Attachment_C_Base_IPS_SOW_FINAL.docx

FDA Information Technology Program and Project Management Support Services (IPS) Statement of Work

Table of Contents

Background

The FDA is responsible for protecting the public health by assuring the safety, efficacy and security of human and veterinary drugs, biological products, medical devices, our nation’s food supply, cosmetics and products that emit radiation. The FDA is also responsible for advancing the public health by helping to speed innovations that make medicines more effective, safer and more affordable and by helping the public get the accurate, science-based information they need to use medicines and foods to maintain and improve their health. FDA also has responsibility for regulating the manufacturing, marketing and distribution of tobacco products to protect the public health and to reduce tobacco use by minors. Finally, FDA plays a significant role in the Nation’s counterterrorism capability. FDA fulfills this responsibility by ensuring the security of the food supply and by fostering development of medical products to respond to deliberate and naturally emerging public health threats.

The FDA has established the Office of Information Management and Technology (OIMT) to ensure the timely and effective delivery of high quality, innovative and cost effective mission related information technology support services across the FDA and its centers. OIMT is responsible for ensuring excellence through the design, development and application of information technology using proven and emerging strategies to reduce cost, improve services and reduce security and system failure risks to support the FDA in protecting the public health. OIMT is implementing this contract to enable the FDA’s OIMT, nine Centers and Offices to work in a standard way to acquire Information Technology Program and Project Management Support Services

In the past, a project team would be able to develop and deploy a system independent from any other systems. The level of documentation and the content of that documentation would depend on the experience of the contractor building that particular system. Today, FDA works more collaboratively, employing integrated project teams for their expertise in software development, security, infrastructure, and data base administration. Furthermore, specific security and system integration depends heavily on a standard technical implementation and execution. Proper documentation is required to provide specific information to support groups as they deploy the application and to ensure a transfer of knowledge and government ownership for Information Technology (IT). This collaborative and fluid way of working only succeeds if the same processes and policies are employed regardless of team, tool, application or data center environment.

The FDA maintains several data centers, and requires homogeneous standards for security and infrastructure. These systems are often sharing databases or hardware and therefore could have a direct impact on other systems if they are not developed properly. Furthermore, the deployments pass through different teams including the customer or user community, requiring frequent communication, interactions and updates. If everyone is following the same processes, uses similar documentation and understands the basic expectations for software development, the processes and templates become routine to the integrated project teams and they can all have some level of assurance that appropriate steps were taken to release a quality software application.

The FDA has many Centers and Offices with different needs and different project support expertise. In addition, the goal is that the contractors, or staff that support each project, ensure standard processes are known, followed, documented and supported. To this goal, the Information Technology Program and Project Management Support Services (IPS) IDIQ will provide a structure to the Contractor to maintain consistency for the variety of needs for IT Program and Project Management.

Objective

The FDA seeks to attain dynamic IT program and project management support services (IPS) to facilitate all phases of the IT Enterprise Performance Life Cycle (EPLC). These services are required by the OIM, FDA Centers and operational units.

Project Scope IPS support includes: strategic planning, concept development and project initiation, configuration design and functional area analysis, program and systems analysis and modeling, quality assurance, service oriented architecture, audit activities as well as mentoring and program and project coordination support, senior and junior level assistance with the daily management of their projects including administrative assistive and process tools, documentation, and privacy implementation.

The contractor shall provide IT program and project support services that will ensure program and project managers have the support for:

· the information readily at hand to control the daily management of their programs and projects

· subject matter expertise in mentoring, education and project coordination support

· requirements gathering

· concept development of a new requirement

· program or project initiation

· development of design documents

· software development

· technical writing

· assistance with all phases of EPLC

· planning, preparing and overseeing project schedules with business and technical expertise

· maintaining spreadsheets for tracking (e.g., cost expenditures)

· interacting with various points-of-contact (POCs) for specific tasks regarding progress, issues and concerns

· preparing reports, data calls and briefings including to FDA management in support of project goals, in support of technical and management decision-making

· reviewing and monitoring requirements through implementation to ensure that business needs are met

· trend analysis, risk analysis and mitigation support and recommendations

This contract provides for program and project management of the Agency’s 90+ IT projects as either in a facilitative or supportive capacity. For the purpose of this IDIQ, a facilitative role may be supporting an integrated project team (IPT), reviewing project artifacts or otherwise gathering or analyzing information pertaining to IT Projects for the explicit responsibility of informing the Government. The intention is that any organizational component within the FDA that may require any of these services described throughout this IDIQ Contract may utilize this vehicle by submitting a task order for the specific support required for their individual program and/or projects. The IDIQ is also intended to harmonize the support provided across the Agency by ensuring standardized support in areas where standards are required (e.g., EPLC). The Contractor shall provide the support in these various areas (to be defined fully in individual task orders. Multiple tasks may be developed under task areas described in this IDIQ contract in section “Description of Task Areas”).

Description of Task Areas The Contractor shall furnish all necessary services, qualified personnel, material, tools and methodologies, not otherwise provided and subject to approval by the FDA, as needed to perform IT program support services. Artifacts shall meet organizational standards or be of a quality that leads to adoption as organizational standards (such as meeting the criteria for acceptance in the Capital Planning and Investment Control (CPIC) portfolio system for investment type work).

4.1. Concept Development and Strategic Planning

The Contractor shall support IT concept development and strategic planning. Representative activities may include:

· Participate in early phase Stage Gate and Baseline Reviews

· Support various program staff in developing the high level business models and define business requirements at the level needed for Concept evaluation and approval by FDA management

· Format and finalize Initiation and Concept Phase deliverables

· Anticipated deliverables include: Business Needs Statements and or Issue Papers, Business Case, Operational Assessment, Project Charter, Boundary Documents, Initial Project Management Plan, Privacy Impact Assessment

· Document of business needs in Issue Papers, Boundary Documents, Concept Documents, and Concepts of Operations

· Assist FDA program staff involved in planning and executing FDA regulatory processes in the gathering and documentation of requirements

· Participate in strategic planning sessions to recommend analysis of alternative approaches

· Participate in the planning activities required by OMB, HHS and the FDA EPLC and document the results: (i.e. Cost benefits analysis; Risk assessments; Alternatives analysis)

· Establish performance goals and metrics

· Develop functional and system requirements for FDA systems

· Conduct requirements review and analysis and development and/or review of user requirements documents

· Participate in programs working groups and provide technical input into regulatory/rule development where appropriate

· Develop requirements for proofs of concept or prototypes to help prove technical concepts

· Develop accurate estimates for future acquisitions, and/or provide input/recommendations to facilitate informed management decisions

· Develop technical concept designs and recommend approaches for implementation

· Perform Program/Project investment analysis

· Develop Business Cases

· Develop clear, workable processes for specific program or project repository content management and ownership

· Provide technical and business expertise to assist Government staff in evaluating alternative approaches to meeting the objectives defined in the Initiation and Concept phase documentation.

· FDA requires the following tasks to support the technical decisions for investments.

· Meet FDA program staff involved in planning and executing regulatory processes

· Interact with FDA staff to ensure that systems will support FDA cross- cutting initiatives

· Generate Concepts of Operations, white papers, briefings, Process Agreements

· Cost Benefit Analysis: Evaluation of the costs and benefits of a particular approach or technology and documentation of the final recommendation

4.2. Program and Project Control

Contractor shall provide management and technical support to assist Project Managers in the management and control of IT projects. This support shall include developing schedules for program or project activities, providing recommendations or alternative solutions to manage program, project and technical risks. This task area may include activities that occur in each life cycle phase as baselines are initially constructed, evolve and change. Representative activities are:

· Prepare and oversee work plans, schedules, planning materials

· Provide input into security planning and Certification and Accreditation activities

· Assist in the resolution of business and technical issues

· Maintain and/or establish clear, repeatable processes for Program and Subject Matter Expertise knowledge repository content management and ownership

· Integrate Capital Planning and Investment Control (CPIC), Subject Matter Expertise Office (e.g., project management organization, PMO), Security, and EA processes to the efficient and effective governance of the FDA information technology investments and assets

· Provide Program/Project process and policy analysis and improvement recommendations

· Provide knowledge transfer to an individual Program/Project Manager or project teams on FDA wide or center specific disciplines, lifecycles and relevant deliverables

· Review and provide feedback sessions with program/project managers on individual program/subject matter expertise artifacts

· Develop training material and instructor training sessions manuals

· Document the initiation, execution, and closing activities for a program/project

· Develop standard guidance procedures for program/project managers

· Develop and maintain program/project plans/artifacts throughout the lifecycle of the initiative

· Develop and disseminate f program/project presentations and status reporting

· Establish and maintain clear, repeatable processes for FDA wide or center specific program/project knowledge repository content management

· Collect data, analyze and report Earned Value metrics

· Create and maintain OMB artifacts formerly known as Exhibit 300 and 53

· Participate in stage gate reviews

· Develop supporting program/project documentation (i.e., status reports, presentations, planning documents, etc.)

· Track action items, issues, and risks

· Gather requirements and prepare technical design and/or network diagram documents

· Review and validate Software Development and documentation

· Produce with guidance from FDA leadership, communication text and graphics to be used for internal and external stakeholders

· Establish, document and manage program baselines (e.g. budget, cost, schedule, requirements, architecture and technical). Formal baseline changes require stakeholder agreement and Government approval before the Contractor may implement the change to ensure program integrity and communication

· Manage change requests, as applicable to the project, and in accordance with FDA change management processes

· Verify compliance with FDA Capital Planning Investment Control (CPIC) processes and acceptance criteria for the Select, Control and Evaluate Phases

· Support the general process maturity and process improvement, mentoring and support of an shared function within the FDA

· Assist with tools to clearly mentor, train and promote the adoption of Program/Project Manager practices within the FDA

4.3. Program and/or Project Planning

The Contractor shall support Program or Project Managers in developing initial management plans for individual projects and provide the initial preliminary baselines for external reporting. This will include all projects that are approved as a result of the Project Concept/Selection Review. In addition, planning activities may be required for technical upgrades or enhancements that are approved based on technical requirements or emergency needs which will not go through the functional analysis required in Concept review. Representative activities are:

· Performance Goals and Metrics: Establish specific performance goals to be met by the program or project and the metrics by which those goals will be measured.

· Programmatic planning: Develop, review and balance multiple projects within a program, to ensure the timing and scope aligns and dependencies are appropriately factored in for anticipated outcomes.

· Risk Assessment: Identify potential technical and business risks that may impact the schedule, cost, or successful deployment of a software application; developing appropriate mitigation strategies and factoring risks into schedule and budget planning as appropriate; monitor risks throughout the project’s life cycle.

· Alternative Approaches: Assess and document potential alternatives that could support the major objectives of the project. Alternatives could be technical or methodological or both and should consider cost, benefits, and risks.

· Functional and System Requirements: Define and document requirements at a level adequate to support acquisition and future contract control, if not sufficiently documented by the Concept team. This activity may require conducting requirements review and analysis and development and/or review of use cases; participation in program working groups; providing technical input into regulatory/rule/guidance development where appropriate; preliminary cost estimate; and estimate of lifecycle costs. The results of this activity may be used to support the Independent Government Cost Estimate (IGCE) for the work effort.

· Preliminary Schedule Development: Develop preliminary schedule of sufficient detail to use for CPIC submissions.

· Technical Concept Design and Implementation Recommendations: Develop Concept of Operations or similar preliminary design documentation to support early planning and the acquisition process including evaluation of vendor solutions for feasibility and risk.

· Development or review of other Project Planning Documents as required in the EPLC or as directed by FDA.

· The Contractor shall respond to queries pertaining to the IT Project that the Contractor is supporting. Representative activities include assisting the Government in developing vendor work plans, schedules, tracking vendor or development costs and accomplishments, risks and mitigations plans or recommendations for action. Each task order shall specify the expected volume and type of these IT project queries.

· Training Rollout Plans: Develop a rollout plan, schedule, documentation and activities to assist with the adoption of an IT tool or system.

4.4. Support of FDA Software Releases and Infrastructure Upgrades The Contractor shall provide management support to facilitate planning for software releases and infrastructure upgrades. The Contractors shall work with project managers, team members, Government and other Contractors to develop plans for individual software releases and infrastructure upgrades. Working with program managers or release managers, the integration and timing of releases and upgrades adds an additional layer of complexity for risk and planning mitigation. A few upgrades may be major projects, but most are small and do not require major project planning as described under the planning activity. Representative activities include:

· Scheduling: Prepare and oversee work plans and schedules.

· Issue Resolution: Using technical, and subject matter expertise to resolve business and technical issues and document.

· Technical Support: Interpret system requirements and review deliverables, facilitate appropriate levels of testing and stage gate reviews.

· Risk Management: Conduct ongoing assessments of potential risks assessments and following through on mitigation strategies where needed.

· Facilitate the release management process with the vendor and FDA environment controls

· Prepare and monitor requests for change, including provisioning requests, infrastructure change requests and fire wall requests

· Prepare and manage versions of the Architecture and Implementation Configuration Request (ACR), Version Description Document (VDD), Datacenter Run book and the Target State Diagram (TSD)

· Assist with the formulation or migration of data or software

· Assist with the installation of software

· Support the installation and testing of upgrades to new versions of the software

· Support the migration efforts to new data centers

· Evaluate potential shared components, interface needs, and integration efforts

· Prepare, assist with or monitor a Single Sign on integration

· Conduct or facilitate code and design reviews of projects and components to evaluate processes, code, process models and general development efforts.

· Monitor the correct use of a release process, component, or interface.

· Support the development of individual test and release plans

· Validating and assisting with data management and data modeling and control activities for the system

4.5. Develop and Document Program-Level Technical Standards & Methods

FDA has recently adopted a cost model which maps investments to business capabilities and projects. Alignment with the model and frameworks is critical to ensure accurate reporting. In addition to project planning, FDA requires standards and methods that are consistent at the investment level. The Contractor shall develop, implement and maintain technical standards and methodologies to support Program level management oversight. IT Standards applicable to the projects include adherence to the FDA’s EPLC, congruence with emerging standards (such as the FDA IT master glossary, a list of vocabulary terms), applicable federal security and privacy regulations and directives, compliance with emerging data standards, and other capital investment management and reporting requirements. Program level standards and methods currently under development include:

· Change Management

· Integrated Scheduling, Service and Investment Roadmaps

· Program Artifact Configuration Management

· Service Oriented Architecture and soon-to-be finalized Target State Architecture

· Cloud services

· Mobile Computing

· Traceability to cost modeling and fee for service

· Other Program Level standards and Methodologies as adopted by FDA

4.6. Research and Recommend New Tools and Techniques

The Contractor shall research and recommend new tools or techniques that could be useful in meeting FDA’s mission and business needs. Such analyses could include research and lessons learned from other similar environments as well as analysis activities that are appropriate to the product or process being examined. Benchmarking and gap analyses may be required within task orders.

4.7. Process and Procedure Improvements

The Contractor shall provide ongoing reviews of existing IT processes and procedures to identify areas where improvements can be made as well as recommend changes that will benefit the quality, efficiency and/or effectiveness of the FDA’s IT-related products. The Contractor shall research, plan, collect, analyze, recommend and implement changes to FDA IT processes and procedures, which may include for example: create and document processes and procedures according to organizational format templates, document as-is and to-be performance baselines, support the development and implementation of performance measures and surveillance methods. Some ways in which improvements may be identified and addressed include:

· Participation in FDA working groups

· Reviewing EPLC deliverables and providing comments/recommendations as appropriate

· Promoting common or enterprise wide process improvements

· Raising visibility of analysis and recommendations to the IDIQ COR during contract management reviews to promote cross program integration

4.8. Support With and Using Business Tools

The Contractor shall provide business tool support to leverage the features available for use in the product, whether acquired in house or commercially, and enhance the presentation layer of a product that is in use at FDA. For example, the user configurations for graphic user interfaces (GUI) such as office suite software, content, collaboration and knowledge management software, and visual basic code. Support includes the type of configuration to enable the task areas in this section including creation of templates, configuration, set up and support of functionality of SharePoint as related to the out of the box features available for use, work flows, reports, and other business office type functions.

4.9. IT Security Support

The Contractor shall provide IT Security subject matter expertise for security planning, including the assessment of security risks, preparing responses to security related data calls (e.g. Privacy Act responses) and supporting Certification and Accreditation activities, including tracking Plan of Action and Milestone tracking. The Contractor shall provide the analysis and recommendation to FDA IT programs/projects applicable to guidance at FDA, Office of Management and Budget (OMB) Circular A-130, Appendix III, Security of Federal Automated Information Resources, and the FDA Certification and Accreditation Program that applies to all FDA IT application systems. The Contractor may support development and updates to IT Project System Security Plans, stage gate reviews and project security milestones, as appropriate.

4.10. Meetings

The Contractor shall participate in various meetings for the IDIQ contract and, as required, for each task order. If required, the Contractor shall prepare the following: meeting agenda, minutes or notes, issues and action items. Additionally, the Contractor may be required to distribute the related documentation (generally by email), and actively contribute to the meetings.

At a minimum, the Contractor shall convene and participate in the following meetings relating to the overall IDIQ contract:

· Contract Kickoff Meeting – Contractor will coordinate this meeting within 15 working days of contract award. Purpose of this meeting is to introduce Contractor staff to the government staff that will be managing the contract. Additionally, Contractor will begin work with the COR (and, if necessary, the CO) to determine the course of future status update meetings and the government’s expectations for reporting such.

· Quarterly Update Meetings – Contractor shall coordinate quarterly meetings with responsible government staff (COR, and if necessary, CO) for the purpose of reporting the status of the overall contract and the individual task orders. During these meetings, Contractor shall report on costs, burn rates, scheduling and any other factors which may impact task orders or the overall contract.

The Contractor shall convene and participate in the following meetings as defined in each Task Order:

· Task Order Kickoff Meeting - Contractor will coordinate this meeting within 10 working days of contract award. Purpose of this meeting is to introduce Contractor staff to the government staff that will be managing the task order. This meeting will include expectations for future work and follow-on meetings to report on task order costs, burn rates, schedule, and any factors which may impact the task order.

· Status Update Meetings – Contractor shall coordinate meetings with responsible government staff (Task Order COR, and if necessary, IDIQ COR and/or CO) for the purpose of reporting the status of the task order. During these meetings, Contractor shall report on costs, burn rates, scheduling and any other factors which may impact the task order.

4.11. Briefings

The Contractor shall prepare and participate in briefings. Generally, briefings are primarily focused on transmission of specific technical or management related information. The Contractor will integrate information from other related activities into focus and develop meaningful briefing materials that aid in Government decision making.

4.12. Responding to Data Calls

The Contractor shall respond to data calls that may originate from FDA, HHS, OMB, GAO and others. There are approximately 50 data calls in a 3-year period of varying complexity, from one-page answers to a single question to 25+ page complex spreadsheets. Calls for information typically include:

· FDA mission needs and their relationship to system functionality

· Status of planned or existing projects or systems

· Platforms/tools/technologies of existing or planned projects or systems

· Budgets/schedule/risks associated with planned projects of systems

Responses shall be vetted through the task order COR prior to response, unless otherwise provided written direction by the COR.

4.13. Quality Assurance

The Contractor shall provide quality assurance. Representative Quality Assurance activities include:

· Review and analyze implementation plans for software releases, infrastructure upgrades and enhancement capabilities and provide recommendations to the Government

· Draft and/or review FDA or other Contractor developed Software Quality Assurance Plans and documentation and provide recommendations to the Government

· Provide validation and verification of software contract deliverables

· Review of Stage Gate deliverables, and provide recommendations to the Government

· Performance testing and analysis and documentation of results

· Perform ongoing review and modification of EPLC standards and best practices

· Provide technical interpretation of system requirements and review and provide recommendations on deliverables

· Conduct assessments on items identified as security risks and provide recommendations

· Develop and/or recommend improvements to internal procedures and processes that could improve the quality, efficiency and effectiveness of FDA’s IT software projects

· Participate in FDA working groups as subject matter expert

· Review EPLC deliverables and provide comments/ recommendations as appropriate

· Recommendations for modifications of the FDA’s Investment Life Cycle (general system development modifications or suggested modifications for adapting the lifecycle to infrastructure projects)

· Update of program/project document repository

· Update of program/project intranet/internet sites

· Complex analysis and reporting, utilizing data within and external to the program repository to support business planning activities

· Modifying current processes and templates for infrastructure projects

· Performance standards will be defined at the Task Order level. The Government performs surveillance to determine whether the Contractor exceeds, meets or does not meet the standards. If the Contractor does not meet a task order performance standard, the Government will inform the Contractor.

4.14. Test Management

The Contractor shall provide test management services and independent verification and validation (IV&V). Representative activities include facilitation of or assistance with:

· Requirements, system, unit, Section 508 compliance, and security and UAT testing.

· Test cases and business scenarios.

· Project test plans and applicable EPLC documentation

· Management of issues, processes, change requests, prioritization of changes, and briefings.

· Test results mitigation and analysis; Recommendations to refine the requirements, system, test plan, processes or documentation

· IV&V of system/software developer testing activities

Task Order Management and Control

The Government requires a written plan which defines the approach to the overall management and performance required for successful execution of defined task order requirements. The plan shall discuss considerations impacting organizational resources, management controls and technical approach to successfully perform in accordance with the requirements of each task order. When required by task order solicitation, the plan shall demonstrate how the contractor will staff up quickly and ensure personnel with the necessary skill sets are available on short notice.

The Contractor shall prepare a Task Order Status Report describing the health of the task order under execution to include cost, schedule, performance, accomplishments, risks, impacts, issues and recommendations. The Task Order status reports may include performance against IDIQ performance standards and applicable task order standards.

The Government may require Task Order progress reports on an ad hoc basis in response to senior management queries. Task Order Progress reports may include a variation of the following data elements based on the senior management query:

· Hours worked by sub-task or activity,

· Accomplishments and status of deliverables,

· Cost summaries by sub-task for the reporting period,

· Planned activities for upcoming reporting period,

· Action items and associated completion dates

· Issues and concerns that will impact time, cost or schedule with recommendations for mitigation

· Identification and prioritization of critical areas, and the identification of problem areas and proposed solutions

· Updated project schedules as applicable

· Computed earned value and actual costs, and report on cost and schedule variances, as this information is available

The Contractor shall be responsible for:

· Preparing and overseeing work plans, schedules and cost expenditures necessary to accomplish the task and its sub-tasks as described

· Sub-task cost estimates and other costs identified as part of the Budgeted Cost of Work Performed (BCWP)

· As tasks are completed, the Contractor shall compute final earned value and actual costs and report cost and schedule variances as the information is available.

The Contractor shall prepare or contribute to an IDIQ Dashboard Status Report summarizing key information that enable about all task orders on the IDIQ contract. Representative information include:

· Status and progress of tasks

· Cost and schedule variances

· Coordination activities across tasks

· Impact or influence of any task on other tasks

· Impact or influence of tasks on overall FDA program

· Recommendations for changes or additional activities to ensure that the tasks support progress on the overall FDA architecture

· Contractual information (e.g. IDIQ/task order ceiling and actual value, dates, active, closed, Centers, CORs, IT Programs)

· Accomplishments (e.g. key milestones met, missed, re-plans), Risks, Issues

· Plans and accomplishments for continuous process improvements

The Government will hold a quarterly program management review (PMR) of the IDIQ Dashboard Status Report to inform the IDIQ COR and CO on cross program activities, common problems and solutions, and to ensure consistent implementation of FDA processes across each IT project task order. The venue of a program review briefing serves as a record of communication between the Government and Contractor to raise problems, discuss outcomes, collaborate, correct inconsistencies across task orders, solicit feedback from Government Project Managers and identify opportunities to realize efficiencies in improved processes, methods, tools or techniques.

The IDIQ Dashboard Status Report from the Contractor shall contain the following:

1) A cost breakdown by labor category for each active Task Order

2) A cost breakdown by labor category for any Task Order which closed or was completed since the last quarterly report

3) A cost breakdown by number of hours per labor category for all Task Orders combined and charged during the current government fiscal year (this should include ALL costs charged to the government for the period)

4) A cost breakdown by number of hours per labor category of all Task Orders since the IDIQ Contract award (this should include ALL costs charged to the government since award)

5) A brief narrative summary for each active Task Order including any risks, mitigations, decisions needed, or other recommendations that would improve the overall Task Order budget, schedule, communications, or completion.

In addition to progress reporting, the Contractor shall be proactive in informing the designated government IDIQ COR and respective Task Order COR(s) of any issues, problems and recommendations that should be addressed to ensure the overall successful accomplishment of requirements. Recommendations for actions that need to be taken by FDA staff, or other Contractors, must be clearly defined and communicated, and have identified dates for completion.

The Contractor shall also be responsible for preparing and participating in program/project reviews, management briefings, stakeholder presentations and cross-agency information exchanges.

IDIQ Deliverable Table

Personnel The Contractor shall ensure that all Contractor personnel are adequately trained, possess the requisite experience and are otherwise fully qualified to provide the high level of support required by this SOW prior to selection for work on any associated task order. All Contractor personnel supporting this SOW and any Task Order shall sign non-disclosure agreement, FDA Form 3398: Contractor’s Commitment to Protect Non-Public Information (NPI) Agreement and provide the signed agreement to the Task Order COR.

Staff Training The Contractor shall ensure that all personnel have the education, experience and training necessary to perform their duties and successful performance of contract requirements. No additional training funds will be allocated in the budget, unless changes to the Government Enterprise Architecture standards require knowledge of products not currently defined.

It is anticipated that Contractor employees may have to attend conferences and symposiums to provide interface and attain knowledge necessary for the performance of government requirements in each task order.

Performance Requirements Performance based concepts such as desired service outcomes and performance standards may be used in task order’s Statement of Objectives (SOO)/Performance Work Statement (PWS) or Statement of Work (SOW). The Contractor shall meet or propose performance requirements. The Government may provide a Quality Assurance Surveillance Plan (QASP), which typically contains a Performance Requirements Summary (PRS) table.

Technical Standards and Guidelines Current standards and guidelines that must be considered in the performance of this IDIQ include:

· The Contractor shall follow Government-wide as well as FDA IT policies. At the government- wide level, these include Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and General Accounting Office (GAO). These can be primarily found at or through the Federal CIO Council website at: http://www.cio.gov/.

· The Contractor shall follow Health and Human Services (HHS) Enterprise Performance Life Cycle (EPLC) Framework. The HHS EPLC is a framework to enhance Information Technology (IT) governance through rigorous application of sound investment and project management principles and industry’s best practices. The HHS EPLC provides the context for the HHS/FDA IT governance process and describes interdependencies between its project management, investment management and capital planning components. The framework will evolve over time in response to changes in technology and business needs and, therefore, the Contractor is expected to adapt accordingly to comply with the most current framework methodology in performance of work under this IDIQ. The Contractor shall consult with the stakeholders clarify the EPLC artifacts required for an individual project or capability. The required artifacts depend on the release type and are tailored through the Project Process Agreement (PPA). Furthermore, the Contractor shall ensure that updated artifacts are maintained in the appropriate (per the COR) repositories.

· HHS documents are found at http://www.hhs.gov/ocio/eplc/. See also Attachment B FDA EPLC Overview.

· The Contractor shall follow FDA’s Staff Manual Guides (SMGs) which are accessible via the web at http://www.fda.gov/AboutFDA/ReportsManualsForms/StaffManualGuides/default.htm. Additional security guides will be made available post award.

· The Contractor shall follow FDA Program and Project Management Processes and Templates, which will be made available upon contract award.

· The Contractor shall follow FDA Earned Value Management Processes and Templates that are applicable to Tier Level EVM requirements described in the “HHS EVM Policy” guide, and in a format acceptable to the CPIC reporting system and oversight group. The HHS EVM guidance can be found here http://www.hhs.gov/ocio/policy/2005-0004p.html. The FAR EVM reference can be found here https://acquisition.gov/far/current/html/Subpart%2034_2.html#wp1111816

· The Contractor shall follow Food and Drug Administration Investment Life Cycle (ILC) to ensure compliance with FDA's EA/IT technical standards.

· The Contractor shall apply the practices in the IT Infrastructure Library (ITIL) as appropriate and within the constraints of the FDA processes.

· The Contractor shall conform to the HHS/FDA Enterprise Architecture framework, policies, standards and procedures. The HHS EA reference can be found here http://www.hhs.gov/ocio/ea/architecture/.

· The Contractor shall ensure compliance to IT Security guidelines, which include:

· HHS Information Security and Privacy Program http://www.hhs.gov/ocio/securityprivacy/index.html

· HHS Acquisition Regulation (HHSAR) 352.239, http://www.hhs.gov/regulations/hhsar/subpart352-30s.html (Reference SOW Security Section for additional information.)

· Federal Information Security Management Act (FISMA) The Contractor shall ensure compliance with the Federal Information Security Management Act (FISMA) 2002 - http://csrc.nist.gov/drivers/documents/FISMA-final.pdf. Also, reference FISMA Memoranda: http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf

· National Institute of Standards and Technology (NIST) SP800-53 http://csrc.nist.gov/publications/PubsSPs.html

· FDA Security Authorization process, which closely resembles NIST SP800-37: http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

· Establish a continuous monitoring capability in accordance with NIST SP 800-137

· FISMA, NIST and OMB requirements

· Comply with FDA 3250 series of SMG policies, as well as HHS security policies. Note: SMG 3251.4 Outsourcing and Third Party Arrangements

· The Contractor shall comply with FDA approved technologies list, as applicable under Task Orders:

· The FDA Master Approved Technology List (MAT) contains a list of approved and not approved technologies, including applications (software), infrastructure and peripherals (hardware), and also scientific software and devices. For any technology or software not currently on the MAT list, FDA’s Office of Information Management (OIMT) must provide its approval through the “IT Standards and the IT Investment Management (ITIM)” process.

Note: Access to the MAT list will be provided upon Contract award.

· Additional References

· FTR reference, http://www.gsa.gov/portal/ext/public/site/FTR/file/FTRTOC.html/category/21865/hostUri/portal Use separate CLINs for anticipated travel expenses in IGCEs and requisitions.

· Personal Services FAR 37.1; https://acquisition.gov/far/current/html/Subpart%2037_1.html#wp1082880

· Inherently governmental functions reference FAR 7.5; https://acquisition.gov/far/current/html/Subpart%207_5.html#wp1078196

· Electronic paperwork; https://acquisition.gov/far/current/html/Subpart%204_3.html#wp1085621

All Contractor and subcontractor employees are required to sign the Contractor's Commitment to Protect Non-Public Information Agreement FDA 3398 prior to commencement of work. Contractor will be invited to meet with key FDA representatives to review current activities and status, Project Management repository contents, current policies, procedures, plans and charters, and any other materials and discussion deemed relevant to the subject areas described in this SOW. Additional discovery and relevant materials can be made available to the Contractor as needed to support execution of tasks as they are awarded.

General IT Compliance The Contractor shall be familiar and comply with applicable federal information technology and information management laws, regulations, policies and standards at the government-wide, HHS, and FDA levels, pursuant to guidance and instruction from the COR. At the government-wide level, these include Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and General Accounting Office (GAO). These can be primarily found at or through the Federal CIO Council website at: http://www.cio.gov/. HHS documents are found at: http://www.hhs.gov/ocio/.

Noncommercial Computer Software Compliance General Requirements The Contractor shall ensure that computer software operated on behalf of the Government is fully functional and operates correctly on systems configured in accordance with government policy regarding configuration requirements. The Contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the government environment. The Government shall have unlimited rights in all software developed exclusively with Government funds.

"Computer software" means:

(i) Computer programs that comprise a series of instructions, rules, routines, or statements, regardless of the media in which recorded that allow or cause a computer to perform a specific operation or series of operations; and

(ii) Recorded information comprising source code listings, design details, algorithms, processes, flow charts, formulas and related material that would enable the computer program to be produced, created or compiled.