ITOM DRAFT PWS.pdf

Department of the Treasury Office of the Comptroller of the Currency

IT Operations and Modernization (ITOM)

Support Services

Performance Work Statement (PWS)

DRAFT

1.0 INTRODUCTION

2.0 OBJECTIVE

3.0 GENERAL REQUIREMENTS

4.0 SCOPE

5.0 GENERAL REQUIREMENTS

5.1 Order Administration

6.0 TASK AREAS

5.1 Network Support

5.2 Communication Systems

5.3 Server Support

5.4 Storage Management

5.5 Directory Services

5.6 Identity Services

5.7 Corporate Platform Support

5.8 IT Security Platform Support

5.9 DevSecOps Platform Engineering

5.10 Application Development

5.11 Web Content Management

5.12 Database Administration

5.13 Data Management/Reporting

5.14 Business Analysis

5.15 IT Quality Assurance (QA)

5.16 IT Program Management

5.17 IT Project Management

5.18 End User Support

5.19 IT Training Services

5.20 Strategic Communications:

5.21 IT Product Management

5.22 Enterprise Planning Support (ERP) Support

5.23 IT Security

5.24 Enterprise Architecture (EA)

6.0 TRANSITION PLANNING AND EXECUTION

7.0 DELIVERABLES

8.0 OTHER DIRECT COSTS

9.0 PLACE OF PERFORMANCE

10.0 FEDERAL HOLIDAYS

11.0 PERIOD OF PERFORMANCE

12.0 SECURITY AND PRIVACY REQUIREMENTS

1.0 INTRODUCTION

The Office of the Comptroller of the Currency (OCC) is an independent bureau of the U.S.

Department of the Treasury. Its primary mission is to charter, regulate, and supervise all national banks and Federal savings associations. The OCC’s goal in supervising banks and

Federal savings associations is to ensure that these entities operate in a safe and sound manner and in compliance with laws requiring fair treatment and access to credit and financial products.

Headquartered in Washington, D.C. with a staff of approximately 4,000 employees, the OCC has four district offices and an Office of the Ombudsman to supervise the activities of national banks. To carry out its mission, national bank examiners conduct on‐site reviews of national banks and Federal savings associations (or Federal thrifts) and provide sustained supervision of these institutions’ operations. Examiners also analyze loan and investment portfolios, funds management, capital, earnings, liquidity, sensitivity to market risk, and compliance with consumer banking laws. In addition, these examiners conduct audits to review internal and external controls, as well as to evaluate management’s ability to identify and control risks.

Information Technology Services (ITS) works to enable the mission of OCC through technology solutions and services. ITS has an effort underway to modernize IT services and solutions utilizing more modern technology products, services, and techniques. Activities are supported through focus areas that include Supervision Platform Services, Cyber Security, End User

Services, Infrastructure and Shared Services, and Customer Experience and Relationship

Management. The current solutions encompass of Microsoft Backend database, windows servers, Low code platform (i.e., Appian, ServiceNow), Commercial Off the Shelf (COTS), as well as cloud services (AWS, Azure Snowflake, etc;). The current IT environment is made up of a mix of current and legacy services, which are supported by a variety of contract vehicles. Currently, OCC has service gaps and coordination issues across the various support areas.

2.0 OBJECTIVE

The objective is to obtain IT operations and modernization services that support the OCC ITS modernization initiatives by ensuring streamlined access to the modern commercial services required to deliver digital products to internal and external OCC users. The successful delivery of such products requires the provisioning of commercial agile delivery services supported by teams with capabilities in a range of Information Technology disciplines including but not limited to; premise and cloud infrastructure design and operation/maintenance, platform design and operations/maintenance, data management/reporting services, software development disciplines, IT security, user support as well as a broad range of associated programmatic services and disciplines, including product management, change management, problem management, test management and user engagement.

Obtaining IT operations and modernization services will provide the following:

1. Access to contractors specializing in modern IT service delivery including enterprise architecture, user‐centered design, user experience research, product management, agile application development, Application Programming Interface (API) development, automated testing, design and operations of premise networking and data center services, design and operation of diverse cloud services, continuous integration/continuous delivery (CI/CD), DevSecOps, data management and services, and related programmatic services and disciplines. Support the EA initiatives and projects, and work to mature OCC’s EA program.

2. Allow for services to be delivered in a rapid‐cycle fashion, in accordance with industry best practices.

3. Support the execution of multiple digital modernization efforts by providing the government a simplified method to add specific and specialized commercial capabilities.

4. Assist in positioning the Government with rapidly adopt industry best practices.

3.0 GENERAL REQUIREMENTS

Provide teams that deliver services that support OCC ITS goals to enable mission success through the modernization and ongoing operation of OCC technology services. The specific task area capabilities required for each team will be articulated at the Order level. Provide multi‐ disciplinary teams with members having expertise required to meet the individual Order capabilities specified.

Design, develop, configure, customize, and deploy solutions. Once deployed, provide production support of the solutions. Deliver modern digital services that use DevSecOps techniques that embrace continuous integration and continuous delivery/deployment (CI/CD).

Deliver secure and tested modern mobile and web application designs using automated testing frameworks.

Provide support to projects that are developing new systems as well as projects that are modifying or replacing, existing systems. Be familiar with current and emerging technologies, commercial off the shelf (COTS) products, services, programming languages and processes required to deliver high‐quality products.

The Contractor shall:

1. Deliver high‐quality, functional products that are measured by metrics appropriate to the product.

2. Incorporate Agile methodologies and ceremonies into work, such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating activities.

3. Actively involve stakeholders, including business partners and end users, in the design of all solutions. Incorporate best practices for modern user research and usability testing, such as (but not limited to) creating user personas, problem space definitions, affinity maps, user flow diagrams, wireframes, information architecture diagrams, design prototypes, user research plans, conversation guides, and user research synthesis.

4. Maintain a consistent look, feel, and voice across stakeholder facing sites and services.

5. Optimize web applications for mobile‐first operation, with all solutions being equally available on both mobile and desktop whenever possible. Incorporate robust accessibility principles into design, development, and testing for all web applications to deliver high‐quality digital experiences to users of assistive devices. Protect user information with best‐in‐class security, given the constraints of the environment.

6. Prioritize the use of DevSecOps methods and continuous delivery and continuous delivery/deployment (CI/CD) operations across all environments including, at a minimum, development, staging, and production.

7. Use of automated testing frameworks to create unit tests, integration tests, functional/black box tests, and load tests (or the equivalent, as applicable) to ensure

100% of functionality delivered is tested in the most comprehensive manner.

8. Adherence to Test‐Driven Development (TDD) principles.

9. Ensure configuration and sensitive data, including data the government defines as sensitive, are not present in source code, and are stored in encrypted credential management systems.

10. Ensure the delivery of code does not contain configuration or sensitive data to a government‐approved repository.

11. Cultivate a positive, trusting, and cooperative working relationship with the Government and all other contractors supporting this work.

4.0 SCOPE

OCC provides support services for approximately 135 applications and corporate platforms.

These applications contain both COTS with customization and fully customized applications to meet the business need.

The OCC ITS requires contractors to provide operations and modernization support services, and in some cases, development of special initiatives and program maturity that encompasses

IT capabilities such as:

Network Support

Communication Systems

Server Support

Storage Management

Directory Services

Identity Services

Corporate Platform Support

IT Security Platform Support

DevSecOps Platform Engineering

Application Development

Web Content Management

Database Administration

Data Management/Reporting

Business Analysis

IT Quality Assurance (QA)

IT Program Management

IT Project Management

End User Support

IT Training Services

Strategic Communications:

IT Product Management

Enterprise Resource Planning Support

IT Security

Enterprise Architecture

The approach of this effort will be further defined in individual Orders. These Orders will be within scope of this Performance Work Statement (PWS). Orders will detail the specific task requirements, deliverables, acceptance criteria and performance key indicators (PKI). Place of performance will be designated within each Order.

5.0 GENERAL REQUIREMENTS

Provide service delivery, including designing, developing, and deploying solutions that meet the needs of OCC and demonstrating a comprehensive understanding and experience across all

Task Areas. To meet the needs of the OCC, contractor shall ensure that they provide:

Timely and efficient responses to all IT service and support requests

High level of customer satisfaction

Continuous improvement and innovation in service delivery

Services that are compliant with Federal IT policies, procedures, standards, and best practices.

Scalability and flexibility to accommodate evolving IT requirements.

5.1 Order Administration

Provide Order administration and program management support services that effectively support OCC ITS. Ensure that tasks are performed with the appropriate resources, efficiently and that appropriate level of communication established and maintained throughout the period of performance. Provide planning and reporting task and project status against scheduled milestones, work management plans, spend and performance reporting including (PKI), work break down structure (WBS) deliverables and invoice tracking. Provide program/project management support to accomplish the work described in each resulting Order.

The Contractor must report staff utilization across Orders, projects, and operations to help track earned value metrics and total amount invoiced for projects and system operations.

All services performed require tracking of hours worked on tasks assigned in the system designated by the OCC. This system helps the OCC to review and budget time and costs associated with customers, applications, roles, and activities performed. This system is not used for time and attendance or to validate hours invoiced by the Contractor.

Conduct monthly status meetings and attend other meetings in support of this effort. The Contractor must complete and distribute meeting minutes no later than five (5) business days after completion of meetings.

6.0 TASK AREAS

5.1 Network Support

Provide Network Support that manages and maintains the integrity of OCC’s network infrastructure, ensuring consistent reliability, seamless operations, and secure performance.

The Contractor shall:

5.1.1 Design, install, and manage a robust network system involving diverse types of networking devices including but not limited to routers, switches, web proxies, load balancers, and firewalls.

5.1.2 Provide guidance and support with Cloud networking mechanics, including setup and management of Virtual Private Networks (VPNs), Direct Connect, ExpressRoute, and equivalents for stable, high‐speed connectivity between premise and Cloud environments.

5.1.3 Identify and resolve network issues to minimize impact on operations.

5.1.4 Maintain and upgrade network hardware and software to ensure optimal performance.

5.1.5 Ensure availability, stability, and performance of network systems.

5.1.6 Monitor network traffic to optimize data flow and minimize latency.

5.1.7 Implement robust security measures to protect the network from potential threats.

5.1.8 Maintain compliance with all relevant Federal and industry network standards, including NIST standards and OMB guidance.

5.1.9 Provide detailed network performance reports detailing uptime, usage statistics, and potential issues.

5.1.10 Implement and manage disaster recovery systems such as data backup systems and procedures to ensure high levels of resiliency and rapid recovery from realized instances of all traditional sources of risk in this context.

5.2 Communication Systems

Ensure that OCC has a Communication Systems that enhances internal and external communication and facilitates the smooth exchange of information. Manage communication systems, ensuring clear, uninterrupted transmission of communication, bolstering collaborative efforts and information dissemination.

5.2.1 Design, setup, and manage communication networks, including VoIP and unified communications platforms.

5.2.2 Maintain communication tools and platforms, including email, intranet, web conferencing, mobile communications, and telephony.

5.2.3 Implement necessary security measures to ensure the confidentiality and integrity of communications.

5.2.4 Monitor and maintain communication systems for optimal performance.

5.2.5 Respond to and resolve any system issues to minimize communication disruption.

5.2.6 Train staff on system usage and best practices to ensure efficient and secure communication.

5.2.7 Ensure all systems adhere to secure federal communications standards and regulations, including OMB, NIST, and FCC guidance

5.3 Server Support

Provide Server Support, encompassing both premise and hyperscale cloud environments, to ensure OCC IT systems store data, host applications, and facilitate network connections. Ensure the high availability and optimal performance of infrastructure, swiftly addressing any issues to minimize downtime and keep government activities at maximum efficiency.

5.3.1 Setup, configure, and manage physical and virtual servers, including in hyperscale cloud environments.

5.3.2 Provision cloud resources using tools like, but not limited to, Terraform, AWS CloudFormation, or Azure Resource Manager templates.

5.3.3 Perform patch management and system updates to keep servers secure and efficient.

5.3.4 Monitor server health and performance to pre‐empt and address issues promptly.

5.3.5 Conduct preventive maintenance to mitigate potential disruptions.

5.3.6 Ensure sound backup and recovery procedures for both premise and Cloud servers.

5.3.7 Implement robust security measures, including firewalls and intrusion detection systems, to protect the infrastructure.

5.3.8 Provide detailed server performance and maintenance reports, including Cloud resource utilization reports, to the Government.

5.3.9 Implement and manage disaster recovery systems such as data backup systems and procedures to ensure high levels of resiliency and rapid recovery from realized instances of all traditional sources of risk in this context.

5.4 Storage Management

Provide Storage Management that safeguards vital data across premise datacenters and hyperscale Cloud platforms. Manage and optimize diverse storage infrastructure, ensure data accessibility, durability, performance, and cost‐effectiveness. Provide services that include the ability to navigate the complexities of hybrid storage environments, employing industry standard strategies for data protection, backup, recovery, and archiving.

5.4.1 Manage diverse storage architectures, including premise datacenters and hyperscale Cloud environments.

5.4.2 Provide data lifecycle management, including allocation, backup, archiving, and deletion.

5.4.3 Provide capacity planning and performance optimization to ensure efficient use of storage resources.

5.4.4 Implement robust data protection strategies for safeguarding against data loss or corruption.

5.4.5 Implement storage disaster recovery strategies, ensuring business continuity during outages.

5.4.6 Transition storage systems, particularly towards hyperscale Cloud platforms.

5.4.7 Audit storage utilization, performance, and compliance.

5.4.8 Provide support maintaining OCC Data Center, including software and hardware asset management.

5.5 Directory Services

Provide Directory Services including identity and access strategies and advanced Identity Lifecycle Management. Ensure the Directory Services, based on integrated Microsoft Active Directory and Microsoft Entra ID, is maintained by the Contractor. Provide user account administration, Group Policy optimization, secure access enforcement, and performance tracking, aimed at promoting secure and efficient access to required resources, accomplishing performance indices, and ensuring audit compliance.

5.5.1 Maintain integrated Microsoft Active Directory and Microsoft Entra ID environments, with specific application to automated Identity Lifecycle Management.

5.5.2 Create, administer, and delete user accounts as per secure guidelines included in

NIST.

5.5.3 Configure Group Policy Objects (GPOs) to balance access and security.

5.5.4 Secure resources adequately via access control lists.

5.5.5 Maintain directory wellbeing through routine tasks like replication, performance tuning, and backups.

5.5.6 Exploit log analysis results to discern system behavior and promptly rectify disruptions.

5.5.7 Execute comprehensive security strategies, and stringent compliance to regulations, including the NIST framework.

5.6 Identity Services

Provide Identity Services that ensure consistent and secure digital identity for both workforce and customers across the U.S. Government’s IT systems, enabling and enriching the value of their experience. In collaboration with Task Area 5.6 Directory Services, manage identities and identity proofing to ensuring secure access for public interfaces and system processes. Provide an encompassing framework that elevates the interoperability of IT system elements, fortifying security, and facilitating efficient cross‐platform interactions.

5.6.1 Provide workforce identity management and identity proofing across diverse systems, applications, and networks.

5.6.2 Manage and maintain Customer Identity and Access Management (CIAM) to foster secure and seamless customer experience.

5.6.3 Integrate and maintain identity management systems seamlessly with Directory Services.

5.6.4 Facilitate and maintain secure and seamless identity federation across multiple platforms.

5.6.5 Audit of user access, both workforce, and customer, to comply with security protocols.

5.6.6 Respond to, investigate, and recover from incidents concerning identity breaches.

5.6.7 Identify and rectify inconsistent or redundant identity information across varying systems.

5.7 Corporate Platform Support

Provide comprehensive Corporate Platform Support, ensuring the smooth operation of the OCC corporate IT platforms. This includes managing and maintaining a variety of platforms that facilitate communication, collaboration, and efficient work processes.

The Contractor shall:

5.7.1 Manage and maintain corporate messaging platforms, including but not limited to MS Exchange.

5.7.2 Support for corporate collaboration tools, such as but not limited to MS Teams and MS SharePoint Online, Microsoft Project Online, M365, to facilitate efficient teamwork and information sharing.

5.7.3 Implement and manage Enterprise Search solutions to enable easy and quick access to relevant information.

5.7.4 Manage and oversight of Enterprise Document Management systems to ensure secure and organized storage and retrieval of documents.

5.7.5 Manage ServiceNow, Appian platform for efficient IT service management and business process automation.

5.7.6 Manage and support NetSkope platform implementation which includes technical resources that are a part of the OCC NetSkope solution.

5.7.7 Provide investment management and portfolio support to enable easy and quick access to relevant information, processes for decision making.

5.7.8 Monitor and update platforms to ensure optimal performance and security.

5.7.9 Ensure all corporate platforms adhere to Federal IT standards and regulations such as NIST.

5.8 IT Security Platform Support

Supporting key IT Security Platforms, assure a secure environment for the OCC continuing digital transformation. Key modern security technologies such as but not limited to Zero Trust Architectures, Cloud Access Security Brokers (CASB), Secure Access Service Edge (SASE), and Cloud Security Policy Managers (CSPM) are within their purview. Providing management, implementation, and 24X7 monitoring of these platforms, ensure a robust security stance that keeps pace with evolving threats, achieving a balance between accessibility and protection.

5.8.1 Design and implement Zero Trust Architectures.

5.8.2 Configure and manage Cloud Access Security Brokers (CASB) to secure cloud‐ based data.

5.8.3 Deploy and maintain Secure Access Service Edge (SASE) for secure and fast cloud resources access.

5.8.4 Manage Cloud Security Policy Managers (CSPM) to ensure compliance with security policies.

5.8.5 Conduct thorough security audits across all platforms.

5.8.6 Respond swiftly and accurately to security incidents across these platforms.

5.8.7 Monitor and update of security configurations to ensure optimal protection.

5.8.8 Ensure all platforms adhere to Federal IT standards and regulations such as NIST.

5.9 DevSecOps Platform Engineering

DevSecOps Platform Engineering is a key enabler of the amalgamation of development, security, and operations into a unified cycle. This includes support for the creation of Cloud Native applications, enhancing scalability, resilience, and efficiency, and includes support for adoption of robust DevSecOps practices for teams developing applications using Low Code Application Platforms (LCAPs). Establish secure, fluid environment(s) with embedded security and performance monitoring mechanisms, fostering accelerated deployment while maintaining the security and operational efficiency of applications.

5.9.1 Set up and manage DevSecOps platforms that support Cloud Native Application Architectures.

5.9.2 Implement and support DevSecOps best practices on custom, low‐code platforms for fast, efficient, and secure application development.

5.9.3 Ensure built‐in security and performance monitoring in all supported platforms, enabling real‐time insights and proactive issue resolution.

5.9.4 Institute a culture integrating security into all stages of DevOps processes.

5.9.5 Provide automation of validation testing, integration testing, and security validation to ensure quality and security in releases.

5.9.6 Ensure constant communication and synergy between development and operations teams.

5.9.7 Design, build, and support environments for hosting, deploying, testing, and maintaining containerized application architectures.

5.9.8 Provide ongoing support and troubleshooting for DevSecOps tools and platforms.

5.10 Application Development

Provide Application development supporting digital transformation strategy for the OCC. ITS prepares for several initiatives that entail the design and iteration of innovative, versatile, and user‐centric software applications tailored to meet the precise requirements of various government departments. This includes the creation of robust applications based on a variety of application architectures, such as but not limited to, Containers, Microservices, Serverless, Power Platform, SharePoint, Adobe Experience Manager (AEM) workflows, .Net, Java, and Low Code Application Platforms (LCAPs).

These solutions should align with an organizational inclination towards Agile methodologies and rapid development practices. Deliver scalable, secure applications enabled for sophisticated testing capabilities that drive productivity, foster integration, and facilitate effectual decision‐making within the ever‐evolving technology ecosystem.

5.10.1 Design and build a wide range of applications, including web, mobile, and desktop applications, leveraging architectures such as Containers, Microservices, Serverless, Power Platform, SharePoint, Adobe Experience Manager (AEM) workflows, .Net, Java and LCAPs on premise and cloud environment.

5.10.2 Develop with Agile and rapid development methodologies, ensuring quick, iterative development and deployment processes.

5.10.3 Utilize diverse programming languages and development frameworks with a focus on adaptability that caters to evolving application requirements.

5.10.4 Apply advanced testing methodologies, including unit testing, functional testing, and feature toggling, supporting practices such as A/B testing.

5.10.5 Provide expertise Full Stack application development, encompassing seamless integration between frontend and backend components.

5.10.6 Design and implement user‐friendly interfaces that prioritize superior user experience.

5.10.7 Incorporate robust security measures into all developed applications, ensuring data privacy and compliance.

5.10.8 Provide comprehensive testing to ensure application functionality, performance, and resilience against potential system vulnerabilities.

5.10.9 Ensure continuous integration/continuous delivery as part of the development process to streamline updates and releases.

5.10.10 Provide ongoing application maintenance, which includes updates, enhancements, issue resolution, and accommodating emerging technological advancements.

5.10.11 Adopt and embed innovative development tools and methodologies such as but not limited to Artificial Intelligence/Machine Learning into the development lifecycle in accordance with Federal, NIST and OCC governance and security standards.

5.10.12 Provide support for the Service Development Lifecycle (SDLC) program, Enterprise Change Control Board, policy governance, configuration, change and release, problem management, utilizing industry frameworks such as IITL, COBIT, and Federal initiatives, standards, and regulations.

5.10.13 Develop and implement interfaces, orchestrations, automations, and mappings to connect various applications and databases relying on APIs and integration services/platforms.

5.11 Web Content Management

Provide Web Content Management (WCM) delivering engaging, up‐to‐date, and user‐centric digital experiences, for the OCC. Leveraging robust Content Management Systems (CMS), streamlining the process of creating, managing, and publishing online content. Provide OCC with crafting and curating content that accurately represents and speaks to the government's voice, fostering an informative, seamless process.

5.11.1 Manage and maintain CMS platforms, including but not limited to Drupal, Adobe Experience Manager, and Joomla, facilitating the creation, modification, and management of web content.

5.11.2 Provide content development, produce engaging, accessible, and SEO‐optimized content that caters to diverse public needs.

5.11.3 Provide regular content updates to ensure the digital platforms remain current, effective, and user centric.

5.11.4 Develop strategies to manage the specific workflows of web content, from creation to approval to publishing.

5.11.5 Implement accessibility standards in content development to ensure inclusivity.

5.11.6 Maintain consistent brand voice across multiple platforms and types of content.

5.11.7 Audit and report content performance making use of analytics tools, refining content strategies based on insights.

5.12 Database Administration

Provide Database Administration services safeguarding the massive data repositories that are integral to the operations of the OCC which includes services in both premise and hyperscale Cloud environments. Assure data accessibility, integrity, and security, guaranteeing optimal database performance while safeguarding data from potential threats. The contractor shall maintain, tune, and ensure smooth database operations.

5.12.1 Manage a variety of database systems, such as but not limited to, MS SQL, Oracle, PostgreSQL, premise and in hyperscale Cloud environments, inclusive of troubleshooting and problem resolution for all aspects of database administration.

5.12.2 Provide database optimization, including performance tuning and capacity planning for evolving data demands, as well as large‐scale data movement, and data Extract, Transformation and Loading (ETL) operations.

5.12.3 Implement robust data protection measures, including comprehensive backup and recovery strategies.

5.12.4 Provide database auditing to maintain data integrity and security, while ensuring compliance with relevant regulations.

5.12.5 Manage database migrations and transition projects, particularly toward hyperscale Cloud platforms.

5.12.6 Provide database query development and optimization for efficient data handling and analysis.

5.12.7 Adopt best practices in data governance, ensuring consistent database structures, standards, and definitions.

5.13 Data Management/Reporting

Provide Data Management/Reporting that will enable the OCC to utilize the potential of its data resources. Provide comprehensive data handling, which includes oversight of data availability, relevancy, consistency, and security across premise and hyperscale Cloud environments.

Provide data lifecycle tasks from data creation, storage, and maintenance to data archiving and deletion, enabling timely and insightful decision‐making while ensuring data privacy and regulatory compliance.

The Contractor shall:

5.13.1 Assist in the establishment and governance of data standards and policies to ensure data consistency and integrity.

5.13.2 Implement, integrate, and support premise and cloud data warehouse platforms including but not limited to Snowflake and Databricks.

5.13.3 Implement, integrate, and support data reporting, analysis, and blending products for data consumers, including data stewards, analysts, system owners, business unit staff, and external agencies.

5.13.4 Develop and maintain reporting solutions to provide stakeholders with timely and accurate information. This includes creating dashboards, reports, and visualizations using tools such as Power BI and Tableau to present data in a clear and actionable manner.

5.13.5 Implement, integrate, prepare data for, and support AI/ML tools and platforms for agency needs, including Generative AI and advanced analytics and sentiment analysis.

5.13.6 Provide data migration support, often focused on transitioning to hyperscale Cloud platforms.

5.13.7 Manage and analyze structured and unstructured data and ensure data quality through validation methods and cleanup procedures.

5.13.8 Develop robust data backup and recovery strategies to safeguard crucial data elements and implement strong security measures to protect data from unauthorized access and breaches.

5.13.9 Provide development and management support for Extract‐Transform‐Load (ETL) processes for on premise and cloud environment.

5.13.10 Audit and report of data usage, performance, and regulatory compliance.

5.14 Business Analysis

Provide Business Analysis and technical writing support that aligns OCC IT investments with its strategic goals.

5.14.1 Capture, refine and support development of business requirements through interviews, workshops, and other direct interaction with stakeholders.

5.14.2 Ensure that IT solutions are tightly coupled with business needs by applying industry best practices such as the Business Analysis Body of Knowledge (BABOK), and facilitate sound decision‐making, process optimization, and evaluation of system requirements.

5.14.3 Translate requirements into actionable IT objectives.

5.14.4 Utilize tools, techniques, and principles from the Business Analysis Body of Knowledge (BABOK).

5.14.5 Utilize visual models, diagrams, and charts for a clear understanding of requirements.

5.14.6 Collaborate with business stakeholders fostering effective communication and consolidating consensus.

5.14.7 Re‐engineer business processes to optimize operational efficiency and productivity.

5.14.8 Revise and validate requirements throughout the development life cycle to ensure alignment with business needs.

5.15 IT Quality Assurance (QA)

Provide IT Quality Assurance, in the context of Software Development, delivering high value products and establishing continuous improvement for the OCC. The Contractor shall aid in creating, or establish and maintain a rigorous Quality Assurance environment, implementing stringent processes to detect and resolve application defects before they reach the user.

Utilizing enabling technologies for requirements development and acceptance testing, the Contractor shall ensure software deliverables meet the highest standards of reliability, functionality, and performance.

5.15.1 Establish and maintain environments where Quality Assurance processes are integral to every Software Development phase.

5.15.2 Utilize enabling technologies such as Azure Devops for requirements development, ensuring clarity and completeness.

5.15.3 Implement automated and manual testing strategies using methods/tools such as Selenium, Katalon Studio, Appium, JMeter, etc; to check software functionality, performance, and usability.

5.15.4 Utilize acceptance testing tools, affirming the software meets the developed requirements.

5.15.5 Establish defect tracking and management processes.

5.15.6 Conduct regression testing during software updates and releases.

5.15.7 Provide test management support which includes document processes related to Test Strategy, Test Plan, Test Management Plan, SOPs, test cases, Test Report.

5.15.8 Provide continuous improvement of QA strategies through feedback integration and evolving industry best practices.

5.16 IT Program Management

Provide IT Program Management that harmonizes multiple IT projects aiming for a collective objective in line with the OCC strategic goals.

5.16.1 Orchestrate complex task, ensuring that the interrelated projects progress in tandem and derive synergistic value to the OCC. The contractor shall balance detailed oversight with a broader vision, managing resources, collaborating, and communicating with multiple stakeholders

5.16.2 Identify, initiate, and coordinate interrelated IT projects to extract synergistic outcomes.

5.16.3 Manage shared resources across projects, optimizing efficiency, and minimizing overlap.

5.16.4 Track, measure, and report the progress of the program in terms of stated objectives.

5.16.5 Provide risk management to identify and mitigate program‐level risks.

5.16.6 Provide stakeholder management, keeping all parties informed and engaged.

5.16.7 Identify and manage inter‐project dependencies to prevent potential bottlenecks.

5.16.8 Document lessons learned and incorporating feedback for continuous program improvement.

5.17 IT Project Management

Provide IT Project Management for successful execution of IT initiatives within the OCC, including specialized project and program management for certain IT areas. Manage the entire lifecycle of IT projects, from initiation and planning through execution, monitoring, and closure.

The contractor adheres to schedule, quality delivery, risk mitigation, and communication, ensuring that each project aligns with specified objectives and contributes to the wider vision of OCC digital transformation.

5.17.1 Initiate, plan, execute, control, and close IT projects.

5.17.2 Track and manage project scope, schedule, resources, risk, and quality.

5.17.3 Support cross‐functional teams towards successful project completion.

5.17.4 Provide risk identification and mitigate project obstacles.

5.17.5 Leverage project management tools and methodologies effectively.

5.17.6 Provide stakeholder communications and periodic updates.

5.17.7 Implement seamless project transitions and handovers.

5.18 End User Support

Provide End User Support capabilities including technical assistance to ensure optimal functionality of user systems and software at the OCC. This includes both remote ServiceDesk capabilities and in‐person

VIP support, device lifecycle management, and software deployment services to maintain seamless operation for the OCC.

5.18.1 Operate remote call‐center style ServiceDesk/Helpdesk to handle inquiries and resolve issues efficiently.

5.18.2 Provision of in‐person VIP end‐user support, ensuring expedited and personalized assistance for OCC high‐priority resource.

5.18.3 Management of end‐user device procurement, deployment, maintenance, and retirement in accordance with life‐cycle best practices.

5.18.4 Development and implementation of end‐user software packaging and deployment strategies to streamline system updates and installations.

5.18.5 Implementation of a ticketing system for tracking, prioritization, and resolution of end‐ user requests and incidents.

5.18.6 Regularly scheduled training for end‐users on new technologies and updates to enhance productivity and minimize support requests.

5.18.7 Continual service improvement processes to analyze support trends and develop proactive measures for reducing support incidents.

5.18.8 Provide Tier‐2 and Tier‐3 Help Desk support.

5.19 IT Training Services

Provide IT Training Support capabilities including the preparation and execution of training services tailoring to enhance the workforce's competencies and performance associated with IT solutions. Training services may include coaching approaches, execution of User Acceptance

Training (UAT) and facilitation of meetings.

5.19.1 Develop customized training modules based on the organization's specific needs and industry standards.

5.19.2 Implementation of adult learning principles and methodologies to optimize learner engagement and retention.

5.19.3 Provision of skilled trainers with expertise in delivering IT‐focused training programs.

5.19.4 Utilization of modern training technologies and platforms for both in‐person and remote learning environments.

5.19.5 Capability to assess training effectiveness and incorporate feedback for continuous improvement.

5.19.6 Manage training logistics including scheduling, materials preparation, and participant tracking.

5.19.7 Provide post‐training support and resources to reinforce learning outcomes.

5.19.8 Create user friendly, accessible user guides and job aids in various mediums such as video, print, digital and other media.

5.19.9 Create knowledge base articles (KBA) using Knowledge Management Framework

5.20 Strategic Communications:

Deliver Strategic Communications Support to advance the organization or project’s mission and vision, ensuring cohesive messaging and proactive engagement with the intended audience at the agency. The Contractor's expertise will be pivotal in elevating the office, IT project, or priority initiative’s profile thought a successful strategic communications plan and execution of the plan. Aarticulate in plain language various complex IT related topics and inform decision‐ making as part of the broader strategic objectives.

5.20.1 Formulate and conceptualize comprehensive communication strategies and plans.

5.20.2 Provide expert counsel on project messaging and media to the intended audiences and agency leadership.

5.20.3 Tailor innovative and informative content for different platforms, adapting to diverse audience needs.

5.20.4 Engage in active dialogue and community management on intranet, email communications and other means to inform audiences.

5.20.5 Measure and report on the impact of communication efforts with quantifiable metrics.

5.20.6 Organize and facilitate training and stakeholder meetings.

5.20.7 Train and guide agency staff on best practices in strategic communications and public engagement.

5.20.8 Draft presentations and talking points for leadership.

5.20.9 Ensure adherence to federal government standards for accessibility.

5.20.10 Provide plain language communications on complex IT topics.

5.20.11 Assist in drafting reports on specific projects and initiatives in varying cadence and audiences, for example, weekly project status reports, monthly reports, annual reports, strategy documents and other requested reports.

5.20.12 Develop and execute Change Management Plans for each enterprise‐wide IT initiative, while leveraging Prosci ADKAR Model for organizational change management.

5.21 IT Product Management

Provide IT Product Management services encompassing the lifecycle of IT products, from ideation to retirement in support of the OCC. Focusing on customer‐centric strategies, market trends, and business objectives, drive the evolution of the products, ensuring their continuous alignment with user needs and the overarching goals of digital transformation.

5.21.1 Define, launch, and manage IT products based on user needs and strategic objectives.

5.21.2 Incorporate assessment, market analysis, and customer feedback in product strategies.

5.21.3 Manage the complete product lifecycle from inception to retirement.

5.21.4 Manage stakeholder expectations and feedback loops to enhance product value.

5.21.5 Balance resources, time, and scope to deliver quality products within schedule.

5.21.6 Set, track, and ensure key performance indicators (KPIs) are met.

5.21.7 Deliver incremental value via Agile or similar methodologies.

5.22 Enterprise Planning Support (ERP) Support

Provide support for Enterprise Resource Planning (ERP) systems, a critical component of the OCC’s operations. Manage, ERP systems that includes business processes across finance, procurement, human resources, and workplace services. Support ERP framework ensuring seamless operations, prompting quick data‐informed decisions.

5.22.1 Mange /support ERP systems such as but not limited to, Oracle, SAP, and Microsoft Dynamics.

5.22.2 Deploy, integrate, and customize ERP modules to meet unique business needs.

5.22.3 Troubleshoot system‐related issues to minimize operational disruptions.

5.22.4 Provide regular system updates and patches to maintain optimal ERP performance and security.

5.22.5 Train users on new ERP features and functionalities.

5.22.6 Provide data migration, backup, and disaster recovery procedures for ERP systems.

5.22.7 Create and maintain comprehensive documentation of ERP configurations, operations, and maintenance procedures.

5.23 IT Security

Provide IT Security services for OCC securing essential data and systems from potential threats and breaches.

The Contractor shall:

5.23.1 Maintain a robust IT security posture, implement comprehensive measures to safeguard network integrity, protect data privacy, manage risks, and ensure compliance with all regulatory standards to ensure OCC maintains a strong Cyber Security posture. The Contractor shall support OCC’s operations of a secure and resilient IT environment.

5.23.2 Identify vulnerabilities, assess risks, and implement mitigation strategies.

5.23.3 Assist, advise, draft and enforce comprehensive IT security policies and procedures.

5.23.4 Provide execution of administrative controls associated with governance and compliance activities.

5.23.5 Provide independent security and privacy control assessments for Security Assessment & Authorization (SA&A) following standards such as NIST and OMB.

5.23.6 Implement secure networks, systems, applications, and data protection measures.

5.23.7 Provide support for continuous monitoring, periodic security audits, penetration testing, cyber assessment, and compliance, POAM lifecycle and achieving regulatory compliance.

5.23.8 Provide incident response planning and management to ensure minimal impact during security breaches.

5.23.9 Employ current cybersecurity tools and tactics, and awareness of emerging threats.

5.23.10 Support the design, development, testing, implementation, operations, and maintenance of cybersecurity solutions such as DLP.

5.24 Enterprise Architecture (EA)

Provide Enterprise Architecture (EA) services in support of OCC’s operations, mature the EA program and develop special projects by documenting existing IT architectures, identifying variations in architectures from mandated or desired standards, creating patterns and templates for architectures, auditing existing architectures, and helping the OCC manage its IT assets by identifying and eliminating functional redundancies.

The contractor's work shall include but not be limited to:

5.24.1 Provide EA Support Services that ensure maintenance of EA operations and mature the overall EA program.

5.24.2 Maintain compliance with all applicable federal laws and regulations during performance such as the Clinger‐Cohen Act of 1996, the Federal Information Security

Act of 2002, and the E‐Government Act of 2002.

5.24.3 Develop design patterns that will be used as templates by various IT groups at the OCC.

5.24.4 Research latest technologies, provide summaries of the research and best practices for implementing such technologies.

5.24.5 Conduct technology reviews of various IT products and provide summaries of the findings.

5.24.6 Develop technical designs in specific IT areas (e.g., Infrastructure, Cloud, Security, Data).

6.0 TRANSITION PLANNING AND EXECUTION

At the end of the period of performance of an individual order, the Contractor shall develop and execute a transition‐out plan to transfer knowledge from its staff to the new contractor team. The transition plan shall include, at a minimum, a description of how the Contractor proposes to perform the knowledge transfer, knowledge transfer requirements, identification of OCC resources required to support the transition, milestones for the transition, and risks for the transition.

These transition‐out activities are for the incumbent contractor to plan for and perform the transfer to an incoming contractor. It would not involve the contractor’s transition‐in planning and activities related to a knowledge transfer from the contractor preceding it.

The Contractor shall support the transition of its work to the new contractor. Support shall include the following:

1. Executing the transition plan

2. Training and mentoring new contractor personnel

3. Providing documentation, including incomplete documentation

4. Providing source code and other artifacts

5. Providing system access

6. Providing descriptions of the roles and responsibilities of the members of the Contract’s existing teams.

The Contractor shall execute the transition plan and all activities necessary for the effective transition of incumbent activities to the new contracting team.

7.0 DELIVERABLES

Deliverables will be specifically defined in each individual task order. The Contractor must provide electronic copies of files, reports and deliverables and they must be submitted in or be compatible with current OCC client software suite or other formats agreed to by the OCC. Each individual Order PWS/SOW will describe details of the applicable deliverables.

The minimum deliverable acceptance criteria, subject to more specificity or higher standards as set forth in each individual Order, are described below:

1. Timeliness: Deliverables are made available to the OCC prior to or on their due date.

2. Accuracy: Deliverables are accurate in technical content and adhere to accepted criteria by mutual agreement of parties.

3. Clarity: Deliverables are clear and concise; engineering or software development terms are used as appropriate; diagrams are easy to understand and relevant to the supporting task.

4. Validity: All deliverables satisfy the Government's requirements, including performance metrics, where applicable and the intended needs and expectations of stakeholders.

5. Deliverable Document Format Requirements:

The Offeror/Contractor shall adhere with the OCC Best Practice Guide for Crafting

508‐Compliant Word/PDF Documents (see Exhibit 1) to produce all electronic documents or reports for use by OCC users.

All EA deliverables must be fully editable via Microsoft PowerPoint, MS Excel, MS

Visio, and/or Microsoft Word as applicable and stored on OCC Infrastructure. Note that final deliverables are understood to be in a finished state and accepted by the

OCC, but some of these deliverables may be subject to periodic review, update, and refresh by the contractor.

The Offeror/Contractor shall also test, and remediate as needed, all web pages, application user interfaces, as well as electronic documents, charts, tables, spreadsheets, presentation slides, diagrams, graphics, and/or videos that will be generated for use by OCC users to be accessible to OCC’s assistive technology tools for users with visual, hearing, or motor manipulation accommodation needs. The

OCC currently provides JAWS Versions 2025/2024/2023, ZoomText Versions

2025/2024/2023, and Dragon Professional Version 16 as approved assistive technology tools.

8.0 OTHER DIRECT COSTS

ODCs including travel anticipated in performance of this work will be included at the Order level. Travel reimbursement shall be made in accordance with the Federal Travel Regulation (FTR) and must be approved by the COR prior to commencing. Local travel, including to and from OCC headquarters and in the surrounding Washington, D.C., metropolitan area undertaken during performance is considered the cost of doing business and will not be reimbursed.

9.0 PLACE OF PERFORMANCE

The place of performance will be determined by individual order and could be both at the Contractor’s facilities and/or OCC facilities. OCC facilities are in various locations throughout the United States. However, OCC headquarters is located at 400 7th St. SW, Washington, DC 20219.

Local travel and parking costs at the OCC Headquarters is not separately reimbursable to the…