PWS - EPS Portfolio Mordernization v20250903.pdf

Department of Justice

Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Office of Science and Technology in partnership with Office of Enforcement Programs and Services (EPS)

National Tracing Center (NTC) Division

Performance Work Statement

Enterprise Optimization of EPS Systems (E-OPES)

September 3, 2025

1.0 Introduction

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is a law enforcement agency within the United States Department of Justice (DOJ). ATF is dedicated to the reduction of violent crime and the protection of our nation. ATF is responsible for the investigation and prevention of crimes that involve unlawful use, manufacture, sale, trafficking, and possession of firearms; illegal use, and storage of explosives; acts of arson and bombings; acts of terrorism;

and illegal trafficking of alcohol and tobacco products. ATF regulates the firearms and explosives industries from manufacture and/or importation through retail sale, and leverages partnerships to enhance its business in regulatory, law enforcement, training, and forensic mission areas. The commitment and skills of ATF’s employees are required to accomplish the Bureau’s critical mission.

The Office of Science and Technology (OST) is responsible for supporting ATF’s mission through delivery of professional, high-quality services related to information, financial investigations, laboratories, and through the strategic acquisition and/or development of advanced technologies supporting ATF. Implementation of this strategy will ensure a robust enterprise infrastructure and support the delivery of services to ATF’s stakeholders, Federal, State, and local, tribal, and international law enforcement partners. Effective delivery of these services will facilitate information sharing between ATF personnel and partners, including providing real-time data to agents, investigators, and intelligence specialists in the field.

OST has developed an ATF Application Architecture based on Software Defined Architecture (SDA) concepts leverage applications programmable interfaces (APIs) to achieve application integration, data access, and data sharing between ATF mission’s applications. The application architecture will allow data sharing between ATF and other government agencies. As OST modernizes legacy applications, the new applications will utilize the ATF Application Architecture.

OST has developed and implemented an agile development methodology to enable the efficient development and delivery of applications. The ATF methodology is based on the “Agile Scrum” methodology and utilizes industry standard application development principles. This methodology is described in section 5 of Attachment 1: ATF IT Governance Manual. As part of this ATF Agile Methodology, a continuous integration / continuous delivery environment (CI/CD) has been implemented. The environment, described in section 6 of Attachment 1, provides a complete set of tools to automate the development, testing, and deployment of applications.

2.0 Background

ATF is tasked with maintaining a process to grant Federal Firearms Licenses, which governs the manufacture and dealing of firearms across the full firearms industry, grant Federal Explosives licenses, which governs the manufacture and dealing of firearms across the full explosives industry, regulate weapons imported into the United States, and maintain a registration record of all weapons governed by the National Firearms Act of 1934 (NFA). The ATF has addressed these statutory responsibilities through distinct processes managed by the National Firearms Act Division (NFAD) and the Firearms and Explosives Services Division (FESD). NFAD is the only federal government entity authorized to manage the one and only one firearms registration database allowed by the Federal Court System.

NFAD is tasked with the management and maintenance of an eForms system (eForms) that will allow for the electronic submission of registration and transfer application for weapons that are governed by the NFA and the proper importation of firearms into The United States of America, the management and maintenance of the National Special Occupational Tax system (NSOT), as well as the maintenance of the National Firearms Registration and Transfer Record (NFRTR).

FESD is tasked with the management and maintenance of the Federal Licensing System (FLS), which is responsible for the issuance of new and renewal FFL and FEL licensure permits, the management and maintenance of the Firearms and Explosives Imports System (FEIS), which processes and tracks applications to import firearms into The United States of America.

Over recent years, the FIT Portfolio of Systems applications has undergone modernization efforts, however maintenance of these systems has become burdensome and cost inefficient.

ATF approaches firearms violence from two distinct fronts: industry regulation and criminal investigation. ATF regulates the manufacture, importation, and sale of firearms in the United States. ATF qualifies individuals who wish to engage in the firearms industry which includes licensing, importation, providing guidelines for operation, and recordkeeping for each acquisition and sale of a firearm. Through this regulatory framework, ATF establishes the tracing process that allows for the tracking of each firearm from its point of manufacture or importation to the point of first retail sale, a process known as “tracing.” By tracing recovered firearms, ATF is able to discern patterns of names, locations, and weapon types that provide invaluable leads that aid in the identification of persons engaged in the diversion of firearms into illegal commerce. ATF has sole regulatory authority over Federal Firearms Licensees (FFLs), and its National Tracing Center (NTC) is the only entity in the federal government authorized to perform the firearm tracing task which is specified in the Gun Control Act of 1968.

The mission of ATF’s National Tracing Center Division (NTC) is to accurately and efficiently conduct firearms tracing and associated programs and processes for international, federal, state, and local law enforcement agencies to provide investigative leads. A firearms trace is the systematic tracking of a firearm from its manufacturer or importer through the chain of distribution of wholesalers and retailers to the first retail purchaser. The NTC is only authorized to trace a firearm for a law enforcement agency involved in a bona fide criminal investigation.

A firearms trace is typically conducted when a law enforcement agency discovers a firearm at a crime scene and wishes to know the origin of that firearm in order to develop investigative leads to: (1) link a suspect to a firearm in a criminal investigation; (2) identify potential traffickers; and (3) when sufficiently comprehensive tracing is undertaken in a given community, detect in-state, interstate and international patterns in the sources and kinds of crime guns.

The method used by the NTC to trace a firearm is complex and labor intensive. There is no federal firearm registry database that can simply be queried to determine who bought a particular firearm. Most firearms must be researched by directly contacting the manufacturer, importer, wholesaler, or retailer, to determine dispositions, except in cases where the FFL has gone out of business, where the gun had been previously reported lost or stolen by an FFL, or where it was part of a multiple sales transaction. In FY 2022, the NTC traced in excess of 623,000 firearms for more than 7,800 federal, state, local, tribal, and international law enforcement agencies. The NTC typically processes a routine trace request in 7-10 business days and an urgent trace request in under 24 hours.

In 2003, ATF deployed a web-based “front end” to the Firearms Tracing System (FTS) known as eTrace. The eTrace application provides for the electronic exchange of crime gun incident related data in a secure web-based environment. eTrace provides law enforcement representatives with the ability to electronically submit firearm trace requests, monitor the progress of traces, retrieve completed trace results, and to query firearm trace related data in a real-time environment. Although the eTrace application has been incrementally updated over the years, the last major version release was deployed in 2009 when Spanish language translation services were added. As of May 2023, more than 9,500 law enforcement agencies (including agencies from 50 foreign countries) and in excess of 81,000 individual users have been granted direct access to eTrace for use in their criminal investigations involving firearms.

3.0 Objective

The objective of this procurement is for the contractor to provide the necessary application and technical program expertise for the Enterprise Optimization of EPS Systems (E-OPES). To that end, this effort will consist of streamlining and consolidating all Licensing form submission, processing, validation, workflow, and reporting functions into one fully-integrated web-enabled firearm licensing application for meeting the legal, regulatory, operational, capability, and functional requirements of the ATF, properly enhancing and maintaining the current capabilities and functions of the FIT Licensing Portfolio of Systems, and for the use of Law Enforcement (LE) purposes.

The result of this procurement will enable the full lifecycle of an ATF application which will go from the submission process and through the approval/disapproval process for the NFA controlled weapon, the registration of an Federal Firearms License or Federal Explosives License, as well as the process that governs the importation of firearms into the United States of America, governed by the National Firearms Act of 1934 or the Gun Control Act of 1968.

Deployments of enhanced functionality should be made to production as frequently as is practical, as determined by the Product Owner and in terms of any approved Deployment Automation Plan

The NTC Division requires major enhancements to the core Firearms Tracing System database and the eTrace user experience in order to streamline operations and consolidate all trace processing, validation, workflow, and reporting functions into one fully integrated web-enabled firearm tracing application. These enhancements will use the existing tracing applications as a starting point and will evolve these applications toward the desired state through small, frequent deployments of functional and architectural improvements. The implementation of a modernized firearms tracing application (eTrace) will significantly improve the operational proficiency of the NTC Division and build capacity to meet expectations in firearms tracing capabilities for federal, state, local and international law enforcement agencies.

The Firearm Tracing (eTrace) application architecture shall remain compliant with ATF’s overall application architecture framework.

Deployments of enhanced functionality should be made to production as frequently as is practical, as determined by the Product Owner and in terms of any approved Deployment Automation Plan.

4.0 Scope

The Government requires the contractor to provide the technical expertise and experience needed to develop, modernize, or enhance both the firearms tracing and licensing suite of applications, utilizing ATF’s Application Architecture/Application Programming Interface (API) approach, and the ATF development methodology.

The Contractor shall demonstrate experience and conform to the current ATF approved technology stack. Contractors may propose additional tools if necessary to update the current technology stack and stay current with technology per industry standard best practices. The contractor shall use the enterprise Continuous Integration/Continuous Delivery (CI/CD) Environment and shall automate all deployments to test and production environments using ATF enterprise standard technologies.

The contractor shall:

1. Provide application development and enhancements, security engineering, DevOps support, database design, data ingestion, standardization, and cleansing, testing and User Interface/User Experience Design (UI/UX) support, data architecture support, consulting services, and all technical expertise to meet the objectives stated within this

SOW.

2. Act as an independent contractor and not as an agent of the Government, furnish management and labor necessary to perform the requirements in this task statement, in partnership with government Product Owners.

3. Obtain Government approval prior to contractor use of contractor provided hardware and software in the performance of this work.

4. Utilize commercial & industry best business practices when delivering services such as but not limited to a. Agile/Scrum Methodology

a. Scaled Agile Framework for Enterprises (SAFE)

b. Continuous Integration / Continuous Delivery (CI/CD)

c. Automated Testing

5. Automated Deployments Use Government provided tools to accurately document, administer, and maintain data and configuration.

6. Provide a Project Manager that will act as the primary point of contact for resolving all contract execution issues between the contractor and the Government. While a dedicated resource is preferred, the Project Manager may be dual hatted with the Scrum Master or other team member role as long as all requirements are met.

7. Participate in authorized on-site and off-site/virtual meetings and prepare and present written and oral briefings and documentation deliverables on progress of work weekly or as requested by the Government.

8. Design, develop, and iteratively deploy a fully integrated modernized firearms licensing application system\structure that leverages ATF’s Application Architecture and DevOps framework

9. Develop user guides and training materials, potentially including online and context-sensitive help and/or instructional videos, for ATF and external (industry) users to provide instruction on the use of both existing and new features within the Licensing system\structure.

10. Design and develop the Licensing system\structure using ATF agile methodology and incrementally deliver and deploy functionality to production based upon priorities and deployment authorizations provided by ATF Product Owner(s).

11. Collaborate with ATF support teams to transition the Licensing system\structure to the incoming contractor at the end of the contract period.

12. Design, develop, and iteratively deploy a fully integrated modernized firearms tracing (eTrace) application that leverages ATF’s Application Architecture and DevOps framework. Design and develop eTrace using ATF agile methodology and incrementally deliver and deploy functionality to production based upon priorities and deployment authorizations provided by ATF Product Owner(s).

13. Review, redesign, and optimize database structures and schemas for optimal use with applications and APIs. Recommend API standard and best practices.

14. Reuse existing authoritative data instead of recreating data sources. Develop user guides and training materials, potentially including online and context-sensitive help and/or instructional videos, for ATF and external (industry) users to provide instruction on the use of both existing and new features within eTrace. Collaborate with ATF support teams to transition eTrace to the incoming contractor at the end of the contract period.

15. The successful achievement and subsequent approval of the procured Licensing structure Authority to Operate (ATO) is required. To accomplish this requirement and deliver the intended system\structure for use in the PRODUCTION environment, the use of an Accelerated ATO process for this proposed procurement is a requirement.

16. The successful achievement and subsequent approval of the procured Tracing structure Authority to Operate (ATO) is required. To accomplish this requirement and deliver the intended system\structure for use in the PRODUCTION environment, the use of an Accelerated ATO process for this proposed procurement is a requirement.

The current technologies listed below are subject to change based upon standard update processes.

• FIT Licensing Portfolio of Systems:

o Java v8 o Microsoft SQL Server 2019 o Angular v19.2 o Node v14.17.1

• FTS/eTrace:

o Java o Microsoft SQL Server 2019 o Angular 11.2.14 o Node.js 14.17.1 o Case360 (to be replaced)

• CI/CD:

o Cucumber o Digital.Ai Agility o GitLab o Jenkins o JMeter o Junit o Katalon o Maven o Microsoft SQL Server 2019 Management Studio o Mockito o Nexus o Node.js o OpenShift o Postman o SonarQube o Selenium o TestNG

Conformity to ATF’s Agile Methodology and IT Governance Policies All Contractor provided work shall conform to the applicable policies, procedures, and standards described in the ATF IT Governance Manual (Attachment 1).

Conformity to the Data Management Requirements The Contractor shall conform to the data management requirements as outlined in the ATF’s Data Governance Strategy. This may also include additional requirements or conditions set by the Office of Science and Technology.

Other Administrative Requirements No work shall be performed under this contract unless personnel requiring access to the ATF facilities, network and/or information have been cleared via Temporary Employment Eligibility (TE) or completed background investigation through ATF’s Personnel Security Division (PSD).

Personnel working under the contract that only requires access to the ATF approved sandbox environment may be granted access in advance of a completed background investigation. These situations will be evaluated on a case-by-case basis.

5.0 Tasks

The Contractor shall provide resources with the skillsets, competency, expertise, certifications (if applicable) required to successfully complete the tasks outlined below.

5.1 (Task 1) Transition-In

The Contractor shall provide a Transition Plan for ensuring continuous operation which includes acquiring the necessary staff to accomplish the tasks described in this Task statement (SOW).

The Transition Plan shall also include a schedule of activities to seamlessly transition work, if necessary, from the incumbent to the new awardee.

In general, the transition-in period is a time for the contractor to recruit/acquire staff, submit security packages for the necessary background investigations, and expeditiously assume leadership of support. Therefore, a 30-day transition is required with ATF cleared / badged personnel to ensure there is no operational downtime of the firearms licensing and tracing applications. At the conclusion of the transition and start-up period, the contractor shall have the proper staffing level and knowledge required for fully supporting them in coordination with ATF leadership and other members of the Licensing & Tracing Service Teams.

The contractor shall submit complete security packages within three (3) business days after contract award for key personnel and five (5) business days after contract award for non-key personnel that are assigned to work on this contract. The COR will provide the required forms and information to the contractor immediately upon contract award.

Please note it may take 60-90 days for individuals to be successfully adjudicated via a full ATF background investigation. Therefore, it is difficult for the Government to provide an estimate on the timeframe for the start-up period. There are times when waivers may be granted or reciprocity applied if a previous background investigation has been completed that meets ATF requirements, but the contractor should expect at least 90 days for the Government to complete the background investigation process. The Government will make every effort possible to expedite this process, but the Contractor is expected to conduct pre-screening of each applicant before submitting their paperwork.

During start-up, individuals may be granted permission to work on tasks that do not require access to ATF systems or information. The Component Task Monitor (CTM) or the Contracting Officer’s Representative (COR) will make this determination. Once this determination is made, the CTM or COR will notify the Contractor PM that the individual may begin work and that the contractor may begin billing for this resource. For all other individuals that cannot begin work until their Temporary Employment is approved or a fully adjudicated background investigation is complete, the government does not expect to be billed until such time the individual officially starts work on the contract.

As individuals are cleared, the Government expects them to begin work immediately. Once the start date is confirmed, the COR will begin all on-boarding activities. On-boarding activities consist of adding the individual to ATF’s Human Resources system and requesting their equipment and setting up of the initial accounts. The contractor will work with the Government Task Manager (GTM) to determine what access is required for the respective projects the resources will be assigned to.

Deliverables

• Deliverable T1-D1 – Transition Plan

• Deliverable T1-D2 – Security Packages

5.2 (Task 2) Contract Kick-Off Meeting

Within five (5) business days of contract award, the Contractor shall attend a kick-off meeting with Contractor personnel who will be assigned to the contract, Contracting Officer (CO), COR, CTM, and the system owner to review business norms, discuss the project/scoping approach, policies, procedures, project planning, metrics, milestones, and deliverables. The purpose of the meeting is to ensure a complete understanding and agreement of the scope of both the Government and the contractor. Depending on the Headquarters occupancy level status, this meeting may be virtual (MS-Teams or WebEx).

The Contractor shall provide a kickoff briefing with an agenda and high-level approach for all tasks outlined within the SOW.

The Contractor shall also document the kick-off meeting discussion and provide meeting notes within three (3) business days of the meeting for review. Comments/clarifications from the Government will be incorporated in the final version and are due back to ATF within two (2) business days of receipt of comments from ATF.

Meeting topics shall include:

• Introduction of key Contractor and Government personnel performing work under the various tasks in this contract

• Presentation by the Contractor confirming their understanding of the work to be accomplished under this contract

• Team Structure Chart

• ATF-furnished information

• Weekly Status Reporting

• Points of Contact

• Task transitioning process and timeframes

• Prioritization of Contractor activities (if applicable)

• Review of Assumptions (if applicable)

The government is open to discussion prior to the kick-off meeting regarding these items and welcome suggestions from the Contractor.

Deliverables

• Deliverable T2-D1 – Kickoff Briefing

• Deliverable T2-D1 – Kick-Off Meeting Notes

5.3 (Task 3) Project Management (PM) Support Provide a consolidated Program Management Office (PMO). The PMO will be composed of the Contractor’s Program Manager, Transition Manager, and other key personnel as needed.

Provide project management services (i.e., planning, direction, coordination, scrum master support, technical writing, and control of contractor resources) to oversee and ensure the execution of the contract and deliver the required services and deliverables.

The contractor shall:

• Provide project management staff with full company authority to oversee the assigned resources and enable rapid resolution of day-to-day service delivery issues.

• Provide project team with guidance on all areas of the engagement and a primary customer contact for all major support issues through the length of the project.

• Work in partnership with ATF System/Product Owners to document and verify user stories (business requirements), and to identify the best approach or solution for implementing each user story.

• Recommend and upon ATF System Owner approval implement one or more Agile teams to implement the requirements of this task.

• Provide project management, communications, and coordination support for the Agile development team(s).

• Develop and incrementally update high-level product roadmap for each application development effort.

• Conduct routine management meetings in accordance with the ATF Agile management methodology, including but not limited to daily stand-ups, sprint planning sessions, sprint review sessions, product demos, and backlog grooming sessions.

• Conduct weekly project status meetings with the Government to review goals, objectives, weekly accomplishments, issues, risk, and priorities.

• Bring issues affecting the performance of the Contractor to the immediate attention of the CTM, System/Product Owner and COR.

• Provide all reports and meeting notes stipulated in the SOW along with any other reports the Government deems necessary following the schedule outlined in Section 5.0, Deliverables. Meeting notes are applicable across all tasks contained within the

SOW.

• Reports include:

o Weekly Status Report – Work Accomplished, Work Planned, Upcoming Tasks, Personnel Issues, and any contract or project related risks or issues.

o Sprint Progress Report – Provide a sprint progress report including a burn down chart and velocity of the sprint. Include a count of backlog items broken down by severity/priority (i.e., Critical, High, Medium, Low) and type (i.e., new, defect, repeat defect).

o Release Report – This report shall include the epic/user story and release burn down for any defined multi-sprint releases.

o Periodic reports and meetings related to project management, velocity, timelines, milestones, development, or other matters pertaining to the project, as determined by ATF.

All key PMO personnel shall:

• Be available for live or virtual meetings within 60 minutes of Government notification.

• Publish a monthly PMO Online Newsletter to the respective communities highlighting successes, lessons learned, and upcoming events.

• Provide task order highlights to them, as they occur, that depict major accomplishments, e.g. reaching a high level of customer satisfaction.

• Provide a single point of contact with multiple resources providing a full range of quickly accessible, high-level technical expertise and tools for customer support.

The Contractor shall provide the following:

• Provide a Project Manager that will act as the primary point of contact for resolving all contract execution issues between the contractor and the Government. The Project Manager may be dual hatted with the Scrum Master or other team role as long as all requirements are met.

• Provide project management staff with full company authority to oversee the assigned resources and enable rapid resolution of day-to-day service delivery issues.

• Program Management Plan (PMP) - Develop and deliver a Draft and Final PMP based on Agile SCRUM Methodology/ Best Practice. The PMP should be flexible, iterative, and should support and enable the incremental deployments. The PMP should adequately decompose tasks in relation to task order requirements.

• The PMP shall identify PMP Updates throughout the task order performance period;

shall be divided into the following: (1) Task Order Award + 180 days) and (2) Day 181 to the end of Year One of the task order with updates for subsequent years; and shall document and provide timelines for Contractor efforts that are multi-year efforts.

• At a minimum this PMP shall include:

o All technical activities (including documentation development) identified, and matrix of all personnel assigned to the program. At a minimum, broken down at the CLIN level.

o Composition of cross functional Scrum/Sprint Teams o Notional Sprint Deployment Cycle/ Schedule o Action Item Log.

o Activities and milestones pertinent to the Contractor’s completion of the technical activities.

o All performance standards followed in support of these requirements.

o A description of the expected results of each milestone in the PMP.

o A matrix of all deliverables, their version/release, and planned delivery dates.

o Level of effort for all tasks.

o Status of current and planned initiatives and programs.

o For all labor hours CLINs, budget information (planned versus actual, including incurred but not billed, by task).

o Task dependencies and interrelationships.

o Project organization.

o Contractor organizational structure.

o Process management and controls.

o Any unique hardware and software utilized by the Contractor.

o A description of the application(s) used to monitor the performance of the network.

Deliverables

• Deliverable T3-D1 – Sprint Cadence and Initial Product Roadmap

• Deliverable T3-D2 – Program Management Plan (PMP)

• Deliverable T3-D3 – Weekly Status Report

• Deliverable T3-D4 – Sprint Progress Report

• Deliverable T3-D5 – Release Report

• Deliverable T3-D6– Periodic Reports (as determined by ATF)

• Deliverable T3-D7 – PMO Online Newsletter

• Deliverable T3-D8 – Meeting Notes (as determined by ATF)

5.4 (Task 4) PMP Attachments The Contractor shall provide separate attachments to the PMP for each of the following reports/plans:

• A PMP Update for completion of each of the Projects. The Contractor shall provide sufficient information based on the overall PMP format to convey the resources, standards, and timeframes for the completion of each initiative.

• Tool Integration Report (TIR) that describes how and when Contractor hardware/software/process tools will be integrated with systems and processes.

• Knowledge Transfer Report (KTR) that presents the information and data captured by the Contractor that will be used to transfer specific knowledge (related to the IT technology, end users, and processes) to Contractor Service delivery personnel. The KTR also includes the schedule of knowledge transfer training of Contractor delivery personnel.

• Operational Parameters Report (OPR) that identifies the operational parameters (and thresholds) that are the target of performance, capacity, and security monitoring and management.

• End User Training Report (UTR) that identifies how the Contractor will conduct training as new technologies or services are implemented based on the training required.

• Regulatory Compliance Report (RCR) that identifies how the Contractor will adhere to all Federal, DOJ, and ATF IT security requirements and industry best practices as an integral life cycle component of all work performed.

5.5 (Task 5) Application Development

Deployments of application development or enhanced functionality should be made to production as frequently as is practical, as determined by the Product Owner and terms of any approved Deployment Automation Plan.

The Contractor shall:

• Leverage the ATF Agile Development Methodology to assess existing functionality and software architecture, plan iterative enhancement strategies to evolve products to the desired state, then design, develop, and deploy incremental product updates.

• Size story points using a standard approach agreed upon by the scrum team.

• Forecast backlog items and/or accompanying milestones, as appropriate, based on agreed upon velocity by the scrum team.

• Develop, verify, and prioritize one or more product backlogs working with the Product Owner for each development/enhancement effort.

• Evaluate and update existing databases structures and schemas to optimize, eliminate redundancies, and inconsistencies while improving performance.

• Map the database fields back to the algorithms and risk analysis. The GTM and System Owner must review and approve.

• Develop API as the standard data sharing mechanism for all application development efforts.

• Develop APIs following industry standards to allow data sharing within all relevant ATF applications as well as with other government agencies. Document Industry standards used for developing API.

• Update the ATF data dictionary for each data element used by the API and develop data flow diagram of core data used by each application.

• Create database script(s) as necessary to create/update table and column level description (used by the API) to the authoritative database.

• Develop application code to optimize performance.

• Develop automated release packages for all code deployment.

• Make use of ATF’s standard containerization platform for all deployments that can be containerized.

• Automate the deployment using CI/CD pipeline.

• Ensure application is cluster-able and can be load balanced.

• Ensure production deployments can be made with zero downtime, while users are using the application, to the extent possible.

• Automate application specific technology stack configurations using scripts and provided tools for the specific component.

• Develop documentation outlined in ATF Agile development methodology.

• Enhance and maintain application to effectively handle usability and growth.

• Address application related production issues/defects and security findings within the agreed upon timeline by the Product Owners.

• Work closely with the OST Server Team, Database Administration (DBA) Team, and the

Network Team to maintain the application.

• Maintain application infrastructure with timely upgrades of the development platform.

• Comply with all Federal, DOJ and ATF standards for application and system development.

• Comply with ATF configuration management policies and procedures.

• Update and provide the Section 508 checklist within ten (10) business days after each release which causes changes to the checklist.

The Contractor shall provide a Security point of contact to complete the application ISSO paperwork. The Contractor shall provide an Information Assurance service that comply with DOJ/ATF/NIST mandatory security controls to include but not limited to:

• FISMA compliance with services provided to ATF

• Standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets

• Supervision and oversight of services activated to ATF to ensure enforcement and monitor usage of information system access controls

• Security controls review to enable more consistent, comparable, and repeatable assessments

• Annual internal and 3rd party audits and assessments of security controls to determine overall control effectiveness

• Risk Management Framework for security categorization, security control selection and implementation, control assessment, information system authorization, and control monitoring

• Complete, reliable, and trustworthy information of ATF organizational officials, to support security accreditation decisions, information sharing, and FISMA compliance

The Contractor shall provide a resource who is familiar with the NIST 800-53 Rev 5 requirements, and will create, deliver, and maintain various system documentation in support of complying with FISMA requirements to minimize cybersecurity risk.

Deliverables

• Deliverable T5-D1 – Related Agile Documentation (Outlined in Attachment 1)

• Deliverable T5-D2 – Database Schemas, Data Model (Logical and Physical) of Core Data

Elements

• Deliverable T5-D3 – Data Dictionary (including table and column level deception) of Core

Data Elements

• Deliverable T5-D4 – Data Flow Diagram

• Deliverable T5-D5 – API Standard and best practices used for each application

• Deliverable T5-D6 – Source Code and Binary Code

• Deliverable T5-D7 – Automated deployment packages

• Deliverable T5-D8 – Design Documentation

• Deliverable T5-D9 – Related Cybersecurity Documentation

• Deliverable T5-D10 – System user guides

• Deliverable T5-D11 – Automated Deployment Plan

5.5.1 DevOps/DevSecOps

The Contractor shall provide application DevOps/DevSecOps support overseeing the tasks and activities necessary to manage product backlogs, perform application development, deployment, and enhancements, as well as address defects, issues, and security findings as prioritized by the ATF GTM and Product Owners.

5.5.2 Go-Live & Post Go-Live Support

Participate in Licensing/NFA and/or Tracing service teams to provide continuous improvement to all involved products, and to ensure delivery of excellent service to users. This requires attending meetings, coordinating with the government and other contractor personnel, and providing technical expertise. Contractors shall support user story creation, refinement, prioritization, and completion following ATF's software lifecycle process.

The contractor shall leverage ATF’s Application Architecture and DevOps framework to design, develop, and deploy functions, features, and enhancements to products used by the Licensing/NFA and/or Tracing service teams. Review, redesign, and optimize functions, features, databases, and existing application enhancements for optimal integration and use with up/down stream systems, applications, and APIs. Additionally, the contractor shall provide application development and enhancements, production support, UI/UX support, data architecture support, consulting services, and all technical expertise required within an integrated DevOps service team model.

The Contractor shall conduct automated testing to the extent feasible to verify functionality of all new user stories and to conduct other types of testing, including unit, integration, and regression testing. User stories will be created, prioritized, and worked in accordance with processes described in ATF’s IT Governance Manual.

The Contractor shall work with the product owners, other developers, and the service teams’ release train engineer(s) to ensure deployments are properly coordinated and tested.

5.6 (Task 6) Licensing Portfolio The Contractor’s dedicated Licensing Team shall develop, test, and support deployment of firearms licensing applications following the ATF Agile methodology, so that new functionality can continue being deployed to production through frequent releases. User stories (business requirements) will be captured by the contractor in ATF’s Agile Project Management Tool (currently Digital AI) to be placed in a product backlog. The System/Product Owners will verify, approve, and prioritize user stories which will be pulled into sprints for development, testing, and acceptance by the Product Owners.

The contractor shall leverage ATF’s Application Architecture and DevOps framework to design, develop, and deploy functions, features, and enhancements to products used by the Licensing service teams. Review, redesign, and optimize functions, features, databases, and existing application enhancements for optimal integration and use with up/down stream systems, applications, and APIs. Additionally, the contractor shall provide application development and enhancements, production support, UI/UX support, data architecture support, consulting services, and all technical expertise required within an integrated DevOps service team model.

Participate in Licensing teams to provide continuous improvement to all products involved, and to ensure delivery of excellent service to users. This requires attending meetings, coordinating with the government and other contractor personnel, and providing technical expertise.

Contractors shall support user story creation, refinement, prioritization, and completion following ATF's software lifecycle process.

5.7 (Task 7) Licensing Portfolio Application Interfaces & Integrations

Application integration within the portfolio consists of both internal and external interfaces with both up and downstream integration points. These capabilities constitute enhancements which must adequately integrate and supplement the core capabilities.

These capabilities include the following:

• API(s) supporting back-end functionality and user interface changes necessary to increase Trace processing throughput.

• Submission of electronic ATF form application submissions from participating industry partners, individuals, trusts, government entities, other legal entities, or corporations without the need for manual communications such as telephone, email, or fax.

• Submission of electronic ATF form application submission responses from the ATF to participating industry partners, individuals, trusts, government entities, other legal entities, or corporations without the need for manual communication such as telephone, email, or fax.

• Submission of electronic Trace requests from ATF to participating industry partners without the need for manual communications such as telephone, email, or fax.

Submission of electronic Trace responses from participating ATF partners to ATF without the need for manual communication such as telephone, email, or fax.

• Submission of trace search requests to ATF’s Enterprise Content Management (ECM) system.

• Form recognition of paper application form submissions, or correspondence, that is capable of identifying the portions of the form (and only those portions) which contain data and subsequent ingestion of that data into the data storage, populating the data into the correct data fields to allow successful form processing by NFAD and FESD, which ATF is authorized by federal statute and federal, DOJ, and ATF policy to electronically index. Any such form recognition shall have adequate privacy protections, including being configurable not to capture data that ATF is not authorized to collect electronically.

• Ensure integration/UAT SME acceptance testing is performed prior to production deployment of new functionality

• Integrate the new APIs and automation technologies into the updated workflows and UIs to the maximum extent feasible without negative impacts.

• Integrate any newly developed automation technologies into the latest user interface, workflows, and backend systems.

5.8 (Task 8) Tracing Portfolio The Contractor’s dedicated Tracing Team shall develop, test, and support deployment of firearms tracing applications following the ATF Agile methodology, so that new functionality can continue being deployed to production through frequent releases. User stories (business requirements) will be captured by the contractor in ATF’s Agile Project Management Tool (currently Digital AI) to be placed in a product backlog. The System/Product Owners will verify, approve, and prioritize user stories which will be pulled into sprints for development, testing, and acceptance by the Product Owners.

The contractor shall leverage ATF’s Application Architecture and DevOps framework to design, develop, and deploy functions, features, and enhancements to products used by the Tracing service teams. Review, redesign, and optimize functions, features, databases, and existing application enhancements for optimal integration and use with up/down stream systems, applications, and APIs. Additionally, the contractor shall provide application development and enhancements, production support, UI/UX support, data architecture support, consulting services, and all technical expertise required within an integrated DevOps service team model.

The contractor shall participate in Tracing service teams to provide continuous improvement to all products involved, and to ensure delivery of excellent service to users. This requires attending meetings, coordinating with the government and other contractor personnel, and providing technical expertise. Contractors shall support user story creation, refinement, prioritization, and completion following ATF's software lifecycle process.

5.9 (Task 9) Tracing Portfolio Application Interfaces & Integrations

Application integration within the portfolio consists of both internal and external interfaces with both up and downstream integration points. These capabilities constitute enhancements which must adequately integrate and supplement the core capabilities.

These capabilities include the following:

• API(s) supporting back-end functionality and user interface changes necessary to increase Trace processing throughput.

• Submission of electronic ATF form application submissions from participating industry partners, individuals, trusts, government entities, other legal entities, or corporations without the need for manual communications such as telephone, email, or fax.

• Submission of electronic ATF form application submission responses from the ATF to participating industry partners, individuals, trusts, government entities, other legal entities, or corporations without the need for manual communication such as telephone, email, or fax.

• Submission of electronic Trace requests from ATF to participating industry partners without the need for manual communications such as telephone, email, or fax.

Submission of electronic Trace responses from participating ATF partners to ATF without the need for manual communication such as telephone, email, or fax.

• Submission of trace search requests to ATF’s Enterprise Content Management (ECM) system.

• Form recognition of paper application form submissions, or correspondence, that is capable of identifying the portions of the form which contain data and subsequent ingestion of that data into the data storage, populating the data into the correct data fields to allow successful form processing by NFAD and FESD, which ATF is authorized by federal statute and federal, DOJ, and ATF policy to electronically index.

• Extraction of pixels or comparable individual form elements from only the above-described subset of each OBR form which ATF is authorized to index.

• Form recognition of out-of-business-records (OBR) that is capable of identifying the portions of the form which contain data which ATF is authorized by federal statute and federal, DOJ, and ATF policy to electronically index.

• Extraction of pixels or comparable individual form elements from only the above-described subset of each OBR form which ATF is authorized to index.

• Transfer of only the authorized pixels or comparable individual form elements to an optical character recognition (OCR) engine capable of identifying letters and numbers contained in printed or hand-written annotations within those authorized areas of the form.

• Ensuring API security employs industry best practices for interface control documents or other industry-facing API documentation

• Storage of the alphanumeric text extracted from the authorized sections of each paper application form or correspondence into the Enterprise Content Management system in such a way that it is searchable and is linked to the final form after processing.

• Storage of the alphanumeric text extracted from the authorized sections of each Tracing form into the Enterprise Content Management system in such a way that it is searchable and is linked to the original OBR form.

• Ensure integration/UAT SME acceptance testing is performed prior to production deployment of new functionality

• Transfer of electronic trace results from ATF’s Enterprise Content Management (ECM) system into the user interface, workflows, and backend systems.

• Integrate the new APIs and automation technologies into the updated workflows and UIs to the maximum extent feasible without negative impacts.

• Integrate any newly developed automation technologies into the latest user interface, workflows, and backend systems.

• Implement technical upgrades to avoid undue technical debt, provide integration and operational support to industry, and provide operational support to ATF NTC regarding API functionality.

5.10 (Task 10) eForms Optimization & Modernization

The Contractor shall provide the capacity necessary to develop, redevelop, and/or deploy electronic forms to the ATF eForms platform.

This includes, but is not limited to:

• Develop and deploy new forms into the existing eForms system

• Redevelop and deploy existing forms, and changes, into the existing eForms system

• Ensure users’ ability to submit following forms electronically.

• Performing discovery and support creation of user stories describing required and desired forms functionality.

• Implement user stories as prioritized by Product Owners.

Existing Forms include:

1. ATF Form 1 (5320.1) – Application to Make and Register a Firearm

2. ATF Form 2 (5320.2) – Notice of Firearms Manufactured or Imported

3. ATF Form 3 (5320.3) – Application for Tax Exempt Transfer of Firearm and Registration to

Special Occupational Taxpayer (NFA)

4. ATF Form 4 (5320.4) – Application for Tax Paid Transfer and Registration of Firearm

5. ATF Form 5 (5320.5) – Application for Tax Exempt Transfer and Registration of Firearms

6. ATF Form 6 Part I (5330.3A) – Application and Permit for Importation of Firearms, Ammunition and Defense Articles

7. ATF Form 6 A (5330.3C) – Release and Receipt of Imported Firearms, Ammunition and

Defense Articles

8. ATF Form 9 (5320.9) – Application and Permit for Permanent Exportation of Firearms

9. ATF Form 10 (5320.10) – Application for Registration of Firearms Acquired by Certain

Governmental Entities

10. ATF Form 5300.11 – Annual Firearms Manufacturing and Exportation Report

(AFMER)ATF Form 5320.20 - Application to Transport Interstate or to Temporarily Export Certain NFA Firearms

11. ATF Form 5630.7 – Special Occupational Tax Application and Renewal

New Forms include but are not limited to:

1) Forms for Federal Firearms Licensees (FFL):

a) Form 7 (5310.12) / Form 7CR (5310.16) – Application for Federal Firearms License

b) Form 7 Part B – Responsible Person Questionnaire

c) Form 8 (5310.11) Part II – Renewal Application)

d) Form 5300.38 – (Application for an Amended Federal Firearms License)

2) Forms for Federal Explosives Licensees (FEL):

a) 5400.13/5400.16 – Application for Explosives License or Permit

b) 5400.13A/5400.16 – Responsible Person Questionnaire

c) 5400.14/15 – Renewal Application

d) 5400.33 – Application for an Amended Federal Explosives License or Permit

e) 5400.28 – Employee Possessor Questionnaire

3) Forms for National Firearms Act Division

a) ATF Form 5320.23 (Form 23) – National Firearms Act (NFA) Responsible Person

Questionnaire

b) ATF Form 5320.24 Description of Firearm and Information on Request for

Demonstration

4) Forms for Imports Branch

a) ATF Form 5330.3B - Form 6 Part 2 - Application and Permit for Importation of Firearms, Ammunition and Defense Articles

b) ATF Form 5330.3D – Form 6 NIA - Application/Permit for Temporary…