.

_X_ (f) At least one mode of operation and information retrieval that does not require fine motor or simultaneous actions and that is operable with limited reach and strength shall be provided.

(End of clause)

IR1052.239.9010 Section 508 Services (SEP 2006)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated electronic and information technology (EIT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR 1194, Subpart B, and functional performance criteria in 36 CFR 1194.31, Subpart C, unless an agency exception to this requirement exists.

The following technical standards and provisions have been determined to be applicable to this contract:

_x _ 1194.21, Software applications and operating systems.

_ x_(a) _ x_(b) _ x_(c) _ x_(d) _ x_(e) _ x_(f) _ x_(g) _ x_(h) _ x_(i) _ x_(j) _ x_(k) _ x_(l)

_x_ 1194.22, Web-based intranet and internet information and applications.

_x_(a) _x_(b) _x_(c) _x_(d) _x_(e) _x_(f) _x_(g) _x_(h) _x_(i) _x_(j) _x_(k) _x_(l) _x_(m) _x_(n) _x_(o) _x_(p)

___ 1194.23, Telecommunications products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j) __(k) - __(k:1) __(k:2) __(k:3) __(k:4)

___ 1194.24, Video and multimedia products.

__(a) __(b) __(c) __(d) __(e)

___ 1194.25, Self contained, closed products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j)

___ 1194.26, Desktop and portable computers.

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

_X_ (a) At least one mode of operations and information retrieval that does not require user vision shall be provided, or support for assistive technology used by people who are blind or visually impaired shall be provided.

_X_ (b) At least one mode of operation and information retrieval that does not require visual acuity greater than 20/70 shall be provided in audio and enlarged print output working together or independently, or support for assistive technology used by people who are visually impaired shall be provided.

_X_ (c) At least one mode of operation and information retrieval that does not require user hearing shall be provided, or support for assistive technology used by people who are deaf or hard of hearing shall be provided.

_X_ (d) Where audio information is important for the use of a product, at least one mode of operation and information retrieval shall be provided in an enhanced auditory fashion, or support for assistive hearing devices shall be provided.

_X_ (e) At least one mode of operation and information retrieval that does not require speech shall be provided, or support for assistive technology used by people with disabilities shall be provided.

_X_ (f) At least one mode of operation and information retrieval that does not require fine motor or simultaneous actions and that is operable with limited reach and strength shall be provided.

(End of clause)

IR1052.239-9011 Section 508 Accessibility of Electronic and Information Technology (100% Compliance) (SEP 2006)

Each electronic and information technology (EIT) product or service furnished under this contract shall comply with the Electronic and Information Technology Accessibility Standards (36 CFR 1194). If the Contracting Officer determines any furnished product or services is not in compliance with the contract, the Contracting Officer will apply the remedies described under FAR 52.246-2, Inspection of Supplies – Fixed Price.

The following technical standards and provisions have been determined to be applicable to this contract:

_x _ 1194.21, Software applications and operating systems.

_ x_(a) _ x_(b) _ x_(c) _ x_(d) _ x_(e) _ x_(f) _ x_(g) _ x_(h) _ x_(i) _ x_(j) _ x_(k) _ x_(l)

_x_ 1194.22, Web-based intranet and internet information and applications.

_x_(a) _x_(b) _x_(c) _x_(d) _x_(e) _x_(f) _x_(g) _x_(h) _x_(i) _x_(j) _x_(k) _x_(l) _x_(m) _x_(n) _x_(o) _x_(p)

___ 1194.23, Telecommunications products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j) __(k) - __(k:1) __(k:2) __(k:3) __(k:4)

___ 1194.24, Video and multimedia products.

__(a) __(b) __(c) __(d) __(e)

___ 1194.25, Self contained, closed products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j)

___ 1194.26, Desktop and portable computers.

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

_X_ (a) At least one mode of operations and information retrieval that does not require user vision shall be provided, or support for assistive technology used by people who are blind or visually impaired shall be provided.

_X_ (b) At least one mode of operation and information retrieval that does not require visual acuity greater than 20/70 shall be provided in audio and enlarged print output working together or independently, or support for assistive technology used by people who are visually impaired shall be provided.

_X_ (c) At least one mode of operation and information retrieval that does not require user hearing shall be provided, or support for assistive technology used by people who are deaf or hard of hearing shall be provided.

_X_ (d) Where audio information is important for the use of a product, at least one mode of operation and information retrieval shall be provided in an enhanced auditory fashion, or support for assistive hearing devices shall be provided.

_X_ (e) At least one mode of operation and information retrieval that does not require speech shall be provided, or support for assistive technology used by people with disabilities shall be provided.

_X_ (f) At least one mode of operation and information retrieval that does not require fine motor or simultaneous actions and that is operable with limited reach and strength shall be provided.

(End of clause)

Performance Based SOW Page 2 image1.png