CMS ARTS Draft SOO.pdf

CENTERS FOR MEDICARE & MEDICAID

SERVICES ANALYSIS, REPORTING & TRACKING

SYSTEM (CMS ARTS)

Statement of Objectives

CMS

July 31, 2025

Please note: This document is procurement Sensitive

Page | 2

Table of Contents

Table of Contents

C.1 PURPOSE

C.2 BACKGROUND

C.3 SCOPE

C.4 Period and Place of Performance C.5 Current Environment C.6 Objectives

C.6.1 Business Objectives

C.6.2 Technical Objectives

C.6.3 Security Objectives

C.6.4 Management & Administrative Objectives C.7 Constraints

C.7.1 Assumptions and Constraints

C.7.2 Standards, Policies and Procedure References

C.7.3 Government Furnished Information (GFI), Equipment and Facilities C.8 Deliverables C.9 Key Personnel C.10 Transition-In C.11 Transition Out C.12 Government Personnel

Page | 3

C.1 PURPOSE

This Statement of Objectives (SOO) describes the goals that the Center for Medicare & Medicaid Services (CMS) / Office of Information Technology (OIT) expects to achieve regarding maintaining the current Analysis, Reporting and Tracking System (ARTS). CMS has adopted a cloud posture to manage costs and transition to software and Infrastructure as Code (IAC) optimized for the cloud. Moving CMS ARTS to a cloud native posture will facilitate leveraging new and emerging technologies, increase availability, scalability and reduced cost. The CMS goals include:

• Developing and implementing the backlog of business requirements for CMS ARTS

• Further improving the posture of CMS ARTS within Amazon Web Services (AWS) infrastructure with regards to improving effectiveness and decreasing cost, such as containerization

• Planning for the future development of CMS ARTS, such as refactoring the application codebase to a more current version of .NET

The primary goals of this acquisition are operations and maintenance (O&M), continued development, and enhancement of the current CMS ARTS.

C.2 BACKGROUND

The Centers for Medicare & Medicaid Services Analysis, Reporting and Tracking System (CMS ARTS) is the CMS system of record for tracking Contractor Business Proposals, Cost Reports, Deliverables, and Workload Information for various departments within the agency and contains financial, budget and cost related information which includes but is not limited to dashboard reports, contract performance reports and FOIA requests. This system is used by CMS staff and various contractors, including but not limited to Medicare Administrative Contractors (MACs), Program Safeguard Contractors (PSCs) and Zone Program Integrity Contractors (ZPICs).

Within the CMS ARTS system, CMS personnel establish contractors' task orders (a.k.a.

contracts), specific tasks associated with each task order, and deliverables associated with each task order. A task order is assigned to a contractor, and from that point forward, the contractor defines business proposals for each applicable period of performance. Periodic (generally speaking, monthly) cost reports are entered against the business proposal by the contractor to allow for tracking and analysis of actual versus estimated costs. Additionally, files containing deliverables are uploaded by the contractor to satisfy the requirements of those deliverable items that have been defined by CMS.

The users' access into the CMS ARTS system is restricted to the specific 'Department(s)' they work within. CMS uses this system for certain contracts and those contracts are segregated

Page | 4 into Departments. The data is segregated by Department, whereby users from one Department have no visibility into the data from another Department (e.g. MAC users cannot view ZPIC data). Data is further segregated at the contractor level, whereby one contractor has no visibility into another contractor's data within the same Department.

Generally, a user will work and have access into a single Department only. A user is assigned exactly one (1) role in the system per Department. That role has activities associated with what they are, and are not, able to do. Specific activities are associated with roles for Government users and Contractor users.

C.3 SCOPE

This SOO addresses the following activities:

1. Maintain AWS environments and services to include but not limited to: DevSecOps implementation of software development, testing, and deployment across multiple environments.

2. Providing operations, maintenance, and enhancement services for CMS ARTS.

3. Providing program and analytical support to maintain and enhance CMS ARTS.

4. Providing configuration and release management services for CMS ARTS.

5. Providing general support services for CMS ARTS.

6. Providing end user support for CMS ARTS.

7. Conducting User Acceptance Training and Testing for scheduled releases.

8. Identify, develop, and implement a full infrastructure as code, disposable micro services, and architecture for refactoring CMS ARTS changes within AWS.

9. Identify, develop, and implement a full codebase conversion for the .NET application code from .NET 4

The CMS ARTS application and database(s) shall be maintained in compliance with federal CMS/HHS Standards, Policies, and Procedures provided in this document. All tasks shall be accomplished in accordance with the CMS Target Life Cycle (TLC) or its successor governance system.

C.4 Period and Place of Performance

The base Period of Performance will be from the date of award (December 24, 2025) with four (4) one-year options. Services will be provided at the Contractor’s site and at other CMS locations throughout the Baltimore/Washington metropolitan areas. The primary CMS headquarters are located at:

Centers for Medicare and Medicaid Services 7500 Security Blvd Baltimore, MD 21244

Page | 5

C.5 Current Environment

CMS ARTS is a CMS-owned, web-based Microsoft ASP .Net application and is hosted off-site within an Amazon Web Services (AWS) data center. CMS ARTS infrastructure is all handled through Infrastructure as Code (IAC) with Terraform and Ansible. The basic structure consists of Windows application servers with a Microsoft SQL Server (MSSQL) database in Amazon Relational Database Service (RDS).

C.6 Objectives

CMS ARTS is a system that allows the contractors performing work for CMS to submit information about the cost of this work and for CMS to review this cost information. This SOO describes CMS goals, objectives, and performance requirements for CMS ARTS to achieve increased user satisfaction, line of business goals, and best value on the total cost of ownership (TCO), while maintaining the highest levels of availability, system integrity, and the ability to implement enhancements. The requested contractor’s PWS covers the contractor services to fully address the primary program outcomes, and the objectives listed below.

C.6.1 Business Objectives

1. Optimize the CMS ARTS application for the cloud, maximize cost reduction, and efficiency of the IT environment.

2. Provide application management and support services that accommodate considerations from an enterprise perspective including impact on CMS business units, contracts, management, technical components, application, infrastructure, and security.

3. Administer and maintain CMS ARTS in a CMS-approved Cloud Hosting Environment.

4. Support the operations and maintenance of the security architecture, cloud technologies, server, network, database, and storage systems as well as systems integration and automation.

5. Ensure 99.99% availability of CMS ARTS during core business hours, 6:00 AM – 6:00 PM EST Monday – Saturday.

6. Provide cyber security engineering, analytical, and programmatic support for CMS ARTS cloud computing initiatives.

7. Increase operational efficiency and lower operational costs through containerization, the use of Infrastructure as Code (IAC) scripting, automated CI/CD pipelines, and/or other DevOps techniques.

8. Support CMS ARTS to include administrative functions, as well as support other engineering teams that interact with CMS ARTS.

9. Analyze the current state of the information architecture and make recommendations for changes to improve operations, reduce costs, increase ease of use, and optimize the selection of the most appropriate components or cloud services for evolving business requirements.

Page | 6

10. Increase CMS ARTS’s speed of delivery of business value, while ensuring high quality.

11. Enable and enhance rapid deployment strategies to quickly address user needs and change requests.

12. Implement scalable automated testing, to support quick and responsive code deployments.

13. Establish continuous monitoring, auditing, and reporting of CMS ARTS applications and services.

14. Provide customer support CMS ARTS application during hours 7:00 AM – 5:00 PM EST

Monday – Friday.

15. Implement a full DevSecOps process for software development, testing, and deployment into the CMS ARTS AWS Environment.

C.6.2 Technical Objectives

1. Develop, test, implement, maintain, and deliver the CMS ARTS applications, supporting a minimum of four epics per quarter.

2. Perform Unit and integration testing, smoke and regression testing after code drops, compatibility testing in (e.g., browser compatibility such as: Edge, Firefox, Chrome, etc.), End-to-end testing with all the interfaces (such as IDM), and Connectivity testing.

3. Provide architectural vision and actively collaborate with CMS and CMSARTS stakeholders to plan and document an architectural roadmap including analyses and recommendations outlined in architecture documents (such as epics, features, data models, etc.).

4. Perform all functional and performance testing, environment configuration, deployment, CI/CD pipeline creation, and sunsetting the current application .NET codebase and other tasks as needed to migrate the codebase to .NET 8 or better. Upon completion of this task, the CMS ARTS application and reports processes will be fully operational using containers in AWS.

5. Test all requirements in all software releases. Testing activities shall include, but not be limited to, modifications to enable the system to stay compatible with the CMS operating environment and other CMS systems, upgrades to system functionality, performance tuning and system optimization, and assistance in diagnosing and correcting problems.

6. Test all changes and requirements in every user story with both positive and negative test cases.

7. Develop and maintain the test data to satisfy all test case requirements.

8. Support the latest versions of CMS approved multiple browsers (Chrome, Firefox, MS, etc.) automation frameworks and testing.

9. Support ongoing testing for system maintenance, including CMS Enterprise changes. This will include, but is not limited to any operating system upgrades, supporting software patches, hardware upgrades, interfacing system changes, security changes, and policy changes.

10. Support the production system and administration of all COTS and open-source applications in use by the CMS ARTS system.

11. Implement a full DevSecOps process for software development, testing, and deployment into the CMS ARTS AWS Environment.

12. Identify Section 508 testing activities to ensure any changes to the application’s user

Page | 7 interface complies with accessibility guidelines.

13. Support the CMS ARTS application interfaces with external systems, such as but not limited to CMS Identity Management (IDM).

14. Maintain cloud services post-deployment.

15. Ensure automation and the use of IAC scripts to provision resources utilizing CMS enterprise tools when available.

16. Validate and integrate the cloud environment with external CMS systems.

17. The CMS ARTS contractor system maintainer is required to renew the Telerik UI for

ASP.NET AJAX and Telerik Reporting licenses on an annual basis. The support & maintenance annual license captures updates and support production and non-production environments alike. Telerik is a COTS tool used within CMS ARTS.

C.6.3 Security Objectives

1. Provide comprehensive analysis of current applications and infrastructure that incorporates considerations for security such as data sensitivity, legal or regulatory issues, disaster recovery, currently deployed remote access, or internal security considerations, etc.

2. Provide support and services in compliance and alignment with Federal Risk and Authorization Management Program (FedRAMP) standardized security assessment, authorization, and continuous monitoring policies.

3. Provide technical services regarding security and privacy that are consistent with NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing” and other applicable standards and guidelines.

4. Describe the framework and approach to incorporating both federal and agency security requirements into all development recommendations.

5. Ensure that the CMS ARTS system and its operations comply with all CMS security policies and best practices. Ensure compliance with information systems security requirements, security documentation, and controls.

6. Support all security reviews and tests required by CMS, to include utilization of RSA Archer IT Security Risk and Management, and the CMS FISMA Controls Tracking System

(CFACTS).

7. Participate in business continuity planning and disaster recovery activities.

C.6.4 Management & Administrative Objectives

1. Manage program cost, schedule, performance, risks, warranties, contracts and subcontracts, vendors, and data required to deliver effective services.

2. Maintain clear government visibility into program cost, schedule, technical performance, and risks, including periodic reporting.

3. Provide CMS with up-to-date and comprehensive information regarding technical and management performance.

4. Manage all aspects of CMS ARTS in compliance with CMS project management and OIT Software Development Life Cycle (SDLC) standards, to include the TLC.

5. Manage all documents, deliverables, and maintain code repositories in a manner

Page | 8 consistent with CMS best practices.

6. Develop with CMS, an agreed upon series of SLAs for action on all production problems in accordance with the timeframes negotiated with CMS, to include associated terms and conditions, and enforcement methodology.

7. Maintain a Quality Assurance (QA) program that ensures the quality of all deliverables.

8. Perform all project management including technical and business management functions, to plan, implement, track, report, and deliver the system.

9. Provide, implement, and maintain an integrated project management approach; develop, deliver, update, and maintain a Project Management Plan (PMP).

10. Support coordination of written, verbal, and electronic communications with end-users, system owners, managers, developers, and CMS staff.

11. Ensure the CMS ARTS Production code meets CMS requirements and standards compliance.

12. Perform periodic code review of all code produced.

13. Utilize the CMS Agile Tool Suite (JIRA, Confluence, GitHub and Slack).

14. Support CMS sponsored Change Control Boards and Change Control Process.

15. Perform regular system health check of all components of CMS ARTS.

16. Report on project information and status to CMS as requested. Examples include but are not limited to monthly reports, financial status reports, project schedule status reports, risk register, trouble ticket reports, project status updates, and System Design Documents

(SDD).

17. Implement tagging and naming conventions of all cloud resources as defined by CMS.

18. Train CMS staff and support contractors on CMS ARTS, and any software or tools provided as part of the support of CMS ARTS.

19. Maintain and update the CMS ARTS User Manual. The User Manual contains the information and references necessary for the user to learn, navigate, and use the system.

C.7 Constraints

C.7.1 Assumptions and Constraints

1. The Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities not otherwise provided by the government, as needed to perform the various requirements of this task order, to include development software licenses and updates including but not limited to Telerik UI for ASP.NET AJAX and Telerik Reporting.

2. The Contractor shall be required to work very closely, collaboratively, and cooperatively with CMS Information Technology (IT) staff, the CMS ARTS business owners, the CMS Government Task Leader (GTL), CMS policy analysts and any other staff, contractors or vendors as directed by CMS.

3. CMS ARTS resides in the cloud.

4. All development and testing activities will be performed in the cloud.

5. The Contractor may be required to work outside of normal business hours for tasks such as load testing, release deployments, patches, outages, and upgrades.

Page | 9

6. The activities and deliverables of the PWS shall comply with the CMS Target Life Cycle (TLC) available at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS- Information-Technology/TLC.

7. The Contractor’s ISSO will perform duties in accordance with IOM Pub. 100-17, and the CMS Business Partner System Security Manual (BPSSM).

8. The Contractor shall be responsible for the disposition of the data and information collected for this Task Order. Any data or information containing personal identifiable information (PII) or personal health information (PHI) falls under HIPAA regulations and must be handled, stored, protected, and disposed of in accordance with HIPAA guidelines, the Privacy Act, and the Federal Information security Management Act of 2002.

9. All Contractor personnel shall participate in CMS Information Security Awareness Training.

10. Contractor personnel who are required to obtain a CMS badge shall undergo a background investigation at the Contractor’s expense.

11. The Contractor shall maintain cooperative and professional standards during all interactions with CMS staff or other CMS designated Contractors.

12. The Contractor shall be responsible for purchasing any hardware and software needed to accomplish their tasks at the Contractor’s location.

13. The Contractor is responsible for ensuring secure remote capabilities are available in compliance with business policies and ARS without disruption.

14. The Contractor shall produce all Design, Development, Testing and Implementation documentation identified in the Quantities and Distribution of Deliverables section.

15. The Contractor shall not design, implement, or maintain any customized or proprietary utilities or obtain unauthorized licenses, without prior approval in writing from the Contracting Officer (CO) and the appropriate CMS governance bodies.

16. The Contractor shall receive prior approval, in writing, from the CO before introducing any new Commercial off the Shelf (COTS) products or proprietary utilities.

17. The Contractor shall provide training to CMS staff on Contractor- provided unique software and tools, upon CMS request.

18. All products, including software and all utilities (proprietary and non-proprietary) developed to support the activities and deliverables of this contract, are the property of CMS. The Contractor shall deliver all products, including software (source code) artifacts, documentation, and utilities (proprietary and non-proprietary) necessary to execute the software, and deliverables of this Task Order at the request of CMS or upon termination of this contract.

19. The solutions developed to support the activities and deliverables of this Task Order shall be in accordance with the CMS Information Security Acceptable Risk Safeguards (ARS).

20. The Contractor shall establish network connectivity to CMS at their own expense.

Contractors who have existing connectivity to CMS through circuits provided on CMSNet may use those circuits to establish connectivity for their employees engaged in work on CMS tasks.

21. All employee workstations communicating with the CMS network shall conform to the CMS standard desktop configuration and abide by the CMS Desktop Features and https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/TLC https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/TLC

Page | 10

Specifications. All users shall comply with the HHS Rules of Behavior. Employee workstations shall only be used to perform work on behalf of CMS.

22. Contractors who do not have connectivity to the CMS network, or those who need to provide their employees with remote access to CMS, shall provide employees with CMS VPN based remote access over Internet broadband connections. The employee workstation configurations shall comply with the requirements defined in the current version of “VPN Process Instructions for CMS Contractors.” These requirements include a CMS standard desktop configuration, CMS PIV enabled badge, a currently patched operating system, current anti-virus software, and a current version of the VPN client used by CMS.

23. Throughout this document, unless specifically denoted as workday(s), all timeframes are in calendar weeks, calendar months, and calendar days.

24. The Contractor shall use CMS approved software to develop and maintain project schedules.

25. The CO is the only CMS official who can approve requests for additional funds under this contract. All Task Order changes must have prior approval of the CO and will be communicated to the Contractor through a written Task Order modification.

26. The Contractor shall establish the ability to show documentation of all deliverables having been routed through and having met established Quality processes and standards, with signoff by the Contractor Quality and Program Manager, prior to final delivery, as having entered and met all quality reviews. Such signoff shall constitute attestation by said managers and represented to the Government as being truthful.

27. The Contractor shall enter into a Data Use Agreement (DUA) with the Centers for Medicare & Medicaid Services (CMS) unless the Contractor has a currently active DUA for NPI data exchange on record. The agreement shall delineate confidentiality requirements of the Privacy Act, implement security safeguards, and explain CMS’ data use policies and procedures. The DUA serves as both a means of informing the contractor of these requirements and a means of obtaining their agreement to abide by these requirements. The DUA must be submitted to the Project Officer within ten business days of contract award. The Data Use Agreement (DUA) must be maintained by the contractor to ensure integrity, security, and confidentiality of information; and to permit appropriate disclosure and use of such data as permitted by law. The Contractor and/or Contractor personnel shall not divulge, or release data or information developed or obtained in performance of this contract until made public by the Government, except to authorize Government personnel or upon written approval by the Contracting Officer. The Contractor shall not use, disclose, or reproduce data identified as proprietary, other than as required in the performance of this contract.

Nothing herein shall preclude the use of any data independently acquired by the Contractor without such limitations or prohibit an agreement at no cost to the Government between the Contractor and the data owner, which provides for greater rights to the Contractor. The Contractor shall release all required deliverables and data, or other works developed under this contract solely in accordance with the terms and conditions of this contract. All data collected and remaining in the custody of the Contractor at the close of this contract that permits identification of an individual or entity described in the data, or an individual supplying it, must be delivered to the COR

Page | 11 or destroyed, in accordance with the future Transition-Out Plan, if necessary, to be established after award. No copies or parts of data or derivative files (encrypted and/or individually identifiable) may be kept by the Contractor.

C.7.2 Standards, Policies and Procedure References The CMS ARTS Contractor shall comply with the standards, policies, and procedures below.

Federal Standards, Policies and Procedures:

1. Health Insurance Portability and Accountability Act (HIPAA)

2. OMB Circular A-130 Management of Federal Information Resources, Appendix III, "Security of Federal Automated Information Systems"

3. MIL-HDBK-61 - Configuration Management Guidance

4. Privacy Act of 1974

5. Public Law 93-579, as amended

6. Rehabilitation Act, Section 508, Accessibility Standards

a. 29 U.S.C 794d (Rehabilitation Act as amended)

b. 36 CRF 1194 (508 Standards)

c. http://www.access-board.gov/sec508/standards.htm (508 standards)

CMS/HHS Standards, Policies and Procedures:

1. Target Life Cycle (TLC) - CMS Target Architecture

The Target Life Cycle framework is the official software lifecycle development process at CMS. It provides assistance and standard guidance to support consistent system development and project management methodologies.

TLC Overview https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/TLC/index

2. Security and Privacy CMS IT Security and Privacy

Technology/InformationSecurity

CMS Business Partner System Security Manual (BPSSM)

Technology/InformationSecurity/Info-Security-Library-Items/CMS1223332

3. Information Technology (IT) Project Management IEEE/EIA Standard 12207.0-1996, Volume 4 “Guide to the Project Management Body of Knowledge”

4. CMS DBA Standards http://www.access-board.gov/sec508/standards.htm https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/TLC/index https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/TLC/index https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity http://www.cms.hhs.gov/manuals/downloads/117_systems_security.pdf https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS1223332 https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS1223332

Page | 12

Technology/DBAdmin

5. CMS Requirements Writer’s Guide

Technology/XLC/Downloads/RequirementsWritersGuide.docx

6. FIPS Data Encryption Standards http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

C.7.3 Government Furnished Information (GFI), Equipment and Facilities

CMS will provide current CMS ARTS documentation, including the Systems Design Document (SDD), the Interface Control Document (ICD) and the Requirements Document (RD).

CMS will not provide equipment or office facilities at the CMS site for CMS ARTS Contractor personnel.

C.8 Deliverables

The Contractor shall provide for the following meetings and reports within the designated timeframes:

Deliverable Recurring Kick off meeting

Within 72 hours of contract award

Financial Status Report 1st Due: 30 days after contract award Recurring: 15th of each month Monthly Status Report 1st Due: 30 days after contract award Recurring: 15th of each month This table is not wholly encompassing of all deliverables and applies only to the listed items.

C.9 Key Personnel

Throughout the period of this contract, the Contractor shall provide only those personnel who are fully qualified and competent to perform their assigned work The Contractor shall designate and identify all key personnel (management, supervisory and technical) who will participate in its day-to-day activities. CMS shall approve all key personnel in writing, including all Subcontractors. The Contractor shall notify CMS of any key personnel leaving the program.

Prior to diverting any of the specified individuals to other programs, the Contractor shall notify the Contracting Officer reasonably in advance and shall submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. No diversion shall be made by the Contractor without the written consent of https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/DBAdmin https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/DBAdmin https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/XLC/Downloads/RequirementsWritersGuide.docx https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/XLC/Downloads/RequirementsWritersGuide.docx http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

Page | 13 the Contracting Officer. The Contracting Officer may ratify in writing such diversion and such ratification shall constitute the consent of the Contracting Officer.

The Contractor shall notify CMS by e-mail of all planned key personnel absences longer than one week as well as provide an interim point of contact. The Contractor shall notify CMS by e- mail when scheduled vacations, attendance at conferences, training, etc. result in simultaneous absence of more than one key personnel from the project. The following requirements related to key personnel must be met:

- If awarded this contract, the Respondent shall assign those persons whose resumes are submitted with their proposal and who are identified in the Respondent’s proposal as Key Personnel to perform on this contract. Not all employees assigned to perform on this contract will be Key Personnel.

- The Contractor agrees that during the first twelve (12) months of contract performance, no Key Personnel substitutions will be made unless necessitated by an individual’s sudden illness, death, or termination of employment. In any of these events, the Contractor shall promptly notify the Contracting Officer (CO). All requests for substitutions/additions of Key Personnel must include a detailed explanation of the circumstances necessitating the proposed substitution/addition, a complete resume for the proposed substitute or addition including skills, experience, education, training, and security level. As determined by the CO, all proposed substitutions/additions must have qualifications that meet or exceed the qualifications of the person to be replaced.

- The listing of Key Personnel shall become part of the contract upon award.

Below are the minimum key personnel required; however, Respondents may propose additional key personnel:

- Program Manager o Provides broad program leadership for large projects or significant segments of large complex projects.

o Possesses and applies comprehensive program management knowledge across key tasks and high impact assignments.

o Acts as a principal program spokesperson.

o Resolves complex program management and organizational problems.

o Leads work and outcomes of team members to integrate into project objectives.

o Exhibits a high degree of ingenuity, creativity, and resourcefulness in problem-solving.

o Achieves objectives and solves problems in creative and innovative ways.

o Provides frequent critical and prominent subject matter input to major decision-making processes.

o Holds and maintains an active Project Management Professional (PMP®) certification through the Project Management Institute throughout the duration of this contract and has a preferred ten (10) years of project management experience managing a multi-disciplinary project team. Experience managing a government project with similar size and complexity is preferred.

Page | 14

- Technical Lead o Possesses and applies comprehensive project management knowledge across key technical tasks and high impact assignments.

o Leads technical team on large projects or significant segment of large complex projects.

o May act as a principal project spokesperson in lieu of the Program Manager.

o Analyzes new and complex project-related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components. Prepares long and short-range plans for application selection, systems development, systems maintenance, and production activities and for necessary support resources.

o Oversee all technical aspects of multiple projects.

o Has a preferred eight (8) years of experience managing a government project with similar size and complexity.

o Overseas DevSecOps tasks.

- Lead Systems Architect (may be combined with technical lead) o Provides high-level architectural expertise to managers and technical staff.

o Develop architectural products and deliverables for the enterprise and operational business lines.

o Develop the strategy for the system and the design infrastructure necessary to support that strategy.

o Advises on selection of technology purchases with regards to processing, data storage, data access, and applications development.

o Advises management of feasibility of potential future projects to management.

o Has a preferred of eight (8) years of experience in implementing large information technology solutions and enterprise services.

o AWS Certified Solutions Architect – Professional certification preferred.

- Senior Business Analyst o Possesses experience performing business cases/requirements analysis, use case development.

o Be self-motivated with excellent verbal and written communication skills.

o Has a preferred ten (10) years of experience in requirement facilitation, storyboarding, functional specification development, and use case diagraming.

o Has a preferred five (5) years of experience in Medicare contracting programs.

o Communicate and define clearly the requirements to other analysts, development team, and demonstrate the product functionality to all stakeholders.

o Leads the requirements sessions to capture the correct and clear requirements.

o Works within agile frameworks.

C.10 Transition-In

The contractor shall meet with CMS representatives within seven (7) calendar days after the contract award to discuss transition planning. The objective of the transition is to

Page | 15 ensure a smooth and uninterrupted service for the CMS ARTS operations and maintenance effort. A Transition-In Plan shall be submitted within the PWS for Stage 2 evaluation. This Transition- In Plan shall include a roadmap for hiring, training, shadowing, and any necessary Transition-In activities. The Contractor will be required to assume full operational responsibility as the CMS ARTS Contractor no-later-than 90 days from the start date of the contract, which is anticipated on March 24, 2026. CMS will be responsible for ensuring that the incumbent contractor will be present for any transition meetings and provide any necessary documents and knowledge transfer to the CMS ARTS contractor during the transition phase. The new CMS ARTS contractor shall work with the incumbent CMS ARTS contractor to draft and sign a Joint Operating Agreement (JOA). The JOA shall define the responsibilities for the incumbent CMS ARTS contractor and the new CMS ARTS contractor and shall be submitted by the incumbent CMS ARTS contractor to CMS for approval before final signatures are obtained. As part of the JOA, the incumbent CMS ARTS contractor and the new CMS ARTS contractor shall form a joint, coordinated management team that will ensure that communication, coordination, cooperation, and consultation between the two entities is maintained in support of the transition and ongoing work. Such a team shall have regular meetings and shall monitor the work of any subgroups during transition and ongoing work.

C.11 Transition Out

The contractor shall work collaboratively with the incoming contractor to ensure a seamless transition of the activities and uninterrupted services. This optional task will only be exercised once during the contract period of performance. The period of performance for this optional task will be a 3-month period

At a minimum, the contractor shall provide the following as a part of the Transition

Out:

o Transition-Out Plan o Transition Schedule o Delivery of final deliverables, artifacts, and lessons learned including insight as to the level of effort estimated to complete work in process for anything not expected to be finished prior to transition.

o Delivery of software, release/code versions, processes, artifacts, and documents supporting each task area of the PWS.

o Outputs of automated test results and pass/fail results. Performance, security, and browser testing results.

o Training of relevant Government personnel and Contractors.

o All security concerns such as badges, tokens, and accounts should be communicated to the CMS COR.

o All technical documentation and material will be archived in a secure location as directed by the CMS. This includes any data first developed during contract performance and not already in the possession of CMS.

Page | 16 o Provide close-out certifications that include a statement that the contract is complete, all deliverables have been provided, all services are complete, and there are no outstanding contractual issues.

o Plan for ensuring that, prior to termination or completion of this effort, the Contractor/Subcontractor does not destroy any information in any form received from CMS or gathered/created by the Contractor while performing this effort without prior written approval by CMS. Any data destruction done on behalf of CM by a Contractor/Subcontractor must be done IAW National Archives and Records Administration (NARA) requirements.

o An orientation phase to introduce the successor Contractor personnel and CMS officials to the incumbent team, explaining tools, methodologies, and business processes.

o A Phase-Out Migration Checklist (Contractor format).

C.12 Government Personnel

Contracting Officer:

Candace Straker 7500 Security Blvd.

Baltimore, Maryland 21244-1850 410-786-8174 Candace.Straker@cms.hhs.gov

Contract Specialist:

Erin Crockett 7500 Security Blvd Baltimore, Maryland 21244-1850 410-786-9922 Erin.Crockett@cms.hhs.gov

Contracting Officer’s Technical Representative:

Rudy Wysinger 7500 Security Blvd Baltimore, Maryland 21244-1850 410-786-9707 Roosevelt.WysingerIII@cms.hhs.gov

Government Task Leader:

William Frank 7500 Security Blvd Baltimore, MD 21244-1850 410-786-8155 william.frank@cms.hhs.gov mailto:Candace.Straker@cms.hhs.gov mailto:Erin.Crockett@cms.hhs.gov mailto:Roosevelt.WysingerIII@cms.hhs.gov mailto:william.frank@cms.hhs.gov