HRIS TRD v3.docx

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Technical Requirements Document

1.1. (U) Multiple Domain Operations:

1.1.1. (U) The contractor shall deliver HCM services, compliant with DIA security requirements, on the unclassified and Top Secret/Sensitive Compartmented Information (TS//SCI) networks.

1.1.2. (U//FOUO) Unclassified: The Agency requires a HCM environment be capable of storing Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), and Protected Health Information (PHI) Tailored in accordance with DoD and IC Control Sets, Impact Level 5 Authorization) within the DIA NIPRNet authorization boundary.

1.1.3. (U) Provide full or partial HCM services on the unclassified and Top Secret/Sensitive Compartmented Information (TS//SCI) networks:

1.1.4. (U) TS//SCI: On the classified networks, there is an elevated level of security to ensure the protection of Agency data and systems that is interwoven in the design of the infrastructure and deployment of systems. To meet these requirements, the solution will adhere to all legal requirements, policies and guidance to meet Agency Cyber and security standards for deploying software or hosting services onto the TS//SCI domains. The HCM environment must align with Intelligence Community Directive 503 (ICD-503) security requirements as well as applying all applicable Intelligence Community Standards (ICS). The Agency requires the HCM environment to be capable of storing and handling Personally Identifiable Information, and Protected Health Information, and limited classified personnel information including meeting Intelligence Overlay B requirements.

1.1.5. (U) Unclassified: The Agency requires an unclassified external recruitment solution that secures data according to PII and PHI, as appropriate. This may be accomplished fully through an unclassified instance of the HCM solution, or partially via the HCM and interfaces with additional unclassified systems, such as USAjobs.com.

1.1.6. (U) As outlined in the Functional Requirements as a future, potential requirement, the government desires to provide a limited subset of HCM services to civilian employees in an unclassified HCM instance. This may be an extension or separate instance from the recruitment solution, or in conjunction with other DIA technologies already employed on the unclassified network.

1.1.7. (U) The contractor shall deliver an HCM environment that provides secure data flows, primarily of recruitment information, to and from the various networks in accordance with DIA cross domain capabilities and policies. The primary data will be transferred from unclassified to TS//SCI. A limited amount of unclassified data will be transferred from TS//SCI to the unclassified network.

1.1.8. (U) All software and infrastructure, on both the unclassified and TS//SCI networks, will be authorized for use according to DIA cyber security policies and procedures, further outlined in the Bidders Library.

1.2. (U) User Types and Loads

1.2.1. (U) The contractor shall provide an HCM solution that is scaled to the Agency’s population and that can manage a unique and diverse set of affiliates, record statuses, and user types.

1.2.2. (U) Affiliate Types: A personnel record must be maintained for various types of affiliates. Affiliate types do not always correspond with user types. Affiliate types are:

1.2.2.1. (U) Civilian Employee: Civilian employees for which DIA is responsible for all or most employee and personnel management services. ~16,500 users.

1.2.2.2. (U) Military Assignee: Military members assigned to duty permanently or temporarily with DIA. DIA is responsible for some personnel management services for military members, such as an updated personnel record, organizational assignment, awards, and performance management. Where possible, military member management will also require interfacing with service personnel systems to send and receive personnel information.

1.2.2.3. (U) Contractor: Non-employees for which DIA is responsible for minimal personnel management, such as an updated personnel record, organizational assignment, and access to agency-wide services such as Americans with Disabilities Act (ADA) Reasonable Accommodation requests.

1.2.2.4. (U) Candidate: A user of the unclassified, external recruitment instance that has been selected for employment processing.

1.2.2.5. (U) Applicant: A user of the unclassified, external recruitment instance that is applying for employment at DIA.

1.2.3. (U) User Types:

1.2.3.1. (U) General Users: These are primarily civilian users plus a limited number of military users assigned as supervisors, that will interact with the full spectrum of HCM employee management services, such as time and labor, benefits, pay, performance management, etc. ~17,000 users. General users can also include:

1.2.3.1.1. (U) HR Users: These users will have various roles and permissions to conduct HR related tasks and activities across all populations of affiliate types. May be civilian, military, or contractor. ~500 users.

1.2.3.1.2. (U) Staff Management Users: These users will have increased visibility of records at the individual and aggregate level, as well as limited record update permissions for users within their organization.

1.2.3.1.3. (U) Power Users: These users will have the ability to create, edit, and manage system workflows, conduct mass updates to records, and provide Tier 2 help functions. May be civilian, military, or contractor. ~50-100 users.

1.2.3.1.4. (U) External Recruiters: These users would be responsible for the full life cycle of external recruitment activities and the primary users of the unclassified recruitment instance. ~100 users.

1.2.3.2. (U) Limited Users: These are primarily contractor and military users that will interact with the system for a small subset of functionality for personnel management. For example, they may update their seat location, or request agency assistance in meeting ADA Reasonable Accommodations. ~10,000 users.

1.2.3.3. (U) External Applicants and Candidates: These would be external applicants and, once accepted, candidates that interact with the system and the ability to submit information related to positions and employment processing. Candidate information would be expected to transition to a civilian employee record on JWICS with general user access upon successful hiring completion.

1.2.4. (U) The contractor shall provide a solution that is capable of interfacing with non-affiliates.

1.2.4.1. (U) The architecture, methodology, and security approach/controls utilized to enable a non-affiliate interface shall require government approval prior to implementation.

1.2.4.2. (U) The solution shall ensure logical separation between affiliates and non-affiliates.

1.2.5. (U) The contractor shall provide a solution capable of handling concurrent users (at any instance in time) during typical and peak load times:

1.2.5.1. (U) Typical Load: 2,000 Users; and

1.2.5.2. (U) Peak Load: 10,000 Users.

1.2.6. (U) The contractor shall provide a solution capable of:

1.2.6.1. (U) Automatic syncing of data across the HCM environment;

1.2.6.2. (U) Adding, deleting, and modifying data fields;

1.2.6.3. (U) Supporting multiple common field types (such as enumerated choices and free text);

1.2.6.4. (U) Importing/Exporting data in industry standard formats;

1.2.6.5. (U) Implementing mass changes (such as personnel actions, re-organizations, updated pay scale, etc.);

1.2.6.6. (U) Supporting multiple types of multimedia formats (storage and display);

1.2.6.7. (U) Storing and attaching files such as Microsoft office documents and PDFs to individual records.;

1.2.6.8. (U) Securing portions of a record and/or attachments (such as psychological or medical assessments));

1.2.6.9. (U) Initial deployment preconfigured with templates, workflows, fields, forms, reports, and ontologies to meet minimum federal HR business functional areas with best practices and industry recommended business processes;

1.2.6.10. (U) Configurable templates, workflows, fields, forms, document generation, reports, and ontologies to be adjusted to best meet DIA business processes. While every effort will be made to use out of the box solutions, there may need to be configuration to meet specific DIA requirements.

1.2.7. (U) The contractor shall provide a solution with the ability to define, manage, update and use time reporting codes in combination with configurable administrative codes for Agency specific needs.

1.2.8. (U) The contractor shall provide a solution that can interoperate with Microsoft products.

1.2.9. (U) The contractor shall provide a solution that can interoperate with Active Directory and other industry standard provisioning services.

1.2.10. (U) The contractor shall provide a solution with the ability to create role-based dashboard views.

1.2.11. (U) The contractor shall provide a solution that is self-healing with automated service restoration that is seamless to the end user. All HCM computer software, firmware, and service upgrades must be non-disruptive. If the computer, software, firmware or service upgrades will be applied to the HCM system, it must be pre-coordinated and approved by the Agency.

1.2.12. (U) The contractor shall provide a solution that shall be compliant with the Agency’s records management disposition schedule as referenced in the Bidders Library.

1.2.13. (U) The contractor shall provide a solution that can successfully pass a federally mandated audit.

1.2.14. (U) The contractor shall provide a solution that maintains technical parity with commercial service offerings, to include patching, versions, and services in accordance with industry standards.

1.3. (U) INTERFACES

1.3.1. (U) The contractor shall provide a solution capable of supporting robust enterprise integration complete with documented APIs. A robust solution offers interfaces such as, but not limited to:

1.3.1.1. (U) Representational state transfer (RESTful) and (Simple Object Access Protocol) SOAP web services;

1.3.1.2. (U) Messaging queues;

1.3.1.3. (U) Replication;

1.3.1.4. (U) Publish/Subscribe Topics; and

1.3.1.5. (U) Fixed position text files, binary and cyclic redundancy check (CRC) checksum encoded (or other form of checksum) to ensure integrity can be verified.

1.3.2. (U) Contractor shall provide a solution that is capable of integrating with internal and external sources at points in the solution’s process flow (example: externally sourced elements of the hiring process): some external elements may replace elements of the solution’s native processes.

1.3.3. (U) Contractor shall provide a solution that delivers and maintains up-to-date data flow diagrams, with associated data dictionaries for the HCM System level, and module, including external data interfaces.

1.3.4. (U) Contractor shall provide the capability to transfer data to other Agency systems including, but not limited to, standard data formats as agreed upon by the Agency for databases, images, files, and objects.

1.3.5. (U) Contractor shall provide ability to access and transport data securely while maintaining data integrity for all data storage types across hosting environments that promotes data sharing.

1.3.6. (U) Contractor shall provide Data Dictionaries describing all data utilized by the HCM solution.

1.4. DATA REQUIREMENTS

1.4.1. (U) Data Handling:

1.4.1.1. (U) The contractor shall provide a solution that receives incremental exchange of data and migrating data of existing Agency HR data from the existing HCM system to the new HCM environment.

1.4.1.2. (U) The contractor shall provide a solution that provides data tagging (to include multiple layers) adhering to DIA data tagging specifications provided by the Chief Data Officer (CDO).

1.4.1.3. (U) The contractor shall provide a solution with data tagging pursuant to DIA enterprise standards (Enterprise Data Header (EDH)).

1.4.1.4. (U) The contractor shall provide a solution capable of tagging data with an EDH upon transit and ingest.

1.4.1.5. (U) Provide a solution capable of implementing DIA and IC Classification Management Tool (CMT) for classification as well as other sensitivity tags and controls.

1.4.1.6. (U) Contractor shall provide a solution that provides for PII markings.

1.4.1.7. (U) Contractor shall provide a solution that has a single authority’s data source for each data element.

1.4.1.8. (U) Contractor shall provide a clean data dictionary with conformal definitions for each data element contained.

1.4.1.9. (U) Contractor shall provide a solution with the ability to delete/purge data on a per element level based on a records disposition schedule.

1.4.1.10. (U) Contractor shall provide a solution with the ability to handle access controls for person and non-person identities.

1.4.1.11. (U) Contractor shall provide a solution which honors tags to provide RBAC and ABAC.

1.4.1.12. (U) Contractor shall provide a solution capable of tagging data at an element level.

1.4.1.13. (U) Contractor shall provide a solution capable of being authorized to handle and to protect numerous types of sensitivity controls, to include PII, PHI, and PAI in accordance with IC, DoD, and DIA requirements.

1.4.1.14. (U) Contractor shall provide a solution capable of handling near real-time, historical data access.

1.4.1.15. (U) Contractor shall provide and execute standard operating procedures (SOPs) for data backup and recovery.

1.4.1.16. (U) Contractor shall maintain data backup and recovery plans to address data loss, data corruption, and data failure scenarios.

1.4.1.17. (U) Contactor shall archive data in accordance with compliance system performance plans.

1.4.1.18. (U) Contractor shall purge data in accordance with Agency compliance and retention plans.

1.4.1.19. (U) Contractor shall perform continuous data quality monitoring and assessment.

1.4.1.20. (U) Contractor shall provide a solution that reduces the introduction of invalid data and performs data correction as defects are discovered. When possible, use automated processes to correct data defects.

1.5. REPORTING REQUIREMENTS

1.5.1. (U) Reporting

1.5.1.1. (U) The contractor shall provide status reports documenting progress of development activities, issues/risks, and future courses of action.

1.5.1.2. (U) The contractor shall provide a mechanism for the Agency to track progress of development activities automatically.

1.5.1.3. (U) The contractor shall provide solution for an automated mechanism, via Graphical User Interface (GUI) for managing near real-time reporting of service availability and utilization metrics across all service offerings.

1.5.2. (U) The contactor shall conduct System Monitoring and Data Views: Provide a solution capable of near real time HCM system monitoring and reporting for service health, outages, failures, and upcoming releases.

1.5.3. (U) Notifications

1.5.3.1. (U) The contractor shall provide the ability to access HCM data via Application Programming Interfaces (API), dashboards, or other mechanisms.

1.5.3.2. (U) The contractor shall provide a mechanism to access detailed information pertaining to outages, failures, and upcoming releases.

1.5.3.3. (U) The contractor shall secure portions and/or entirety of records and/or attachments (such as psychological or medical assessments).

1.5.3.4. (U) The contractor shall provide automated mechanism for notifications, including any change that may affect the security of the services or the HCM environment and adherence to Agency configuration management processes. Notifications shall include planned/known disruption of services (prior to occurrence), disruption to the marketplace service offerings, and security changes.

1.5.3.5. (U) The contractor shall provide an automated mechanism for notifying the Agency when protection measures have been implemented.

1.5.3.6. (U) The contractor shall provide an integrated and unified metrics, monitoring and alerting solution, which spans all provided services and permits users to receive health and performance statistics in an automated manner, via GUI and notifications or API, across the contractor’s hosting service offerings. Use DIA identified environments to store and display agreements, help desk and technical support, roadmap for services with descriptions and release dates, service catalog, notional solution architectures, and resources.

UNCLASSIFIED//FOR OFFICIAL USE ONLY