GEMS 2.0 Scope of Work

Georgia Enterprise Management Suite (GEMS) 2.0

GEMS 2.0 - Scope of Work (98000-GTA-EPMO-RFI-FY22-201) June 2022

Georgia Enterprise Management Suite (GEMS) 2.0 98000-GTA-EPMO-RFI-FY22-201

Contents Background & Purpose

Current State Challenges

Desired Future State

Requirements

1. High-Level Requirements

2. Requirements by Investment Lifecycle Phase & Investment Management Process

3. Document & Collaboration Management Requirements

4. Reporting and Analytic Requirements

5. System Security Requirement

Background & Purpose

GTA’s Enterprise Portfolio Management Office (EPMO) supports the technology investment decisions of State of Georgia Agencies across a lifecycle of project investment milestones. Through these milestone events, across the lifecycle of the project investment, the EPMO collects a wide range of valuable technology project investment data. However, over the years, the EPMO has acquired and developed tools that gather static, point-in-time technology project portfolio data. The current tools do not offer comprehensive project portfolio dashboard reporting today. Many of these tools are dated, manual and are not well-suited for agile, responsive development within a data management framework needed to enable the EPMO Dashboard Reporting Program.

The Georgia Enterprise Management Suite (GEMS 2.0) will replace the current static tools that enable the Project Investment Lifecycle manually today, with an application suite, document repository, and data management framework designed and architected with enterprise dashboard reporting in mind from day one. GEMS 2.0 is the central deliverable of the EPMO Dashboard Reporting Program (EDRP). The EDRP will be structured as a program comprised of several sub-projects that will deliver increased value to agencies and potentially citizens as well.

Current State Challenges

The table and image below depict the most significant challenges / limitations of the Legacy GEMS solution and other EPMO Tools needed to manage the Project Investment Lifecycle.

Legacy Tool Limitations

Description

1. Current EPMO tools function independently and do not share data.

2. Current EPMO tools were not designed with reporting and analytics in mind.

3. EPMO tools were acquired and/or created as point-in-time reactions to previous business challenges.

4. Current suppliers’ tools are rigid, expensive, slow, and not well-suited for agile, responsive development that can react to the speed of change.

5. None of the current EPMOs tools offer enterprise level project portfolio reporting and analytics.

6. There is no comprehensive data management framework in place to ensure data quality.

Desired Future State

To address the challenges with the current legacy GEMS, GEMS 2.0 will be reimagined, architected, and built as an integrated suite of tools using a low code application platform (LCAP), while adopting

Application Lifecycle Management (ALM) principles for agility and simplicity. With this approach, business users (citizen developers) or development professionals will be able to rapidly initiate, implement, prepare and operate solutions at the speed of change. Ease of use and speed to solution will be hallmarks of GEMS 2.0. The high-level requirements of the desired future state are as follows:

• Single Integrated Platform: The EPMO desires to have as much of the Project Investment Lifecycle as possible served by a suite of tools that work together and minimize third-party contracts/licensing, data storage limitations/fees and integrations and multiple data models.

• Improved Service Levels: The GEMS 2.0 platform will be the heart of all of Project Investment

Lifecycle business functions. It must be robust and integrated to facilitate user stories of multiple stakeholders and their supporting business processes while improving EPMO effectiveness by automating manual processes when possible. We expect to have a single investment record that tracks all lifecycle milestones, statuses, and documents from Idea through implementation upon completing this engagement.

• User-centric: The design will be intuitive and visually appealing, enable efficient access to information, and be accessible by multiple user types. The GEMS 2.0 look and feel must complement GTA branding and will enhance the view of the EPMO as a leader in innovation in simplifying how we support the project investment needs of State of Georgia agencies.

• Modern Enterprise Architecture: The platform for the GEMS 2.0 suite will be 100% cloud-based with the proven underlying architecture. Rather than looking for a supplier to host databases in a separate data center, we prefer a modern platform that is easy to maintain. Our new architecture must support GTA’s growth strategies and be capable of handling the size, scale, and complexity of our operating environment.

• Information Security: GTA is at the forefront of the State of Georgia information security best practices to ensure compliance with industry, state, and federal regulations and to protect the privacy of its employees, workforce, and stakeholders. GEMS 2.0 must adhere to modern information security principles while allowing for efficient statewide operations.

• Enhanced Reporting and Workflow Automation: A key benefit of GEMS 2.0 is to provide self-service operational reporting and built-in analytics to all levels of users across the Project

Investment Lifecycle. Enhanced reporting capability will support and enable more efficient compliance, improved decision-making, intelligent automation, and predictive analytics. Robust workflow should be available and easily configured to provide access to input or retrieve data in any Project Investment Lifecycle Milestone.

• Electronic Records: GEMS 2.0 will leverage modern case management features such as workflow tools that can eliminate manual processing and report preparation. Replacing electronic forms with intelligent digital ingestion tools will streamline investment tracking controls and speed time to procurement for users and agencies.

In addition to the primary requirements listed above, the EPMO expects to realize additional benefits including, but not limited to the following:

• Increased quality of data by implementing a data management framework

• Increased integration of key systems

• Single point of online access/entry and reporting for business owners, procurement officers, project managers, GTA leadership, EPMO staff, other GTA staff, Department of Administrative

Services (DOAS) staff, 3rd party contractors/suppliers and others

• Enhanced and simplified navigation, usability, features, and functionality

• Increased user satisfaction: business owners, procurement officers, project managers, GTA leadership, EPMO staff, other GTA staff, DOAS staff, 3rd party contractors/suppliers and others

• Tools to enhance the tracking of project investments

• Reduction in non-value activities, such as duplicate data entry, data manipulation, copy-paste, and other time-consuming tasks

• Streamlined processes and increased staff efficiency

• Greater flexibility to integrate with third-party and internal data visualization tools

Requirements

1. High-Level Requirements The following are the general or high-level requirements of GEMS 2.0.

1.1 The system must be configured as an interoperable suite of tools that share data for status, tracking and monitoring.

1.2 The system must enable and streamline Georgia Technology Authority's (GTA)’s Enterprise Portfolio Management Office (EPMO) to collect, tract and monitor a wide range of technology project investment data in the process of enabling the technology investment decisions of Georgia agencies across the Project Investment Lifecycle stages: Planning, Pre-Procurement.

Procurement, Award, Project Assurance, and Active Project Oversight.

1.3 The system must be able to provide event/milestone-based notifications via email, chat, or dashboard message.

1.4 The system must allow spell/grammar checking in all user entered data fields.

1.5 The system must allow basic formatting (bullets and numbering) in all user entered data fields.

1.6 The system must provide the ability to provide all defined stakeholders with Reporting and

Analytics (Dashboards) as applicable.

1.6.1.1 Public Citizens

1.6.1.2 DOAS Leadership and Staff

1.6.1.3 Office of Planning and Budget (OPB) Leadership and Staff

1.6.1.4 Agency Leadership

1.6.1.5 Agency Project Teams

1.6.1.6 GTA Leadership

1.6.1.7 GTA EPMO Staff

1.7 The system must provide the ability for agency-specific views of agency project portfolio data.

1.8 The system must have the ability to provide a central access point to submit procurement documents for review per OCGA 50-25-4, which empowers GTA to review all technology procurements. This requires agencies to submit procurement documents for review by GTA prior to being posted or approved. These include but are not limited to:

1.8.1.1 New Request(s) for X (RFI, RFP, RFQC, etc.)

1.8.1.2 Contracts / Contract Amendments

1.8.1.3 Statements of Work

1.8.1.4 IT Temporary Staffing Contracts (greater than $1m)

1.8.1.5 Sole Source Solicitations

1.9 The system must have the ability to interface with other systems or 3rd party suppliers to collect, track and monitor a wide range of technology project investment data.

1.10 The system must have the ability to upload various file types. Including, but is not limited to:

1.10.1.1 Adobe PDF

1.10.1.2 Microsoft Word Documents

1.10.1.3 Microsoft Excel Spreadsheets

1.10.1.4 Others as defined

2. Requirements by Investment Lifecycle Phase & Investment Management Process

The EPMO business unit manages several Investment Management Processes. These processes occur as various project investments evolve through EPMO Project Investment Lifecycle. The intent of this section of the GEMS 2.0 Scope of Work, is to provide context for how The Processes interact with the events of The Lifecycle. The visual representation of this context is conveyed in the color-coded illustrations below, the subsequent detail in the paragraphs below, and the GEMS 2.0 DETAILED Requirements.xlsx – provided separately.

GTA | EPMO Project Investment Lifecycle v1

GTA | EPMO Investment Management Processes v1

2.1 Planned Investment Management Process-

Must allow all designated system users to register and onboard all project investment procurement documents. This includes the ability to enter, modify documents by agency, program, and project and be displayed in dashboards for tracking and reporting.

2.2 Business Case Review Process-

Must allow all designated system users to enter or upload the justification for proposed investment based on the estimated cost against the risks, anticipated business benefits, and savings gained. This requirement must be able to accommodate co-authors, ability to download completed documents, versioning, and the formatting capabilities of a word processing solution such as MS Word.

2.3 Exemption Review Process-

Must allow all designated system users to complete or access a downloadable link, to a questionnaire that, once completed, provides agencies with an avenue to deviate from enterprise IT policy or standard upon review by the GTA Planning and Strategy Office.

2.4 Technology Procurement Review-

Must allow all designated system users to upload multiple (15-25) attachments that will be reviewed independently by a team of 3-5 reviews, capturing individual risk observations from a

Procurement Awarded Active Project

Portfolio Archived

Project Registry Pre-Procurement Project Assurance Planning

Procurement Awarded Active Project

Portfolio Archived

Project Registry Pre-Procurement Project Assurance Planning

Procurement Awarded Active Project

Portfolio Archived

Project Registry Pre-Procurement Project Assurance Planning

Procurement Awarded Active Project

Portfolio Archived

Project Registry Pre-Procurement Project Assurance Planning separate procurement checklist (.xlsx) containing 130-150 unique risk areas and to populate in a recommendation table that gets added to official Procurement Review Letter that documents GTAs endorsement positions, risk observations and corresponding recommendations. All individual recommendations must be captured by agency, program, project and key performance indicator (KPI); and able to be displayed in dashboard reporting.

2.5 Project Assurance Assessment-

Must allow all designated system users to respond to questions on cost, criticality and complexity that are scored and provide a composite score that is plotted against project assurance tiers that determine the type of assurance should be applied to the project investment.

Independent Verification & Validation (IVV) Tier Assessment Scoring:

•Tier 5: Full IVV: 26 – 32 (Very High) •Tier 4: IVV Heavy: 20 – 25 (High) •Tier 3: IVV Medium: 14 – 19 (Medium) •Tier 2: IVV Lite: 7 – 13 (Low) •Tier 1: GEMS Reporting: 0 – 6 (Very Low)

IVV Tiering Description

Tier 5: Full IVV– All federally-funded projects regardless of budget or assessment scoring.

Federal reporting or compliance requirements may or may not exist. Use the full spectrum of IVV deliverables. An IVV Vendor will be selected.

Tier 4: IVV Heavy – Projects that score very high or high in criticality, complexity, and Risk;

and no Federal reporting requirements. IVV Vendor is selected using appropriate level of deliverables based on assessment.

Tier 3: IVV Medium – Two of three categories are ranked medium to high. IVV provided by vendor, Subject Matter Expert (SME) or GTA EPMO and reviews project using appropriate level of deliverables based on assessment.

Tier 2: IVV Lite – Two of three categories are ranked low to medium. IVV provided by vendor, SME, or GTA EPMO and reviews project using appropriate deliverables based on assessment.

Procurement Awarded Active Project

Portfolio Archived

Tier 1: GEMS Reporting – Two of three categories are ranked very low to low. Project will report through GEMS only.

2.6 Independent Verification & Validation Requirements-

GTA is required by legislation to provide IV&V services for executive branch agency IT projects with a budget of more than $1 million. IV&V requirements must allow all designated system users to perform an independent assessment by a 3rd party assessor who monitors and evaluates projects throughout their lifecycle. The IV&Vs observations must be captured by key performance indicator (KPI) and both a project health & KPI health indicator assigned. Also, must allow an EPMO user to override the entries of an IV&V vendor while leaving an audit trail.

Procurement Awarded Active Project

Portfolio Archived

2.7 Project Team Dashboard Reporting Requirements-

The GTA EPMOs GEMS Project Team Dashboard Reporting tool tracks project team stakeholders’ responses monthly, to KPI-specific questionnaires to provide insight on the health of in-flight projects. GEMS Project Team Dashboard Reporting combines quantitative, operational data with qualitative free-form responses.

Portfolio Archived

Communication-

• Quality of communication, both upwards and downwards

• Level of training for customers/users

• Sufficiency of project status reporting to all stakeholders

• Requirements defined and communicated well enough to move forward

Cost-

• Confidence that budget contingency amount is sufficient

• Sustainability model that is defined and regularly reviewed

• Project-to-date costs meeting expectations

Issue Management-

• Effectiveness of issue management occurring

• Escalation path in place for all issues

• Timely resolution of issues

Quality-

• Acceptability of deliverables reviewed during last reporting period

• Satisfaction with quality of work product to date

• Success criteria well defined

Risk Management-

• Effectiveness of risk management occurring

• Documented response strategies for risks

• Level of risk carried by the project

Schedule-

• Confidence in viability of the schedule

• Schedule performance

• Changes to schedule expectations

• Submission of schedule into tool

KPI dials represent the result of questionnaires are sent to:

• Project Managers (PM)

• Business Owners

• Sponsor

• CIO

• Team Leads

• Supplier PM

• Team Members

3. Document & Collaboration Management Requirements

Currently document collection and collaboration are captured, but not easily accessible as the project investment changes status throughout the Project Investment Lifecycle. These requirements are critical for maintaining a total picture of the project investment.

3.1 Planned Investment Notification (PIN) / Onboarding- Must allow onboarded project investments and associated documents to be uploaded and associated with the investment.

3.2 Business Case Review- Must allow business case documents to be uploaded and associated with the onboarded investment. (w/out this, files must be copied and moved)

3.3 Procurement Review- Must allow all procurement documents (RFx, SOWs, Contracts, Contract Amendments, Sole Source Solicitations) to be uploaded and associated with an onboarded investment. (w/out this, files must be copied and moved)

3.4 Active Project Oversight- Must allow access to all uploaded procurement documents (RFx, SOWs, Contracts, Contract Amendments, Sole Source Solicitations) when project investments progress through the Project Investment Lifecycle. (w/out this, files must be copied and moved).

3.5 Inactive Project Repository- Must allow all procurement artifacts (RFx, SOWs, Contracts, Contract Amendments, Sole Source Solicitations, Chats, Apps, Schedules, Notebooks, etc.) to be uploaded and associated with an onboarded investment.

3.6 Inactive Project Status- Must allow all procurements to be assigned an inactive status (Closed, On-Hold, Archived, Merged, etc.).

Portfolio Archived

4. Reporting and Analytic Requirements GEMS 2.0 must deliver comprehensive, easy-to-use, dashboard reporting and analytics for all designated system users, for any data captured and tracked in EPMO Project Investment Lifecycle.

4.1 GEMS 2.0 must have establish a data management infrastructure and framework that can make application data available for data reporting and analytics in the same ecosystem as the application development platform data sources, or for consumption by other 3rd party data visualization tools, for authenticated and public users.

4.2 The system must provide detailed audit trails to track data entries by agency, division, user, content, date, etc.

4.3 The system must have the ability to query and report on all EPMO Project Investment Lifecycle

Milestone events including:

Planning Pre-Procurement Procurement Awarded Project Assurance Active Project Oversight Inactive Archived Projects

4.4 The system must provide the ability to have detailed transaction audit trails saved and available to users, for reporting by agency, transaction date, and user.

4.5 The system must have predefined standard reports included with solution. The standard reports should provide the option to include graphic representation of data in the form of bar charts, pie charts and other visualizations.

4.6 The system must provide easy to use ad-hoc reporting tools for end users to query data, write reports, perform ‘what-if’ analysis and save the queries for future use.

4.7 The system must provide the ability to set-up and track key performance indicators and provide graphical reports and historical trends. The key performance indicators must include the following KPIs/Metrics:

Overall Communication Cost Issue Management Quality Risk Management Schedule Governance

Operational Readiness Organizational Change Management Vendor Management Resource Management

4.8 The system must have the ability to report on historical data.

4.9 The system must have the ability to report on KPI related metrics for the current period and compare with values from previous periods.

4.10 System must allow EPMO users to override agency project team assessment of any KPI.

4.11 The system must have the ability to report on KPI related metrics for the current period and compare IV&V assessments with values from agency project team assessments.

4.12 The system must have the ability to export reports and date into the following file formats:

Adobe Acrobat, Microsoft Word, Excel, Text File (comma or tab delimited), and Rich Text.

4.13 The system must have the ability to run reports on a user defined scheduled basis.

4.14 The system must have the ability for all user-defined fields must be available for ad- hoc reporting capabilities.

5. System Security Requirements

5.1 The GEMS 2.0 Supplier is responsible for ensuring the proper information security controls are in place and for providing a third-party audit reporting of status of those controls. The State uses the Federal Information Security Management Act (FISMA) security framework and has classified the data and systems related to this service as MODERATE for confidentiality, integrity, and availability.

5.2 The GEMS 2.0 Supplier will provide a third party SSAE18 SOC 2 Type II audit report of the NIST controls at the time of proposal and annually after that.

5.3 The GEMS 2.0 Supplier will provide a Service Level Agreement (SLA) for system availability including the scheduled maintenance windows and the process for notifications for changes.

5.4 The GEMS 2.0 Supplier will provide redundant infrastructure for availability to include a disaster recovery plan with a service level agreement for recovery time.

5.5 The GEMS 2.0 Supplier will provide a copy of their business continuity plan.

5.6 The GEMS 2.0 Supplier will comply with the State’s data security and hosting policies such as requiring employee and contractor background checks, and that the data resides in the United States and is only accessible only to US Citizens.

5.7 The GEMS 2.0 Supplier is responsible for notification and remediation in the event of a breach in security. The supplier shall follow formal documented security incident response procedures involving data and shall maintain a plan that addresses incident preparation, identification, assessment, containment, eradication, recovery, and follow-up. Supplier shall immediately notify the State regarding any data breaches or policy violations involving data. Supplier will describe the protocol and notification schedule in the event of a system breach and how the vendor will assist DOAS is developing the overall security plan for the system.