DRAFT AS_NG SOO_.docx

NONPUBLIC//FDIC INTERNAL ONLY

NONPUBLIC//FDIC INTERNAL ONLY

Acquisition System - Next Generation Statement of Objectives

Federal Deposit Insurance Corporation Division of Administration (DOA) Acquisition Services Branch (ASB)

1 Purpose The Federal Deposit Insurance Corporation (FDIC) is procuring and implementing an enterprise-level acquisition lifecycle solution – Appian Government Acquisition Management Solution (GAMS) – for contract writing (CW), contract filing (CF), and early acquisition planning (EAP) contract management. CW will enable Contracting Officers (COs) to create, update, and track solicitations and awards; Program Offices (POs) to nominate Oversight Managers (OMs) and appoint Technical Monitors (TMs); and for COs and OMs to initiate and monitor contractor performance evaluations. CF will allow users to easily store, access, and manage contract files and documents. EAP refers to the collaboration between COs and Program Offices to create, update, and track complete requirements package. Within the FDIC and throughout this Statement of Objectives (SOO), the new acquisition solution will be referred to as the Acquisition System-Next Generation (AS-NG). AS-NG is intended to significantly enhance the efficiency and effectiveness of activities across the acquisition lifecycle by automating and integrating acquisition workflows and processes used by key end users across the FDIC. It is also expected to improve compliance with policies and procedures by reducing workarounds to existing systems and manually performed tasks. Furthermore, it will expand transparency and enhance data-driven decisions by enabling robust reporting and data query capabilities.

The purpose of this SOO is to obtain required contractor support, licenses, software, and tools to develop and deploy AS-NG across the FDIC. The Awardee’s technical approach – to include specific tasks, performance standards, and the Quality Control Plan (QCP) – will be incorporated into the final contract as the Performance Work Statement (PWS). The FDIC’s desired PWS will focus on measurable performance standards rather than prescribed methods.

2 Background General The FDIC is a non-Federal Acquisition Regulation (FAR), non-appropriated agency that follows its own acquisition policy and procedures implemented by the Division of Administration (DOA), Acquisition Services Branch (ASB).

The Acquisition Services Branch (ASB) is responsible for awarding and administrating Contracts, Basic Ordering Agreements (BOAs), Receivership Basic Ordering Agreements (RBOAs), and Task Orders in support of the FDIC’s mission. ASB on average awards 425 new agreements/contracts and administers on average just over 900 agreements/contracts annually. The acquisition process is supported by a network of Oversight Managers (OMs) and Technical Monitors (TMs) whose roles are similar to those of Contracting Officer Representatives (CORs) in the FAR contracting environment.

Current Acquisition Systems and Tools AS-NG will replace the FDIC’s heavily customized contract writing system, the Automated Procurement System (APS). APS is a Commercial-off-the-Shelf (COTS) product built on an Appian platform running on Version 18.2. APS is supported on-premises and not in line with the FDIC’s cloud architecture. See Appendices B Contract Writing Business Process Models.

The FDIC uses visualization tools like Power BI and other tools listed in Figure 1, Technology Stack to build dashboards and reports based on APS and other FDIC enterprise data.

The FDIC will also replace its official contract document storage repository, Consolidated Document Information System – Contract Electronic Filing (CDIS-CEFile). CEFile is a component of CDIS, a centralized digital repository which utilizes Documentum. CDIS will not be replaced, however AS-NG’s contract filing module will replace the CEFile component.

The FDIC does not have an automated solution for early acquisition planning. These tasks are accomplished using Microsoft SharePoint and email.

Technology Stack Figure 1 is a representative Development, Security, and Operations (DevSecOps) toolchain that is part of an ecosystem that supports the FDIC’s product development. It is not a comprehensive list and includes only the major tech stacks and target platforms.

Figure 1 3 Scope The scope of this requirementincludes all services required to deliver a secure enterprise-level, end-to-end acquisition lifecycle solution consisting of three modules and associated functionalities described herein this SOO and Appendices across both mobile and desktop devices. The contractor shall provide all labor, management, tools, and materials to deliver a secure enterprise solution inclusive of program/project management, discovery & fit-gap, configuration & development, data & information management, testing & QA, security & compliance, ATO, deployment & cutover, training & OCM, operations & maintenance, and continuous improvement. Support includes acquiring GAMS software licenses, creating interfaces to FDIC’s training system, financial systems, and other required databases, and migrating documents and data from two legacy systems, APS and CDIS/CEFile. AS-NG modules and expected timelines are listed below in priority order. The expectation is that the system will be developed iteratively across three functional modules, with capabilities delivered through timeboxed sprints. Development of modules may occur in parallel.

The Contractor is responsible for acquiring and maintaining licenses required for this solution. In this role, the Contractor shall propose details of their business licensing model, licensing agreement (e.g., enterprise, seat, user, filings, etc.) including quantities, costs, duration of support, and related provisions, including any changes that happen during the life of the product or contract duration (e.g., portability of licenses).

The FDIC projects approximately 1100 people will need to be trained in the new solution based on roles assigned (i.e., CO, Oversight Manager (OM), Technical Monitor (TM), System Administrators).

4 General Approach The FDIC’s preferred approach is the use of Agile methodologies focused on iterative delivery, flexibility, collaboration, and rapid development, breaking projects into small, manageable cycles (sprints) to adapt to change and incorporate continuous customer feedback, prioritizing working software, people, and responding to evolving needs. Approach shall also utilize user-centered feedback and design to include software that is easy to learn and navigate, allowing users to accomplish tasks efficiently while creating an enjoyable and engaging experience for users.

The contractor's Agile development team shall work closely with FDIC’s Program Manager, Product Owner, Data Team, and end users to ensure cross-functional collaboration.

In support of Agile development, the Contractor shall:

· Develop/enhance Product Vision and Goal, Product Roadmap, and the ongoing process of refining and prioritizing the product backlog (new features, bug fixes, enhancements, technical work) including clear acceptance criteria, estimating size of user stories and sprint timeframes. Also assist in the development of Constraints, Limitations, Users, and Exclusions (CLUE) to help focus development team and prevent scope creep during a sprint. See Appendix A: User Stories.

· Design, code, test, and deliver functional software increments and supporting artifacts based on refined, prioritized product backlog and user stories.

· Support Continuous Integration (CI) and Continuous Delivery (C/D) to trigger automated builds and tests to catch bugs early, and ensure code is always ready to deploy.

· Identify, document, and track all system components (code, documentation, servers) to ensure system integrity, consistency, and traceability throughout the software lifecycle to include process for reviewing, approving, and implementing changes to those assets to minimize risks.

· Plan, create, and validate scripts for AS-NG deployment, directly support AS-NG deployment and provide release planning and management support.

· Work daily to include daily stand-up meetings to synchronize progress, discuss blockers, and align goals.

Note: This list is not meant to be comprehensive, but to illustrate the FDIC’s desire to have a solution built using Agile methodologies.

5 Objectives

5.1 Implement Appian GAMS to meet the User Stories in Appendix A and acts as an integrated, secure, compliant, and searchable repository that streamlines the FDIC contract lifecycle; key features include automated document assembly with templates and clause libraries, process automation and workflows, document management and search, e-signature integration, version control and collaboration, contract portfolio reporting to track and manage KPIs, customizable reporting/analytics.

5.2 Provide a user-centric approach where everything starts with understanding the users’ needs, prototyping solutions, testing, and iterating, ensuring the final product is intuitive, accessible, and meets business goals. Provide Usability Testing that evaluates the products developed by testing them with a representative set of users to learn if participants are able to complete specified tasks successfully, identify how long it takes to complete specified tasks, and discover how satisfied participants are with the product.

5.3 Provide a Security Plan to include security standards and best practices through all stages of development to include but not limited to:

· Compliance with applicable FDIC security standards for technology and data requirements, NIST

· Remediation of security issues identified by the FDIC’s Information Security and Privacy Programs

· Supporting efforts related to establishing and maintaining the FDIC Authorities to Operate (ATOs)

· Ensuring data protection, integrity, and privacy requirements are designed and adhered to.

· Protecting information used, gathered, or developed under this contract and for the implementation of security controls identified in the FedRAMP package

5.4 Provide a solution that complies with FedRAMP security requirements and assessment framework and provides sufficient detailed documentation to enable the FDIC to review all assessment processes, activities, results, and conclusions. Provide core FedRAMP documentation for FDIC’s review to include:

· System Security Plan (SSP)

· Security Assessment Plan (SAP)

· Security Assessment Report (SAR)

· Plan of Action and Milestone (POA&M); POA&M should reflect any findings discovered in the annual controls assessment

· Continuous Monitoring Plan

· Vulnerability Deviation Request form(s), if applicable

· Solution Penetration Testing Results, if applicable

· Third Party Assessment Organization’s (3PAO’s) security assessment and continuous monitoring findings to include how the Contractor addressed findings

· Open Web Solution Security; solution must be free from Open Web Solution Security Project (OWASP) Top 10 vulnerabilities.

5.5 Provide a solution that complies with FDIC Disaster Recovery plan if/when necessary to the FDIC for review:

· At a minimum, the disaster recovery plan shall include the procedures for testing the plan.

· The contractor shall provide the results of most recent testing of their disaster recovery plan.

· The Maximum Time for Downtime (MTD) should not be greater than 72 clock hours.

· The solution shall support multi-factor authentication.

5.6 Provide a solution that is configured to support Single Sign-On (SSO) to support user authentication.

5.7 Provide a solution that scales to accommodate 10% quarterly growth without any degradation of system performance.

5.8 Provide a solution that conforms to the FDIC style guidelines.

5.9 Provide a solution that complies with Section 508 requirements and provide a voluntary product accessibility template (VPAT) to FDIC for review.

5.10 Provide a solution that delivers best in class database design, development, implementation and management practices and techniques to deliver effective data structure for optimal data management and retrieval – to include easy to maintain and cost-effective data storage in a manner that improves data consistency.

5.11 The Contractor shall actively participate in transition activities in support of a smooth transition of support responsibilities to/from the FDIC and other Contractors.

5.12 Establish and maintain an automated test suite for the purpose of performing testing to ensure functionality and quality of the digital solutions delivered. This type of testing includes but is not limited to user interface testing, API testing, performance testing, and code quality testing. Additionally, testing methodologies such as Behavior Driven Development (BDD), Test Driven Development (TDD), and Acceptance Test Driven Development (ATDD) should be considered. The overarching goal is to ensure a reduction in the number of test cases ran manually and improve testing time and test coverage. In addition, provide a Test Plan detailing objectives, resources, and processes.

5.13 Provide a solution that ensures audit tracking to automatically and chronologically record activities, events, and changes to data to create a secure audit log with reporting capabilities.

5.14 Provide an approach that includes a structured, Section 508 compliant training focused on user adoption through tailored FDIC specific, role-specific learning, onsite sessions, role-based training, hands-on practice, simulations to complete an action (i.e., issue a solicitation) and a clear explanation of benefits and continuous support. Provide a training plan that includes type and frequency of training, and develop training in different formats, including training videos/tutorials/job aids, including webinars and workshops to provide live, interactive training, one-on-one coaching, user guides and FAQ for quick reference. Provide training and training material updates on time and to standards as required. Provide training material that includes online course published as a Sharable Content Object Reference Model (SCORM 1.2) package.

5.15 Provide a solution approach for organizational change management to include stakeholder analysis and management, regular, consistent communications to stakeholders, training and education, and support and feedback in the form of a help desk or support structure for troubleshooting and gathering feedback for continuous improvement.

5.16 The Contractor will migrate data and documents from legacy systems to AS-NG. See Appendix C: Data Migration Business Requirements. The Contractor shall provide a Data and Document Migration and Validation Plan to guide efforts and ensure successful migration.

5.17 The Contractor will provide a Data Management Plan detailing data collection, organization, storage, security, and sharing of data during and after project is completed.

5.18 Provide a solution with rich reporting capabilities to include visual, interactive dashboards, automated and scheduled reports, ability to apply various reporting criteria (i.e., filtering, sorting, field selections) so reports can be tailored to meet specific needs, drilldown capability down to the lowest level of data, and ability to generate metrics for various activities and actively monitor (i.e., Procurement Administrative Lead Time (PALT), Clause Report, User Access Report).

5.19 Provide comprehensive system documentation defined as comprehensive blueprint of a system (software, hardware, or process), detailing its design, components, architecture, operation, and maintenance, serving as a vital reference for developers, admins, and users to ensure consistency, facilitate updates, and enable seamless knowledge transfer. It includes requirements, design specs, source code, and user guides, acting as an "owner's manual" to prevent chaos during changes or issues.

Documentation will be provided that supports internal developers and system administrators (architecture, code, setup), external for customers (tutorials, job aids, FAQs), and process-oriented (internal workflows and standards). Key components include:

· Requirements: What the system needs to do (Product Requirements Document - PRD).

· Architecture: High-level design, component relationships, and dependencies.

· Design Decisions: Rationale behind key choices.

· Source Code Documentation: Explanations within the code itself.

· Operational Procedures: How to deploy, configure, and maintain the system.

· User Guides: Tutorials and FAQs for end-users.

· Quality Assurance: Testing documentation

5.20 Provide real-time, business-facing metrics through configurable dashboards in the FDIC’s designated Agile Management Tool (GitHub); reporting also includes Agile burn down charts, release roadmaps, and schedules.

5.21 Provide Application Support Service Level Agreements (SLAs )and associated Key Performance Indictors (KPIs), such as uptime, response time, and resolution time. Metrics will include title, description, methodology for measuring/calculating, and frequency. AS-NG is a mission critical system and if it experienced any outage or any major failures the FDIC would experience a work stoppage in a critical business operation.

5.22 Provide Agile Software Performance KPIs to track team productivity, project progress, and workload efficiency including metrics with title, description, methodology for measuring/calculating, and frequency.

5.23 Provide a System Implementation Plan detailing how AS-NG will be installed, configured, and deployed.

5.24 Provide a Transition Plan detailing how services, knowledge, and assets will be transitioned to a follow-on contractor or Government entity at contract completion.

6 Deliverables The Contractor shall provide deliverables to the assigned FDIC OM and TM electronically and in the format specified via email by the close of business day 4:30 PM EST Monday through Friday. All deliverables submitted (uploaded) in electronic format shall be free of any known computer virus or defects. If a virus or defect is found, the deliverable will not be accepted. The replacement file shall be provided within two (2) business days after notification of the presence of a virus.

The initial format for most deliverables will be a standard Microsoft Office format however the FDIC is continuing to evolve its application development process and practices. When requested, the Contractor shall use these new technologies in the submission of deliverables.

7 Place of Performance Contractor support will be provided virtually and in-person, when necessary and approved. In-person support will take place at FDIC Offices located in Arlington, Virginia and/or Dallas, Texas.

8 Contractor Personnel Work will be completed using Agile Methodologies. The Contractor shall determine number of teams and size of teams and may offer up options as a part of their proposal. The Contractor shall ensure team(s) is/are cross-functional and possess all the necessary skills (coding, testing, designing, analysis, etc.) to complete tasks independently and to meet or exceed objectives discussed throughout this SOO.

All Contractor personnel shall possess professional proficiency, experience, knowledge, and skills to successfully perform the required tasks in an Agile manner while also adhering to the principles of an DevSecOps environment. The Contractor shall ensure that its contractor personnel and subcontractors maintain any required professional certifications, accreditations, and proficiency relative to their areas of expertise.

In addition, the Contractor shall ensure the team(s) is/are self-organized with the ability to manage workload, identify tasks, and decide how to turn product backlog items into working, tested, high quality software while also being customer-centric focused and using customer feedback to pivot and refine the product as necessary.

As the work progresses or evolves, the Contractor shall adjust its team composition as appropriate to the new needs and with the approval of the FDIC OM. Key personnel changes require a modification to the contract.

Contractor Personnel Bench It is expected that the Contractor will have a bench of FDIC cleared contractor personnel who can act as substitutes for team members who may be absent. The Contractor bench staff shall have a breadth of skills and experience sufficient for them to effectively pick up the work of absent Team colleagues on a temporary basis.

Key Personnel The following roles are designated as key personnel:

· Program/Project Manager

· Scrum Master/Team Coach

· Solution Architect

· Lead Developer

· Change Manager

The Contractor is responsible for any appropriate pre-screening to ensure all submitted candidates will achieve timely suitability adjudications (here, timely means within six weeks). Contractor personnel shall have the required qualifications, knowledge, skills, and experience to perform the work assigned to the team. The CO may require, in writing, that the Contractor remove any contractor personnel from the Contract the CO deems low-contributing, careless, unprofessional, or otherwise objectionable.

Project Manager Project Manager (PM) responsible for serving as the single POC for the FDIC OM, TM, and PM. The PM shall be responsible for the reporting and deliverables that are addressed in this SOO, as well as coordination of all the onboarding and off boarding activities associated with this Contract. The PM requires a Bachelors Degree and have experience implementing Appian Platform solutions, with Graduate degree and specific GAMS experience preferred, as well as experience in problem-solving, advanced proficiency in analysis, leadership, and communication skills (verbal and written) and a proven record of working well in a team environment.

Scrum Master The Contractor shall provide a Scrum Master who is responsible for facilitating continuous improvement at the overall program level for AS-NG. This role helps to educate the team(s) to ensure that the agreed agile processes are followed.

Solution Architect The Contractor shall provide a Solution Architect to design and manage the end-to-end architecture of an Appian solution and ensure that all the components of the solution integrate with FDIC architecture. The Solution Architecture must have experience in Appian GAMS projects similar in scope, size and complexity to the requirements for AS-NG.

Lead Developer (LD) The Contractor shall provide a LD with experience developing code and leading development teams in the Appian technology. The LD must have expert knowledge of the software tools, platforms, and processes required to support the associated technology tower and Microsoft suite of tools, SAP, PS, ETL tools and/or other package software applications. The LD must also have expert knowledge of databases and related tools and utilities (as applicable above).

Change Manager (CM) The Contractor shall provide a Change Manger with experience in projects similar in scope, size and complexity to the requirements for AS-NG.

9 Appendices

Appendix A – User Stories Appendix B – Contract Writing Business Process Models Appendix C – Data Migration Business Requirements Appendix D – System Security Assessment and Authorization Requirements Appendix E – Service Level Agreements image1.png image2.png image3.jpg image4.png