RFI 47HAA023N0007 IRIS.pdf

General Services Administration Office of Internal Acquisition

Request for Information: 47HAA023N0007

PBS Inventory Reporting Information System (IRIS)

Operations and Maintenance Support

For

Office of Chief Information Officer Office of Public Buildings Information Technology Services

May 5, 2023

Disclaimer

This Request for Information (RFI) is for planning purposes only and is not a Request for Quotes (RFQ), Request for Proposals (RFP), Invitation for Bids (IFB) or an obligation on the part of the Government to acquire any services. Responses to this RFI are not offers and can/will not be accepted by the Government to form a binding contract. The Government reserves the right to determine how it should proceed as a result of this notice. Furthermore, those who respond to this RFI should not anticipate feedback with regard to their submission. The Government will not pay any cost incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the responding party’s expense. The information provided in this RFI is subject to change and is not binding on the Government. Failure to respond will not in any way prevent a potential offeror from participation in any future solicitations.

You are requested to respond to this RFI via electronic mail to Contracting Officer, Erica Pelham at erica.pelham@gsa.gov no later than May 19, 2023 at 11:00 AM EST.

1.0 Introduction

1.1 Purpose

The General Services Administration’s (GSA) Office of the Chief Information Officer – Office of Public Buildings Information Technology Services (PB-ITS), 1800 F Street, NW, Washington, DC intends to acquire support for the operations and maintenance (O&M) for GSA’s enterprise-wide Inventory Reporting Information System (IRIS) application. The task will provide support for the application operability which includes support for the operability, usability, security, and upgrades to integrations. Operational maintenance of the application including all necessary updates, corrective action of escaped defects or on behalf of user operations, security-related changes, security mitigation solutions, and support of future-contracted enhancements. The support of this application will include the incorporation of and ongoing maintenance of workflows presently existing as well as those developed by enhancements. The Contractor shall provide corrective / adaptive / perfective / preventive maintenance and support as described in Section 3.1 The Contractor shall use industry best practices and Federal guidelines for ensuring the optimal support of the IRIS application. As identified in code review, security audits, health checks or other reviews of the application, the Contractor shall identify a plan to incorporate changes to ensure the secure, stable, and sustainable maintenance of the application in the GSA environment. Where applicable the Contractor shall solicit feedback, clarification or suggest modifications to ordering or sequencing of events that will improve the business process.

1.2 Objective

The objective of this task is to provide a means by which a Contractor will be selected who shall be responsible for the performance of work as described in this document, with paramount importance placed on quality, efficiency, cost effectiveness, and optimal utilization of resources.

The Contractor shall exercise their best efforts in performing the required services and provide qualified staff to perform services in a complete, prompt, accurate, professional, and efficient manner. The ability to respond and to perform assignments with high quality services within stringent time frames is essential. The Contractor shall maintain continuous performance regardless of holidays, vacations, or sick leave. As a part of the scope of work, the Contractor shall perform the tasks described throughout this document. All tasks shall be performed in close and continuous coordination with the appropriate PB-ITS Government representatives: PB-ITS Project and Program Managers, and/or Contracting Officer’s Representative (COR) (hereinafter “the Government”). All the approaches and/or methodologies proposed by the Contractor are subject to the approval of the Government and all deliverables are subject to review by the Government prior to acceptance. The Contractor shall provide all personnel, administration, management, and local travel necessary to perform the following functions:

● Program and Technical Support

● O&M of IRIS

● Systems Enhancements (As Requested by the Government - OPTIONAL)

● Procedures and Guidelines

The period of performance for this SOW will consist of a 12-month base year and not to exceed four (4) twelve (12) month option periods.

1.3 Background

GSA has repair and alteration responsibility for over 1,600 buildings covering 250 million square feet of office buildings, courthouses, warehouses, and other unique properties. It is important for Public Buildings Service (PBS) to allocate available repair and alterations funds in a manner that is consistent with its overall portfolio strategy, which calls for us to concentrate our available funding on strong income-producing properties while fulfilling our obligation in meeting the workplace needs of our customer agencies.

The process of identifying building deficiencies and developing a multi-year plan of repair and alteration projects begins with the Building Assessment Tool (BAT) module within IRIS whereas the Work Item Inventory Module within IRIS helps in the documentation and scheduling of the identified building needs and tracks the execution of projects.

The Portfolio (PT) Basic Repairs & Alterations (R&A) BA54 program funds repairs and alterations, mainly in GSA PBS's owned inventory, between $50,000 (the BA61/BA54 threshold) up to the prospectus threshold ($3,613,000), apart from recurring work. Most of BA54 funding is for approved projects whereas around 35% of those funds are for discretionary purposes. These funds are for projects to respond to emerging/unforeseen R&A work needs, change orders, small project designs, etc.

Overall, IRIS distinguishes between repairs and replacements that are required to ensure the short-term operational viability of the building and those capital projects that will be required over the long term. IRIS tracks work items as Design, Inventory, and Construction and archives them when they are completed. When funds are obligated, the associated work items are designated as construction status and are sent to the financial and accounting systems.

IRIS is used by Asset Teams to create and catalog work items for a building. These work items have an estimated value which is determined outside of IRIS. IRIS currently houses 5 Web-enabled applications with a sixth one under development to be released in June 2023. The six applications are Work Items (WI), Building Assessment Tool (BAT), Facilities Management Assessment (FMA), Occupational Safety and Health (OSH), Prioritization of Asset Repair (PAR) and Utility Competitive Account Tool (UCAT).

IRIS Work Items helps Portfolio Management in managing the estimated repair and alteration costs for building projects and new construction. Work items are used to create projects, either as a standalone, or bundled with other work items. Organization of Work Items in IRIS helps in program analysis which in turn helps in the planning of our BA54 and BA55 programs. IRIS also captures and feeds key data elements to downstream financial systems, and tracks the status of R&A deficiencies identified during survey inspections:

● In the planning phase, IRIS helps in identifying and organizing a list of Repairs and

Alterations (R&A) projects for every region. IRIS also helps in planning and managing disaster related and other special emphasis and initiative funds through the assignment of National Priority codes.

● In the execution phase, IRIS tracks various project milestones such as actual versus planned completion dates and estimated vs obligated/actual costs. IRIS also is the source of project coding that goes into Purchase Requests (PR).

● In the closure phase, IRIS helps in project documentation needed for financial closeout and to trigger depreciation in capitalized projects.

Building Assessment Tool (BAT) serves as a strategic planning tool for assessing and analyzing the reinvestment requirements of GSA’s owned real property portfolio to comply with OMB’s mandate of reporting GSA’s total liability on an annual basis. BAT automates and standardizes condition assessments. It provides a regular and consistent assessment of the physical condition of each building’s basic structure and systems and an overall assessment of GSA's building inventory. BAT helps Portfolio Management Division in:

● Identifying building liabilities that are later used by Portfolio for developing multi-year plans for repair and alterations projects.

● Consolidating and prioritizing building deficiencies through survey inspections that helps in identifying deferred maintenance costs.

Facilities Management Assessment (FMA) helps the Office of Facilities Management (OFM) to assess business processes regarding the way that risks to our physical assets, people, and the environment are identified, analyzed, and mitigated. The FMA module provides the backbone for data-driven risk management. It will allow for the identification of trends, creation of strategic solutions, and development of economies of scale in risk mitigation approaches.

Occupational Safety and Health (OSH) streamlines the process of risk management associated with unsafe or/and unhealthful working conditions at GSA workplaces for timely corrective actions.

● Risk Identification: Through regular scheduled survey assessments, OSH helps surveyors assess risk areas in the field of Occupational Safety and Health.

● Risk Reporting: In order to ensure timely reporting and minimize the impact of a deficiency, OSH module helps route the information to the appropriate GSA personnel for their action in risk mitigation.

● Risk Mitigation: OSH module facilitates regional users to document corrective action along with planned and completion dates. This helps OSH users track and prioritize risk conditions based on severity and probability for timely mitigation and closure.

Prioritization of Asset Repair (PAR) allows the regional asset teams to maximize their ROI by prioritizing their investments for a robust asset strategy. PAR will enable the Portfolio Management and Customer Engagement (PMACE) division to organize and prioritize short- and long-term asset investment needs based on a systematic methodology.

Utility Competitive Account Tool (UCAT), which is currently under development and scheduled to go live in June 2023, would allow the GSA Energy Division to support all operations of the deregulated energy supply programs including customer and vendor gas and electric accounts, contract, and MOA information, so that team members do not have to manually enter data multiple times or manage it outside of the system in spreadsheets. This is to ensure that timely and accurate account management, updates, and reporting needs are fulfilled as well as to ensure timely customer support.

IRIS supports four business lines, Portfolio Management and Customer Engagement (PMACE), Office of Facilities Management (OFM), Office of Design and Construction (ODC) and Office of Administrative Services (OAS). For PMACE and ODC, IRIS has three dedicated applications: IRIS-WI, IRIS-PAR and IRIS-BAT. These three applications have been explained above. IRIS supports OFM with the FMA and UCAT modules. FMA supports the Risk Management Division in the Fire Protection, Health & Safety and Environmental program areas.

The UCAT module within IRIS supports the Energy Management division within OFM with procurement of their energy needs. IRIS supports OAS with its OSH module that focuses on occupational health and safety.

The IRIS application supports 4 business functionalities within four separate modules: Work Items, Safety Assessments, Building Assessment, and Asbestos. Currently, IRIS is hosted on JBOSS AS and PostgreSQL 15.1 DB enterprise database solutions. The PBS portal provides the security framework, including a single-sign-on (SSO) mechanism and user authentication for IRIS and other PBS applications. IRIS currently utilizes middle-tier architecture components (primarily for presentation) JEE Application Server, REST-JSON, AngularJS, and JQuery for the front end and Spring framework supporting the backend for IRIS Work Items, FMA, OSH and BAT modules. PAR has been developed to use Angular instead of Angular JS and UCAT is being built to use the same. For both PAR and UCAT, the backend is supported by Spring framework. IRIS was a developed platform, which facilitates richer and more sophisticated features as well as higher volume of transactions and users.

IRIS obtains and provides data to other GSA/PBS applications; however, these are not through direct interfaces. All data exchanges are performed via the PBS Business Information (BI, which is a data warehouse) except for Kahua that uses Mulesoft API to read data from IRIS directly.

The current user community consists of 137 roles for the 5 modules, each holding different levels of data access privileges, and approximately 3200 users with read, create, and edit access across the United States and United States Territories.

1.3.1 Release Information Statistics

The following release information statics occurred during FY22:

Number and Type of Releases. There were a total of 28 releases in FY22.

● 1 major (45 of average requirements) (45 Total)

● 12 minor (16 average requirements) (184 Total)

● 5 DRs (2 average requirements) (8 Total)

● 11 eFixes (3 average requirements) (27 Total)

● Average Requirements per Release: 10 (264 Total)

The total number of enhancement user stories (note: requirements and user stories are used interchangeably) were 338 in FY22.

Number of FY22 Tier Two/Three Help Desk Tickets logged in ServiceNow. The number of help desk tickets was 274.

IRIS interfaces with BI to push a subset of data to Pegasys and to pull certain data from FMIS.

Through an interface with PBS BI Infrastructure IRIS:

● Retrieves building and lease information from BI to display in all the IRIS modules.

● Sends Project ASIDs and Substantial Completions Dates to Pegasys via the BI interface.

● Pulls project spending results from USDA’s FMIS via BI to display in Work Items and PAR.

1.3.2 IRIS Data Exchange

The following diagram visually represents the data exchange between IRIS and other information systems. IRIS does not employ persistent or dedicated interconnections, instead it employs the dynamic, sporadic, or regularly occurring data feeds, services, or file transfers.

Some of these main interfaces are:

● Sailpoint is the 3rd-party product used to manage user identity and access via IRIS roles.

It provides a workflow process for users to request access and respective application admins to process access requests.

● Pegasys: GSA’s core accounting system, which, among other accounting activities, provides general ledger, budget execution, project cost accounting, and cost allocations.

IRIS does not directly interface with Pegasys. Instead, IRIS pushes the ASID actual data that it receives from FMIS to Pegasys via the interface with the BI Framework.

● FMIS: database is a warehouse of financial information owned by the USDA. IRIS receives updates of the project amounts (ASIDs) via the BI Framework data warehouse.

IRIS receives financial actuals from the FMIS system for each ASID. IRIS receives this information with database scripts every morning. IRIS receives the following information elements from FMIS for each ASID:

· Obligations

· Payments

· Open Items Summary

· Real Property Asset Depreciation – RPADS

· Fixed Asset(s)

● The BI Framework environment: was created to eliminate much of the redundant/errant data within existing PBS applications. It simplified the navigation across systems and the corresponding collection of data for the typical end users. The BI Framework provides a true data warehouse for PBS associates, and creates a single path for data access, the creation and compilation of information for reports, dashboard populations, and the simplification of the overall business architecture.

IRIS interfaces with BI to push a subset of data to Pegasys and to pull certain data from FMIS. Through an interface with PBS BI Infrastructure IRIS:

● Retrieves building and lease information from BI

● Sends Project ASIDs and Substantial Completions Dates to Pegasys via the BI interface.

● Pulls project spending results from USDA’s FMIS via BI

● Asset Business Plans (ABP): Portfolio uses the Asset Business Plan (ABP) to develop, track, and store long-term asset strategies used for managing and optimizing the financial performance of the PBS real property inventory. The application pulls data from many other PBS national systems (RExUS, OA Tool, BI, IRIS) to assemble a detailed snapshot of each asset in the portfolio, including its financial performance, budget data, physical condition, liabilities, tier, short- and long-range plans, and customer and market information.

● Enterprise Acquisition System Integrated (EASi): EASi streamlines and automates the acquisition lifecycle process from creation and funding of a procurement request to standardization of the solicitation and award packages, funding the certification, obligation, and administration of an award.

● Reimbursable Work Authorization Entry and Tracking Application (RETA): The Reimbursable Work Authorization Entry and Tracking Application (RETA) enables external customer agency and internal GSA users to initiate, amend, review, digitally sign, and submit work requests, Reimbursable Work Authorizations (RWAs or GSA Form 2957) and RWA cost estimates. The entire process is available online for customer agencies. RETA also provides the ability to search online for RWAs and generate reports summarizing and detailing RWAs; review obligations, commitments, and costs at a detail and summary level; and review financial information; and maintain an audit trail of key transactions.

● Kahua/Project Management Information System (PMIS): Kahua is PBS’ new enterprise-wide project management information system. It will be the tool where project work gets done and will set the foundation for project excellence. If you collaborate on projects in federally owned or leased space, you will use Kahua to store and share project information and track the project progress. Having all stakeholders use the same project management tool helps to improve project delivery practices, standardize operating procedures, and ensure security and privacy.

2.0 Scope of Work

The Contractor shall provide all personnel, administration, and management necessary in support of the IRIS Application and ensure its success by providing support in the following areas:

● Project Management

● Application Operation and Maintenance (O&M) Support

● Optional Enhancements

● Security Compliance

This work will include but is not limited to software development, integration, testing, maintenance, audit support, system analysis, impact analysis, documentation, reports, and progress monitoring using reporting procedures and measures of performance. These shall be in accordance with industry best practices, NIST, OMB, GSA and PB-ITS policy and guidance in a manner consistent with CMMI Level III and ISO 9001:2015 practices and protocols.

Contractor shall propose an Agile approach to development and use Agile methods to the extent feasible to deliver an operational solution. Contractor shall propose methods to monitor the delivery of work using Agile artifacts such as product backlog, iteration backlog, release backlog, iteration planning and review, iteration team meetings, velocity, error detection and management, and reports on burndown rates. Contractor shall provide a list of proposed artifacts and the frequency of their submission to GSA as part of their Agile Approach narrative in their Performance Work Statement.

Contractor shall use a Government-designated electronic repository to capture all artifacts and deliver the solution in the agreed-upon timeframe, and per the agreed-to criteria for acceptance.

GSA currently uses JIRA.

3.0 Specific Requirements or Tasks

The Contractor shall assume responsibility to provide support for the operation, maintenance, and performance of the IRIS Application. Support for this application includes all environments (PROD, TST, INT, INT-O, API FW, Contingency). The Contractor shall coordinate all technical implementation tasks with Government-designated support teams including server, application, network and/or security teams. This task includes the technical support, changes, and architectural expertise to maintain the application in compliance with all existing GSA policies and guidelines. Issues that may be discovered through scan, reviews, and audits throughout the task and phase-out periods shall be resolved in the timeframes defined by GSA Policy. The Contractor shall follow the approved PB ITS lifecycle methodology for system upgrades, releases, and maintenance activities. Please note, GSA will not provide the vendor a development (DEV) environment or any associated licensing of products supporting the DEV environment.

The Contractor shall meet and comply with all GSA IT Security Policies and all applicable GSA and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology. The Contractor shall follow the Enterprise Quality Program (EQP) for Public Buildings Information Technology Services (PB-ITS).

Since IRIS is directly related to construction cost estimates and the algorithms that run in IRIS help in determining the deficiency estimates, it’s important that the incoming vendor has a firm knowledge base of construction cost estimates and how they play a role in the determination of building deficiency cost. The task requires a thorough analysis of surveys where algorithms are tied to survey questions in the determination of deficiencies pertaining to various building systems. In addition, familiarity with the following technologies would be a benefit:

1) RS Means Data

2) Building Management

3) Building Assessment Methodology - Survey based versus Building Engineering Reports

4) Micro systems

5) Jasper Reporting Tools

3.1 Operation and Maintenance - Task 1

Activities include:

● Identifying and repairing defects resulting from design errors, logic errors and coding errors. The Contractor shall document the defects resulting from:

o data processing errors, system performance errors, escaped defects from internal quality control and user acceptance testing (UAT), or reported through a help desk or other incident identification methods.

● Upon report of an escape defect, logic error and/or coding errors the Contractor shall initiate a root cause analysis (RCA).

o The RCA prepared by the Contractor shall indicate the error, its symptoms, and the impact of the error on present operations. If a workaround is available this shall be documented as well as any other instructions for end users or Tier 1 helpdesk personnel to use until the error is corrected.

o The report shall indicate the time the defect was first reported as well as progress notes (including resolution estimates if known). This report shall explain in non-technical language all pertinent details of the error and resolution once the error’s solution is known.

o The initial report shall be delivered via email to the Government Program Manager and COR. Each report shall indicate the next estimated update. The Contractor shall make updates to the PM and COR following this schedule and/or when requested by the Government.

● Ensuring the application is operable using the GSA list of approved software.

Specifically, we require the use of hardware/software/tools that are on PB-ITS IT Roadmap. (This is not an exhaustive list of all technologies used or approved in GSA, rather only a subset of GSA approved technologies.) See Appendix F - PB-ITS Technical Roadmap.

o If the Contractor wishes to propose a new technology, they shall follow the software approval process outlined here: https://tech.gsa.gov/guides/software-request-guide/

● Ensuring that the application remains compatible with GSA-designated desktop operating systems and supported browsers (currently Chrome and Microsoft Edge). The current agency standard for desktop operating systems includes Microsoft Windows 10 and Microsoft Office 365.

● Recommending activities to improve security, performance, or availability.

● Ensure the application functions as expected, (i.e smoke testing) following changes to the environment or infrastructure, such as after OS updates or security patches, etc.

● Supporting server, data, or other service migrations to ensure applications are operational post-migration. Migration activities may include any environment, on-prem server to server, data conversions, on-prem to cloud, application refactoring or other.

● Ensure the application remains optimally operational following industry best practices of design and technical operating environments. The Contractor may recommend to Government-designated support teams technical configurations that may improve performance, availability, or stability. However, the Contractor shall ensure the application is optimally available given the architecture, toolsets, configurations, and resources available within the agency.

● Providing fixes for security findings in compliance with current GSA IT Security policy.

https://tech.gsa.gov/guides/software-request-guide/ https://tech.gsa.gov/guides/software-request-guide/

● Notify the Government of hotfixes or end-of-life dates to the operating system, middleware, database or supporting technical platforms (including patches) impacting the usability or having an impact on the application. Contractor shall be responsible for coordinating with the government to ensure components of the application will be upgraded prior to the end-of-life hardware/software.

● Ensure the application remains operable following changes to the environment where the application sits. The application will optimally perform with these patches in accordance with IT Security Policy and prior to Government-designated published update cycles. The environment change may result from a change in business rules or processes, government policies, and software and hardware platforms.

● Maintaining or creating all documentation required by PB-ITS (e.g., design documents, testing plans and scripts, installation instructions). This documentation shall be included as artifacts for each deliverable consistent with the EQP Policy for a given release.

● Prepare release packages based on the maintenance release plan and strategy following EQP processes o Support deployment of the release into all environments including production.

o Ensure applications are tested under “real world” loads and scenarios to maintain optimal average “page load time” for each page in the application o Use the Government’s instance of JIRA to formally submit and track releases.

● The Contractor shall support server or data migrations to ensure applications are operational post-migration. Migration activities may include any environment, on-prem server to server, data conversions, on-prem to cloud, application refactoring or other.

● The Contractor shall perform maintenance to ensure the application meets minimum accepted performance targets. Maintaining the system’s performance, maintainability, reliability and security shall follow emerging standards such as the Consortium for IT Software Quality (CISQ) (http://it-cisq.org/standards/), including the updating of documentation and the upgrade of components, frameworks, versions to maintain the technical operation of the information system.

● The Contractor shall deliver corrective responses to security findings ensuring compliance with Government security requirements. Delivery of these corrective security findings shall be conducted within the timeline designated by audit teams or may follow prescribed deadlines. The Contractor shall ensure the corrective response is within the minimally recommended date. Current policy requires all high and critical findings to be resolved within 30 days.

● The Contractor shall maintain all current application interfaces with other applications, as well as any application interfaces established in the future. Contractor shall coordinate and work with any Contractor supporting an interfaced application with activities to include, but not be limited to, troubleshoot interface issues, establish a new interface, provide data, etc.

● The Contractor will support any calculation changes to algorithms that run in BAT to determine deficiency estimates, as described in Section 3.0. Any modifications to said algorithms including, but not limited to, changes to improve accuracy of results, correct issues, and/or update calculations and figures, shall be done as a task under O&M.

● Corrective / Adaptive / Perfective / Preventive Maintenance and Support. The Contractor shall provide corrective / adaptive / perfective / preventive maintenance and support as http://it-cisq.org/standards/ described below utilizing Agile techniques to include cross-functional teams, rapid iteration, and regular testing to make improvements to this solution.

o As an example of how this support might work: Project ABC utilizes 2-week parallel Agile sprint cycles, one for operations and maintenance and one for optional enhancements. There are typically 26 O&M sprints which include between 55-70 user story points depending on the specific development going on.

There are dedicated business line product owners who work closely with the development team throughout sprint cycles in support of Agile processes and participate in all Agile ceremonies. At the end of each sprint, the business line chooses whether to deploy each sprint into production or bundle sprints.

Typically, O&M sprints are deployed at the end of each sprint, while optional enhancement development sprints are typically bundled and deployed at the end of the project and merged with the current maintenance code.

o Corrective maintenance and support: Involves repairing defects resulting from design errors, logic errors and coding errors. Defects result from data processing errors and system performance errors, escaping internal quality control and client acceptance testing, or reported through a help desk or other designated interface.

Ongoing maintenance and support may include the administrative update of data by script, data load or similar updates consistent with the Content Management policy of the Government.

o Defect Support - Corrective maintenance for all enhancements after their Government acceptance and deployment in the Production environment.

o Perfective maintenance and support: Involve accommodating new or evolved user requirements. It generally includes functional or user interface enhancements to a component or service and activities that increase the system’s performance. Minor changes to system features, configurations, templates, reports, dashboards, and integrations based on test results, user feedback, or changes in agency needs are included in this Perfective Maintenance work. (Note: enhancements are considered those where there are significant structural change(s) or significantly new features are added requiring substantial work and are not included in this category of maintenance and support).

o Preventive maintenance and support: Involve activities aimed at increasing the system’s maintainability, such as improving the modular structure of the software systems, testing system and configuration changes, and updating documentation.

This maintenance includes the upgrade of components, frameworks, versions to maintain the technical operation of the information system.

3.1.1 Performance Subtask

The Contractor shall:

● Develop and manage all documentation required by PB-ITS (e.g., design documents, testing plans and scripts, installation instructions). This documentation shall be included as artifacts for each deliverable consistent with the EQP Policy for a given release.

● Ensure applications are tested under “real world” loads and scenarios to maintain optimal average “page load time” for each page in the application and “% of slow pages” for average of the entire application. The Government will provide the Contractor with the target metrics for page load time and percent of slow pages. The Contractor shall recommend configuration settings to optimize infrastructure and shall modify application code or SQL Queries to meet government performance targets.

● Prepare release packages based on the maintenance release plan and strategy.

● Vendor shall support the deployment of the release by Government appointed staff into all environments including production.

● Vendor shall assist Government appointed staff in maintaining the IRIS application on servers supported by Government appointed staff.

3.1.2 Quality Management Subtask

The Contractor shall identify and implement its approach for providing and ensuring quality by developing a Quality Management Plan (QMP). The QMP shall describe the application of the appropriate methodology (i.e., quality control and/or quality assurance) for accomplishing performance requirements. The QMP shall describe how the appropriate methodology integrates with the Government’s requirements. The Contractor shall submit the QMP as part of its technical quote. The Contractor shall make appropriate modifications to the QMP (at no additional cost to the Government). The Government has the right to require revisions of the QMP (at no cost to the Government) should the QMP fail to deliver the quality of the services required at any time during performance.

The Contractor is expected to develop meaningful and measurable performance measures and metrics that directly correlate to all aspects of this SOW (help desk, defects, agile, etc.). The Government will develop and utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the required services in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. The Government will perform periodic reviews of the Contractor’s performance in accordance with the Government’s QASP. The QASP will be finalized after the award. The Government reserves the right to review services to be provided, including those developed or performed at the Contractor's facilities, to determine conformity with performance and technical requirements.

The Contractor shall:

● For any identified defects in the O&M system(s) that the Contractor must fix, the Contractor shall report the following to PB-ITS weekly:

o Defects – Total number of software defects, by assigned severity category, recorded during the following phases:

■ Defects found from start of deployment to end customer, through the first three months of operational use after deployment; and

■ Defects found during operations and maintenance.

■ Status of end of life components and plan for mitigations

■ Status of coding violations and plan for mitigations

● Proactively identify and put into effect policies, procedures, and approaches to discovering and remediating defects.

3.2 Program Management - Task 2

The Contractor shall provide program management support throughout the task. This includes the management and oversight of all activities performed by Contractor personnel, including subContractors, to satisfy the task/subtasks identified in this task.

The Contractor shall designate a Program Manager (PM) by name for all programmatic issues, concerns, or updates. The PM shall be responsible for overall execution of this task and shall have full authority to make decisions and commit the Contractor’s organization under this task. The Contractor PM shall respond to GSA’s questions, concerns, and comments. The Contractor PM shall be proactive in alerting GSA to potential contractual issues including situations that may compromise the Contractor’s ability to provide the required services.

3.2.1 Prepare a Monthly Status Report (MSR)

The Contractor shall develop and provide an MSR using Microsoft (MS) Office Suite applications and/or Google Applications, by the 10th calendar day of each month via electronic mail to the PM and the Contracting Officer’s Representative (COR). The MSR shall include, but is not limited to, the following:

a) Activities during reporting period, by task and subtask to include (but not limited to) on-going activities, new activities, activities completed, progress to date on all above-mentioned activities. Each section shall begin with a brief description of the task.

b) Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c) Personnel gains, losses, and status (to include GSA Homeland Security Presidential Directive (HSPD)-12 badging status, security clearance, etc.).

d) Government actions required.

e) Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

f) Information pertaining to the execution of the task as requested by the Government

Program Manager or Contract Officer Representative.

g) Work in progress.

h) Helpdesk ticket summary to include opened, closed, and in progress.

i) Complete, meaningful analysis and report on their performance meeting the metrics described in their PWS (Section 3.1.2).

3.2.2 Provide Program Documentation Management

The Contractor shall create and maintain files that document the processing of work products, deliverables and other associated information pertaining to actions performed under this task.

The Contractor shall maintain within the Government-designated electronic repositories.

Examples of files include, but not limited to, the following:

a) Documentation providing traceability and rationale for the Contractor's technical program decisions.

b) The latest internally controlled version of all specifications, drawings, databases, and software that define or implement the system.

c) Detailed Standard Operating Procedures (SOPs)

d) All configuration management documentation.

e) SOW work products and deliverables.

f) Updates related to reporting artifacts (including and not limited to data dictionary changes impacts from enhancements) to reporting team and downstream data consumers.

The Contractor shall provide the government access to all records to ensure mission support is not interrupted. This information shall be stored on government sponsored applications. Upon completion of the task, the Contractor shall turn over all such records to PB-ITS in approved formats; specifically a shared Google drive. All delivered code shall be stored in Gitlab and will be the property of GSA.

3.2.3 Provide Communications and Meeting Support Services

The Contractor shall provide the following communication support services to maximize IT efficiency and stakeholder satisfaction throughout the PB-ITS:

1. Strategic Communications: proactively deliver an ongoing campaign to identify IT tasks which can be solved by the end user without help desk support; draft communication (e.g., web pages, emails) to guide users through the self-help steps; and promote that content.

2. Operational Communication: develop and deliver communications about PB-ITS systems and tools. Subject matter shall include system outages, system updates, and other end-user-targeted information.

3. Data Analytics: provide frequent reviews of data such as help desk tickets, web analytics, surveys etc. to determine audience needs and deliver information for management to achieve strategic goals. This review shall include a report and recommendations for content management. Assist with implementing those recommendations and tracking their impact.

4. Meeting Support: Attend and support meetings, briefings, etc. on behalf of or in support of the application.

3.2.4 Application Technical Roadmap

The Contractor shall deliver a proposed technical roadmap for the application. This summary document shall include the components the application is required to run (including Operating System, Database, Middleware, Technical Platforms (if any) and ancillary supporting application, modules, or software packages. For each component a transition plan including retirement dates for support shall be included when known.

This technical roadmap shall document the recommended timeframe to ensure all system components remain supported within standard support schedules (i.e., support shall remain within the standard support period).

3.3 Optional Enhancement Support

Enhancements are significant modifications to the application that add functionality or features to the application. Enhancements do not include configuration changes, technology upgrades, security or application patches or actions that are required to ensure the application remains operational.

The Contractor may be asked during the life of the task and shall implement and manage a backlog of enhancement activities. Activities shall constitute a prioritized list of tasks related to the operation and maintenance of the application. The Contractor shall engage the Government to establish priorities and collaborate on the estimated size of each task. The backlog shall include elemental tasks with user impacts and acceptance criteria. Tasks may be rolled into containers such as epics and themes as they address objectives of the task. Management of the backlog ensures stories, descriptions, personas, estimates and test cases meet the objectives of the task.

An enhancement is a noteworthy, and noticeable improvement to the application above and beyond what is considered normal and existing functionality of the application and does not include corrective / adaptive / perfective / preventive maintenance and support as described above. Enhancements have their associated funding that is approved separately from normal maintenance. Enhancements include the creation of a new module or other major changes to the functionality of the application.

Enhancements do not include normal changes in keeping up with modern, secure technology changes or bug fixes that are found in previously published code. Security-related changes would also not be included in enhancements such as updating to a newer version of encryption as it is a required change to keep the application up to date and compliant with security. Existing inter-system connections and integrations would also not be considered an enhancement if there is a required change to the connection due to other applications making upgrades or modernizations if the functionality remains relatively unchanged. Minor changes to existing applications and configurations due to changing business line requirements or user feedback is also not considered enhancements.

3.3.1 Requirements Management and Analysis

The Contractor shall provide technical guidance in assisting the Government to understand the technical requirements of potential changes to the application.

3.3.2 Impact Estimates

The Contractor shall provide technical guidance to develop estimates based on the level of detail available. The Government may request any one of the following types of estimates:

● Rough Order of Magnitude (ROM) - a high level idea, including the best-that-we-know expectation for the enhancement or its components.

● Level of Effort - a comparable estimate based on previous work completed.

● Level of Complexity - Also known as costing. Estimates provided by the development team that represent the level of difficulty of each user story (impact/change). The LOC also provides insight into the available capacity of the team while also determining if the team’s velocity is increasing over time.

● Impact Analysis - the estimate examining more specific details or proposed solutions, including their implementation and downstream impacts.

The following table describes the difference between each estimate. Also included are the levels of accuracy expected for each estimate, including the estimated duration for development of an estimate.

Table 3.3.2 - Estimate Characteristics Rough Order of Magnitude

(ROM)

Level of Effort Impact Analysis

Duration 2-3 days Duration 3-7 days Duration 5-10+ days

Variance: 50-100% Variance: 25-75% Variance: 5-10%

● High level, describes input / data / system interfaces

● Describes effort in term of high, medium or low in terms of:

o Hours o Cost o Durations o Resources required

● Change in schedule to implement

● Analogous or historical estimates

● Bottom-up / top-down estimates

● Describe the changes impacted:

o Database o Interface / workflows o Screens / reports

● Change in schedule to implement

● Comprehensive analysis of:

o Events o Business activities o Downstream impacts

● Proposed solution(s)

● Impact to the system / interfaces

Once the COR finalizes the enhancement requirements for formal submission to the Government Contracting Officer (CO), the CO will issue an Enhancement Notice and Request for Quote (RFQ) to the Contractor. In response to the RFQ, the Contractor will have 10 business days to submit a System Impact Plan/Software Development Plan (SIP). The SIP must provide details of the proposed technical solution, a description of the impact to the overall system, proposed milestone schedule, and the labor mix utilizing the labor categories and rates contained in the BPA. The Government shall review the plan and negotiate any changes required. Upon approval of the Plan and agreement on price, schedule and any other terms and conditions, the Government will issue a modification to the BPA Call, establishing a sub CLIN and providing funding. Enhancements will be negotiated as firm, fixed price sub CLINs to the greatest extent possible.

3.4 Enterprise Quality Program (EQP)

The Enterprise Quality Program (EQP) for Public Buildings Information Technology Services (PB-ITS) provides the foundation for increasing and controlling the quality of IT products and services to PBS. The EQP incorporates sound CMMI processes that will ensure products and services are on time, within budget, and meet the requirements of our PBS customers. The EQP has three distinct areas. They are Project Management, Quality Assurance and Independent Verification and Validation. PB-ITS continuously works to improve its processes to deliver quality products and services the first time.

Contractor shall follow the EQP standards. All deliverables shall be produced in accordance with EQP requirements, GSA Solutions Life Cycle (SLC) Guidance Handbook, as well as all GSA Security standards. Reference: https://portal.pbs.gsa.gov/pbs/group/portal/appops

3.4.1 DevSecOps

● PB-ITS has implemented DevSecOps processes and tools for the automation of application installation process. This solution is a collection of open source and standards-based tools currently using JIRA as the front end for project managers and developers with Jenkins and Ansible “under the hood.” The current tool set includes Jira, Jenkins, Ansible, Gitlab, Docker, Nessus, Invicti, CAST Application Intelligence Platform and Highlight, and Artifactory.

● Releases managed through the DevSecOps process shall be required to provide certain artifacts to ensure a compliant build. Those currently include Source Code, Executables and Build and TestScripts. Build scripts can currently be written using Ansible, Bash, or Powershell.

● The Contractor shall follow the necessary processes and provide necessary artifacts to release this application through the DevSecOps process and shall comply with GSA IT DevSecOps Guide and all other PB-ITS and GSA policies, procedures and guidance.

Figure 1. DevSecOps

3.4.2 Software Code Quality

As part of its continuous delivery improvement, PB-ITS has implemented a software code review process and quality analysis. Improving the quality of code provides for more secure and resilient solutions for PBS. PB-ITS references the Consortium for IT Software Quality (CISQ) (https://www.it-cisq.org/standards/code-quality-standards/) for guidance on how to measure, evaluate and improve software. Particular areas of importance are Performance Efficiency, Reliability, Maintainability and Security. PB-ITS currently uses CAST Application Intelligence Platform (AIP) and CAST Highlight to evaluate code quality.

● The Contractor shall describe how they will adhere to coding best practices and engage in continuous improvement to achieve PB-ITS performance targets. The Contractor shall https://portal.pbs.gsa.gov/pbs/group/portal/appops https://tech.gsa.gov/guides/dev_sec_ops_guide/ https://tech.gsa.gov/guides/dev_sec_ops_guide/ https://tech.gsa.gov/guides/dev_sec_ops_guide/ adhere to the standards for delivery (EQP process) and shall improve code quality as part of O&M activities.

3.4.3 Section 508 Compliance

The Contractor(s) shall provide accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U. S. C. 794d). All electronic and information technology (EIT) delivered must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. The 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. All deliverables will be Section 508 compliant and will be reviewed for compliance by the government which reserves the right to reject the deliverable(s) until remediation of deficiencies has been successfully completed by the Contractor. Complete technical descriptions are provided on the following website: http://www.section508.gov.

3.4.4 IPv6 Requirements

Operational deployment and use of IPv6 has been mandated by the Office of Management and Budget (OMB) via M-21-07.