Draft DMS PWS.pdf

Draft Performance Work Statement for

Rural Development Automated Systems Development Modernization and Enhancement (DME)

XX April 2024

Contents

1 INTRODUCTION

2 BACKGROUND

2.1 Scope

2.2 Current Operations and Technical Environment

3 TASKS

3.1 Program Management

3.1.1 Training

3.2 Development, Maintenance and Enhancement (DME)

3.2.1 Requirements Definition

3.2.2 Development/Configuration

3.2.3 Deployment

3.3 Operations & Maintenance (O&M)

3.4 Definition of Done

3.5 Deliverables

4 CONTRACT ADMINISTRATION

4.1 Place of Performance

4.2 Period of Performance

4.3 Days and Hours of Performance

4.4 Invoicing

4.5 Type of Contract

4.6 Government Furnished Equipment

4.6.1 Validation of Government Furnished Items (GFI) and Equipment Inventory

4.7 Key Personnel

4.8 Contractor Personnel

5 SECURITY

5.1 General Information

5.1.1 Intellectual Property

5.1.2 Data Ownership

5.1.3 Data Security

6 SECTION 508

6.1 Accessibility of Information and Communications Technology

6.2 Compliance

7 ACRONYMS/DEFINITIONS

8 LIST OF ATTACHMENTS

1 INTRODUCTION

The United States Department of Agriculture’s (USDA) Rural Development (RD) Assistant Chief Information Officer (ACIO) is responsible for developing, maintaining, and operating a portfolio of automated systems in support of RD’s core services: Rural Business Cooperative Service (RBS); Rural Housing Service (RHS); and Rural Utilities Service (RUS). Each Agency offers programs that provide financial assistance in the form of guaranteed loans, direct loans, and grants to help businesses grow, improve housing and essential community facilities, and finance infrastructure in rural areas.

2 BACKGROUND

2.1 Scope

The scope of this effort is development, modernization, and enhancements (DME) of RD business applications and capabilities, platform, and licensing support, such as

• Requirements Definition, Discovery meetings and overall Program advancement of the system capabilities

• Development and Configuration of new and existing Applications and Portal

• Operations & Maintenance of RD digital services environment and platform

• Legacy Application and/or System Modernization & Transition

• Initiatives including (IT Operations Management, IT Service Management, IT

Asset Management, IT Business Management)

• Incorporation of other major USDA initiatives should the Contractor provide an efficient and cost-effective solution.

It also incorporates maturing RD’s scaled agile framework (SAFe) software development methodology utilized with scale to meet mission needs.

2.2 Current Operations and Technical Environment

Figure 1: Jira Workflow Status for Themes, Epics, Capabilities, Features, Enablers, Tasks, Subtasks, and Issues

3 TASKS

3.1 Program Management

The Contractor shall provide comprehensive program management and shall work with the RD project manager to manage and coordinate all workflows and activities. Program management shall include the following focus areas.

• Quality Management – The Contractor shall define the quality management approach and institute quality control and assurance processes. This includes ensuring all design, development, and configuration documentation is delivered and accepted by the RD product owner.

• Risk, Issue, and Task Management – The Contractor shall support risk, issue, and task management planning including identification, analysis, response planning, risk control, and status reporting activities. The Contractor shall develop and maintain a Risk and Issue Log to document these throughout the course of the project.

• Communications Management – The Contractor shall support communications management planning and general communications including the development of a communications plan and communication materials. Communications may include both internal and external stakeholders and oral, written, and electronic (e.g., web portals) means. The communications management plan shall document at a minimum the communication objectives, channels, frequency, and timing by stakeholder group.

• Project Information/Documentation Management – The Contractor shall establish a document library where all design, development, test, change management plans, and all work products the Contractor creates for the RD will be stored.

• Project Integration Management – The Contractor shall identify, define, and coordinate all workflows to establish an integrated transition strategy. This includes developing, preparing, coordinating, and maintaining a comprehensive project plan to effectively manage and control project activities, resources, and cost.

• Project Analysis and Presentation Development – The Contractor shall conduct analysis and develop presentations and or reports in support of achieving PWS objectives.

3.1.1 Training

The Contractor shall provide training services for both RD and contractor personnel who will operate, maintain, and use the new environment. For all processes listed in this PWS, the Contractor shall train the cognizant RD subject matter expert (SME) on the new processes so that they can assist stakeholders and provide training for end users following contract conclusion.

3.2 Development, Maintenance and Enhancement (DME)

The following paragraphs describe the general requirements and deliverables for Requirements Definition, Development/Configuration, and Deployment.

3.2.1 Requirements Definition

The Contractor shall facilitate kick-off meetings for each requirements sprint. The Contractor shall engage stakeholders from across the RD Mission Areas to achieve these objectives:

• Define measurable and objective stakeholder requirements.

• Identify RD leads and subject matter experts to support requirements definition.

• Collect data, procedures, delegations of authority, and other information about the RD environment to gain an understanding before configuring applications.

• Develop project charter and gain clarification on business requirements.

The Contractor shall perform engagement preparation and identify RD expectations and requirements by facilitating workshops for each module to review the process guides, out of the box (“OOTB”) forms, fields and workflows, and identify the gap between the OOTB features and functions versus RD’s current state process. The Contractor shall develop draft and final requirements, design, and specification documents for development. The Contractor shall write, refine, and prioritize user stories and journey maps required to support the agreed upon process flow, data and form requirements, and shall manage the configuration, release and testing of Themes, Sprints, Epics, and Stories in coordination with the COR.

The Contractor shall develop the requirements for establishing a robust Knowledge Base for each sprint. To include:

• Design the vision and strategy for self-service, facilitated by the Knowledge Base

• Develop a project plan for implementation

• Create knowledge base articles and templates; this includes development of frequently asked questions (e.g., relating to process, forms, policies, and procedures) and answers based on existing documentation, including information gathered from interviews and design sessions

• Validate the strategy and FAQs with RD stakeholders

• Identify which Knowledge Base items must be developed by RD

With RD involvement and approval, the Contractor shall develop the plans to support future development and deployment. Specifically, the Contractor shall develop the User Acceptance Test (UAT) strategy and Training & Change Management Plan.

Additionally, the Training & Change Management Plan shall:

• Segment stakeholders (e.g., based on user roles)

• Define the training and change management plan for each stakeholder group o Training objectives o Identify stakeholder needs and strategies for encouraging acceptance and adoption of new operating procedures o Training materials and tools (e.g., videos, written user guides, guided tours, standard operating procedures) needed for each stakeholder group o Training delivery options and recommendations (e.g., live webinars, recordings)

• Strategy for identifying and implementing a “train the trainer” and “super users” within each functional area

• Plan to leverage and maximize use of Knowledge Base

• Identify required communications (e.g., training notices), objectives of the communication, communication medium (e.g., targeted emails, newsletters, one-on-one interactions with leadership groups)

• Develop an integrated training schedule that shows sequencing and potential “grouping” of training and communications to each stakeholder group.

3.2.2 Development/Configuration

The Contractor shall develop applications and modules using Agile methods. Applications and modules shall support services request intake, assignment, tracking, and closeout. The modules will be developed to provide functionality. The applications and modules will include customer satisfaction feedback loop, external links, data analytics and accessibility. The Contractor shall also set up roles, credentials, server connections, entry points, pattern mapping, and discovery schedules.

Development and configuration of RD applications shall achieve the following:

• Request – The application will provide access to all RD customers (internal and external) using existing USDA credential, so that those employees can create service requests for administrative services across the entire range of functional areas and categories. The application will provide statuses and notifications at key milestones in the life cycle of the service request.

• Workflow – The application shall have robust tracking and workflow functionalities, with workflow automation and flexible configuration, data and business rules enforcement and the ability to easily reconfigure workflows to quickly respond to future business process changes.

• Integrated – The application shall be integrated (or designed for future integration) with Federal, USDA, and other tools and systems. This may include, but is not limited to electronic document management, electronic plan review, interactive voice response, electronic payment, geographic information, financial management, management reporting, billing, etc.

• Assign – The application will provide unique access to all administrative service agents using existing USDA credential, so that they can receive the service requests. The application will support the use of known data about each RD user such as role, location, to provide direction and workflow of service requests to respective teams and individuals. The application will provide statuses and notifications at key milestones in the life cycle of the service request.

• Track – The application shall provide for robust workflow and tracking functionality that allows RD users to view their requested services and tickets, including pending, in-progress, and closed requests, as well as allow individuals to monitor and track details including status and history of request through the service request lifecycle, including request level metrics like resolution time among others.

• Closeout – The application will support closure of the service requests when the work on the request is complete and resolved. The application will provide statuses and notifications at key milestones in the life cycle of the service request as required by RD. The application will also support the ability to re-open and re-assignment of service requests based on either pre-defined business rules and scenarios, or as requested by one of the authorized individuals related to the request.

• Customer Satisfaction Feedback loop – The application will support automation of customer feedback loop at the completion of each service request action and stage. Feedback metrics will also be available as metrics for reporting.

• Knowledge Base – The Contractor shall establish Knowledge Base articles relevant to each sprint, including links to appropriate sites, forms, and other artifacts.

• Data analytics – The application shall have end user friendly ad-hoc reporting functionality. It shall support reporting, analytics, and dashboard of various service management metrics and KPIs, in both static as well as dynamic (real time) reports and dashboards. The Contractor shall develop customized reports and dashboards for several levels of the organization (e.g., service providers, customers, managers, RD leadership).

During the Development/Configuration phase, the Contractor shall also develop the training course outline, course materials, and related content in preparation for deployment. The COR shall approve the training course outline prior to the Contractor creating course materials and related content (e.g., quick reference guides, standard operating procedures, handbooks).

3.2.3 Deployment

The Contractor shall prepare an Agile Release Train (ART) to collaboratively facilitate execution of pre-determined and ad hoc ART launch readiness activities with the Program’s stakeholder community. The Contractor shall determine the ART launch date which facilitates the determination of the program’s cadence, enabling the creation of a roadmap with known milestones, including program implement planning sessions.

The Contractor shall host daily standups and the Scrum Masters will meet with the Product Owners daily to collaborate and make decisions. The schedule may be modified if approved by the CO, COR, COR Advisor and Agency Program Manager.

The Contractor shall communicate a Release Plan that identifies deployment procedures, dependencies, and potential mitigations for each release, in conjunction with established Stage Gate Review (SGR) documents and procedures. The Contractor shall prepare Release Notes to explain functionality of the user story in the release. Release notes should contain, at a minimum, the following information:

• Release Name

• Release version #

• Release date

• Summary of all changes made

• Any epics with linked features in the release with each epic’s Jira ID, title, and

ReConnect module, e.g., Intake, Community Connect, PNF/PNR, Infrastructure and Broadband affected

• Any features with linked stories in the release with each feature’s Jira ID, title, and RD module affected

• Any user stories in the release with each story’s Jira ID, title, RD module affected, and short description

At the conclusion of each PI, the Contractor shall facilitate, document, and deliver a report for a PI Retrospective in line with Agile principles to capture and apply lessons learned for work completed during the Program Increment, including, but not limited, to development or testing processes or team composition.

3.3 Operations & Maintenance (O&M)

The Contractor shall provide RD with documentation on the operation and maintenance of released products, including, but not limited to, architecture designs, interconnections, data mappings, and data schemas including Entity Relationship Diagram (ERD), Data Flow diagram (DFD), Logical Data Model (LDM), Physical Data Model (PDM), Business Process Flow Diagram (BFPD), Data Dictionary (DD) In preparation and support of Sprint Planning, the Contractor shall support the Product Owner(s) in:

• Preparing detailed User Stories that align with the functional requirements for the application.

• Developing each User Story to be unitary, consistent, non-conjugated, traceable, current, unambiguous, testable, and prioritized.

• Estimating the relative complexity of each User Story prioritized for a sprint using Story Points or another quantifiable, relative value scale.

• Ensuring that the method of estimation is an industry standard for Agile software development, which may include any combination of expert opinion, Planning Poker, PERT, Affinity Mapping, or other establish method. The Contractor shall maintain sufficiently detailed records of how each User Story, Enablers, Bugs, Subtasks etc.) was estimated, so that post estimate analysis may be performed to assess the accuracy of each estimate, and so that future changes to an estimate are accurate.

• Identifying dependencies between User Stories, including predecessors, successors, and enabler stories.

Within each sprint, the Contractor shall:

• Implement all functional requirements assigned to the sprint during Sprint

Planning.

• Prepare User Stories for the next sprint.

• Collaborate with RDTO personnel, stakeholders, and business owners to implement features and enhancements to the application and/or associated platforms, such as Salesforce and MuleSoft.

• Utilize DevOps techniques. Specifically,

• Utilize a configuration management tool such as Git or other approved tool, that supports multiple concurrent development branches

• Utilize a build engine, such as Jenkins or other approved tool, that supports automated Unit Testing upon code check-in and branch merge.

• Perform manual Unit Testing upon new/changed code, triggers, and other applicable elements.

• Implement automated Unit Testing upon code check-in or branch merge to execute specified Unit Tests and gather Unit Test coverage metrics to include the following: statement, branch, path, and class coverage, and other such metrics as identified by the Quality Management team.

• Implement automated Unit Testing sufficiently to meet or exceed all of the following metrics: 75% Unit Testing coverage for lines of code; 75% Unit Testing coverage of branches in branching statements; 50% Unit Testing coverage of Cyclomatic Complexity code paths; 75% of lines of code in exception handling code blocks (catch-throw-finally, or equivalent); ensure that the full set of all Unit Tests for the application utilize each code class at least once. Unit Test coverage guidelines should include code applicable to positive testing and code applicable to handling exceptions during negative testing. All unit tests metrics and results must be included in Unit Testing reporting.

• Utilize a build engine, such as Jenkins or other approved tool, that provides automated deployment of the application to a system integration / QA environment, after automated Unit Tests have executed and passed. This will enable QA testing to begin as soon as development and Unit Testing are successfully completed and prevents arbitrary delays in QA testing by forcing QA to wait until the end of a Sprint.

The Contractor will support RD QA test management with correct use of Jira testing plugins.

• Provide support to ensure that tests are tracked via Jira, and traceability from any test to appropriate User Story, bug, or other Jira issue is complete and correct.

• Provide support to transition any tests written in Excel or other file formats to a Jira test plugin or other applicable tool within RD’s IT Tool Chain.

The Contractor shall collaborate and coordinate with the Product Owners to determine the Objectives of each sprint. The scope of each sprint shall be defined by the new and backlog items (list of tasks to be completed during the sprint to achieve that goal) assigned to the sprint in Sprint Planning.

The Contractor shall collaborate and coordinate with Product Owners to obtain a sprint signoff with zero defects (Functional testing) in an approved environment for all functions developed/modified in current sprint by providing login credentials for appropriate user roles, test scripts and expected test results. The Contractor shall collaborate and coordinate with QA team to obtain a sprint signoff with zero defects (Functional testing + 508 testing) in an approved environment by QA team (CI, etc.) for all functions developed / modified in the current sprint by providing login credentials for appropriate user roles, automated test scripts and expected test results Changes to the Sprint length shall be mutually agreed to by the COR, vendor, Product Manager, Program Manager and Product Owners based on the requirements of the DME work and the frequency in which these requirements may change. RD may evaluate completeness as part of its backlog management, feature prioritization, and SAFe delivery program.

Contractor documentation on the operation and maintenance of developed products include architecture designs, interconnections, data mappings, and data schemas including Entity Relationship Diagram (ERD), Data Flow diagram (DFD), Logical Data Model (LDM), Physical Data Model (PDM), Business Process Flow Diagram (BFPD), Data Dictionary (DD)

At the conclusion of each Iteration, the Contractor shall provide a demonstration (Iteration Demo) of all work completed in the Iteration. The demo cannot have features that do not work properly. At the conclusion of each PI, the Contractor will provide a demonstration (Solution Demo) of any software developed and/or to be deployed in that PI.

At the beginning of the PI, the Contractor shall work with the Program Staff to write SMART (Specific, Measurable, Achievable, realistic, and Time-bound) PI Objectives, assign the Business Value of all Business Objectives for the PI per team and combined PI Objectives for the Program. At the end of the PI, the Contractor shall work with the Program Staff to assess the Business Value of all Business Objectives completed in the PI.

3.4 Definition of Done

For this PWS and the increments delivered, the Contractor shall use the following definition of done:

Item Definition of Done User Story • Any configuration, APEX, Visualforce, or Lightning component code meets RD configuration/coding standards

• A functional test meets acceptance criteria

• A code/configuration review is conducted

• Passes the unit test

• Configuration/code is checked in to the RD repository

• Potentially releasable code or configuration is checked in to the appropriate repository

• All Unit Tests and Functional Tests pass successfully

• Integration and Regression Testing is performed on the product after defect remediation

• No Blocker, Critical or High defects are in the Defect Report

• Technical documents are updated based on the functionality delivered

• User Story acceptance criteria is met as described in the acceptance criteria

Release •All levels of testing are complete, including 508 testing by the USDA Accessibility Team and Security Vulnerability testing by the RDTO Security Engineering Team, and the results are accepted by RD and completed as per User Story acceptance criteria

• All required deliverables are completed and accepted by RD

• No Blocker, Critical or High defects are in the Defect Report

• The configuration/code is successfully migrated to the Production environment and is available to end users

• The RD Technology Office provides final approval to release the product to Production as per the SDLC

3.5 Deliverables

The Contractor shall submit draft and final documents, using Microsoft Office document types, to the RD electronically. RD requires 5 business days for review and submission of written comments to the contractor on draft and final documents. The Contractor shall make revisions to the deliverables and incorporate the RD’s comments into draft and final deliverables before submission. Upon receipt of the RD’s comments, the Contractor shall have 3 business days to incorporate the RD’s comments and/or change requests and to resubmit the deliverable in its final form.

Non-conforming products or services will be rejected. Deficiencies will be corrected by the Contractor within 3 business days of the rejection notice. If the deficiencies cannot be corrected within 3 business days, the Contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within 2 business days.

Deliverable/ Item Title

Description Frequency Submit To Due By

Onboarding Status Report

This report is to include all relevant details of the onboarding process, including but not limited to:

1. All outstanding onboarding requests that need to be reviewed by the

COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

Weekly Via email to

COR

Coordinate with COR to determine the most appropriate day of the week

Monthly Status Report Monthly report documenting: actual and target work progress, completed and planned activities, and deviations from the scheduled milestones.

Once per month Via email to

COR

The 5th day of each month after POP begins

Weekly Status Reports Weekly Report documenting actual and target work progress completed, planned activities, deviations from schedule, Risks, and Issues

Weekly Microsoft Doc/PowerPoint delivered Via email to Government Lead

Monday of the week following.

Monthly deliverable listing

Listing of all documents delivered and accepted as final deliverable.

Monthly Excel The 10th day of each month

Monthly meeting notes Develop agendas for monthly POA&M meetings and provide action items and meetings notes

Each meeting Meeting invite for agenda and word doc for action items and notes

Agenda to be posted at least 3 workdays prior to meeting. Action items and notes to be sent within 1 day after meeting.

Iteration Demo

Provide a demonstration of work completed during an Iteration

Once per Iteration

PowerPoint and recording of the demonstration

5 business days from the end of each Iteration

Solution Roadmap

A diagram showing what business objectives each team will be focusing on in each sprint for the next four Program Increments

Once per Optional Solution Roadmapping

PowerPoint or Microsoft Word

Within 5 business days after the end of the Solution Road-mapping session

Quarterly contract status briefings

Provide quarterly briefing to RD TO leadership on status of contract.

Deliverables, issues, Once a quarter Teams meeting with documentation to present

Once a quarter projections for next quarter, etc.

Quality Control Plan

(QCP)

The Contractor maintain a complete Quality Control Plan (QCP).

One time (or updated as needed)

Via email to

COR

Finalize as within 14 days after contract POP begins.

4 CONTRACT ADMINISTRATION

4.1 Place of Performance

Contractor staff will work remotely. The Contractor shall propose the location for staff based on their approach and experience including the rationale for each. However, the RD may request meetings and/or limited Contractor support at the authorized RD locations with advanced notice. The current work locations are:

• USDA Rural Development 1400 Independence Ave SW Washington DC, 20250

• One Metropolitan Square 211 N. Broadway Saint Louis, MO 63102-2711

Contractor location as approved by COR and CO. Note that performance is limited to the continental United States and U.S. states and territories that are not a part of the continental U.S., such as Hawaii,Alaska, Guam, Puerto Rico, America Samoa, and U.S. Saipan.

4.2 Period of Performance

The anticipated period of performance is a base with year with two (2) option years.

4.3 Days and Hours of Performance

The Contractor is required to be available, except for on recognized Federal Holidays, from 9:00 am ET until 5:00 pm ET, Monday through Friday to correspond with USDA RD’s Points of Contact, such as the Contracting Office, Contracting Officer’s Representative, COR Advisor, Product Owners, and the Program/Technical Office. The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

The observed Federal Holiday may be different from the actual holiday day depending on the calendar year. It is up to the Contractor to be aware of such dates and discuss any concerns at least 30 days in advance of the holiday date with the COR/CO.

4.4 Invoicing

The Contractor shall submit the original of the invoice to the COR, as well as submit via the Invoice Processing Platform (IPP) at http://www.ipp.gov. Invoicing aligns to the SAFe iterations (agile sprint) cycles proposed. For example, if 2-week iterations are utilized, and invoicing occurs every 4-weeks (2 iterations). As such there would be 13 invoices submitted annually.

Invoice reporting must include a summary of deliverables and services included in the invoice.

Services supporting direct IT delivery may require program or project specific cost reporting with the invoice. The Contractor will provide invoice accounting reports that include, but are not limited to, CLINs on the contract, DME and O&M utilization/burn, specific budget spend lines, and total dollars billed by each application per iteration and YTD cumulative.

4.5 Type of Contract

This contract will be firm-fixed price (FFP) multiple award blanket purchase agreement. The RD may issue Call Orders for tasks identified in the PWS

4.6 Government Furnished Equipment

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide support as defined in this Performance Work Statement (PWS) except for those items specified below as government furnished property and services:

• Laptops – Receipt of government issued laptops are contingent upon Contractor employees passing Suitability Requirements.

• PIV Card – A USDA Personal Identity Verification (PIV) card, which contains the necessary data for the cardholder to be granted to Federal facilities and information systems and assure appropriate levels of security for all applicable Federal applications will need to be obtained by Contractor employees. The COR will work with Contractor to obtain PIV cards for Contractor’s employees.

4.6.1 Validation of Government Furnished Items (GFI) and Equipment Inventory The Contractor shall develop and maintain a complete GFI inventory that shall be made available to RD upon request. Within three workdays of receipt of any GFI, the Contractor shall validate the accuracy of the materials and notify the COR, in writing, of any discrepancies.

NOTE: Validation shall consist of the Contractor checking for physical and logical completeness and accuracy. Physical completeness and accuracy shall be determined when all materials defined as Government furnished are provided, as defined in the delivery order.

Logical completeness and accuracy shall be determined when all materials defined and associated with a program, system, or work package are provided.

4.7 Key Personnel

The personnel listed below are considered essential to the work being performed hereunder. Prior to substituting, removing, replacing, or diverting any of the specified individuals, the Contractor must notify the Contracting Officer 15 working days in advance and shall submit a written request and justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this contract. The proposed substitution of personnel must meet or exceed the education, experience, and other technical requirements of the personnel being replaced. No change in personnel shall be made by the Contractor without the prior written consent of the Contracting Officer. However, in urgent situations, as determined or agreed to by the Contracting Officer, an oral request to substitute key personnel may be approved and subsequently ratified by the Contracting Officer in writing. The Contracting Officer will notify the Contractor within 10 working days after receipt of all required information of the decision on the substitution(s).

In the event the proposed substitution of key personnel does not meet or exceed the education, experience, and other technical requirements of the personnel being replaced, RD reserves the right to require continued performance of previously approved key personnel or to require substitution of acceptable replacements for the individuals specified below. The key personnel listed below may, with the consent of the contracting parties, be amended from time to time during the Contract to either add or delete personnel as appropriate.

Key Personnel Requirements

Key Personnel Requirements

Release Train Engineer

• Demonstrated Release Train Engineer experience in organizing, planning and executing large-scale projects from conception through implementation.

Experience coordinating multiple teams in a technology environment.

• Certified Scrum Master (CSM) certification or equivalent

• SAFe Program Consultant (SPC4 or SPC5) certification or equivalent

• Must be SPC5 certified by end of the contract Base Period.

• SAFe Certified Release Train Engineer certification or equivalent

Scrum Master • Senior Certified Scrum Master (CSM) certification or equivalent (PSM (Professional Scrum Master) is acceptable certification as an equivalent.)

Commercial Lending SME/Advisor:

• A minimum of ten years of financial advising and Commercial Lending experience with emphasis on Business/Government services

• Significant experience advising large financial institutions, including government on infrastructure, applications, and solutions.

The Salesforce Technical SME

• A minimum of five years’ experience with Salesforce implementation projects

• Experience implementing employee-centric solutions on Salesforce

• Must be a Salesforce Certified Technical Architect (CTA).

4.8 Contractor Personnel

The Contractor shall be fully qualified to conduct any activities as required in this PWS and hold the appropriate system and security related certifications. This includes, but is not limited to, Salesforce Certifications. At least one developer on each scrum team should also present their Salesforce Platform Developer II, Salesforce Administrator, and Salesforce Advanced Administrator certification.

The Contractor shall provide experience to demonstrate current capabilities that assures performance of the requirements in this PWS. Evidence of supporting subcontractors, consultants and business partners will be considered. Appropriate balance and mix of education and training of team members should be provided.

For all tasks, the contractor must submit the candidates resume, planned hours, and planned tasks to the COR prior to being placed on the contract. Only after the COR consults with the RD

Project Manager and receives approval for the addition will the COR notify the contractor that the addition is approved. RD may reject additions for lack of qualifications and/or the availability of funding.

5 SECURITY

The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment. The Contractor shall comply with IT systems security and/or privacy specifications set forth in Rural Development and USDA directives, policy, and procedures; the Computer Security Act of 1987; OMB Circular A-130; and the Federal Information Security Management Act of 2002 (FISMA).

The Contractor shall be responsible for assuring that each Contractor employee who requires routine unaccompanied physical access to a Federally controlled facility and/or unaccompanied access to a Federally controlled information system, including a Rural Development-issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The Contractor is required to maintain a listing of all individuals who have completed Computer Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten calendar days of an individual starting work on this contract.

• Access Requirements:

The Contractor shall acquire access to the USDA’s Network/Systems to perform work under the contract. The COR will oversee such access.

• Information Assurance:

The Contractor shall protect and not disclose any PII. The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available - in any medium and from any source that, when combined with other available information, could be used to identify an individual.

5.1 General Information

5.1.1 Intellectual Property

All designs, documents, drawings, etc. prepared by the Contractor specifically for the USDA on behalf of the USDA program shall be the property of USDA. The Contractor shall not publish or distribute any document without prior written permission from the Contracting Officer and the COR. The Contractor shall review and provide written comments on the technical accuracy and completeness of all final deliverables. No documents, reports, information, etc. developed by the Contractor specifically for the USDA may be released to the public or provided to any party without prior written approval of the Contracting Officer and the COR.

5.1.2 Data Ownership

• Performance of the effort may require the Contractor to access data and information proprietary to USDA or its clients. All such data is and shall remain the exclusive property of USDA or its customers, as applicable. The scope and pricing of the agreement shall ensure that USDA may have access and download capability of all data for any purpose, including, but not limited to, research, investigation, transfer, or migration to other systems, in a format requested by

USDA.

• The Contractor shall provide notice immediately of any third-party request for USDA or RD customer data and may not service the request without RD’s prior approval. All data used by or contained in USDA’s FMS systems is the property of the United States Government.

5.1.3 Data Security

• FISMA and NIST SP 800-37, requires that all information technology systems acquired by the Government meet the requirements for Certification and Accreditation established in the Act. This requirement extends to government data which is processed on or resides on Contractor systems.

• The selected contractor shall acquire a cyber insurance policy within 10 days of award. The selected contractor shall submit a copy of the acquired cyber insurance policy to the Contracting Officer within 10 days of award. The selected contractor shall be responsible for all costs associated with a data breach or loss of data as outlined in this section.

• The Contractor must safeguard Sensitive Security Information (SSI) and PII. All Contractor personnel must understand and follow USDA requirements, policies, and procedures for safeguarding SSI and PII and is responsible for the security of all data that is generated by the Contractor on behalf of USDA, USDA data transmitted by the Contractor, and USDA data stored or processed by the Contractor regardless of who owns or controls the underlying systems while that data is under the Contractor’s control.

• Contractor personnel shall be required to complete online SSI, Informational Security, and Privacy training.

• In the event of a breach, all suspected or actual losses or breaches of PII or other sensitive information must be reported immediately to the COR and CO. A written report of the suspected or actual loss or breach must also be provided to the CO and COR within 24 hours after reporting the initial breach. Per OMB requirements outlined in OMB Memo 07-16, all suspected or actual breaches of PII must be reported within one hour of discovery. If directed by the CO, the Contractor should conduct its own investigation and provide a written report of the investigative results to the CO and COR. The Contractor must fully cooperate with any Government investigation(s). The Contractor is fully liable to USDA and shall cover all costs in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract.

• The term “data breach” means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. The Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

6 SECTION 508

6.1 Accessibility of Information and Communications Technology This contract vehicle is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C.

749d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). The Revised Section 508 Standards, which consist of 508 Chapters 1 and 2 (Appendix A), along with Chapters 3 through 7 (Appendix C), contain scoping and technical requirements for information and communication technology (ICT) to ensure accessibility and usability by individuals with disabilities. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

Each ICT product or service furnished under this contract shall comply with the Revised Section 508 ICT Accessibility Standards at a minimum, as specified in the contract. If any furnished product or service is determined to be noncompliant, the Contracting Officer will notify the Contractor in writing. The Contractor shall, without charge to RD, remediate or replace the noncompliant products or services within a specified timeframe as determined by the RD in writing. If such remediation or replacement is not completed within the time specified, RD shall have the following recourses:

• Cancellation of the contract, delivery, task order, purchase, or line item without termination liabilities; or

• In the case of custom ICT being developed by a contractor for the Government, RD shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant ICT, with the Contractor liable for reimbursement to RD for any expenses incurred thereby.

The Contractor must ensure all noncompliant ICT products and services are provided pursuant to extensive market research and exhibit the highest level of compliance while satisfying the contract requirements.

For every ICT product or service accepted under this contract by RD that does not comply with the Revised Section 508 Accessibility Standards, the contractor shall, at the discretion of the RD, remediate or upgrade the item with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

6.2 Compliance

Contractors, and their respective ICT products and services shall comply with the following standards, policies, and procedures. In the event of conflicts between the referenced documents and this contract vehicle, the contract vehicle shall take precedence.

1) Revised Section 508 ICT Accessibility Standards

2) Section 508 of the Rehabilitation Act as amended (29 U.S.C. 794d)

3) Federal Acquisition Regulation (FAR) Subpart 39.2

4) USDA Section 508 Departmental Regulation https://www.access-board.gov/ict/#about-the-ict-accessibility-standards https://www.access-board.gov/law/ra.html#text-of-section-508-of-the-rehabilitation-act-of-1973-as-amended-29-usc-794d https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2039_2.html http://www.ocio.usda.gov/document/departmental-regulation-4030-001

Additionally, all contract deliverables are subject to these standards.

All ICT products and services, regardless of format, must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities equivalent access to and use of information and data provided to those without disabilities.

All contractors, sub-contractors, and consultants are responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document. Remediation of any noncompliant ICT or materials as set forth in this contract vehicle shall be the responsibility of the contractor, sub-contractor, or consultant.

According to the Access Board’s Section 508 Scoping Requirements The following Section 508 provisions apply to the products and/or services identified in this contract vehicle:

• C202 Functional Performance Criteria: Where the requirements in Chapters 4 and 5 do not address one or more functions of telecommunications or customer premises equipment, the functions not addressed shall conform to the Functional Performance Criteria specified in Chapter 3.

• C203 Electronic Content: Electronic content that is integral to the use of telecommunications or customer premises equipment shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.

• C204 Hardware: Where components of telecommunications equipment and customer premises equipment are hardware, and transmit information or have a user interface, those components shall conform to applicable requirements in Chapter 4.

• C205 Software: Where software is integral to the use of telecommunications functions of telecommunications equipment or customer premises equipment and has a user interface, such software shall conform to C205 and the applicable requirements in Chapter 5.

WCAG Conformance: User interface components, as well as the content of platforms and applications shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.

• C206 Support Documentation and Services: Where support documentation and services and provided for telecommunications equipment and customer premises equipment, manufacturers shall ensure that such documentation and services conform to Chapter 6 and are made available upon request at no additional charge.

In addition, vendors and contractors shall comply with the standards, policies, and procedures below for all ICT pursuant to this contract:

• For Custom ICT Development Services, the Contractor shall ensure the ICT fully conforms to the applicable Revised Section 508 standards prior to delivery and before final acceptance.

• For Installation, Configuration, and Integration Services, the contractor shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised Section 508 standards.

• For Maintenance, Upgrades, and Replacements, the Contractor shall ensure maintenance upgrades, substitutions, and replacements do not reduce the original https://www.access-board.gov/ict/#508-chapter-2-scoping-requirements https://www.access-board.gov/ict/#C202-functional-performance-criteria https://www.access-board.gov/ict/#C203-electronic-content https://www.access-board.gov/ict/#C204-hardware https://www.access-board.gov/ict/#C205-software https://www.access-board.gov/ict/#C206-documentation-services level of conformance with the applicable Revised Section 508 standards at the time of the contract award.

• Service Personnel are ensured by the Contractor to possess the knowledge, skills, and ability necessary to address the applicable Revised Section 508 standards and shall provide supporting documentation upon request.

• When providing Hosting Services, the Contractor shall not reduce the existing level of conformance of the electronic content with the applicable Revised Section 508 standards.

• When purchasing ICT where 1) Section 508 validation is not possible prior to award, 2) the ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, the Contractor shall test and validate the ICT solution for conformance to the Revised Section 508 standards, in accordance with the required testing methods as defined by the agency.

• The Contractor shall document and maintain information regarding the measures taken to ensure compliance with the applicable requirements. This documentation includes but is not limited to testing records, product demonstrations, and reported defects by end users and testers.

• Prior to acceptance, the Contractor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, and/or configured for the agency and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by the ITI.

Note: A supplemental ACR may be required if the agency has additional or stricter accessibility requirements than what is outlined in the VPAT.

• Prior to acceptance, the agency reserves the right to require a full working demonstration of the completed ICT item to demonstrate conformance to the agency’s accessibility requirements in addition to independent testing to validate.

• In the case of non-compliance where the Contractor claims its products and/or services satisfy the applicable Revised Section 508 standards specified in the contract vehicle, the contracting officer will promptly inform the Contractor in writing of the non-compliance. The Contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

All Information and Communications Technology (ICT) subject to the Revised Section 508 standards will be evaluated for Section 508 conformance and usability. The test must be administered by a Federal Section 508 Testing Center. All maintenance for ICT that requires upgrades, modifications, installations, repairs, and purchases shall adhere to the Revised Section 508 standards.

https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility

7 ACRONYMS/DEFINITIONS

API Application Programing Interface APR Authorized Representative Request.

ART Agile Release Train BCAS Broadband Collection…