RFI Attachment 01 - DRAFT PWS.docx

ENTERPRISE ARCHITECTURE PROGRAM

OCIO Chief Technology Officer Enterprise Architecture Tool

1. PURPOSE

The purpose of this order is to procure an Enterprise Architecture Tool for the Office of Personnel Management (OPM) Enterprise Architecture Program (EAP) by way of the Office of Chief Information Officer (OCIO) and the Chief Technology Officer (CTO). An Enterprise Architecture Tool supports and sustains OPM’s ability to manage IT complexity, enable data driven decision making and drive strategic digital transformation.

2. BACKGROUND

The U.S. Office of Personnel Management (OPM) serves as the chief human resources agency and personnel policy manager for the Federal Government. OPM provides human resources leadership and support to Federal agencies and helps the Federal workforce achieve their aspirations as they serve the American people. OPM directs human resources and employee management services, administers retirement benefits, manages healthcare and insurance programs, oversees merit-based and inclusive hiring into the civil service, and provides a secure employment process. As the largest employer in the country, a key OPM priority is to position the Federal Government as a model employer.

OPM’s Office of the Chief Information Officer (OCIO) and the Chief Technology Officer (CTO) plays a central role in enabling OPM to accomplish this mission. OCIO has the charge of improving OPM’s effectiveness through modernization and digital advancement. In an era of rapid technological advancement and the increasing demand for seamless data interoperability, the agency seeks to not only adapt but lead the charge towards a future ready IT infrastructure. To achieve this, an actionable and successful Enterprise Architecture Program (EAP) is imperative. Enterprise Architecture is the conduit between the strategic objectives of the organization and the deployment of the corresponding technology to effectively and efficiently support the OPM mission. The EAP is in need of an enterprise architecture tool to significantly enhance the organizational’ s ability to manage complexity, enable data driven decision-making, and drive digital transformation.

3. SCOPE

The adoption of an Enterprise Architecture (EA) tool is critical to the support of OPM’s strategic initiatives. EA tools provide a central repository for architectural artifacts, robust visualization capabilities, and enables in-depth analysis across the organization’s programs to include all of OPM. The tool will empower the Enterprise Architecture Program (EAP) to effectively mange the complexity of architecture, properly align IT initiatives with business objectives, mitigate risks, and enhance decision making. The tool shall also provide business intelligence reports to support operations and capital investments.

The agency currently does not a tool to support the Enterprise Architecture Program. Thereby, limiting the organization’s ability to align IT initiatives and technology investments to business objectives, enable and control IT efficiencies, and manage risk across the entire enterprise.

3.1 Enterprise Architecture Tool Requirements

This contract is to acquire an Enterprise Architecture Tools to support and empower OPM’s Enterprise Architecture program. The Contractor shall provide an Enterprise Architecture Tool that supports but not limited to the following requirements:

3.1.1 Intuitive Interface

· The tool shall provide an intuitive user interface without or minimal tool customization to ensure quick adoption.

· The tool shall be configurable for organizational and individual stakeholder views and business requirements.

3.1.2 Integration

· The tool shall integrate seamlessly with existing systems and tools used within the organization to streamline workflows and data exchange.

· The tool shall seamlessly integrates into an industry agnostic reference architecture and no-code/low-code API integration

· The tool should support integration with Data Governance tools, such as Collibra

· The tool should seamless integrate with third party products such as Microsoft products (Excel, Power BI, etc.)

· The tool should seamlessly integrate with other enterprise systems, such as ERP, CRM, ITSM, and more

· The tool shall support Azure cloud deployment and integrates with Azure services

· The tool shall integrate with Azure identity and access management (IAM) tool

3.1.3 Modeling

· The tool shall have the ability to link elements in the repository to defined business capabilities, goals, strategic objectives, as well as other taxonomies at various levels

· The tool shall support Business Process Model and Notation (BPMN)

· The tool shall support the ability to extend the meta-model to include object classes, underlying notation, relationship types, and methodologies to reflect the organization domain-specific context

· The tool shall enable the ability to map external data sources to appropriate element types and fields within the meta-model

· The too should support federated extensions of the meta-model to allow different viewpoints of the same content for different stakeholders

· The tool shall allow the creation of comprehensive architectural models, to include business processes, data, applications, and technologies

· The tool shall support cross line of business collaboration and optimize workflows

· The tool should support application portfolio management, technology risk management, IT integration, and overall business transformation

3.1.4 Data Governance

· Support robust data governance practices, including data quality, lineage, security, and compliance with regulatory standards.

· The tools shall manage and process large volume of data

· The tool should support automatic attestation for meta date related to the technology within the repository

· The tool shall allow for real-time data feeding and analysis

3.1.5 Collaboration

· Enable real-time collaboration among stakeholders

· Allow for collaboration among cross functional teams to share information and work together

3.1.6 Customization

· The tool shall support no code/low code implementation

3.1.7 Repository

· A centralized database storage for all architectural assets for easy managing and retrieving information

· Repository shall connect data, diagrams, metrics, and KPIs to ensure integration and integrity

· The tool shall allow for an extensible metamodel that enables new classes, business concepts, metrics, and relationships.

· The tool repository shall provide a single source of truth for storage, categorization, and versioning of objects and models related to business capabilities and technology.

· The tool shall support the ability to represent value streams and support the aggregation of metrics and connection to portfolio analysis to create transparency.

3.1.8 Analysis and Reporting

· Allows for evaluation of potential changes, impacts, and provides “what-if” analysis for better decision-making

· Advance analytics and user-friendly reporting capabilities to generate insights from architectural data

· The tool shall track performance metrics and identify potential bottlenecks

· Allow for intuitive visualization reports or dashboards to tracking progress, identifying bottlenecks, and making data-driven decisions

· Allows for the creation of roadmaps showing the transition from current to future state architectures

· The tool shall provide heat maps, gap analysis, scenario planning, and risk indicators to support decision making

· Allow for version control and tracking changes made to the architecture

· The tool should provide interactive visual exploration across elements in the repository

· The tool should allow analytical views to automatically update based on selection or filtering in one pane.

· The tool shall provide role-based and configurable dashboards with user defined searches

· The tool shall allow multiple forms of visualization such as 3D, 2D graphs, tree maps, and multidimensional roadmaps

3.1.9 Scalability

· The tool shall be able to scale horizontally or vertically as the organization grows, accommodating increasing data volumes and user numbers

· The tool shall support distributed teams accessing and updating information seamlessly

3.1.10 Security

· Ensure data privacy, compliance, and robust security features to prevent data breaches

· Shall have robust security features, access control based on role and permissions and protect sensitive data

· The tools shall support role-based access controls with support for single sign-on (SSO)

3.1.11 Training

· Provide training sessions to familiarize users with the features, interface, and functionalities of the tool

· Teach users how to navigate through various workflows within the tool, such as creating, modifying, and deleting architectural artifacts

· Train users on best practices for using the tool effectively, including naming conventions, version control, and documentation standards

· If the tool integrates with other systems or tools, provide training on how to connect and utilize these integrations

· Educate users on security measures within the tool, such as access control, permissions management, and data encryption

· For power users or administrators, offer training on advanced features and configurations of the tool

3.2 Constraints

3.2.1 508 Compliance

· Pursuant to FAR subpart 39.2, all EIT procured through this contract must be compliant with the applicable Section 508 standards. For more information, visit www.section508.gov.

3.2.2 FedRamp Compliance

· The contractor/vendor is required for their cloud-based product/s to be compliant or in-process of FedRamp compliance.

3.2.3 Mainframe Integration

· The contractor is required to integrate with existing legacy systems currently being used.

3.2.4 Cloud Implementation

· Any installation of components on OPM network will reside in the Azure IaaS/PaaS.

3.2.5 Support Hybrid Data Environment

· Currently data sources are on-prem and in the cloud.

3.2.6 Adhere to OPM Cyber Security Requirements

· Contractor/Vendor will be responsible for ensuring compliance with OPM Cyber Security policy and requirements to include (but not limited to): Phishing Resistant Multifactor Authentication (MFA) – The vendor shall ensure the application employs OPM approved phishing resistant MFA methods. The application will require certificate based phishing resistant MFA for agency users and provide phishing resistant MFA options for external users. Acceptable options are

· Certificate Based (PIV)

· FIDO2

· Login.gov

4. DELIVERABLES

The contractor shall provide all deliverables to the designated Contracting Officer’s Representative (COR) as well as to appropriate OCIO program managers. All deliverables must be published in OPM’s designated environment.

4.1 Deliverables Table

Project Plan of Action and Milestones/ Roadmaps

5. CONTRACT TYPE

The contract type is Firm Fixed Price.

6. PERIOD OF PERFORMANCE

The period of performance for this order will be one base (1) year and four option years.

The period of performance will align with the expected time it will take to complete the work. The contract is expected to be awarded not later than September 30, 2024.

7. TRAVEL

Currently the Government does not anticipate travel for this requirement.

8. SECURITY REQUIREMENTS

8.1 PRIVACY ACT

This task may involve contractor employees with information that is subject to provisions of the Privacy Act. OPM will provide specific direction and guidance concerning the safeguard of such information.

8.2 DATA RIGHTS AND OWNERSHIP OF DELIVERABLES

The Government must hold unlimited rights in all deliverables in accordance with the FAR clause at 52.227-14, Rights in Data - General (May 2014). The Government has unlimited rights to budget and performance data and all documents/materials produced under this order. All documents and materials, including the source codes, scripts, and processes of any software, produced under this order shall be Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may be used or sold by the Contractor only with written permission from the Contracting Officer. If the Contractor uses their proprietary software to develop any aspect of the tool, OPM should be advised to determine how this impacts the data rights clause. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Further, OPM retains unlimited rights to the tool in its Azure cloud environment, including all subsequent operations, maintenance, and periodic enhancements, subject to necessary license renewals.

Additionally, the government intends that any data or deliverables created as a result of the work performed under this order could be publicly accessible without restriction.

8.3 IDENTIFICATION AND AUTHENTICATION

Authentication designs shall be implemented in such a way that accounts uniquely identify all users (e.g., first-name last-name) and are not default or generic. Authentication designs shall be implemented in such a way that accounts uniquely identify system processes.

Identification and authentication mechanisms for the Contractor’s solution used by OPM users shall be designed and implemented to leverage the PIV-based authentication, federated Single Sign On (SSO) capabilities, or other phishing-resistant authentication mechanism.

Identification and authentication mechanisms for the Contractor’s solution used by non-OPM users (e.g., public users) shall be designed and implemented to offer phishing-resistant multifactor authentication to the greatest degree possible.

8.4 OPM CLOUD SERVICE USAGE

This pertains to the acquisition of services from a cloud service provider outside of OPM. Internal cloud computing services are already covered by existing requirements. This also applies to information systems owned or operated by contractors on behalf of OPM. Use of cloud computing services must be formally authorized in accordance with the NIST Risk Management Framework and the OPM assessment and authorization processes.

Cloud computing services must have an existing OPM or Joint Authorization Board (JAB) Federal Risk and Authorization Management Program (FedRAMP) authorization to be considered for use at OPM. Products/services that are in process of FedRAMP authorization may also be considered. The contractor/vendor must be able to prove an "in process" status. However, FedRAMP authorization alone is not sufficient to meet the requirement of authorization for OPM for a particular service for a particular purpose. An appropriate Authorizing Official, sufficiently familiar with the context of the use of the service [including the mission requirements and associated Federal Information Processing Standard (FIPS) 100 impact level], and adequately informed of the associated risks through a risk assessment, must document an acceptance of risk and formal authorization of the use of the cloud computing service

9. POST-AWARD CONFERENCE AND PERIODIC PROGRESS MEETINGS

The Contractor agrees to attend any post-award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the CO or designee will apprise the Contractor of how the Government views the Contractor's performance, and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

10. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The COR will be assigned upon the award of this contract. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, and specifications; monitor Contractor's performance and notify both the CO and Contractor of any deficiencies; coordinate availability of Government-furnished property; and provide site-entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the BPA Call.

11. GOVERNMENT-FURNISHED ITEMS

Except for those items specifically stated to be Government-furnished in Part 8, the Contractor shall furnish everything required to perform under this PWS.

12. SECTION 508 REQUIREMENTS

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

13. TRANSITION PLAN

The Contractor shall assist the Government in transitioning data out of the system in the format it was transitioned in, or a format proposed by the Contractor that is acceptable to the Government within 30 days of notification by COR.

At the end of the order the Government will require full cooperation in transitioning its data out of the Contractor system within 30 days of notification by the COR. At a minimum, the Contractor must be able to transition the data out of their system in the format it was transitioned in; however, the Contractor may propose alternative formats to transition the data that can be used with approval by the COR. Upon completion of the transition, the Contractor will attest, in writing, that its system no longer contains any of the data.

The government will require creating and approving a plan to transition-out with the contract awardee as described below.

· Defining and delivery of a plan for Contractor and government approval for a successful transition-out

· Upon government acceptance of a plan, execute the plan which will include, but not be limited to participation in meetings, transitions of roles and responsibilities, code reviews, documentation and reviews of documentation, and reviews of any other relevant project artifacts

· Knowledge transfer for key areas, defined in Section 10, will need to be performed

· All documentation should be finalized, and project documentation must include training materials, technical specifications, and a contractor’s final report

· All artifacts created, including software and code, must be delivered to OPM before the end of the contract. Documentation for the artifacts must include the artifact’s level of completion, and suggested steps for completion for any uncompleted artifacts

14. DEFINITIONS AND ACRONYMS

This section includes all special terms and phrases used in this PWS. Each definition provided should be carefully considered; that definition becomes binding for all requirements in the BPA Call. This section should also contain a complete listing of all acronyms used; giving both the acronym and the term the acronym represents.

· PWS: Performance Work Statement

· CO: Contracting Officer

· Defective service: A service output that does not meet the standard of performance associated with it in the PWS.

· Quality Assurance Surveillance Plan (QASP): A written document specifying the surveillance method used for surveillance of Contractor performance.

· Quality Control (QC): Actions taken by a Contractor to control the performance of contracted services to meet PWS requirements.

· Quality Assurance (QA): Actions taken by the Government to assure contracted services meet PWS requirements.