PWS_VSPTS.pdf

Attachment A - VSPTS O&M System Support Services PWS

ICE Visa Security Program Tracking System

(VSPTS)

Operations and Maintenance (O&M) Support Services Performance Work Statement

April 15, 2026

U.S. Immigration and Customs Enforcement (ICE)

Office of the Chief Information Officer (OCIO)

Table of Contents

1. PURPOSE

2. BACKGROUND

3. TECHNICAL LANDSCAPE

3.1. SYSTEM OVERVIEW

3.2. SYSTEM ARCHITECTURE

3.3. HOSTING ENVIRONMENT

3.4. TECHNOLOGY STACK

4. SCOPE OF WORK

5. TASKS

5.1. TASK 1 - SOFTWARE MAINTENANCE – TIERED SUPPORT

5.2. TASK 2 - SYSTEM SUPPORT

5.3. TASK 3 - CONFIGURATION MANAGEMENT

5.4. TASK 4 - TRAINING SUPPORT

5.5. TASK 5 - SYSTEM SECURITY / ISSO SUPPORT

5.6. TASK 6 – QUERIES AND REPORTING

5.7. TASK 7 - SUPPORT OF EXTERNAL INTERFACES AND DATA IMPORTS/EXPORTS

5.8. TASK 8 - SYSTEM ENHANCEMENTS AND MAINTENANCE

5.9. TASK 9 - VSPTS DATABASE MANAGEMENT

5.10. TASK 10: ICM INTEGRATION - OPTIONAL TASK/SURGE SUPPORT

5.11. TASK 11: MANTIS WORKFLOW AUTOMATION - OPTIONAL TASK/SURGE SUPPORT

5.12. TASK 12 SEARCHABLE ATTACHMENTS FUNCTIONALITY – OPTIONAL TASK/SURGE SUPPORT

5.13. TASK 13: SYSTEM LIFECYCLE MANAGEMENT (SLM) AND DELIVERABLES

5.14. TASK 14: CERTIFICATION AND ACCREDITATION (C&A) DOCUMENTATION

5.15. TASK 15: TASK ORDER MANAGEMENT

6. PERFORMANCE STANDARDS

7. PERSONNEL REQUIREMENTS

7.1. PERSONNEL REQUIREMENTS

7.2. KEY PERSONNEL

8. DELIVERABLES

8.1. DELIVERABLES MATRIX

8.2. DRAFT DELIVERABLES

8.3. WRITTEN ACCEPTANCE/REJECTION BY THE GOVERNMENT

8.4. NON-CONFORMING PRODUCTS OR SERVICES

8.5. NOTICE REGARDING LATE DELIVERY

9. GOVERNMENT FURNISHED EQUIPMENT (GFE) AND INFORMATION (GFI)

10. PLACE OF PERFORMANCE

10.1. REMOTE ACCESS

10.2. TRAVEL

10.3. TELEWORK

10.4. HOURS OF OPERATIONS

11. PERIOD OF PERFORMANCE

12. ICE REGULATIONS

13. ORGANIZATIONAL CONFLICTS OF INTEREST

14. SECTION 508 REQUIREMENTS

APPENDIX A – LIST OF ACRONYMS

1. Purpose The purpose of this procurement is to provide Operations and Maintenance (O&M) Support Services for the Department of Homeland Security (DHS) / Immigration & Customs Enforcement (ICE) / Homeland Security Investigations (HSI) Visa Security Program (VSP). The VSP requires Information Technology (IT) support to maintain the Visa Security Program Tracking System (VSPTS) Software Operations and Maintenance (O&M) Support Services.

2. Background ICE DHS is responsible for identifying and shutting down vulnerabilities in the nation’s border, economic, transportation and infrastructure security. The Office of the Chief Information Officer (OCIO) is responsible for the overall management, planning, development, deployment, operation, maintenance, coordination, and evaluation of ICE technology programs and activities.

Within OCIO, the System Delivery Division’s (SDD) mission is to acquire, develop, and deploy technology solutions that support ICE’s operational mission and mission support needs by combining deep understanding of the mission, technical expertise and process knowledge.

Within SDD, the Homeland Security Investigations (HSI) Portfolio Delivery Branch oversees IT programs and projects within the organization and develops system applications and information delivery services with an emphasis on the design, development, and support of technical solutions to meet the needs of HSI customers.

Managed by ICE OCIO and HSI’s International Operations (IO) Visa Security Program (VSP), Visa Security Program Tracking System’s (VSPTS) primary mission is to enhance national security by identifying and preventing potential threats posed by individuals applying for U.S.

visas. VSPTS personnel work closely with the Department of State (DOS) and other federal agencies to screen visa applicants and ensure that individuals who may pose a risk to the United States are denied entry. VSPTS supports VSP personnel in employing advanced investigative techniques, intelligence analysis, and law enforcement expertise to identify fraudulent applications, criminal activity, or ties to terrorism. VSPTS is a complex, high visibility national security system that includes a wide array of functionality including case management, interfaces to internal and external agencies and departments like Customs and Border Protection (CBP) and DOS, and detailed reporting capabilities. The VSPTS application is utilized to store, track, and manage DHS visa vetting and screening operations including the capture of metrics related to actions taken as a result of vetting, including Watchlist nominations, creation of Subject Records, and enforcement actions such as arrests or property seizures. The VSPTS application also provides the means to report on project metrics for the internal management of the program and for providing information as needed to Congress. The application is also the mechanism through which DHS submits admissibility recommendations to DOS regarding visa issuance decisions.

Recent enhancement work focused on expanding automating interfaces with external partners and expanding the user-facing functionality of the system to support additional business functions. The interface expansion includes the automation of Security Advisory Opinions (SAO) data to and from DoS Consular Consolidated Database (CCD). Additionally, enhancements have been made to the Immigrant Visa interface to allow pre-adjudication vetting to streamline and better prepare for the applicant interview process. The system functionality expansion primarily supports improved reporting capabilities and automated system monitoring.

The VSPTS support team requires an understanding of the following major technologies:

• Java Enterprise Edition (Java EE)

• PostgreSQL RDBMS

• JBoss / WildFly

• Artemis Active MQ

• Ansible

• Terraform

• Artificial Intelligence (AI)/Machine Learning (ML)

• Other emerging technology

Additionally, it is helpful for VSPTS support to have helpful detailed understanding of DoS Consular Affairs and CBP National Targeting Center (NTC) business and technical organizations.

3. Technical Landscape This section provides a high-level overview of the systems architecture, technology, and environments.

3.1. System Overview

VSPTS is an internal ICE application accessible only via ICE Intranet and is designed as a Web-based multi-tier JEE application. The system consists of a thin user interface client presented via a user’s Web browser, supported by backend Business Services and Data Access layers residing on a JEE Application Server. Authentication to the system is a hybrid implementation with Single Sign-On login leveraging the DHS AppAuth service and application-specific login for users not supported by AppAuth. The VSPTS Component Boundary was recently updated to WildFly as the web service.

VSPTS has data-sharing interfaces with CBP and the DoS. The diagram below displays an operational view of VSPTS and its relationship to ICE facilities, DoS and CBP.

3.2. System Architecture

VSPTS is architected as a standard 3-tier JEE application supported by an RDBMS data store:

1. Presentation Tier - provides access control for, and presentation of, the application to the user. The presentation tier is implemented using a combination of Servlets, JSPs, templates, and JavaScript for client-side validation and enhanced user experience features.

2. Business Services Tier – provides the business logic supporting the web client and data sharing interfaces. This tier is implemented by business model objects and business services objects accessed through a services façade and Message Driven Beans (MDBs) to service data sharing interfaces.

3. Data Access Tier – provides access to the VSPTS data store from the Business Services Tier. This tier is implemented by objects designed following the DAO design pattern leveraging Hibernate for Object-Relational Mapping functionality and Spring for transaction management.

4. Data Store Tier - provides presentation of, and access to, system data. The VSPTS data store is implemented by an RDBMS database server, currently an Oracle 19c database.

The diagram below displays the system architecture of VSPTS.

In support of DHS architecture standards and guidelines, ICE OCIO has developed a standard architectural framework and has deployed shared infrastructure to support the implementation and integration of business capabilities.

Releases are web-based and are accessed via a web browser from the standard ICE workstation/laptop image behind the ICE firewall. The application is used worldwide with expected up time, 24 hours a day and 7 days a week. The application is built in Java using standard and select third-party libraries but rely on the support of the WildFly Application Server enterprise application server container, provided by ICE Operations Application Services Branch

(ASB). Data is presented and accessed from an Oracle 19c database. All communication between the client and application server is over HTTPS protocol to ensure the secure exchange of data between the client browser and server. Communication between application server and database server is over standard Java Database Connectivity (JDBC) communication.

Releases include interfaces for the ingestion of data from DOS and as a means to provide DHS visa issuance recommendations to DoS. These interfaces in VSPTS are fully automated and include incoming and outgoing interfaces with CBP’s Automated Targeting System - Unified Passenger (ATS-UPAX) system.

Ingestion of DoS data in VSPTS relies on a format-specific translation of various reports from the DoS CCD system developed by DoS Consular System and Technology (CST) for the VSP organization.

VSPTS interfaces are implemented as queue-based mechanisms. VSPTS has interfaces with a BP system for the ingestion of visa application data originating from DoS, ingestion of screening results data, and the provision of DHS recommendations and select investigative information. All interfaces with CBP systems are implemented using IBM WebSphere MQ technology.

Automated submission of DHS recommendations to DoS occurs over an Oracle AQ queue interface hosted by DoS within a ‘Demilitarized Zone (DMZ) environment’ accessible to its data-sharing partners.

3.3. Hosting Environment

The VSPTS application relies on the DHS and ICE networks (including the ICE AWS Cloud) provided and supported by DHS OneNet and ICE Network Operation Centers (NOC) and the hosting infrastructure provided and maintained by the ICE ASB. The DHS and ICE network teams not only provide the network communication for the VSPTS infrastructure and users but also provide support for interagency network connectivity with CBP and DoS. The hardware architecture for the system is typical for a Web application within the ICE enterprise. Those components of the ASB infrastructure utilized by the VSPTS applications are detailed below:

• Hardware Load Balancing (F5).

o The load balancing cluster intercepts incoming requests and employs load balancing algorithms to route requests to available endpoints. In the context of the VSPTS application, client HTTPS requests are intercepted and routed to an available Web server for processing.

• Web Server WebSphere IBM HTTP Server (IHS).

o The Web server handles incoming HTTP requests from the client browser. The

Web server serves as the HTTP/HTTPS protocol handler and authenticates the SSL request before routing it to the application server.

• Application Server (WebSphere Application Server).

o The application server handles HTTP requests, acts as the J2EE container for the application software, and handles the HTTP response sent back to the client. The VSPTS application is a deployment unit that resides in the application server space. Calls to the VSPTS database, the WebSphere MQ servers for interfaces with ATS-UPAX, and calls to the DoS Oracle AQ interface are initiated from the application server.

• Database Server (Oracle Database).

o The database server provides the RDBMS acting as the central repository for all Create, Read, Update, and Delete (CRUD) operations within the application. It provides persistence of the data that the VSPTS application exposes.

• MQ Server (WebSphere MQ).

o The MQ server provides communication channels and message queuing functionality for transmitting messages between applications using a queuing construct. The MQ server provides the means for asynchronous message queue-based communication of data between VSPTS and CBP’s ATS-UPAX.

• External AQ Server (DOS).

o The External AQ server provides message queuing functionality for transmitting messages between applications using a queuing construct implemented within an Oracle database server. The External AQ server provides the means for asynchronous message queue-based communication of data between VSPTS and DoS-CCD.

AWS Cloud Instances are classified as either small, medium, large or extra-large. VSPTS runs mostly on medium and large CentOS Instances.

3.4. Technology Stack

Name Version Manufacturer Function

Java 8 Oracle Main programming language for Java EE application.

Spring Framework 3.2.13 VMWare

Java Application framework ad control container for Java.

Apache Struts 2.3 Apache Software Foundation

Open-Source web application framework for Java EE web applications.

Hibernate 3.0 Red Hat Object-relational mapping tool for the Java application.

Apache Tiles 3.0 Apache Software Foundation Templating framework for Java UI.

JUnit 4.7 Eclipse Public License Testing framework for Java application.

JasperReports 3.14 LGPL Reporting tool.

Jsp, Javascript, jQuery, CSS,HTML N/A Open source Front-end UI.

PostgreSQL 14.17 PostgreSQL RDBMS. Data repository and stored procedures.

Artemis ActiveMQ 2.19.1 IBM

Asynchronous messaging for data sharing interfaces.

Wildfly 18.0.1 Red Hat Java EE Application Server (beginning Sep.

2020)

Cloudbees CI N/A Cloudbees Continuous Integration/Continuous Delivery Github N/A Microsoft Corp Source control repository.

Name Version Manufacturer Function

Ansible N/A Ansible Inc/Red Hat

Infrastructure as Code (IaC) provisioning configuration management and application-deployment tool.

Terraform N/A Hashicorp Infrastructure as Code (IaC) provisioning tool.

Vault N/A Hashicorp Tool to secure sensitive tokens, passwords, etc.

4. Scope of Work ICE requires all applications to be maintained in an operational and efficient manner to ensure the highest level of support for the user community. O&M support includes adaptive maintenance, perfective maintenance, corrective maintenance, and preventative maintenance to include enhancements to the system and any requisite updates to the system documentation as requested by the Government. O&M support includes modifications to the application due to changes in the larger DHS Mission, VSPTS application configuration changes, security changes, infrastructure changes, and minor regulatory or agency changes. The Contractor shall provide personnel to support the O&M requirements of the VSP’s system as well as assist with the support of the VSPTS hosting environments which are in AWS Gov Cloud. O&M support includes the following major areas:

• Adaptive – modifying the system to cope with changes in the application platform

• Perfective – implementing new or changed user requirements which concern functional enhancements to the application platform

• Corrective – diagnosing and fixing errors, possibly ones found by users

• Preventive – increasing software maintainability or reliability to prevent problems in the future

To ensure successful performance, the Contractor must be flexible enough to adapt to changing priorities and to navigate the dynamic ICE OCIO environment. The Contractor shall work seamlessly with other project teams across the organization tasked with executing the Agency’s mission. Evolving and sometimes complex environmental factors may influence day-to-day workflow; however, Contractors shall participate fully and with best intentions to promote seamless interoperability across diverse OCIO project teams while fostering transparency and information sharing. The Contractor will be required to collaborate and coordinate with inter-governmental program offices (i.e. ICE, CBP, DHS, DoS, etc.). Solutions developed in connection to this work shall become the property of the Government; use of proprietary tools and sources is discouraged.

The Contractors shall maintain, manage, operate, and sustain supporting services and architectural solutions as part of agile sustainment. This includes adjusting to and meeting changing requirements and expectations. The O&M team will follow the agile software development methods based on iterative and incremental improvements. It promotes adaptive planning, evolutionary development and delivery, a time-boxed iterative approach, and encourages rapid and flexible response to change. It is a conceptual framework that promotes foreseen interactions throughout the enhancement cycle.

All system enhancements performed under this task order will follow agile principles as defined by the Government. This includes formal planning, grooming, reviews, collaboration, and commitment to deliverable size and timeline.

5. Tasks The Contractor shall provide qualified, experienced personnel to perform service and support for the continued O&M of the VSPTS application; the Contractor’s team shall be proficient in the technologies listed below:

• Java Enterprise Edition (Java EE)

• PostgreSQL RDBMS

• JBoss / WildFly

• Artemis Active MQ

• Ansible

• Terraform

• Artificial Intelligence (AI)/Machine Learning (ML)

• Other emerging technology

The Contractor shall utilize ICE's Agile Development Methodology to support operations and maintenance for VSPTS. This methodology is a structured approach to managing IT projects that emphasizes iterative progress, collaboration, and responsiveness to change. Within Agile, epics, stories, and backlogs are foundational elements for organizing and prioritizing work. Epics represent large-scale objectives or features, such as major system upgrades or enhancements to VSPTS, which are broken down into smaller, actionable units called stories - specific tasks or user requirements that contribute to the completion of an epic. These stories are organized into a backlog, a prioritized list of work items that teams address during iterative sprints. Tier 2 and Tier 3 help desk tickets, often involving complex technical issues, escalations, or requests, are integrated into this Agile framework. For example, software maintenance tasks, such as patching and updates, shall be treated as recurring stories, while incident management tickets related to system outages or errors shall be prioritized based on urgency and operational impact. Similarly, enhancement management tickets, which request new features or improvements, can be grouped into epics if they represent broader functionality changes.

Additionally, system change requests (SCRs), formal requests for modifications to VSPTS, originate from Tier 2 and Tier 3 tickets when recurring issues or user feedback highlight the need for system adjustments. By applying Agile methodology, the Contractor shall ensure that software maintenance, incident resolution, and system enhancements for VSPTS are handled efficiently and systematically. This approach addresses immediate technical challenges while also driving long-term improvements to the system, ultimately supporting ICE’s mission of securing the visa process and enhancing national security.

The Contractor shall adhere to a predefined sprint schedule, which includes operations and maintenance support as well as system enhancements. Each sprint shall be time-boxed and focused on delivering working software and meaningful functionality aligned with ICE’s objectives. During sprint planning sessions, the Contractor shall organize user stories into meaningful sets of functionality approved by Homeland Security Investigations (HSI) and the Office of the Chief Information Officer (OCIO). Each sprint shall implement the planned number of user stories, ensuring that they are tied to requirements, level of effort, story points, acceptance criteria, and alignment with respective epics or business processes. Sprint effectiveness shall be measured by the logical progression of functionality tied to the release structure and the successful completion of user stories’ acceptance criteria.

5.1. Task 1 - Software Maintenance – Tiered Support

The Government’s ICE Service Desk supports Tier 1 helpdesk tickets. The Contractor shall support all Tier 2 and Tier 3 helpdesk tickets.

5.1.1. Tier 1 Support

The ICE Service Desk serves as the single point of contact for IT issues and supports Tier 1 helpdesk tickets. The response times for Tier 1 are: immediate for telephonic reports and within one hour for e-mail reports. The ICE Service Desk has the following responsibilities:

• Receiving and recording accurately all calls from End Users regarding IT products and services into a ticket and assigning tickets to the appropriate Tier 2 or Tier 3 group for resolution, as needed

• Dealing directly with simple requests such as password resets and account unlocks for all applications supported, including basic network and application troubleshooting

• Monitoring incidents reported and escalating them to Tier 2 or Tier 3 groups, as appropriate

• Monitoring system or application outages assigned to the Tier 2 or Tier 3 groups and reporting on resolution progress to identified individuals

• Monitoring the tickets created to ensure users are updated on tickets’ status and progress

• Providing reports to ICE management and System / Application Program Management, as required or requested

Any IT issue or problem that cannot be resolved at the ICE Service Desk level or that is not under the purview of the Service Desk will be forwarded to the Contractor’s Tier 2 and Tier 3 support teams.

5.1.2. Tier 2 and Tier 3 Support

Helpdesk tickets that cannot be resolved at the ICE Service Desk level are escalated to the Contractor’s Tier 2 support team. The Contractor shall report the status of the helpdesk ticket using the ICE approved tracking tool.

If the Contractor’s Tier 2 support team cannot resolve and close the helpdesk ticket, then the ticket shall be referred to the Contractor’s Tier 3 support. All maintenance activities that reach this level shall have an SCR opened and be reported using the ICE approved tracking tool. SCRs will be approved in writing by the Government. SCRs will be prioritized and agreed to by authorized government personnel and recorded in the ICE approved management-tracking tool.

The Government will prioritize all outstanding bugs and SCRs and incorporate them into the development backlog. These issues will be resolved by the Contractor once the Government identifies them as the highest priority. The Contractor shall be responsible for carrying out all application maintenance requirements projects including opening SCRs and entering the data in the ICE approved management tracking tool.

Prior to commencing a system modification, the Contractor, ITPM and the OCIO Project Manager shall designate the level of effort using story points as specified in the table below.

Story Point Scale Estimated Effort Required

1 1 – 4 Hours 2 5 – 8 Hours 3 8 – 16 Hours 5 17 – 40 Hours 8 41 – 60 Hours 13 61 – 80 Hours

Troubleshooting Scripts Known issues that cannot be addressed through an SCR shall be documented and coordinated with the Office of the Chief Information Officer (OCIO) Operations Tier 1 Help Desk for inclusion as a troubleshooting script within the Service Desk tool.

Application Feedback Loop The Contractor shall develop an application feedback loop, whereas systemic issues identified during common Tier 1, 2, and 3 escalation procedures are routinely evaluated and reviewed with the Information Technology Project Manager (ITPM) to assess the need for a System Change Request (SCR) in a future release.

Service Level Agreement The Contractor shall respond to all Software Maintenance Tier 2 and Tier 3 helpdesk tickets in accordance with the service level agreements (SLA) agreed upon by the Governments as specified in the SLA table below.

Service Level Agreement Level Response Time Level 0: Modify system immediately, within six (6) hours (may require

Emergency Change Request) Level 1: Modify system within twenty-four (24) hours (may require Emergency

Change Request) Level 2: Modify system within forty-eight (48) hours (may require Emergency

Change Request) Level 3: Modify system within seventy-two (72) hours – one hundred (100) hours

SCR Requirements The following requirements apply to each of the software maintenance SCRs:

• All software maintenance is to be performed in accordance with ICE SLM procedures;

this includes, but is not limited to, the creation and maintenance of SLM documentation and successful completion of all release requirements as determined by the ICE Quality Assurance Branch.

• All software maintenance shall adhere to ICE and DHS Change Control Policies.

• All software maintenance shall adhere to ICE and DHS Architecture standards.

• All software maintenance shall adhere to DHS and ICE Security requirements; this includes, but is not limited to, maintaining security documentation and working with ICE Security personnel to address known security vulnerabilities, and supporting application certification and accreditation activities.

• All software maintenance shall adhere to DHS and ICE Privacy requirements; this includes maintaining privacy documentation as determined by the ICE Privacy Office

• All software maintenance shall be conducted on ICE Government Furnished Equipment

(GFE).

• All VSPTS code shall be stored in the ICE GIT Hub repository application.

• All VSPTS SLM documentation shall be stored in the ICE ELMS application.

• The Contractor shall coordinate and collaborate with HSI business stakeholders, end user community, and Interagency Partners as needed to troubleshoot, maintain and enhance the VSPT system.

• The Contractor shall provide Tier 2 and Tier 3 services using the ICE Service Now System. Access to the ICE Service Now System will be provided to the Contractor. Tier 2 and 3 support includes but is not limited to:

- Addressing questions/problems that Tier 1 is unable to resolve or must be coordinated with ICE government personnel, DHS Data Centers, ASB, and Security Operations Center

- Analyzing and identifying root cause(s) of all reported system issues

- Reporting findings and recommending response/resolution

- Documenting and maintaining helpdesk tickets using ICE approved Service

Now tool

- Generating statistical, workload, and trend analysis reports in addition to reports that ICE ASB provides

- Developing updated Standard Operating Procedures (SOPs), scripts, and procedures for Tier 2 and 3 staff to use when new information, releases, or changes have been distributed and/or implemented

- Providing support for collection and processing of metrics

Historical and Anticipated Level of Effort There are, on average, five (5) Tier 2 requests received per month for the VSPTS application for a total of 60 requests annually. The average resolution timeframe can vary significantly from only a few minutes to several hours depending on the issue presented and root cause. Over the past few years, approximately 78% of the help desk tickets submitted were minor in nature. The remaining 25% of tickets submitted were major issues (system down, manual import errors, etc.);

taking a few hours to several hours to resolve.

Troubleshooting complex issues usually requires coordination with end users, ICE ASB, and interagency business and technical stakeholders. Any issues identified with a root within the VSPTS application code will route to Tier 3 Development O&M. A SCR will be opened and the fix will follow either the Critical Release process (if critical) and/or be incorporated into the next release cycle of the application.

Over the past few years, two tickets have been escalated to Tier 3 Development O&M and resolved via the critical release process. The Contractor is expected to work closely with the ITPM on all Tier 2 and 3 support, to ensure issues are properly prioritized and managed.

The following table contains the anticipated number of Tier 2 and 3 break-fix/incident SCRs for each year:

Story Point Scale

Estimated Effort

Required

Typical Number of Stories Each Year

1 1 – 4 Hours 130 2 5 – 8 Hours 115 3 8 – 16 Hours 75 5 17 – 40 Hours 50 8 41 – 60 Hours 15 13 61 – 80 Hours N/A

5.2. Task 2 - System Support

The Contractor shall provide IT operational system support which includes support of interfaces and data sources, database support, reporting support, system tuning, migration of applications, and system administration.

The Contractor shall provide support for interfaces, including CBP’s (UPAX) system and the DoS’ Consolidated Consular Database (CCD). Additionally, the Contractor shall support the workflow for Security Advisory Opinion (SAO) data, which involves manually downloading SAO data from CCD daily and uploading it into VSPTS. Once recommendations are finalized, they shall be sent back to the DoS via email. The Contractor shall also support planned interfaces including automating the existing SAO interface to eliminate manual work and email communication.

The Contractor shall support all database updates to the data store. This includes all database structural changes to support system enhancements and defect corrections and the writing of database scripts to update or query information in the database. The Contractor shall support ad-hoc queries as requested by the OCIO program office and/or perform data analysis as requested.

The Contractor may be required to conduct performance tuning of the system as operational needs arise. The Contractor shall provide the ICE OCIO program office with guidance for system performance improvements for a more stable and robust system.

The Contractor shall provide support to the ICE Engineering group for system administration activities to include service configuration, troubleshooting performance issues, and installation of software updates/versions. The Contractor shall also support interfacing organizations with administrative activities including troubleshooting and configuration of server component software and security. The Contractor shall be responsible for correcting flaws in the software applications that escaped detection during development and testing of the system, or that have been introduced during previous maintenance activities; and improve software attributes such as performance, memory usage, and documentation.

The Contractor shall support ad-hoc data requests, standard reports, field problem report fixes, analytical report requests and fixes. The Contractor shall follow the SCR process set forth by the ICE SLM process. The reporting functions include, but are not limited to, the following:

• Creation of new standard reports.

• Modification of standard reports.

• Creation of ad-hoc reports.

• Support SQL Tuning/Report Tuning efforts as needed.

The Contractor shall also support Disaster Recovery (DR) and Continuity of Operations

(COOP).

5.3. Task 3 - Configuration Management

The Contractor shall conduct application-level configuration management for all O&M changes made to the system. The Contractor shall also support all requests for changes to established baselines and configuration management through the ICE approved SCR process. The Contractor, in conjunction with the ITPM, shall submit and review changes with the Change Control Board (CCB) as required.

The Contractor shall provide the following configuration support:

• Assign proper identification of all configuration items in accordance with agreed upon conventions.

• At the time of release, create a code branch for the release to support potential break fix needs.

• Prepare the development for the next planned release that shall be implemented against the trunk, this includes: The Contractor shall check out the code from GIT Hub and modify source code and unit test the code before committing it to the trunk. Once the code is committed to the trunk, it is automatically built and deployed into the development integration environment where the Contractor shall complete integration testing for that feature. This cycle is repeated throughout the development cycle.

Functional Quality Testing (FQT) builds are on demand and not automatically triggered. The promotion to FQT is managed by ICE-Engineering and their workload may not be able to support regular promotions. Once FQT, integration, and Section 508 testing is completed, limited independent interoperability testing may be required. At the completion of testing, the Contractor will request an on demand build to the production environment after the SLM approvals and CCBs have occurred.

The Contractor and ITPM will work closely to support configuration management in the allotted development hours.

5.4. Task 4 - Training Support

The Contractor shall maintain and update training materials to include the User Guide and System Administration & Operations Manual when an enhancement or other significant Software O&M release occurs. The Contractor shall provide an electronic copy of all training material to the ICE OCIO Electronic Lifecycle Management System (ELMS) document repository, the ITPM, and the Contracting Officer’s Representative (COR).

5.5. Task 5 - System Security / ISSO Support

The VSPTS O&M team is responsible for the ongoing support of the environment and application. All security patches must be implemented and reported on as completed. In addition, the Contractor shall:

• Ensure VSPTS complies with DHS/ICE standards for security, disaster recovery, and accreditation

• Work with the assigned ICE Information System Security Officer (ISSO) to address system security requirements including Reporting on Patch Management, and Updating/providing Security Documentation, if requested

• Support the Authority to Operate (ATO) renewals as required

• Ensure system administration training is up to date for any resource managing the environments and provide verification to the assigned ISSO

• Provide a Report on Remediation of Security Gaps and Vulnerabilities per the direction of federal staff

• Participate in activities that will support the ATO process in the systems development lifecycle

• Adhere to the ICE change control board policy and procedures

• Participate and remediate changes proposed by DHS audit team

5.6. Task 6 – Queries and Reporting

5.6.1. Queries

The Contractor shall provide the following support for queries:

• Search/query DHS databases or any other designated database as required

• Access and perform research on designated automated intelligence databases for identifying information of interest to the customer; downloading the identified information to an appropriate medium and editing the information into format(s) to be specified by the customer

• Conduct Ad hoc queries

• Conduct Batching and Imports of DHS and other systems’ data

• Write Oracle database queries and modifications

• Generate a Report on Number of Queries Generated as requested

5.6.2. Reporting

The Contractor shall support ad-hoc data requests, standard reports, field problem report fixes, analytical report requests and fixes. The reporting functions include, but are not limited to, the following:

• Creation of new standard reports

• Modification of standard reports

• Creation of ad-hoc reports

• Generate a report on number of reports generated as requested

The Government will provide the Contractor with licenses for the VSPTS reporting tool, Tableau, as needed.

5.7. Task 7 - Support of External Interfaces and Data Imports/Exports The Contractor shall support interfaces that feed into and out of the VSPTS application, this includes the import and export of data to and from business partners. The Contractor shall provide on-going support for interfaces that provide data to various components (e.g. DoS and CBP) and reports. In addition, the Contractor shall support interfaces to the various technical systems utilized for overstay vetting.

5.8. Task 8 - System Enhancements and Maintenance

The O&M effort will utilize the ICE Agile development methodology for any system enhancements required by the program. ICE’s Agile Development Framework consists of upfront product planning activities paired with an iterative implementation process. The figure below provides a high-level overview of ICE’s Agile Framework from the receipt of business requirements to the deployment of user prioritized functionality. A copy of the ICE Agile Methodology will be provided separately and will provide greater details concerning each step of the framework. The following diagram depicts the process that will be used for the enhancement/development effort.

The Contractor shall support the development and deployment of the following system enhancements.

5.8.1. Ad-Hoc Reporting

Currently, generating new reports and modifying existing ones is a manual process. When reporting coding changes are made, they cannot be implemented until the next scheduled VSPTS coding release. The Contractor shall provide the capability to generate ad-hoc reports in VSPTS by decoupling the reporting code from the VSPTS case code. As part of this effort, the Contractor shall collaborate with stakeholders to identify which existing reports will be retained, convert the backend logic of all retained reports into asynchronous processes using serverless components to allow faster modifications without dependency on release cycles, and update the VSPTS interface to provide greater flexibility in configuring report parameters.

The Contractor shall provide an Ad-Hoc Reporting Technical Approach for Government review and approval prior to implementation of the solution.

5.9. Task 9 - VSPTS Database Management

The Contractor shall assist with modifications to the VSPTS Database:

Creating the Backlog Developing and Managing Enhancement Development Process

• Monitor ongoing enhancements and maintenance of the VSPTS database application to include the addition of new modules, enhanced search capabilities.

• Assist with VSPTS Database Modifications as required.

• Continually enhance web service communication between other systems to automatically enhance VSPTS data.

The Government will provide the Contractor with a modification request instructing the Contractor on when to complete the change and the level of priority assigned. Below is a break-down of the priority structure for VSPTS modifications and the corresponding response time required by the Contractor.

In support of modifications, the Contract shall:

• Maintain a Log of Modifications to the VSPTS Database; include the log in the Monthly Status Report.

• Prepare the modification for approval by the designated ICE IT Program Manager.

• Make changes and document the changes to the system by providing a Monthly Status

Report to the ITPM.

• Ensure that documentation is complete and up to date.

5.10. Task 10: ICM Integration - Optional Task/Surge Support

The Contractor shall plan, design, develop, test and deploy integration with the ICE Investigative Case Management (ICM) application. The Contractor shall provide an ICM Integration Approach for Government approval prior to initiating this effort.

5.11. Task 11: Mantis Workflow Automation - Optional Task/Surge Support The Contractor shall plan, design, develop, test and deploy a feature to automate the import of Mantis Security Advisory Opinions (SAO) into VSPTS. MANTIS is a code name for a process within the visa security framework that focuses on identifying individuals who may pose a threat due to their involvement in sensitive technologies, weapons proliferation, or other activities that could impact U.S. national security. This solution is dependent on DoS action. Below are the expected phases of work:

1. The Contractor shall support discussions with DoS to automate the webservice call to pull data at consistent intervals (at least daily). This process is currently conducted manually on a daily basis.

2. The Contractor shall automate DHS responses to DoS leveraging the existing data flow to send response messages to DoS. This is currently conducted over email.

3. The Contractor shall automate Requests for Information (RFI) which is currently conducted over email. The automation would allow ICE to send the requests to DoS over an Application Programming Interface (API). DoS in turn would access VSPTS to post documents in response to the request. This capability is dependent on the completion of the Attachments feature.

The Contractor shall prepare a Government approved Mantis Workflow Automation Approach prior to initiating this effort.

5.12. Task 12 Searchable Attachments Functionality – Optional Task/Surge Support The Contractor shall provide search functionality of all attachments including keyword searches on the attachments. The Contractor shall prepare a Government approved Searchable Attachments Approach using AI prior to initiating this effort.

The Contractor shall prepare a Government approved O&M Support Catalog Item Approach prior to initiating this effort.

5.13. Task 13: System Lifecycle Management (SLM) and Deliverables The Contractor shall develop and submit SLM deliverables as required for System Maintenance Services projects as directed by the Government. All appropriate documentation shall be prepared in accordance with the guidelines specified by the SLM and the approved Project Tailoring Plan.

5.14. Task 14: Certification and Accreditation (C&A) Documentation The Contractor shall be responsible for maintaining and updating existing C&A artifacts to stay current with DHS/ICE and Federal requirements. VSPTS is in the Ongoing Authorization (OA) Program. OA abandons the traditional three-year ATO cycle through continuous monitoring with monthly tailored risk assessments and event-driven risk assessments. The Contractor shall also be responsible for supporting the Information Systems Security Officer (ISSO) for any annual C&A activities,

5.15. Task 15: Task Order Management

5.15.1. Post-Award Kick-Off Meeting

The Contractor agrees to attend any post award conference convened by the Contracting Office.

The Contractor shall present a Kick-off Briefing one (1) week after contract award, to include an overview of the project team, scope of work, deliverables, transition activities, communication approach, initial risks, and next steps.

The CO, COR, and other government personnel, as appropriate, may meet periodically with the Contractor to review the contractor's performance. At these meetings the CO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

5.15.2. Roadmap

The Contractor shall develop and execute, upon Government approval, a comprehensive Roadmap outlining their approach to performing operations and maintenance for VSPTS including a strategy for managing the system effectively, a breakdown of specific tasks and activities, key milestones, deliverables, and roles and responsibilities within the Contractor’s team. The Roadmap shall also address risk management by identifying potential challenges and proposing mitigation strategies and include a communication and reporting approach to ensure regular updates and alignment with stakeholders.

5.15.3. Backlog Management & Sprint Planning

The Contractor shall manage the Backlog which includes all operational O&M tickets, security updates/patching, quality assurance tasks, and 508 compliance using Agile methodology.

The Contractor shall plan for and conduct the sprint planning meetings for new releases where open SCRs will be reviewed and prioritized. The Government ITPM and System Owner will determine, in participation with the Contractor, the items to develop the initial baseline schedule for SCRs.

5.15.4. Status Reporting

5.15.4.1. Weekly Status Reports

The Contractor shall provide a Weekly Status Report on immediate tasks, issues, and short-term progress and accomplishments. The report shall include the following:

• Accomplishments: Key tasks and milestones completed during the week.

• Planned Activities: Tasks and deliverables planned for the upcoming week.

• Current Issues/Risks: Any challenges, blockers, or risks encountered, along with mitigation plans.

• Action Items: Outstanding tasks or decisions required, with assigned owners and deadlines.

• Resource Updates: Any changes in team resources or availability, if applicable.

5.15.4.2. Monthly Status Reports

The Contractor shall provide Monthly Status Reports on a broader view of progress to include:

• Executive Summary: A high-level overview of the project’s status, progress, and key updates.

• Progress Against Milestones: Updates on major milestones, deliverables, and timelines.

• Key Accomplishments: Significant achievements or completed deliverables during the month.

• Upcoming Activities: Major tasks, milestones, or deliverables planned for the next month.

• Issues and Risks: Summary of critical issues and risks, along with mitigation strategies.

• Change Requests: Any approved or pending changes to the project scope, timeline, or budget.

• Metrics: Performance metrics

• Dependencies: Updates on external or internal dependencies impacting the project.

5.15.4.3. Quarterly Status Report

The Contractor shall provide Quarterly Status Reports that include a strategic and comprehensive view of the project’s progress, challenges, and alignment with goals. The report shall include:

• Executive Summary: A strategic overview of the project’s progress, alignment with goals, and overall health.

• Progress Overview: A summary of progress made during the quarter, including completed milestones and deliverables.

• Schedule and Timeline: Updates to the project schedule, including any delays or adjustments.

• Key Accomplishments: Major achievements and successes during the quarter.

• Challenges and Risks: High-level analysis of critical risks, issues, and their impact on the project.

• Planned Activities for Next Quarter: High-level plans, goals, and deliverables for the upcoming quarter.

• Lessons Learned: Insights or lessons from the quarter that can improve future performance.

• Decisions and Approvals Needed: Any critical decisions or approvals required from leadership or stakeholders.

• Performance Metrics: A summary of performance indicators to measure project success.

5.15.4.4. Annual Status Report

The Contractor shall provide Annual Status Reports on the project’s overall performance, achievements, challenges, and alignment with organizational objectives over the year. The report shall include:

• Executive Summary: High-level overview of the project’s annual performance, including key achievements and challenges.

• Project Goals and Objectives: Review of how the project aligned with organizational goals and objectives.

• Major Accomplishments: Summary of significant milestones, deliverables, and successes achieved during the year.

• Schedule and Timeline Review: Analysis of the project’s timeline, including delays, adjustments, and adherence to original plans.

• Challenges and Risks: Comprehensive review of risks encountered during the year and how they were mitigated.

• Lessons Learned: Key insights and lessons from the year that can inform future projects or phases.

• Performance Metrics: Annual review of metrics to evaluate project success and impact.

• Stakeholder Feedback: Summary of stakeholder input, concerns, and recommendations.

• Future Plans: Outline of next steps, goals, and deliverables for the upcoming year or project phase.

• Strategic Recommendations: Suggestions for improving project execution, addressing challenges, or enhancing alignment with organizational priorities.

5.15.5. Status Meetings

5.15.5.1. Weekly Status Meetings

The Contractor shall plan for, schedule and conduct we weekly status meetings to track schedule updates and changes. Operational support will require cross-departmental (e.g., Department of State) and cross-agency (e.g., Customs and Border Protection) coordination to define requirements, design, develop, and implement system interface system change requests.

The Contractor is expected to capture Meeting Minutes from all weekly status meetings and provide Weekly Schedule Updates to the ITPM. Communication is essential between the Contractor, System Owner, and Government ITPM to respond to any questions or requirements clarifications.

The Contractor may be tasked to develop additional IT solutions as components of the current application.

5.15.6. Quarterly Status Meetings

The Government and Contractor shall meet on a quarterly basis meet to review the state of the work performed under the PWS and discuss any issues regarding how the project is being conducted and mutually agree upon resolving any concerns. Such quarterly meeting shall include HSI management from the Government and executive leadership from the Contractor.

5.15.7. Transition Planning

The Contractor shall ensure a smooth Transition-In from the current activities and responsibilities of the incumbent. The Contractor shall complete the Transition-In activities within 60 calendar days after award. Beyond the typical system access and code review transition activities, VSPTS maintains critical interfaces with two partner agency systems: CBP's UPAX and Department of State's Consolidated Consular Database. These interfaces are the most common failure points for the VSPTS workflow and represent the greatest area of complexity.

Due to these partnerships, a number of distinct stakeholder groups maintain interest in VSPTS and must be fully understood by the incoming team. Lastly, while most tasks are automated, there are a number of manual activities and processes that must be learned and transitioned to the new team during the transition-in period.

Administrative and technical activities included as part of Transition-In include:

Administrative

• Workplace logistics and staffing plan: Identification of transition team members by name, position, Entry on Duty (EOD),…