RFI EPMT.pdf

REQUEST FOR INFORMATION NOTICE

Reference: Enterprise Project Management Tool (EPMT) RFI Number: RFI-0003

To All Vendors:

The Government Accountability Office (GAO) is requesting information to identify information, experiences and expertise in support of an Enterprise Project Management Tool.

This Request for Information (RFI) is being issued consistent with and in the spirit of an exchange of information with industry as per Federal Acquisition Regulation Part 10. This RFI is prepared for planning purposes only and is issued with the intent of obtaining price, delivery, other market information, or capabilities and is not being issued with the intent of awarding a contract. Consistent with FAR 52.215-3, the Government will not pay for any information/items submitted in response to this notice. The Government will neither award a contract solely on the basis of this notice nor will it reimburse the contractor for any costs associated with preparing or submitting a response to this notice.

This RFI is issued for information gathering purposes only. It is the intent that input gathered during this RFI process will improve the understanding of Government’s requirements and industry capabilities, thereby enhancing the Government’s ability to obtain quality supplies and services at a reasonable price for future procurements. Failure to participate in the RFI will not impact an interested party’s ability to participate in any future competitive procurements. GAO reserves the right to cancel this RFI at any time.

TABLE OF CONTENTS

1. Objectives

2. Vendor Instruction for Submitting Responses

3. Vendor Responses

4. Organizational Conflict Of Interest

1. OBJECTIVES

The objective of this RFI is to gather information from potential vendors of an Enterprise Project Management product that will provide mission teams and staff offices adequate visualization and collaborative project planning software to create sound engagement and project plans to actively manage their work. This software will provide fundamental tools for collaborative and iterative project management of scope, schedule, cost, resources, and risk using different project management methods (Agile, Waterfall, etc.). GAO anticipates a successful vendor with a compatible product can be found in the commercial market place.

Synopsis:

This is a RFI. The GAO is soliciting industry feedback to support market research for the acquisition of a web-based, commercial-off the-shelf, Enterprise Project Management System, with managed services. The Enterprise Project Management System, hosted in a secure cloud environment is designed and configured within the continental United States for GAO. The Vendor supporting GAO shall follow the Federal Information Security Modernization Act of 2014 (FISMA) and, at a minimum, shall offer an information technology (IT) solution that is compliant with the legislation’s Agency Program requirements. The Vendor shall incorporate both industry and federal government best practices and standards with the proposed solution.

Input from the vendor community will help to shape this planned acquisition.

Background:

The GAO is the audit, evaluation, and investigative arm of Congress. Commonly known as the “congressional watchdog,” we examine how taxpayer dollars are spent and advise lawmakers and agency leaders about ways to make government work better. We are unique in our audit and evaluation capacity to support Congress by performing original research, providing technical assistance, and conducting analyses to help Congress make informed decisions across the federal budget, producing tangible results and enhanced oversight. GAO has approximately 750 active performance audits—known as engagements—ongoing at a time which can range in duration from a few days to multiple years. These engagements follow Generally Accepted Government Auditing Standards (GAGAS), which provides a framework for performing high-quality audits with competence, integrity, objectivity, and independence. GAGAS requires each engagement to develop a project plan that specifies the tasks, staff responsibilities, and estimated dates for completing steps in the audit. However, these plans are often unreliable and used as a documentation exercise instead of an active tool for managing work. Tools are needed to visualize the scope of work and dependencies, constraints, estimating level of effort, and produce reports that are used to actively monitor progress against plans at varying levels of organizational review. Through this visualization and monitoring, we would be able to make more justifiable requests of time and resources when they are warranted.

Over the past few years, GAO has been developing a robust project management program to increase staff expertise in planning and executing work while updating our project management approaches with industry standard techniques for knowledge-based projects. The ePM program is developing GAO-wide expectations for using Agile Project Management approaches for planning and executing work and using scope management, staff day estimation, and scheduling techniques for more reliable information on project cost and timeframes. GAO seeks project management software that will support these efforts and to implement an IT solution that would support the organization in achieving a standardized way of controlling project work in the various PM phases (i.e., project initiation, planning, execution, monitoring, and closing). This EPMT solution would provide input into PM continuous process improvement and staff professional skill development.

Required System Components and General Functions

GAO’s Enterprise Project Management Tool must be operational and available for all twelve

(12) GAO locations that are located in each of the four continental United States time zones.

GAO’s enterprise project management tool must be available and fully functional during the following time periods: Monday through Friday from 05:00 to 23:59 and from 07:00 to 23:59 on Sunday in each time zone. All system maintenance or updates must be performed outside of these hours and system downtime must not exceed 14 hours per month unless specifically coordinated with and approved by GAO.

The estimated staff that will require access to the system is up to the agency. System must have the capability to simultaneously manage projects for up to or beyond 1500 projects that are spread across all twelve (12) GAO locations. Prior to the Covid-19 pandemic, historically, GAO maintained over 1200 projects at various stages throughout the agency and at one time.

However, the system must be flexible and allow the addition and removal of projects based upon demand.

A. The New System

The vendor shall provide the following to facilitate the transition:

1. The vendor shall provide written system documentation describing all functions of all modules included in the software as configured for GAO.

2. The vendor shall provide initial training to the GAO Enterprise Project Management team that will cover all aspects of the system.

B. System Architecture and Security

The system must meet the security requirements listed below:

1. All information entered into the system by GAO is to be owned by GAO. GAO retains the right to export, import, alter, and back-up data while using the software.

2. The vendor must adhere to records requirements, as detailed by GAO Privacy Program Order, 0450.1, GAO Records Management Program Order 0410.1 and GAO’s Records Retention Schedules.

3. The vendor shall allow on-site access to the data center where the system is hosted upon request by authorized representatives of GAO in order to observe security measures in place at the data center. The system must adhere to leading privacy practices including requirements in the Privacy Act of 1974 and GAO’s Privacy Program Order, 0450.1.

4. All components must run at a 98.5 percent uptime (down no more than 10 hours, 57 minutes and 26 seconds monthly).

5. Web-based interfaces must be used for all administrative functions.

6. The proposed solution shall not require any software to be installed locally on GAO machines.

7. The system must meet security standards as described below:

7.1 A minimum, a FIPS 199 Moderate impact Federal Risk and Authorization Management Program (FedRAMP) certified Software-as-a-Service (SaaS) or Platform-as-a-Service (PaaS) solution with a current security assessment report (SAR) that includes a recommendation to authorize/re-authorize the system. If not FedRAMP-certified, the system shall be in compliance and in alignment with the National Institute of Standards and Technology (NIST) standardized security assessment, authorization, and continuous monitoring standards and guidelines.

8. The vendor shall ensure that GAO has an opportunity to review the FedRAMP or NIST artifacts, to include the vendor’s current IT security white papers/documentation, that support the solution’s overall security posture, to include its infrastructure, platform, and software components, at the time of the award. The IT security documentation should include information such as access controls, authentication, boundary protection, change management, customer segregation, encrypted data transmission capabilities, log management, restricting website access, security monitoring, among other security capabilities.

9. The vendor shall provide access to GAO, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an IT security program.

GAO reserves the right to conduct on-site inspections. The vendor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

10. The system shall provide an automated mechanism to collect log files (including syslogs, Apache logs, etc.) for security and other analysis purposes. The vendor shall ensure that the automated mechanism allows GAO to periodically review the logs.

11. The vendor shall have an incident/breach notification process that will ensure that GAO is notified within an agreed upon timeframe consistent with federal government guidance.

12. The vendor shall be prepared to discuss the feasibility of giving GAO the ability to monitor GAO’s hosted environment using a Cloud Management Platform service.

13. The vendor shall maintain all of GAO’s data, to include backup data, within the continental United States. The staff managing the data and/or systems maintaining GAO data shall be employed within and working from a system that is within the continental United States and should be United States citizens or current permanent residents.

14. The vendor shall implement a catastrophic/disaster failover capability to ensure that the high availability requirement of the system is achieved. The failover site shall be geographically disparate from the primary production location such that loss of the primary production location or functionality does not prohibit the use of the system. The failover site must be in the continental United States.

15. The vendor shall deploy strong end-to-end application layer cryptographic mechanisms that are compliant with the current Federal Information Processing Standards Security Requirements for Cryptographic Modules, level 2, at a minimum. The mechanism shall protect customer PINs, user passwords and other sensitive data in the network and data at rest.

16. The vendor shall encrypt customer account and transaction data which is transmitted, transported, delivered or couriered to external parties or other locations, taking into account all intermediate junctures and transit points from source to destination.

17. The vendor shall require all employees who will have access to GAO data, the architecture that supports GAO data, or any physical or logical devices/code to pass the appropriate background investigation required by the Government in compliance with HSPD -12.

18. The system shall provide security and privacy that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing.”.

19. The system shall be able to support the establishment of a virtual private network between GAO and the FedRAMP-certified system.

20. The system shall authenticate users through single sign on (SSO) using Active Directory Federation Services (ADFS) or through an agreed upon multi-factor authentication mechanism.

21. The vendor shall provide access to GAO, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. GAO reserves the right to conduct on-site inspections. The vendor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

22. The vendor shall ensure that its environment remains compliant with the control standards of Federal Information Security Modernization Act of 2014 (FISMA), the current NIST standards in FIPS 140-2 or 140-3, FIPS 199, FIPS 200, FIPS 201 and current NIST Special Publications 800-37, 800-53, 800-60, 800-61, 800-70, 800-144, and 800-163. In addition, the Vendor must provide GAO with any documentation it requires for its security-related reporting requirements within 10 days of a request.

C. Support and Maintenance

1. The vendor shall provide live customer support (through telephone or real-time chat) every business day from 8:00 AM to 6:00 PM ET. This will entail intake of content errors and basic technical support issues. A ticketing process is required for tracking reported issues through the entire problem life cycle.

2. The vendor shall regularly enhance the products based on customer input and industry changes.

3. The vendor shall provide training in all aspects of the system as needed.

4. The vendor shall provide all updates to the system.

5. The vendor shall provide advance notice, of two business days, of any updates that shall require an interruption of service.

D. Specific Tasks and Components

GAO seeks an enterprise project management tool that will provide the following functions by role; project team, portfolio manager, stakeholder, ‘super manager’, and administrator. (These are GAO terms for the roles. We expect that vendors may have different title names.) The vendor software must be meet the requirements below:

By Project Teams:

1. Users can access the software easily.

2. Teams must be able to utilize the tool for a scrum based agile project management approach.

a. Backlog Creation and Management

i. Must have the ability to create a backlog.

ii. Must have the ability to add and delete tasks to a backlog.

iii. Must the ability to re-prioritize the backlog on an ongoing basis.

b. Sprint Management

i. Must have the ability for teams to pull backlog tasks into a sprint based view.

ii. Must have the ability for teams to visually track progress throughout the sprint utilizing a Kanban or similar work flow chart.

iii. Must the ability for teams to comment notes/impediments on a task if issues arise during sprint.

3. Must have the ability for teams to utilize the tool for other agile approaches, if applicable.

4. Must have the ability for teams to create their backlog using a combination of templates and ongoing new project tasks that can be combined together and with new project tasks to create a project backlog.

5. Must have the ability for GAO to create templates for teams.

6. Must have the ability for teams to create a high-level view for their project that can be updated iteratively, and shared with all team members, managers, and stakeholders. The high level view should be able to collapse and expand into views of detailed breakdown of tasks associated with each category or epic of work.

7. Must have the ability for teams to record time estimates for effort of project work using agile estimation techniques (e.g. t-shirt sizing, LOEs, story points etc.)

8. Must have the ability for teams to assign team members to tasks.

9. Must have the ability for a team to view planned work at both the team and individual level.

10. Must have the team’s ability to include details and comments for work tasks.

11. Must have the ability for the team to be alerted or notified when updates are made to a task.

(e.g., details added, comments or questions made, tasks are marked as complete.)

12. Must have the ability for users/admins to manage alert or notification settings.

13. Must have the ability for multiple users to access, edit, and work in the tool at the same time on the same project.

By Portfolio Managers:

14. Must have the ability for portfolio managers to see high-level planned and upcoming work across their portfolio.

15. Must have e the ability for portfolio managers to see a visually dynamic view/dashboard of team level and/or portfolio level progress.

16. Must have the ability for portfolio managers to use software to make informed decisions on project scope, time, and resources.

17. Must have the ability for portfolio managers to view a high level portfolio view that collapses into increasing levels of detail by portfolio and project.

By Stakeholders: (GAO methodologists, attorneys, and other subject matter experts who provide input and reviews on multiple projects.)

18. Demonstrate the ability for individual stakeholders to see current, past, and upcoming tasks assigned to them across multiple projects.

19. Must have the ability for stakeholders to be notified when a new task is assigned to them.

By “Super Managers”: (GAO’s Senior Executives)

20. Must have the high-level analytics available to super managers;

a. Must have the visualize projects that are not yet started, in progress, and complete at a portfolio level,

b. Must have what they could see from an aggregate progress reporting level, (aggregate velocity, resource utilization, project duration etc.)

c. Must have the ability for super managers to view a high level agency view that collapses into increasing levels of detail by all agency portfolios and their subsidiary projects, and

d. Must have the ability for managers to view progress by portfolio, team, and/or individual user.

By Administrators:

21. Must have the process for creating a new project. Demonstrate both the logistics of how an individual could create a project on their own and if the administrator controls the creation;

explain the pros and cons.

22. Must have the process for archiving/storing information from a completed project.

23. Must have both the logistics of how an individual could archive a project board on their own and if the administrator controls the archive functions; explain the pros and cons.

24. Must have the ability for multiple offices to control administrator to control access to their projects.

25. Must have the ability for admins to edit alert and notification settings by role.

26. Must have the ability for admins to manage roles in the system (e.g. create, read, update, and delete)

27. Must have the ability for admins to view a history of changes log.

Vendor Instructions for Submitting Responses

3. VENDOR RESPONSES

Disclaimer: This information is for GAO internal planning purposes only.

All interested vendors are invited to respond.

RESPONSES WILL ONLY BE ACCEPTED VIA EMAIL.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid GAO, please segregate proprietary information. Please be advised that all submissions become Government property and will not be returned.

All responses are due no later than March 31, 2022. Responses should be sent via e-mail to Mr.

Glenn Hamilton at HamiltonGE@gao.gov and Mr. Cedric Mitchener at MitchenerC@gao.gov.

Interested parties may email questions for clarification to the RFI notice to HamiltonGE@gao.gov and MitchenerC@gao.gov. No information concerning this RFI or requests for clarification will be provided in response to telephone calls. Questions must be received by close of business Eastern Standard Time (EST) on March 15, 2022.

Questions received after this time and date will not be answered. GAO will answer submitted questions and will release the answers as an amendment to the original RFI announcement.

RFI responses must include:

1. Name of Company, Point of Contact for the response with Title/email/phone organization's CAGE code, DUNS number, contact information, facility and safeguarding clearance levels, Size and Company Type (Large, Small, 8(a), SDV, Women-Owned, etc.), Government-Wide Acquisition Contract (GWAC) Number (i.e.

GSA, NASA SEWP, NITAAC, etc.), and accounting system status on the first page.

2. Be specific in your response about how your solution meets with reference to the requirements stated above.

3. Include general pricing model information.

4. ORGANIZATIONAL CONFLICT OF INTEREST

If vendors responding to this RFI anticipate that providing a response creates or represents an actual or potential organization conflict of interest (OCI), the Vendor shall immediately disclose this actual or potential OCI in accordance with FAR Subpart 9.5. The Vendor is also required to complete, sign and submit an Organizational Conflict of Interest Statement in which the Contractor (and any Subcontractors, consultants or teaming partners) agrees to disclose mailto:HamiltonGE@gao.gov mailto:HamiltonGE@gao.gov information concerning the actual or potential conflict regarding submission of a response to this RFI. All actual or potential OCI situations shall be handled in accordance with FAR Subpart 9.5.