Indian Health Service Division of Program Management and Budget

IHS’s Replacement Enterprise Portfolio Management Tool (EPMT) Statement of Work

Version 2.0 October 2025

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Controlled with Standard Dissemination This information is subject to safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure.

Dissemination is permitted to the extent that it would further the execution of a lawful or official purpose.

1. Introduction The Indian Health Service (IHS) wishes to mature its Capital Planning and Investment Control (CPIC) program to achieve the agency’s mission through optimal performance of its core business processes within an efficient information technology (IT) and Health IT (HIT) environment. The desired end state will provide CPIC with the blueprint for systematically and completely improving its organization’s current (baseline) and desired (target) environment.

The IHS innovatively will use secure and reliable IT and HIT to improve health care quality and delivery, enhance access to care, reduce medical errors, and modernize administrative functions.

IHS supports the IHS, Tribal, and Urban (I/T/U) programs that care for 2.3 million American Indian and Alaska Native (AI/AN) people across the Indian health system. IHS provides the technology infrastructure for a nationwide health care system, including a secure wide-area network, enterprise email services, and regional and national Help Desk support for approximately 20,000 network users.

The Division of Program Management and Budget (DPMB), in the Office of Information Technology (OIT), is responsible for various programs to help achieve the agency’s mission through optimal performance of its core business processes within an efficient information technology (IT) and Health IT (HIT) environment. The CPIC program is responsible for configuring, documenting, providing system and administration training, and offering support for the IHS Enterprise Portfolio Management Tool (EPMT) to meet Federal requirements outlined under the Clinger-Cohen Act of 1996 and the Federal Information Technology Reform Act (FITARA) of 2014.

1.1 Purpose

This IHS EPMT Statement of Work (SOW) offers the organization an opportunity to reflect on the requirements that have been captured and confirms that this document and its details are both accurate and sufficient to represent their EPMT needs.

1.2 Scope

The Contractor will support the IHS Office of Information Technology (OIT) in implementing a FedRAMP-certified, cloud-based Enterprise Portfolio Management Tool (EPMT) to replace the current on-premises Planview system.

The Contractor support will include licensing, technical implementation, configuration, data migration, and integration with existing enterprise systems to enable seamless data flow and process automation. The Contractor will also develop workflow designs, templates, security roles, documentation, and training materials, ensuring alignment with IHS business objectives and adoption of best-in-class portfolio management practices.

1.3 Objective

The Contractor will provide analytical, technical, and management expertise in support of IHS’s portfolio management activities. The Contractor will assist IHS in application development, data migration from the previous EPMT, training, and overall EPMT support to meet program requirements and ensure a successful transition from the current Planview EPMT to the new

EPMT.

The objective of this effort is to procure and deploy a secure, scalable, and integrated EPMT that:

• Supports the development, implementation, and management of a standardized, aligned, and synchronized Portfolio Management framework by linking Strategic and Capital Planning, Information and Project Management, and investment strategies in support of the IHS’s IT investments.

• Supports the development and implementation of the new EPMT and provides guidance and professional recommendations on IT Portfolio Management requirements and concepts.

• Engages subject matter expertise to assist in the development of improved portfolio and project management processes for optimal utilization of the new EPMT.

• Assists in developing knowledge and proficiency among the CPIC Team to support the training, documentation, and administrative support of the new EPMT.

• Enhances integration with existing platforms such as ServiceNow Strategic Portfolio Management (SPM), Business Intelligence (BI) systems, and Agile/DevOps environments.

1.4 Period of Performance

The period of performance includes one base year and four option years.

1.5 Place of Performance

Remote locations at the Contractor’s worksite.

1.6 Recognized Holidays

The official federal holidays in the United States are as follows

• New Year’s Day

• Martin Luther King Jr. Day

• Presidents’ Day

• Memorial Day

• Juneteenth National Independence Day

• Independence Day

• Labor Day

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Any other day designated by a President's Proclamation

It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel will not otherwise be a reason for an additional period of performance or entitlement to compensation except as set forth within the contract. If a Contractor believes that an unplanned absence impacts the cost or period of performance, it should notify the contracting officer (CO) of the changed condition and submit a claim for equitable adjustment (see FAR 52.233-1). Nothing in this clause abrogates the rights and responsibilities of the parties relating to "stop work" provisions cited in other sections of this contract.

1.7 Government-Furnished Property/Information

Government Furnished Equipment (GFE) No GFE is anticipated for this effort. If a limited GFE (e.g., government-managed virtual desktop or secure access device) is required, it will be approved in advance by the Contracting Officer and managed in accordance with FAR 52.245-1.

Government Furnished Information (GFI) The Government will provide relevant system documentation, interface specifications, legacy data sets, and access credentials necessary to support integration, configuration, and testing activities.

Contractor Clearance Contractor personnel requiring logical or physical access to Government systems, networks, or data will be subject to a Public Trust background investigation commensurate with their duties, in accordance with HHS Personnel Security/Suitability Policy and HSPD-12.

The Government reserves the right to review and approve all contractor staff before granting system access. No classified information will be handled under this contract, and a national security clearance is not required.

The Contract personnel will be required to sign a Non-Disclosure Agreement to access the government information.

2. FedRAMP Certification The Federal Risk and Authorization Management Program (FedRAMP) is a mandatory government-wide program for Federal Agency cloud deployments. FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The IHS will only use cloud services that have obtained a FedRAMP Moderate or High Impact Authority to Operate (ATO), also referred to as a FedRAMP-certified cloud service.

The IHS’ preliminary risk assessment indicates that the EPMT solution will require a minimum FedRAMP Moderate authorization. The Contractor will provide evidence in its proposal that the proposed solutions are FedRAMP Moderate authorized.

3. Compliance and Standards The EPMT will meet the requirements of all relevant compliance requirements as appropriate to the scope of the EPMT.

3.1 Accessibility – 508 Compliance

The EPMT solution shall be 508 compliant

3.3 3.2 Security The Contractor will implement and maintain industry-standard security measures, including but not limited to encryption, access control, audit logging, and incident response. The solution must be integrated with the IHS identity management system and support multi-factor authentication (MFA). All data will remain the property of IHS and must be exportable in a secure format upon request. The Contractor must notify IHS within twenty-four (24) hours of any data breach and cooperate fully with integration and remediation efforts.

Authentication & Access Control

• Support for Single Sign-On

• Integrate with Active Directory

• Role-based access control with customized roles and permissions

• MFA enforcement for user access

Data Security

• Full audit logs for data access and modification

• Support for data classification and tagging

Compliance & Certification

• FedRAMP – Must provide current certification

Audit and Monitoring

• Real-time logging of user activity

• Ability to export logs for internal and external audits

• All integration must use secure APIs

Cloud or SCCoE Hosting

SCCoE hosting will offer the greatest long-term value and alignment with modernization strategy, while FedRAMP-customizable solutions provide a viable alternate path when SCCoE deployment is not immediately feasible. COTS tools, although fast to deploy, present limitations in customization, compliance, and lifecycle sustainability.

Corbin, Julie (IHS/HQ) HHS clause and provision will be included in the solicitation

Corbin, Julie (IHS/HQ) Also, this clause is not current. Recommend to remove from this doc. CO will include current 508 clause and provision in solicitation. Clauses are not included in SOW/PWS.

Riedel, Michelle K (IHS/HQ) Deleted old clauses

Corbin, Julie (IHS/HQ) This custom clause will be included in the solicitation and award.

If hosted under SCCoE, the Contractor will utilize the platform approach to provide the most customizable solution with better visibility, data ownership, and better control over COTS. COTS can be readily available but less customizable.

Requirements:

• Deployable within a FedRAMP Moderate/High IaaS (AWS GovCloud, Azure Government, etc.) under SCCoE oversight.

• Full data ownership and observability: logs, metrics, and audit trails available to IHS without vendor restrictions.

• Supports schema flexibility, plugin integration, workflow customization, and Zero Trust-aligned governance.

• Enables cross-program portfolio integration and cost governance across IHS modernization initiatives.

If SCCoE hosting is not feasible within the program’s timeline, the Contractor may propose a FedRAMP Moderate/High-authorized solution that will provide equivalent levels of customization, integration, and control for project, portfolio, and budget management.

• Contractor must demonstrate active FedRAMP authorization with supporting security package (SSP, SAR, POA&M) available in MAX.gov.

• Contractor must allow workflow customization, portfolio dashboards, and budgeting integrations tailored to IHS requirements (not just out-of-the-box COTS).

• Contractor must integrate with IHS systems (e.g., MS Project, dashboards, Data Warehouse) to ensure enterprise portfolio alignment.

• Contractor must commit to ConMon reporting, annual 3PAO reassessments, and alignment with HIPAA/Privacy Act requirements.

• FedRAMP Security Package Submission (SSP, SAR, POA&M)

• Customization & Integration Implementation Plan

• Lifecycle Cost Estimate (implementation, O&M, continuous monitoring)

• Quarterly Compliance & Risk Posture Report

3.4 Privacy and Records Management

The contractor will comply with the following regulations:

• Privacy Act, 5 U.S.C. 552a - Office of Privacy and Civil Liberties | Privacy Act of 1974

• Health Insurance Portability and Accountability Act (HIPAA) - eCFR: 45 CFR Part 164 -- Security and Privacy

• CFR 42 Part 2 - eCFR: 42 CFR Part 2 -- Confidentiality of Substance Use Disorder Patient Records https://www.justice.gov/opcl/privacy-act-1974 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

4. Reserved Ease of Management and Supportability The EPMT solution Contractor will provide a well-defined management model that presents relevant supportability characteristics, which will be considered for selection.

4.1 Configurability

The Contractor will provide an Enterprise Portfolio Management Tool (EPMT) solution with a well-defined management model that enables configuration and administration of all portfolio elements in accordance with agency governance requirements. The management model will incorporate supportability characteristics and provide flexibility to accommodate evolving organizational needs, including but not limited to:

• Configurability: Ability to tailor workflows, user roles, reporting structures, and approval hierarchies without custom code.

• Data Extensibility: Capability to define and manage additional data fields, metadata, and relationships (refer to Section 9.8).

• Structural Adaptability: Support for modification of portfolio and project hierarchies, categorization schemes, and organizational structures.

• Lifecycle Management: Ability to define, track, and automate the progression of portfolio and project lifecycles.

• Templates and Standards: Provision of reusable templates for projects, programs, and investments to promote consistency and efficiency.

• Dynamic Business Rules: Capability to configure and evolve business rules, conditional logic, and automated workflows based on agency-defined triggers and policies.

The Contractor will ensure that all such configurability and management capabilities are accessible through administrative interfaces, fully documented, and maintainable without vendor dependency or modification of source code.

4.2 Annual Licensing

The Contractor will provide the required annual licensing, including annual maintenance and support for a FedRAMP-certified cloud-hosted EPMT. The licenses for system roles must include:

License Type Number of Licenses

Executive/Information Access Only 20

System Administration 10

Time Reporters 550

Program and Project Management, Critical Partner Input 200

4.3 Availability and Managed Downtime

The Contractor will maintain a minimum system availability of 99.9% during Government business hours, excluding pre-approved maintenance windows. The Contractor will:

• Provide at least 14 calendar days’ advance notice for all planned downtime or maintenance events.

• Coordinate downtime with the EPMT Administration Team to minimize operational disruption.

• Develop and maintain a Downtime Management Plan, including contingency procedures and system restoration steps.

• Provide a Post-Maintenance Report detailing activities performed, issues encountered, and validation results.

Deliverables: Advance Maintenance Notification; Post-Maintenance Report

4.4 System Notification and Alerts

The Contractor will provide real-time notifications for any critical incident affecting system performance, data integrity, or security. The Contractor will:

• Notify designated IHS personnel immediately of unplanned outages, security events, network issues, or major performance degradations.

• Provide email and dashboard notifications for planned updates and maintenance events at least five business days in advance.

• Maintain an online System Status Dashboard accessible to authorized Government users, showing current operational status, maintenance schedules, and incident updates.

Deliverables: Incident Notification Log; System Status Dashboard Access

4.5 Coordinated Upgrades and Release Management

The Contractor will coordinate all system releases, version upgrades, and patches with the Government’s EPMT Administrator. The Contractor will:

• Provide release notes, change impact analyses, and rollback procedures for all updates.

• Conduct upgrades in a staging or test environment before production deployment.

• Ensure backward compatibility and data integrity during upgrades.

• Maintain version control and configuration documentation.

Deliverables: Release Management Plan with Use Cases, User Acceptance Testing (UAT) Report

4.6 Reporting Requirements

The Contractor will prepare and deliver reports that provide the Government with visibility into operational health and security posture. Reports will be provided monthly, and ad hoc reports will be produced upon Government request. The Reports will include:

• System performance metrics (uptime, response time, throughput)

• Security metrics (incidents, patch status, vulnerability scans)

• Operational support metrics (ticket volume, resolution times, job success rates)

Deliverables: Monthly Operational and Security Metrics Report

4.7 Support Model and Ticket Routing

The Contractor will operate within a tiered support structure integrated with IHS ServiceNow and the EPMT Administration Team.

TIER RESPONSIBLE PARTY SCOPE OF SUPPORT

Tier 1 IHS ServiceNow Service Desk Intake, triage, and routing of EPMT-related tickets.

Tier 2 IHS CPIC / EPMT Administration Team

Application-level support, configuration management, and functional troubleshooting.

Tier 3 EPMT Contractor Support Team Software defects, system-level issues, integrations, and infrastructure-level troubleshooting.

• The IHS Service Desk will route all EPMT-related tickets to the CPIC EPMT Administration Team through the IHS ServiceNow instance, which will coordinate escalation to the Contractor’s support system as required.

• The CPIC EPMT Administration Team will escalate the ticket to the EPMT contractor Support Team, if required.

• The Contractor will provide a ticketing interface or collaborative workspace to allow visibility into ticket status, progress, and resolution SLAs.

• The Contractor will provide monthly support performance metrics, including ticket volume, resolution times, and SLA compliance rates.

Deliverables: Support Procedures Document; Escalation Matrix; Monthly Support Metrics Report

4.8 Service Level Expectations

The Contractor will meet the following service-level response times, and a dedicated POC must be available.

Metric Target Measurement Frequency

Planned Upgrades & Execution

< 2 weeks in advance As Required

System Availability ≥ 99.9% Monthly

Critical Incident Response

≤ 4 hours Per Incident

High-Priority Ticket Resolution

≤ 24 hours Per Incident

Medium-Priority Ticket Resolution

≤ 3 business days Per Incident

Low-Priority Ticket Resolution

≤ 5 business days Per Incident

Maintenance Events ≤ 72 hours for critical As Required

Deliverables: Hourly Reporting of System Outages to include estimated up times.

4.9 Management and Supportability Deliverables

Deliverable Description Frequency

Monthly Security and Compliance Report

Summary of security incidents, vulnerabilities, patching, and ConMon results

Monthly

Advance Maintenance Notification

Notice of scheduled downtime ≥14 days in advance

Post-Maintenance Report Validation and summary after maintenance As needed

Incident Notification Log Real-time alert record of incidents and root cause analysis

As incidents occur

Release Management Plan with Use Cases & UAT Report

Documentation of updates and testing results

Per release

Monthly Operational Log Summary

System job status, errors, and exceptions Monthly

Monthly Operational & Security Metrics Report

Aggregated performance and security reporting

Monthly

Support Procedures & Escalation Matrix

Support flow and responsibilities Initial / Updates as needed

Monthly Support Metrics Report

Support ticket analysis and SLA adherence Monthly

Hourly Reporting of System Outages

Provide hourly updates for system outages Updates as needed

5. Training The Contractor will offer a variety of training courses, including instructor-led and online courses, by maximizing user engagement and enhancing the use of its portfolio management solutions.

The Contractor will also provide advanced customized train-the-trainer, reporting, and system administration courses.

As part of a comprehensive training plan, the contractor will provide supporting training documentation and training materials to support the tool's implementation into the IHS environment. The Contractor will provide training source materials that IHS can use to create internal training at no extra cost.

6. EPMT

6.1 EPMT Domains

The EPMT will provide services across three primary domains: Request, Strategy, and Project and Resource Management.

6.1.1 Request

The EPMT will facilitate the initiation of requests for various business objectives, including CPIC planning items that support IT Governance, requests for EPMT configuration changes, and requests for process and policy changes within IHS OIT.

6.1.2 Strategy

The EPMT will support the establishment and maintenance of the annual budget planning cycle data, organizational goals and objectives, executive approval cycles, portfolio planning and prioritization, and investment controls.

6.1.3 Project and Resource Management

The EPMT will support the organization’s ability to authorize, initiate, staff, manage, and report throughout all planning and execution stages of projects, and the resources required to support those projects.

6.2 EPMT Hierarchies

The EPMT solution will be designed in accordance with the following organizational hierarchy requirements.

6.2.1 Strategy

The ability to represent the strategic organizational level of IHS to place the strategic data at the appropriate level in that structure.

Example: Enterprise Office Division Program

6.2.2 Project

The ability to place projects and major project types into a hierarchical structure that aligns them to the organization that is driving those projects.

Example: Enterprise Office Division Program Major Project Type (IT work, non-IT work) Project

6.2.3 Resource

The ability to associate resources with their appropriate organizational hierarchy levels.

Example: Enterprise Area/Office Division Department Team

6.2.4 Organizational Resources

The ability to create resource groupings or teams within an organizational hierarchy that will ultimately provide staffing for the work and projects the organization undertakes.

Example: Enterprise Area/Office Division Department Team Resource (named person)

6.2.5 Standard Activities

The ability to reflect on non-project activities that impact resource availability.

Example: Leave Vacation or Leave Training

6.2.6 Expenditure Types

The ability to capture various non-labor expenses.

Example: HW/ SW Costs

6.2.7 Financial Planning Accounts

The ability to define financial planning accounts and to reflect the Technical Business Management (TBM) Taxonomy structure in the EPMT’s financial planning accounts.

Example: Labor, DME (Capitalized Costs), Administrative Cost, Benefits, and Revenue.

Technology Business Management (TBM) Taxonomy - TBM Council.

6.2.8 Process Roles

The ability to define managed process roles that will correspond to the work and governance process requirements of the organization. The ability to assign individuals to one or more process roles as is appropriate for their function within the organization and its processes.

https://www.tbmcouncil.org/taxonomy/

7. Extensible Structures and Fields The Contractor will provide an EPMT solution designed with an extensible data model and configurable metadata architecture that enables the Government to define, manage, and secure additional data structures, fields, and relationships as required by the IHS business processes.

The EPMT solution will:

• Provide the ability to create, modify, and organize data fields beyond those provided “out-of-the-box,” including:

- List of values (static, dynamic, and hierarchical multi-level picklists)

- Free-form and long text fields with configurable length and format

- Numeric, date, Boolean, and derived fields based on calculated expressions

• Support hierarchical and relational data structures, enabling users to define parent-child relationships, associations, and categorization schemes.

• Allow field-level constraints, validation rules, and default values to be configured by administrators.

• Enable custom naming conventions and localized display labels for new and existing fields.

• Provide context-sensitive field-level help text that can be customized by IHS administrators.

8. Data Migration Plan The Contractor will develop and execute a comprehensive Data Migration and Transition Plan to support a successful transition from the current Enterprise Portfolio Management Tool (EPMT) to the new FedRAMP-certified EPMT solution. The Contractor will provide:

• Develop a Data Migration and Transition Plan that defines the migration approach, sequencing, mapping, validation procedures, and rollback strategy.

• Identify all data sources, data types, and interdependencies within the existing EPMT platform.

• Provide a data inventory and migration mapping matrix documenting field-level relationships between the legacy and new systems.

• Establish migration milestones aligned with the overall implementation schedule.

• Submit the draft plan for Government review and approval

Deliverable: Draft and Final Data Migration and Transition Plan

8.1 Execution

The Contractor will:

• Perform data extraction, transformation, and loading (ETL) using secure and automated migration tools approved by the Government.

• Ensure all data transfer activities comply with FedRAMP Moderate and HHS data handling requirements, including encryption in transit and at rest.

• Conduct incremental or phased migrations as needed to minimize downtime.

• Provide daily migration logs summarizing progress, exceptions, and remediation actions during the migration window.

Deliverables: Daily Migration Logs; Final Data Migration Summary Report

8.2 Data Validation and Quality Assurance

The Contractor will:

• Perform data validation testing to verify the completeness, accuracy, and consistency of migrated records.

• Conduct reconciliation testing between legacy and new systems to confirm the successful transfer of all data elements.

• Document and resolve discrepancies identified during validation.

• Provide a Data Validation Report certifying the accuracy of the migrated data and detailing residual issues, if any.

Deliverable: Data Validation and Reconciliation Report

8.3 Data Mitigation Strategy for Non-Migratable Data

The Contractor will:

• Identify data that cannot be migrated due to format, structure, or obsolescence constraints.

• Develop and propose a Mitigation Strategy for such data, which may include data archival, reformatting, or manual conversion approaches.

• Obtain Government approval before implementing mitigation measures.

• Maintain full documentation of non-migrated data and its disposition.

Deliverable: Non-Migratable Data Mitigation Plan

8.4 Automation and Tools

The Contractor will:

• Employ automation tools to streamline extraction, transformation, loading, and validation processes wherever feasible.

• Document all tools, scripts, and procedures used for migration and provide them to the Government for reuse and audit purposes.

• Ensure tools are compatible with the IHS IT environment and meet FedRAMP and cybersecurity standards.

Deliverable: Migration Automation Tool Documentation and User Guide

8.5 Reporting and Project Tracking

The Contractor will:

• Provide a weekly status report summarizing migration activities, hours expended, issues encountered, risks, and mitigation actions.

• Log and report project hours worked directly within the EPMT solution for visibility and tracking.

• Maintain a cumulative migration progress dashboard accessible to the Government for real-time monitoring.

• Escalate risks or blockers to the EPMT Program Manager within one business day of identification.

Deliverables: Weekly Migration Status Report; Cumulative Progress Dashboard

8.6 Acceptance Criteria

The data migration will be considered complete when:

• All in-scope data has been successfully transferred and validated with ≥ 99.5% accuracy.

• All non-migratable data is documented and approved under the Mitigation Plan.

• The EPMT solution is fully operational with migrated data accessible and functional within business processes.

• The Government provides written acceptance of the Final Data Migration Report.

Deliverable: Final Data Migration Report and Government Acceptance

8.7 Deliverables Summary

DELIVERABLE DESCRIPTION FREQUENCY/TIMING

Draft Data Migration and Transition Plan

Initial migration strategy, mapping, and schedule

Within 30 days of the award

Final Data Migration and Transition Plan

Approved plan incorporating Government feedback

Before migration execution

Daily Migration Logs Progress and exception summaries During the migration window

Data Validation and Reconciliation Report Test results verifying data integrity Post-migration

Non-Migratable Data Mitigation Plan Disposition plan for excluded data Prior to go-live

Migration Automation Tool Documentation Tools and scripts used for migration Prior to completion

Weekly Migration Status Report

Summary of work hours, progress, and risks Weekly

Final Data Migration Report Comprehensive summary and closeout Upon completion

9. Configurable Screens The EPMT solution will provide the ability to modify the EPMT out of the box with user interaction screens to meet IHS requirements. This is particularly important to support IHS’s ability to:

• Maintain current workflow processes to the extent possible

• Support EPMT tool adoption

• Include prompts, help, and graphical guidance to support stakeholders

• Reinforce policy and governance requirements

• Organize information and user guidance in a logical and appealing presentation

• Support expanding/collapsing content as appropriate

• Support matrix/table type data entry

• Support natural and intuitive screen navigation

10. Project and Resource Management A key opportunity for the IHS in selecting its EPMT solution will be the shift toward an enterprise portfolio management approach that integrates strategy, resources, and execution across all programs and projects.

The EPMT solution will provide comprehensive portfolio, project, and resource management functionality to enable data-driven planning, monitoring, and decision-making across the IHS enterprise.

10.1 Integrated Project Planning and Scheduling

The EPMT solution will:

• Enable users to plan, schedule, and manage project tasks and milestones across multiple portfolios and programs.

• Support linking of resources to project tasks to capture workload, skill utilization, and cost allocation.

• Track project progress and performance based on effort expended, percent complete, and schedule variance.

• Support task dependency management, critical path analysis, and milestone tracking.

• Provide administrative tools to configure templates, scheduling rules, and approval workflows for consistent planning practices across IHS.

Deliverable: Project Planning Configuration Guide and Templates

10.2 Resource and Capacity Management

The EPMT solution will:

• Provide centralized resource planning and allocation capabilities to support capacity management across projects, programs, and portfolios.

• Enable users to conduct resource forecasting based on role, skill set, and availability.

• Support what-if scenario modeling to evaluate the impact of proposed projects or scope changes on available resources.

• Identify resource over-allocation, underutilization, and potential conflicts through automated analytics.

• Allow resource managers to perform capacity-to-demand analysis to align workload with organizational priorities.

Deliverable: Resource Capacity Planning and Utilization Report

10.3 Schedule and Financial Baselining

The EPMT solution will:

• Support the creation and management of project baselines for schedule, cost, and scope.

• Provide version-controlled baselines to compare planned versus actual performance.

• Automatically calculate and display earned value metrics (e.g., Planned Value, Earned

Value, Actual Cost, Schedule, and Cost Variance).

• Enable authorized users to re-baseline projects upon Government approval, maintaining full traceability of baseline changes.

• Integrate with IHS financial and business systems (e.g., ServiceNow SPM, BI platforms) to ensure accurate financial reporting.

Deliverable: Baseline Management and Earned Value Reporting Configuration Document

10.4 Resource Utilization Modeling

The EPMT solution will:

• Provide visualization and modeling tools (e.g., heatmaps, dashboards) to assess current and projected resource utilization.

• Enable multi-dimensional views (by program, region, role, or funding source) to optimize workforce alignment.

• Allow users to simulate project scenarios and instantly view resource load impacts.

• Generate utilization reports for leadership decision-making and performance review.

Deliverable: Resource Utilization Modeling and Reporting Dashboard

10.5 Executive Management (EM) Reporting

The EPMT solution will:

• Provide role-based dashboards and reports to support executives, portfolio managers, and project leads.

• Include configurable Key Performance Indicators (KPIs) for schedule performance, budget utilization, resource efficiency, and risk status.

• Enable automated generation and distribution of Executive Management (EM) Reports on a recurring schedule (e.g., monthly).

• Support integration with Business Intelligence (BI) tools (e.g., Power BI, Tableau) for advanced analytics and visualization.

• Maintain consistency with IHS Capital Planning and Investment Control (CPIC) and OMB IT PortfolioStat reporting requirements.

Deliverable: Executive Management Dashboard and Reporting Package, Quarterly Performance Metrics Report

10.6 Deliverables Summary

DELIVERABLE DESCRIPTION FREQUENCY

Project Planning Configuration Guide and Templates

Configurable templates and planning processes

Initial / Updates as needed

Resource Capacity Planning and Utilization Report

Resource availability and demand analysis Monthly

Baseline Management and Earned Value Reporting Document

Baseline tracking, EVM setup, and performance reports Quarterly

Resource Utilization Modeling Dashboard

Visualization of utilization and capacity metrics Monthly

Executive Management Dashboard and Reports

Leadership-level KPIs and portfolio insights Monthly

Quarterly Performance Metrics Report

Progress toward portfolio management objectives Quarterly

11. EPMT Solution Requirements IHS will require the EPMT solution to provide a suite of features that cover the following capabilities, preferably in an integrated and holistic implementation:

PRIMARY

CATEGORY

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Strategy Annual Planning Cycles The ability to establish annual planning cycles in which the organization's business plan, priorities, and financial plan are developed, iterated, reviewed, and approved.

Budget Annual Funding Requests The ability to establish annual funding requests to document annual strategic and financial requirements.

Governance CPIC Request The ability to initiate, develop, review, approve, and dispatch requests for investment.

Governance Goals and Objectives The ability to connect requests for investment to the strategic goals and objectives that they support.

Governance IT Governance ID The ability to generate a unique IT Governance ID and associate it with an investment request (CPIC Request).

Governance Request Portfolios The ability to collect investment requests (CPIC requests) into virtual folders (portfolios) so that they can be evaluated, statused, and reviewed.

Governance Capacity Planning Capability for clearly aligning strategies with resources, requirements, and schedules throughout the lifecycle of the investments.

Governance Reporting and Analytics The ability to pre-configure reports and dashboards to show status to management.

Governance Earned Value Measurement and Reporting

PMT can identify the business value of each application in the portfolio.

Project Management

Forecasting Ability to establish project, resource, and project financial forecasts.

Project Management

Capacity Planning The ability to capture and manage current resource time utilization and cost, and measure the capacity available for additional work.

Governance CPIC Request The ability to capture requests, prompt the requester for essential information for the request, classify requests by their types, and route those requests through a pre-defined workflow.

Strategy Annual Planning The ability to initiate programs and identify projects that belong to those programs.

PRIMARY

CATEGORY

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Project Management

Project and Resource Management

The ability to initiate projects, capture necessary project information, track projects, associate resources to the projects, and track their progress, establish project lifecycle and governance milestones (EPLC), utilize templates and workflows that can be pre-defined, and forecast and manage project financials.

Strategy Strategic Scenario/Modeling The ability to create alternative strategic plans and compare them.

Strategy Ranking and Prioritization The ability to capture strategic prioritization decisions for programs and projects.

Governance Program Health The ability to evaluate program health across various constraints (schedule/ resource/budget).

Project Management

Project Health The ability to evaluate project health across various constraints (schedule/ resource/budget).

Project Management

Variance Analysis The ability to capture project baselines and utilize those baselines to report on variances.

Governance Request Status The ability to monitor the status of lifecycle tasks for Requests.

Project Management

Percent Complete The ability to monitor the status of tasks for Projects.

Project Management

Project Status The ability to capture project status information on a periodic (weekly) basis.

Governance Role-Based Access The ability to categorize users by their role in the CPIC Request processes and control access to information and features based upon that role.

Strategy Role-Based Access The ability to categorize users by their role in the Strategy processes and control access to information and features based on that role.

Project Management

Role-Based Access The ability to categorize users by their role in the Project and Resource management processes and control access to information and features based upon that role.

Project Management

Time Reporting The ability to identify users who will report time on projects.

Project Management

Time Reporting The ability for certain users to report time spent each week on tasks and projects.

Project Management

Timesheet Approval The ability to review, approve, or disapprove timesheet submissions.

Project Management

Progress Tracking The ability to track progress on project tasks.

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Project Management

Milestones The ability to represent project milestones.

Project Management

Critical Path The ability to calculate and manage the critical paths for projects.

Project Management

Intra-Project Dependencies The ability to identify dependencies between tasks on a project.

Project Management

Inter Project Dependencies The ability to identify dependencies between tasks on different projects.

Governance IT Governance ID The ability to manage periods of effectiveness for IT Governance IDs and link expired IT Governance IDs to their replacements for long-duration investments.

Project Management

Project Management The ability to represent and manage projects with a waterfall methodology.

Project Management

Project Management The ability to represent and manage projects with an agile methodology.

Project Management

Project Management The ability to represent and manage projects with a hybrid waterfall and agile methodology.

Project Management

Resource Management The ability to represent resources by their functional role.

Project Management

Resource Management The ability to associate individual users with their resource (functional) role.

Project Management

Resource Management The ability to request resources for projects by functional role or resource name.

Project Management

Resource Management The ability for resource managers to assess the demand for their resources and make distribution, prioritization, and resource loading decisions.

Governance Infrastructure Solution components must comply with HHS and IHS infrastructure requirements.

Governance Security Solution and its components, and integrations must comply with HHS and IHS Security Requirements.

Governance Privacy Solution and its components, and integrations must comply with HHS and IHS Privacy Requirements.

Governance Records Management Solution and its components, and integrations must comply with HHS and IHS Records Management Requirements.

Project Management

Integrations The ability to import MS Project plans into the PMT and define which data to import into the

PMT.

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Project Management

Integrations The ability to export project and resource data from the PMT into Data Warehouse Analysis, Dashboard solutions.

Project Management

Integrations The ability to export strategy and annual planning data from the PMT into Data Warehouse Analysis and Dashboard solutions (PowerBI or QLIK).

Governance Integrations The ability to export IT Governance data from the PMT into Data Warehouse Analysis and Dashboard solutions.

Strategy Vendor Viability Solution Vendor is considered a leader in the PMT space with at least five (5) years of customer satisfaction performance.

Governance Vendor Viability Solution Vendor is native owned or contracted through a native-owned enterprise.

Strategy Vendor Viability Solution Vendor is established in the Federal market.

Governance 508 Compliance Solution is 508 compliant for the features that are most commonly accessed by the majority of the business users.

Governance Single Sign-On Solution is enabled for Single Sign-On.

Governance D1 Validation Solution utilizes the user's D1 credentials for single sign-on authentication.

Governance Vendor Viability Ability to generate comprehensive reports and dashboards for stakeholders, providing transparency and accountability, and is 508 compliant.

Project Management

Vendor Viability The ability of both the CBS and WBS, over project budget, schedule, and operations all within one system.

Strategy Ease of Support Overall process/organizational improvement management (iterative improvements) and risk management.

Strategy Strategically aligned business planning and execution

Ability to connect Strategy to Organizational Objectives (request/program, program/AFR, and project/work)

Strategy Strategically aligned business planning and execution

Ability to connect Strategy to Programs (request/program, program/AFR)

Strategy Financial Linkages connecting strategy to execution

Ability to connect Programs to Projects (program/AFR, project/work)

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Project Management

Project Management Ability to establish project budgets (forecast).

Strategy Financial Linkages connecting strategy to execution

Ability to connect project budgets to the AFR(s) that will fund the projects (program/AFR, project/AFR)

Strategy Financial Linkages connecting strategy to execution

Ability to verify that the AFR(s) can adequately fund the associated projects (business logic).

Budget Resource Management and Capacity Planning

Ability to capture resource requirements for projects/work.

Budget Resource Management and Capacity Planning

Ability to report on unmet resource requirements.

Budget Financial Linkages connecting strategy to execution

Ability to capture labor costs in the project financials (forecast).

Budget Financial Linkages connecting strategy to execution

Ability to capture labor costs in the project financials (actuals).

Project Management

Time Reporting The ability to have Time reported by individuals to capture progress on project tasks.

Budget Labor Costs The ability to reflect actual labor costs on project financial data from invoiced contract data.

Budget Expenses The ability to capture non-labor costs on the project financial plan data from invoices and contract data.

Budget Labor Costs The ability to represent the Federal Labor line items.

Project Management

Effort Planning Ability to track the Effort requirements to accomplish the project (WBS task level).

Project Management

% Complete Ability to track percentage complete on effort already expended and still required to complete the project (WBS task level).

Project Management

Resource Management and Capacity Planning

Ability to evaluate resource constraints across the portfolios of projects/work.

Project Management

Financial Health Ability to evaluate financial health (variance) across the portfolio of projects/work.

Project Management

Variance Management The ability to establish requirements for project baselines (schedule and financial) in the workflow.

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Project Management

Portfolio Analysis Ability to evaluate portfolios of projects/ work timeline/milestone roadmap, and identify dependencies between projects.

Project Management

Critical Path Calculation Ability to evaluate project timeline or roadmap and calculate the critical path.

Governance IT Governance and EPLC Ability for projects/work with larger budgets to have additional governance (CIO) to approve the project plan and budget.

Governance Financial Health Develop a monthly close process

Governance Financial Linkages connecting Strategy to Execution

Require that every project be linked to one or more eligible AFRs.

Project Management

Requirements Traceability Functional scope management for project and resource management, dynamic prioritization.

Project Management

Requirements Traceability Requirements and scope management for technical aspects and mandates for Project and Resource Management prioritization.

Governance IT Governance and EPLC Go/no-go decision making.

Governance IT Governance and EPLC Establish IHS PMO where CPIC develops EPLC standards (and others) necessary to create an IHS project and resource management framework.

Strategy Compliance and Standards OKTA is compatible with multi-factor authentication.

Project Management

Resource Management The ability to manage projects whose supporting resources are supplied by multiple contracts with different vendors.

Strategy Security The EMPT solution will include the following security control types: technical, operational, and managerial. Procedures will comply with

NIST 800-53.

Strategy SDLC The EPMT solution will utilize best-in-class procedures, including EPLC (Enterprise Performance Life Cycle - previously mentioned) and SDLC (Software Development Lifecycle) as elements of IHS's security risk management processes.

Strategy Security and Authorization Procedures

The EPMT will comply with IHS guidelines for security and authorization procedures identified in the IHS Technical and Management Handbook DIS-SOP-06-11b, where appropriate.

Governance User Accounts and Controls The EPMT will employ processes to control user accounts in compliance with Active

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Directory, disablement controls, grant audits, and access logging to monitor activity.

Governance Vulnerability Scanning The EPMT will support vulnerability scans of all network endpoints for EPMT servers and produce reporting as necessary in compliance with DIS-SOP-06-09 Vulnerability Scanning.

Governance Audit and Log Management The EPMT will support audit and logging as required by DIS-SOP-21-03 Log Management.

Governance Audit Reviews The EPMT will support audit reviews and logging in compliance with log storage and retention requirements.

Strategy SLA The EPMT vendor will agree to SLA terms that provide a response within 24 hours.

Project Management

Roadmap The ability to configure different roadmap views and save those views into PPT.

Project Management

Roadmap It would be nice to see product roadmap views with a network diagram to reflect the product roadmap.

Strategy Security and Authorization Procedures

The EPMT must be SPLUNK integration-ready.

Strategy Data Import The EPMT will support the ability to integrate with Microsoft Plug-ins, particularly to support the ability to import MS Project Plans.

Strategy Agile DevOps The EPMT must support integration with ADO.

Governance Compliance and Standards The EPMT solution will comply with any relevant requirements as outlined by the IHM (Indian Health Manual).

Governance FedRAMP certification If the product is offered as a SaaS/Cloud solution, FedRAMP certification is required.

Project Management

Project Management The ability to manage projects using only existing resources, with no additional contract required.

Project Management

Project Management The ability to reflect non-labor project costs in the project financial data, for forecasting, and to reflect invoiced costs as actual costs in the project financial data.

Project Management

Project Management Provide support for the Division's PMO by delivering features, workflow data requirements that align with the PMO's ability to initiate and manage projects, manage resources, report, and coordinate in support of the organization's programs and priorities.

REQUIREMENT STATEMENT REQUIREMENT DESCRIPTION

Portfolio Management

Portfolio Management Creates multiple types of enterprise portfolios and sub-portfolios, including investments, business capabilities, products, services, IT assets, applications, programs, projects, and digital products.

Portfolio Management

Portfolio Management Creates discreetly managed programs that can be related to elements in other portfolios.

Renders product roadmaps. Enables a shared understanding of interdependencies, constraints, and risks across products that need managing for optimal results.

Governance Records Management Provides required data storage capacity, file types, and locations. It supports processes such as disaster recovery, rollbacks, extraction, or eradication.

Implementation Vendor Services for Startup Provides implementation resources, including setup, testing, and training, to meet the desired go-live date.

Implementation Vendor Services for Startup Provides a clear implementation plan and resourcing, including setup,…