Attachment_1_-_Statement_of_Work.pdf

Overseas Private Investment Corporation

Risk Scorecard Software Implementation

Statement of Work

March 2018

Overseas Private Investment Corporation 1100 New York Avenue NW, Washington, DC 20005

Risk Scorecard SOW Page 2 of 29

Contents 1 Overview

2 Background

3 Scope

4 Project Approach

a. Task 1: Project Management

i. Project Kick-off

ii. Ongoing Reporting and Meetings

iii. Coordination with Stakeholders and Governance Bodies

b. Task 2: Planning and Design

i. Project Plan and Schedule

ii. Requirements Development & Sign-off

iii. Architecture and System Interface Assessment, Design Plan and Sign-off

iv. Environment Set-up (Tools, Licenses, Accesses, etc.) Plan

v. User Interface Design and Plan

vi. Data Migration Assessment and Plan

vii. Training Plan

viii. Security Readiness Review and Development Readiness Plan

c. Task 3: Single Scorecard Development

i. Environment Set-up and Development Preparation

ii. Iterative Functional Development and Reviews

iii. Data Mapping, Cleansing and Migration

iv. System Interfaces and Integration(s)

v. Report Development

vi. Testing

vii. Sign-off

d. Task 4: Remaining Nine Scorecards Development

i. Iterative Functional Development and Reviews

ii. System Interfaces and Integration(s)

iii. Report Development

iv. Testing

v. Sign-off

Risk Scorecard SOW Page 3 of 29

e. Task 5: Full Scorecard Solution Deployment

i. Training

ii. Production Readiness Reviews

iii. Data Mapping, Cleansing and Migration

iv. Deployment to Production and Sign-off

v. Bug-fixes

vi. Operations and Maintenance Transition

f. Task 6: Ongoing Consultancy Support (if needed)

5 Support Construct

a. Constraints

b. Assumptions

6 Support Hours of Operations

7 Deliveries and Performance

a. Place of Performance

b. Period of Performance

c. Technical Direction

d. Key Personnel and Staff

e. List of Deliverables

f. Monthly Program Report

8 Quality Assurance Plan

9 Acceptance

10 Government Furnished Property

11 Contractor Furnished Property

12 Identification of Contractor Employees

13 Non-Personal Service Statement

14 Organizational Conflict of Interest

15 Non-Disclosure Agreement

16 Section 508 Compliance

17 Acronyms

18 Attachment

19 Appendix

a. OPIC’s System Development Life Cycle (SDLC)

Risk Scorecard SOW Page 4 of 29

b. OPIC’s Scorecard Workflow (High-Level)

c. Sample Finance Risk Report

d. Initial Requirements

Risk Scorecard SOW Page 5 of 29

Risk Scorecard Software Implementation

1 Overview As the U.S. Government’s development finance institution, OPIC mobilizes U.S. private capital to help solve critical development challenges and in doing so, advances U.S. foreign policy. Because OPIC works with the U.S. private sector, it helps U.S. businesses gain footholds in emerging markets, catalyzing revenues, jobs and growth opportunities both at home and abroad. OPIC achieves its mission by providing investors with financing, guarantees, political risk insurance, and support for private equity investment funds.

2 Background The Risk Management Group (“Risk”) is responsible for establishing portfolio risk measurement methodologies and Finance credit risk scoring models with associated probabilities of default (PD) and loss given default (LGD). Accordingly, Risk has developed and managed ten complex MS Excel-based PD scoring models and one LGD framework (“Scorecards”). Since this methodology has been tested, Risk is now positioned to actualize those models in an automated and technology-based interface for ongoing and future management. The following sections outline the scope, constraints, assumptions, and project approach for this desired implementation.

3 Scope OPIC’s priorities are to foster productivity and efficiency through this initiative by implementing a state of the art technical framework that meets existing and future corporate business processing needs.

It is also important to recognize that existing governance structures, to include executive decision making bodies such as Risk, the IT Governance bodies, the Data Working Group and other associated working groups, shall be utilized to serve and guide this initiative and its objectives. (Note: these details and any associated artifacts are susceptible to further refinement prior to and as part of the contract kick-off.)

Based on the aforementioned priorities and the existing governance structures which support initiatives such as this one, the vision and key objectives of this contract are listed below.

Vision: Develop a Risk Scorecard Software Platform that will allow for workflow capabilities, version control, data storage, analytics, improved data integrity through system integration, and reporting via web-based software.

Key Objectives:

• Replace the ten existing MS Excel and MS Access-based solutions with a cost effective and operationally robust web-based solution.

• Provide functionality to manage Scorecard business processes and data, and the related integration with other OPIC technology solutions.

• Ensure historical data currently captured in MS Access is effectively migrated/leveraged for ongoing, historical, and trending scorecard-based reports.

• Institute an automated and technologically robust reporting solution with self-servicing capabilities.

The following outlines in-scope activities.

Risk Scorecard SOW Page 6 of 29

• Develop and validate functional and data requirements, system integration points, and business processes for an effective scorecard software solution;

• Analyze, recommend, and implement Risk business process improvements, where possible;

• Develop and implement a software solution that automates current scorecard management;

• Establish core workflow capabilities to efficiently manage Risk business processes;

• Develop operational and analytical reporting capabilities;

• Retire Scorecards currently in use;

• Facilitate data clean up and perform complete data migration from MS Access to the new software solution;

• Enable integration with OPIC applications to include Oracle E-Business Suite (EBS), Oracle-LNS

(custom Oracle Loans application), reporting warehouse, Salesforce, MS .Net solutions, OPIC’s financial statement spreading application, and other existing reporting capabilities; and,

• Partner and collaborate with onsite IT teams for system integrations.

4 Project Approach This initiative is structured into six distinct tasks:

1) Project Management

2) Planning and Design

3) Single Scorecard Development

4) Remaining Nine Scorecards Development

5) Scorecard Solution Deployment

6) Ongoing Consultancy Support as needed.

Each task is critical to the successful implementation of a holistic scorecard software application. The subsequent sections further detail the associated project approach activities to be performed per task.

Adherence to OPIC Software Development Life Cycle (SDLC) (as referenced in Appendix “a”) is required across all tasks.

a. Task 1: Project Management

The Risk Scorecard Solution will have critical touch points across the enterprise and supporting systems.

Therefore, the Contractor Project Manager (PM) shall work to enforce best practices and take action regarding dependencies, business process capabilities, and data governance throughout the life of the project. The PM shall work with the OPIC Risk Team, the Office of the Chief Information Officer (OCIO) senior management, OCIO Program Management and Oversight office (PMO), and all other information technology (IT) project managers to ensure implementation decisions are effectively accounted for across the enterprise.

i. Project Kick-off

The Contractor project manager shall schedule and coordinate a project kick-off meeting. The Contractor shall develop an agenda for the meeting and ensure that all identified participants are notified of the meeting in advance; to include, at a minimum, key contractor personnel, the OPIC Contracting Officer, Risk, and other key OPIC personnel; and present an updated stakeholder list, the principal Points of Contact (POC), timelines to include an updated project plan, general governance procedures, and any additional information the Contractor and/or OPIC deems relevant.

Risk Scorecard SOW Page 7 of 29

ii. Ongoing Reporting and Meetings

The Contractor shall support this initiative by leading personnel, facilitating meetings, providing reports, and driving cost, schedule and resources, to include, but not limited to, the following responsibilities:

a. Establish and manage an Integrated Project Team (IPT), composed of business and IT stakeholders, which will serve as the critical body in the definition and testing of the solution;

b. Conduct weekly integrated project team (IPT) meetings to present a written status report detailing the week’s accomplishments, upcoming activities, risks/issues, items for decision, and performance information against scheduled delivery milestones;

c. Participate in the OCIO Program Management and Oversight (PMO) bi-weekly Project Status Review (PSR) where each project lead reports out on the status, risks, dependencies, and schedule of their project;

d. Conduct SDLC control gate meetings to obtain OPIC sign-off on the SDLC phase documents and approval to move to the next SDLC phase;

iii. Coordination with Stakeholders and Governance Bodies

The Contractor shall be responsible for identifying key stakeholders, stakeholder groups (internal and cross-departmental) and shall be responsible for coordinating activities and ensuring these stakeholders are in full understanding of the initiative, solution expectations, and associated project implementation status.

Risk and OCIO senior management, and the IT and Data Governance bodies shall be leveraged for defining and driving decisions with regard to existing OPIC systems and associated business processes. Related presentation, meeting agenda and meeting minute materials shall be developed and provided per each governance body meeting as part of ongoing project management.

b. Task 2: Planning and Design

The Risk Scorecards’ associated business processes require automation and software support to meet the gaps and issues as identified by Risk senior management. The new Risk solution shall provide process improvements through integration, workflow, and enhancements to better serve the evolving needs of OPICs business.

It is critical this Scorecard software solution be properly planned and designed to ensure a scalable, flexible solution that facilitates technology, process, and data management best practices. Accordingly, this section details Task 2 deliverables, which will prepare OPIC for an effective implementation that meets the organization’s needs.

i. Project Plan and Schedule

The Contractor shall prepare and deliver a project plan and schedule that details all activities, milestones, deliverables, and resources for all six tasks. The plan will be organically updated and refined throughout the life of the project lifecycle.

ii. Requirements Development & Sign-off

As outlined in the OPIC SDLC, the Contractor is responsible for capturing and documenting all the requirements for this solution, such as detailed functional and technical requirements. Initial requirements have been defined and are provided in Appendix a. The requirements documents will

Risk Scorecard SOW Page 8 of 29 be critical in the development, testing and maintenance phases. Stakeholders within the approved governance structures shall define, review, approve and officially sign-off on all requirements, to include:

• Functional,

• System interface,

• User interface,

• Workflow,

• Data requirements, and

• Report specifications.

These requirements shall include defining where the integration of data from multiple source systems is required for core reports. Requirements gathering should be performed as a precursor to the system integration deliverable as it will be critical to identify data sources necessary for required reporting. Once requirements are finalized, the project team shall work with users to prioritize the desired reports, define report design details and sign-off on those report requirements, prioritization and design. Other activities may include the development and/or documentation of field definitions, data dictionary, business rules, and improved processes, where appropriate.

iii. Architecture and System Interface Assessment, Design Plan and Sign-off

The Contractor shall perform a full system interface impact assessment. The impact assessment shall address all architectural, system, data, user and reporting interfaces. It is critical this assessment is thorough and occurs prior to the initiation of development as the identified impacts may dictate design decisions. A mitigation plan must be developed for each impact identified in the assessment. Where deemed necessary and approved by OPIC, the Contractor shall implement each mitigation plan.

The Contractor shall also develop architecture and systems interface design plans based on the approved requirements and impact assessment. These design plans shall include details regarding architectural, system, data and reporting interfaces. Systems such as INSIGHT (i.e., Salesforce), Oracle (EBS, LNS), and OPIC’s warehouse for reporting shall be evaluated. This plan must also evaluate and recommend improvements to existing business processing and associated workflow.

This plan and all associated facets must be reviewed and accepted by OPIC. Additionally, the Contractor shall map all requirements to the design to ensure all requirements are addressed within the design.

The Contractor shall incorporate several system integration touch points and/or interfaces in the implementation. Accordingly, system integration must occur with the following:

• OPIC’s financial statement spreading application

• OPIC’s general IT Infrastructure to include storage and virtualization management

• OPIC’s existing Finance portfolio (i.e., Salesforce interface)

• OPIC’s Enterprise Business Suite (EBS) Oracle instance to include custom modules

• OPIC’s reporting and/or warehouse solution

• Active Directory

• Centrify Single Sign-On (SSO)

• Windows Server 2008, 2012, and 2016

Risk Scorecard SOW Page 9 of 29

• MS SQL Server 2008 / 2012

• SharePoint 2013 and SharePoint Online (O365)

• Country and Regulatory Environment Ratings Applications

All system integration touch points and interfaces must be evaluated and documented. The Contractor shall work closely with on-site IT teams for all system integration activities accordingly.

iv. Environment Set-up (Tools, Licenses, Accesses, etc.) Plan

The Contractor is responsible for the planning, costing, and establishment of the appropriate hosting environment for the Risk Scorecard solution (i.e., cloud vs. OPIC on premise). They are required to ensure the OPIC IT infrastructure properly facilitates environment(s) appropriate for development, testing, and implementation.

The Contractor shall develop an environment set-up plan based on requirements, software solution requisites, and the architecture and system interface design plans. This environment set-up plan must detail all required tools, licenses, and accesses needed by the development team, business stakeholders, and any other necessary parties involved in the scorecard software solution implementation. Minimally, there should be development, test, and production environments to support the OPIC SDLC and best practices. This plan must be reviewed and accepted by OPIC.

v. User Interface Design and Plan

The Contractor shall develop a user interface design and plan based on the approved requirements, which need to include user interface requisites, business process improvements, and facilitation of Risk’s full lifecycle workflow. User roles, associated capabilities, and process improvement recommendations shall be fully documented. This plan is critical, as the user interface will dictate a majority of OPIC stakeholder exposure to and experience with the software solution. This design and plan must be reviewed and accepted by OPIC.

vi. Data Migration Assessment and Plan

The Contractor shall assess the data migration needs for this solution and develop an associated data migration plan. In particular, the Contractor is responsible for ensuring historical data currently captured in MS Access and MS Excel is properly migrated to the appropriate destination(s) for ongoing scorecard management, future trend analysis, and reporting. This plan must be reviewed and accepted by OPIC.

vii. Training Plan

The Contractor shall develop a training plan that details all training materials and associated trainings in accordance with the delivery of the scorecard software platform. Training may include demonstrations, one-on-one trainings, presentations, videos, blogs, email communications and newsletters. OPIC approval of the training plan and proposed materials must be obtained.

viii. Security Readiness Review and Development Readiness Plan

The Contractor shall develop a security readiness and operational readiness plan for OPIC’s Chief Information Security Officer (CISO). This plan shall establish a detailed schedule to harden code prior to production deployment and steps required for completing security readiness and operational readiness reviews.

Risk Scorecard SOW Page 10 of 29

c. Task 3: Single Scorecard Development

Implementation and delivery of the Risk Scorecard software solution includes programming and automating the ten risk Scorecards and associated processes into the approved platform. Task 3 lays the groundwork for the full solution by focusing on the development of the first scorecard and the related LGD framework. Intense testing by a broad user group of the first scorecard will ensure a strong foundation is set and can be leveraged for the development of the remaining scorecards in Task 4.

It is expected for Task 3 to meet OPIC approved project schedule and cost parameters, as well as meet expectations via defined requirements (see Appendix “d” Initial Requirements). Correspondingly, the following activities are outlined to support this end and produce an acceptable, satisfactory solution.

i. Environment Set-up and Development Preparation

The environment(s) must be prepared for development, all forms of testing, and ultimately production deployment. The Contractor shall execute the environment set-up plan and ensure that all services, access, and data interfaces are employed in preparation for development and testing.

The Contractor is responsible for managing the set-up for all environments, to include the scorecard solution environment(s) and environments that encompass points of integration.

ii. Iterative Functional Development and Reviews

The Contractor shall perform all of the necessary development activities to ensure successful deployment of the Scorecard software solution. Iterative development cycles and reviews are required. The deployment of the solution shall occur as an iterative process with progress shown via modules or module subsets completed and demonstrated for acceptance by OPIC.

A functional/workflow and data review must also be continuously conducted. It is critical all aspects of the user experience, to include the interface, data management, process improvement and workflow implementation, are thoroughly managed throughout the iterative functional development and reviews. Additionally, system user roles, capabilities and functionality shall be developed and prepared for reviews. These reviews must be presented to OPIC senior management and sign-off/acceptance must be obtained. The OPIC Contracting Officer Representative (COR) must accept and approve all deliverables accordingly.

iii. Data Mapping, Cleansing and Migration

The Contractor shall provide data mapping, and migration services of a subset of the historical scorecard data to enable testing and verification that the historical data from MS Access and MS Excel will properly move during Task 5. This data transition shall be documented and the migration target shall be vetted and accepted by OPIC.

iv. System Interfaces and Integration(s)

The Contractor shall evaluate and incorporate several system integration touch points and/or interfaces in the software solution implementation, in conjunction with the OPIC IT team.

Accordingly, the Contractor shall leverage the system interface assessments, plans, and designs developed as part of Task 2 for this development. System integration must occur with the following:

• OPIC’s financial statement spreading application

• OPIC’s general IT Infrastructure to include storage and virtualization management

• OPIC’s existing Finance portfolio (i.e., Salesforce interface)

Risk Scorecard SOW Page 11 of 29

• OPIC’s Enterprise Business Suite (EBS) Oracle instance to include custom modules

• OPIC’s reporting and/or warehouse solution

• Active Directory

• Centrify Single Sign-On (SSO)

• Windows Server 2008, 2012, and 2016

• MS SQL Server 2008 / 2012

• SharePoint 2013 and SharePoint Online (O365)

• Country and Regulatory Environment Ratings Applications

Other desirable integration interfaces are detailed in the initial requirements (see Appendix “d”).

All integration touch points and interfaces must be evaluated and approved by OPIC prior to deployment. Furthermore, the Contractor shall work closely with on-site IT teams for all system integration activities.

v. Report Development

The development and management of associated Scorecard reporting shall leverage the report, data and user interface requirements defined in Task 2. The Contractor shall also develop report test scripts, manage the design implementation, conduct unit testing and user acceptance testing (UAT), and lead the technical development and implementation of each report based on user-defined priority.

vi. Testing

The Contractor shall manage the entirety of testing to include unit testing, building test scripts, and facilitating UAT. Testing will guarantee OPIC’s requirements and expectations are met. UAT may occur as an iterative process, however, OPIC sign-off is required following the completion of each UAT module. UAT time minimally should be 25% of Task 3 level of effort and schedule.

vii. Sign-off

Before moving on to the subsequent task, the Contractor must receive approval from the Government that Task 3 is complete and accepted.

d. Task 4: Remaining Nine Scorecards Development

Once OPIC provides approval and sign-off of Task 3, the Contractor can begin the development of the remaining nine Risk Scorecards in the platform. It is assumed that the first scorecard will serve as the model for the subsequent scorecards and related LGD framework and any workflow, data, or reporting variations would be captured in the Task 2 Requirements documentation activity.

i. Iterative Functional Development and Reviews

The Contractor shall perform all of the necessary development activities to ensure successful deployment of the Scorecard software solution. Iterative development cycles and reviews are required. The deployment of the solution shall occur as an iterative process with progress shown via modules or module subsets completed and demonstrated for acceptance by OPIC.

A functional/workflow and data review must also be continuously conducted. It is critical all aspects of the user experience, to include the interface, data management, process improvement and workflow implementation, are thoroughly managed throughout the iterative functional development and reviews. Additionally, system user roles, capabilities and functionality shall be

Risk Scorecard SOW Page 12 of 29 developed and prepared for reviews. These reviews must be presented to OPIC senior management and sign-off/acceptance must be obtained. The OPIC Contracting Officer Representative (COR) must accept and approve all deliverables accordingly.

ii. System Interfaces and Integration(s)

The Contractor shall evaluate and incorporate several system integration touch points and or interfaces in the software solution implementation, in conjunction with the OPIC IT team.

Accordingly, the Contractor shall leverage the system interface assessments, plans, and designs developed as part of Task 2 for this development. System integration must occur with the following:

• OPIC’s financial statement spreading application

• OPIC’s general IT Infrastructure to include storage and virtualization management

• OPIC’s existing Finance portfolio (i.e., Salesforce interface)

• OPIC’s Enterprise Business Suite (EBS) Oracle instance to include custom modules

• OPIC’s reporting and/or warehouse solution

• Active Directory

• Centrify Single Sign-On (SSO)

• Windows Server 2008, 2012, and 2016

• MS SQL Server 2008 / 2012

• SharePoint 2013 and SharePoint Online (O365)

• Country and Regulatory Environment Ratings Applications

Other desirable integration interfaces are detailed in the initial requirements. All integration touch points and interfaces must be evaluated and approved by OPIC prior to deployment. Furthermore, the Contractor shall work closely with on-site IT teams for all system integration activities.

iii. Report Development

The development and management of associated Scorecard reporting shall leverage the report, data and user interface requirements defined in Task 2. The Contractor shall also develop report test scripts, manage the design implementation, conduct unit testing and user acceptance testing (UAT), and lead the technical development and implementation of each report based on user-defined priority.

iv. Testing

The Contractor shall manage the entirety of testing to include unit testing, building test scripts, and facilitating UAT. Testing will guarantee OPIC’s requirements and expectations are met. UAT may occur as an iterative process, however, OPIC sign-off is required following the completion of each UAT module. UAT time minimally should be 25% of Task 4 level of effort and schedule.

v. Sign-off

Before moving on to the subsequent task, the Contractor must receive approval from the Government that Task 4 is complete and accepted.

e. Task 5: Full Scorecard Solution Deployment

Upon completion of Task 4, the Contractor shall provide the necessary support to successfully deploy the Risk Scorecard Solution for production use by OPIC. This entails not just the deployment of code, but the

Risk Scorecard SOW Page 13 of 29 critical activities such as end-user training, readiness reviews and sign-off, and operations and maintenance ownership transition.

i. Training

The Contractor shall develop and deliver all training materials, and conduct training per the delivery of the implementation deployment. The Contractor shall deliver a detailed user guide that documents navigating the system, system functionality, all facets of the user interface, processes specific to OPIC's use, FAQ's and where to find further information on the system. The Contractor shall conduct sufficient training so that when the new system is deployed to production, there is seamless user management of functionality, to include scorecard processing and management, data entry, workflow, associated business processes and systems integration. Training may include demonstrations, one-on-one trainings, presentations, videos, blogs, email communications and newsletters. OPIC approval of the materials must be obtained.

ii. Production Readiness Reviews

The Contractor shall perform a security readiness and operational readiness review with OPIC’s CISO and shall harden code for production deployment based on the predefined schedule. OPIC must approve the security readiness and operational readiness reviews as well as the code hardening for each production deployment.

In addition to the above-mentioned deliverables, the Contractor shall develop and deliver all other associated documentation necessary for ongoing operations and maintenance.

iii. Data Mapping, Cleansing and Migration

In conjunction with the iterative functional development (i.e., concurrent activity), the Contractor shall provide data mapping, cleansing, and migration services to guarantee historical data from MS Access and MS Excel is properly moved and housed for future use. This data transition shall be documented and the migration target shall be vetted and accepted by OPIC.

iv. Deployment to Production and Sign-off

The Contractor shall provide all appropriate services to ensure successful deployment of the scorecard software solution to the production environment. An official package of associated documentation to include all SDLC artifacts must be delivered prior to deployment. OPIC must review and sign-off on the deployment procedure(s) and final, physical solution to be deployed.

v. Bug-fixes

Once the Risk Scorecard solution is deployed and operational, the Contractor is responsible for addressing all bug fixes till the close of the period of performance. This service includes all changes to the scorecard software solution that adhere to and/or support the approved set of requirements.

Tracking of the bugs and related status shall be reported by the Contractor to OPIC on a weekly basis.

vi. Operations and Maintenance Transition

The Contractor shall be responsible for transitioning the ownership of operations and maintenance (O&M) to the OPIC IT O&M team. This entails providing the required documentation outlined in the

Risk Scorecard SOW Page 14 of 29

OPIC SDLC and conducting transition meetings with all relevant parties to ensure a smooth hand-off.

f. Task 6: Ongoing Consultancy Support (if needed)

Following Task 5 completion, OPIC will assess Contractor delivery and needed consultancy services, and award the option year(s) Task 6 for ongoing support if determined necessary and as appropriate.

5 Support Construct The Contractor must manage within the provisioned support construct to include all associated contracting constraints and assumptions as detailed in the following section.

a. Constraints

Work under this contract may have the following constraints:

• OPIC requires a seamless transition between the current scorecard solution and the new web-based solution; no interruption of service or access to OPIC information or reports is acceptable.

• Regulatory and policy requirements are subject to change over the course of this contract that may impact current policies and operations.

• Consent to Non-Disclosure Agreement (Attachment, Section 18).

b. Assumptions

The following assumptions apply to the efforts during the execution of this contract:

• This initiative includes the responsibility to identify, document and implement business-processing improvements that foster system processing, system usability, data integrity, system integration and reporting, where appropriate.

• The associated governance bodies may prioritize and determine aspects of this effort.

• The OCIO will weigh in on technical decisions where/as appropriate when technical impacts must be evaluated.

• The implementation of the solution must meet or exceed baseline compliance to OPIC’s System

Development Lifecycle (SDLC) best practices.

• The Contractor will coordinate and collaborate across all IT teams to meet the objectives and requirements of the EDW solution.

• The Contractor will efficiently and effectively respond to OPIC questions, concerns, and comments.

• Timely notification of deliverables requiring OPIC review and collaboration will be provided to

OPIC to ensure proper planning on OPIC’s side can occur.

• The Contractor will be proactive and alert OPIC management to potential contractual, programmatic and performance concerns, risks and/or issues.

6 Support Hours of Operations The Contractor must maintain an adequate work force for the uninterrupted performance of all activities and deliverables defined within this SOW. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the services are essential. The Contractor is responsible for providing support as determined by the COR.

Risk Scorecard SOW Page 15 of 29

7 Deliveries and Performance

a. Place of Performance

Bulk of work will be done at contractor’s offices. Any in-person meetings are to be held at OPIC’s offices at 1100 New York Avenue, N.W. Washington, D.C. 20527

b. Period of Performance

The anticipated base period of performance is 18 months from date of award (Tasks 1-5) with up to three one-year option periods (Task 6).

c. Technical Direction

OPIC’s Contracting Officer’s Representative (COR) may provide technical direction and general guidance to the Contractor and key resource personnel. As used herein, “Technical Direction” is direction to the Contractor that fills in details, suggests possible lines of inquiry, or otherwise completes the general scope of the work. “Technical Direction” must be within the terms of this contract, shall not change or modify the contract in any way, and shall not constitute changes (as described in the clause of this contract entitled “FAR 52.243-1 Changes – Fixed Price (August 1987), which may only be accomplished by the Contracting Officer (CO).

d. Key Personnel and Staff

The following are considered to be key personnel positions. The Contractor shall provide resumes for the proposed personnel in each of these positions.

• Project Manager– Responsibilities include, but are not limited to:

o Excellent analytical, organizational and communication skills;

o Proven ability to meet deadlines, mitigate risks, and manage people, to include project staff, stakeholders and senior management;

o Proven ability to accomplish project objectives by effectively planning, scheduling, evaluating project activities, tasking, training, and enforcing;

o Achieves operational objectives by contributing information and recommendations to strategic plans and reviews; preparing and completing action plans; overseeing development, productivity, quality, and customer-service standards; resolving problems; identifying trends;

determining system improvements; implementing/deploying change;

o Experience managing system development lifecycles and software implementations such as the desired scorecard software implementation;

o Meets financial objectives by forecasting requirements; preparing budget; scheduling expenditures; analyzing variances; and initiating corrective actions;

o Demonstrated program management capabilities with at least four years work experience;

o Demonstrated experience for providing similar solutions for clients of similar size, scope, magnitude, and complexity; and, o Proficient experience with Microsoft Office, to include Excel, Word, and Power Point.

• Developer(s) – Responsibilities include, but are not limited to:

o Excellent analytical and organizational skills;

Risk Scorecard SOW Page 16 of 29 o Experience developing and/or delivering software applications, automated business process workflows and application architecture to include design approaches, technical analysis, and impact analysis;

o Experience managing technical infrastructures as they relate to software applications/platform, connect to internal systems and facilitate a web-based customer interface;

o Demonstrated experience mapping design to requirements, and translating requirements, system specifications and detailed design documentation into software components or code;

o Ability to translate and/or leverage physical, logical and object-based data models and associated artifacts;

o Experience developing software components such as the Scorecard software application OPIC desires, conducting peer reviews and providing summary progress of the development effort;

o Experience establishing and maintaining the integrity of baseline configuration, application versioning, descriptions and related documentation; establishing test and verification procedures to ensure application integrity and fully met functional requirements; and, conducting unit, application and integration testing to validate the application’s capabilities;

o Understanding/knowledge of Oracle, .Net and Salesforce databases and interfaces.

• Quality Assurance Tester – Responsibilities include, but are not limited to:

o Plan test schedules or strategies in accordance with project scope or delivery dates;

o Understand the business logic, functional and non-functional requirements and system functionality to plan comprehensive testing and QA activities;

o Develop testing artifacts including: requirements traceability matrix, test strategy, test plan, test cases/scripts, and test results reports;

o Coordinate with system developers to communicate test results and resolve defects;

o Create and report testing metrics to project management in order to assess stability and status of all testing activities;

o Provide support to unit testing, user acceptance testing, and other testing as required o Possess strong analytical and problem solving skills.

e. List of Deliverables

The following deliverables detailed in Table 1: Deliverables are to be prepared and provisioned by the Contractor. Each deliverable review cycle and final delivery deadline must be initially determined within the project management plan and schedule, and must be approved/accepted by OPIC. In addition, the Contractor shall maintain all deliverables and other relevant project documentation on the OCIO PMO SharePoint site, as advised by OPIC.

The Contractor is not limited to providing only these documents and is encouraged to propose additional documentation as part of the proposed solution.

Note: Additional deliverables may be negotiated and specified in the contract award.

Table 1: Deliverables

Item # Deliverable Title

1.0 Task 1: Project Management

1.1 All OPIC SDLC Initiation and Planning Phases Outputs (Reference Section 21.1)

1.2 Weekly IPT Status Report(s)

1.3 Bi-Weekly OCIO PMO Project Status Report(s)

1.4 Contract Kick-off Meeting

Risk Scorecard SOW Page 17 of 29

1.5 Senior Management-level Governance Meeting Presentations and Minutes (where appropriate/as needed)

1.6 Integrated Project Team Meeting Presentations and Minutes (as needed)

1.7 Evidence of meeting SDLC Control Gate criteria

2.0 Task 2: Planning and Design

2.1 All OPIC SDLC Requirements and Design Phases Outputs (Reference Section 21.1)

2.2 Requirements Development (to include backend, database, user-interface, system interface, data migration & report specifications) & Sign-off

2.3 Architecture and Systems Interface Assessment, Design and Plan

2.4 Environment Set-up (tools, licenses, accesses, etc.) Plan

2.5 User Interface Design & Plan

2.6 Data Migration Assessment & Plan

2.7 Initial Training Plan

2.8 Evidence of meeting SDLC Control Gate criteria

3.0 Task 3: Single Scorecard Development

3.1 Environment Set-up Execution

3.2 All OPIC SDLC Development, Integration & Test Phases Outputs (Reference Section 21.1)

3.3 Iterative Functional Development and Reviews of a Single Scorecard selected by OPIC

3.4 Data Mapping, Cleansing and Migration

3.5 System Interfaces and Integration(s)

3.6 Report Development

3.7 User Acceptance Testing (UAT)

3.8 Evidence of meeting SDLC Control Gate criteria

4.0 Task 4: Remaining Nine Scorecard Development

4.1 All OPIC SDLC Development, Integration & Test Phases Outputs (Reference Section 21.1)

4.2 Iterative Functional Development and Reviews of 9 Scorecards

4.3 Data Mapping

4.4 System Interfaces and Integration(s)

4.5 Report Development

4.6 User Acceptance Testing (UAT)

4.7 Evidence of meeting SDLC Control Gate criteria

5.0 Task 5: Full Scorecard Solution Deployment

5.1 All OPIC SDLC Implementation and O&M Phases Outputs (Reference Section 21.1)

5.2 End-User Training Materials

5.3 End-User Training Sessions

5.4 Security Readiness Review

5.5 Operation Readiness Review

5.6 Deployment to Production, Acceptance and Sign-off

5.7 Bug-fix Metric Reports

5.8 O&M Transition Materials

5.9 Evidence of meeting SDLC Control Gate criteria

f. Monthly Program Report

In addition to the deliverables identified above, the Contractor shall deliver a monthly program report.

This report shall be a comprehensive account of all activities performed by the Contractor including:

• Overall program status

Risk Scorecard SOW Page 18 of 29

• Iterative functional development – per phase and associated modules

(Note: Two versions shall be provided - one electronic copy shall be emailed and one copy shall be posted online.) Each draft report shall be delivered on the 10th calendar day of the following month and each final report shall be delivered five calendar days after receipt of OPIC comments.

8 Quality Assurance Plan

The Contractor shall develop of Quality Assurance Plan (QASP) that details the monitoring program to be undertaken to ensure that the requirements are being met. The QASP establishes procedures on how this assessment/inspection process will be conducted.

The contractor is responsible for implementing and delivering performance that meets contract standards using its Quality Control Plan. The QASP provides the structure for the government’s surveillance of the contractor’s performance to assure that it meets contract standards. It is the government’s responsibility to be objective, fair and consistent in evaluating contractor performance.

The QASP is not part of the contract nor is it intended to duplicate the contractor’s quality control plan. This QASP is a living document. Flexibility in the QASP is required to allow for an increase or decrease in the level of surveillance necessary based on contractor performance.

The Performance Requirements Summary (PRS) is the list of performance objectives and standards that must be performed by the contractor. This Summary details the method of surveillance the COR will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR file.

9 Acceptance

OPIC acceptance will be based upon the quality of the solutions and deliverables. OPIC will employ experts for independent validation of Quality Assurance Surveillance Plan (QASP) factors, especially for compliance to OPIC CIO and CISO policies, completeness of SDLC outputs, and implementation of industry best practices.

Quality will be assessed through the SDLC control gates, periodic reviews by the PMO, and user acceptance testing.

To further ensure quality control, immediately following implementation, there will be a minimum of two weeks of warranty support by the Contractor. This team will address all post-implementation issues before it is fully transitioned to the O&M team to maintain.

Prior to the conclusion of the warranty period, the Contractor will present a turnover to operation and maintenance through an Operational Readiness Review (ORR). Upon approval, OPIC will provide final acceptance of the solution and assume operations and maintenance responsibilities.

10 Government Furnished Property

The Government will not furnish any property for this effort.

Risk Scorecard SOW Page 19 of 29

11 Contractor Furnished Property The contractor will provide all labor, collection expenses, materials, equipment, and facilities to complete all tasks required for this effort.

12 Identification of Contractor Employees

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All contractor personnel may be required to obtain and wear OPIC badges in the performance of this service.

13 Non-Personal Service Statement

Contractor employees performing services under this order will be controlled, directed, and supervised at all times by management personnel of the contractor. Contractor management shall ensure that employees properly comply with the performance work standards outlined in the Statement of Work. Contractor employees shall perform their duties independent of, and without the supervision of any Government official. The tasks, duties, and responsibilities set forth in the task order may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work.

14 Organizational Conflict of Interest

Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

15 Non-Disclosure Agreement

The Contractor shall deliver to the COR a signed nondisclosure agreement (NDA) for all Contractor personnel

Risk Scorecard SOW Page 20 of 29 for whom there exists the possibility of coming into contact with “OPIC materials and information,” as defined in the NDA. All such Contractor personnel must sign and submit to the COR the Nondisclosure Agreement included in Section 18 herein. The Contractor shall provide the signed nondisclosure agreements to the COR prior to the Contractor’s staff commencing their assigned duties within the Overseas Private Investment Corporation’s headquarters building or at any of its other offices.

16 Section 508 Compliance

Rehabilitation Act of 1973- All microcomputer data files (including text documents, databases, spreadsheets, graphs, and other types of files), when required, shall be IBM-PC compatible. When producing these data files, the Contractor shall take into account the needs of all end users – including people with disabilities. To ensure that end users with disabilities have access to and use of information and data that is comparable to that provided to others, contractors shall provide deliverables that are compliant with statutory Section 508 of the Rehabilitation Act of 1973 (found at 29 U.S.C. 794d).

17 Acronyms CISO- Chief Information Security Officer CO- Contracting Officer COR- Contracting Officer Representative EBS- Oracle E-Business Suite IPT- Integrated Project Team IT- Information Technology LGD- Loss Given Default NDA- Non-Disclosure Agreement OCI- Organizational Conflict of Interest OCIO- Office of the Chief Information Officer O&M- Operations and Maintenance OPIC- Overseas Private Investment Corporation ORR- Operational Readiness Review PD- Probabilities of Default PM- Project Manager PMO- OCIO Program Management and Oversight office POC – Points of Contact PRS – Performance Requirement Summary PSR- Project Status Review QASP- Quality Assurance Surveillance Plan SDLC- Software Development Life Cycle SOW – Statement of Work UAT- User Acceptance Testing

18 Attachment Non-Disclosure Agreement (NDA)

19 Appendix

a. OPIC’s System Development Life Cycle (SDLC)

The following chart details OPIC’s SDLC and the associated requirements expected to be delivered by the Contractor.

Risk Scorecard SOW Page 22 of 29

b. OPIC’s Scorecard Workflow (High-Level)

Specific data points would be PULLED by scorecard from INSIGHT, EBS/ORACLE, Risk Analyst Specific data generated by the scorecard would need to by PUSHED to Budget, PMD Officer, TRIM, Data Warehouse and INSIGHT (as needed)

RISK ANALYST

SPREADS

Create New

Scorecard Origination 1st level clearance Credit Policy

2nd Level clearance

Risk Mgmt

Update Existing

Scorecard

PMD

Officers

1st level clearance

PMD

Directors

2nd Level clearance

Risk Mgmt

FM/ORACLE

Commitments/Disbursements/

Repayments

SCORECARD PLATFORM

PMD/

Orig

Officer/ Credit Policy

Officer

Final Scorecard

TRIM

Budget

Data Warehouse

Reports

ALR

INSIGHT

Create New Project

Subsidy Calculations

Project Due

Diligence

Oracle - Financial

Statements

Risk Scorecard SOW Page 23 of 29

c. Sample Finance Risk Report

d. Initial Requirements

The requirements (detailed in the following “Risk Scorecard Solution Requirements” spreadsheet) are to be leveraged by the Contractor as a preliminary list for all tasks. Each requirement and associated criticality weight (with “10” being the most critical) must be analyzed and utilized where appropriate in the scorecard software solution.

FINANCE RISK REPORT - AS OF SEPTEMBER 30, 2017

Loan # New Project ID # Subtype

Loan Count Project Name Country Region Status

Scorecard Type

Assesment Date

Scorecard Rating

Override Rating PD (%) LGD (%)

Expected Loss (%)

Watch Flag

Watch Date

Default Date Undisbursed Outstanding Officer

NAICS

Code

XXXXXXXXXX XXXXXXXXXX F 1 PROJECT NAME A EL SALVADOR LA COMMITTED PF 8/28/2017 5 7 7.2% 25% 1.80% $10,000,000.00 $0.00 Doe, John 522298 XXXXXXXXXX XXXXXXXXXX F 1 PROJECT NAME B TANZANIA AFR OUTSTANDING MIV 3/8/2017 6 8 11.6% 65% 7.54% Y 9/30/2015 $8,000,000.00 $15,000,000.00 Doe, John 525990 XXXXXXXXXX XXXXXXXXXX F 1 PROJECT NAME C CAMBODIA ASIA OUTSTANDING BANK 8/15/2017 6 4.7% 65% 3.06% 9/30/2016 $0.00 $100,000,000.00 Doe, John 522110 XXXXXXXXXX XXXXXXXXXX F 1 PROJECT NAME D COLOMBIA LA COMMITTED NBFI 3/31/2017 8 11 51.0% 65% 33.15% $25,000,000.00 $0.00 Doe, John 5324 XXXXXXXXXX XXXXXXXXXX F 1 PROJECT NAME E MEXICO LA OUTSTANDING NBFI 11/14/2016 7 11 51.0% 65% 33.15% $15,000,000.00 $7,000,000.00 Doe, John 5324 XXXXXXXXXX…