PWS_ABMC.GOV Website OM v6 FINAL.pdf

AMERICAN BATTLE MONUMENTS COMMISSION

PERFORMANCE WORK STATEMENT

FOR

ABMC.GOV WEBSITE OPERATIONS & MAINTENANCE

April 02, 2026

Contents About ABMC

Overview

Site Architecture

Quality Control

CLIN 1 – Website and Infrastructure Support and Maintenance

CLIN 1 Deliverables

CLIN 0002 and 0003 (Optional): Website Theme Update and Implementation

Project Objectives

Scope of Work

Design & Theming

Content Migration & Compatibility

Plugin & Functionality Integration

Performance & Security Optimization

Testing & Quality Assurance

Deployment & Go-Live Support

CLIN 2 & 3 Deliverables

Requirements:

Acceptance Criteria:

CLIN 0004 (Optional): Deploy and Support Artificial Intelligence (AI) Chatbot

Objectives

AI Chatbot Functionality

Technical Requirements

Visual Experience, User Experience & Interface

Deployment & Testing

CLIN 4 Deliverables

Project Requirements:

Acceptance Criteria

CLIN 005 (Optional) – Comprehensive Website Assessment

CLIN 006 (Optional) – Implementation of Approved Tasks from CLIN 0005

Contract Line Item Numbers (CLINs)

Proposal Response Template

Evaluation Criteria

Service Level Agreement

Assumptions

Kickoff Meeting

Contractor Background

Period of Performance

Place of Performance

Federal Holidays

Additional Considerations

Information Security Requirements

NIST and FIPS Compliance

Protection of Information

Confidentiality and Non-Disclosure

Appendix A – Performance Metrics – Website Maintenance

Appendix B – Performance Metrics – Website Support

Appendix C - Condensed list of application on ABMC.gov

About ABMC The American Battle Monuments Commission (ABMC) is an independent agency established under authority of Chapter 21 of Title 36 U.S.C. Its mission is to commemorate the sacrifices and achievements of the United States armed forces. It accomplishes this mission through the administration, operation, and maintenance of commemorative cemeteries and memorials in 17 countries around the world, including the United States. ABMC is also responsible for establishing and maintaining new memorials as directed by Congress. The Commission is composed of up to 11 members appointed by the President and a Secretary of the Commission, who is also a Presidential appointee. The Secretary is responsible for the day‐to‐day operation of the Commission.

The agency’s workforce consists of approximately 500 staff located at offices in Arlington, Virginia;

Paris, France; and at 26 cemeteries in 10 countries.

Overview ABMC has an immediate need for Operations and Maintenance Support for its new WordPress-based public website launched on March 03, 2025. The new site provides a redesign of the former Drupal-based website (decommissioned on March 3, 2025) and contains updated materials including news articles, multimedia, events, cemetery details, education content, publications and a burial and memorialization database.

Contractor shall perform the following CLINs:

1. CLIN 1 – Operations and Maintenance of the entire website and its cloud infrastructure.

2. CLINs 2 & 3 Optional – Separate projects to implement facelifts of visual design and layout, including new content and some redesign or overhaul of functionalities of the website at approximately 2-3 year intervals to keep the site modern and consistent with the agency’s public engagement objectives.

3. CLIN 4 Optional – Project to implement generative artificial intelligence.

4. CLIN 5 Optional – A comprehensive site assessment designed to evaluate its visual design, infrastructure, plugin architecture, WordPress implementation, accessibility compliance, security, and performance. The goal is to identify actionable recommendations that enhance high availability, accessibility, security, performance, and overall user experience.

5. CLIN 6 Optional – A project to implement ABMC-approved recommendations resulting from CLIN 5 recommendations. The scope will be based on the prioritized action items selected by ABMC and may include improvements to infrastructure, code, design, content, accessibility, or security.

ABMC requires a qualified contractor to have personnel that are cleared and favorably NACI adjudicated by ABMC to provide comprehensive website support and maintenance services for its public website and its infrastructure. The contract includes a base year and seven (7) option years. Contractor shall provide personnel that can be favorably adjudicated by ABMC to start work no later than June 15, 2025.

Site Architecture The ABMC.gov WordPress website is hosted on Microsoft Azure Web App Services. The infrastructure consists of:

1. Azure Front Door Premium - Manages traffic routing and provides DDoS protection.

2. Azure Web App Service - Hosts the WordPress-based website with auto-scaling enabled.

3. Azure MySQL Database - Migrated from Drupal and optimized for WordPress queries.

4. Azure Blob Storage - Stores media files for scalability and performance.

5. Azure Content Delivery Network (CDN) - Ensures fast loading times globally.

6. Azure Monitor & Security Center - Provides real-time monitoring and security compliance.

Technology Stack The website uses the following general applications and infrastructure. A more detailed list is detailed in Appendix C.

Component Technology Used

CMS WordPress

Primary Plugins Elementor Pro, ACF Pro

Hosting & Storage Azure Web App Service and Azure Blob Storage

Database MySQL

Security Azure Front Door Premium, WordFence Pro

SEO & Analytics Google Tag Manager, Yoast, Google Analytics

Quality Control The WordPress site has been tested under rounds of user acceptance testing for the following:

1. Functional Testing: Ensured navigation, forms, and dynamic content function properly.

2. Cross-Browser Testing: Validated across Chrome, Firefox, Edge, Safari.

3. Mobile Responsiveness: Tested across iOS and Android devices.

4. Performance Testing: Optimized page load speed & caching mechanisms.

5. Security Testing: Verified SSL, firewall rules, and access controls.

6. Database Failover Testing: Ensured automatic failover for MySQL.

7. User Acceptance Testing (UAT): Validated with ABMC stakeholders before launch.

CLIN 1 – Website and Infrastructure Support and Maintenance

Contractor shall provide support and maintenance for the ABMC.gov website and its cloud infrastructure.

Services shall ensure security, availability, compliance, and alignment with ABMC’s communication needs. Work includes Azure monitoring, WordPress administration, content updates, SEO management, system backups, development, accessibility management, and technical support.

Contractor personnel must include project managers, WordPress developers, visual/user experience specialists, Azure specialists, and accessibility experts.

Specifically, Contractor shall perform the following tasks:

1. Azure Maintenance and Monitoring

• Monitor site infrastructure to maintain 99.99% uptime (excluding Azure Web App elements under Microsoft SLA).

• Identify, respond to, and resolve infrastructure issues.

2. WordPress Updates and Security Patching

• Test, deploy, and manage WordPress core updates, plugins, themes, and replacements.

• Maintain website on the latest stable WordPress version.

• Plan and execute all version upgrades (minor and major).

• Verify updates align with CMS and cybersecurity standards.

3. Site Maintenance and Optimization

• Conduct scheduled maintenance to support site operation and performance.

• Optimize site performance, including load times, caching, and database efficiency.

• Ensure compliance with applicable security guidelines.

4. Quality Assurance and Testing

• Conduct functionality testing across all browsers and devices.

• Ensure compatibility with existing responsive themes.

• Identify, coordinate, and implement SEO recommendations (e.g., SiteImprove) with ABMC.

5. Backup and Disaster Recovery

• Perform and verify quarterly backups of site content and infrastructure.

• Store backup files in ABMC’s cloud storage.

• Conduct annual disaster recovery testing, updating recovery procedures as needed.

6. WordPress Development and Customization

• Modify site structure and content layouts as directed by ABMC Public Affairs and IT teams.

• Develop and implement changes to user interfaces, databases, APIs, and site branding.

• Develop modules and integrations per ABMC requirements.

• Maintain code repositories within ABMC’s Azure DevOps environment.

• Update system documentation (including enterprise architecture diagrams).

7. CMS Administration and General Support

• Provide ongoing CMS support to ABMC Public Affairs team.

• Assist with content updates, page structure modifications, and media management.

• Maintain and regularly update the Section 508 sitemap inventory.

8. Specialized WordPress Support for ABMC IT

• Ticketing and SLA Management:

Operate a structured support ticketing system and meet defined service-level agreements.

• Testing and Validation:

Conduct functional, security, and performance testing before deployments.

• Content and SEO Management:

Support ABMC IT in updating text, images, multimedia content, and implementing SEO improvements.

• Disaster Recovery (DR):

Support ABMC’s annual disaster recovery testing and perform necessary system changes to meet recovery objectives.

• Technical Troubleshooting:

Resolve technical issues, including bugs, performance problems, and integration errors.

• Compliance and Best Practices:

Ensure ongoing adherence to federal website standards (Section 508, cybersecurity) and established best practices for WordPress and Azure.

CLIN 1 Deliverables

Deliverable Frequency Medium/Format/# of Copies

Submit To

Kick Off Meeting Within five (5) business days of award

In person or remote. Consult with CO and COR, to schedule

Monthly Patch Rollout Plan

By the 15th of every month

Via email. OCIO@abmc.gov and Contracting Officer

Monthly Service/Ticket Status Report or Dashboard

By the 15th of every month

Monthly Service Status Call or Dashboard

By the 15th of every month

Remote Meeting. OCIO@abmc.gov and

Monthly Performance & Security Report or Dashboard

Monthly Via email. OCIO@abmc.gov and

Monthly Verification & Validation of and Updates to Section 508 Sitemap Inventory

Monthly Via email OCIO@abmc.gov and mailto:OCIO@abmc.gov mailto:OCIO@abmc.gov mailto:OCIO@abmc.gov

Backup & Disaster Recovery Test Results

Quarterly Via email. OCIO@abmc.gov and

Website Compliance Review such as Section 508 Audits and Results

Annually Via email. OCIO@abmc.gov and

Updated As-built Documentation

Within 14 business days after implementation

Via email OCIO@abmc.gov

Risk Management Plan for potential failures in hosting, database corruption, disaster recovery, or security breaches.

90 calendar days after award and updated at least annually.

Online ticketing system

Within five (5) business days of award

Online to ABMC-assigned users.

Problem Escalation Matrix

Within 2 business days of kickoff

Updated Problem Escalation matrix which includes names, emails, phone numbers of support desks or staff responsible for service support and operations.

OCIO@abmc.gov and mailto:OCIO@abmc.gov mailto:OCIO@abmc.gov

CLIN 0002 and 0003 (Optional): Website Theme Update and Implementation ABMC plans to update the website’s design and layout up to two times during the contract period, approximately once every two to three years. These updates will include refreshed visuals (i.e. WordPress themes), new content, and improvements to site functionality. Each redesign will be treated as a separate project and will only proceed if requested by the Contracting Officer.

Project Objectives The contractor shall update the website’s design, usability, performance, and accessibility while ensuring that existing content and core functionalities remain intact. This project focuses on refreshing the site's look and functionality, not a full redesign. Contractor shall:

• Apply a modern, responsive WordPress theme to enhance visual appeal and usability.

• Improve visual experience (VX) and user experience (UX) and ensure compliance with WCAG

2.1 and Section 508 accessibility standards.

• Optimize the site for performance, mobile responsiveness, and SEO.

• Review and determine which existing content and features should be maintained, updated, or removed.

• Develop and integrate new content, graphics, media, and functional enhancements.

• Ensure compatibility with WordPress plugins, APIs, and third-party services.

• Provide training and documentation for website administrators and content managers.

• Assess existing Azure resources and implement necessary updates to support site scalability and performance improvements.

Scope of Work The contractor shall complete the following tasks to update the website’s design and functionality:

Design & Theming

1. Theme Development or Selection: Choose or create a custom WordPress theme that aligns with project requirements, such as ABMC’s upcoming 105th and 110th anniversaries in 2028 and 2033, respectively.

2. Branding & Styling: Apply ABMC’s branding guidelines, including specified colors, fonts, and layout adjustments for consistency.

3. New Design Elements: Create up to three (3) new designs, including graphics, multimedia elements, and content updates. Develop custom page templates for the homepage, landing pages, and other key sections.

4. Structural Enhancements: Improve the appearance and functionality of headers, footers, navigation menus, and sidebars for better user experience.

5. Review & Refinement Process: Conduct three (3) structured rounds of reviews, covering:

o High-Definition Design Reviews: Evaluate and refine the overall look and feel.

o Wireframe Reviews: Assess and adjust layout structures before development.

o Content Reviews: Ensure accuracy, clarity, and proper formatting of website content before finalization.

Content Migration & Compatibility

1. Ensure all existing pages, blog posts, and media files remain intact.

2. Implement automated and manual content migration if required.

3. Optimize existing and new content for SEO and readability.

4. Validate all internal and external links post-migration.

5. Validate, verify, and update Section 508 sitemap inventory.

Plugin & Functionality Integration

1. Evaluate Azure resources as-built and fully implement new Azure resources to scale with any changes in requirements as part of the retheming initiative.

2. Ensure compatibility with essential WordPress plugins (Yoast SEO, Elementor, WPForms, etc.).

3. Implement new plugins for enhanced functionality as needed.

4. Remove existing plugins if no longer needed and perform data migration and/or cleanup.

5. Test third-party integrations (APIs, payment gateways, CRM, analytics, etc.).

Performance & Security Optimization

1. Optimize site speed and performance by minimizing CSS, JavaScript, and image sizes.

2. Ensure compatibility with caching solutions (W3 Total Cache, WP Rocket, etc.).

3. Enhance security with WordPress hardening best practices.

4. Conduct vulnerability scanning and penetration testing.

Testing & Quality Assurance

1. Cross-browser testing for compatibility with Chrome, Firefox, Edge, and Safari.

2. Mobile responsiveness testing for various devices and screen sizes.

3. Functional testing for forms, navigation, search, and interactive elements.

4. SEO validation using schema markup, metadata, and structured data.

5. Accessibility testing to meet WCAG 2.1 and Section 508 compliance.

Deployment & Go-Live Support

1. Set up staging environment for pre-launch testing.

2. Migrate theme and final configurations to the production environment.

3. Conduct final checks for performance, security, and functionality.

4. Provide post-launch support for forty-four (44) working days (approximately 60 calendar days).

CLIN 2 & 3 Deliverables

1. New WordPress theme implementation and customization.

2. New design mockups and wireframes, graphics, and content.

3. Content migration and optimization.

4. Integration of existing and new plugins.

5. Performance, security, and SEO improvements.

6. Testing and quality assurance report.

7. Deployment and post-launch support.

8. Administrator training and documentation.

9. Staging environment setup and pre-launch testing report.

10. Final compliance review and security audit report.

11. Final accessibility testing to meet WCAG 2.1 and Section 508 compliance scan result and report.

12. Updated Section 508 Sitemap Inventory.

13. Updated as-built documentation.

14. User experience enhancements and feedback implementation.

Requirements:

1. Conduct compatibility testing and recommend solutions.

2. Implement and customize the selected WordPress theme.

3. Ensure content, plugins, and integrations remain functional.

4. Conduct performance optimization and security hardening.

5. Conduct User Acceptance Testing and quality control.

6. Provide training materials and ongoing support.

7. Ensure there is no loss of functionalities of the site, such as SEO ranking, plug-ins, etc.

Contractor shall implement 301 redirects, metadata preservation, and SEO best practices.

8. Perform post-launch cleanup activities (e.g., decommission system resources).

9. Offer post-launch support and iterative fixes as part of CLIN 1 scope.

Acceptance Criteria:

1. The new theme is successfully deployed and fully functional.

2. The website maintains all existing content, features, and integrations.

3. Performance and security optimizations are fully implemented.

4. The website passes User Acceptance Testing (UAT) and final quality checks.

CLIN 0004 (Optional): Deploy and Support Artificial Intelligence (AI) Chatbot ABMC anticipates expanding the capability of the website by adding generative Artificial Intelligence (AI) capabilities to enhance the user experience. Contractor shall plan, implement, and support ChatGPT Gov or an equivalent AI-powered chatbot on a WordPress-based website. The AI chatbot will enhance user engagement, streamline customer service, and improve accessibility by providing automated assistance for public inquiries.

Objectives

1. Plan and deploy an AI-powered chatbot to provide automated responses to user queries.

2. Integrate with existing WordPress CMS and relevant databases.

3. Ensure compliance with government security and accessibility standards (Section 508, WCAG 2.1, NIST cybersecurity guidelines).

4. Optimize for performance, uptime, and scalability.

5. Provide training and documentation for system administrators and content managers.

6. Provide operations and maintenance support for the deployed generative AI tool(s).

AI Chatbot Functionality The AI chatbot will include the following capabilities:

• Natural Language Processing (NLP): Ability to understand and respond to user inquiries in a conversational manner.

• Predefined Knowledge Base: Access to a curated database of FAQs, policies, and informational content.

• Live Agent Handoff: Seamless transfer to a live ABMC representative for complex queries.

• Multilingual Support: Ability to respond in multiple languages.

• Secure Authentication (Optional): Integration with Single Sign-On (SSO) for authenticated user interactions.

• Analytics & Reporting: Dashboard to track user interactions, common queries, and chatbot effectiveness.

Technical Requirements

• Hosting & Infrastructure: Deployed within the existing WordPress Azure Web App Service infrastructure.

• Integration:

o API connectivity to ABMC Burial Search API, Data.gov JSON API, or other relevant databases.

o Compatibility with existing WordPress plugins and theme structure.

o Webhook & REST API support for third-party system integrations.

• Security Measures:

o Compliance with FedRAMP, NIST, and government cybersecurity standards.

o Implementation of data encryption (e.g. TLS 1.2/1.3), access controls, and logging mechanisms.

o Protection against malicious bot activity, injection attacks, and data breaches.

Visual Experience, User Experience & Interface

1. Customizable Chat Widget:

o Design aligns with ABMC.gov website branding.

o Positioning, color schemes, and UI customization.

2. Responsive Design:

o Mobile-friendly interface for iOS and Android users.

3. Accessibility Features:

o Adherence to WCAG 2.1 standards for text-to-speech and keyboard navigation support.

Deployment & Testing

• Staging Environment Testing:

o Deploy and test within a sandbox environment before production release.

o Performance testing under high-traffic scenarios.

• Security & Compliance Testing:

o Conduct penetration testing and vulnerability scans.

o Implement GDPR & CCPA compliance for data privacy.

• User Acceptance Testing (UAT):

o Collect feedback from internal stakeholders and end users.

o Make necessary refinements before full deployment.

CLIN 4 Deliverables The following deliverables will be provided:

1. AI Chatbot Software Installation & Configuration

2. WordPress Integration & API Connectivity

3. Security & Compliance Certification Documentation

4. End-User and Administrator Training Materials

5. Go-Live Support & Post-Deployment Monitoring

6. Final Implementation Report

Project Requirements:

• Develop and integrate the AI chatbot into WordPress.

• Conduct security audits and ensure regulatory compliance.

• Conduct User Acceptance Testing (UAT) and implement quality control.

• Provide documentation and training for content managers and administrators.

• Offer post-deployment monitoring and support for at least 30 days after launch.

• Develop risk management and contingency plan such as:

o Ensuring that AI chatbot integrates properly with WordPress AI. Conduct pre-deployment API testing and performance validation.

o Assess security vulnerabilities and mitigation measures to ensure no sensitive data is exposed, including implementation of end-to-end encryption, access control, and auditing capabilities.

o Conduct user training sessions for both internal and external site users, such as walk-throughs, live demonstrations, etc.

Acceptance Criteria

• Chatbot successfully deployed and functional on ABMC.gov.

• Meets all security and accessibility compliance standards.

• Successfully integrated with WordPress and relevant APIs.

• Passes User Acceptance Testing (UAT) and performance validation.

CLIN 005 (Optional) – Comprehensive Website Assessment Contractor shall evaluate ABMC.gov to identify areas for improvement in design, infrastructure, plugins, WordPress implementation, security, accessibility, and performance.

Work Requirements:

Contractor shall provide necessary personnel and tools to perform:

1. Design Review: Assess visual design for consistency and adherence to ABMC and Federal government branding guidelines.

o Ensure site is mobile responsive and reflects ABMC Public Affairs Office’s guidance.

o Ensure compliance with the U.S. Web Design System (USWDS) Design Principles.

2. Technical Evaluation: Analyze WordPress configuration, plugin usage, and custom code.

o Review hosting infrastructure on Azure for performance and scalability.

3. Accessibility Audit: Evaluate compliance with Section 508 and WCAG 2.1 standards.

o Utilize the Accessibility section of the federal checklist to guide the assessment.

4. Security Assessment: Mitigate website site vulnerabilities.

https://designsystem.digital.gov/design-principles/ https://digital.gov/resources/checklist-of-requirements-for-federal-digital-services/#accessibility o Ensure alignment with the Security requirements outlined in the federal checklist.

5. Content and SEO Analysis: Update approved site contents for clarity, accuracy, and relevance.

o Assess search engine optimization and analytics configurations.

Deliverables:

Contractor shall provide:

1. Assessment Plan: Outline of assessment objectives, methodologies, and timelines.

2. Design and UX Report: Findings on visual design consistency and user experience.

3. Technical Analysis Report: Evaluation of WordPress setup, plugins, and hosting environment.

4. Accessibility Compliance Report: Detailed findings on accessibility compliance and recommended remediation steps.

5. Security Assessment Report: Identification of security vulnerabilities with suggested mitigation strategies.

6. Content and SEO Report: Analysis of content quality and SEO effectiveness.

7. Recommendations Matrix: Prioritized list of actionable recommendations with estimated costs and timelines.

8. Executive Summary: Concise overview of key findings and recommendations.

Acceptance Criteria:

• Deliverables submitted in draft for review; one round of revisions to be incorporated.

• Final reports to provide clear, actionable recommendations.

• Recommendations matrix to include time and cost estimates.

• Executive summary to be delivered within 10 business days of final report approval.

• Acceptance upon written approval from the Contracting Officer's Representative (COR) after ABMC review.

Pricing Type:

Firm Fixed Price https://digital.gov/resources/checklist-of-requirements-for-federal-digital-services/#security

CLIN 006 (Optional) – Implementation of Approved Tasks from CLIN Contractor shall implement ABMC-approved recommendations from the CLIN 0005 assessment to enhance the website's design, infrastructure, functionality, security, and compliance.

Scope

Contractor shall provide necessary personnel and tools to perform:

1. Planning: Develop an implementation plan for the approved changes outlined in CLIN 005, detailing tasks, timelines, and responsibilities.

2. Execution: Implement approved changes in a staging environment.

3. Conduct thorough testing to ensure functionality, security, and compliance with federal requirements.

4. Deployment: Upon ABMC approval, deploy changes to the production environment.

5. Documentation: Update all relevant documentation to reflect changes made.

Deliverables:

Contractor shall provide:

1. Implementation Plan: Detailed schedule and task assignments.

2. Staging Environment Deployment: Fully functional implementation in a test environment.

3. Testing Reports: Results from functionality, security, and accessibility testing.

4. Production Deployment: Successful deployment of approved changes to the live site.

5. Updated Documentation: Revised technical and user documentation reflecting implemented changes.

6. Final Implementation Report: Summary of work completed, including before-and-after assessments.

Acceptance Criteria:

ABMC will use the following criteria to assess Contractor deliverables:

• Implementation plan approved by ABMC prior to commencement.

• All staging deployments to pass quality controls by Contractor, and quality assurance by ABMC.

• Successful production deployment with minimal downtime.

• Comprehensive and accurate documentation updates.

• Final implementation report submitted and approved by the COR.

Contract Line Item Numbers (CLINs)

CLIN Description Period Pricing Type

0001 Website Support & Maintenance (Base Year) Base Year Firm Fixed Price

1001 Website Support & Maintenance (Option Year 1) 12 Months Firm Fixed Price

2001 Website Support & Maintenance (Option Year 2) 12 Months Firm Fixed Price

3001 Website Support & Maintenance (Option Year 3) 12 Months Firm Fixed Price

4001 Website Support & Maintenance (Option Year 4) 12 Months Firm Fixed Price

5001 Website Support & Maintenance (Option Year 5) 12 Months Firm Fixed Price

6001 Website Support & Maintenance (Option Year 6) 12 Months Firm Fixed Price

7001 Website Support & Maintenance (Option Year 7) 12 Months Firm Fixed Price

0002 Optional – Website Appearance Redesign #1 TBD Firm Fixed Price

0003 Optional – Website Appearance Redesign #2 TBD Firm Fixed Price

0004 Optional – Generative AI Integration & Support TBD Firm Fixed Price

005 Optional – Comprehensive Website Assessment 1 month Firm Fixed Price

006 Optional – Implementation of Approved Recommendations from CLIN 0005 3 months Firm Fixed Price (to be quoted upon completion of CLIN 5)

Proposal Response Template Proposal Instructions

Proposals shall not exceed 30 pages, excluding appendices and pricing spreadsheet.

Section 1: Executive Summary

• Summary of the approach to website maintenance and support and site redesign.

• Key differentiators of the proposed solution.

Section 2: Technical Approach

• Proposed ticketing system and SLA for Critical, High, Medium and Low priority tickets, including vendor-proposed penalties for not meeting SLA terms.

• Approach to Azure maintenance, WordPress patching, software updates.

• Quality assurance, testing methodologies, backup & recovery plans.

• Security and compliance strategy.

Section 3: Key Personnel & Past Performance

• Resumes of key personnel with background check, including any certifications in Microsoft Azure, WordPress and relevant technologies.

• Relevant past projects demonstrating experience in similar contracts.

Section 4: Price Proposal

• Detailed pricing for each CLIN.

Section 5: Compliance Matrix

• Statement of compliance with Federal standards.

• Adherence to WordPress and Microsoft Azure best practices.

All services must meet Federal security and accessibility compliance standards.

Evaluation Criteria Award will be made based on a best value determination considering the following factors:

Criteria Sub-Criteria

Past Performance – 20% Experience in providing similar initiatives & solutions (i.e., Enterprise Internet strategy and design on WordPress Platform).

Contractor shall provide three (3) client references for whom Azure infrastructure, WordPress design upgrade, and WordPress on Azure services support have recently been implemented with similar criteria.

The contact details must include the contact number and email addresses.

The references must not be older than 36 months from the date of the RFP submission. ABMC may verify the scope provided, and if your referee does not confirm the scope, the reference will not be considered.

Solutions Approach – 40% Provide full details of the proposed installation for the maintenance and support of ABMC.gov.

• Technical design of the solution.

• Proposed Quality Assurance Approach (e.g., User Acceptance

Plan and Tests, Data Migration Verification & Validation Plan, milestones, deliverables, etc.)

• A comprehensive presentation of service meeting or exceeding the PWS requirements.

Proposal Technical – Relevancy and Page Limit – 5%

Proposal directly responds to specified requirements and objectives.

Entire proposal must not exceed 30 pages, not including Appendices and pricing proposal.

Competencies – 15% Demonstrated relevant certifications and competencies in Azure, web development, WordPress Content Management System, etc.

Price – 20% The price is fair and reasonable to the US Government.

Service Level Agreement Contractor shall provide a proposed Service Level Agreement (SLA) for reported tickets and issues as part CLIN 1.

Assumptions

1. Contractor personnel working on this contract shall sign Non-Disclosure Agreements (NDA) furnished by the ABMC.

2. All Contractor personnel working on the contract shall hold appropriate and current technical certifications.

3. All deliverables shall be presented to the ABMC for acceptance in secure electronic format.

4. The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Kickoff Meeting Contractor shall schedule no later than five (5) business days after the award of this contract.

Contractor Background Contractor personnel must possess an active clearance or pass a background check.

Period of Performance

• Base Year: June 15, 2025 – June 14, 2026

• CLIN 002 to 006: TBD as negotiated with ABMC

• Option Year 1: June 15, 2026 – June 14, 2027

• Option Year 2: June 15, 2027 – June 14, 2028

• Option Year 3: June 15, 2028 – June 14, 2029

• Option Year 4: June 15, 2029 – June 14, 2030

• Option Year 5: June 15, 2030 – June 14, 2031

• Option Year 6: June 15, 2031 – June 14, 2032

• Option Year 7: June 15, 2032 – June 14, 2033

Place of Performance Work will be performed remotely.

Federal Holidays The list of observable US Federal Holiday is available on the OPM website:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

Additional Considerations In addition to scheduled holidays, ABMC observes any additional days designated by U.S. Federal Statute, Executive Order, or Presidential Proclamation.

• Any other day designated by Federal Statute, Executive Order, or a President's Proclamation

• ABMC staff will not be available to support project activities during the following periods due to local and organizational holidays:

• Approximately mid-December 2025 to mid-January 2026 globally

• Approximately three weeks in August 2025 in European sites

Contractor shall account for these availability restrictions when developing the detailed project implementation schedule and milestones. ABMC will confirm specific unavailable dates at the project kickoff meeting and subsequent project meetings. Contractor must adjust work schedules accordingly to avoid delays.

Information Security Requirements

NIST and FIPS Compliance All work that is associated with government information, systems, and information security shall be compliant with the Federal Information Security Modernization Act of 2014 as implemented by Federal Information Processing Standards Publication 200 (FIPS 200), “Minimum Security Requirements for Federal Information and Information Systems.” This standard specifies minimum-security requirements Federal agencies must meet. The appropriate security controls and assurance requirements to be selected are described in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems and Organizations” and associated documents. Specific impact levels required (per FIPS 200) for government information and information systems may vary and will be specified as requirements are identified.

Protection of Information The contractor shall be responsible for properly protecting all information used, gathered, or developed as the result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract is required to be considered as CUI. It is anticipated that this information will be gathered, created and stored within the primary work location. If contractor personnel must remove any information from the primary work area they shall protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=2020

The contractor shall be responsible for complying with the requirements of the Privacy Act, 5 U.S.C.

552a, as well as any relevant OMB Directives. The Contractor shall abide by and follow all Agency security and privacy policies, procedures, processes, and standards. In addition to complying with applicable system security requirements, the contractor shall be responsible for protecting all records containing PII from unauthorized access through appropriate administrative, technical, and physical safeguards. Access shall be restricted on a ‘‘need to know’’ basis. Contractor employees shall complete all requisite training specific to their roles to ensure they are knowledgeable about how to protect PII (to be provided upon award). The contractor shall safeguard all equipment and information it is provided.

All sensitive information in hard copy and on diskettes shall be secured and locked in appropriate cabinets when unattended. All electronically stored sensitive data shall be encrypted using FIPS validated crypto suites.

The contractor shall be familiar with all public Federal mandates, laws, Department policies, and procedures (i.e., technical, management, and operational security controls) and conform to application and system security no later than 30 business days following the award date.

Protection of the Agency’s business information and Personal Identifiable Information (PII) is essential and a basic requirement for compliance with OMB Directives and federal regulations, such as OMB M- 06-16, OMB M-07-16, FIPS 201, FIPS 140-2, and Federal Information Security Modernization Act

(FISMA).

Confidentiality and Non-Disclosure The preliminary and final deliverables, all associated working papers, and any other materials generated by the contractor in the performance of this task order are the property of the U.S. Government and must be submitted to the COR at the conclusion of the task order. All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the contractor. All appropriate project documentation will be given to ABMC during and at the end of this contract. The contractor shall not release any information without the written consent of the Contracting Officer. Any request to the contractor for information relating to the resulting Task Order must be submitted to the Contracting Officer for approval prior to release.

Personnel working on any of the described tasks, at the Government’s request, shall sign formal nondisclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents

The contractor’s employees assigned to any task order under this task order shall be required to sign contract specific Nondisclosure Agreements (NDAs) and/or Individual Conflict of Interest (COI) forms which become part of the Organization Conflict of Interest plan

Appendix A – Performance Metrics – Website Maintenance

Desired Outcomes

Required Services

Performance Standard

Acceptable Quality Level

(AQL)

Monitoring Method

Incentives/

Disincentives

Contractor shall continuously monitor system health, propose preventive or corrective system actions, obtain change management approvals, implement approved changes, maintain a highly available and secure IT environment.

ABMC systems meet and maintain a highly available and secure IT system. Technical and program management staff have access to qualified, knowledgeable subject matter expert.

Monitor and maintain the

ABMC

WordPress Application

All systems under purview are operational and secure.

All WordPress Core and Module patches are applied within 30 days of issuance.

All Critical Application Patches are applied within 48 hours of issuance.

99% application uptime per month.

No deviation.

No deviation.

Review of monthly reports.

Random tests by COTR or designee.

reports.

Random tests by reports.

Random tests by

Contractor shall provide a monthly Contract Discrepancy Report that reports violations to the Contracting Officer (CO).

The CO will withhold or deduct up to 5% of the monthly invoice.

Appendix B – Performance Metrics – Website Support

Required Services

Level

(AQL)

Level 2 and 3 ABMC.gov Application Support. The Contractor shall maintain a fully functional service providing remote application support during Business Hours from Monday through Friday (except for Federal holidays) to ABMC Public Affairs and IT teams.

ABMC Public Affairs and IT Teams have immediate access to qualified, knowledgeable level 2 to 3 ABMC Website application support during business hours and use the Help Desk to help resolve all technical questions and problems.

Provide level 2 to 3 WordPress application support for ABMC.gov

All e-mail messages are answered within 1 hour of receipt.

High Priority Level 2 Service Requests (no escalation needed) received during the month are solved within 1 hour of diagnosis of the report of problem.

Medium Priority Level 2 Service Requests (no escalation needed) received during the month are solved within 8 hours of diagnosis of the

Low Priority Level 2 Service

99% compliance.

90% of the service requests are resolved within 1 hour of diagnosis of the problem.

requests are resolved within 8 hours of requests are

Random tests by reports.

A Contract Discrepancy Report that cites violations permits the Contract Officer to withhold or deduct up to 5% of the monthly invoice until the Contract Officer determines there is full compliance with the standard or section.

Required Services

Level

(AQL)

Requests (no escalation needed) received during the month are solved within 2 days of diagnosis of the

All referrals from Level 2 are resolved within 8 working hours of initial call.

resolved within 2 days of

Appendix C - Condensed list of application on ABMC.gov

Analytics and Tracking

• ForeSee Results

• Google Analytics

• Google Universal Analytics

• Google Analytics 4

• Global Site Tag

• US Gov Digital Analytics Program

Widgets and UI Tools

• Apple Whitelist

• Canva

• Google Font API

• Google Tag Manager

• US Privacy User Signal Mechanism

Performance and Popularity Data

• CrUX Dataset

• CrUX Top 1m

• CrUX Top 500k

• Official US Government Domain

• Cloudflare Radar

• Cloudflare Radar Top 500k

CAPTCHA and Anti-Bot Tools

• reCAPTCHA

• reCAPTCHA v2

Site Search

• Sitelinks Search Box

WordPress Plugins

• W3 Total Cache

• Yoast Plugins

• Yoast WordPress SEO Plugin

• WordPress Plugins

• Elementor

• Elementor Pro

• Essential Addons for Elementor

• The Events Calendar

Language Settings

• English

Frameworks and Scripting

• Bug Bounty

• PHP

• Organization Schema

• Hello Elementor

Mobile Optimization

• Viewport Meta

• iPhone / Mobile Compatible

• Mobile Optimized

• Apple Mobile Web App Capable

• Apple Mobile Web Clips Icon

Content Delivery Networks

• GStatic Google Static Content

• Microsoft Azure Blob Storage

• jQuery CDN

Media and Video

• YouTube

Content Management Systems

• Drupal

• Drupal 10

• WordPress

JavaScript Libraries

• Lightbox

• jQuery

• jQuery UI

• jQuery Colorbox

• jQuery 3.7.1

• jQuery 3.6.0

• Tiny Slider

• Angular JS

• imagesLoaded

• Intersection Observer

Advertising and Social

• DoubleClick.Net

• Facebook

• Twitter

• Instagram

Site Features and Compliance

• Members Page

• Events Page

• Accessibility Statement

• YouTube Link

• Artificial Intelligence

• X (Twitter)

• Plans and Pricing

Hosting and Infrastructure

• Microsoft Azure Front Door

• Amazon

• Microsoft

SSL and Security

• Thawte SSL

• SSL by Default

• DigiCert SSL

• HSTS

• HSTS IncludeSubdomains PreLoad

Email Services

• SPF

• DMARC

• DMARC Reject

• Microsoft Exchange Online

• Office 365 Mail

DNS and Internet Standards

• CloudFlare

• DNSSEC

• IPv6

CDN and Delivery

• Microsoft Azure Verified CDN

• Content Delivery Network

Webmaster Tools

• Google Webmaster