J-1_HIDS_SOW_06-30-14.docx

Section C - Statement of WORK – Health Care Quality Information Systems (HCQIS) Infrastructure and Data Center Support (HIDS)

30 June 2014

Section C - Statement of WORK - HCQIS Infrastructure and Data Center Support (HIDS)

Independently and not as an agent of the Government, the HIDS contractor (hereafter referred to as the “Contractor”) shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work (SoW) below:

C.1 INTRODUCTION

The Center for Clinical Standards and Quality (CCSQ) mission is to improve healthcare outcomes, beneficiary experience of care, and population health while reducing health care costs. Within CCSQ, the Information Systems Group (ISG) mission is to architect, build and support innovative health care IT systems that focus on optimizing CCSQ quality programs.

This Statement of Work describes the products and services required to manage and operate the Healthcare Quality Information Systems (HCQIS) infrastructure and Data Center supporting CMS’ quality improvement programs run by the CCSQ.

This contract is for one (1) twelve(12) month base period and nine (9) twelve (12) month option periods. All efforts shall be performed in accordance with Centers for Medicare & Medicaid Services (CMS) requirements and shall meet ISG objectives of continuous improvement around efficiency and effectiveness of operations, timely implementation of systems designed to meet statutory and regulatory requirements, and providing high-quality services and support to the user community and CMS business partners.

C.1.1 Background

HCQIS is comprised of a central data center currently located in Warrenton, VA and a data network supporting servers and desktop systems located throughout the U.S. at Quality Improvement Organizations (QIO), End-Stage Renal Disease (ESRD) Networks, and a Clinical Data Abstraction Center (CDAC).

The HCQIS infrastructure and network support major application environments to collect clinical data and measure quality of care for Medicare and Medicaid beneficiaries. The primary programs and applications include, but are not limited to:

· Quality Improvement Organizations (QIOs) and the Clinical Data Abstraction Center (CDAC);

· Quality Reporting and Value Based Purchasing(VBP) for Physician Quality Reporting System (PQRS), End Stage Renal Disease (ESRD), Hospital Quality Reporting (HQR), Hospital Inpatient and Outpatient quality reporting;

· Ambulatory Surgical Centers, Inpatient Psychiatric Facilities, and Cancer Hospital Reporting;

· Consolidated Renal Operations in a Web-Enabled Network (CROWNWeb), ESRD Quality Incentive Program (QIP) and Renal Management Information System (REMIS);

· Quality Improvement and Evaluation System (QIES) for Long Term Care and Post-Acute Care Provider assessments and CMS and State surveyors;

Section C.2 Scope of Work describes the range of functions and services required to support these systems and programs in more detail. In general, the services fall into the following categories of work:

· HCQIS support for Engineering and Architecture to support the above applications;

· Build-out and configuration of all hardware, operating systems, middleware and tools within HCQIS;

· Operations and Maintenance (O&M) of the infrastructure and systems supporting the above applications;

· Help Desk support for end-users of the above applications;

· Production control support for the above applications;

· Help Desk, File/Print and e-mail services, systems administration and desktop support for both ESRD and QIO contractor facilities;

· IT Security, Information Assurance, and Identity Management for all HCQIS systems.

Additionally, the HCQIS infrastructure contractor is expected to closely collaborate with ISG’s other primary contractors to provide seamless IT services to CCSQ business owners and users. These other contractors are described below:

· Program Management Business Requirements (PMBR). PMBR is responsible for program management, project management, day-to-day project oversight, business process modelling and business requirements and user story development.

· Application Development Organizations (ADO). ADOs are responsible for designing and developing software products that meet CMS technical and security standards, satisfy requirements, and perform efficiently. Additionally, ADOs are responsible for the performance of their products, unit testing, and Quality Assurance (QA) testing.

· Reporting and Analytics (R&A). R&A provides ad hoc reporting and complex data analytic services to ISG and CCSQ programs.

· Quality Improvement and Evaluation System (QIES). (QIES) is CMS’ key tracking, analysis, and data repository system for Medicare, Medicaid, and Clinical Laboratory Improvement Amendments (CLIA) provider quality of care.

· Testing Services Contract (TSC). TSC provides end-to-end oversight of testing throughout the development lifecycle and performs Independent Validation and Verification (IV&V) testing services.

CCSQ’s data center operates on a combination of Oracle (formerly Sun) and HP Wintel platforms. These systems run Solaris, Red Hat Linux, and Windows operating systems using UNIX and Windows virtualization technologies. Most applications are developed using an Oracle stack incorporating WebLogic, Oracle Service Bus, and Oracle development tools to access Oracle databases. Network communications is provided by Cisco equipment and primary storage uses EMC’s VMAX storage area network (SAN) technology. The entire suite of products, platforms, and tools used in the data center to support HCQIS is outlined in detail in Appendices’ C.A, C.B, C.C, and C.E. All IT assets are Government Owned assets and will need to be transitioned from outgoing Contractor to the incoming Contractor.

The Health Information Technology for Economic and Clinical Health (HITECH) Act was passed as part of the American Reinvestment and Recovery Act (ARRA) of 2009. As noted in the HITECH Act, CMS has been charged with defining "meaningful use" of certified electronic health record (EHR) technology and developing incentive payment programs for Medicare and Medicaid providers.

For 2012, CMS moved toward closer alignment with other quality measurement programs, including HITECH and the Medicare Shared Savings Program. In doing so, some of the current Physician Quality Reporting System reporting options were modified or discontinued. Data Submission Vendors (DSV) was added as well as a separate incentive payment for eligible professionals who satisfactorily participate in the Physician Quality Reporting System and participate in a Maintenance of Certification Program. In addition, CMS will publicly report the performance results of the group practices participating in the Physician Quality Reporting System Group Practice Reporting Option (GPRO).

C.1.2 Assumptions and Constraints

CMS wants to make clear that the contractors are viewed as experts in the area of data center operations. Therefore, the information contained in this document is for information purposes only. CMS will rely on the contractors to determine how services are to be delivered, monitored and evaluated. In the event information provided in this document is contrary to industry best practice or the contractor’s standard operating procedure, the Contractor shall clearly indicate the contradiction and present their recommended best practice approach so as to encourage dialogue between CMS and the Contractor, working toward a mutually agreeable solution.

C.1.2.1 Assumptions The Contract establishes certain assumptions:

· The Contractor shall verify the quality of work products through formalized internal reviews and audits.

· If the Contractor receives direction it considers outside of the scope of this SoW or contrary to any of its terms and conditions, the Contractor shall withhold performance on the directive in question and immediately notify the Contracting Officer (CO) and Contracting Officer’s Representative (COR) in writing as to the specific discrepancies and proposed corrective actions.

· The Contractor shall provide all deliverables listed in Appendix J.2 of RFP.

· The Contractor is responsible for the disposition of the data and information collected for this project. Any data or information containing personal health information (PHI) falls under HIPAA regulations and must be handled, stored, protected, and disposed of in accordance with HIPAA guidelines and the Federal Information Security Management Act of 2002.

· The Contractor is required to follow all Federal, CMS, and HCQIS guidelines for maintaining the security of privacy and sensitive data.

· The Contractor shall not develop any applications, code, tools, etc. that have not been approved by CMS. CMS prefers the use of commercial or government off the shelf products where feasible and cost effective.

· CMS prefers web-based, zero footprint applications where feasible and cost effective.

· The Contractor shall not use any proprietary precuts, processes, hardware, software, etc. unless approved by CMS.

· All products, processes, methods, models and algorithms created under this contract are the sole property of CMS.

C.1.2.2 Constraints The following constraints affect Contractor’s eligibility to compete for tasks in a specific Phase:

· Contract tasks are subject to Software Engineering Institute (SEI®) Capability Maturity Model Integration® (CMMI®) level 3 requirements. Therefore, Contractors who are unable to demonstrate process maturity at this level for industry standard practices for operating large scale, complex data centers shall be deemed unqualified and restricted from competing for the work.

· Contract tasks have built-in gate reviews (checkpoints) that require CMS to formally authorize continuation or termination of the effort by the Contractor.

· The Contractor shall not perform any work outside of the United States unless approved by CMS. This includes subcontractors and consultants.

· The Contractor shall not develop any applications, code or tools that have not been approved by CMS. CMS prefers the use of Commercial Off-The-Shelf (COTS) or Government Off-The-Shelf (GOTS) products where feasible and cost effective.

· The Contractor shall not use any open-source products unless they have obtained prior written approval from ISG group-level management.

· The Contractor is responsible for ensuring that all products delivered meet design objectives and is of good quality, including system software, firmware, physical equipment and engineered systems.

· The Contractor shall comply with all federal regulatory requirements for Section 508 compliance, the Federal Acquisition Regulation (FAR) and Federal Information Systems Management Act (FISMA) in the performance of this SoW.

C.1.3 Purpose

The purpose of this Statement of Work (SoW) is to obtain contract services for managing, implementing, operating and supporting technical components of the HCQIS environment. This support is wide-ranging, covering areas such as:

· Hosting a data center

· Network management

· UNIX and Microsoft server management

· Configuration management and change control

· IT infrastructure and data center operations

· Stress and performance testing

· Project management

· Security

· Help Desk

· Procurement

· Production control and operations

· QIO and CDAC server and network systems administration

· ESRD server and network systems administration

· File and print services

· E-mail services

· Desktop support

The intent is to engage a Contractor able to provide high quality IT services and the ability to expand in scope, complexity and capacity to meet the dynamic needs of CCSQ during the transformation of the nation’s healthcare through the implementation of quality and value-based payment programs. As such, the Contractor shall proactively manage the evolutionary growth and expansion of the HCQIS and associated IT services. Furthermore, the critical nature of the programs supported by HCQIS requires that the Contractor shall use recognized best practices for IT engineering and architecture, data center operations and management, help desk support, and sustain CMMI Level III process maturity in all functional service areas.

C.2 Scope of Work The scope of work for the HCQIS Infrastructure and Data Center Support (HIDS) contract are described in the following sections. In general, the Contractor is responsible for IT program and project management, infrastructure design and engineering, environment builds and code deployments, data center operation and production and end user/desktop support of the HCQIS.

HCQIS Data Center contains a large inventory of IT assets, including but not limited to:

· Application software and databases

· Systems software and middleware

· Commercial Off the Shelf (COTS) products, tools, and applications

· Licenses and certificates

· Physical and Virtual Servers and Workstations

· Network equipment and security appliances

· Online storage equipment, virtual tape libraries, and tape drives

· Facility/environmental equipment and controls

· Cabling and wiring Due to the dynamic nature of HCQIS Data Center, the inventory of IT assets changes on a frequent and regular basis. The latest accounting of HCQIS IT Assets is summarized in Appendix C.A. The Contractor shall be responsible for procurement, engineering, management and active maintenance of all HCQIS IT inventory as defined above. The inventory shall be maintained in Remedy (as stated in section C.2.3.4) with on demand reporting available to CMS as needed. Key reports for physical assets shall be readily available. Customized reports shall be available within two weeks of the request.

In addition, the Contractor shall provide facilities, IT operations and desktop/helpdesk support for all HCQIS IT Systems. A list of current major HCQIS Applications and Services is listed in Appendix C.B. Due to dynamic and ever changing nature of HCQIS programs, additional LOB applications and/or services may be added in the future.

The scope of the HIDS contract includes management and support of a wide variety of IT hardware and software. Appendix C.C is a comprehensive list of the products the Contractor shall update, patch, configure, and operate within the scope of this SoW and includes:

· Application architecture components

· Hardware and software platforms and components

· External integration components

· WAN interfaces, email, internet, video conferencing components

· User interfaces, portal products

· Storage and data management, storage area networks (SAN) and their associated components

· HCQIS Data Center and Network Operation Center/Security Operations Center (NOC/SOC)

· HCQIS Network and Devices

· IT Help Desk

· Application Monitoring and Performance

· The HCQIS Wide Area Network (WAN) management and monitoring, to include all circuits and links.

· All HCQIS systems and networks in the HCQIS Infrastructure to include HCQIS Data Center and all supported locations. Remote support of the government furnished IT equipment and software for all of the HCQIS application development organizations (ADO).

· Remote support and coordination of government furnished IT equipment and software located at QIO’s and ESRD Networks throughout the regional United States. The systems are primarily Microsoft servers/workstations leveraging an Active Directory model.

These responsibilities described above are considered baseline responsibilities. HCQIS is a dynamic and growing environment and the Contractor should demonstrate ability to respond to rapidly changing requirements.

C.2.1 Program Management Strategy

The Contractor shall provide Administrative, Program Management, Project Management, and Communications support to all tasks in this SoW.

C.2.1.1 Program Management The Contractor shall apply sound program management principles and practices to infrastructure projects, initiatives, pilots and the overall data center operations and maintenance in order to ensure efficiency and successful performance of the contract.

The Contractor shall provide ongoing program management of all activities to include:

· Guidance and management of project teams;

· Improvements and changes to project and operational processes;

· Resource allocation to projects and operations;

· Reviews of significant deliverables and artifacts;

· Maintenance of infrastructure project and task schedules;

· Submission of status reports as required and/or requested by CMS;

· Program financial and contract management; and

· Management and execution of multiple projects.

The Contractor shall submit a detailed Program Management Plan to reflect all tasks as specified in the Deliverable Schedule. A weekly master project schedule of all projects and activities shall be provided to CMS for incorporation with the Integrated Master Schedule (IMS). The IMS is the single master schedule of all HCQIS IT Projects across various HCQIS contractors and is managed and maintained by the PMBR Contractor.

C.2.1.2 Project Management Project management support for HCQIS Enterprise Services and LOB IT systems development and enhancement projects involving multiple CMS contractors are provided by the PMBR Contractor. The Contractor shall be required to provide input to PMBR regarding tasks related to the scope of this SoW. This input includes identifying tasks, levels of effort, key milestones, and resource assignments. Additionally, the Contractor shall identify risks and issues associated with their work on these projects.

The Contractor for this SoW is also required to provide project management services for those projects which are entirely within the scope of the HIDS Contract such as installation of COTS products in the HCQIS Infrastructure, data center operational improvement initiatives, desktop refreshes, implementation of new tools or products, and other significant efforts requiring coordination, planning, and control. The Contractor shall follow fundamental project management principles and structured methods such as those delineated in the Project Management Institute’s Project Management Body of Knowledge (PMBOK) and conform to CMS ISG project management governance.

The Contractor shall provide project management support on all significant infrastructure enhancement phases including planning, design, engineering, implementation and project close-out as defined in this Statement of Work including but not limited to the following:

· The Contractor shall provide Work Breakdown Structure (WBS) and updates as required by CMS. The Contractor shall prepare a Project Management Plan and provide/maintain a Work Breakdown Structure (WBS) that outlines the major tasks and subtasks necessary to complete the work in accordance with ISG IT governance standards.

· The Contractor shall submit detailed project schedule and provide updates as required by CMS.

· The Contractor shall ensure that the WBS include for each task dependences, level of effort, duration (start and end dates), resource assignments and milestone dates.

· The Contractor shall submit weekly Project Status Reports outlining completed tasks, upcoming tasks, risks, issues and schedule.

· For projects being managed by the Contractor, the Contractor shall conduct periodic status calls and meetings to discuss work activities, timelines, risks, issues and participate in calls with project stakeholders and participants as directed by the Contracting Officer Representative (COR) and/or GTL(s).

C.2.1.2.1 Risk and Issue Management

The Contractor shall provide and maintain a Risk Management Plan for the successful execution of all projects and operations including identification, prioritization, and mitigation of key project and program risks. The Contractor shall also report and coordinate its risk management approach and mitigation efforts with CMS, other Contractors, and other stakeholders. The key risk management activities the Contractor shall perform include but not limited to:

· Develop risk management processes that encourage the rigorous identification of risks and continuing assessment/reassessment of risk exposure;

· Ensure timely risk handling decisions to prevent negative consequences;

· Develop effective contingency and mitigation plans sufficiently early to preempt ad hoc reactions;

· Track and monitor risk status; and

· Monitor and ensure mitigation action are planned and executed.

As risks are realized and issues arise, the Contractor shall provide and maintain an Issue Management Plan. The Contractor shall prioritize each issue and develop a list of actionable steps that need to be taken to bring issues to closure. The Contractor shall routinely provide a report on issues and elevate those that are critical and need immediate attention.

C.2.1.2.2 Communications Management

The Contractor shall provide and maintain a Communication Management Plan for the successful communication between the Contractor, CMS, other Contractors and stakeholders for all projects and tasks under this SoW. CMS emphasizes that the Contractor’s approach to communications shall be proactive, timely and adequate when risks or issues exist that may adversely impact operations, service to stakeholders, public perception, personnel safety or contractual compliance. The Contractor shall advise CMS in advance when possible of any indication that a potential problem may be developing with these ramifications. In the case of a known impending risk or issue, the Contractor shall be forthcoming with CMS to address the problem and assist when appropriate with identifying mitigation strategies and actions.

C.2.1.2.3 Collaboration and Meetings

The Contractor shall work in cooperative and collaborative business arrangement with CMS, CMS’ external partners and other CMS contractors. The Contractor shall comply with the following requirements to achieve an effective, collaborative environment in the execution of the tasks in this SoW:

· Contractors shall promptly provide CMS and other CMS contractors with full access to project-related work products and deliverables as directed by CMS.

· Contractors shall provide CMS and other CMS contractors with access and visibility into internal project and operational processes and practices as directed by CMS, except processes designated in advance as proprietary by the Contractor in their response to this SoW.

· Contractors shall facilitate a collaborative environment by:

· Providing prompt and complete responses to CMS and CMS Contractors’ requirements for project-related work products and deliverables within and between tasks and subtasks of the CMMI Services Model;

· Fostering and practicing open communications that promote smooth transitions between tasks and phases and interoperability among work products;

· Publishing schedules and participating in meetings to ensure clear communications between Contractors at all times;

· Publishing communication plans that describe the Contractor's approach for ensuring a free flow of information and products among the partnership (CMS and Contractors); and

· Identifying issues and risks that span within and across HCQIS.

· Contractors shall be held accountable for positive and negative collaboration performance that advances or impedes the ability of CMS, and other contractors to perform effectively.

The Contractor shall participate as appropriate in meetings (meetings may occur via conference call or in person and the Contractor shall be required to attend within 24 hours of notice) as needed to comply with CMS IT governance and systems development life cycle policy and practices. The Contractor shall supply meeting materials as requested. These meetings may include:

· HCQIS Change Control Board (CCB)

· HCQIS QualityNet Configuration Management Board (QCMB)

· Application Status

· HCQIS QualityNet Technical Review Board (QTRB)

· Technical Review Board (TRB)

· User Group Calls

· Joint Application Development (JAD) and workgroup

· Infrastructure upgrades and operations/maintenance

· Management

· User Councils

· Other meetings as requested C.2.1.3 Quality and Process Management The Contractor shall be responsible for identifying, correcting, and improving on key internal management processes that govern the Contractor’s ability to deliver high-quality services and ensure that the critical enterprise-level integration requirements and collaboration objectives are met. The Contractor shall establish, implement and maintain a quality assurance program to ensure consistent quality for all work products delivered and services performed under this SoW. The Contractor shall document its quality assurance program in a Quality Assurance Plan.

Contract tasks are subject to Software Engineering Institute (SEI®) Capability Maturity Model Integration® (CMMI®) Level III requirements. The contractor shall either possess an independently prepared Standard CMMI Appraisal Method for Process Improvement (SCAMPI) appraisal results assessed at CMMI Level III (or higher) or be able to successfully demonstrate maintaining a working environment equivalent to CMMI Level III. If the Contractor does not possess CMMI Level III (or higher), the Contractor shall submit specific examples that demonstrate their ability to maintain a working environment equivalent to CMMI Level III practices upon request by CMS prior to the award of this contract and at any time during the period of performance of this SoW.

The Contractor shall conduct two CMMI SCAMPI Class A appraisals for Level III assessment during the ten-year PoP of this contract with the first appraisal taking place no later than the completion of Option Year 1 of the contract.

C.2.1.4 Earned Value Management The Contractor shall monitor cost, schedule, and technical performance for the overall program and large-scale projects as defined by CMS. Earned Value Management (EVM) shall be used by the Contractor to effectively integrate the project technical scope of work with schedule and cost elements for optimum project planning and control.

· The Contractor shall use an Earned Value Management System (EVMS) that complies with ANSI/EIA Standard EIA-748-A for all work executed under this contract including its subcontractors.

· The Contractor shall assess, quantify, and forecast trends; analyze variances; and facilitate development and implementation of corrective actions.

· The Contractor shall be certified by a Cognizant Federal Agency (CFA). The certification must be for the functional organization performing the work.

· In the performance of this contract, the Contractor shall create and follow a System Description for their Program Management Control System (PMCS). This Government-approved document shall describe how the Contractor manages cost and schedule on the program in an EVM-compliant manner. The System Description must comply with the EVM Guidelines (ANSI/EIA Standard EIA-748-A).

· The Contractor shall not re-baseline its performance measurement baseline without the prior permission from CMS.

· The Contractor shall not, under any circumstances, adjust cost performance data (Budgeted Cost of Work Scheduled (BCWS), Budgeted Cost of Work Performed (BCWP), and Actual Cost of Work Performed (ACWP)) from prior months. Any errors, accounting adjustments or approved re-base lining actions shall be recorded as a single point adjustment in the current reporting month.

· The Contractor shall provide access to all pertinent records and data requested by CMS or its duly authorized representative to monitor the compliance of the Contractor’s actual program/project management procedures with its PMCS.

· The Contractor shall ensure that its teaming partners, major subcontractors, and other program suppliers comply with the intent of the EVM Guidelines and report their monthly EVM data accurately and in time for inclusion in the Contractor's Cost Performance Report (CPR). CPR Formats 1–5 shall be used for formal EVM reporting.

C.2.1.4.1 EVM System Review

For each period of performance, at a time mutually agreeable to both CMS and the Contractor, the Contractor shall make appropriate staff available for an EVM System Review/Integrated Baseline Review (IBR). The goal of the System Review will be to ensure that the Contractor’s PMCS:

· The format and content of the IBR shall be in accordance with Federal Acquisition Regulation (FAR) 52.234-2, FAR 52.234-3, FAR 52.234-4;

· Provides timely and reliable cost, schedule and technical performance measurement information summarized directly from the Contractor’s internal management system;

· Complies with the EVM guidelines EVMS guidelines contained in the American National Standards Institute Electronic Industries Alliance (ANSI/EIA) 748, and CMS Earned Value Management System guidance;

· Provides timely indications of actual or potential problems;

· Maintains baseline integrity;

· Provides information that depicts actual conditions and trends; and

· Provides comprehensive variance analysis at the appropriate levels including proposed corrective action concerning cost, schedule, technical, and other problem areas.

The System Review will focus on major system activities and problem identification to ensure the greatest return for resources expended. The review will rely heavily on interviews with individual Control Account Managers (CAM) to ensure that they have adequate knowledge of the PMCS and to ensure that they are familiar with all of their CAM responsibilities.

The System Review team will consist of CMS personnel and Contractor team members. The Contractor shall be prepared to discuss the following topics:

· Data Analysis and Reporting

· Performance Measurement

· Program Budget Planning

· Subcontract Planning and Control

· Work Authorization

· Organization

· Scheduling

At the conclusion of each System Review, the team will prepare a list of items that require correction or further explanation and will go over the list with the Contractor’s management team. At the beginning of each System Review, the team will review the action item list with the Contractor’s management team and will assess the provided corrections and explanations.

CMS may also request additional Systems Reviews/Integrated Baseline Reviews during the period of performance for all contract tasks or specific tasks as changes occur.

C.2.1.4.2 Contractor’s EVM Self-Monitoring Responsibilities

The Contractor shall establish and conduct an internal monitoring program to ensure that it continues to follow the EVM Guidelines and that it’s PMCS is implemented and used correctly on the program. The Contractor will note all instances in which its PMCS is not being followed correctly or where its processes are contrary to the EVM Guidelines, and will ensure that these instances are corrected and not repeated. The Contractor shall also ensure that its team members and subcontractors comply with the EVM Guidelines and will ensure that instances of non-compliance are corrected and not repeated.

C.2.1.4.3 Earned Value Contract Performance Report

The Contractor shall prepare and submit a Contract Performance Report (CPR) each month describing the amount of work scheduled and achieved to date and the actual costs associated with that work. The CPR consists of the following five (5) report formats:

· Format 1 – provides data to measure cost and schedule performance by product-oriented Work Breakdown Structure (WBS) elements, the hardware, software, and services to the Government;

· Format 2 – provides the same data as Format 1 by the Contractor’s organization (functional or Integrated Product Team (IPT) structure);

· Format 3 – provides the budget baseline plan against which performance is measured;

· Format 4 – provides staffing forecasts for correlation with the budget plan and cost estimates; and

· Format 5 – is a narrative report used to explain significant cost and schedule variances and other identified contract problems and topics.

C.2.1.4.4 Management Review

The Contractor shall conduct monthly Management Reviews as a forum for the Contractor and CMS to discuss program and project status. The primary focus will be the status against the Program Management Plan baseline and the Performance Measurement Baseline (PMB). The Management Review shall include:

· An overview of the project status with a focus on outstanding issues and risks;

· A detailed overview of tasks planned for the next three months;

· A high-level overview of major milestones planned for the next 12 months;

· A description of the progress that has been made in Process Improvement activities; and

· Provide a bi-annual financial review.

C.2.1.5 Incoming Transition Plan During the incoming transition period, CMS will provide the new Contractor a training schedule and a schedule of events that will include the following:

· Transition milestones and timeframes, including a detailed timeline for work-in-progress and production cutovers;

· A comprehensive listing of the responsibilities of all personnel participating in the transition to include the policies, practices and procedures to be employed by the incumbent contractor to ensure there is no conflict between routine system maintenance and the activities of the transition;

· An in-depth schedule and thorough description of the methodology to be employed by the incumbent contractor to ensure no degradation of service during the transition period;

· A risk management plan and issue management plan that includes a list of the potential risks during the transition period and the plan to mitigate each;

· A complete and detailed resource-planning/resource-turnover analysis; and

· Any travel necessary to support the transition.

In collaboration with CMS and the incumbent contractor, the Contractor shall deliver a final transition plan within 4 weeks of award.

C.2.1.6 Joint Operating Agreement The new Contractor shall establish a Joint Operation Agreement (JOA) with the incumbent Contractor within seven calendar days of completion of the transition plan. Not more than two (2) weeks after notification by CMS that the contract has been awarded, the new Contractor shall submit to the Contracting Officer Representative (COR) and Government Task Leaders (GTLs) a draft written agreement. The purpose of the agreement is to establish a process for managing the workload while both contracts are in place and to also establish a process to fully transition the workload from the incumbent contract to the new contract. The agreement shall illustrate the manner in which the two entities will maintain support during the transition of the work from the incumbent's contract to the new contract including methods that will be used to communicate and coordinate activities to communicate to CMS. The agreement shall be delivered by the new Contractor and reviewed and approved by the CMS GTL and COR.

During this transition period, the new Contractor shall work with CMS and the incumbent(s) to ensure a smooth transition. Both the incumbent Contractor and the new Contractor shall sign the agreement. The agreement shall define the responsibilities for all Contractors (both incumbent and new) and shall be submitted to CMS for approval before final signatures are obtained.

In addition, as part of the agreement, CMS, the incumbent Contractor and the new Contractor shall form a joint team that will be managed by CMS to ensure that communication, coordination, cooperation, and consultation among all entities is maintained in support of the transition and ongoing work. Such a team shall meet regularly (as defined by CMS) and shall monitor the work of any subgroups during transition and ongoing work.

Not later than seven calendar days after notification by CMS that the transition to a new Contractor shall take place, the new Contractor shall submit to the COR a Transition Plan. All formats for documentation will be defined and/or approved by CMS. The Plan shall include, but not be limited to, the following:

· Transition milestones and timeframes, including a detailed timeline for work-in progress and production cutovers;

· A proposed comprehensive listing of the responsibilities of all personnel participating in the transition to include the policies, practices and procedures to be employed by the incumbent Contractor to ensure there is no conflict between routine system maintenance, current enterprise & project data model workload, and the activities of the transition;

· A CMS approved in-depth schedule and thorough description of the methodology to be employed by the incumbent Contractor to ensure no degradation of service during the transition period;

· A CMS approved risk management plan and issue management plan that includes a list of the potential risks during the transition period and the plan to mitigate each; and

· A CMS approved complete and detailed resource-planning/resource-turnover analysis.

C.2.2 Design and Engineering

The Contractor shall have primary responsibility in the design and engineering of infrastructure related changes, enhancements, and the implementation of new tools and technologies to improve HCQIS infrastructure and data center efficiency. The Contractor shall also collaborate with CMS, other contractors and product vendors to provide infrastructure design and engineering expertise during the development and enhancement of HCQIS IT systems and services.

Infrastructure design and engineering includes but is not limited to: network, servers, workstations, storage (online and offline), security, building and facility including environmental controls and electricity, enterprise tools, and all information systems appliances used in the architecture of HCQIS IT systems and services. This task includes the development of all technical documentation such as logical and physical design drawings required by the CMS Expedited Life Cycle (XLC) and Technical Review Board (TRB).

Design and engineering tasks defined under this section are projects and initiatives that add, change, or remove IT infrastructure to improve the overall efficiency and effectiveness of the HCQIS infrastructure, data center, and operations and maintenance (O&M) activities. Ongoing O&M activities for HCQIS infrastructure are defined in section C.2.4.

C.2.2.1 Enterprise-Wide Engineering The Contractor shall propose and, upon CMS approval, engineer enterprise-wide changes to the HCQIS infrastructure, data center and processes to deliver cost-effective, high performing environments for hosting HCQIS enterprise software and databases.

The HCQIS Infrastructure must be capable of handling increasing performance requirements. The Contractor shall engineer infrastructure architecture and components to be highly scalable and flexible to meet any system peaks and performance requirements in a very short time period.

Enterprise-wide engineering tasks shall include industry best practices, tools, and proven techniques to improve the overall efficiency of the HCQIS Data Center and IT infrastructure. Sample enterprise-wide engineering focus areas include but are not limited to:

· New technologies and modernization initiatives (see Section C2.6.2)

· Continued adherence to CMS TRA requirements and CMS IT and Security policies

· Adherence to IPv6 requirements per OMB M-05-22

· Migration from stove piped LOB infrastructure to Enterprise Infrastructure

· Server and data center virtualization

· IT system and service performance improvement

· High availability, scalability and performance

· Network optimization

· Application and service integration

· Advanced enterprise storage solutions

· Disaster recovery/business continuity planning and implementation

· Directory services

· Security

· Secure large file transfers

· Monitoring, detection and alerting

The Contractor shall provide an IT Integrated Management Plan (ITIMP) that defines a strategic vision for the HCQIS infrastructure and the recommended tactical implementation path six months after award and every six months thereafter. The plan should address the future needs and plans for enterprise architecture, platforms, technologies, and tools needed to sustain a high level of performance among the applications running in the HCQIS environment. The ITIMP shall include budgetary estimates for initial investment amounts and on-going O&M cost for a three-year planning horizon.

C.2.2.2 Network Design and Engineering The Contractor shall research, plan, and engineer CMS approved changes and enhancements to the HCQIS network environment. Changes shall comply with CMS XLC, CMS and Federal security frameworks, and be implemented following CMS approved configuration and change management processes.

Included among the network engineering tasks are:

· Enhanced network management and monitoring

· Videoconferencing over IP

· Configuration and administration of external/Internet DNS servers

· Collaboration technologies and unified communications technologies

· Load balancing, fail-over and redundancy

· Integration and changes associated with partner networks/touch points such as the CMS Office of Information Services (OIS), ESRD dialysis facilities and other business partners.

Additional network engineering tasks (e.g., new or evolving external interfaces) are anticipated in the base year of the contract. Significant changes shall be authorized by CMS contract modification.

C.2.2.2.1 LAN Engineering

The Contractor shall provide the Local Area Network (LAN) engineering to include but not limited to the following:

· Routing and switching

· Remote access

· Address assignment and inventory management

· Network virtualization

· Redundancy and failover

· Security monitoring and alerting

· Cabling and connectivity

· Performance measurement, monitoring and alerting C.2.2.2.2 WAN Engineering

All CMS Wide Area Network (WAN) services are provided through the Federal Government’s Network contract. HCQIS circuits are installed and operated by a Network Service Provider and are monitored and managed by the infrastructure Contractor. Collectively, the HCQIS WAN consists of multiple tiers of circuits that span the U.S. supporting QIOs, ESRD Networks, and the CDAC. These WAN components are in a perpetual state of evolution and growth due to changing business requirements and emerging technologies. Current network design and architecture is subject to future changes to meet CMS business requirements. When and if appropriate, the Contractor should propose alternate WAN technologies that provide improved cost benefit to CMS.

The Contractor shall research, plan for, and with CMS approval, engineer changes to the HCQIS network infrastructure using appropriate life cycle processes, following established CMS and Federal security frameworks, artifacts, and change management practices. Sample near-term network engineering tasks include:

· Enhanced network management

· Videoconferencing over IP phased implementation

· External/Internet DNS servers

· Internet Service Provider

· Collaboration and unified communication technologies

· Auditing and monitoring

· Integration and changes associated with partner networks/touch points such as the CMS Office of Information Services (OIS), ESRD Dialysis facilities and other business partners as they arise.

C.2.2.3 Server Engineering The Contractor shall research, plan, and engineer CMS approved changes and enhancements to the HCQIS server environments across all life cycles. These servers are generally Wintel and UNIX platforms and typically include web servers, application servers and database servers. At CMS’ direction, the Contractor shall have the technical lead for changes within each server environment at each of the HCQIS facilities such as the data center and other locations. Changes shall comply with CMS XLC, CMS and Federal security frameworks, and HCQIS change management process. Listed below are representative server engineering tasks that the Contractor is required to perform:

· Review, improve, and maintain standard build configurations;

· Update Disaster Recovery plan (DR) and Business Continuity plan (BCP);

· Design/engineering support for modifications/hardening of servers based upon USGCB changes/requirements;

· Consolidate and increase performance for all server environments on an on-going basis (e.g. Unix, Wintel);

· Design/engineering of the Active Directory environment;

· Design/engineer images (physical and virtual servers) for HCQIS servers;

· Ensure a “GOLD” standard is established and updated after each new configuration baseline is approved;

· Ensure “GOLD” standard image is consistent across all life environments for all systems;

· Integration into an LDAP-compliant database environment;

· Server consolidation where applicable across the environment;

· Operating system upgrades;

· Patching servers according to a patch management schedule; and

· Any additional tasks as required

C.2.2.3.1 Server Virtualization

CMS is in the process of reevaluating its current standard within the TRA that requires physical partitioning of the three zone environment. The result of this evaluation process will be reflected in future versions of the TRA and TRA Supplements.

CMS is challenging the Contractor to present solutions that will increase the use of virtualization while maintaining the highest level of security and reducing cost.