RFI_NOP-OIDsupport_final.pdf

SOURCES SOUGHT NOTICE

The United States Department of Agriculture (USDA), Agricultural Marketing Service (AMS), National Organic Program (NOP) is issuing this sources sought notice to conduct market research to identify parties having an interest in and the resources to support this requirement for information technology (IT) application development, system implementation, and operations and maintenance (O&M) support services. The result of this market research will contribute to determining the method of procurement. The applicable North American Industry Classification System (NAICS) code assigned to this procurement is 541511 with a size standard of $34 million.

THERE IS NO SOLICITATION AT THIS TIME. This request for capability information does not constitute a request for proposals; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred.

If your organization has the potential capacity to perform these contract services, please provide the following information:

Request for Information Instructions:

Interested sources may notify USDA of their interest in performing this type of work. Responses must include:

1. Name of Company and Contact Information to include telephone and e-mail;

2. Business Size and type of ownership (e.g., Large Business, Small Business, HubZone

Small Business, Service-Disabled Veteran Owned Small Business (SDVOSB), 8(a), Women-Owned, Small Disadvantaged);

3. Tailored capability statements addressing the particulars of this effort, with appropriate documentation supporting claims of organizational and staff capability. If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

4. Unique Entity Identifier (UEI) issued by the System for Award Management (SAM);

5. Responses to the requested information questions in appendix objective section.

6. Three past performance references relevant to the company's ability to perform this type of work and/or literature that supports the company’s capability to perform this work.

The government will evaluate market information to ascertain potential market capacity to 1) provide services consistent in scope and scale with those described in this notice and otherwise anticipated; 2) secure and apply the full range of corporate financial, human capital, and technical resources required to successfully perform similar requirements; 3) implement a successful project management plan that includes: compliance with tight program schedules;

cost containment; meeting and tracking performance; hiring and retention of key personnel and risk mitigation; and 4) provide services under a performance based service acquisition contract.

BASED ON THE RESPONSES TO THIS SOURCES SOUGHT NOTICE/MARKET

RESEARCH, THE GOVERNMENT WILL DETERMINE THE TYPE OF SMALL BUSINESS

SET-ASIDE. Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

Submission Instructions: Interested parties who consider themselves qualified to perform the above-listed services are invited to submit a response to this Sources Sought Notice by 10:00 AM CT on April 12, 2024. All responses under this Sources Sought Notice must be emailed to Larry.D.Nelson@usda.gov.

If you have any questions concerning this opportunity, please contact:

Larry.D.Nelson@usda.gov.

APPENDIX: Purpose and Objectives

BACKGROUND

The mission of the USDA National Organic Program (NOP) is to protect the integrity of the United States Department of Agriculture (USDA) organic seal, both domestically and abroad, and ensure that both producers and consumers trust the organic label. The NOP does this through marketing and regulatory activities related to organic agriculture, including administering the USDA organic regulations; accrediting and overseeing USDA-accredited certifying agents (called “certifiers”) and State Organic Programs; and administering an organic compliance and enforcement program. NOP has developed and maintains multiple data systems that support the varied business needs of the program mission.

The Organic Integrity Database (OID), built in 2015, is NOP’s flagship data system and the official database of U.S. certified organic operations. Accredited certifiers are responsible for entering data on certified organic operations and products and issuing NOP organic import certificates for their clients. USDA staff, USDA Trade Partner Government staff, and Certifiers can access the system via secured login. OID offers public Application Programming Interfaces (APIs) for public data exchange, and secure APIs for certifier data submission. Since 2015, NOP has continued to invest in Information Technology (IT) projects, including data warehouses and Commercial off the Shelf (COTS) applications, that build on the OID platform to support regulatory compliance and enforcement activities. These systems support NOP’s ability to improve fraud detection and oversight to ensure the USDA organic seal remains verified and trusted.

NOP’s OID is comprised of multiple application modules, a data warehouse integrated with multiple data analytics tools, and integration with additional business support systems including an online learning center, case management system, and customer experience software. Due to the growth of the system user base and data needs, increased federal cybersecurity requirements (i.e., zero-trust architecture, least privilege access, two factor authentication, etc.) and a complex cloud-based infrastructure management structure, NOP needs a holistic approach to effectively manage and support its portfolio of IT systems.

This sources sought seeks information on the capabilities of companies to provide support for NOP’s system enhancement development, applications maintenance, systems integration, data analytics, and system user support services, and lifecycle operations (Operations & Maintenance (O&M)) within the USDA and its enterprise mission offices.

OBJECTIVE

The primary objective of issuing this Sources Sought is to identify potential vendors capable of providing IT system development and enhancements, applications integration, maintenance and system implementation, and end user support services. Strategic goals in support of this objective are:

• Develop and maintain easy-to-use an easy-to-use system, with multiple applications, providing NOP staff and stakeholders with effective access to organic data.

• Improve integration and data exchange with various NOP systems, enabling applications to respond to changing business needs on a sustainable system platform, that is compliant with cybersecurity requirements; and

• Deliver IT portfolio steady-state operations (O&M), within three years by leveraging current and new technology, software, and platforms to ultimately reducing overall total lifecycle operation costs.

It is anticipated that vendors interested in supporting NOP’s IT portfolio, can demonstrate an ability to provide:

1. Systems analysis including:

• Code review and assessment to identify existing bugs, coding issues, and improve code quality.

• Architecture analysis, future diagramming, and system performance improvement recommendations.

2. Business and project analysis including:

• Business process review and analysis.

• Requirements gathering, definition, and mapping to business and mission requirements.

• Define and manage a product innovation roadmap.

• Assess the user experience and design an appropriate user interface experience.

3. Develop systems utilizing Agile processes such as Scrum (e.g., ability to respond to changing requirements in a fast-paced environment with frequent business owner interactions) with a demonstrated track record of completing tasks on schedule and at or close to initial estimates for anticipated level of effort, including:

• Facilitate and maintain product backlog.

• Develop appropriate user stories to ensure a positive end user experience.

• Maintain and report team performance metrics, ensuring adherence to Service

Level Agreements (SLAs).

4. Demonstrate experience with application development enhancements, release deployments, and post implementation maintenance and support, including:

• Follow USDA Secure Software Development Lifecycle (SSDLC) processes within an agile environment, including system documentation and change and archival document management.

• Ensure quality assurance in all stages of design, development, and deployment.

• Provide effective user training and support.

• Deliver timely, cost-effective application maintenance support, defect resolution, and DevSecOps techniques that embrace Continuous Integration (CI) / Continuous Deployment (CD).

• Support rapid, cost-effective architecture upgrades and modifications while minimizing system lifecycle costs for steady state operations.

5. Provide data analytics, design, Extract, Transform, and Load (ETL) and data management, including:

• Analysis of database design and data models for existing solutions and products.

• Create, implement, and manage ETL processes to continuously transfer data from existing sources to the production environment.

• Data analytics and data visualization (e.g., dashboards, charts, tables) support for reports, to provide information on system performance including organic commodity data.

• Adhere to federal cybersecurity requirements, including:

o SSO (Single Sign On) mechanisms such as Security Assertion Markup Language (SAML), Multi-factor Authentication (MFA), and USDA eAuthentication

(OIDC).

o National Institute of Science and Technology (NIST) Security Controls/Compliance, Authority to Operate (ATO) / Authorization to Use (ATU), and Federal Information Security Modernization Act (FISMA) regulations.

o Microsoft Azure Cloud and Kubernetes Container security best practices.

o Experience with security scripting in Python and/or PowerShell.

o Performing security audits, risk analysis, and threat modeling.

o Application and API Security (SSDLC, OWASP Top 10, Free Open-Source

Software (FOSS) security, and secure coding methodologies) o Experience with web application incident response use cases.

o Management and policies for handling Controlled Unclassified Information (CUI) and privacy information including Personally Identifiable Information (PII).

o Federal authorization and accreditation processes.

o Experience with federal encryption policies and best practices.

o Experience with federal and commercial database security best practices.

TECHNICAL ENVIRONMENT

NOP believes the following knowledge and skillsets are required to support the OID platform within the USDA and AMS MS Azure technical environment:

• SQL databases and data warehouse management o Microsoft SQL server o Python o SQL/T-SQL

• Secure Coding and Code development tools and libraries o .NET MVC Microservice Architecture o Telerik o jQuery o Blazor (.NET/C#) o JavaScript o Python o SQL/T-SQL o PowerShell o Open Worldwide Application Security Project (OWASP) Top 10 vulnerabilities

Secure coding mechanisms o OCI Container hosting environments: Docker, Kubernetes, Azure App Service o Azure cloud and Cloud infrastructure o Infrastructure as Code o Azure DevOps Pipelines

• System monitoring tools (e.g., Dynatrace, Akamai)

• Automated test tools (e.g., Test Rigor)

• Data analytics tools including Tibco Spotfire, Tableau, Crystal Reports

• Microservices and API tools (.NET framework and MuleSoft)

• Code Repositories including TFS, Git

OUTCOME

NOP anticipates that respondents will be able to demonstrate an ability to deliver the above stated objectives. Specifically, NOP would like you to explain how:

1. What is your experience in meeting the objectives identified above?

2. How would you approach this project detailing the following activities:

• Staffing, including quantity and role of personnel. What is your ability to provide staff or resources for surge projects due to new technology requirements or additional system scope (e.g., to resolve any highly technical new technology requirements or development of new system modules, or O&M vulnerability resolutions)?

• Ramping up of team knowledge including systems (i.e., business processes and platform architecture).

• Delivery of system enhancements including development and maintenance support for two years.

• Transitioning to and support of steady state system operations and maintenance (O&M).

3. What is your approach for ensuring our system meets all federal cybersecurity policies and requirements?

4. What best practices does your organization follow during software development, application development, and system platform operations and maintenance to ensure long term but cost-effective system viability?