Draft IT Staffing Support Services_SOW.pdf

Federal Occupational Health (FOH) Information Technology (IT) Staffing Support Services Draft Statement of Work (SOW)

C.2.0 STATEMENT OF WORK

C.2.1 GENERAL REQUIREMENTS

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified), and otherwise do all the things necessary for or incident to the performance of the work as set forth in the contract.

The Contractor shall perform day-to-day operations and maintenance for the Federal Occupational Health (FOH) Information Technology (IT) infrastructure , which includes customized government off-the-shelf (GOTS) applications, security applications and supporting infrastructure (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document), that is used to manage and perform work within FOH. These system support critical business and program activities.

The Contractor will shall provide administrative, technical, and engineering staff support to develop, implement, and maintain all elements of the assigned FOH IT Infrastructure. The Contractor shall perform all service delivery responsibilities in compliance with all Department of Health and Human Services (HHS) IT standards, direction, and guidance, as well as other application service delivery documents as directed by the Government.

The Contractor will shall maintain a framework that enables disciplined management and execution of changes to FOH IT Systems and the configuration management of those changes. The Contractor shall perform proactive planning to ensure high availability, reliability, and responsiveness of FOH IT Systems while adapting to and implementing frequent changes and working within a quality control environment that encourages and reinforces appropriate testing of new capabilities to prevent adverse impact to operations or the user’s experience during system modification and/or upgrades.

The Contractor will be required to provide superior end-user service delivery through a flexible and responsive delivery methodology capable of quickly and effectively responding to new IT service needs and mission requirements, provide customer-focused service delivery performance targets that align all IT services with FOH requirements and needs, and enable FOH with continuous, highly available, secure, and efficient IT service support. The Contractor shall achieve continual improvement in customer satisfaction while meeting or exceeding performance targets.

C.2.2 EXISTING FOH IT SYSTEMS, ARCHITECTURE, AND CONFIGURATION

The Contractor shall manage operations, maintenance, and the continuous enhancement of all FOH IT systems and services, as well as support any third-party replacement or modernization to achieve the target end state of the FOH IT environment as directed by the Government.

The existing FOH IT Systems, Architecture, and Configuration is described in the attached FOH IT Systems, Architecture and Configuration Overview document.

C.3.0 OPERATIONS AND MAINTENANCE

C.3.1 FOH IT System Operations Requirements The Contractor shall:

• Develop, document, and implement processes, techniques, and disciplines to coordinate and carry out the activities and processes required to deliver and manage services at agreed levels of service for the FOH infrastructure which includes customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document).

• Implement processes to ensure ongoing management and control of the day-to-day activities and technology that is used to deliver and support services (e.g., infrastructure monitoring and reporting tools, utilities).

• Develop processes for the systematic monitoring of service delivery performance, assessing metrics, and gathering and analyzing data collected during service operations and reporting results to the Government, including the integrated project management plan.

• Utilize standard industry practice for systems operations and maintenance, consistent with the Project Management Body of Knowledge (PMBOK), disciplined engineering practices, best practices and applicable standards. Performance of this task will be monitored and reported on in accordance with the Quality Assurance Surveillance Plan ( QASP).

C.3.2 Asset Management and Tracking The Contractor shall perform the following asset management tracking and support services for IT hardware, software and software licenses, network, and telecommunication resources:

• Assist in the development, maintenance and improvement of inventory management protocols and procedures.

• Provide all asset inventory record keeping and logistics support requirements associated with FOH inventory management.

• Manage and monitor all IT assets.

• Support activities to audit physical inventories of IT resources.

• Support excessing of IT assets.

• Support contract administration efforts to continually improve the efficiency and effectiveness of IT resource management.

• Support management of all FOH software licenses used throughout the enterprise.

• Support the management of the inventory of telecommunications, and network circuits.

• Implement a management system to ensure that all FOH’s IT asset data is captured, accurately recorded, and updated monthly throughout the entire asset lifecycle of all existing, and newly acquired IT and their attributes (e.g., location, costs, depreciation, contracts, vendor, serial numbers).

• Develop and deliver asset inventory report as directed by the Contracting Officers Representative (COR).

C.3.3 Software License Management The Contractor shall establish, monitor, and manage a centralized data repository for FOH enterprise-wide use for recording and tracking information regarding software licensing and support agreements (e.g., vendor name, software name and version, number of authorized users and/or devices covered, licensing fees, commencement, and expiration date). Performance of this task will be monitored and reported on in accordance with the QASP and execution of configuration management.

C.3.4 Telecommunications Systems Support The Contractor shall provide telecommunications system support and planning associated with delivery of infrastructure capabilities including:

• Identify current or anticipated problem areas relating to telecommunications hardware and software systems and present technical issues of interest or value to the Government regarding telecommunications.

• Provide asset management and tracking support of cellular, Voice Over Internet Protocol (VoIP), analog, circuits and broadband services, and associated equipment.

• Establish, monitor, and manage a centralized data repository for FOH enterprise-wide use for recording and tracking information regarding telecom assets of cellular, VoIP, analog, circuits and broadband services, and associated equipment.

• Develop and deliver telecom status and asset tracking reports.

C.3.5 Application Support The Contractor shall provide application technical support and user access support to all FOH staff and customers, for the FOH infrastructure which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document. End users may contact the application support team via telephone, email, and web-based software. Phone inquiries are automatically routed to the next available staff member. If staff is not immediately available, the system will allow the person to leave a voicemail or to queue up to connect to the next support specialist.

The Contractor shall:

• Receive, record, research, monitor, coordinate, and track the resolution of all customer issues to ensure timely resolution.

• Coordinate with HHS Office of the Chief Information Officer (OCIO) on support issues including user accounts, email, hardware (e.g., laptops, telephones, mobile devices, network printers), and software issues and installations.

• Provide end user support for the implementation of changes and upgrades to FOH specific applications and services.

• Perform support to resolve IT hardware, system software, telecommunications, and customer support issues.

• Utilize and maintain GOTS (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document).

• Conduct and support stakeholder engagement efforts including lunch and learns, town hall meetings, applications systems training, and office hours.

• Be familiar with the technical aspects of maintaining GOTS and custom-built IT systems; as well as be equipped and familiar with the people and systems necessary to support FOH users and oversee the effective operations and maintenance of whatever system is implemented.

• Oversee the process and track and report issues in the weekly status report and monthly progress, status, and management report.

• Provide live application support 7am – 6pm Eastern Standard Time (EST). Currently, rotating shifts are used to cover the call volume.

• Arrange staffing to ensure that under normal call volumes, approximately 100-165 calls weekly, users will not have to wait in queue longer than three (3) minutes before they gain access to an application support specialist.

• Provide initial responses for inquiries within two (2) hours of receipt, given normal call volumes, and for inquiries placed during operating hours.

• Resolve greater than 85% of all inquiries within one (1) business day of the initial contact.

• Escalate inquiries that cannot be immediately resolved by the application support team to designated experts on specific support topics, who will work to resolve the issue. Specific issues may require the involvement of staff responsible for maintaining the system itself (e.g., systems engineer). Once a problem has been validated to be a system or data issue, the Contractor shall escalate the issue to the designated subject matter expert or systems engineer.

Issues passed to the maintenance team should be tracked in the issue tracking system applicable to the system. These issues may represent request for changes, data requests (changes to data performed by programming operations, which are usually done on large groups of data, or on data that the users do not have direct access to), and/or defect reports. If an issue is passed to an engineer or OCIO, the Contractors shall place the ticket “On Hold”, update with the OCIO ticket number, track and monitor the issue until it is resolved.

C.3.6 Configuration / Change Management Services The Contractor shall implement, track, and document the following Configuration / Change Management services for FOH IT systems (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document), as approved, by the Government:

• Configuration Management

• Change Management

• Change / Configuration Control Board

C.3.6.1 Configuration Management The Contractor shall provide Configuration Management activities including but not limited to baseline identification, change control, status accounting and auditing. The contractor shall develop, deliver, and implement a Configuration Management Plan, as approved by the Government. The Contractor shall implement, track and record configuration management activities in a Government approved repository Weekly/ Monthly in accordance with configuration changes.

• The contractor shall implement, manage, monitor, and update a Configuration Management Database (CMDB).

• The Contractor shall use a CMDB to account for all IT Assets and provide accurate information on configurations and provide a sound basis for Change and Release Management and to verify configuration records against the infrastructure and correct any exceptions.

Performance of this contract will be monitored and reported on in accordance with the QASP.

C.3.6.2 Change Management The Contractor shall implement, update, and manage an FOH enterprise-wide standard Change Management system to be used when preparing to introduce any system or service changes into the IT production environment. The Contractor shall develop a change management plan that establish standardized methods and procedures for the efficient and prompt handling of all IT change requirements (e.g., submitting, reviewing, prioritizing, approving, recording, managing processes) to minimize the impact of change within thirty (30) business days of contract award.

Performance of this task will be monitored and reported on in accordance with the QASP.

C.3.6.3 Configuration / Change Control Board The contractor shall provide the following Change / Configuration Control Board services:

• The Contractor shall comply, as an invited participant, with the existing processes and procedures of HHS’ Change/Configuration Control Boards (including Enterprise Review Boards).

• The Contractor shall manage day-to-day activities related to Configuration / Change Management for the FOH infrastructure (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document) in accordance with the HHS Policy for IITEPLC, including:

o Conduct Change Request (CR) Management activities, including validating CRs.

o Facilitate entry and management of (CR )in Change Management tool.

o Implement and facilitate Configuration / Change Control Board (CCB) as approved by the

Government.

o Preparing and maintaining meeting minutes in conjunction with the CCB.

o Develop, maintain, and continually improve, Change Management processes and policies.

o The Contractor shall develop, deliver, and implement a Change Control Charter, as approved by the Government within 30 business days of contract award.

Performance of this task will be monitored and reported on in accordance with the QASP.

C.3.7 Database Services The contractor shall provide database services activities focused on the development of physical data models, database design, design of extraction, transformation and load design, data preparation design, and data interface design for FOH systems which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document). The Contractor shall develop data models that are very detailed and fully attributed (all data elements are defined); adhere to business rules or shall be defined by business rules and adhere to HHS/FOH data administration standards and align with HHS/FOH Enterprise Architect (EA) data models. The Contractor shall provide database services in compliance with all HHS data and database standards and conventions.

The Database Services dependencies include work products from Initiation, Concept and Planning Services, Requirements Services, and Design Services.

C.3.8 Security Control Assessment (SCA) Services The contractor shall provide SCA Services, which determine the extent to which the security controls in FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document)are implemented correctly, operate as intended, and produce the desired outcome with https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/policy-for-information-technology-enterprise-performance.html respect to meeting the security requirements for the application and/or infrastructure. SCA Services include comprehensive security testing to ensure that the system meets all legislative, regulatory, and HHS security and privacy requirements prior to implementation.

The contractor shall perform the following SCA Services requirements and coordinate :

• The Contractor shall provide a project-level Project Management Professional (PMP) for the SCA contract.

• The Contractor shall conduct testing remotely or in-person, as directed by the Government.

• The Contractor shall utilize the security assessment documentation, which can be found on the

HHS OS Compliance Management Website https://hhsgov.sharepoint.com/sites/OS-Compliance- Management/SitePages/OS%20-%20CRM%20Home.aspx?sw=bypass.

• The Contractor shall develop and deliver an SCA Test Plan to include all testing and evaluation procedures and techniques necessary to evaluate the controls implemented to protect the system.

• The Contractor shall document the controls and components within the SCA scope in the test plan in relation to the application’s defined system authorization boundary, or accreditation boundary.

• The Contractor shall conduct the SCA services using the testing and evaluation techniques and procedures contained in the SCA Test Plan.

• The Contractor shall develop and deliver SCA Reports using the security assessment template provided by the Government; however, in some instances, to be determined by the Government, the Contractor can use their own template as long as pertinent information is collected. Templates for all required SCA and Authority to Operate (ATO) artifacts can be found on the Office of the Secretary (OS) Compliance Website at:

https://hhsgov.sharepoint.com/sites/OS-Compliance-Management/SitePages/OS%20- %20CRM%20Home.aspx?sw=bypass.

• The Contractor shall provide all draft and final SCA deliverables including the test plan, final report, and tested controls/findings document to the Government at frequency to be determined by the Government, per HHS requirements.

• The Contractor shall coordinate with HHS / OCIO to conduct SCA activities, as directed by the Government.

C.3.9 Maintenance Services The Contractor shall provide Maintenance Services, for FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document). The maintenance services shall include activities required to maintain the system code in the production environment and covers fixes, development of limited scope enhancements, changes required by users, and modifications required because of changes in the production environment.

The Contractor shall ensure that software products meet design objectives, are of good quality, including rectifying software, database, and system defects that are identified during testing.

The Contractor shall perform maintenance services that mirror the development life cycle and include the following activities:

• Initiation – problem and modification identification, classification, and prioritization

• Analysis – detailed analysis of the modification to determine impact, feasibility, and alternatives https://hhsgov.sharepoint.com/sites/OS-Compliance-Management/SitePages/OS%20-%20CRM%20Home.aspx?sw=bypass https://hhsgov.sharepoint.com/sites/OS-Compliance-Management/SitePages/OS%20-%20CRM%20Home.aspx?sw=bypass https://hhsgov.sharepoint.com/sites/OS-Compliance-Management/SitePages/OS%20-%20CRM%20Home.aspx?sw=bypass https://hhsgov.sharepoint.com/sites/OS-Compliance-Management/SitePages/OS%20-%20CRM%20Home.aspx?sw=bypass

• Design – design modification solution

• Implementation – develop code, processes, and procedures to implement modification

• Development Testing – validate the modification and determine the impact on the existing system or application and the systems environment in general

• Acceptance Testing – validate that the modification meets the requirements

• Delivery – provide the modification as part of a release package for installation in the operational environment.

The Contractor shall perform maintenance services including:

• Maintenance Requirements and Analysis

• Maintenance Design and Implementation

• Maintenance Delivery Services

C.3.9.1 Maintenance Requirements and Analysis Maintenance Requirements and Analysis involves identifying and classifying modifications and assigning an initial priority ranking. The Contractor shall provide Maintenance Requirements and Analysis services including the following for FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document):

• Perform maintenance processes and procedures consistent with software development best practices including but not limited to Agile development, industry standards, and the System Development Management Plan on file with HHS ITEPLC.

• Evaluate change requests (CR) to determine its classification and handling priority. Classification shall be identified as corrective, adaptive, perfective, or preventative (see Institute of Electrical and Electronics Engineers Standards Association/International Organization for Standardization/International Electrotechnical Commission (IEEE/ISO/IEC) 14764-2021, IEEE International Standard - Software engineering - Software life cycle processes - Maintenance). The CR shall be analyzed in conjunction with system and project documentation to determine the feasibility and scope of the modification and to devise a preliminary plan for design, implementation, test, and delivery.

• Provide deliverables as specified in the contract consistent with the application’s Release

Management processes and IEEE/ISO/IEC 14764-2021.

• Develop, deliver and implement (per Government approval), a project management plan that documents a maintenance development plan, processes and procedures consistent with HHS operational needs and release management practices and Release Strategy (hhs.gov).

C.3.9.2 Maintenance Design and Implementation The contractor shall perform design and implementation of maintenance modifications for FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document) including the following:

• Provide design services based on the products from the Maintenance Requirements and Analysis task in conjunction with current system and project documentation and existing software and https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/policy-for-information-technology-enterprise-performance.html databases.

• Develop source code and create implementation products necessary for test and installation of modifications.

• Develop and update existing test strategies.

• Perform development testing to ensure the quality of maintenance modification products prior to validation and implementation testing.

• Upon successful testing and Government approval, integrate the modified software into the system.

• Conduct validation and implementation testing.

• Update system documentation and operations manual to reflect changes to the system resulting from the modification.

C.3.9.3 Maintenance Delivery Services The Contractor shall perform delivery services after successful validation and implementation testing of the maintenance modifications for FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document), including:

• Identify the maintenance modification for a specific maintenance release dependent on its priority and classification within the context of HHS release schedules, processes, and priorities.

• Comply with HHS standard release practices, products, and schedules.

• Ensure the maintenance modifications are ready for release in accordance with HHS maintenance processes, procedures, and release schedules.

C.3.10 Data Request Services The contractor shall provide Data Request Services, which provides a more efficient and cost-effective means of satisfying the ongoing and increasing demand from various HHS internal and external customer/stakeholders for data. Such data requests are an unplanned workload that is unpredictable in terms of frequency, complexity, and urgency. Data requests originate from a variety of HHS internal and external sources, are usually somewhat unique in their content and format requirements, and often have short turnaround expectations. Data requests also are frequently high priority demands from HHS senior staff or are needed to support litigation or Congressional inquiries. Some data requests require coordination among multiple system support contractors to fulfill.

The Contractor shall implement a data request tracking log and track requests to completion accessible by the Government and reported in the weekly/monthly report. The Contractor shall fulfill data request within timelines requested, as approved by the Government.

C.3.11 Systems Administration The Contractor shall perform the following activities for FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document), in accordance with disciplined engineering practices, best practices and in compliance with applicable standards:

• Install, support, and maintain computer systems, data systems and applications, databases, and environments for which limited documentation exist.

• Provide technical support and systems engineering for the analysis, design, integration, installation, testing and lifecycle support of existing systems, associated with the delivery of infrastructure capabilities.

• Provide testing support that may include regression testing, product system integration, system performance testing and user acceptance testing.

• Provide the government all developed, modified, or converted source modules, processes, programs, scripts, operating instructions, databases, system fields, documentations, test files and test conditions used to develop each approved system changes request

• Plan and respond to service outages.

• Provide system recovery services, to include, diagnose, prioritize, and restore impacted services or devices including software and hardware failures, to resolution.

• Implement and ensure security preventive measures are fully functioning.

• Monitor, manage and enhance the performance of data systems.

• Support the implementation of all data system changes.

• Develop, maintain and re-engineer code for FOH systems for when no or limited legacy documentation exist (i.e., STM, FedHealth, MERITS).

• Provide design, configuration and maintenance services and support for custom, GOTS system, FedHealth, with minimal down time.

• Provide consultation on design, capacity planning, and performance enhancements to data systems.

• Design, implement, and manage server virtualization solutions, client virtualization solutions, terminal services, and secure remote connectivity solutions.

• Provide systems design, integration, configuration, implementation, recertification and maintenance support for multifactor authentication utilizing HHS Access Management System (AMS) and NextGen External Management System (XMS).

• Provide application hosting support and implement, and maintain development environments for all FOH applications within 30 business days after completion of the transition in.

• Maintain the master code repository and services used to support software configuration management for all applications in a secure location within the FOH hosting environment accessible by FOH.

• Perform installation of application updates on a bi-weekly schedule in accordance with the Contractor developed, and Government approved Change Management approval process.

• Develop a methodology for tracking and documenting application issues in a standardized format approved by the FOH COR and Chief Technology Officer.

• Document and track all application issues in format approved by FOH COR and Chief Technology Officer.

• Design and implement IT continuity plans.

• Perform planning, design, and periodic testing of continuity of operations (COOP) plans.

• Develop and deliver Systems Performance Report, daily or as directed by COR.

• Develop and deliver incident response report as required by HHS Security Policy.

• Engage with HHS Office of the Chief Information Officer (OCIO) and third-party vendors to provide resolution management.

• Analyze system log and server performance and usage reports for trends, operational anomalies, and solutions to systemic problems.

• Perform auditing activities in compliance with National Institute of Standards and Technology (NIST) and HHS auditing standards and requirements.

• Develop and deliver audit reports as required by HHS policy and as directed by the COR.

• Provide design consultation and implementation support for hardware and software upgrades.

• Implement and configure all data systems.

• Provide database administration and architecture support.

• Provide planning, architecting, requirements development and management services.

• Provide technical management and control, technical reviews, technical measurements, integrated risk management, configuration management, inspections and maintenance, source of supply and repair, testing and evaluation, and verification and validation support.

C.3.12 Enterprise Level Support Services These are the general enterprise-level support services required to facilitate the delivery of the Service Categories described herein. The Government does not consider these services to be priced separately. These general enterprise-level support services must be included in the services ordered under this contract. HHS has established the following requirements for achieving an effective, collaborative environment for the Program.

The contractor shall provide the following enterprise-level support services as approved by the Government:

• Provide HHS Services contractors and SCA contractors with full access to project-related work products and deliverables.

• Provide HHS, HHS Independent verification and validation (IV&V ) and SCA contractors with required access and visibility into project-related internal processes and practices.

• Facilitate a collaborative environment by:

o Providing immediate and complete responses to HHS and HHS Contractors’ requirements for project-related work products and deliverables within and between tasks and subtasks.

o Publishing schedules and participating in meetings to ensure clear communications between the Government and Contractors.

o Publishing communication plans that describe the Contractor's approach for ensuring a free flow of information and products among the partnership (HHS and Contractors) stored in the FOH Staff Portal.

• Contractors shall be held accountable for positive and negative collaboration performance that advances or impedes the ability of HHS and other Contractors to perform effectively.

C.3.13 Cybersecurity Services The contractor shall provide the following cybersecurity services support services for FOH systems, which includes specialized and customized government off-the-shelf (GOTS) applications (as described in section C.2.2., refer to FOH IT Systems, Architecture and Configuration Overview document):

• Conduct security vulnerability and threat assessments, analysis, and remediation.

• Patch software.

• Report security incidents.

• Coordinate with HHS OCIO, HHS ISSO/ISSM /Information System Security Officer/Information

Systems Security Manager and vendors, as applicable.

• Provide the HHS ISSO/ISSM with any information required by the ISSO/ISSM to meet the security responsibilities for the FCS system (e.g., FSTM, FedHealth, and FMerits) including development and updates to ATO, Federal Information Processing Standard (FIPS)-199, System Security Plans, Contingency Plans and Contingency Plan Test and Annual Assessments.

• Receive appropriate security training.

• Provide information needed for security data calls.

• Adhere to all applicable Federal IT security laws and regulation and HHS IT security rules and policies in all aspects of their operations and maintenance duties.

• The Contractor shall mitigate weaknesses from the date the weaknesses are formally identified in accordance with the following service level thresholds:

o Critical risk weakness– 15 calendar days.

o High risk weakness – 30 calendar days.

o Medium weakness – 90 calendar days.

o Low weakness – 365 calendar days.

• The Contractor, for deficiencies not addressed within the required thresholds identified above, shall document all remaining deficiencies in a system POA&M.

• The contractor shall develop and implement processes to document and track cybersecurity services.

C.3.14 Service Now Implementation and Maintenance The Contractor shall perform full SDLC services for the implementation and maintenance of ServiceNow, an OCIO managed service, for FOH IT operations. The contractor shall work with OCIO as necessary and shall provide full support to execute this task including the following:

• Planning – includes gathering requirements, defining business goals, and identifying risks.

• Analysis - includes researching product options, determining feasibility, and making recommendations.

• Design – includes developing and refining workflows and processes.

• Testing and Integration – includes develop and implement testing and integration plan.

• Implementation – includes developing and execute implementation plan; developing Standard

Operating Procedures (SOP)’s, participate in and providing user training.

• Maintenance – includes supporting software updates and updating SOPs and program documentation.

C.3.15 Agile Methodology The Contractor shall provide an iterative agile approach to development and system lifecycle management that provides the best opportunity to incrementally build and test software functionality. The Contractor shall follow the HHS Policy for Information Technology (IT EPLC) which includes agile development and continuous integration that are the baseline life cycle models used to structure and track progress and value. The Contractor shall use modular, agile, flexible service-based approach to systems enhancement.

C.3.16 Business Intelligence Power Tool The Government requires a contractor to provide appealing interactive reports and dashboards, with hands-on experience using business intelligence tools (i.e., Microsoft Power Business Intelligence (BI).

The contractor will work closely with various stakeholders to understand their needs and drive analyses https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/policy-for-information-technology-enterprise-performance.html that enhance data-driven decision-making processes. The contractor shall build data transformation and modeling. The contractor shall perform the following:

• Design, develop, implement, and support Business Intelligence solutions, including reports, dashboards, and templates for self-service BI.

• Provide performance optimization in Microsoft Power BI to include complex data modeling, and Data Analysis Expressions (DAX) scripting.

• The contractor shall create, integrate, and maintain workflow connections to unrelated database sources in the underlying data platform within the Microsoft Dataverse and online and on-premises data sources (i.e., Microsoft Azure, Excel, SharePoint, Dynamics 365, Office 365, Structured Query Language (SQL) Server, APIs, Microsoft Power BI).

• Conduct data acquisition using Power Query for data transformation and preparation.

• Create and maintain SQL queries for data analysis.

• Collaborate with stakeholders to gather requirements and translate business needs into effective visualizations.

• Create and manage end-to-end Power BI projects, from requirements gathering to deployment.

• Develop the semantic layers for the Microsoft Power BI tools utilized by the organization.

• Consume and create interactive reports utilizing Power BI Service features, including sharing, collaboration, and administration.

• Ensure data accuracy, consistency, and integrity within Microsoft Power BI solutions.

C.3.17 Power Automate Development The Government requires a contract to provide automation and workflow development, with hands-on experience using Microsoft Power Automate. The contractor will work closely with various stakeholders to understand their needs and create automated workflows that enhance business processes and reduce manual effort.

The contractor shall perform the following:

• Create, configure, and maintain workflows using Microsoft Power Automate.

• Develop custom connectors, actions, and triggers in Microsoft Power Automate.

• Integrate Power Automate with other Microsoft services (e.g., SharePoint, Dynamics 365, Office

365) and third-party applications to include external Application Programming Interfaces (APIs).

• Work with stakeholders to identify automation opportunities and gather requirements.

• Analyze existing processes and recommend improvements through automation.

• Provide technical expertise and recommendations for implementing new workflows.

• Conduct thorough testing of automated workflows to ensure functionality and reliability.

• Troubleshoot and resolve issues with existing workflows.

• Continuously monitor and optimize workflows for performance and efficiency.

• Document all workflows, including design, development, and deployment processes.

• The contractor shall provide training and support to end-users on using automated solutions.

• The contractor shall create user guides and technical documentation for solutions developed.

C.3.18 OneView Salesforce The Contractor shall provide support with FOH’s Salesforce platform, OneView, that is owned and managed HHS/Program Support Center (PSC.)

• Provide industry standard experience and provide recommendations to improve the Salesforce IT and Business implementations in FOH.

• Provide strategic planning advice and guidance including but not limited to, implementation support, meeting facilitation, preparation of system and program documentation, and serving as a liaison with HHS OCIO.

• Assist with creation of road maps, workflows, slide decks, development of project plans and Agile sprints.

• Apply Agile methodologies and Human Centered design principles.

• Develop use cases, user stories, and acceptance criteria.

• Analyze existing processes and recommend improvements through automation.

• Provide technical expertise and recommendations for implementing new workflows and functionality.

• Conduct thorough testing of automated workflows to ensure functionality and reliability.

• Provide operations and maintenance additional support including additional development, testing, management guidance, leadership, and expertise to the FOH team.

C.3.19 SharePoint Design / Content Management The Contractor shall provide SharePoint design and content management services including the following:

• Create, configure, maintain, and improve FOH SharePoint sites including user access management and the collection and organization of data and metrics.

• Research various methods of collecting and tracking data and reporting in printable formats.

• Evaluate and improve existing processes and develop new processes where applicable.

• Develop, maintain, and improve SharePoint cloud/file share configurations and content.

• Create and test configurations, folders, documents, calendars, and other SharePoint objects, and scripts.

C.4.0 PROGRAM MANAGEMENT, PROJECT MANAGEMENT AND ADMINISTRATION SERVICES

C.4.1 Program and Project Management The Contractor shall provide program and project management services for all aspects of the contract through the integrated activities of planning, reporting and risk management, including the following, as approved by the Government:

• The Contractor shall provide a Project Management Institute (PMI) certified Project Management Professional (PMP) Project Manager.

• Lead and ensure project initiation, planning, execution, monitoring and controlling, and closeout for projects are according to PMI PMBOK® best practices.

• Establish and implement a communications process to ensure the Government has full transparency of the status of project activities.

• The Contractor shall ensure project success criteria are clearly defined and documented including measured against achievement of goals and can support Contractor recommendations to move ahead, correct, or terminate, as approved by the Government.

• The Contractor shall ensure project lifecycle phases (i.e., planning, execution, and closure) and management policies are performed and adhered to in accordance with timelines provided and/or agreed upon by the Government.

C.4.2 Work Breakdown Structure (WBS) and Microsoft Project Schedules Within 14 business days of contract award, the Contractor shall collaborate with HHS and shall provide a draft WBS of all of the project work and required project management (as required in C.4.1 Transition- In Services). The Contractor shall conduct a walkthrough of the WBS with HHS within one week of this delivery. The Contractor shall deliver a final WBS within six weeks after contract award and an additional walkthrough may be requested by HHS. The WBS will be baselined at HHS direction. In addition, the Contractor shall provide HHS with a contact list for the WBS or an alternative and comparable communications process for HHS to have transparency into the status of project activities at this level of detail. These specific delivery and review dates may change at HHS discretion based on project progress.

The Contractor shall update the WBS and project schedules on an on-going basis and deliver updates to the Government on a bi- weekly basis in accordance with the cycle of the bi-weekly project management status meetings or more frequently as directed by the Government. Both the WBS and schedule shall be maintained under a contractor-managed, HHS approved, integrated change control process which involves HHS in the approval of changes to the WBS at the control account level, and for schedule changes which impact the project end date and any key milestones.

C.4.3 Integrated Project Management Plan The Contractor shall develop and deliver an integrated project management plan within 30 business days of contract award, that is based on the Contractor’s proposal solution that breaks out management items to the contract requirements (e.g., Transition-In, Program and Project Management, Network Operations). The Contractor should update the integrated project management plan throughout the period of performance and deliver to the Government, bi-weekly or at frequency determined by the Government. The integrated project management plan shall identify updates throughout the contact performance period; shall be divided into 6 months increments beginning with contract award to the end of year one of the , with updates for subsequent years; and shall document and provide timelines for Contractor efforts that are multi-year efforts. At a minimum, this integrated project plan should include:

a. All technical activities (including documentation development) identified and organized in a Work Breakdown Structure (WBS) (as required in C.6.2) providing details for the Contractor to manage the work at no less than a weekly basis. At a minimum, the WBS shall be broken down at the contract requirement level.

b. Action Item Log.

c. All performance standards followed in support of these requirements.

d. Gantt chart which contains activities and milestones pertinent to the Contractor’s completion of the technical activities.

e. A description of expected result of each WBS level task and/or milestone in the Project

Management Plan.

f. A matrix of all deliverables, their version/release, and planned delivery dates.

g. A matrix of all personnel assigned to the program and total aggregate level of effort for all tasks.

h. Status of current and planned initiatives and programs.

i. Budget information (planned versus actual, including incurred but not billed, by task for all service labor hours,).

j. Task dependencies and interrelationships.

k. Project organization.

l. Contractor organizational structure.

m. Process management and controls.

n. A list of hardware and software utilized by the Contractor.

C.4.4 Risk Management The Contractor shall perform risk management services. The Contractor shall develop and deliver a draft and final Risk Management Plan (RMP) for review and approval of the Government. This RMP must comply with American National Standards Institute International Organization for Standardization (ANSI/ /ISO 31000:2018) risk management guidelines, The RMP should be implemented upon approval by the Government and shall describe how the Contractor:

a. Develops risk processes that encourage the identification of risks and continuing assessment/reassessment of risk exposure.

b. Manage and monitor risk handling decisions, in accordance with government approved timelines to prevent negative consequences.

c. Develop, manage, and monitor contingency and mitigation plans annually.

d. Tracks and monitors risk status.

The Contractor shall conduct risk identification sessions (including Government stakeholders and contractors), analyze and perform risk response planning, and track risks. The Contractor shall develop and maintain a risk registry bi-weekly. The risk registry shall include, date risk identified, description of identified risk, likelihood of risk, risk status, owner, and recommendations for mitigation strategy.

The Contractor shall develop and deliver a risk report bi-weekly or as directed by the Government, that summarizes risks.

C.4.5 Data and Document Management The Contractor shall develop program documentation in support of each contract task. Examples include but are not limited to integrated project plans, work breakdown structures (WBS) and project schedules, status reports, audit reports, agendas, presentation materials, meeting minutes, knowledge base papers, systems documentation, user guides, SOPs, and incident reports.

The Contractor shall establish, maintain, and administer an integrated data and documentation management capability for collection, control, publishing, and delivery of all program documents using FOH SharePoint or other system as directed by the COR. The data management system may include, but is not limited to integrated project plans, work breakdown structures (WBS) and project schedules, status reports, audit reports, agendas, presentation materials, meeting minutes, knowledge base papers, systems documentation, user guides, and SOPs.

The Contractor shall establish and implement a change control process which involves FOH in the approval of changes to program and project documentation (including integrated project plan, WBS, project schedules, and SOPs)

The contractor shall establish and maintain a naming convention and process for version control of program and project documentation.

C.4.6 Technical Writing Support The Contractor shall provide qualified personnel and services to perform IT technical writing services to include the creation or assembly of all IT related technical documentations used for technical reference (e.g., Customer User Guides, Standard Operation Procedure, Knowledge Articles, training materials, etc.). The Contractor shall work with the internal and external stakeholders, including technical support teams and end users, for the purposes of creating technical, operational, training medias, and support documentation, including presentations.

The Contractor shall provide technical writing support including the following:

• Develop, establish, and maintain policies, processes, and procedures.

• Collaborate with individuals from various internal functional areas to generate and review programmatic documents within agreed upon timelines.

• Communicate with subject matter experts to obtain details in order to accurately capture content material.

• Work closely with to develop and write content on the use of different technical equipment, systems, software applications, etc.

• Review the already written technical documents and make changes in the existing technical documents to update these as per the latest technical information.

• Research and translate technical information for non-technical and technical users.

• Originate, revise, and maintain internal and external SOPs. Recommend and conduct document formatting and reduce the complexity of existing internal SOPs.

• Adhere to the deadlines given by the government and ensure written products are error free, and of good quality content.

• Provide expertise and guidance in interpreting governmental regulations, agency guidelines, and internal higher-level policies to assure compliance.

• Establish and maintain a process for quality assurance of written products.

Performance of this task will be monitored and reported on in accordance with the QASP.