FINAL_HSHQDN-17-R-0002_RPM_RP_RFP-Atch_17-Configuration_Management_Plan-2017-1-19.docx

Radiation Portal Monitor Replacement Program

RFP HSHQDN-17-R-0002

Attachment 17 Configuration Management

The Radiation Portal Monitor (RPM) supports law enforcement activities at US ports of entry (POE). Configuration Management (CM) is required to ensure that the RPMs have met cybersecurity and CBP Enterprise Architecture requirements. Thus, CM ensures that only the approved RPM systems of record are deployed. CM is the responsibility of the Government and the Offeror. The Government is responsible for ensuring that any configuration changes are verified, tested, and certified with CBP’s Enterprise Architecture before deployment. The Offeror is responsible for proposing, developing, testing, transmitting, and tracking configuration changes throughout the RPM lifecycle.

The Government’s requirements and recommendations for an effective Configuration Management Plan (CMP) are contained in this attachment as a sample. Part A details the specific requirements for configuration management for Department of Homeland Security, Customs and Border Protection Non-Intrusive Inspection, and the Domestic Nuclear Detection Office. Part B provides an example outline with specific items typically included in an effective CMP for an RPM system being modified and deployed.

Part A. Expected Configuration Management Activities The Offeror will be required to have CM as part of the RPM Replacement deployment. The Offeror’s CMP should capture all CM activities that effect the system’s configuration. The Offeror is expected to:

· Develop, document, and maintain under configuration control, a current baseline configuration of the RPM system

· Establish and document configuration settings for information technology products employed within the RPM system

· Document an inventory of all RPM system components that accurately reflects the current RPM system and includes all components within the system boundary

· Perform CM during integration, testing, and operation of the system

· Provide Requests for Deviation for changing the system configurations when required

· Document, manage, and control integrity of change to the RPM system or any of its components

· Implement only Government-approved changes to the system, component, or service The Offeror will be required to:

· Test software and firmware updates for effectiveness, potential side effects, and potential security impacts before proposing the change to the Government

· Maintain a configuration database for all deployed RPMs by serial number and Logistics Control Number (LCN) for all Line Replaceable Units (LRU) of the RPM

Part B. Contractor Configuration Management Plan Outline The following outline is provided from MIL-HDBK-61A Configuration Management Handbook as an example to Offerors to identify the Government’s general expectations of an Offeror’s CMP. (Differences between the RPM Replacement Program and the Handbook are due to deviations in acquisition strategy.)

Section 1. Introduction

· The purpose, scope and specific contractual applicability of the CMP and the program phase(s) to which it applies

· A brief description of the system or top level Configuration Item (CI), and of the component lower level CIs, such as each LRU, to which the CMP pertains

· Reference to applicable directives or glossaries containing definitions of terminology and acronyms used in the plan

· A description of the plan's major features and objectives and a concise summary of the Offeror's approach to CM, including any special conditions (such as large number of organizations, security constraints, interoperability constraints, unique contracting methods, non-developmental items, etc.) upon which the approach is based.

Section 2. Reference Documents List of the specifications, standards, manuals and other documents, including Offeror policy directives, referenced in the Plan by title, document number, issuing authority, revision, and when applicable, change notice, amendment number, and date of issue Section 3. Organization Description and graphic portraying the Offeror's organization including:

· Relationships and integration of the project organization

· Responsibility and authority for CM of all participating groups and organizations, including their role in configuration control boards, and the integration of CM functions with other program activities

· Identification of the CM lead and their responsibilities

· Interfaces between the CM lead and the Government Section 4. Configuration Management Phasing and Milestones Description and graphics portraying the sequence of events and milestones for implementation of CM in phase with program milestones and events, including, at a minimum:

· Establishment of internal developmental configuration and contractual baselines

· Implementation of internal and tasking activity configuration control

· Establishment of configuration control boards

· Conduct of configuration audits Section 5. Data Management Description of the methods for meeting the CM of technical data Section 6. Configuration Identification The Offeror's configuration identification process and procedures, including, as applicable:

· System elements identified as CIs both hardware and software components

· Maintenance of configuration including document, drawing and software development libraries and corrective action process

· Configuration documentation required for the Product baselines and graphic illustration of configuration documentation relationships

· Release and correlation of manufactured products

· Assignment and application of configuration identifiers including document numbers, nomenclature, serial numbers, LCN, and software identifiers to hardware, software and firmware Section 7. Interface Management The procedures for identification of interface requirements, establishment of interface agreements, and participation in interface control working groups Section 8. Configuration Control This section shall describe the Offeror's configuration control procedures including, as applicable:

· Functions, responsibility, and authority of configuration control boards

· Classification of changes, and the level of authority for change approval/concurrence

· Processing of Requests for Deviation (RFDs)

· Processing of Notices of Revision (NORs) Section 9. Configuration Status Accounting Offeror's procedures for configuration status accounting, including, as applicable:

· Methods for collecting, recording, processing and maintaining data necessary to provide status accounting information via reports and/or database access

· Description of reports/information system content related to:

· Identification of current approved configuration documentation and configuration identifiers associated with each CI

· Status of proposed engineering changes from initiation to implementation

· Results of configuration audits

· status and disposition of discrepancies

· Status of requests for critical and major deviations

· Traceability of changes from baselined documentation of each CI

· Effectivity and installation status of configuration changes to all CIs at all locations

· Methods of access to information in status accounting information systems and/or frequency of reporting and distribution Section 10. Configuration Audits Offeror's approach to including plans, procedures, documentation, and schedules for functional and physical configuration audits; and format for reporting results of incremental or completed configuration audits Section 11. Subordinate Performing Activity/Vendor Control Methods used by the Offeror to ensure the effectiveness of subcontractor and vendor CM processes