Performance Work Statement SURPASS Task Order One.pdf

Indefinite Delivery Indefinite Quantity (IDIQ) Task Order Performance Work Statement

(PWS)

Single Family Housing Direct Loan Origination System

Solution for UniFi Replacement Providing an Advanced Streamlined System (SURPASS)

Contents

I. DEFINITIONS/ACRONYMS:

II. GENERAL REQUIREMENTS:

1. Introduction:

2. Background:

2.1 Statutory authority, regulations, or policy affecting the overall requirement as applicable include but are not limited to:

3. Type of Contract:

4. Non-personal and Not Inherently Governmental Services

5. Place(s) of Performance

5.1 Contractor Site Location (remote/virtual)

6. Days and Hours of Performance:

7. Performance Period or Delivery Date:

8. Kickoff Meeting

9. Travel

10. Government-furnished Property, Equipment, and/or services:

11. Identification of Contractor Employees:

12. Non-Disclosure and Confidentiality:

13. HSPD-12 Credentials:

14. Contractor Personnel Security Requirements:

Information Technology Systems Requirements:

Access Requirements:

Information Assurance:

Background Investigation Requirements:

15. On-Boarding Process:

16. Contractor Personnel Staffing and Assignments:

17. Compliance with IT Security Policies:

18. Special Considerations:

19. Organizational Conflict of Interest (OCI):

20. Data Rights:

21. USDA Visual Identity Guidelines:

22. Constraints or Assumptions:

PRINCIPLES AND DESIGN STANDARDS

SECURITY SUPPORT

TECHNICAL LANDSCAPE

23. Order of Precedence:

24. Service Contract Labor Standards (SCLS) (Formerly known as the Service Contract Act of 1965) Applicability:

25. Incorporated Attachments:

III. SCOPE OF WORK

1. General Scope:

1.1 Specific Tasks or Requirements:

FA 1: Development, Modernization, and Enhancement (DME) A. Planning and Design B. Product Development and Configuration C. Testing D. 508 Testing .......................................................................................................................................... Error! Bookmark not defined.

E. HyperCare

1.2 MVP Delivery

1.2.1 CUSTOMER RELATIONSHIP MANAGEMENT (CRM) REQUIREMENTS

1.2.2 LOAN ORIGINATION REQUIREMENTS

1.2.3 CROSS-SOLUTION REQUIREMENTS

1.2.4 REPORTING REQUIREMENTS

1.2.5 ROLE-BASED REQUIREMENTS

1.2.6 FORMS CONVERSION REQUIREMENTS

FA 4: Subject Matter Expert (SME) Services FA 5: Licensing and Fees FA 6: Transition

Transition-In FA 7: Cyber Security

Technical Deliverables:

1.3 Deliverables Chart

IV. PAYMENT AND INVOICING

1.0 Evaluation Method for Periodic Payment

1.1 Invoicing and Payment

2.0 Contract Line-Item Number (CLIN) Structure:

V. OTHER REQUIREMENTS

1. Project Management Requirements

1.1 Project Management

1.2 Program Management

1.3 Scaled Agile Framework Enterprise (SAFE) Methodology

1.3.1 Program Increment (PI) Stages

1.3.3 Sprints

1.4 - Standardized Workflows and Work Patterns

1.4.1 WORKFLOWS

1.4.2 WORK PATTERN

1.5 Design

1.6 Development

1.6.1 - Definition of Done

1.8 Defect Repair

1.9 Project Tracking Tools

1.10- FitGAP Analysis Methodology

1.10.1 - Interactive Design Workshops (IDW)

1.10.2 - System Decomposition 1.10.3- The FitGAP Worksheet

1.10.4 -System Requirement Mapping

1.10.5 - Gap Types

1.10.6 - Gap Source

1.10.7 - Recommended Solution System Modifications

1.10.8 - System Stack Alignment

1.10.9 - Solution Viability

1.11 Quality Assurance Surveillance Plan (QASP)

1.12 - Review and Acceptance

1.13 Technical Design

1.13.1 Adaptive Design

I.DEFINITIONS/ACRONYMS:

ACRONYM/TERM DEFINITION

API Application Programming Interface ART Agile Release Train Assistant Chief Data Officer (ACDO)

The ACDO leads the RD Mission Area data strategy and governance activities, and provides leadership by establishing consistency and governance in managing data across RD so that data can be more easily used and shared within proper security parameters; oversees centralized analytics teams and provides analytics capacity to address cross-cutting questions or issues within RD; enables program areas to conduct program-specific analytics with common tools; and ensures RDs alignment with USDA data strategy.

Assistant Chief Information Officer

(ACIO)

RD’s ACIO coordinates with RD’s ACDO as counterparts in ensuring that the departmental vision is carried out at the Mission Area level and that business and technology requirements are met to support this vision.

CI/CD Continuous Integration/Continuous Development CIW Capital Investment Workbook CLIN Contract Line-Item Number Contracting Officer

(CO)

A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. A CO is only individual who can legally bind the government.

Contracting Officer's Representative (COR)

A representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the contractor. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

COR Advisor A representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the Contractor. This individual does NOT have authority to change the terms and conditions of the contract.

COTS Commercial off-the-Shelf – for the purpose of the performance work statement, COTS refer to commercially-developed software.

Delivery-order contract

FAR 16.501-1 defines a delivery order contract as a contract for supplies that does not procure or specify a firm quantity of supplies (other than a minimum or maximum quantity) and that provides for the issuance of orders for the delivery of supplies during the period of the contract.

Deployment Software and administrative changes made in the Production environment DME Development, Modernization ad Enhancement DNP Do Not Pay Epic A container for a significant Solution development initiative that captures the more substantial investments that occur within a portfolio, which require the definition of a Minimum Viable Product (MVP) and approval by Lean Portfolio Management (LPM) before implementation.

ERD Entity Relationship Diagram Feature A service that fulfills a stakeholder need. Each feature includes a benefit hypothesis and acceptance criteria and is sized or split as necessary to be delivered by a single Agile Release Train (ART) in a Program Increment (PI).

FedRAMP Federal Risk and Authorization Management Program. Provides a standardized approach to security authorizations for Cloud Service Offerings.

FISMA Federal Information Security Management Act of 2002 (FISMA) GFE Government Furnished Equipment IOC Initial Operational Capability Indefinite - quantity contract

FAR 16.504 defines an indefinite-quantity contract as a contract that provides for an indefinite quantity, within stated limits, of supplies or services to be furnished during a fixed period, with deliveries or performance to be scheduled by placing orders with the contractor.

IDW Interactive Design Workshops. Workshops held between Software and solution SMEs to align functionality.

Iteration Each iteration is a standard, fixed-length timebox, where Agile Teams deliver incremental value in the form of working, tested software and solutions. This PWS defines the duration of the timebox to be three weeks.

LOS Loan Origination System Minimal Viable Product (MVP)

The minimum capabilities a product should have to meet the Government’s objectives.

Office of the Chief Information Officer

(OCIO)

An Office within the Office of Administration and Management at RD. OCIO is responsible for providing state-of-the-art, reliable, and quality products, and services whenever and wherever needed with customer collaboration and teamwork. OCIO ensures that the products and services provided emanate from RD’ strategic goals and values. Additionally, OCIO provides proper resource alignment for the delivery of reliable and sustainable information services. Finally, OCIO ensures infrastructure services are readily accessible to all RD customers.

OMB Office of Management and Budget PDR Preliminary Design Review Program Increment

(PI)

A Program Increment (PI) is a timeboxed planning interval during which an Agile Release Train plans and delivers incremental value in the form of working, tested software and solutions.

PII Personally Identifiable Information PMO Portfolio Management Office PMO Procurement Management Office PO Product Owner Performance Work Statement (PWS)

A statement of work for performance-based acquisitions that describes the required results in clear, specific, and objective terms with measurable outcomes.

Progress Database Progress Database is an object-relational database by Progress Software Corporation Quality Assurance The government shall evaluate the contractor’s performance under each Call order in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Quality Assurance Surveillance Plan

(QASP):

An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance to assure services meets the requirements of the Performance Work Statement.

Quality Control The contractor shall develop and maintain an effective quality control plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

The contractor’s QCP is how it is assured that work complies with the requirement of the contract.

Rural Development

(RD)

A USDA Mission Area committed to helping improve the economy and quality of life in rural America by offering loans, grants, and loan guarantees to help create jobs and support economic development and essential services such as housing; health care; first responder services and equipment; and water, electric and communications infrastructure.

Rural Development Technology Office

(RDTO)

Led by the RD Assistant Chief Information Officer, RDTO is responsible for developing, maintaining, and operating a portfolio of automated systems, and for providing technology-related services, in support of RD’s core businesses and back-office operations

Rural Housing Services (RHS/ Agency)

A USDA RD sub-agency that offers a variety of programs to build or improve housing and essential community facilities in rural areas, by offering loans, grants and loan guarantees for single- and multi-family housing, childcare centers, fire and police stations, hospitals, libraries, nursing homes, schools, first responder vehicles and equipment, housing for farm laborers and much more.

SAFe Scaled Agile Framework. A knowledge base for adopting agile work methods in large organizations.

Shall The word “shall” is denoted to mean a mandatory duty or obligation

Single Family Housing Direct (SFHD)

The Section 502 Direct loan program provides low- and very low-income people the opportunity to own adequate, modest, decent, safe, and sanitary homes in eligible rural areas. The Section 504 loan/grant program assists very low-income owner occupants of modest single-family homes in rural areas repair those homes. The objective of the Section 306C WWD individual grant program is to facilitate the use of community water and/or waste disposal solutions by the residents of colonias along the U.S./Mexico border. The Code of Federal Regulations, 7 CFR part 3550, sets forth policies for the direct single family housing loan programs operated by RHS and addresses the requirements of sections 502 and 504 of the Housing Act of 1949, as amended, and includes policies regarding both loan and grant origination and servicing. The Handbook-1-3550-Direct Single Family Housing Loans and Grants – Field Office Handbook and Handbook-2-3550 Direct Single Family Housing Loans and Grants Customer Service Center Handbook provide USDA staff and others participating in the SFHD programs with the tools needed to originate, underwrite, and service loans and grants efficiently and effectively.

SOP Standard Operating Procedure. A procedural document specific to your operation that describes the activities necessary to complete tasks in accordance with laws, regulations, instructions, or solution activities.

Task-order contract FAR 16.501-1 defines a task order contract as a contract for services that does not procure or specify a firm quantity of services (other than a minimum or maximum quantity) and that provides for the issuance of orders for the performance of tasks during the period of the contract.

Third Party Organizations (TPO)

USDA RD supports partnerships with third party organizations (e.g., Intermediaries, loan packagers, Self-Help grantees) which can provide outreach and presence in counties where an USDA RD Field Office is not located; assist the USDA RD in reaching very low-income applicants; promote the program in underserved areas; prescreen potential applicants;

counsel potential applicants on how to improve their ability to qualify for a home; ensure that applications are complete and accompanied by the supporting documentation needed for USDA RD‘s decision.

TRID TILA-RESPA Integrated Mortgage Disclosure UAD Uniform Appraisal Dataset ULAD Uniform Loan Application Dataset URLA Uniform Residential Loan Application US Department of Agriculture (USDA)

USDA provides leadership on food, agriculture, natural resources, rural development, nutrition, and related issues based on public policy, the best available science, and effective management. USDA’s vision is to provide economic opportunity through innovation, helping rural America to thrive; to promote agriculture production that better nourishes Americans while also helping feed others throughout the world; and to preserve our Nation's natural resources through conservation, restored forests, improved watersheds, and healthy private working lands.

II.GENERAL REQUIREMENTS:

1. Introduction:

The United States Department of Agriculture (USDA) Rural Development (RD) is seeking a Cloud solution to replace the legacy Loan Origination System (LOS), UniFi Pro Mortgage. The replacement of legacy UniFi Pro Mortgage for the Single-Family Housing Direct (SFHD) programs is critical as it remains in a code freeze (sustainment) state until migration to the new solution occurs. Because of this state, no system updates will be provided due to the planned sunset of this system.

2. Background:

The SFHD programs provide low and very low-income households the opportunity to own and/or repair modest homes in rural areas that are decent, safe, and sanitary. Loan origination activities include those financial and non-financial actions necessary to make sure that the portfolio of pre-qualifications and applications are managed and serviced in accordance with all applicable governing laws and in accordance with departmental policies, procedures, and regulations.

UniFi Pro Mortgage was implemented over twenty (20) years ago with some updates to support regulatory requirements and some other custom enhancement for Rural Development. UniFi Pro Mortgage stores application information, orders credit reports, generates application documentation, supplies pertinent application information to the loan servicing system (LoanServ), provides various reporting capabilities, and imports third-party packager loan applications via e-Forms. RD has also enhanced UniFi to add underwriting through an interface to Direct- US, which is the USDA RD underwriting solution for the Direct Single-Family Housing portfolio. Limited changes have created several challenges as the business needs of USDA RD staff and customers have evolved overtime.

Currently, SFHD obligates and closes approximately 11,000 to14,000 loans and grants each year, which can vary. These loans and grants include supporting the 502, 504 and 306C loan and grant programs. This does not include applications withdrawn, denied, or applications that do not yield a decision\obligation and approval. Total overall applications (approved, obligated, withdrawn, denied, etc.) received each year can range from 25,000 to 30,000. There are currently approximately 1,300 RD Staff users who have access to UniFi (with varying degrees of use). We have on average between 180 to 275 concurrent users of the system. There are also roughly 250 external loan packagers (of various types) that access our eForms system to submit applications electronically that eventually are consumed into UniFi. There are currently no external users (i.e., applicants, packagers, other potential external users) who have access to UniFi (RD Staff only). The current Self-Assessment tool, which applicants, external loan packagers and RD Staff can use to generate initial estimates on what applicants may be eligible for depending on income, location, etc., has ranged from 45,000-100,000 saved assessment reviews over the last 3 fiscal years. This does not include any assessments ran that are not saved (saving requires a log in ID by the user).

One notable difference is the mortgage industry’s adaptation to an increasingly efficient, paperless, customer-friendly online LOS. USDA RD application intake is still primarily paper-based. As a result, there are several business challenges including, but not limited to:

Significant RD staff resources required to receive and process loan applications manually.

Limited ability to process applications across state lines or from centralized locations.

Lack of preliminary credit risk management features such as the ability to order support services directly from the system (e.g., flood risk products, income and employment verification, appraisal orders and quality checks).

Lack of compliance risk management against Federal, State, and Local laws that regulate mortgage transactions.

Lack of integration with document preparation services and data-filled forms.

Program delivery to customer is inconsistent. Manual application process amplifies the variance in response times to applicants.

2.1 Statutory authority, regulations, or policy affecting the overall requirement as applicable include but are not limited to:

• Clinger-Cohen Act (also known as the “Information Technology Management Reform Act of 1996”) (40 U.S.C. § 11101-11704);

• E-Government Act of 2002 (44 U.S.C. Chapters 35 and 36);

• Federal Information Security Modernization Act of 2014 (44 U.S.C. Chapter 35, Subchapter II);

• Federal Information Technology Acquisition Reform Act (FITARA) (Pub. L. 113-291);

• Paperwork Reduction Act (PRA) of 1980, as amended by the Paperwork Reduction Act of 1995 (44

U.S.C. Chapter 35);

• Privacy Act of 1974, as amended (5 U.S.C. § 552a);

• Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101);

• Electronic Signatures in Global and National Commerce Act (E-Sign) (15 U.S.C. Chapter 96);

• Government Paperwork Elimination Act of 1998 (44 U.S.C. § 3504);

• Government Performance and Results Act (GPRA) of 1993, as amended by the Government

Performance and Results Modernization Act RA Modernization Act) of 2010 (5 U.S.C. § 306 and 31 U.S.C. §§ 1115 et seq.);

• Office of Federal Procurement Policy Act (41 U.S.C. Chapter 7);

• Budget and Accounting Procedures Act of 1950, as amended (31 U.S.C. Chapter 11);

• Chief Financial Officers Act (31 U.S.C. § 3512 et seq.)

• USDA RD Resources, Directives, and Regulations: https://www.rd.usda.gov/resources

• USDA Departmental Regulations, Notices, Manuals, and Secretary Memoranda:

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

• USDA Digital Strategy: https://www.usda.gov/digital-strategy

• RD Departmental Regulation for Cloud Computing Cloud Computing RD Departmental Regulation

• CIO.gov Policies and Priorities: https://www.cio.gov/policies-and-priorities/

3. Type of Contract:

This Task Order shall be a Firm-Fixed-Price (FFP) type contract.

4. Non-personal and Not Inherently Governmental Services All services requested under this acquisition and PWS are non-personal and not inherently governmental in nature.

5. Place(s) of Performance

The Contactor shall perform the requirements of this contract at the authorized Government work locations unless otherwise specifically stated in this PWS. All work supporting this effort is anticipated to be performed remotely.

The current work locations are:

5.1 Contractor Site Location (remote/virtual)

Changes in Authorized Work Locations:

Work locations are subject to change when it is advantageous to the Government to eliminate or add a work location or change work locations to remote. Should a change occur, the contractor will be notified in writing by the CO. Should the Contractor decide to relocate existing employees due to a change, employee relocation will be done at no cost to the government.

The Contractor may propose contractor work locations in addition to those identified in Places of Performance when it is advantageous to the government. This includes contractor employee telework https://www.rd.usda.gov/resources https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.usda.gov/digital-strategy https://rdconfluence.cert.sc.egov.usda.gov/download/attachments/45647675/Cloud%20Computing%20RD%20Departmental%20Regulation.PDF?api=v2&modificationDate=1631552161000&version=1 http://cio.gov/ https://www.cio.gov/policies-and-priorities/ locations during specified periods when the government facilities are closed due to weather and other emergency situations and/or when government facilities are unavailable due to other events making a government facility uninhabitable. The alternate work locations will be coordinated with the COR in advance and shall be at no additional cost to the government.

The Contractor shall ensure all government furnished equipment (GFE) assigned to individual employees are safely and securely operated and maintained regardless of the location where the work is performed.

Note: Currently all requirement tasks are being supported remote/virtually in support of efforts to combat COVID 19. USDA expects to have a mixed (virtual/in person) workforce, but largely does not expect any contractors to perform work onsite at government locations unless requested to attend in-person meeting, which would be infrequent. The government has limited space available to house Vendor’s workforce, for this acquisition efforts, in its new DC or MO locations.

6. Days and Hours of Performance:

The Contractor is required to be available on non-government holidays from 8:00 am EST until 6:00 pm EST, Monday through Friday to correspond with USDA RD’s point of contacts, such as the Contracting Office, Contracting Officer’s Representative, and the Program/Technology Office. The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

HOLIDAY SCHEDULE

New Year’s Day Labor Day

Birthday of Martin Luther King, Jr. Columbus Day

Washington’s Birthday Veterans Day

Memorial Day Thanksgiving Day

Juneteenth National Independence Day Christmas Day

Independence Day

Table 1: Federal Holiday Schedule

7. Performance Period or Delivery Date:

The below table displays Performance Period:

PERFORMANCE PERIOD

Based Year (Year 1) Date of Award Plus 12 months

Table 2: Performance Period

8. Kickoff Meeting

Upon award of the Task Order, within 10 business days of award, Offeror shall initiate work on this contract by meeting with key government USDA RD representatives to ensure a common understanding of the requirements, expectations, and ultimate end products. Offeror shall discuss the overall understanding of the initial and overall projects and review the background information and materials provided by the government. Discussions will also include the scope of work, deliverables to be produced, how the efforts will be organized, and project conducted, assumptions made/expected and results. A concerted effort shall be made to gain a thorough understanding of the government USDA RD expectations. However, nothing discussed in this or in any subsequent meeting(s) or discussions between the government and Offeror shall be construed as adding, deleting, or modifying any IDIQ

Task Order requirements, including deliverable specifications and due dates. Any additions, deletions, or modifications to this Task Order requirement must be approved by the CO.

Note: Due to COVID-19 protocols, virtual meetings and conferences shall be utilized where appropriate.

9. Travel

Travel will not be authorized under this acquisition.

10. Government-furnished Property, Equipment, and/or services:

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide transition support as defined in this PWS except for those items specified below as Government furnished property and services:

1. Laptops – receipt of Government-issued laptops is contingent upon Contractor employees receiving an USDA’s personal identity verification (PIV) card, which contains the necessary data for the cardholder to be granted to Federal facilities and information solutions and assure appropriate levels of security for all applicable Federal applications.

2. PIV Card – The COR will work with Contractor to obtain PIV cards, known as a LincPass at USDA, for Contractor’s employees.

3. Workspace and utilities shall be provided at USDA, if applicable. (see Note in section 8)

a. USDA Rural Development, 1400 Independence Avenue, Washington, DC 20250

b. USDA Rural Development, 4300 Goodfellow Boulevard, St. Louis, MO 63120

c. Other Government offices as required under acquisition work performance

The Order COR will:

• Provide a Order Awardee Contractor with original and/or electronic copies of USDA authored materials, applicable handbooks, and other pertinent material or information as needed to accomplish the work.

• Arrange authorization to allow Order Awardee Contractor employees to enter required government work sites and access to USDA’s Network/Systems to perform call order tasks upon favorable completion of Homeland Security Presidential Directive 12 (HSPD-12) and the Federal Information Processing Standards Publication (FIPS PUB 201-1) Personal Identity Verification (PIV) of Federal Employees and Contractors.

• Provide Order Awardee Contractor employees a government issued laptop, contingent upon Contractor employees receiving the USDA PIV card/LincPass.

• Advise a Order Awardee Contractor of all formal meetings, presentations, at which their attendance is required, providing at least 3 calendar days advance notice whenever possible.

11. Identification of Contractor Employees:

All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. When performing work outlined in this PWS while in USDA facilities or RDs sites, contractor is required to wear Federal government-issued personal identification card.

12. Non-Disclosure and Confidentiality:

The work to be performed under this acquisition and the data released to the Contractor’s personnel shall be treated as sensitive and confidential in nature and is not to be discussed with or released to anyone except USDA employees assigned to work with the contractor and other contractor personnel working on this acquisition. The

Contractor is responsible for requiring all its employees working under this acquisition, who have access to privileged information, to sign the USDA Non-Disclosure Agreement, provided as an attachment to the solicitation and contract. USDA, as it deems appropriate, may require additional certifications be completed by the contractor at any time during acquisition performance.

The Contractor is required to develop and utilize procedures for custody, use/handling, reproduction, preservation, storage, safeguarding, and disposition of all documents and information of this nature so that there is no unauthorized disclosure of such documents and information throughout the course of performance. The Contractor shall be responsible for the security of all project documents provided to them for work under this acquisition. It is essential that this information be properly handled, stored, and protected from the risk and magnitude of loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction.

The Contractor shall protect and not disclose any PII.

Contractor-generated preliminary and final deliverables, all associated working papers, and other material RD deems relevant in the performance of this acquisition are the property of the U.S. Government and must be submitted to the CO by the conclusion of this acquisition and shall not be reproduced or retained by the Contractor. The Contractor shall not release any information without the written consent of the Contracting Officer.

When no longer required, this information, data, or equipment shall be returned to Government control;

destroyed; or held until otherwise directed by the CO. Items returned to the Government shall be hand carried or emailed to the CO or other designee. The Contractor shall destroy unneeded items by burning, shredding or any other method that precludes the reconstruction of the material.

The Contractor shall immediately notify the appropriate CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment.

Training. All Contractor employees assigned to this acquisition who create, work with, or otherwise handle records are required to take USDA-provided records management training. The Contractor is responsible for confirming training has been completed according to USDA RD policies, including initial training and any annual or refresher training. To the extent an USDA RD requires contractors to complete records management training, the USDA RD must provide the training to the contractor.

Proprietary Information:

If performance of any work under this acquisition causes the Contractor to gain access to proprietary or confidential information of other firms/contractors, the Contractor is required to immediately execute Technology Exchange Agreements/Non-Disclosure Agreements with those firms/contractors, to protect the information from unauthorized use. The Contractor is required to refrain from using any such information for any purposes other than for which it was furnished. The Contractor must immediately provide the CO with a copy of any such agreements with original signatures affixed. The attached Network Access Security Policy document is incorporated into this PWS.

13. HSPD-12 Credentials:

Contractor personnel must complete necessary requirements to obtain HSPD‐12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD‐12 credentials is grounds for removal/suspension of contractor personnel from the contract.

https://www.dhs.gov/homeland-security-presidential-directive-12

Contractor Collaboration: At the CO’s direction, the Contractor may be required to work in conjunction with other vendors, to provide Procurement Management Office (PMO) weekly status reports and meet regularly with said vendors. This authority shall not be delegated to any COR.

https://www.dhs.gov/homeland-security-presidential-directive-12

Project specific Task orders will define any associated requirements for security clearances or public trust suitability in accordance with Homeland Security Presidential Directive 12 (HSPD-12) and the Federal Information Processing Standards Publication (FIPS PUB 201-1) Personal Identity Verification (PIV) of Federal Employees and Contractors.

The task order Awardee Contractor employee’s failure to submit the required information, submission of unacceptable information, or non-compliance with respective HSPD-12 security regulations will be grounds for removal of the respective Contractor employee. The Government retains the right to deny any Contactor employee access to the project for failure to obtain the proper security clearance. Further, the Government reserves the right to exclude or remove from the site or building any Contractor employee whom the Government deems incompetent, careless, insubordinate, or otherwise objectionable or whose continued employment on the work is deemed by the Government to be contrary to the public interests.

All security clearances or public trust suitability will be processed by the Government at no additional cost.

However, Contractors must pay the cost associated with traveling to get the card. This usually requires two trips to the nearest credentialing station.

The Government reserves the right to close any project site or Government facility where call order work is being performed and order contractor personnel off the premises in the event of a national emergency or a shut-down.

14. Contractor Personnel Security Requirements:

Information Technology Systems Requirements:

The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The Contractor shall comply with IT systems security and/or privacy specifications set forth in Rural Development and USDA directives, policy, and procedures; the Computer Security Act of 1987; OMB Circular A-130; and the Federal Information Security Management Act of 2002 (FISMA).

Pursuant to FSIS policy, the Contractor shall be responsible for assuring that each Contractor employee who requires routine unaccompanied physical access to a Federally controlled facility and/or unaccompanied access to a Federally controlled information system, including a Rural Development- issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The Contractor is required to maintain a listing of all individuals who have completed Computer Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten calendar days of an individual starting work on this contract.

Access Requirements:

Contractor Access to USDA’s Network/Systems. The Contractor shall require access to the USDA’s Network/Systems to perform work under the contract. The COR will oversee such access.

Information Assurance:

The Contractor shall protect and not disclose any PII. The term “PII,” as defined in OMB Memorandum M-07- 1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available - in any medium and from any source that, when combined with other available information, could be used to identify an individual.

Background Investigation Requirements:

The attached Background Investigation Requirements document is incorporated into this PWS.

15. On-Boarding Process:

The Contractor shall manage the onboarding of its staff for all Contractor personnel who have not yet been onboarded at USDA. Onboarding includes steps to obtain a USDA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required USDA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide, to the COR, an Onboarding Status Report for any staff with outstanding onboarding requests. Additional information regarding the On-Boarding process is addressed in the attachment “PWS Background Investigation Requirements”.

Deliverable:

A. Onboarding Status Report – due weekly.

This report is to include:

1. All outstanding onboarding requests that need to be reviewed by the COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

16. Contractor Personnel Staffing and Assignments:

(a) In the event that any of the key personnel named in the Contractor’s quotation, as accepted by the Government at award, are unable to perform because of death, illness, resignation from the Contractor’s employ, dissolution of agreement, or other reasons, the Contractor shall submit within 24 hours to the CO/COR, detailed written explanations of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any other information that the CO/COR deems pertinent to approve the substitution. No substitution is to be made without the prior written approval of the CO/COR. No increases in Call order pricing will be allowed when substitutions are authorized by the Government.

(b) Personnel possessing unique technical specialties may be required for certain services related to the acquisition tasks. Such personnel shall have qualifications as required by the applicable tasks and approved by the CO/COR, which are appropriate to the nature of the services that will be provided.

(c) The CO will have the right to effect removals of any Contractor employees working under any Call order at any time during the life of the BPA, if those employees are deemed not to possess the proper level of competence or abilities, or otherwise found to be unsuitable for work required. In such cases, the Contractor must promptly submit the names and any other information pertinent to approvals of substitutions if requested.

(d) Failure or delays by the Contractor in providing qualified personnel who meet the stated requirements of this acquisition, may be deemed sufficient reason by the COR to recommend termination for cause to the CO.

The Contractor shall provide the CO with a primary and alternate administrative point of contact (POC) after award. One of these points of contact must be a Contract Executive. The Contractor shall notify USDA RD of any changes in contact information as expeditiously as possible.

17. Compliance with IT Security Policies:

• Information systems and system services provided to USDA by the Contractor must comply with the current USDA/ IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

• Contractors are also required to comply with current Federal regulations and guidance found in the:

o Federal Information Security Modernization act of 2014 (FISMA) o Privacy Act of 1974; E-Government Act of 2002, Section 208 o National Institute of Standards and Technology (NIST) Federal Information Processing

Standards (FIPS) o 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch

Management Technologies o Office of Management and Budget (OMB) memoranda o USDA Information Security Program policies, and other relevant Federal laws and regulations with which USDA must comply.

• USDA departmental regulation DR 3575-002, System, and Information Integrity (08/16/18), mandates that information technology development projects follow the USDA RD accepted System Development Lifecycle (SDLC). All projects with congressional visibility can expect to be audited for compliance. Other projects may be audited at USDA RD discretion. Audits may occur at any time.

• Contractors are required to protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the Contractor must review and remediate the vulnerabilities and then present the results for Government approval within the timeframes documented in USDA IT security policies.

• Zero Trust Security:

o Refer to NIST Special Publication 800-207 Zero Trust Architecture.

o National Institute of Standards and Technology | NIST

18. Special Considerations:

Contractor Collaboration: At the CO’s direction, the Contractor may be required to work in conjunction with other vendors. In addition, the Contractor may be required to meet and work with said other vendors regularly.

However, it is expected that vendor collaboration working meetings would not be more frequent than twice a week at a duration of not more than 3 hours per meeting. These meetings may be obligatory to address project issues/concerns/improvements, etc. Collaboration working meetings are in addition to the meetings listed in the deliverables table.

At the CO’s direction, the Contractor may be required to provide PMO ad hoc status reports in addition to any status reports in the deliverable table.

This authority shall not be delegated to any COR.

Meetings: Please be advised that most acquisition meetings are held in Microsoft TEAMS. Meetings may be recorded for the contract file. The COR or CO is to set up meetings in TEAMS to facilitate meeting transcripts.

19. Organizational Conflict of Interest (OCI):

Contractor and subcontractor personnel performing work under this acquisition may receive, have access to proprietary or information (e.g., cost/pricing, specifications, work statements, etc.) or perform services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.nist.gov/

20. Data Rights:

The Government has unlimited rights to all documents/material produced under this IDIQ and subsequent IDIQ Task Orders. All documents and materials produced under this acquisition shall be Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. This right does not abrogate any other Government rights.

21. USDA Visual Identity Guidelines:

All visual materials intended for release to the public, both electronic and printed, delivered in the performance of this contract, must wholly conform to the current USDA Rural Development Visual Identity Guidelines. See attachment, “USDA Visual Identity Guidelines”.

22. Constraints or Assumptions:

Contractor shall adhere to USDA Digital Strategy, US Web Design Standards, and Chief Information Officers Council (CIO.gov) policies and priorities.

PRINCIPLES AND DESIGN STANDARDS

The Contractor shall:

Manage the project using the Scaled Agile Framework (Safe) principles.

Include the Federal CIO Digital Services Playbook Play into the delivery model to the greatest extent possible.

Include the Federal Design standards (https://standards.usa.gov/) into the product build to the greatest extent possible.

Utilize USDA and Federal Web Design standards (https://designsystem.digital.gov/design-principles/) and best practices into the product build, to the greatest extent possible (I.e., 508 Standards).

Where possible, reuse purchased or licensed Commercial Off-the-Shelf (COTS) products that integrates with the current RD Technology stack which includes Salesforce and MuleSoft solutions including but not limited to: FICO Blaze, ESRI ArcGIS, RD Salesforce objects, MuleSoft APIs, and others.

Apply Mortgage Industry Standards Management Organization (MISMO®) to origination, servicing, and appraisal activities.

Utilize USDA eAuth and SAML SSO capabilities as the current authentication.

Store all requirements, planning, and source code in the RD IT Tool Chain: Jira, Confluence, Bitbucket, Jenkins, and Selenium.

Develop all products using pertinent tools and methodology for Continuous Integration

Continuous Delivery (CI/CD).

Utilize DevOps functionality and the RD branching strategy to manage development changes to Sprint Releases.

Coordinate with the Technology Office team on regular basis for status updates, solution architectural discussions and decisions confirming alignment to the RD Future State Architecture, development standards alignment to include Technology (i.e. SalesForce, Java, .Net) object governance, process improvements and all other topics.

SECURITY SUPPORT

The Contractor shall:

Complete development, testing, and deployment of user stories in the product backlog for implementation of the application intake portal, back-end integration, COTS solution, https://standards.usa.gov/ https://designsystem.digital.gov/design-principles/ https://designsystem.digital.gov/design-principles/ change requests and ATO approval criteria. Approval of changes to the user stories will be agreed upon by the SFHD, RD Technology Office, COR, and CO.

Support extension of the ATO to account for any new accreditation boundary changes from this project.

Provide support for integration of security requirements throughout each development cycle.

Provide support for USDA/RD internal vulnerability assessments and timely remediation of the security findings.

Provide support for USDA/RD POA&M process and timely resolution.

Provide support for independent testing such as Assessment and Authorization (A&A) security testing and 508 compliance testing by teams both inside and outside of the

USDA/RD.

TECHNICAL LANDSCAPE

USDA RD currently leverages the products below to maintain our project management, mission, financial and reporting capabilities. The project management tools (JIRA Data Center, Confluence Data Center) are required for use by the Contractor. The Cyber security tools (SonarQube) are required for use by USDA RD.

The source code repository is also available, optional, and not required for use by Contractor based upon discussion and agreement by USDA RD. All other products are available for potential integration point solutions per Contractor proposal on design and USDA RD approval.

NAME MANUFACTURER FUNCTION

MuleSoft Anypoint MuleSoft Integration Layer

Salesforce DX Salesforce Continuous integration continuous delivery

Salesforce GovCloud Salesforce User Experience and User Interface layer

Tableau Salesforce Reporting Service

Informatica Informatica Extract Transform and Load (ETL)

Oracle OBIEE Oracle Reporting Service

BitBucket Data Center

Atlassian Source code version control repository

Jenkins Atlassian / Open Source Automate build, test, and deploy used for continuous delivery

Jira Data Center Atlassian Project and issue tracking

Confluence Data Center

Atlassian Document and collaboration

SonarQube SonarSource Application static and dynamic application security scanning

Selenium Selenium Test Script creation and Execution

Visual Studio Code Microsoft Integrated Development Environment

JBoss Developer Studio

IBM IDE for JAVA development

Java EE 1.8 Oracle Some RD applications

NOTE: Please refer to Scanning and Remediation of Configuration and Patch Vulnerabilities for guidance on security scanning (https://www.usda.gov/directives/dr-3530-006).

23. Order of Precedence:

In the event of inconsistencies, between the Contractor’s proposal/quote and PWS, the required work specified in this PWS will take precedence over the Contractor’s proposal/quote.

24. Service Contract Labor Standards (SCLS) (Formerly known as the Service Contract Act of 1965)

Applicability:

Contractors are to quote based on any wage determination that may be applicable per SCLS. It is the Contractor’s responsibility to review its employee roles that may be employed during administration of the ensuing contract and/or its tasks orders in context of the SCLS for potential labor categories covered under the SCLS.

This is not a labor hour contract. The contractor is to propose its own labor category mix based on the tasks included in this PWS.

Contractor awardee may want to contact its legal advisor to provide itself more information.

FAR 52.222-41 and FAR 52.222-43 are included as clauses in this acquisition that will carry over to the contract.

Wage determinations will be provided to the awardee based on the Contractor awardee’s proposed locations, as well as any updated ones as required per any exercised option.

The Contractor awardee will be responsible for ensuring that its personnel subject to the SCLS meet or…