DRAFT SOW - eAcq Continuous Development.pdf

Statement of Work eAcquisition Continuous Development

1. OVERVIEW / BACKGROUND.

The Library of Congress (Library) Contracts and Grants Directorate (CGD) negotiates and awards approximately 2,000 contracts and grants for $250 million annually. The CGD Deployed the eAcquisition application on the Distributed Solutions Incorporated (DSI) AEON platform. The application enables the generation of data and documents to request, execute, and manage Contracts, Grants, and other transactions. The eAcq application is hosted in the Microsoft Azure Cloud and maintained by the AEON software manufacturer, DSI. The eAcquisition application is closely interfaced with the Legislative Branch Financial Management System (LBFMS), hereinafter “Momentum”. The integrated solution enables Library Service Unit (SU) staff to identify, prepare, review, and submit requests for contracts, grants, and other transactions to CGD Staff and for financial budget and commitment data to be ingested into the eAcq application, for CGD Staff to prepare solicit and award documentation in eAcq and forward to SU Contracting Officer Representatives (CORs) and other SU staff to support their contract oversight and management roles. The Momentum interface transmits data between eAcquisition and Momentum to properly record financial obligations to the Library’s General Ledger. The eAcquisition application stores record copies of documents and data, i.e. the Contract File, for contracts, grants, and other transactions and preserves them to ensure their availability for audit, litigation, or other purposes pursuant to the applicable National Archives and Records Administration schedule. Data and reports from the eAcquisition application are transmitted to a server within the Library’s network environment and ingested to the Library’s Acquisition Dashboard, which presents key visualizations of data and associated metrics to facilitate effective contract and grant management.

2. SCOPE

The contractor shall license, maintain, and upgrade the eAcquisition application, including interfaces to the Legislative Branch Financial Management System (LBFMS) and associated reporting applications.

3. REQUIREMENTS

The contractor shall license, maintain, and upgrade the eAcquisition application including interfaces to the Legislative Branch Financial Management System (LBFMS) and associated reporting applications. The system must maintain a security management continuous monitoring environment that meets or exceeds the latest edition of FedRAMP Cloud Computing Security Requirements Baseline and must be updated periodically to meet FedRAMP Continuous Monitoring Requirements.

3.1 Licenses: The Contractor shall provide the following Licenses:

• 50 Licenses for eAcquisiton/AAMS: AEON Document & System of Record Management Solution w/ Basic Contract Writing

• 150 Licenses for eAcquisition/POMS: AEON Program-Office Planning & Funding Solution

• 300 Read Only Licenses

At the Library’s sole discretion, the Library may purchase up to an additional 50 AAMS licenses and up to an additional 200 POMS licenses pursuant to the clause at 52.217-6.

3.2 Iterative/Agile configuration and deployment: The Contractor shall provide continuous development services to configure and deploy fixes, updates, and enhancements to the eAcquisition Application following an iterative process. The contractor shall deliver an updated application for inspection and acceptance and gather feedback for further application development. Standard Agile practices are defined by the SCRUM Alliance, including sprint planning, daily scrums, user story-based development, continuous integration, automated testing, and measuring project progress and value through the use of agile tools and methodologies (i.e., velocity, burn down and burn up charts). The Contractor shall maintain, execute, and provide updates to a product backlog accessible to the Contracting Officer’s Representative (COR) and product owner within the Library’s JIRA application or an alternate application to be hosted by the contractor. The application shall include all technical and functional user stories, bugs, and tasks to determine required subject matter expert or other resources needed to participate in upcoming sprints and to track successful completion of all work.

3.2.1 Maintenance and Continuous Development

The Contractor shall provide the Library will unlimited access to all software patches/updates, documentation, and APIs made available during the contract period of performance. The contractor shall provide ongoing maintenance and production support for the system which includes at least quarterly releases, updates, bug fixes as well as upgrades and enhancements to the system. The Contractor shall make every effort to provide software updates and maintenance in conformance with the Technical Support section Below.

3.2.2 Technical Support

Contractor shall correct any failure of the SaaS Solution (collectively, “Defects”). Defects will be classified by Library as Priority 1, 2, 3 or 4 in accordance with the descriptions below. Contractor shall use commercially reasonable efforts to repair any Defect (or provide a technical workaround if immediate repair is not possible) within the following specified priorities and time frames:

a. Priority 1 Defects: Priority 1 Defects are defined as Defects that prohibit operation of a mission critical SaaS Solution function that materially prohibits or severely inhibits a business operation unless remedied and for which there is no reasonable workaround. Contractor shall respond within 30 minutes of receiving notice of a Priority 1 Defect and will immediately attempt to resolve the Defect. Contractor shall use best efforts to resolve the Defect immediately; however, the Defect must be resolved no later than 24 hours after contractor has been notified.

b. Priority 2 Defects: Priority 2 Defects are defined as Defects that prohibit operation of a critical SaaS Solution function but for which a reasonable delay will not hinder operations or where there is a workaround that can be employed in the interim. Contractor shall respond within 24 hours of receiving notice of a Priority 2 Defect and must schedule the Defect for resolution. Contractor shall use best efforts to resolve the Defect within two (2) business days, however the Defect must be resolved no later than seven (7) business days of receiving notice thereof.

c. Priority 3 Defects: Priority 3 Defects are defined as Defects that are incorrect operations of the SaaS Solution and inhibit the optimum operation of a business function but do not prevent the function from being performed with or without a workaround. Contractor shall respond within forty-eight (48) hours of receiving notice of a Priority 3 Defect and must schedule the Defect for resolution. Contractor must to resolve the Defect within thirty (30) days of receiving notice.

d. Priority 4 Defects: Priority 4 Defects are defined as Defects which are incorrect operations of the SaaS Solution but which do not inhibit or prevent a software function from being performed. Contractor must respond within seven (7) days of receiving notice of a Priority 4 Defect and must log the Defect.

Contractor shall use best efforts to resolve the Defect in the next major release of the Software or as mutually agreed with the COR.

3.2.3 Technical Support Hours

a. Contractor shall provide non-emergency support services (i.e., those for Priority 2, 3, and 4 Defects) must be performed between the hours of 9:00 am and 8:00pm Eastern Time, Monday through Friday excluding holidays.

b. Emergency Support: Contractor shall provide an emergency telephone number (in addition to a support web site and/or an online request for assist system) for support technician on duty, to provide support exclusively for Priority 1 issues 24 hours a day Eastern Time, seven days per week.

c. Initiation of support: Contractor shall provide the COR with access to a web support ticket system that assists in processing and handling support issues. The Library will use reasonable efforts to initiate all support requests through such system unless doing so would, in Library’s opinion, unreasonably delay Library’s access to the support services.

3.2.4 Backups and Disaster Recovery:

Contractor shall maintain and implement regular data database backups and disaster recovery and avoidance procedures to ensure that the SaaS Solution is not interrupted during any disaster. Contractor shall provide the COR with a copy of its current database procedures and disaster recovery plan, at the beginning of the Period of Performance for this contract, when any updates to that plan occur during the term or anytime upon request by the COR. The requirements of this Contract, including those relating to security and confidentiality, shall apply to the database backups and Contractor disaster recovery site.

4. PROJECT MANAGEMENT

4.1. Kickoff Meeting

Contractor shall participate in a project kickoff meeting via Zoom (or another video-conference platform) with the COR and Library stakeholders. At this meeting, the Contractor shall identify major phases of work, key milestones, review sessions, deliverables, and review duration expected of Library staff. Assumptions, risks, and any known issues related to the application should be noted at the meeting.

4.2 –Status Reports

The Contractor shall schedule and host weekly meetings with Library stakeholders to identify and discuss issues and upcoming Knowledge Base and other releases and upgrades. The contractor will maintain and communicate the release schedule to stakeholders, and provide notification to stakeholders at least one week in advance of any proposed changes to the application.

5. TRAINING

The contractor shall provide targeted live, on-line training for users three times annually, in concurrence with any major upgrade or release and to introduce new staff to the use of the application. Training shall be for a minimum of four hours and shall be recorded and made available to Library staff for viewing on demand. The contractor shall provide any training material, role-based Users and System Administrators guides to the COR for review at least Ten (10) business days prior to any scheduled training. The COR will provide feedback within Five (5) business days of receiving the course material.

Any changes required by the COR must be made by the Contractor within Three (3) business days. All training material provided by the contractor may be duplicated and used by Library staff to train others at the Library.

6. OTHER REQUIREMENTS

C.6.1 Accessibility

The Library has a responsibility to ensure an equitable user experience for system users (internal Library staff and external applicants) with disabilities. At a minimum, the grants system must:

a. Meet or exceed applicable Revised Section 508 Standards and WCAG 2.1 A and AA standards without the use of accessibility overlay technology. Overlays include third-party applications, which use JavaScript to alter the product interface.

b. Support the creation of accessible content. Any parts of the system that allow for content creation must meet or exceed Authoring Tool Accessibility Guidelines (ATAG).

c. Allow seamless use of the integrated assistive technology, particularly the screen reader.

d. Include reference guides and/or customer service support for users of assistive technology using the platform.

e. Provide accessible alternatives for print materials including braille and large print versions.

The Contractor shall:

a. Designate a point of contact for accessibility issues;

b. Fix accessibility issues found during the period of performance of the contract within 90 days of reporting; and

c. Fix accessibility issues found after deployment of new versions, features and other changes to the system. Issues must be resolved within 90 days of reporting.

C.6.2 Software Vulnerabilities

Software used by the Library is subject to routine security scanning whether hosted internally or externally as part of the Library’s continuous security monitoring program. These security scans may result in the identification of software security vulnerabilities that must be mitigated within the following timeframes:

• High Vulnerabilities - within 30 days

• Medium Vulnerabilities – within 180 days

• Low Vulnerabilities – within 360 days https://www.access-board.gov/ict/ https://www.w3.org/WAI/standards-guidelines/wcag/glance/ https://www.w3.org/TR/ATAG20/

Upon notification of a security vulnerability, the contractor shall take steps to correct the vulnerability within the above timeframes, including code modification, testing and installation on all Library instances of the software. The contractor shall also provide documentation, such as, release notes, installation guides and user guides, documenting the changes made to the software to address the identified vulnerability. Costs associated with addressing software security vulnerabilities are not reimbursable separately and must be included as part of the contractors quote for providing the Library the software licenses or software maintenance.

Per Library’s IT Security Directive 5-410.1, as the Library continues its move of more IT systems to cloud service providers, the Library’s Office of Chief Information Office (OCIO) directs that Federal Risk and Authorization Management Program (FedRAMP) Cloud Service Providers be used. FEDRAMP Authority to Operate (ATO) documentation should be leveraged which reduces the Library’s time and the effort it takes to complete a full A&A. For more information on required documentation and IT Security process by product type, please see Attachment J-1 (SAAS/PAAS Requirements).

C.6.3 Key Personnel

The following position is considered contractor key personnel:

Project Manager – Contractor shall provide a Project Manager to be responsible for managing the Contractor’s team, coordinating the creation and maintenance of the system, ensuring deliverable quality, representing the contractor’s team in various meetings and ensuring the contractor’s team has the appropriate skill sets and experience to perform the development activities that are scheduling in current and upcoming sprints.

(End of Statement of Work)