DOL-OPS-15-R-00006_Amendment_000001.pdf

(x)

DOL-OPS-15-R-00006

x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

Washington DC 20210-0001

OPS

S4307 200 Constitution Ave, NW Office of Procurment Services US Department of Labor

Washington DC 20210-0001

OPS

S-4307 200 Constitution Ave, NW Office of Procurement Services US Department of Labor

03/11/2015000001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

03/11/2015

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

THE CONTRACTOR SHALL PROVIDE QUALITY ASSURANCE (QA), QUALITY CONTROL-INDEPENDENT

VERIFICATION, VALIDATION & TESTING (QC-IVV&T), SOFTWARE CHANGE MANAGEMENT (SCM) AND

INFRASTRUCTURE CHANGE MANAGEMENT (ICM) SERVICES.

Period of Performance: 05/19/2015 to 05/18/2020

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Jeanetta Roberson

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

DOL-OPS-15-R-00006

B – SUPPLIES OR SERVICES/PRICE

B.1. GENERAL

The contractor shall furnish Quality Assurance (QA), Quality Control- Independent Verification, Validation, & Testing (QC-IVV&T), software Change Management (sCM) and infrastructure Change Management (iCM) services for the U.S. Department of Labor, Employment and Training Administration (ETA), Office of Information Systems and Technology (OIST) in accordance with the terms and conditions as set forth in the Solicitation document (including all amendments), and resulting contract.

B.2. CONTRACT TYPE

The Government anticipates awarding a labor hours (LH), indefinite delivery, indefinite quantity (IDIQ) type contract for a one year base period and four one year option periods. All options will be exercised at the unilateral discretion of the Government.

B.3. PERIOD OF PERFORMANCE

This contract shall be in effect for a Base Period of one (1) year from date of contract award. The anticipated performance periods are as follows:

Base Period: 5/19/2015 – 5/18/2016 Option Period 1: 5/19/2016 – 5/18/2017 Option Period 2: 5/19/2017 – 5/18/2018 Option Period 3: 5/19/2018 – 5/18/2019 Option Period 4: 5/19/2019 – 5/18/2020

B.4. MINIMUM GURANTEED

The Government’s only obligation is the Guaranteed Minimum Amount of Service for the Base Period under the contract. The minimum amount is $2,000.00 for the contract. The five year ceiling amount is $43,111,482.19.

B.5. DELIVERY SCHEDULE

Employee & Training Administration, U.S. Department of Labor, 200 Constitution Avenue,NW,Washington, DC 20210. Attn: COR Florence Davidson.

B.6. INCREMENTAL FUNDING

Funds are not presently available for performance under this contract beyond the base period. The Government's obligation for performance of this contract beyond that date is contingent upon the availability of funds from which payment for contract purposes can be made through the benefits fund. No legal liability on the part of the Government for any payment may arise for performance under this contract beyond the existing period of performance, until funds are made available to the Contracting Officer for performance and until the contractor receives notice of availability which must be confirmed in writing by the Contracting Officer.

B.8. ESTIMATED QUANTITIES

CLIN Base Year Estimated Labor Category Est Hrs

0001 Project Manager (PM) 3024

0002 infrastructure Configuration Management(iCM) 4032

0003 infrastructure Configuration Analysis (iCA) 4032

0004 infrastructure Application Engineering (iAE) 2016

0005 sCM Configuration Manager (sCM) 4032

0006 sCM Configuration Analyst (sCA) 2016

0007 sCM Applications Systems Administrator (sASA) 2016

0008 Quality Assurance Management Analyst (QA) 2016

0009 Quality Control Application Analyst Lead (Tester) (QCLT) 6048

0010 Quality Control Application Analyst (Tester) (QCT) 16128

0011 Quality Control Load Test Specialist (QCLTS) 4032

0012 sCM Application Engineer 2016

0013 Quality Control Automated Test Specialist 2016

TOTAL ESTIMATED HOURS

53424

CLIN Base Year Estimated Labor Category Overtime Est Hrs

0014 Project Manager (PM) 600

0015 infrastructure Configuration Management(iCM) 600

0016 infrastructure Configuration Analysis (iCA) 600

0017 infrastructure Application Engineering (iAE) 600

0018 sCM Configuration Manager (sCM) 600

0019 sCM Configuration Analyst (sCA) 600 0020 sCM Applications Systems Administrator (sASA) 600 0021 Quality Assurance Management Analyst (QA) 600

0022 Quality Control Application Analyst Lead (Tester) (QCLT) 600

0023 Quality Control Application Analyst (Tester) (QCT) 600

0024 Quality Control Load Test Specialist (QCLTS) 600

0025 sCM Application Engineer 600

0026 Quality Control Automated Test Specialist 600

TOTAL ESTIMATED HOURS 7800

CLIN Base Year Estimted Labor Category On Call Est Hrs

0027 Project Manager (PM) 480

0028 infrastructure Configuration Management(iCM) 480

0029 infrastructure Configuration Analysis (iCA) 480

0030 infrastructure Application Engineering (iAE) 480

0031 sCM Configuration Manager (sCM) 480

0032 sCM Configuration Analyst (sCA) 480

0033 sCM Applications Systems Administrator (sASA) 480

0034 Quality Assurance Management Analyst (QA) 480

0035 Quality Control Application Analyst Lead (Tester) (QCLT) 240

0036 Quality Control Application Analyst (Tester) (QCT) 480

0037 Quality Control Load Test Specialist (QCLTS) 480

0038 sCM Application Engineer 480

0039 Quality Control Automated Test Specialist 480

TOTAL ESTIMATED HOURS 6000

CLIN Option Period One (1) Estimated Labor Category Est Hrs

1001 Project Manager (PM) 3024

1002 infrastructure Configuration Management(iCM) 4032

1003 infrastructure Configuration Analysis (iCA) 4032

1004 infrastructure Application Engineering (iAE) 2016

1005 sCM Configuration Manager (sCM) 4032

1006 sCM Configuration Analyst (sCA) 2016

1007 sCM Applications Systems Administrator (sASA) 2016

1008 Quality Assurance Management Analyst (QA) 2016

1009 Quality Control Application Analyst Lead (Tester) (QCLT) 6048

1010 Quality Control Application Analyst (Tester) (QCT) 16128

1011 Quality Control Load Test Specialist (QCLTS) 4032

1012 sCM Application Engineer 2016

1013 Quality Control Automated Test Specialist 2016

TOTAL ESTIMATED HOURS 53424

CLIN Option Period One (1) Estimated Labor Category Overtime Est Hrs

1014 Project Manager (PM) 600

1015 infrastructure Configuration Management(iCM) 600

1016 infrastructure Configuration Analysis (iCA) 600

1017 infrastructure Application Engineering (iAE) 600

1018 sCM Configuration Manager (sCM) 600

1019 sCM Configuration Analyst (sCA) 600

1020 sCM Applications Systems Administrator (sASA) 600

1021 Quality Assurance Management Analyst (QA) 600

1022 Quality Control Application Analyst Lead (Tester) (QCLT) 600

1023 Quality Control Application Analyst (Tester) (QCT) 600

1024 Quality Control Load Test Specialist (QCLTS) 600

1025 sCM Application Engineer 600

1026 Quality Control Automated Test Specialist 600

TOTAL ESTIMATED HOURS 7800

CLIN Option Period One (1) Estimted Labor Category On Call Est Hrs

1027 Project Manager (PM) 480

1028 infrastructure Configuration Management(iCM) 480

1029 infrastructure Configuration Analysis (iCA) 480

1030 infrastructure Application Engineering (iAE) 480

1031 sCM Configuration Manager (sCM) 480

1032 sCM Configuration Analyst (sCA) 480

1033 sCM Applications Systems Administrator (sASA) 480

1034 Quality Assurance Management Analyst (QA) 480

1035 Quality Control Application Analyst Lead (Tester) (QCLT) 480

1036 Quality Control Application Analyst (Tester) (QCT) 480

1037 Quality Control Load Test Specialist (QCLTS) 480

1038 sCM Application Engineer 480

1039 Quality Control Automated Test Specialist 480

TOTAL ESTIMATED HOURS 6240

CLIN Option Period Two (2) Estimated Labor Category Est Hrs

2001 Project Manager (PM) 3012

2002 infrastructure Configuration Management(iCM) 4016

2003 infrastructure Configuration Analysis (iCA) 4016

2004 infrastructure Application Engineering (iAE) 2008

2005 sCM Configuration Manager (sCM) 4016

2006 sCM Configuration Analyst (sCA) 2008

2007 sCM Applications Systems Administrator (sASA) 2008

2008 Quality Assurance Management Analyst (QA) 2008

2009 Quality Control Application Analyst Lead (Tester) (QCLT) 6024

2010 Quality Control Application Analyst (Tester) (QCT) 16064

2011 Quality Control Load Test Specialist (QCLTS) 4016

2012 sCM Application Engineer 2008

2013 Quality Control Automated Test Specialist 2008

TOTAL ESTIMATED HOURS 53212

CLIN Option Period Two (2) Estimated Labor Category Overtime Est Hrs

2014 Project Manager (PM) 600

2015 infrastructure Configuration Management(iCM) 600

2016 infrastructure Configuration Analysis (iCA) 600

2017 infrastructure Application Engineering (iAE) 600

2018 sCM Configuration Manager (sCM) 600

2019 sCM Configuration Analyst (sCA) 600 2020 sCM Applications Systems Administrator (sASA) 600

2021 Quality Assurance Management Analyst (QA) 600

2022 Quality Control Application Analyst Lead (Tester) (QCLT) 600

2023 Quality Control Application Analyst (Tester) (QCT) 600

2024 Quality Control Load Test Specialist (QCLTS) 600

2025 sCM Application Engineer 600

2026 Quality Control Automated Test Specialist 600

TOTAL ESTIMATED HOURS 7800

CLIN Option Period Two (2) Estimted Labor Category On Call Est Hrs

2027 Project Manager (PM) 480

2028 infrastructure Configuration Management(iCM) 480

2029 infrastructure Configuration Analysis (iCA) 480

2030 infrastructure Application Engineering (iAE) 480

2031 sCM Configuration Manager (sCM) 480

2032 sCM Configuration Analyst (sCA) 480

2033 sCM Applications Systems Administrator (sASA) 480

2034 Quality Assurance Management Analyst (QA) 480

2035 Quality Control Application Analyst Lead (Tester) (QCLT) 480

2036 Quality Control Application Analyst (Tester) (QCT) 480

2037 Quality Control Load Test Specialist (QCLTS) 480

2038 sCM Application Engineer 480

2039 Quality Control Automated Test Specialist 480

TOTAL ESTIMATED HOURS 6240

CLIN Option Period Three (3) Base Year Estimated Labor Category Est Hrs

3001 Project Manager (PM) 3000

3002 infrastructure Configuration Management(iCM) 4000

3003 infrastructure Configuration Analysis (iCA) 4000

3004 infrastructure Application Engineering (iAE) 2000

3005 sCM Configuration Manager (sCM) 4000

3006 sCM Configuration Analyst (sCA) 2000

3007 sCM Applications Systems Administrator (sASA) 2000

3008 Quality Assurance Management Analyst (QA) 2000

3009 Quality Control Application Analyst Lead (Tester) (QCLT) 6000

3010 Quality Control Application Analyst (Tester) (QCT) 16000

3011 Quality Control Load Test Specialist (QCLTS) 4000

3012 sCM Application Engineer 2000

3013 Quality Control Automated Test Specialist 2000

TOTAL ESTIMATED HOURS 53000

CLIN Option Period Three (3) Estimated Labor Category Overtime Est Hrs

3014 Project Manager (PM) 600

3015 infrastructure Configuration Management(iCM) 600

3016 infrastructure Configuration Analysis (iCA) 600

3017 infrastructure Application Engineering (iAE) 600

3018 sCM Configuration Manager (sCM) 600

3019 sCM Configuration Analyst (sCA) 600

3020 sCM Applications Systems Administrator (sASA)

3021 Quality Assurance Management Analyst (QA) 600

3022 Quality Control Application Analyst Lead (Tester) (QCLT) 600

3023 Quality Control Application Analyst (Tester) (QCT) 600

3024 Quality Control Load Test Specialist (QCLTS) 600

3025 sCM Application Engineer 600

3026 Quality Control Automated Test Specialist 600

TOTAL ESTIMATED HOURS 7800

CLIN Option Period Three (3) Estimted Labor Category On Call Est Hrs

3027 Project Manager (PM) 480

3028 infrastructure Configuration Management(iCM) 480

3029 infrastructure Configuration Analysis (iCA) 480

3030 infrastructure Application Engineering (iAE) 480

3031 sCM Configuration Manager (sCM) 480

3032 sCM Configuration Analyst (sCA) 480

3033 sCM Applications Systems Administrator (sASA) 480

3034 Quality Assurance Management Analyst (QA) 480

3035 Quality Control Application Analyst Lead (Tester) (QCLT) 480

3036 Quality Control Application Analyst (Tester) (QCT) 480

3037 Quality Control Load Test Specialist (QCLTS) 480

3038 sCM Application Engineer 480

3039 Quality Control Automated Test Specialist 480

TOTAL ESTIMATED HOURS 6240

CLIN Option Period Four (4) Estimated Labor Category Est Hrs

4001 Project Manager (PM) 3012

4002 infrastructure Configuration Management(iCM) 4016

4003 infrastructure Configuration Analysis (iCA) 4016

4004 infrastructure Application Engineering (iAE) 2008

4005 sCM Configuration Manager (sCM) 4016

4006 sCM Configuration Analyst (sCA) 2008

4007 sCM Applications Systems Administrator (sASA) 2008

4008 Quality Assurance Management Analyst (QA) 2008

4009 Quality Control Application Analyst Lead (Tester) (QCLT) 6024

4010 Quality Control Application Analyst (Tester) (QCT) 16064

4011 Quality Control Load Test Specialist (QCLTS) 4016

4012 sCM Application Engineer 2008

4013 Quality Control Automated Test Specialist 2008

TOTAL ESTIMATED HOURS 53212

CLIN Option Period Four (4) Estimated Labor Category Overtime Est Hrs

4014 Project Manager (PM) 600

4015 infrastructure Configuration Management(iCM) 600

4016 infrastructure Configuration Analysis (iCA) 600

4017 infrastructure Application Engineering (iAE) 600

4018 sCM Configuration Manager (sCM) 600

4019 sCM Configuration Analyst (sCA) 600

4020 sCM Applications Systems Administrator (sASA) 600

4021 Quality Assurance Management Analyst (QA) 600

4022 Quality Control Application Analyst Lead (Tester) (QCLT) 600

4023 Quality Control Application Analyst (Tester) (QCT) 600

4024 Quality Control Load Test Specialist (QCLTS) 600

4025 sCM Application Engineer 600

4026 Quality Control Automated Test Specialist 600

TOTAL ESTIMATED HOURS 7800

CLIN Option Period Four (4) Estimted Labor Category On Call Est Hrs

4027 Project Manager (PM) 480

4028 infrastructure Configuration Management(iCM) 480

4029 infrastructure Configuration Analysis (iCA) 480

4030 infrastructure Application Engineering (iAE) 480

4031 sCM Configuration Manager (sCM) 480

4032 sCM Configuration Analyst (sCA) 480

4033 sCM Applications Systems Administrator (sASA) 480

4034 Quality Assurance Management Analyst (QA) 480

4035 Quality Control Application Analyst Lead (Tester) (QCLT) 480

4036 Quality Control Application Analyst (Tester) (QCT) 480

4037 Quality Control Load Test Specialist (QCLTS) 480

4038 sCM Application Engineer 480

4039 Quality Control Automated Test Specialist 480

TOTAL ESTIMATED HOURS 6240

C – STATEMENT OF WORK

CHANGE MANAGEMENT/QUALITY ASSURANCE/QUALITY CONTROL

PWS STATEMENT OF WORK

OBJECTIVES

The purpose of this solicitation is to award a contract for Quality Assurance (QA), Quality Control-Independent Verification, Validation, & Testing (QC-IVV&T), software Change Management (sCM) and infrastructure Change Management (iCM) services. In response to this solicitation, vendors are requested to submit their proposed plan regarding how they will execute the services/tasks as described within this SOW. This includes services/tasks such as but limited to, (not listed in any particular order):

The vendor shall be a certified Capability Maturity Model Integration Maturity Level -2, (for Services preferred) company, providing Capability Maturity Model Integration - Level 2, (for Development) services to:

DOL/OCIO, infrastructure Configuration Management (iCM):

o Project Management o Infrastructure Configuration Management(iCM) o Infrastructure Configuration Analysis (iCA) o Infrastructure Application Engineering (iCAE)

ETA/OIST

o Project Management o Software Configuration Management (sCM) o Software Configuration Analysis (sCA) o Software Application Engineering (sAE) o Software Applications Systems Administration o Quality Assurance (QA) o Quality Control-Independent Verification, Validation & Testing

(QC-IVV&T)

Pursuant to the execution of these services, the vendor is expected to have:

Knowledgeable and experienced in industry accepted Change Management, Quality Assurance and Quality Control-IVV&T principles, network and data center operations and architectures, current techniques and tools for monitoring enterprise IT environments, analytics, industry and Government best practices and Government IT security regulations and policies.

Demonstrated experience with applying industry and government best practices to all service activities identified above.

Demonstrated experience and knowledge with applications development and governance processes (e.g. Organizational Configuration Management Board (OCMB), Change Control Board (CCB) and Release Management (RM))

Demonstrated experience and knowledge with the practical application of Software Development Life-Cycle Management principles

Demonstrated experience and design, implementation, maintenance and management of a configuration Management Database (CMDB).

Demonstrated experienced in QA, QC-IVV&T, sCM as they applied to software development operations throughout the product’s life-cycle.

This includes but is not limited to, continuous monitoring of policy and process compliance, governance, current application testing techniques, defects (bug) reporting and change control activities;

maintaining the integrity of the application and documentation repository; developing and maintaining configuration management plans; monitoring system configurations e.g. assessing and testing the level of compliance with established baseline configurations;

static and dynamic functional and regression applications testing &verification; static and dynamic application security testing; 508 compliance testing; mobile application testing, web portal testing, defects (bugs) reporting techniques; monitoring updates to baseline configurations; and configuration status of the enterprise IT environment.

Demonstrated experienced in providing overarching Continuous Quality Improvement program that is inclusive of processes, policies, governance and operations. It is incumbent upon the vendor to ensure the integrity and quality of applications and subsidiary products developed to support the execution of ETA/OIST’s mission. The vendor must be certified at a CMMI – Level 2 (for Services preferred).

DOL/OCIO’s Infrastructure Change Management

DOL/OCIO’s iCM is a closely focused and distinct specialty that places rigorous adherence to well-engineered processes, rigid quality assurance standards and quality control measurements, continuous and real-time enterprise IT infrastructure monitoring inclusive of all environments, rapid and precise management controls for responding to risks and unauthorized changes.

Infrastructure Change Management

ICM activities include all activities associated with monitoring and documenting DOL’s enterprise IT environments (Production Network/Data Center environment, QA/QC Testing environment, QA/QC UAT Testing environment and Developmental environments)

ICM shall document and annually update all DOL OCIO policies and procedures associated with Infrastructure Change Management

ICM shall identify and verify enterprise IT assets and configurations within the DOL enterprise IT environments.

ICM shall identify Configuration Items (CI) to include collecting, recording and maintaining accurate information about CIs.

ICM shall create, managing and maintain DOL’s CMDB.

ICM shall document all authorized and approved configuration changes to DOL’s IT enterprise infrastructure.

ICM shall develop, document, and maintain baseline configurations, configuration management plans, as well as system component inventories.

ICM shall monitor, manage and control all authorized changes, according to DOL OCIO policies and guidance, to the enterprise IT infrastructure.

ICM shall document and report all authorized changes made to DOL’s enterprise IT infrastructure to include but not limited to:

o Hardware o Software (GSS, COTS, Govt. developed application) o Firmware o Other

ICM shall report all unauthorized changes to the Enterprise IT infrastructure according to DOL Policies and guidelines.

ICM Develop and implement procedures to routinely monitor and manage hardware, software, and firmware configurations.

ICM shall routinely monitor changes to the configuration settings in accordance with DOL policies and procedures.

ICM shall develop, document and maintain baseline configurations of the Enterprise IT Infrastructure and shall provide this report at the beginning of each month to OCIO Federal Manager, and provide adhoc reports as requested.

ICM shall perform system administrative functions, e.g. major/minor software release version upgrades, service pack installations, software patch releases for OCIO’s CM operations:

OCIO Application Suite o Remedy ver. 7.x o Remedy ver. 8.x

ICM shall provide custom development applications and tools capabilities using current OCIO CM Software Suite to maximize efficiencies and/or to exploit the applications capabilities and deploy value-add tools that improve or enhances OCIO’s business operations.

ICM shall perform a variety of system engineering tasks and activities relative to current OCIO CM Software Suite.

ICM shall develop and maintain automated workflows that comply with CMMI II standards using software products owned by DOL:

Application Suite o Remedy ver. 7.x o Remedy ver. 8.x

ETA/OIST’s Change Management

In the broadest of terms, provides the framework from which processes are designed that governs the logical flow of any change type from initiation/creation, through technical review and vetting, to approval, implementation, monitoring, and reporting. Often, Change Management is thought of within the context of an organization’s IT infrastructure, hardware, firmware, Operating Systems and applications. CM is accountable to oversee a collection of processes that collectively bring about an assurance that a Change Request is meticulously vetted, and if approved, becomes a sanctioned change that is acted upon in a definitive manner, ensuring activities and resources are coordinated, stringent management controls are in place and monitoring validates only the authorized change, as approved, is implemented. Risk is well defined and risk response plans are in place to effectively mitigate the impact of any known risk should they occur. As a collective systematic approach to execution, these processes increase the likelihood of a successful change implementation, while reducing the probability an exposure to a new and unknown risk that could inadvertently result in an adverse condition affecting the system, the network or the enterprise’s IT infrastructure in total.

Software Change Management

ETA/OIST’s software change management (sCM) executes and manages change requests as they pertain to software applications development and the movement (promotions and demotions) of packages (code) to and from the application developer’s environment (target server) and the QC-IVV&T and UAT test environment (target servers), and when the application is ready, promotion of the code to the Production environment (target servers). SCM does not execute the “load” the application software on the target servers, that responsibility is managed and controlled by the OCIO’s Infrastructure Division. SCM also provides application and server hardware configuration base-lines, comparative base-line analysis, bandwidth monitoring, analysis and reporting, asset inventories, alarming of specified target servers and the management of the application software and document repository, it’s software and corresponding SQL databases. The database team manages the database and servers that other CM/QA software utilizes. SCM also assumes additional responsibilities that are unique to ETA/OIST QA Branch’s operations. SCM has is responsible for, preforming system administration duties for all of QA Branch’s core application suites, provides software application engineering to exploits the Branch’s core applications for uses in other business areas, e.g. the modules within CA Service Catalog application, such as, ARTS, SLA management, and the development of a Financial Charge-back system, Help Desk operations, process flows modification and statistical reporting. SCM also provides Tier 1-4 support for all QA Branch’s core applications.

SCM shall document and annually update all ETA/OIST sCM policies and procedures associated with software Change Management.

SCM shall promote packages according to DOL/OCIO and ETA/OIST Governance policies, regulations, and standard operating procedures regardless of environment.

SCM shall ensure all development and Production releases are strictly controlled under QA’s version control processes and Release Management policies.

SCM shall perform system administrative functions, e.g. major/minor software release version upgrades, service pack installations, software patch releases for QA Branch’s QA, sCM, QC-IVV&T application tool suites:

o ManageEngine

OPManager Net Flow Traffic Analyzer Security Manager Plus Asset Explorer o CA, Inc.

Software Change Manager

CMDB

Service Desk

Service Catalog o Hewlett-Packard (HP) Application Lifecycle Management Suite

Quality Center LoadRunner QuickTest Professional

SCM shall provide custom development capabilities for applications to maximize their efficiencies or to exploit the applications capabilities and deploy value-add tools that improve or enhances ETA/OIST business operations, e.g. ARTS, automated SLAs, Financial Charge Back system.

SCM shall perform, Identification of Configuration Items (CI) to include collecting, recording and maintaining accurate information about CIs.

SCM shall develop and maintain the organizations CMDB and provide reporting as required.

SCM shall maintain a current baseline configurations of the enterprise IT infrastructure pertaining to ETA hosted systems in all environments.

SCM shall maintain a current server mapping for all target servers used by ETA to host Production, Staging, Test, and Development environments.

SCM shall develop and maintain the organizations Knowledge Base in a Service Desk/Service Catalog solution.

Quality Assurance

Quality Assurance (QA) is responsible for the development of accurate workflows, processes and continuous process improvement and implementation of recommended process improvements; monitoring and auditing customer compliance to all QA Branch processes; ensure change control processes are consistent with ETA/OIST IT Governance policies;

ensuring QC-IVV&T is compliant with stated testing protocols and defect reporting requirements; audit mandatory federal 508 testing compliance, ensure NIST security testing for applications (code and web based), is completed prior to production release, ensure the Production application’s SDLCM documentation is consistent with the version or has been identified as a defect in the Defects Report, Audit version control compliance to ensure the application version in production is also the same as what is in the code repository and manages the Release Management package promotions/deployment to completion.

QA shall document and annually update all ETA/OIST organizational Quality Assurance policies and procedures specific to Quality Assurance, Quality Control-IVV&T, and software Change Management to include but not limited to:

o Version Control process, policy and SOP o Software Testing Protocol and Testing process, policy and

SOPs o Software Change Management processes, policy and SOPs o QA monitoring processes policy and SOPs o ETA/OIST’s organizational QA Change Management Plan o QA process improvement plan and SOPs

QA shall monitor compliance of the following processes:

o Change Control - IT Governance (OCMB, CCB and RMB).

o Applications software development (SDLCM).

o Software Change Management (process flows completed).

o Application Testing.

o Defect Reporting.

o Version Control of Production Product is same as that in the Application and documentation Repository.

o Accuracy and integrity of the application (code) and the supporting documentation stored in the Repository.

QA shall provide the QA Federal manager quarterly, the results and recommendations from their Total Quality Management process reviews.

QA shall audit the final product Testing Report and Defects Report against the Functional Design Document and Requirements Matrix to ensure Products meets defined requirements and customer expectations.

QA shall document and annually update Problem and Escalation Management processes and procedures.

QA shall document and annually update Organizational Configuration Management Plan.

QA shall assist the Federal PM with OIG audits and A-123 assessments QA shall assist the Federal Program Manager with tasks associated with meetings, (e.g., establishment of agenda, meeting minutes, tracking status of action items and deliverables, etc.) in the accomplishment of their assigned responsibilities and duties.

QA shall provide end-user training at least quarterly, for all commonly used application tools customers must use in the performance of their mission or job, e.g. submission of Change Requests, Developer testing, ARTS, Service Desk

Quality Control-Independent Verification, Validation & Testing

Quality Control-Independent Verification, Validation & Testing (QA- IVV&T) provides complete application life cycle testing according to Testing Protocols, Defects Reporting, Defect Deferments, and provides a comparative analysis of specific tests conducted and their alignment to the requirement listed in the Requirements Matrix. QC-IVV&T is also responsible for QC-IVV&T testing and to review and ensure the SDLCM documentation requirements are met and the documents accurately reflect the version of code being tested for Production release.

QC-IVV&T shall document the Testing process (aka Testing protocol) and the Standard Operating Procedure used in Testing. Each shall be in sufficient detail such that no ambiguity exists regarding what and how testing is conducted.

QC-IVV&T shall provide the following Software testing:

o Functional Applications Testing (Blackbox) o Regression Testing o Applications Load Testing o 508 Compliance Testing o Security (code level) Testing o Security Compliance Testing o Automated Testing

Actual testing delivered will be determined as each build/content is verified, based on the Government’s need (i.e., if Section 508 compliance checks are done by Development team on front end and DOL/CIO upon receipt, and through UAT by end users prior to deployment, there may not be a need for a fourth layer of additional Section 508 testing at CM/QA). The service provider shall ensure proper documentation for software releases, enhancements, and that defects are stored in accordance with DOL CM/QA policies.

QC-IVV&T shall review SDLCM documentation for accuracy with respect to applications version prior to Production release.

QC-IVV&T shall document and prepare a formal Defects Report upon completion of each testing cycle. The defects report shall contain at a minimum, the following three sections:

o All Found Defects o All Defects Deferred o Correlation of each test to its corresponding requirement in the Requirements Matrix

MAJOR TASKS

DOL/OCIO SPECIFIC TASKS

Four tasks are identified in this SOW with a detailed operational overview of what is required by DOL/OCIO.

Task 1: DOL/OCIO Configuration Management Plan

At a minimum, the contractor shall:

Develop, document, and update quarterly OCIO’s Enterprise IT Infrastructure Configuration Management Plans for the systems that includes pertinent information, such as roles, responsibilities, and configuration management processes and procedures.

Define Configuration Items (CI) for OCIO’s Enterprise IT Infrastructure information systems and ensure these items are controlled through OCIO’s Change Request process IWA DOL Policies and guidance.

Establish methods for identifying Configuration Items (CI) throughout the SDLCM and a process for managing the configuration of the configuration items

Other duties as assigned

Success Factors

Configuration Management Plans are clearly defined, timely completed/updated, accurate, and require no re-write.

CIs are well-defined and documented.

Documented Configuration Management Plans result in no audit finding for major systems.

Task 2: DOL/OCIO Baseline Configuration

At a minimum, the contractor shall:

Develop, document, and maintain baseline configurations for OCIOs enterprise IT infrastructure to include: hardware, software, and firmware throughout the SDLC. The baselines must include:

o List of hardware, software, and firmware components o Standard software load for workstations or laptops o Updated patch information o Logical placement within the systems architecture

Ensure configuration of OCIO enterprise IT infrastructure is consistent with the DOL Enterprise Architecture and Federal Enterprise Architecture.

Ensure the developed baseline configuration document is compliant with NIST approved configuration checklists.

Monitor the network to determine what software programs are running on the network against an approved list.

Generate a bi-weekly report for the Contracting Officer of all approved software and suspected unapproved software that is running on OCIO’s infrastructure to ensure appropriate remediation.

Review and update at least quarterly or when a change occurs as part of information system component installations the OCIO baseline configuration document(s).

Maintain baseline configuration documents under version control in order to support rollback activities (if necessary).

Review configuration setting and validate compliance with DOL’s configuration policies and procedures. Prepare and submit compliance report to the Federal Manager quarterly

Ensure security configuration and mandatory settings are implemented within all OCIO systems.

Other duties as assigned

Success factors

Due to implemented baseline configurations systems operational availability meets or exceeds 98% of required availability.

System security configurations are documented and on file.

System baseline configuration documents are clearly defined, timely completed/updated, accurate, and require no re-write.

Documented baseline configuration documents result in no audit finding for major systems.

Baseline configurations are compliant with applicable DOL and NIST approved configuration checklists or best practices.

Baselines configurations are updated within two weeks of changes from component installations and at the beginning of each new fiscal year

Task 3: DOL/OCIO Change Management Control

At a minimum, the contractor shall:

Manage configuration planning, change control, status accounting, and audits.

Assist OCIO in determining the types of changes to the agency’s systems that should be under configuration control.

Test, validate, and document changes to OCIO’s enterprise IT infrastructure according to DOL/OCIO policies before implementing the changes on production systems.

Manage systems source code and related SDLC documentation IWA OCIO policies and guidance.

Participate in OIG audits regarding OCIO processes, policies, requirements, status and findings.

Track, manage, and update Configuration Change Requests.

Ensure Promotion Deployments are executed on schedule Other duties as assigned

Success factors

Change Control processes result in improved system operations and services.

Tests results are documented and issues are adequately resolved prior to production implementation.

Change Control documents result in no audit finding for major systems.

Promotion of packages are executed according to the schedule 95% of the time

Task 4: DOL OCIO IT Asset Inventories and CMDB

At a minimum, the contractor shall:

Develop, document, and maintain system inventories, to include, but not limited to:

o Manufacturer o Model number o Serial number o Software license number o System/component owner

Develop, manage and update the OCIO CMDB.

Schedule and conduct routine asset inventories according to OCIO

Policies.

Provide the results of the Asset Inventory Report to the Federal

Manager.

Other duties as assigned.

Success factors:

System inventories are scheduled no less than 30 days prior to the event and they are clearly defined, timely completed/updated, and accurate.

System inventories shall have no degradation affect to the enterprise IT infrastructure

Asset Inventory Reports are provided to the Federal Manager with more than 3 later reports per fiscal year.

ETA/OIST SPECIFIC TASKS

There are thirteen (13) Tasks identified in this SOW with a detailed operational overview of what is required by the ETA/OIST QA Branch.

Task 1: Configuration Management Plan

At a minimum, the contractor shall:

Develop, document, and update quarterly configuration management plans for ETA systems that includes pertinent information, such as roles, responsibilities, and configuration management processes and procedures.

Define the configuration items for ETA’s information systems and ensure these items are controlled via configuration management.

Establish methods for identifying configuration items throughout the SDLC and a process for managing the configuration of the configuration items.

Other duties as assigned.

Success factors:

Configuration Management Plans are clearly defined, timely completed/updated, accurate, and require no re-write.

CIs are well-defined and documented.

Documented Configuration Management Plans result in no audit finding for major systems.

Task 2: Baseline Configuration

At a minimum, the contractor shall:

Develop, document, and maintain baseline configurations for ETA’s hardware, software, and firmware throughout the SDLC. The baselines must include:

o List of hardware, software, and firmware components.

o Standard software load for workstations or laptops.

o Updated patch information.

o Logical placement within the systems architecture.

Ensure configuration of ETA systems is consistent with the DOL Enterprise Architecture and Federal Enterprise Architecture.

Ensure the developed baseline configuration document is compliant with NIST approved configuration checklists.

Monitor the network to determine what software programs are running on the network against an approved list.

Generate a bi-weekly report for the Director of Infrastructure Operations of all approved software and suspected unapproved software that is running on the ETA infrastructure to ensure appropriate remediation.

Review and update at least quarterly or when a change occurs as part of information system component installations the ETA/OIST baseline configuration document(s).

Maintain baseline configuration documents under version control in order to support rollback activities (if necessary).

Review configuration setting and validate compliance with DOL’s and ETA’s configuration policies and procedures. Prepare and submit compliance report to the CM/QA manager quarterly.

Ensure security configuration and mandatory settings are implemented within ETA’s systems.

Other duties as assigned.

Success factors:

Due to implemented baseline configurations systems operational availability meets or exceeds 98% of required availability.

System security configurations are documented and on file.

System baseline configuration documents are clearly defined, timely completed/updated, accurate, and require no re-write.

Documented baseline configuration documents result in no audit finding for major systems.

Baseline configurations are compliant with applicable DOL and NIST approved configuration checklists or best practices.

Baselines configurations are updated within two weeks of changes from component installations and at the beginning of each new fiscal year

Task 3: Change Management Control

At a minimum, the contractor shall:

Manage configuration planning, change control, status accounting, and audits.

Assist ETA/OIST in determining the types of changes to the agency’s systems that should be under configuration control.

Develop, document, and maintain a configuration change control process e.g. OCCB, CAB and RM.

Test, validate, and document changes to ETA’s IT systems according to ETA/OIST policies before implementing the changes on production systems.

Manage systems source code and related SDLC documentation.

Work with cross-functional teams in product deployments and software releases.

Participate in OIG audits and A-123 assessments regarding CM/QA processes, policies, requirements, status and findings.

Track, manage, and update Configuration Change Requests.

Track problems and changes in documentation and software. Report changes and current configuration to CM/QA manager.

Promotion of packages are executed on schedule Other duties as assigned

Success factors:

Change Control processes result in improved system operations and services.

Tests results are documented and issues are adequately resolved prior to production implementation.

Change Control documents result in no audit finding for major systems.

Promotion of packages are executed according to the schedule 95% of the time

Task 4: IT Asset Inventories

At a minimum, the contractor shall:

Develop, document, and maintain system inventories, to include, but not limited to:

o Manufacturer o Model number o Serial number o Software license number o System/component owner

Development, management and updating ETA/OIST CMDB Schedule and conduct routine bi-weekly inventories according to

ETA/OIST’s component installation, removal, and update processes.

Provide the bi-weekly Inventory report to the Director of

Infrastructure Operations and Chief, CM/QA.

Other duties as assigned.

Success factors:

System inventories are clearly defined, timely completed/updated, and accurate.

System inventory information is updated bi-weekly.

Bi-weekly reports are provided to the Director of Infrastructure

Operations and Chief, CM/QA with not more than 3 later reports per fiscal year

Task 5: Training

At a minimum, the contractor shall:

Develop basic and advanced training curriculums and courses, including training manuals, for customers using current CM/QA/QC solutions (subject to change):

o CA Harvest Software Change Manager o CA Service Desk o CA Service Catalog o HP Quality Center

Deliver Quarterly classroom training, and desk side training as required, to customers using current CM/QA/QC solutions (subject to change):

o CA Harvest Software Change Manager o CA Service Desk o CA Service Catalog o HP Quality Center

Maintain a list of customers requiring training, and those that have completed training.

Provide customers a satisfaction survey upon completion of training.

Other duties as assigned.

Success factors:

Training documentation and handouts are current, relevant, and easy to read and understand.

Classroom training is conducted quarterly Training evaluations (feedback) are 95% positive.

Task 6: Application Systems Administration for CM/QA Core Applications

At a minimum, the contractor shall:

Perform requisite system administration activities to ensure CM/QA applications are properly installed, available, and operating as described by the Manufacturer product documentation. Below is a listing of the current CM/QA/QC solutions (subject to change).

ManageEngine o OPManager o Net Flow Traffic Analyzer o Security Manager Plus o Asset Explorer

CA, Inc.

o Software Change Manager o CMDB o Service Desk o Service Catalog

Hewlett-Packard (HP) Application Lifecycle Management Suite o Quality Center o LoadRunner o QuickTest Professional

Coordinate routine maintenance outages with customers and the Division of Infrastructure Operations no less than 5 days prior to schedule outage.

Notify customers of any application outages according to CM/QA policies.

Provide administrative customer services and support, e.g. add /delete /modify user accounts and privileges, help desk requests, trouble shooting, etc…, according to customer Service Level Agreements

Coordinate with the appropriate department/division for additional IT resources to ensure proper operations of CM/QA applications, e.g.

disk storage, routine backups and recovery, server/VMs, RAM, licensing, remote access, system privileges, etc…

Provide standard system reports within one business day and custom reports within 3 business days.

Ensure the Harvest file repository is routinely backed up and validate the data.

Other duties as assigned.

Success factors:

Availability of CM/QA applications shall exceed 98%.

Customer support shall meet standards established in the Service

Level Agreements.

Applications shall be maintained and updated to current published technical specifications e.g. major release version, minor release version, service packs, SW patches etc.

Task 7: Application Engineering

At a minimum, the contractor shall:

Perform a variety of system engineering tasks and activities relative to CM/QA operations.

Develop automated workflows that comply with CMMI level II standards using software products owned by ETA.

Develop Web enable management reports.

Design programs, code, test, and debug for systems and applications.

Collaborate with end users to define business requirements for complex systems development activities associated with Service Desk and Service Catalog.

Provide hands on Service Desk coding (design, develop, test, debug and implement applications and programs).

Success factors:

Automated workflows are designed and implemented according to ITIL best practices and CM/QA operational needs and direction.

Web enabled reports are accurate and are provided according to customer Service Level Agreement.

Systems and applications are error free.

Defined and document customer business requirements.

Obtain customer acceptance of deliverables with no major changes to the product as a result of missed business requirements.

Deliver end-state final product to customer on-time.

Task 8: Quality Assurance

At a minimum, the contractor shall:

Develop and execute the CM/QA vendor’s Quality Assurance Plan.

Develop Software Quality Assurance Plans for projects.

Develop and incorporate quality assurance standards, routinely monitor and randomly audit to ensure compliance.

Develop and track operational metrics for quality assurance of systems.

Verify that development of software products is in compliance with Governance Policies, Change Management Policies and processes, and formally report all violations to the Federal QA Branch Manager and Chief of IT Governance

Verify all SDLC documentation for systems/projects are complete and updated as required. Report all discrepancies to the Organization Configuration Management Board.

Validate the QA Branch’s Harvest file repository is routinely backed up and tested.

Resolve software related problems for CM/QA activities.

Success factors:

Plans and procedures conforms 100 percent to ETA/OIST requirements and has less than 5 errors (grammatical or typos).

Software related problems are resolved within 4 hours and propagation can be rolled back successfully if there are major errors.

Task 9: Quality Control Testing

At a minimum, the contractor shall:

Collaborate with software and system personnel in application testing to include system, functional, unit, regression, load, and acceptance testing.

Develop, write, revise, verifies quality standards and test procedures for systems and applications evaluations.

Create and execute test plans, scenarios, and scripts.

Provide the following Test services:

o Blackbox Testing o Regression Testing o Load-Testing o 508 Compliance Testing o Security Code Testing

Coordinate testing requirements.

Develops test data.

Create and updates QTP scripts.

Communicate test progress and results with customers, staff and management.

Analyze formal test results to discover defects, bugs, errors, configuration issues, and interoperability flaws.

Evaluate and test new or modified software programs used and verify that they function in accordance with user requirements and conform to ETA/OIST guidelines.

Maintains test plans and scripts.

Success factors:

All test results are maintained in a repository.

Findings as a result of testing are reported to project staff, ETA/OIST management,…