Final OGP CPIC PMO RFI.pdf

GSA OGP CPIC PMO RFI Page 1 of 8

REQUEST FOR INFORMATION (RFI)

Office of the Government-wide Policy (OGP)

Capital Planning and Investment Control (CPIC) Project Management Office (PMO)

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE FOR MARKET RESEARCH ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. THIS IS NOT A SOLICITATION. The General Services Administration (GSA), Office of the Government-wide Policy (OGP), Capital Planning and Investment Control (CPIC) Project Management Office (PMO) is issuing this RFI notice to measure the interest and availability of vendors that are capable of providing IT Professional Services and agile software services who have:

● Agile software development experience;

● Advanced knowledge of the CPIC requirements in Office of Management and Budget (OMB)

Circular A-11 section 55;

● Experience with supporting a PMO that provides cross-functional multi-agency services, as well as directly supporting the agency customer of those services; and

● Deep experience supporting and iterating the service delivery model of a federal shared service

This RFI is to exclusively gain knowledge of interest, capabilities, and qualifications of various companies; it is not to be construed as a commitment by the Government. A contract will not be awarded as a result of this RFI. No reimbursement will be made for any costs associated with providing information in response to this RFI or any follow-up information requests. Failure to respond will not in any way prevent a potential offeror from participating in future solicitation. All information provided will be given consideration and may influence the development of future solicitation requests.

A. PURPOSE:

The purpose of this RFI is to conduct market research for the OGP CPIC PMO to provide agile application development, PMO support, and member agency support; including agile development, testing, new agency migration, CPIC knowledge/best practices, technical and functional support of the Folio application, the Federal IT Dashboard, as well as the development of the new IT Collect API product and the support services these systems provide to the federal enterprise.

The goal of this RFI is to gain understanding to determine the feasibility of partnering with vendors who have capabilities and capacity to provide.

B. BACKGROUND:

The GSA OGP CPIC PMO manages a suite of two products: Folio and the Federal IT Dashboard; and plans to introduce a third capability under the list Folio services, the IT Collect API. It also provides a full service, customer-oriented PMO, help desk, CPIC related services to its member agencies, and OMB CPIC Policy/Guidance support.

CPIC PMO:

The GSA CPIC PMO enables agencies, OMB, Congress, GAO, and the public to understand the value of their federal IT portfolios, manage the health of their IT investments, and makes better IT planning decisions

GSA OGP CPIC PMO RFI Page 2 of 8 through the use of the CPIC software solutions and the collaboration of a cross-government community of practitioners. It does this through managing the agency facing Folio application, the public facing ITDB application, and the future IT Collect API; as well as providing services and support to our member agencies and CPIC guidance Subject Matter Expertise (SME) support to OMB Office of the Chief Information Officer

(OFCIO).

Folio eCPIC was first released in 2004 by a consortium of federal agencies, and was transferred to GSA to manage in 2009. For over 16 years, eCPIC has served as a premier government-wide IT portfolio management shared service solution. Over time, the eCPIC tool became a legacy application that relied on outdated technology, resulting in growing development and maintenance costs. As a result, the Federal eCPIC Steering Committee (FESCOM) voted in 2017 to build a new application (Folio) to replace eCPIC. All of the eCPIC agencies were migrated into Folio and eCPIC will sunset in January 2021. Folio is the premier state-of-the-art, government-owned, web-base, fee-for-service, Software-as-a-Service (SaaS) technology solution for federal agencies, and is the successor to the legacy eCPIC application. Folio supports agencies in performing internal portfolio management, IT governance processes as well as meeting their external reporting requirements to OMB.

While the Folio tool is centrally managed by the GSA CPIC PMO, it is governed by three overlapping customer groups. The first group is the Federal eCPIC Steering Committee (FESCOM). This group consists of one member for each agency that uses the Folio tool. Every agency has a single vote on Folio and program mission related decisions. The FESCOM meets monthly to talk about IT Capital Planning and IT Governance Best Practices/Lessons Learned, as well as tool development/enhancement. Annually, the FESCOM votes on a single member to become the FESCOM Chairperson. This individual and the one or two individuals he/she appoints as vice-chairs are known collectively as the ‘FESCOM Leadership’, and they are the second group of governance for the program. The Chairperson and the Vice-Chairperson serve an annual term; however, there is no limitation on consecutive terms. In the event that the Chairperson cannot complete the term, the Vice-Chairperson becomes Chairperson and appoints a new Vice-Chairperson. The FESCOM Leadership works in partnership with the CPIC PMO to:

1. Develop a vision, strategies, priorities and schedules for the ongoing enhancement and support of the

Folio application;

2. Communicate and coordinate participation of partner agencies;

3. Identify issues, forge solutions and develop consensus among the membership;

4. Schedule meetings, establish agenda, and conduct meetings; and

5. Establish the procedures for promulgating decisions and resolutions.

The third and final group is the FESCOM Product Advisory Team (PAT). The PAT and reatled Tiger Teams serve the community as subject matter experts in both CPIC practices and Folio application design. They are charged to help the community to define requirements for the enhancement and support of the Folio application, and set the high level priorities for the Folio product roadmap. The FESCOM PAT Tiger Teams are composed of 1-2 FESCOM members per agency who choose to serve on the committee.

Folio product is 100% supported through a fees-for-services delivery model. Folio receives no appropriated funds from Congress and all program expenses are drawn from annual fees charged to member agencies.

Lack of reliance on appropriated funds as well as the need to provide member agencies best “value for the money” aligns the CPIC program directly with a “customer focus” model more common to the private sector than Government Agencies.

GSA OGP CPIC PMO RFI Page 3 of 8

Federal IT Dashboard / IT Collect API The F ederal IT Dashboard (ITDB) was launched in 2009 by OMB’s OFCIO to provide federal agencies and the public with visibility into how federal IT dollars are spent as well as report on the general health of agency IT investments. The ITDB collects and displays data received from agencies through the CPIC process through tools, like Folio. Information on the ITDB includes IT budget data, as well as IT project level cost schedule, risk, and performance.

Vision Over the next three plus years, OGP’s vision is to modernize the disparate IT data collection and visualization systems under its management, and to evolve the current state into a cohesive, centrally-hosted suite of systems and subsystems. For the first time ever, this capability will provide clear, digestible, and actionable CPIC and non-CPIC data to agency IT decision makers, OMB, and the public. The final suite of products will consist of two primary components. The first component in this evolution was the development and release of the agency-facing modernized Folio application, which focuses on the collection of agency CPIC and IT management data. Folio streamlines agency data entry processes, allowing agencies to collect data at various levels of their IT portfolio, and enables the integration of new technology, IT management strategies, and methodologies.

The second component is a complete redesign of the ITDB application to create the new IT Collect API. The new IT Collect API will be an API-only application that will follow modern software architecture best practices to collect CPIC and non-CPIC data required through OMB OFCIO data calls. In its production state, the application will serve as the omni-channel real-time data source to OGP’s Visualization Platform and other data visualization services based on various data access permission levels. This API will enable federal agencies, industry, the general public, and other stakeholders to view details of federal IT data collected by OMB OFCIO. IT Collect API will seamlessly interface with the downstream Folio application and other agency CPIC and management toolsets as well as the upstream OGP Visualization Platform through a restful API interface. The OGP Visualization Platform will display the IT Collect API data and other OGP data sources for agencies, OMB, and the public. This allows data sets from many sources to be displayed in one place and enables for greater access and analysis of that data.

The OGP CPIC PMO has strategically integrated and streamlined the CPIC Tool and ITDB modernization and continues to show innovation and government-wide cost reduction with the creation of the IT Collect API and the OGP Visualization Platform consolidation. This centralized management will drive the long-term vision to transition all OFCIO data collection through a single mechanism, OGP’s IT Collect API.

The consolidation of OFCIO’s data calls enables agencies to submit their OFCIO data requests. Additionally, agencies, OMB, and the public will have enhanced visibility into the results of those submissions (per their set permissions) and will likely reduce the overall number of data calls due to the ease and access of existing data.

This is a unique requirement, as the CPIC PMO requires code development for the Folio/ITDB/IT Collect API applications as well as extensive CPIC knowledge/best practices for Federal clients and OMB Policy support. All software development will be done within a predefined environment and must be accomplished through Agile methodologies.

http://itdashboard.gov/

GSA OGP CPIC PMO RFI Page 4 of 8

C. OBJECTIVE OF RFI:

The GSA OGP CPIC PMO is to conduct market research on vendor capabilities with extensive experience and knowledge in agile development, testing, transition, CPIC knowledge/best practices, and technical support services. To obtain services for a centralized continuity of support for Folio, IT Dashboard, and the development of the new IT Collect API product as well as the support services these systems provide to federal client agencies and OMB CPIC policy SME support. The new contract will ensure continuity of service for all critical business processes supported by the CPIC PMO.

D. SOLUTION OBJECTIVES:

Mature CPIC: Mature IT capital planning and IT investment management across federal agencies:

● Share and deliver CPIC best practices and lessons learned so all agencies can improve their internal practices by leveraging the experience of others;

● Deliver best-in-class guidance and training materials to improve knowledge around IT capital planning processes so agency end users can more efficiently and effectively use the tool;

● Develop a CPIC-as-a-service delivery model to efficiently provide agencies with CPIC subject matter expert support;

● Provide timely, customer-friendly support services, help desk, and training that meet the needs of the end-users; and

● Lead and participate in CPIC industry forums to bring best practice understanding to the FESCOM and to communicate FESCOM needs and challenges to external stakeholders.

Effective Guidance: Support OMB as their IT capital planning and IT investment management guidance and policy subject matter expert:

● Facilitate a collaborative CPIC guidance production process;

● Assist OMB to streamline CPIC processes that improve data quality and transparency while minimizing agency burden; and

● Ensure the development of IT Collect API capabilities align with and support OMB’s IT policy decisions.

Tool Modernization: Provide a modernized toolset for agencies and OMB to report and review IT cost, schedule, risk, performance, and contract data:

● Modernize current capabilities by utilizing a DEVOPS pipeline to enable Folio and the future IT Collect API applications to take advantage of modern technologies and implement current UI/UX, 508, and API web design standards; and

● Develop a new IT Collect API to replace the legacy ITDB that takes efficient advantage of technology platforms, a modern architecture, and a reduction in the effort required to update the dashboard with IT policy changes.

E. SCOPE OF RESPONSE:

Interested Parties are encouraged to provide a comprehensive capabilities statement on how they would provide GSA with the services noted herein. (See Attachment A, Business Questions and Discussion Topics)

GSA OGP CPIC PMO RFI Page 5 of 8

F. RESPONSE STRUCTURE:

The Respondent shall structure and number their response sections as prescribed below and address all items/topics listed:

1.0 COVER PAGE - One (1) page - The cover page of all submissions shall contain the following information:

● Company Name

● Company Description

● Primary Point of Contact Name, Address, Telephone Number, and Email Address

● Headquarter Location, Telephone Number

● NAICS Code

● Business Size and any socio-economic status claimed by the Respondent

2.0 SOLUTION OVERVIEW - Six (6) pages - Respondents shall provide responses to questions in

Attachment A: Business Questions and Discussion Topics.

G. RESPONSE INFORMATION.

The Government is not obligated to and will not pay for any information received from the potential sources as a result of this RFI. It is requested that interested businesses submit to GSA’s Contract Officer a brief capabilities statement package (single spaced, one sided, letter size, Times Roman, 12-point font minimum, with 1 [one] inch margins, in “.doc”, “.docx”, or “.pdf” file formats with a maximum of seven (7] pages including the cover page) demonstrating their ability to provide a solution and perform the requested services.

No Classified information will be included anywhere in your responses.

All proprietary information must be clearly marked in accordance with the instructions set forth below in “Marking Requirements.” Any information submitted in response to the RFI may be disclosed to GSA and other Government personnel. All information marked as proprietary information will be safeguarded by GSA to prevent unauthorized disclosures to non-government personnel and entities in accordance with applicable law and regulation. The GSA reserves the right to challenge proprietary information markings.

Notwithstanding any proprietary information marking, GSA shall be able to include any information provided by interested sources, in a subsequent Request for Quote (RFQ), should one be issued.

Marking Requirements: The header and footer of each page containing interested source proprietary information shall be marked with the legend “PROPRIETARY INFORMATION.” Further, the particular paragraph(s) section(s), etc. containing the actual proprietary information shall be clearly high-lighted or otherwise marked by the Respondent.

This is an RFI. No solicitation exists; therefore, do not request a copy of the solicitation. If a solicitation is released, it will be synopsized in Beta.Sam.gov or GSA Schedules. It is the potential offeror’s responsibility to monitor the release of any solicitation. The information provided in this RFI is subject to change and is not binding on the Government. GSA has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

GSA OGP CPIC PMO RFI Page 6 of 8

Responses are due no later than October 12, 2020 by 5:00 PM EST. Submit your responses via email only in “.doc”, “.docx”, or “.pdf” file formats to Bonnie Impastato, Contracting Officer at bonnie.impastato@gsa.gov with the email subject header “CPIC PMO RFI Response - {your company name}”. All responses received after the due date will not be considered. The Government is not obligated to review responses to the RFI received after the deadline specified above. Please be advised that all submissions become Government property and will not be returned. Only electronic submissions in “.doc”, “.docx”, or “.pdf” file formats will be accepted.

Questions: Questions regarding this RFI shall be submitted to the Contracting Officer, Bonnie Impastato, bonnie.impastato@gsa.gov with the email subject header “CPIC PMO RFI Question- {your company name}” by October 05, 2020, by 10:00 AM. EST. GSA will provide a consolidated response to all questions by October 07, 2020 by 10:00 AM EST. No questions will be accepted after the specified time and due date to submit questions. Each question submitted must cite the RFI Section number/title/RFI question number for which the question pertains, unless the question is general in nature and not specific to a particular portion(s) of the RFI.

Do not include the following in your response:

● Proposals or offers

● Requests to be considered for award or to be notified of a future solicitation

● Requests to be added to a mailing or distribution list

● Questions or comments not related to this RFI

● Classified information

ESTIMATED HIGH LEVEL MILESTONES DESCRIPTION DUE DATE

1. GSA Release of RFI, October 01, 2020.

2. Vendor questions on content of RFI October 05, 2020. (2nd business day after RFI Release)

3. Government Response to questions October 07, 2020. (4th business days after RFI Release)

4. RFI Responses from vendors, October 12, 2020. (7 business days from RFI release date)

H. ATTACHMENT LIST:

The following attachments are provided for portions of the response preparation:

Attachment A: Business Questions and Discussion Topics Attachment B: Security and Other Requirements mailto:bonnie.impastato@gsa.gov mailto:Carolyn.turner@gsa.gov

GSA OGP CPIC PMO RFI Page 7 of 8

Attachment A: Business Questions and Discussion Topics Please limit the response to the below questions to six (6) single spaced, one sided, letter size (8.5”x11”), 1 (one) inch margins, Times Roman, 12- point font single pages.

Section 1 - Agile Development:

1. Provide a value statement of your company's experience supporting agile software development practices within a large, cross-government community and how that experience would benefit the

CPIC PMO.

2. Provide a value statement on the importance of experience supporting agile software development in a fixed price environment.

3. In your experience, what are the characteristics of a successful agile development contract? What SLAs/metrics should the government include in a future RFQ to track agile development performance?

4. Recommend an agile development approach that both keeps in mind the principles of agile / iterative development as well as the predefined requirements of the A-11 section 55.

Section 2 - Project and Customer Service:

1. Provide a value statement on the synergies the GSA CPIC PMO could obtain from vendors with CPIC expertise integrally involved with the FESCOM, PAT Tiger Teams, providing PMO support, Help Desk support, OMB CPIC policy support, and IT Dashboard/IT Collect API agile development efforts.

2. Provide a value statement on how experience supporting a cross government shared service and community would benefit the CPIC PMO.

3. Provide a value statement on how experience with CPIC practices and processes as well as building a system supporting Capital Planning and Portfolio Management processes would benefit the CPIC

PMO.

4. Are the other offerings or services you think the CPIC PMO could offer to our member agencies?

5. Provide some best practices and innovative approaches to providing PMO support to the CPIC PMO.

Section 3 - IT Security:

1. What requirements should the government look for in regards to a vendor's experience with agile development software as it relates to meeting new security requirements as directed in new versions of the NIST 800-53 revisions?

2. The Folio application is currently hosted on FEDRAMP certified cloud infrastructure, but is not itself a FEDRAMP shared service. What experience or best practice approaches can you recommend for becoming a FEDRAMP Software as a Service (SaaS) certified application?

Section 4 - General:

1. What are the advantages/disadvantages of doing a single award versus a multiple award contract?

2. Which combination of contract types would you recommend for the sections 1-3 above?

i. Firm-Fixed- Price (FFP), Firm Fixed Price Level of Effort (FFP/LOE), and/or Time and Materials (T&M), Labor Hour (LH), or some mixture?

3. Describe your experience managing programs using Capability Maturity Model Integration (CMMI) level 4 or 5 processes?

4. Please identify and describe the government contract vehicles on which your services related to this RFI are currently available.

5. Provide a value statement on your company’s experience to quickly and successfully transition from in person to remote delivery of PMO support / agile software development services without a disruption of services.

GSA OGP CPIC PMO RFI Page 8 of 8

Attachment B – Security and Other Requirements

● GSA Information Technology (IT) Security Policy, Chief Information Officer (CIO) P2100.1

● Information Technology (IT) Security Policy, Chief Information Officer (CIO) P2100.1

● GSA IT Security Procedural Guide: Managing Enterprise Risk (Security Categorization, Risk)Assessment, & Certification & Accreditation) CIO-IT Security-06-30

Links:

● ADA 508 – https://www.section508.gov/

● Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that are comparable to people without disabilities. Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ic efresh/final-rule/text-of-the-standards-and-guidelines

● NIST - https://www.nist.gov/topics/cybersecurity

● GSA Information Technology (IT) Security Policy:

https://www.gsa.gov/cdnstatic/CIO_2100_1L_CHGE_1_CC040905_signed_PDF_version_7-15-201 9.pdf

● GSA IT Security Procedural Guide: Managing Enterprise Risk:

https://www.gsa.gov/cdnstatic/Managing_Enterprise_Risk_%5BCIO_IT_Security_06-30_Rev_16% 5D_10-03-2019docx.pdf

● IT Security Procedural Guide: Configuration Management (CM) CIO-IT Security-09-48, section

5.9:

https://www.gsa.gov/cdnstatic/Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_% 5BCIO_IT_Security_09-48_Rev_4%5D_01-25-2018.docx

● FY 21 IT Budget – Capital Planning Guidance (June 28, 2019): https://www.whitehouse.gov/wp-content/uploads/2019/07/FY-2021-IT-Budget-Guidance.pdf

● US Web Design Standards: h ttps://designsystem.digital.gov/ https://www.section508.gov/ https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.nist.gov/topics/cybersecurity https://www.gsa.gov/cdnstatic/CIO_2100_1L_CHGE_1_CC040905_signed_PDF_version_7-15-2019.pdf https://www.gsa.gov/cdnstatic/CIO_2100_1L_CHGE_1_CC040905_signed_PDF_version_7-15-2019.pdf https://www.gsa.gov/cdnstatic/Managing_Enterprise_Risk_%5BCIO_IT_Security_06-30_Rev_16%5D_10-03-2019docx.pdf https://www.gsa.gov/cdnstatic/Managing_Enterprise_Risk_%5BCIO_IT_Security_06-30_Rev_16%5D_10-03-2019docx.pdf https://www.gsa.gov/cdnstatic/Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_4%5D_01-25-2018.docx https://www.gsa.gov/cdnstatic/Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_4%5D_01-25-2018.docx https://www.whitehouse.gov/wp-content/uploads/2019/07/FY-2021-IT-Budget-Guidance.pdf https://www.whitehouse.gov/wp-content/uploads/2019/07/FY-2021-IT-Budget-Guidance.pdf https://designsystem.digital.gov/