Draft_PWS_-_HSPD-12_Products_and_Services.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

PERFORMANCE WORK STATEMENT (PWS)

FOR

MODERNIZATION OF THE DHS IDENTITY MANAGEMENT SYSTEM (IDMS)

SERVICES FOR THE CONTINUED IMPLEMENTATION OF HSPD-12

1.0 GENERAL

1.1 BACKGROUND

The Department of Homeland Security (DHS) has a requirement for an Identity Management System (IDMS) to continue the implementation of Homeland Security Presidential Directive–12 (HSPD-12) and meet the needs of the Department. This capability shall provide HSPD-12 Personal Identity Verification (PIV) credential issuance and management, management and tracking of identity and attribute information, integration with DHS personnel vetting process, interfacing with logical and physical access systems for application enablement, information discovery and audit, data security and segmentation, system interfaces, online scheduling system, public key infrastructure (PKI), and systems management.

Under the guidance of the DHS Office of the Chief Security Officer (OCSO), the Identity Management Division (IMD) supports the Department by managing and securing the identities of its Federal employees and contractors, and by improving the security of DHS information systems, facilities, and data by controlling access to these resources. IMD is also solely responsible for the planning and implementation of HSPD-12 throughout the Department. The IDMS solution shall be developed in accordance with HSPD-12; Office of Management and Budget (OMB) Memorandum M-11-11, Continued Implementation of Homeland Security Presidential Directive (HSPD)-12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011 (“M-11-11”); and Federal Identity, Credential and Access Management (FICAM) Roadmap and Implementation Guidance, Version 1.0, November, 2009. In addition, the IDMS technical solution shall be built following FICAM Roadmap and Implementation Guidance which provides overarching architecture and implementation guidance in support of HSPD-12, National Institute of Standards and Technology (NIST) specifications, and other mandates and guidance.

Since 2008, DHS has provided an IDMS to serve as the focal point for aggregating and correlating personnel biometric, biographic, attributes, cryptographic, certificate and credential information for DHS employees and contractors. The IDMS supports Federal Information Processing Standard (FIPS) 201-1 compliant enrollment and issuance processes. The IDMS manages the lifecycle of personnel data and related attributes, including the Facility Agency Smart Credential Number (FASC-N) and electronic data interchange personal identifier (EDI-PI) for the purposes of identification and access management. It supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical access but do not require a PIV card (i.e. employees/contractors working for less than 6 months). The IDMS also provides a web portal interface for administrative, audit/reporting, data entry and ad hoc queries. The current solution supports data http://en.wikipedia.org/wiki/Electronic_data_interchange_personal_identifier http://en.wikipedia.org/wiki/Electronic_data_interchange_personal_identifier segmentation in accordance with DHS Component structure (e.g. CBP, DHS HQ, FEMA, FLETC, ICE, TSA, USCIS and USSS), security and business needs.

The IDMS shall integrate with the following:

• US Treasury PKI (manages DHS PKI Certificate Authority) for certificate issuance and management.

• DHS Integrated Security Management System (ISMS), which is the authoritative system for personnel security records for DHS employees and contractors, and acts as the sponsor for the PIV card issuance process. The ISMS provides key data elements for each managed identity.

• DHS Automated Biometric Identification System (IDENT), which is the official clearinghouse for all biometrics used by DHS. Fingerprints collected by the IDMS during the enrollment process are submitted to IDENT for background check/investigation processing. Results are returned to IDMS, which passes them along to ISMS for validation, adjudication, and storage.

• FBI’s Criminal Justice Information System (CJIS), which is a repository of criminal fingerprints and history records that will be searched by DHS. Information provided by CJIS will be used for background check/investigation processing.

• Component and Enterprise Physical Access Control System (PACS), which is the authoritative system for controlling and monitoring access to specific physical facilities (e.g., buildings, rooms, airports, warehouses) and integrates with the IDMS to improve security and process efficiencies through data provisioning and synchronization.

• Component and Enterprise Logical Access Control System (LACS), which are processes and technologies for controlling and monitoring access privileges to online resources (e.g., active directories, networks, files, computers, databases) and integrates with the IDMS to improve security and process efficiencies through data provisioning and synchronization.

• Card/Credential Management System (CMS), which is responsible for managing the disposition of credentials for personnel and associated data managed by the IDMS.

• Hardware Security Module, which is responsible for storing, protecting and managing sensitive cryptographic key materials used by the IDMS for encrypting or signing data or establishing and managing data sessions (e.g. global platform sessions for PIV card management).

• Enrollment and Issuance Workstations (EIWS), which are PC based platforms used for data input and management for enrolling, updating, issuing, encoding, and managing the lifecycle of PIV and other credentials. The EIWS consists of a PC, smart card reader, card printer for card printing and encoding, camera and fingerprint reader for biometric fingerprint and facial image capture, and a document scanner for capturing personnel identification cards and other data.

• Light Activation Stations, which are lightweight PC based interfaces to the CMS that support self-service PIV card updates, unlocks, and Personal Identification Number (PIN) resets.

1.2 SCOPE

The scope of this Performance Work Statement (PWS) includes the full range of program management support, engineering services, labor, materials, and equipment (except for government furnished items) required to build, install, integrate, test, deploy, manage, operate, and maintain the HSPD-12 Identity and Credential Management solution. Under this PWS, the Contractor shall provide the core infrastructure that will be installed at DHS Data Center locations, in addition to Enrollment and Issuance Workstations (EIWS) and Light Activation stations. The scope of this PWS includes the support and management of the transition from the existing solution and provider, and the solution integration with relevant authoritative data sources.

The Contractor shall provide up to 400 EIWS to be installed at no less than 300 DHS locations and be capable of issuing and managing at least 300,000 PIV cards. The Contractor, where applicable, and to the extent feasible, shall integrate the existing DHS EIWS (up to 405) into the new HSPD-12 Identity and Credential Management solution infrastructure. Light activation stations shall be installed within each Component location (up to 16,000).

The Contractor shall support and manage the transition from the existing solution and provider (the incumbent Contractor), minimizing downtime and cost overruns as well as functional, security and performance impacts; this is relevant for all system elements including back-end infrastructure and interfaces and distributed end user facing systems (e.g., IDMS, CMS, EIWS, Light Activation Stations and relying PACS and LACS).

The Contractor shall support solution integration with relevant authoritative data sources, leveraging existing interfaces, to facilitate the identity proofing process, the PIV issuance and management lifecycle as well as the lifecycle of the associated identity and corresponding attributes.

The Contractor’s program and transformational change management staff will provide support services for the Department’s HSPD-12 Program to ensure the success of the adoption and implementation of the HSPD-12 Identity and Credential Management solution. The Contractor's efforts shall encompass program planning, program management and program support for the HSPD-12 Identity and Credential Management solution. This PWS addresses work involving:

• Program level planning to prepare for the modernization of the current HSPD-12 solution, where relevant, and establish an end-to-end Identity and Credential Management System to support the lifecycle issuance and management of PIV and other DHS cards, enable LACS and PACS usage and interoperability, and support ICAM target objectives.

• Managing, monitoring and control, and performing activities to conduct a seamless and expedited transition from the current to target solution with minimal disruption to business operations while insuring data integrity.

• Supporting the HSPD-12 Program in the procurement, design, build, test, implementation, security authorization (formerly Certification & Accreditation - C&A), deployment, management, operation, and maintaining a secure and scalable Identity and

Credential Management solution that increases facility and data security, and protects personal data.

1.3 OBJECTIVES

The objective of this PWS is to acquire an IDMS and PIV EIWS to support the continued implementation and sustainment of the Department’s HSPD-12 program. The Contractor shall provide the Government with a HSPD-12 Identity and Credential Management solution and services throughout the period of performance. The transition from existing to the new solution shall not disrupt processes for PIV identification, logical or physical access, PIV lifecycle management (issuance, update, and management). The capability provided shall also support the transition to full Enterprise IDMS and CMS as defined in the Requirements Traceability Matrix and DHS Enterprise ICAM Segment Architecture.

This task order shall establish a program management structure to manage, monitor, and control all subsequent HSPD-12 Program IDIQ delivery/task orders initiated to obtain services and products required to satisfy the program objectives. The Program Manager established in this IDIQ shall oversee and provide direction and guidance to the Project Managers of the subsequent IDIQ delivery/task orders. The Program Manager shall coordinate efforts between all IDIQ delivery/task orders and projects. Essential responsibilities of the Contractor’s Program Manager and program management structure in respect to all task orders are:

• Identify, monitor, and control interdependencies between IDIQ delivery/task orders

• Manage escalated issues amongst the IDIQ delivery/task orders that compromise the program

• Track the contribution of each IDIQ delivery/task order's project and non-project work to the consolidated program benefits.

The integrative nature of this IDIQ involves coordinating the processes for each of the IDIQ delivery/task orders for the entire duration of the program; this applies through all Program Management process groups of initiating, planning, executing, monitoring and controlling, and closing. The Contractor shall manage processes at a level higher than those pertaining to a project. An example of this type of integration is the management of Systems Engineering Life Cycle (SELC) documents that need to be coordinated at the program level because they are created, updated, and approved across multiple SELC phases and cross IDIQ delivery/task order boundaries, and otherwise cannot be managed at an individual project level.

1.4 APPLICABLE DOCUMENTS

1.4.1 Compliance Documents

The Contractor shall refer to OMB, NIST, FICAM, and DHS for specifications, standards, and guidelines that must be complied with in order to meet the requirements of this PWS.

1.4.2 Reference Documents

The Government will provide documents which may be helpful to the Contractor in performing the work described in this PWS as available. The Government intends for this supporting documentation to provide information to the Contractor about the structure of DHS PIV Card

Issuer (PCI), its facilities, any external service providers, the roles and responsibilities within the PCI, policies and procedures which govern its operations, and a description of how requirements of FIPS 201-1 are being met prior to award. These documents are provided solely for informational purposes and their content is subject to change.

Documentation Provided with the PWS Document Version Description DHS Management Directive 140-01, Information Technology Systems Security

July 2007 This directive establishes DHS policy regarding Information Technology (IT) Systems Security.

DHS 4300A, Sensitive Systems Policy

Version 9.1, July

Articulates the DHS Information Security Program policies for sensitive systems.

DHS 4300A, Sensitive Systems Handbook

Version 9.1, July

Provides direction to managers and senior executives for managing and protecting sensitive systems. It also outlines policies relating to management, operational, and technical controls necessary for ensuring confidentiality, integrity, availability, authenticity, and nonrepudiation within DHS information system infrastructure and operations.

DHS Instruction Manual 102-01-001, Appendix B:

DHS Systems Engineering Life Cycle (SELC)

Version 2.0, September 2010 (Interim)

Directive which defines the DHS acquisition program, creates common acquisition standards and practices, and establishes a single, tailor-able life cycle acquisition framework.

DHS PIV Card Issuer (PCI) Operations Plan

Version 3.0, February 2013

A comprehensive document incorporates all the information about the PCI that is needed for any independent party to review it and assess the capability and reliability of the PCI’s operations. A PCI operations plan includes a description of the structure of the PCI, its facilities, any external service providers, the roles and responsibilities within the PCI, policies and procedures which govern its operations, and a description of how requirements of FIPS 201-1 are being met.

DHS HSPD-12 Procedures Reference Book

Version 4.0, March 2012

Provides a comprehensive set of HSPD-12 compliant procedures for the DHS PIV Card Lifecycle Management Process.

Document Version Description DHS Enrollment Official User Guide

July 2012 The purpose of this user guide is to ensure that all individuals who are assigned the Enrollment Official (EO) role have the required knowledge and skills to execute their duties and provide outstanding customer service. This document supports, supplements, and further details the procedures corresponding to an EO as contained in the DHS HSPD-12 Procedures Reference Book (PRB).

Functional, Operations, and Data Document

April 2013 Statement of an application's functional requirements.

Homeland Security (HLS) Identity, Credential, and Access Management (ICAM) Segment Architecture (SA) Phase Report

Version 1.0, March 2010

The HLS Enterprise Architecture (EA) ICAM SA initiative is a joint effort with the Screening Coordination Office (SCO) and Enterprise Architecture Program Management Office (EA PMO) to provide substantive and actionable guidance for ICAM solutions.

1.5 PERFORMANCE REQUIREMENTS SUMMARY

This contract includes a Performance Requirements Summary (PRS) at PWS 11.0. The PRS plays an integral role in the administration of the IDIQ delivery/task orders. In addition to any applicable inspection clauses or other related terms and conditions contained in the IDIQ delivery/task order, the PRS shall serve as a primary tool for inspection and acceptance of services as facilitated by the Contracting Officer’s Representative (COR). Evaluation of the Contractor’s overall performance shall be in accordance with the performance standards set forth in the PRS, and will be conducted by the COR. The PRS constitutes a material aspect of the IDIQ and will not be changed or otherwise modified without prior written approval of the Contracting Officer.

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Task 1 –Design, Development, Test, Implement, and Maintain, and Support the DHS HSPD-12 Identity and Credential Management System (IDMS/CMS)

The Contractor shall design and present a plan to modernize the DHS IDMS/CMS with the assistance of the program. Additionally, the Contractor shall provide a scalable solution that permits the Department to scale the capabilities delivered in Task 1 to achieve the delivery of an Enterprise IDMS and CMS as defined in PWS section 2.8.

The Contractor shall work with Divisional Subject Matter Experts (SMEs) to determine the functional, operations, and data requirements including identifying areas of improvement and cost driving requirements.

The Contractor shall include as part of the design, storage of all data and reports. The data will become part of the Department’s IDMS/CMS. The final structure of the IDMS/CMS will be determined by the COR and Contractor.

The Contractor shall document the design and all technical details for maintenance purposes.

The Contractor shall provide support for workflow orchestration, database architecture, system and machine interfaces, experience with identity and card/credential management systems, and programmers.

The solution will deliver the following capabilities:

• Identity Management o Establish workflows and integrate with existing process to facilitate the lifecycle management of the PIV card and person digital identities o Perform the identity proofing, verification, and validation functions required to establish identity claim validity in compliance with HSPD-12; hold and process applicant status information; and ensure that all card issuance requirements are met prior to printing a card.

o Establish, manage, and maintain person digital identities for DHS employees, contractors, and other personnel, until deleted.

o Capable of aggregating, managing and correlating, biometric and biographic data from various authoritative data sources including ISMS, US-VISIT IDENT, and Active Directory or the Component Identity Management (IdM) throughout the identity lifecycle (from the post of creation until DHS deletes the data).

o Provide active and passive electronic notifications of key workflows events using a rules/policy-based engine.

o Establish and maintain a chain of trust for identities stored within the IDMS (creation, updates, manage, link, unlink, activate, deactivate and terminate).

o Provide interfaces, connectors, and/or tools to integrate with Component ICAM solutions, logical and physical access control systems, and authoritative and consumer data sources (e.g., Active Directory, HR, ISMS, US-VISIT IDENT), and database and directory integration services (e.g., Identity Hub).

o Provide user self-service workflows and web interfaces for identity data management.

• HSPD-12 PIV Credential Issuance and Management o Capable of issuing, tracking, and managing PIV credentials for DHS to include:

HSPD-12 PIV, Facility Access Cards (FAC), PIV-I, Visitor Cards and other as needed; DHS PIV Cards shall be used as an identification card, enable PIV based physical and logical access (PACS and LACS), support digital signatures for non-repudiation of transactions, and support for data and document encryption for secure communication.

o Issue a FIPS 201 compliant card which includes PIV Authentication Certificate, PIV Digital Signature Certificate, PIV Asymmetric Card Authentication Certificate (also known as Card Authentication Key (CAK)), and PIV Encryption Certificate (on card escrow and server).

o Track and manage the full lifecycle of PIV cardstock, from initial receipt from the Government Printing Office or card manufacturer, through final disposition, either destruction or lost/stolen declaration.

o Deliver a standards based Enrolment and Issuance Workstation Station, with local personalization, identity enrolment, printing and end-to-end lifecycle management capabilities to support the lifecycle issuance and management of PIV, PIV-I, PIV- C, FAC and other credentials o Deliver a light footprint card update, unblock and activation station which leverages existing GFE workstations and can coexist, without causing conflicts, with other DHS middleware (for example, Microsoft CAPI, ActivClient, etc.).

• Integration with DHS personnel vetting process o Integrate with existing identity vetting processes such as ISMS.

o Integrate with existing DHS processes for personnel vetting and adjudication using Service-Oriented Architecture (SOA) Web Services to support the issuance, management and use of the PIV cards and associated attributes.

o Host web services for authoritative information providers to consume and must have the capability to consume web services of other providers.

• Fingerprinting Services o Capture and extract the primary and secondary fingerprints and process and store prints for identity management, HSPD-12 credentialing, and background investigation processing o Shall be capable configurable to support both slapped or rolled prints for personnel background screening to USVISIT IDENT, FBI IAFIS and/or OPM o Integrate with USVISIT IDENT to streamline the background investigation to capture fingerprint data and submit using appropriate message formats and standards establishing a technical chain of trust and provide continuous vetting.

Where relevant, integration with IDENT shall also support DHS business needs for personnel background screening.

o Shall leverage existing infrastructure, such EIWS and Component store and forward systems

• Interfacing with authoritative and non-authoritative data stores, and logical and physical access systems for application enablement o The solution should provide a web-service based interfaces allowing vetting systems to consume web services and to pass attribute data.

o Integrate with the Department’s logical and physical access directories.

o Reduce the transmission and re-keying of Personally Identifying Information (PII) and identity data by interfacing /integrating with authoritative data sources and dependent systems.

o Integrate with DHS certificate authority (Entrust-based) for the issuance and signing of four key pairs.

o Integrate a Unique ID for DHS and the transition of Federal Agency Smart Credential Number (FASC-N) to Universally Unique Identifier (UUID) to support

PACS.

• Support for information discovery and audit o Track the status and disposition of PIV cards from manufacture to destruction and be capable of performing search and correlation of credential and identity data for the lifecycle of the associated individual.

o All access shall be digitally logged and made available through a standards-based interface for collection, correlation and reporting purposes o Enforce role-based access control in compliance with FIPS-201 and DHS requirements for systems operating under a HIGH security category.

o Allow for the access rights of managed users to be quickly audited across the DHS enterprise.

• Data Security and Segmentation o Ensure the protection of all data elements in transit and at rest and support the segmentation of data based on DHS Component and Role o The solution shall maintain the technical and operational chain of trust for identity and PIV credentials

• System Uptime o Provide no less than 99% system uptime measured on a monthly basis (no more than 7 hours per month unplanned outage).

• System Interfaces o Provide a secure web based machine to machine, administrative and end user interfaces where relevant.

• Systems Management o Integrate with existing Department patch management systems and processes or implement automated processes to reduce administrative overhead and complexity and operational and support costs.

o Allow for continuous monitoring and vulnerability scanning

In addition to the requirements above, the solution shall:

1. Provide a segmented identity and credential database that supports the Department’s and Components’ security and business needs, enforcing a strict need to know and separation of duties. This would also include segmenting one or more Component’s data from another.

2. Integrate with DHS infrastructure, networks, monitoring, and configuration and patch management solutions, and Data Centers, where applicable.

3. Provide EIWS appointment scheduling that supports location management to identify site-specific work schedule, holidays, services and duty assignments; and internet accessibility to support applicant registration and schedule management.

4. Establish a scalable, secure and high performance solution capable of supporting the Department’s distributed population and facilities; at a minimum of 1 million personnel records.

5. Support platform-appropriate hosting virtualization, both for back end systems and lightweight activation systems.

6. Comply with the interpretation of the U.S. Common Policy and integrate with the US Treasury (Entrust Backend) PKI to facilitate PIV card and credential issuance and management.

7. Documentation delivered by the Contractor shall comply with the DHS SELC.

2.1.1 Subtask 1.1 – IDMS Design, Build, Test, and Implementation

The Contractor shall procure, design, build, test, implement, and obtain system security authorization for the IDMS.

The IDMS solution shall:

1. Be a secure and scalable HSPD-12 compliant solution that consists of a (1) production primary, (2) production backup, and (3) production test installed at DHS designated Data Centers.

2. Include effective contingency planning (including back-up and disaster recovery capabilities).

3. Have data and user interfaces that are standards-based and/or widely accepted communication protocols to increase usability and interconnectivity with external systems without increasing costs.

4. Have multi-year warranty and maintenance plans that minimize disruption to system needs.

5. Be GOTS based using COTS applications and solutions.

6. Provide comprehensive System Security Plan that includes responses to system-based security controls.

2.1.2 Subtask 1.2 –CMS Design, Build, Test, and Implementation

The Contractor shall provide a card/credential management system, which integrates with the IDMS, to track and manage the status of credentials throughout their entire lifecycle. This includes but is not limited to the request, personalization, activation, issuance, suspension, and revocation of credentials. Card operations and maintenance functions such as addressing lost cards, card malfunctions, card renewal, card reissue, applet updates, PIN resets and other card “life cycle” functions shall be managed by the CMS.

In addition, the solution shall:

1. Provide standardized PIV card management interface specifications.

2. Define the process for updating of applets, PKI certificates and other information on the integrated circuit card (ICC), forgotten and regularly changing of PIN’s, and other card life cycle functions.

3. Interface with the IDMS, the PKI certification authority, and the card printing system, and be capable of interacting with a variety of Government systems for enterprise-level logical access control systems and physical access control systems in a secure manner.

4. Establish distributed and manageable network of EIWS and light activation/update stations that support the issuance and card lifecycle management requirements for DHS populations worldwide.

5. Develop SELC documentation as defined in PWS section 2.5 and Appendix B of the

DHS SELC

2.1.3 Subtask 1.3 – IDMS Services and Support

The Contractor shall provide HSPD-12 services and support that meets all minimum requirements, performance standards, reduces/minimizes management and administrative overhead, increases facility and data security, and protects personal data.

These services and support shall:

1. Provide Operations, Maintenance and Support for IDMS, CMS, EIWS and Light Activation Stations.

• O&M requires multi-person control which the Contractor must be capable of providing; Government resources can be provided to assist with physical access to data center and system resources.

2. Reduce the Government’s burden related to the management of Identity and Credentials (e.g. PIV cards) issued or managed by the solution.

3. Establish automated management capabilities over manual process, where applicable.

4. Provide the necessary safeguards and follow established protocols to secure identity management data.

5. Define the configuration management, change control, and system component inventory process to effectively manage the hardware, software, firmware, documentation, test, test fixtures, and test documentation throughout the life cycle of the solution.

6. Support the Program’s objective to implement robust methods for reporting status, progress, and benefits of Program services in as close to real-time as possible. The approach should minimize the need for self-reporting and emphasize automated collection of data to transparently measure and report performance metrics.

7. Develop SELC documentation as defined in PWS section 2.5 and Table 9.

8. Develop O&M Plans and Documentation in accordance with the DHS SELC.

2.1.4 Subtask 1.4 – IDMS/CMS Technical Support Documentation

The Contractor shall develop IDMS/CMS documentation in accordance with the DHS SELC Tailoring Plan to assist those who manage, operate, maintain, and use the new system to ensure that appropriate systems engineering activities are implemented in each stage of the life cycle to increase this procurement’s likelihood of success. The documentation shall be sufficiently detailed with a full description of the system components, interfaces/integrations with other software/systems, end user information, and troubleshooting information as the system progresses through the Development and Integration & Test stages. Unless exceptions are granted by the COR, SELC documentation shall conform to Section 508 requirements for accessibility. The documentation shall be developed according to human systems integration (HSI) criteria to ensure that they are complete, clear, current, accurate, accessible, updateable, and compatible with user knowledge and skill levels. The following subtasks define the documents required to be produced.

2.1.4.1 Develop Operators Manuals

The Contractor shall develop Operator Manuals that describes the components of the system and how the system is to work from the perspective of those who are to operate it. Everything that is required to operate and support the operation of the system shall be provided in the operator’s manual, including a full description of the system components, the expectations for system operation, system functionality, and operational trouble shooting.

2.1.4.2 Develop Maintenance Manuals

The Contractor shall develop Maintenance Manuals that describes the components of the system and the practices required to keep the system functioning. Performance monitoring, periodic testing of facilities and system functionality, and periodic maintenance activities to ensure the system functions shall be included in the manual. Trouble shooting guides and other help content shall be included.

2.1.4.3 Develop User Manuals

The Contractor shall develop User Manuals that describe how the end users – those for whom the system was developed – are to interact with the system in order to receive the benefits it provides. Information describing the functionality that the system provides and how to access it shall be included in the user manual. User scenarios that depict common interactions shall be provided, as are instructions for help desk access, guidance for general troubleshooting from the user’s perspective, and where to go for training.

2.2 Task 2 – Seamless and Expedited Transition of the IDMS

The Contractor shall conduct a seamless and expedited transition from the current to the target solution with minimal disruption to business operations while insuring data integrity.

The Contractor shall:

1. Plan and conduct an expedited transition from the current environment to the new environment, including support for parallel operations.

2. Coordinate with current solution Contractor to establish an efficient and executable data migration plan that will migrate existing data to the new solution with zero data loss.

3. Transition or leverage existing EIWS and light activation stations in the field.

4. Transition to end state integrations with existing data sources and processes for issuance, management and use of credentials.

5. Provide system documentation, guides, and role-based train-the-trainer sessions for system support personnel and EIWS officials to provide them with the capability to effectively manage and use the system.

2.3 Task 3 – DHS PIV Card Enrollment and Issuance Workstations (EIWS)

The Contractor shall support the use of the existing EIWS segment of the IDMS/CMS functions.

The Department currently operates over 405 EIWS that were procured under the incumbent BPA. The Contractor shall assist the HSPD-12 program in using existing EIWS and integrating the existing technology into a new system if required.

The Contractor shall provide card enrollment and issuance workstations, the associated workflow and peripherals to guarantee seamless integration into the DHS IDMS and a nationwide deployment. The Contractor shall provide the necessary hardware that shall interface with the DHS IDMS solution. The Contractor shall propose hardware that complies with the DHS Enterprise Architecture Technical Reference Model requirements, FIPS 201, NIST supporting special publications, and other referenced federal standards. The proposed hardware shall have the flexibility to support additional credentialing initiatives as they are identified, to include supporting fixed and mobile operations.

The Contractor’s EIWS solution shall have the ability to update the EIWS automatically in order to provide EIWS certificate updates, card topology changes, and other changes as required.

The Contractor shall provide workstations that comply with applicable technical and functions performance criteria of Section 508 unless exempted. The workstations shall include but are not limited to the following:

1. Laptop with 17” screen and built in SCM card reader

2. Laptop Docking Station

3. Mouse

4. Flatbed Document Scanner (Example: Epson Flatbed Scanner)

5. 10 Digit Fingerprint Scanner (Example: L-Scan Crossmatch Guardian)

6. Biometric Fingerprint Authenticator (Example: Hampster IV)

7. SCM Card Reader

8. Digital Camera (Example: Cannon Powershot S31S, high resolution web cam)

9. PIN pad

10. PIV Card Printer (Example: Datacard SP75+)

11. Fingerprint parsing

12. Uninterruptable Power Supply/Source (UPS), battery backup

The Contractor shall provide a phase-in approach that integrates GFE EIWS equipment into the IDMS solution by initially using existing equipment with a planned replacement cycle, over a four-year period, rather than an upgrade or replacement of the GFE EIWS infrastructure. If not feasible, identify the transition period required to accommodate procurement of long-lead-time components based on 400 EIWS to be deployed.

2.3.1 Subtask 3.1 – EIWS Warranties and Maintenance Support

The Contractor shall provide to the Government the terms and conditions of their warranties and maintenance support for all EIWS in clear and understandable terms. These terms and conditions should identify services, service levels, and pricing. The Contractor shall provide maintenance support for the system and all subsystem elements, including good faith estimates. The Contractor shall administer product warranties and maintenance agreements, including fulfillment of such instruments. The Contractor shall perform maintenance on the PIV enrollment and card issuance components and support audit of maintenance actions. The Contractor shall perform maintenance to support the Government testing laboratory environments.

2.3.2 Subtask 3.2 – EIWS Technical Support Documentation

The Contractor shall provide the following documentation in an electronic word document format to the COR to assist those who operate, maintain, and use the enrollment/card issuance workstation. The Contractor shall update that documentation with a full description of the system components, end user information, and troubleshooting information. The Contractor shall use industry best practices in maintaining version control and documenting updates or changes to these and other documents. Unless exceptions are granted by the COR, manuals should conform to Section 508 requirements for accessibility. The manuals shall be developed according to human systems integration (HSI) criteria to ensure that they are complete, clear, current, accurate, accessible, updateable, and compatible with user knowledge and skill levels. The following subtasks define the documents required to be produced.

2.3.2.1 Operator’s Manual

1. The Contractor shall draft and submit to DHS documentation that describes the components of the system and how the system is to work from the perspective of those who are to operate it. Everything that is required to operate and support the operation of the system shall be in the operator’s manual, including a full description of the system components, the expectations for system operation, system functionality, operational trouble shooting, and a clear identification and delineation of systems roles and responsibilities consistent with the current version of FIPS 201.

2. The Contractor shall review the operator’s manual documentation annually with the DHS HSPD-12 Program Manager.

3. Process and document changes identified by the IDIQ COR within 10 business days.

4. Submit a final Operator’s Manual in Microsoft Word for the IDIQ COR approval.

2.3.2.2 Maintenance Manual

1. The Contractor shall draft and submit to the COR documentation that describes the components of the system and the practices required to keep the system functioning.

2. Performance monitoring, periodic testing of facilities and system functionality, and periodic maintenance activities to ensure the system functions shall be included in the manual. The Contractor shall include trouble shooting guides, help desk scripts, and other help content that addresses the full scope of the technical solution and resulting from the Contractor’s relevant HSPD-12 lessons-learned and experience.

3. The Contractor shall review the maintenance manual documentation annually with the DHS HSPD-12 Program Manager.

4. Process and document changes identified by the IDIQ COR within 10 business days.

5. Submit a final Maintenance Manual in Microsoft Word for the IDIQ COR approval.

2.3.2.3 User Training Manual

1. The Contractor shall draft and submit to the COR documentation that describes how the end users are to interact with the system in order to receive the benefits it provides.

Information describing the functionality that the system provides and how to access it shall be in the user training manual. User scenarios that depict common interactions shall be in the user training manual, as are instructions for help desk access, guidance for general troubleshooting from the user’s perspective, and where to go for training.

2. The Contractor shall review the user training manual documentation annually with the DHS HSPD-12 Program Manager.

3. Process and document changes identified by the IDIQ COR within 10 business days.

4. Submit a final User Manual in Microsoft Word for the IDIQ COR approval.

2.4 Task 4 – Operations and Maintenance (O&M) Support Plan

The Contractor, in close coordination with the DHS HSPD-12 Program Manager, shall create, deliver, maintain an Operations and Maintenance (O&M) Support Plan that involves planning for, and executing, activities, such as operating the system, monitoring system performance, making repairs, testing the system after any changes are made, and tuning the system. The IDMS will require regular maintenance. Preventive maintenance involves inspection and proactive actions, such as cleaning, replacement of components prior to the end of their rated life, backing up software, storing data, and replacing components that have become obsolete and unsupported. Reactive maintenance involves correcting faults when they occur. Software maintenance involves correcting malfunctions [bugs] when they are discovered, upgrading components that become obsolete and unsupported, and making minor modifications as needed to improve functionality.

During the Concept of Operations phase of the IDMS solution, the Contractor shall define the system from the O&M perspective. This perspective, which provides how the system will operate and be maintained, becomes the initial planning for the system when it is commissioned into service. Once the system is commissioned into service, these plans are updated to reflect the as-is operational and maintenance environment. The complete O&M Support Plan shall:

• Identify policies supporting on-going operation & maintenance

• Identify the aspects of the system needing operation or maintenance

• Identify the manuals [users, administrators, and maintenance], configuration records, and procedures that are to be used in operation & maintenance

• Identify the personnel who will be responsible for operations & maintenance

• Identify initial and on-going personnel training procedures, special skills, tools, and other resources

• Identify operations & maintenance related data to be collected and how it is to be processed and reported

• Identify methods to be used to monitor the effectiveness of operations & maintenance

O&M information shall be collected throughout the operational life of the system including:

disruption in service of the system, restoration measures undertaken, and system performance.

Down time and the mean time to repair should be documented and used to assess the average availability of the system. Repair logs should include vendor notice of obsolescence and notice of design changes that will affect the maintainability of the system elements.

http://www.fhwa.dot.gov/cadiv/segb/glossary/c.htm#text_Components

O&M procedures need to proceed as defined in the O&M Support Plan. Over time the procedures will need to be refined and updated because the system changes or improved procedures are developed. The O&M Support Plan shall be updated as well as the documented procedures, operator’s manuals, and maintenance manuals.

Help Desk

The Contractor shall provide help desk services structured in a 3 tier approach:

• Tier 1: Current DHS HQ and/or Component Help Desk

• Tier 2: DHS HQ Service Support Desk and/or Contractor

• Tier 3: Hardware/Software vendor support and/or Contractor

The Contractor may receive calls from enrollment officials, DHS Components, Component or DHS HQ Help Desks or DHS Service Support Desk. The Contractor shall be available during the hours of operation of the fixed or mobile enrollment/card issuance location. The Contractor shall maintain accurate and timely records of calls received and provide the report to the COR upon request. The Contractor shall provide tier/level 2 and 3 help desk support and problem diagnosis documentation for tier/level 1 help desk in the form of Help Desk Scripts (i.e., feedback and lessons-learned from all activities within scope of this SOW, to include the installation and de-installation of Contractor’s technical solution). Level 1 help will be performed by DHS and Component help desks that are already in place.

2.5 Task 5 – Support for the Development, Implementation, and Maintenance of an IDMS Test and Development Environment

The Contractor shall develop the capability for test environment for troubleshooting problems, testing patches and new releases, completing product and interface testing to ensure that the developed system functions properly, satisfies the requirements, including security, and performs adequately in the host environment.

Contractor shall perform and support product/interface development, unit testing, integration testing, regression testing, system acceptance testing, security testing, Component acceptance testing, and any post-deployment testing of the IDMS/CMS.

The test environment testing shall be performed in an isolated environment to ensure that new programs do not adversely impact the current IDMS production system. Testing ensures that data will be processed correctly and reliable output will be produced in the desired format.

2.6 Task 6 – HSPD-12 Systems Engineering Lifecycle Documentation and Process

In accordance with the DHS SELC, the Contractor shall develop, manage and maintain the following documentation and processes.

2.6.1 Subtask 6.1 – Program Management Plan

The Contractor shall provide a Program Management Plan (PMP) for managing this IDIQ contract. As additional IDIQ delivery/task orders are awarded, the PMP shall be updated to incorporate those requirements. The Contractor's Program Management Plan shall address planning and control policies and procedures for project administration, execution and tracking.

The planning and control policies and procedures should address identification of milestones, dependencies and critical path items where Government information or activity is required as well as identification of timeline dependencies for subsequent Contractor activities. The PMP must also identify the Contractor’s program management structure and program management strategy. Additional required elements of the PMP are identified below.

2.6.1.1 Integrated Master Plan

The PMP shall include the Contractor’s Integrated Master plan (IMP) that allows traceability to the Contractor's Integrated Master Schedule (IMS) (see Section 2.6.5) and Work Breakdown Structure (WBS) (see Section 2.6.1.2). The IMP shall explain how the Contractor plans to manage the program at the following three (3) levels:

• Key Events — Activities to meet technical agreement/contract requirements

• Accomplishments — Desired results prior to or at completion of a Key Event that indicates a level of the programs progress criteria that verify the accomplishments completion

• Criteria — Definitive evidence that a specific accomplishment has been completed; each criteria reflects what must be done and describes the overall approach to executing tasks

2.6.1.2 Work Breakdown Structure

The PMP shall include the Contractor’s WBS. The WBS must be developed in accordance with the most recent version of PMI Practice Standard for Work Breakdown Structures, accompanied by a WBS dictionary that includes 100% of the work defined by the project scope and captures all deliverables — internal, external, and interim — in terms of the work to be completed, including project management. The Contractor's WBS shall include a minimum of four 4 levels.

The work represented by the activities in each work package must add up to 100% of the work necessary to complete the work package.

The Contractor shall be responsible for making all updates to the WBS to ensure consistency between each WBS created for individual IDIQ delivery/task order work.

2.6.2 Subtask 6.2 – Risk Management Plan

The Contractor shall collaborate with the Government and incorporate details and processes to provide a consolidated Risk Management Plan. The plan shall detail the processes used to identify, document, track, mitigate, and report project risk. The plan shall facilitate the processes to identify, analyze, prioritize, mitigate, and monitor risk throughout the HSPD-12 Identity and Credential Management solution SELC. The plan must align with the HSPD-12 Program's Risk

Management Plan. The Contractor shall provide the Government with electronic access to any proposed risk management tools and requisite training on these tools.

2.6.3 Subtask 6.3 – Configuration Management (CM) Plan

The Contractor shall collaborate with the Government and incorporate details and processes to provide a consolidated CM Plan that identifies the processes which will be used for identifying, organizing, documenting, and managing changes to the HSPD-12 Identity and Credential Management solution as it evolves throughout the SELC. The CM Plan shall include the managerial and technical activities established to ensure that standard procedures are defined to protect the integrity of the HSPD-12 Identity and Credential Management Baseline and provide a means for evaluating and improving the program. The CM Plan shall include processes for monitoring, metrics/statistics, auditing, and archiving of HSPD-12 Identity and Credential Management configuration items. The CM Plan must include controls to ensure that changes are checked into a version control system and tasks are created to rectify any nonconformance in the HSPD-12 Identity and Credential Management Baseline Solution.

2.6.4 Subtask 6.4 – Requirements Management Plan

The Contractor shall provide a Requirements Management Plan that identifies how the Contractor will gather, analyze, document, and control requirements. The Plan shall detail the requirements management tools, procedures and processes. The Contractor shall provide the Government with electronic access to any proposed requirements management tools and requisite training on these tools.

2.6.5 Subtask 6.5 – Integrated Master Schedule

The Contractor shall develop and maintain an IMS, containing all activities, in accordance with the most recent version of the PMI Practice Standard for Scheduling, that provides a networked schedule that contains detailed, discrete work packages and planning packages necessary to support the events, accomplishments, and criteria of the IMP. In addition, the schedule shall contain milestones, exit criteria, and activities from contract award to contract completion. The Contractor shall work with the Government to identify and quantify schedule risk in hours, days, or weeks of delay and provide optimistic, expected, and pessimistic durations for each IMS activity and event.