RFP 12SAD120R0016 Application Sustainment O-M.pdf

August 27, 2020

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

The solicitation number is 12SAD120R0016. This solicitation is issued as a request for proposals

(RFP).

This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2020-07.

This is a set-aside for 8A Small Business Concerns.

The associated NAICS code is 541511 and the small business size standard is $30 Million.

This requirement is for services for “RD Application Sustainment Operations & Maintenance”.

Please review the Performance work Statement for a detailed description of requirements for the services to be acquired.

The period of performance for the IDIQ is a one-year base period with two one-year option periods.

Anticipated Period of performance is as follows:

Base Period: September 30, 2020 – September 29, 2021

i) Option Period 1: September 30, 2021 – September 29, 2022

ii) Option Period 2: September 30, 2022 – September 29, 2023

52.212-1, Instructions to Offerors-Commercial, applies to this acquisition

The evaluation procedures to be used are described in included PROPOSAL PREPARATION AND EVALUATION INFORMATION section within the Attachments.

Offerors are to include a completed copy of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Items, with its offer.

52.212-4, Contract Terms and Conditions-Commercial Items, applies to this acquisition and a statement regarding any addenda to the clause.

52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders- Commercial Items, applies to this acquisition.

Offers are due no later than 3;00 PM EST, September 17, 2020 Include the Solicitation number in your email submission Subject line.

RFP 12SAD120R0016

https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_212-1 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1060550 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1060971 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_212_5

Submit your proposal package to: Christy.Glass@USDA.gov Contracting Officer, Rural Development.

For information regarding the solicitation, contact Christy L. Glass at Christy.Glass@USDA.gov

All questions shall be submitted to the above e-mail address no later than 3:00 PM EST on September 3, 2020. There is no guarantee that questions received after this time will be answered. The earlier the questions are submitted, the earlier a response should be able to be posted.

Anticipated Award date is September 28, 2020.

Contracting Office:

USDA – Rural Development Business Center 1400 Independence Ave, SW Washington, DC 20250

RFP 12SAD120R0016

mailto:Christy.Glass@USDA.gov mailto:Christy.Glass@USDA.gov

Performance Work Statement (PWS) RD Application Sustainment Operations & Maintenance

As of 8/25/20

I. DEFINITIONS/ACRONYMS:

• A&A: Assessment & Authorization

• ACIO: RD Assistant Chief Information Officer

• Agile is defined as an iterative and incremental approach to software development performed by highly collaborative teams with just enough ceremony to produce high-quality software.

• AMAS: Automated Multifamily Accounting System

• CEC: Client Experience Center

• CICS: Customer Information Control System

• CISO: RD Chief Information Security Officer

• CO: Contracting Officer, a person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. A CO is only individual who can legally bind the government.

• COR: Contracting Officer's Representative, a representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the contractor. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

• COTS: Commercial off the shelf, for the purpose of the performance work statement, COTS refer to commercially developed software.

• CPU: Central Processing Unit

• DevOps model – (Development and Operations) DevOps construct blends development, and operations to extend continuous integration mechanisms to ensure the software development and operation teams interact much earlier, preferably during the design of features. DevOps introduces formal and operational tests earlier in the development lifecycle so that more defects are found “in phase.” Adoption of continuous delivery becomes a forcing function to check out the software build on a continuous basis in a production like environment. To be effective the software development, formal test, and operations teams will need to remove communication barriers and prepare for test and operations personnel to build scripts and use tools earlier in the typical workflow.

• DB: Database

• DISC: Digital Infrastructure Services Center (formerly National Information Technology Center

(NITC))

• DME: Development, Modernization, and Enhancement

• DONE - The Definition of Done (DoD) is when all conditions, or acceptance criteria, that a software product must satisfy are met and ready to be accepted by a user, customer, team, or consuming system. This will lower rework, by preventing user stories that don’t meet the definition from being promoted to higher level environments. It will prevent features that don’t meet the definition from being delivered to the customer or user.

o User Story Done means the Product Owner reviewed and accepted the user story. Once accepted, the “done” user story will contribute to the team velocity. You must meet all of the defined criteria or the user story isn’t done.

o User Story DoD Examples:

Unit tests passed Code reviewed Acceptance criteria met

RFP 12SAD120R0016

Functional tests passed Non-Functional requirements met Product Owner accepts the User Story o Feature Done means it qualifies to add to a release. Not all user stories need to be completed. Rather, it means the feature may be sufficient to satisfy the need. Once accepted, the done feature will contribute to the release velocity. Again, you must meet all of the defined criteria or the feature isn’t done.

o Feature DoD Examples:

Acceptance criteria met Integrated into a clean build Promoted to higher level environment Automated regression tests pass Feature level functional tests passed Non-Functional requirements met Meets compliance requirements Functionality documented in necessary user documentation o Epic Done refers to an organizational strategic priority, portfolio plan item, or some other collection of features that satisfied a market need. Not all user stories or features need to be completed. Rather, the epic may be sufficient to satisfy the need. Once accepted, the done epic will contribute to throughput calculations to see if the supply is in balance with demand.

o Epic DoD Examples:

Non-Functional requirements met End-to-end integration completed Regression tests pass Promoted to production environment Meets defined market expectations

• DR: Disaster Recovery

• FA: Focus Area

• FSA: Farm Service Agency

• General Support System Toolchain (GSS) Tool Chain: The RD General Support System has been designed and tested as the agency’s method of modernizing application development to support agile and incremental delivery of RD CIO Application Development. Currently across RD there is a decentralized method of software development that is aging and does not support modern methods integration, testing, deployments, and agile methods of software deployment. Our mission for the General Support Systems is to build an environment that will have the capability to support multiple lower environments and ability to deploy tools to facilitate the modern methods of application development. The General Support Systems environment will host the DevOps Tool Chain. One of the main goals of this implementation, other than modernizing application development tools, it to provide Agency traceability from the inception of the business need through production deployment and throughout the production lifecycle. The General Support System environment will host the DevOps and Security Tool Chain which consists of Confluence, Jira, Jira Service Desk, BitBucket, Git, Sparx, MS Project Online, ArtiFactory, Jenkins, Compliance Sheriff, Selenium, IBM AppScan, Burp Suite Professional, Checkmarx, and Microfocus Web Inspect.

• ITIL: IT infrastructure library

• O&M: Operations and Maintenance

• OCI: Organizational Conflict of Interest

• OMB: Office of Management and Budget

• PII: Personally identifiable information

• PIV: Personal Identity Verification Card, all employees and contractors working for USDA must be issued a PIV card, known as LincPass

• PMO: Procurement Management Office

• PSO: Production Support Operations

• PWS: Performance Work Statement

• QA: Quality Assurance

• QASP: Quality Assurance Surveillance Plan - An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance to assure services meets the requirements of the PWS.

• RD: Rural Development

• RDTO: Rural Development Technology Office

• SDLC: System Development Lifecycle, RDTO guide for successful planning, execution, and control of IT projects by providing a framework to ensure that all aspects of a project are properly and consistently defined, planned, and communicated.

• SET: Sustainment Engineering Team

• SLA: Service Level Agreement, a provision within a contract between a service provider

(Contractor) and the end user that defines the level of service expected from the service provider.

SLAs may include provisions related to requirements for the reliability of services (limits on outages or down time), responsiveness (service availability percentages of time, procedures for reporting problems (who will be contacted, how to report, when and how to escalate), monitoring a reporting service levels (who will monitor, what data will be collected, how often).

• Shall: denotes a mandatory duty or obligation

• Software maintenance: This term shall include correcting faults, improving performance or other attributes, adapting to a changing organization and technical environment, and performing preventive maintenance.

• Software sustainment: This term includes Software maintenance and also addresses other issues such as documentation, operations, deployment, security, configuration management, training, help desk, commercial off-the-shelf product management, and technology refresh.

• TRD: Technical Requirements Document

• UAM: User Access Management tool - is an in-house developed tool. It is used as an ITSM support for ticketing, incident, request, knowledge, and the like, from what gather in the PWS.

o Platform: Linux o Technology: Apache/Tomcat/Java o Version Information: Tomcat 5.5, MS SQLServer The UAM Team completes an average of 262 per week and 13,611 annually.

• USDA: United States Department of Agriculture

• User Acceptance Testing or UAT: Formal testing with respect to user needs, requirements, and business processes conducted to determine whether a system satisfies the acceptance criteria and to enable the user, customers or other authorized entity to determine whether or not to accept the system.

• V model or waterfall process is defined as traditional but unique, linear development methodology used during a software development life cycle software method.

II. GENERAL REQUIREMENTS:

1. Introduction:

The United States Department of Agriculture (USDA) Rural Development (RD) Business Center has a need for contractor technology support in four focus areas:

• Focus Area 1: RD Application Helpdesk Support (O&M) - Tier 1, Tier 2, and Tier 3 helpdesk providing application support, User-Access Management (UAM), ticket management, ticket platform/system management, IT Service Management, training, reporting, and coordination for support of new production services.

• Focus Area 2: Production Support Operations (PSO) (O&M) – support PSO by implementing, enforcing, and maintaining separation of duties between IT development and operational support efforts and keep RD applications running smoothly by providing production support, monitoring/dashboard, analysis, incident management, and improving standard processes/procedures.

• Focus Area 3: Sustainment Engineering Team (SET) (O&M) - sustaining lifecycle support of deployed/production applications/systems, covering everything from new feature requests, bug fixes, product improvements, and process improvements, including consistency in the way the product source code is developed, tested, and managed.

Implementing best practices to streamline a DevOps model for lowering cost/price of operations and maintenance (O&M) across the legacy RD system portfolio.

• Focus Area 4: Legacy System Enhancement and/or Modernization Planning (DME) - legacy system enhancement or modernization planning, using an Agile approach to address complex IT objectives incrementally in order to increase the likelihood of achieving workable solutions for attainment of those objectives.

2. Background:

The USDA RD Assistant Chief Information Officer (ACIO) is responsible for developing, maintaining and operating a portfolio of automated systems in support of RD's core programs:

Rural Business-Cooperative Service (RBCS); Rural Housing Service (RHS); and Rural Utilities Service (RUS). These programs provide financial assistance in the form of guaranteed and direct loans and grants.

The systems inventory includes a program funds control application and non-financial applications that support RD business and operational needs. Users of the RD systems include employees, private sector lending institutions, management agents, other mission areas or agencies and their finance offices, customers, potential customers, and the public. Each of these constituents has both common and unique information and support needs. Each of the agency program management constituents use both direct and guaranteed loans in the execution of their program activities. The current automated financial systems have components which interface, exchange data, and use certain common processes. Our external constituents including lending institutions, management agents, customers, and potential customers have different informational and servicing needs than our internal constituents.

With mandated initiatives, our existing legacy components must be enhanced to allow all constituents the necessary access to information and the functionality to more efficiently implement our loan programs. Once implemented these initiatives will:

• Improve the availability, accuracy, and timeliness of management information;

• Provide the servicing office with the capability to maintain and manage their guaranteed and direct loan portfolios;

• Improve our loan programs to be more attractive to our lending institutions and potential customers;

• Facilitate continuous process improvements within the business and the automation development organizations;

• Enable agency management to proactively monitor and manage individual loans, program portfolios, and funding authorities;

• Provide agency management timely access to information required by Congress, Office of

Management and Budget (OMB), Department of the Treasury, General Accounting Office, Office of Inspector General, and USDA.

RD IT helpdesk support is needed to provide high-level call-center support services that enhances and sustains the performance, quality, integrity, and availability of RD systems and provides technical assistance to users of the systems. The helpdesk focuses on providing support for RD’s lending applications, not end user desktop support. The helpdesk tracks all customer support gathered from live calls, email, or other agency-provided ticket/issue tracking system to provide ticket accountability from opening to closure. Tickets are currently assigned based on system, and the type of problem or issue. Support may be for new or legacy applications, Microsoft Office Suite applications, and other commercial off the shelf (COTS) operating systems or software. The helpdesk identifies and resolves security, eAuthentication, and International Technology Service (ITS) interface issues impacting users and coordinates with vendors or other government agencies/departments as needed to resolve issues. Reports are maintained for daily, weekly, monthly, quarterly, annual statistics, and problem/issue trends analysis. Utilizing the IT Infrastructure Library (ITIL) framework, the helpdesk identifies weaknesses and potential problems and implements ongoing process improvement to provide enhancements and corrective actions to improve operations.

The Production Support Operations (PSO) Branch is within the Solution Delivery Division of RDTO’s Business Center Operations Office. The PSO team’s purpose is to establish the separation of duties between IT development and operation efforts and keep RD applications running smoothly by providing production support and monitoring services. The PSO’s responsibilities include: Infrastructure and Platform Management; Application Management;

Strategic Advisory and Counseling; Documentation and Process Engineering; Continuous Improvement; Database Management and IT Contingency/Disaster Recovery operations. PSO is critical to the ability of the agency to recover applications and backup data in the event of a disaster. The Solution Delivery Division and PSO Branch Leads are first responders in rebuilding the agency systems.

The Sustainment Engineering Team (SET) serves in the PSO Branch and works with RDTO leadership to implement operations and maintenance (O&M) industry best practices, processes, procedures, actions, definitions, and workflows to successfully realize long-term SET goals. One of the goals for SET is to implement a streamlined DevOps model for lowering cost/price of O&M across the legacy RD system portfolio. SET supports many systems and addresses all functional defects, including security application vulnerabilities, and resolves them prior to code being promoted to a higher environment.

Legacy system enhancement or modernization planning to address complex IT objectives incrementally in order to increase the likelihood of achieving workable solutions for attainment of those objectives, using an Agile approach the Contractor has demonstrated success with and collaborates with the Government Product Owner. The Government Product Owner will specify high-level requirements/capabilities to the Agile team. As in typical Scrum-based Agile processes, the USDA Product Owner will work together with the team to develop and estimate user stories and establish acceptance criteria. These acceptance criteria will specify expected functionality for a user story, as well as any non-functional requirements that must be met in the development of the story. The USDA Product Owner, supported by subject matter experts and business analysts, will determine whether acceptance criteria have been satisfied.

New capabilities or strategic training may be needed to design, enhance, configure, tailor, test, implement, train and document new capabilities that will be required to deliver new enhancement and/or training on behalf of the USDA RD. Consistent with Agile- and Sprint-based development, any new capabilities, features, or requirements are subject to change based on Sprint planning during the period of the contract. Legacy system enhancement or modernization planning of system solutions may include software development or COTS integration and tailoring, test and evaluation, information assurance, operational test support, and system training. Efforts may support the SET team processes for system approval and acceptance.

Software sustainment is a priority for RDTO in that operations and sustainment costs can easily reach 60% to 80% of a system’s total lifecycle costs. The Contractor shall leverage Agile methods, which may combine practices from traditional and Agile methods to create a software sustainment method that works well within RDTO’s environment.

For Focus Area (FA) 3-SET, and FA4-Legacy Enhancement/Modernization Planning USDA RDTO expects more formal Agile methods to be used. As it currently stands, USDA RDTO does not envision FA1-Helpdesk or FA2-PSO to utilize formal Agile methods, but rather traditional or first-in-first-out methodology, as USDA evolves and matures as an organization and improve processes and procedures this could change. As a matter of consistency and uniformity, what is most important is that the focus areas share a fixed price and schedule construct, based on a team-based model.

2.1 Statutory authority, regulations, or policy affecting the overall requirement as applicable include but are not limited to:

• Clinger-Cohen Act (also known as the “Information Technology Management Reform Act of 1996”) (40 U.S.C. § 11101-11704);

• E-Government Act of 2002 (44 U.S.C. Chapters 35 and 36);

• Federal Information Security Modernization Act of 2014 (44 U.S.C. Chapter 35, Subchapter II);

• Federal Information Technology Acquisition Reform Act (FITARA) (Pub. L. 113-291);

• Paperwork Reduction Act (PRA) of 1980, as amended by the Paperwork Reduction Act of

1995 (44 U.S.C. Chapter 35);

• Privacy Act of 1974, as amended (5 U.S.C. § 552a);

• Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101);

• Electronic Signatures in Global and National Commerce Act (E-Sign) (15 U.S.C. Chapter

96);

• Government Paperwork Elimination Act of 1998 (44 U.S.C. § 3504);

• Government Performance and Results Act (GPRA) of 1993, as amended by the

Government Performance and Results Modernization Act (GPRA Modernization Act) of 2010 (5 U.S.C. § 306 and 31 U.S.C. §§ 1115 et seq.);

• Office of Federal Procurement Policy Act (41 U.S.C. Chapter 7);

• Budget and Accounting Procedures Act of 1950, as amended (31 U.S.C. Chapter 11);

• Chief Financial Officers Act (31 U.S.C. § 3512 et seq.)

• USDA RD Resources, Directives, and Regulations: https://www.rd.usda.gov/resources

RFP 12SAD120R0016

https://www.rd.usda.gov/resources

• USDA Departmental Regulations, Notices, Manuals, and Secretary Memoranda:

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

• USDA Digital Strategy: https://www.usda.gov/digital-strategy

• CIO.gov Policies and Priorities: https://www.cio.gov/policies-and-priorities/

3. Type of Award:

USDA Rural Development intends to establish a single Indefinite Delivery Indefinite Quantity (IDIQ) to issue Task Orders for services as defined in the PWS Scope and identified by CLINS.

This award and subsequent Task Orders are subject to Availability of Funds.

The IDIQ maximum for the base and all option years is $47,600,000.

The IDIQ minimum for the base and all option years is $10,000.

Task Orders Task Order types allowed under this IDIQ will be Firm Fixed Price.

Task Orders will be issued when requirements are required by the ordering activity.

Only the Contracting Officer is authorized to place a Task Order under this IDIQ.

A payment schedule will be specified in each Task Order.

Each Task Order shall specify its period of performance and the Task Order award amount.

Contractor shall complete an IDIQ STATUS REPORT after issuance of each Task Order.

Contractor shall be provided 45 days to begin work on a Task Order after it has been issued.

4. Non-personal and Not Inherently Governmental Services All services requested under this PWS are non-personal and not inherently governmental in nature.

5. Place(s) of Performance:

The Contractor shall perform the requirements of this contract at authorized vendor locations (primary) unless otherwise specifically stated in this PWS. The current work locations authorized for work by the government are:

i. USDA Rural Development 1400 Independence Ave SW, Washington DC, 20250

ii. USDA Rural Development 4600 Goodfellow Boulevard Federal Center, St. Louis, MO

63120

iii. Customer Site Location (Remote)

Changes in Authorized Work Locations:

Work locations are subject to change when it is advantageous to the Government to eliminate or add a work location or change work locations to remote. Should a change occur, the contractor will be notified in writing by the Contracting Officer (CO). Should the Contractor decide to relocate existing employees due to a change, employee relocation will be done at no cost to the government.

The Contractor may propose contractor work locations in addition to those identified in Places of Performance when it is advantageous to the government. This includes contractor employee telework locations during specified periods when the government facilities are closed due to weather and other emergency situations and/or when government facilities are unavailable due to other events making a government facility uninhabitable. The alternate work locations will be coordinated with the Contracting Officer Representative (COR) in advance and shall be at no additional cost to the government.

RFP 12SAD120R0016

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.usda.gov/digital-strategy https://www.cio.gov/policies-and-priorities/

USDA will provide Hardware/Software and workspace for the contractor’s staff to manage the service Helpdesk if the Contractor employees are working is USDA work locations. If not working at a USDA work location, USDA will only provide the Hardware/Software (laptop).

The Contractor shall ensure all government furnished equipment (GFE) assigned to individual employees are safely and securely operated and maintained regardless of the location where the work is performed.

6. Days and Hours of Performance:

The Contractor is required to be available on non-government holidays from 9:00am until 5:00pm EST, Monday through Friday to correspond with USDA RD’s point of contacts, such as the CO, COR, and the Program/Technology Office. The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

The contractor shall be required to perform the services under this contract during normal business hours and after hours as may be necessary so that access to the systems may not be interrupted during normal business hours. The normal business hours window is between 6:00 AM and 6:00 PM EST, Monday through Friday, except for Federal holidays. The contractor will be expected to provide services from offsite locations if they are unable to enter closed government facilities.

PSO team members will be part of a rotating 24/7 on call schedule and may need to be available on weekends and holidays to administer splash pages and/or recover a RD enterprise application system that is down or experiencing catastrophic problems. Unscheduled on-call after hours support is estimated to be 2-4 hours per week. Regularly scheduled after hours support is estimated to be 6-8 hours per week, depending on project activity.

Federal Holiday Schedule New Year’s Day Martin Luther King, Jr. Birthday Washington’s Birthday Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

7. Performance Period or Delivery Date:

The anticipated period of the IDIQ is a one-year base period with two one-year option periods.

(i) Base Period: Estimated September 30, 2020 through September 29, 2021.

(ii) Option Period one: Estimated September 30, 2021 through September 29, 2022.

(iii) Option Period two: Estimated September 30, 2022 through September 29, 2023.

Upon award of the initial IDIQ, and subsequent IDIQ Task Orders, at a mutually agreeable time, Offeror shall initiate work on this contract by meeting with key government agency representatives to ensure a common understanding of the requirements, expectations, and ultimate end products. Offeror shall discuss the overall understanding of the initial and overall projects and review the background information and materials provided by the government. Discussions will also include the scope of work, deliverables to be produced, how the efforts will be organized, and project conducted, assumptions made/expected and results. A concerted effort shall be made to gain a thorough understanding of the government agency expectations. However, nothing discussed in this or in any subsequent meeting(s) or discussions between the government and Offeror shall be construed as adding, deleting, or modifying any IDIQ Task Order requirements, including deliverable specifications and due dates. Any additions, deletions or modifications to any IDIQ Task Order requirement must be approved by the CO. Similar “kickoff” meetings shall be accomplished with each subsequent order placed.

9. Travel:

Travel reimbursement will not be provided under this IDIQ or any associated IDIQ task orders.

10. Government-furnished Property, Equipment, and/or services:

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide transition support as defined in this PWS except for those items specified below as government furnished property and services:

• Laptops: Receipt of government issued laptops are contingent upon Contractor employees receiving an USDA PIV card, known as LincPass, which contains the necessary data for the cardholder to be granted to Federal facilities and information systems and assure appropriate levels of security for all applicable federal applications.

• PIV Card/LincPass: The COR will work with Contractor to obtain PIV Card/LincPass for Contractor employees.

• Workspace and utilities shall be provided at USDA locations, if applicable.

a) USDA Rural Development 1400 Independence Ave Washington, D.C. 20250

b) USDA Rural Development 4300 Good Fellow Boulevard St. Louis, MO 63120

c) Other USDA offices as required under PWS work performance

11. Identification of Contractor Employees:

All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. When performing work outlined in this PWS while in USDA facilities or RD sites, contractor is required to wear Federal government-issued personal identification card.

12. Non-Disclosure Policy The work to be performed under this acquisition and the data released to the contractor’s personnel shall be treated as sensitive and confidential in nature and is not to be discussed with or released to anyone except USDA employees assigned to work with the contractor and other contractor personnel working on this acquisition. The contractor is responsible for requiring all its employees working under this acquisition, who have access to privileged information, to sign the USDA Non-Disclosure Agreement, provided as an attachment to the solicitation and contract.

RFP 12SAD120R0016

8. Kickoff Meeting

USDA, as it deems appropriate, may require additional certifications be completed by the contractor at any time during acquisition performance

13. Contractor Personnel Security Requirements

• Information Technology Systems Requirements:

The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The Contractor shall comply with IT systems security and/or privacy specifications set forth in Rural Development and USDA directives, policy, and procedures; the Computer Security Act of 1987; OMB Circular A-130; and the Federal Information Security Management Act of 2002

(FISMA).

Pursuant to FSIS policy, the Contractor shall be responsible for assuring that each Contractor employee who requires routine unaccompanied physical access to a Federally controlled facility and/or unaccompanied access to a Federally-controlled information system, including a Rural Development- issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The Contractor is required to maintain a listing of all individuals who have completed Computer Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten calendar days of an individual starting work on this contract.

• Access Requirements:

Contractor Access to USDA’s Network/Systems. The Contractor shall require access to the USDA’s Network/Systems to perform work under the contract. The COR will oversee such access.

• Information Assurance:

The Contractor shall protect and not disclose any PII. The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available - in any medium and from any source that, when combined with other available information, could be used to identify an individual.

14. OnBoarding Process The Contractor shall manage the onboarding of its staff for all Contractor personnel who have not yet been onboarded at USDA. Onboarding includes steps to obtain a USDA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required USDA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide, to the COR, an Onboarding Status Report for any staff with outstanding onboarding requests.

Additional information regarding the OnBoarding process is addressed in the attachment “PWS

BACKGROUND INVESTIGATION REQUIREMENTS”.

Deliverable:

A. Onboarding Status Report – due weekly.

This report is to include:

1. All outstanding onboarding requests that need to be reviewed by the COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

15. Special Consideration:

Contractor Collaboration: At the CO’s direction, the Contractor may be required to work in conjunction with other vendors, to provide PMO weekly status reports and meet regularly with said vendors. This authority shall not be delegated to any COR.

16. Organizational Conflict of Interest (OCI) Contractor and subcontractor personnel performing work under this acquisition may receive, have access to proprietary or information (e.g., cost/pricing, specifications, work statements, etc.) or perform services which may create a current or subsequent OCI as defined in FAR Subpart 9.5.

The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

17. DATA RIGHTS. The Government has unlimited rights to all documents/material produced under this IDIQ and subsequent IDIQ Task Orders. All documents and materials produced under this acquisition shall be Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. This right does not abrogate any other Government rights.

18. USDA Visual Identity Guidelines All visual materials intended for release to the public, both electronic and printed, delivered in the performance of this contract, must wholly conform to the current USDA Rural Development Visual Identity Guidelines. See attachment, “USDA Visual Identity Guidelines”. Such materials include the following, and any other products agreed to in advance between the COR and the vendor:

• Reports and other documents;

• Handouts;

• Advertisements intended for both printed and electronic media;

• Still visual presentations;

• Video presentations;

• Banners;

• Infographics;

• Posters;

• Folders;

• Cards and Envelopes;

• Photographs;

• Visual themes;

• Logos;

• Layout;

• Graphic design;

• Graphics;

• Graphs and charts;

• Illustrations;

• Drawings.

19. Constraints or Assumptions:

Contractor shall adhere to USDA Digital Strategy, US Web Design Standards, and Chief Information Officers Council (CIO.gov) policies and priorities.

20. Order of Precedence:

In the event of inconsistencies, between the Contractor’s proposal/quote and PWS, the required work specified in this PWS will take precedence over the Contractor’s proposal/quote.

21. Attachments that are incorporated into this PWS.

• RD Application Security Baseline Requirements

• Background Investigation Requirements

• RD IT Contract Requirements - 508 Compliance, Internet Protocol, EVM Reporting

Requirements, Records Management, Web Content Accessibility Guidelines

• Network Access Security Policy

• Non-disclosure agreement

• System Privacy Baseline Process Requirements

• Software Development Lifecycle (SDLC) Policy

• Acceptance and Defect Rubric (Very important to follow under FA2: PSO Operations.)

• USDA Visual Identity Guidelines

• Application Sustainment List of Systems Supported spreadsheet

III. SCOPE OF WORK

The selected contractor shall provide focus area (FA) support for four FAs.

The general scope of the FA support are as follows:

• FA 1: RD Application Helpdesk Support (O&M). The selected contractor shall provide application helpdesk support by providing Tier 1, Tier 2, and Tier 3 helpdesk providing application support, UAM, ticket management, Ticket platform/system management, IT Service Management, training, reporting, and coordination for support of new production services.

• FA 2: Production Support Operations (PSO) (O&M). The selected contractor shall support the PSO by implementing, enforcing, and maintaining separation of duties between IT development and operation efforts, keeping RD systems/applications/infrastructure running smoothly by providing production support, monitoring/dashboard, analysis, incident management, and improving standard processes/procedures.

• FA 3: Sustainment Engineering Team (SET) (O&M). The selected contractor shall support the SET by providing sustaining lifecycle support of deployed/production applications/systems, covering everything from new feature requests, bug fixes, product improvements, and process improvements, including consistency in the way the product source code is developed, tested, and managed.

• FA 4: Legacy System Enhancement or Modernization Planning (DME). The selected contractor shall support legacy system enhancement and/or modernization planning, using an Agile approach to address complex IT objectives incrementally in order to increase the likelihood of achieving workable solutions for attainment of those objectives.

1. FA 1: RD Application Helpdesk Support The Contractor shall:

• Develop and report key performance indicators, metrics, dashboards and billing reports related to the IT hosted and cloud infrastructures. Utilizing the general support systems toolchain. This will require collaboration with the PSO, as there may be some overlap.

o Helpdesk Requests Opened # per Mission Area/Department # by Type/Category (HW, SW, UAM, Application, etc.)

# by Priority (High, Medium, Low) # by Intake method (Phone, Email, System, etc.)

o Helpdesk Requests Closed Average Request Response Time – MTTR (mean time to respond) # per Mission Area/Department # by Type/Category (HW, SW, UAM, Application, etc.)

# by Priority (High, Medium, Low) # by fix agent.

• Support RD Tier 1, Tier 2, and Tier 3 IT helpdesk including, but not limited to, answering helpdesk calls, responding to and documenting ticket requests in the government approved system.

o Tier 1 Basic helpdesk resolution and service desk delivery o Tier 2 In-depth technical support o Tier 3 Expert product and service support that is escalated to PSO or SET. It goes to PSO if it is related to infrastructure or service. It goes to SET if it is related to applications.

Priority Description/

Code

Target Initial

Escalation Times

Target Tier 3 Escalation

Times

Target Resolution

Times

Critical 15 min 1 hour 4 hours High 30 min 2 hours 8 hours Moderate 1 hour 4 hours 24 hours Low 1 hour Planned Planned o Historical data suggest that there was an average of a 30-day resolution rate at 64%, with average of 14 minutes per resolution time o The contractor may utilize the following tools for ITSM support for ticketing, incident, request, knowledge, and the like, RDTO’s General Support System Toolchain, Jira and Jira Service Desk Enterprise Lifecycle Management System (ELMS) (being replaced by Jira

SD)

and the User Access Management (UAM) tool.

• Provide Best practices for implementing IT infrastructure library (ITIL) for service desk management

• Provide monthly SLA reporting and other helpdesk statistics to RDTO senior leadership

• Provide transition planning, training, and coordination support for new production applications to be supported by the helpdesk

• Provide enhancement planning and coordination support for the current ticketing platform, Jira and Jira Service Desk

• Provide communication monitoring for service issues through the approved ticketing platform, including ticket generation, issue confirmation with log number, resolution, and closing

• Provide development and enhancement of a knowledge base to be used by both external customers and support staff

Note: RD’s helpdesk is largely for the support of RD enterprise applications such as GLS, GUS, Loanserv, etc.

Notes:

• Helpdesk contact information is currently communicated by ticket, phone, email, and web.

• Daily Average call volume based upon 250 working days (52 weeks -10 holidays) by type of contact is as follows:

o Service Request- 20,065 Avg: 1.9232 o Incident Request- 483 Avg: 80.26 o Featured Request- 1 Avg:0.004

• Historical Ticket data is depicted in the following chart:

Created By Dates 7/31/2019 to 7/31/2020 (Last Day of ELMS)

Application Tier 1 Tier 2 Tier 3 Commercial Loan Servicing System 41 1 0 Guaranteed Loan System (GLS) 765 80 0 Guaranteed Loan System (GLS) – FSA unique programs 22 0 0 Multi-Family Housing Information

(MFIS) 125 15 0

Performance Management System -

- Performance Evaluation 0 0 0 eGovernment System Applications -- eGov 0 0 0 Administrative Technology Support Applications -- Customer Service Division Administration Support System 0 0 0

Mobile Applications -- MFIS Mobile 16 2 0 Program Funds Control System

(PFCS) 27 0 0

Commercial Program Application -

- CPAP 24 4 0

Processing (CPAP) 24 4 0 RD Apply Maintenance -- RD Apply 361 16 0 Automated Multifamily Accounting 22 1 0 Enterprise Cash Management System (ECMS) 12 1 0 ReConnect 248 36 0 Employee Portal -- OneRD 198 6 1 Higher Blends Infrastructure Initiative Program (HBIIP) 178 2 0 Prosperity Gateway

Deliverables to COR:

A. Monthly status report on activities or accomplishments associated with this FA. Report must include:

a. Breakdown of each helpdesk ticket by tier 1, 2, or, 3.

i. Number of tickets received

ii. Number of tickets resolved

iii. Average time period for each tier ticket to be resolved

2. FA 2: PSO Operations The contractor shall implement, enforce, and maintain separation of duties between IT sustainment engineering, development and operation efforts as well as identify related issues.

The frequency of after-hours support requests is as follows:

• Unscheduled requests – 2-4 hrs per week

• Scheduled activities – 6-8 hrs per week (*depending on project activity)

Operations and Maintenance support The contractor shall:

• Provide infrastructure and platform management.

o Platform and common component support includes but is not limited to FicoBlaze, JBoss, IIS, Apache, Essbase, OBIEE, Oracle Financials, Informatica, various databases, and the like.

o Infrastructure support includes but is not limited to: Platform as a Service (PaaS), Software as a Service (SaaS), Cloud, Mainframe, Microsoft Server, Linux, AIX, Solaris UNIX, Salesforce, MuleSoft, and the like.

o General Support System Toolchain will host the DevOps and Security Toolchain which consists of Confluence, Jira, Jira Service Desk, BitBucket, Git, MS Project Online, ArtiFactory, Jenkins, Compliance Sheriff, Selenium, IBM AppScan, Burp Suite Professional, Checkmarx, and Microfocus Web Inspect.

• Provide general support system tools support and application configuration.

• Provide application operations management.

• Provide support for installing, updating and operating hosted, cloud, and Mainframe applications.

• Provide database management and support for monitoring database efficiency, and tuning databases to be more efficient (SQL, Oracle, DB2, and the like).

o Perform database daily checks including database, verify daily database backup generation, health of databases including index maintenance, health of replication and log shipping, performance monitoring of the physical database systems.

o Utilize Microsoft SQL performance tools and Oracle TOAD toolsets.

o Execute database updates, server configurations and changes as directed by the projects.

o Provide mainframe Database support, DB2, IDMS, Focus, and the like.

• Provide IT business continuity/disaster recovery operations.

o Support Disaster Recovery (DR) efforts lead by the RD Chief Information Security

Officer (CISO) to design, implement, and support for performing disaster recovery failover testing.

o Provide input to the DR plan maintained by RDTO Cyber security division.

Note: There are 2, 10-day, scheduled DR exercises annually. Cybersecurity manages the DR exercising planning. Operations supports cybersecurity with planning activities, infrastructure, DB, and applications. Recovered infrastructure and applications are verified and turned over to application groups for application certification, and then PSO supports issue resolutions throughout the exercise.

• Provide integration of application certificates at the server and load balancer layers.

• Provide support and coordinate with the Operations and Maintenance Sustainment

Engineering Team (SET) and Development, Modernization, and Enhancement (DME) groups on application deployments, technology upgrades, security enhancements, and the like.

o This is code migration/deployment from lower environments to pre-production and production environments. Deployment methods depends upon the platform, but PSO has access to the tools and code repositories.

o RDTO is moving to a DevOps methodology using Jenkins, BitBucket and other tools.

• Fulfill Infrastructure Change and Service requests for all environments, following the RD Change and configuration IT management policies. Environments include development, test, pre-production, production, disaster recover, in both a PaaS hosted and cloud infrastructures.

• Provide release management, support, review, and build of installation packages for the hosted, cloud, and Mainframe environments. Including but not limited to Microsoft Windows, Mainframe, Solaris UNIX, Salesforce, MuleSoft, and Redhat Linux computing environments.

o Respond within 24 hours to emergency deployments that are approved in advance by RD management, which may disrupt and postpone regular scheduled deployments and other routine activities

• Provide incident management, support for responding to infrastructure and application outages caused by application errors, operating system patches, hardware failures, application interoperability problems, and the like.

o Liaison with Client Experience Center (CEC) and Digital Infrastructure Service Center (DISC), two internal USDA service providers, hosting support if the outage seems to be caused by a DISC general support system (hardware and/or network) to resolve the underlying issues as promptly as possible. The process to determine cause of outage follows the standard incident management utilizing an ITIL based incident management process, including but not limited to investigation, observation, reviewing logs, and the like.

• Support weekly maintenance of all applications, including coordination with CEC and DISC engineers, weekly builds of compiled applications into…