S000000182 ARCSIS O and M RFP.pdf

STATE OF ARKANSAS

DEPARTMENT OF TRANSFORMATION AND SHARED SERVICES

OFFICE OF STATE PROCUREMENT

501 Woodlane St., Ste. 220

Little Rock, Arkansas 72201-1023

REQUEST FOR PROPOSAL (MAP)

SOLICITATION DOCUMENT

SOLICITATION INFORMATION

Solicitation Number:

S000000182 Solicitation Issued:

November 29, 2022

Description: Operations, Maintenance, Support, and Enhancement of ARCSIS

Department: Department of Finance and Administration Office of Child Support Enforcement

SUBMISSION DEADLINE AND DELIVERY OF RESPONSE DOCUMENTS

Proposal Opening Date: December 22, 2022 Proposal Opening Time: 2:00 PM, Central Time

Proposal submissions for this Request for Proposal must be submitted through ARBuy, the State’s eProcurement system. It can be accessed at https://arbuy.arkansas.gov. Proposals received after the submission deadline may be rejected as untimely. See Section 1.2 for information regarding Live Proposal Openings.

TSS OFFICE OF STATE PROCUREMENT CONTACT INFORMATION

TSS OSP Buyer: Tiffany Bilon Buyer’s Direct Phone Number: 501-324-9320

Email Address: Tiffany.Bilon@arkansas.gov TSS OSP’s Main Number: 501-324-9316

TSS OSP

Website:

https://www.transform.ar.gov/procurement/ https://arbuy.arkansas.gov/ mailto:Tiffany.Bilon@arkansas.gov https://www.transform.ar.gov/procurement/

SECTION 1 – GENERAL INFORMATION AND INSTRUCTIONS

• Do not provide responses to items in this section unless specifically and expressly required.

1.1 INTRODUCTION

This Request for Proposal (RFP) is issued by the TSS Office of State Procurement (TSS OSP) for the Department of Finance and Administration Office of Child Support Enforcement (DFA OCSE) to obtain pricing and a contract for the operations, maintenance, support, and enhancement of the Arkansas Child Support Information System (ARCSIS).

The Contract awarded will be made to the Prospective Contractor determined to have submitted the proposal that is the most advantageous to the State. This RFP will follow requirements of 45 CFR 75.326 and 45 CFR 75.328.

Direct all questions, comments, or concerns you may have regarding this solicitation to the TSS OSP, not the Department.

1.2 LIVE PROPOSAL OPENING

Use the information below to view the proposal opening online.

Zoom Meeting Link:

https://arkansas-gov.zoom.us/j/82564442006?pwd=ZHB6b1VROWlkdWFreU92UGsycW9hUT09 Meeting ID: 825 6444 2006 Meeting Password: 406748 Dial-In Information: 877 853 5257 US Toll-free 888 475 4499 US Toll-free

1.3 TYPE OF CONTRACT

A. As a result of this RFP, TSS OSP intends to award a contract to a single Contractor. The Contract shall be a Firm Fixed Price contract in order to provide maximum incentive for the awarded Contractor to control costs and meet and/or exceed performance expectations.

B. The anticipated starting date for any resulting contract is July 1, 2023, except that the actual contract start date may be adjusted unilaterally by the State for up to three (3) calendar months. By submitting a signed proposal in response to the RFP, the Prospective Contractor represents and warrants that it will honor its proposal as being held open as irrevocable for this period.

C. The initial term of a resulting contract will be for three (3) years. Upon mutual agreement by the Contractor and Department, the contract may be renewed by TSS OSP for up to four (4) additional one-year terms or portions thereof, not to exceed a total aggregate contract term of seven (7) consecutive years.

1.4 SOLICITATION SCHEDULE

For informational purposes, TSS OSP is providing a Solicitation Schedule; however, dates listed and noted with an asterisk (*) are anticipated dates only and are subject to change at the discretion of the State. All times are listed in Central Time.

TABLE 1: TENTATIVE SOLICITATION SCHEDULE

ACTIVITY DATE

RFP Release to Prospective Contractors 11/29/2022

Bidders Conference 12/2/2022 @ 10 am

Deadline for Prospective Contractor Questions 12/7/2022 @ 5 pm

Answers to Questions Posted to ARBuy* 12/15/2022

Proposal Due Date 12/22/2022 @ 2 pm

Initial Proposal Evaluation* 1/4/2023 https://arkansas-gov.zoom.us/j/82564442006?pwd=ZHB6b1VROWlkdWFreU92UGsycW9hUT09

Interviews* 1/12/2023

Final Proposal Evaluation* 1/12/2023

Discussions Kick Off Meeting* 1/18/2023

Finalize Discussions* 1/25/2023

Post Anticipation to Award* 1/26/2023

Award Contract* 7/1/2023

1.5 BIDDERS CONFERENCE

A. TSS OSP will host a bidders conference to provide additional information and clarification regarding the RFP.

1. The conference will take place on the date and time listed in Section 1.4 Table 1.

2. The conference is important for Prospective Contractors to understand the tasks a Prospective Contractor shall complete when submitting a proposal (“Submission Requirements”).

3. Prospective Contractors may attend the conference via Zoom.

Zoom Meeting Link:

https://arkansas-gov.zoom.us/j/82971776908?pwd=K21SOXJ1Q1BFUllzSSszN2xTa2dPdz09 Meeting ID: 829 7177 6908 Meeting Password: 322790 Dial-In Information: 877 853 5257 US Toll-free 888 475 4499 US Toll-free

4. The bidders conference presentation will be posted to the Solicitation posting in ARBuy.

1.6 CLARIFICATION OF SOLICITATION

A. Submit any questions requesting clarification of information contained in this Solicitation via the

Solicitation posting in ARBuy by the date and time listed in Section 1.4 Table 1.

1. For each question submitted, Prospective Contractor should reference the specific Solicitation item number to which the question refers.

2. Prospective Contractors’ written questions will be consolidated and responded to by the State as deemed appropriate. The State’s consolidated written response is anticipated to be posted to the Solicitation posting in ARBuy by the close of business on the date provided in Section 1.4, Table

1. If Prospective Contractor questions are unclear or non-substantive in nature, the State may request clarification of a question(s) or decline to answer.

B. The Prospective Contractor should notify the TSS OSP buyer of any term, condition, etc., that precludes the Prospective Contractor from submitting a compliant, Responsive Proposal. Prospective Contractors should note that it is the responsibility of the Prospective Contractor to seek resolution of all such issues, including those relating to the terms and conditions of the contract, prior to the submission of a proposal.

C. Prospective Contractors may contact the TSS OSP buyer with non-substantive questions at any time prior to the proposal opening.

D. An oral statement by TSS OSP will not be part of any contract resulting from this Solicitation and may not reasonably be relied on by any Prospective Contractor as an aid to interpretation unless it is reduced to writing and expressly adopted by TSS OSP.

1.7 DEFINITION OF TERMS

A. Unless otherwise defined herein, all terms defined in Arkansas Procurement Law have the same meaning herein.

B. “Contract” means a contract awarded to a Prospective Contractor as a result of this RFP.

https://arkansas-gov.zoom.us/j/82971776908?pwd=K21SOXJ1Q1BFUllzSSszN2xTa2dPdz09

C. “Contractor” means a person or company awarded a contract by the State to perform services as a result of this RFP.

D. “Cybersecurity Incident” means any compromise of the security, confidentiality, or integrity of an information system maintained by DFA OCSE, a contractual provider of an information system that contracts with DFA OCSE, or other computer-related services of DFA OCSE, that is caused by any unauthorized:

1. Access to an information system of DFA OCSE;

2. Destruction of an information system of DFA OCSE or the data of an information system of DFA OCSE; or

3. Acquisition of data or loss of data from an information system of DFA OCSE.

E. “Enhancements” means a perfective activity that enhances both the function and efficiency of the code and changing the functionalities of the system as per the users’ changing needs.

F. “Maintenance” means modifications of the system after implementation in order to correct errors and monitor and adjust performance to maximize the security and efficiency of the system.

G. “Operations” means the day-to-day system management responsibility for IT infrastructure such as data center, client/desktop or connectivity/network.

H. “Prospective Contractor” means a responsible offeror who submits a proposal in response to this solicitation.

I. The terms “Request for Proposal,” “RFP,” and “Solicitation” are used synonymously in this document.

J. “Requirement” means something required.

K. “Responsive Proposal” means a proposal submitted in response to this solicitation that conforms in all material respects to this RFP.

L. “Services” means the furnishing of labor, time, or effort by a contractor to meet the requirements of this RFP.

M. “Shall” and “Must” mean the imperative and are used to identify requirements.

N. “Specification” means any technical or purchase description or other description of the physical or functional characteristics, or of the nature, of a commodity or service. “Specification” may include a description of any requirement for inspecting, testing, or preparing a commodity or service for delivery.

O. “State” means the State of Arkansas. When the term “State” is used herein to reference any obligation of the State under a contract that results from this solicitation, that obligation is limited to the Department using such a contract.

P. “Subcontractor” means a person or entity that has been engaged by the Contractor to perform work or services for a contract that has been awarded between the State and the Contractor and is not an employee of the Contractor.

Q. “Support” means technical and functional help to users of the system.

1.8 RESPONSE DOCUMENTS

A. All proposal responses must be submitted through ARBuy, the State’s eProcurement system. The system can be accessed at https://arbuy.arkansas.gov.

B. Technical Proposal Packet

1. Responses within the Information for Evaluation and Exceptions sections must not contain the Prospective Contractor’s name or any other identifiers, including without limitation names of staff members, projects, products, and addresses.

https://arbuy.arkansas.gov/

2. Prospective Contractors shall utilize the Technical Proposal Packet to submit their responses.

3. The following items are proposal Submission Requirements and must be submitted as part of a Prospective Contractor’s proposal response.

a. Signed Proposal Signature Page. Signature may be ink or digital. (See Technical Proposal Packet.)

b. Technical Proposal response to the Information for Evaluation section included in the Technical Proposal Packet. Proposal response must be in the English language.

c. Completed Pricing Response. Official Solicitation Price Sheet attached to solicitation posting in ARBuy. Pricing must be proposed in U.S. dollars and cents.

d. Recommended Options Form. The Recommended Options form included in the Technical Proposal Packet allows Prospective Contractors to identify any recommended options or optional service ideas that may benefit the State that were not included in the Requirements and the proposed solution.

e. Proposed Subcontractors Form. The utilization of any proposed subcontractor is subject to approval by the Department.

f. Exceptions Form.

g. Copy of Prospective Contractor’s Equal Opportunity Policy.

4. The following items, which must be submitted prior to a contract award to the Prospective Contractor, may also be included with the Prospective Contractor’s proposal:

a. EO 98-04: Contract and Grant Disclosure Form.

b. Voluntary Product Accessibility Template (VPAT), if applicable.

5. DO NOT include any other documents or ancillary information, such as a cover letter or promotional/marketing information.

C. Redacted Copy of the Technical Proposal Packet and Completed Pricing Response

1. One (1) redacted (marked “REDACTED”) copy of the Prospective Contractor’s proposal response (see Section 6 of the Solicitation Terms and Conditions referenced in Section 1.10.)

1.9 ACCEPTANCE OF REQUIREMENTS

A. Unless a Prospective Contractor expressly and conspicuously identifies any exception or exceptions to any of the Requirements in the Requirements Section(s) of this RFP by listing them on the Exceptions Form (see Technical Proposal Packet), Prospective Contractor understands and agrees its submission of a proposal to represent that its proposal meets all such Requirements.

B. A Prospective Contractor’s proposal may be rejected if a Prospective Contractor takes exception to any Requirements in the Requirements Section(s) of this RFP.

1.10 ADDITIONAL TERMS AND CONDITIONS

A. This RFP incorporates all of the Solicitation Terms and Conditions located on the TSS OSP website found at transform.ar.gov.

1. Any special terms and conditions included in this solicitation shall override the Solicitation Terms and Conditions.

B. Unless a Prospective Contractor expressly and conspicuously identifies any exception or exceptions to any of the terms in the Services Contract (SRV-1) Fillable Form (found here) by listing them on the Exceptions Form (see Technical Proposal Packet), Prospective Contractor agrees and shall adhere to all terms if selected as the successful Contractor.

1. Items identified as non-negotiable may only be modified if the legal requirement is satisfied and approved by the State.

https://www.transform.ar.gov/wp-content/uploads/2021/12/MASTER-Solicitation-Terms-and-Conditions-11-29-21.pdf https://www.transform.ar.gov/wp-content/uploads/2021/08/Services-Contract-SRV-1-Fillable-Form-V.2.pdf

C. A Prospective Contractor’s proposal may be rejected if a Prospective Contractor takes exception to any terms or conditions in the documents listed in Sections 1.10.A and 1.10.B.

SECTION 2 – REQUIREMENTS

• Do not provide responses to items in this section unless specifically and expressly required.

2.1 BACKGROUND

A. The Office of Child Support Enforcement (DFA OCSE) is a division within the Department of Finance and Administration (DFA). DFA OCSE works in partnership with the Federal Office of Child Support Enforcement and other State agencies to establish and enforce court-ordered financial and medical support.

B. DFA OCSE is comprised of the following:

1. Central Office: Provides necessary support services for field staff and to administer the program at the State level.

2. Field Offices: 26 offices across the State provide direct services to customers.

3. Arkansas Child Support Clearinghouse: Responsible for the collection and disbursement of payments in child support orders.

4. DFA Office Information Services: Provides the information technology support for DFA

OCSE.

a. DFA OCSE Information Services: Responsible for support of the ARCSIS application.

b. Chief Information Security Office: Responsible for developing agency security policy and overseeing the development of application ecosystem specific security policy and procedures.

c. Technical Services: Responsible for maintaining the network, data center, and desktop support for DFA OCSE.

C. In order to comply with Federal funding requirements, planning, designing, development, installation, and enhancement information must be included in DFA OCSE’s initial Advanced Planning Document (APD), and the annual update as required under 45 CFR § 307.15. DFA OCSE currently submits an Annual Advanced Planning Update to the Federal OCSE annually in April of each year.

2.2 CURRENT ENVIRONMENT AND COMPLIANCE

A. ARCSIS is a fully implemented, federally certified case, financial management, SDU (State

Disbursement Unit) and reporting system that provides DFA OCSE workers, administrators, operations personnel, the public and the Federal Office of Child Support Enforcement with an integrated system of tools encompassing the entire child support program. These tools provide a customer service-oriented approach to child support services and provide the field staff with the technology necessary to manage its caseload effectively and efficiently. The ARCSIS system is a fully custom developed solution that is wholly owned and is the intellectual property of the State of Arkansas. It is compromised of the following 4 major components:

1. Case and Financial Management: Case and financial management applications are part of ARCSIS, which addresses the requirements associated with Federal certification of the comprehensive, automated, statewide child support enforcement systems. Complete details concerning a federally certified system can be found at: Automated Systems for Child Support Enforcement: A Guide for States | The Administration for Children and Families (hhs.gov).

2. State Disbursement Payment Processing: The SDU payment processing applications are part of ARCSIS and were developed to process all incoming payments from numerous sources (i.e. employers, individuals, and other states) and in various formats (i.e. electronic and paper).

The SDU payment system scans, identifies, and processes all payments and prepares them for distribution and disbursement through ARCSIS. ARCSIS utilizes Check 21 for the deposit of all paper payments.

https://www.acf.hhs.gov/css/training-technical-assistance/automated-systems-child-support-enforcement-guide-states https://www.acf.hhs.gov/css/training-technical-assistance/automated-systems-child-support-enforcement-guide-states

3. Reporting: Different reporting tools are used to present statistical information to users. A web front-end portal allows users to access reports in a variety of formats, including .pdf, Excel files, .Net web reports, and Microsoft SQL Server Reporting Services.

4. Websites: DFA OCSE maintains two secure websites to provide case and financial information to customers and employers paying child support. Both sites were developed using Microsoft .Net framework.

B. Software Environment: In addition to ARCSIS, the software components detailed below are used for the day-to-day operations of ARCSIS. The State purchases all software components for ARCSIS.

1. Development Software: ARCSIS utilizes the complete Microsoft Visual Studio suite of products for the development of web-based applications. These development products include Visual Studio and Team Foundation Server, which are manufactured by Microsoft. Development software tools are used to increase development productivity and streamline the development process.

2. Code Management Software: DFA OCSE utilizes Microsoft Team Foundation Server to maintain version control of the application and as the primary location to store all system related documentation. Team Foundation Server is used exclusively to record test cases and testing results from the various stages of the software development lifecycle. A custom developed code migration application is utilized to migrate code from the Team Foundation Server to the production servers based on predefined roles.

3. System Software: The system software provides essential functions necessary for the successful operation of the DFA OCSE enterprise. Products include:

a. Database Management System: Microsoft SQL Server suites is the database management system used. The database is compatible with Windows Server and has Internet integration allowing organizations to build active websites and internal Intranet sites. The current version in use is Windows SQL Server 2017.

b. Operating System: Microsoft Windows Server is the operating system used on DFA OCSE servers. It keeps track of user authentication files and print services. Other features include multiple websites on a single machine, innovative web publishing features, customizable tools, and new wizard technologies. The current version being used is Windows Server 2019.

c. PDF Batch: ActiveReports is a Visual Studio integrated design tool used for creating batch PDF documents. This tool is used extensively in batch form generation for daily and monthly print jobs.

4. IT Helpdesk Software: DFA OCSE uses Track-It! by BMC to manage emails, phone calls, and other requests from users, tickets, change requests, data integrity work items, security access, network issues, connectivity, and IT assets. The software is a web-based application, which is hosted on-premises at the DFA OCSE data center.

5. Document Management Software: An objective of the Arkansas Child Support program is to efficiently manage the high volume of documentation that amasses with managing a child support case. The core components of Arkansas’ solution are Open Text’s Captiva family of products and the use of Open Text ApplicationXtender export and web services solution. The Captiva family of products converts paper, fax, and electronic data sources into content that can be processed by other applications. ApplicationXtender stores and organizes the content so it can be presented to the enterprise through a desktop interface or a browser. The development and rollout of this document management solution occurred in State Fiscal Years 2010 and 2011. DFA OCSE continues to expand its usage of ApplicationXtender to further address the growing need to become less dependent on paper files.

6. Client Software: Client software installed on staff workstations to perform necessary duties include:

a. Microsoft Office Suite 365: The productivity suite in use by staff. Individual products include Microsoft Word, Excel, Outlook and PowerPoint.

i. Microsoft Edge: The web browser is the primary gateway for DFA OCSE staff to access the ARCSIS application and other IT tools.

C. Hardware Environment: This section identifies the hardware that is utilized by the DFA OCSE IT infrastructure. The different categories of hardware are outlined below.

1. Network Connectivity: DFA OCSE currently operates and maintains a series of interconnected LANs. These LANs make up the switched network and provide Statewide communications between the DFA OCSE Information Systems (IS) office and various field offices. In a typical DFA OCSE field office, Cisco switches are linked to Cisco routers provisioned by the Arkansas TSS Division of Information Systems (TSS DIS). TSS DIS provides all WAN connectivity. Within each field office, Cisco switches provide LAN connectivity. DFA OCSE uses the DIS network in providing the data connection between the DFA OCSE field offices and the DFA OCSE data center. The transmission between the field office and the data center is encrypted and TCP/IP is the protocol used for communication between the client and the web server. Services also include Voice over Internet Protocol (VoIP) Telephony. VoIP services are delivered via dedicated VLANs with the service itself being managed by TSS DIS utilizing Cisco CallManager.

2. Server Environment: DFA OCSE uses ARCSIS, an Intranet application, and other auxiliary applications for its day-to-day operations. All data is accessed through https requests to the Intranet information web server, which in turn provides the data by fetching it from the relational database (MS SQL) server. DFA OCSE uses the TSS DIS network in providing the data connection between the DFA OCSE field offices and the DFA OCSE data center.

a. The DFA OCSE data center recently migrated all server compute and storage requirements to a dedicated on-premise Infrastructure as a Service (IaaS) solution provided by HPE GreenLake that is supported by State and HP technicians. The transmission between the field office and the data center is encrypted and TCP/IP is the protocol used for communication between the client and the web server. The DFA OCSE SQL Cluster farm is the main database engine that runs the DFA OCSE enterprise providing data warehousing capabilities. The primary technologies used in the DFA OCSE environment are:

i. Windows Server;

ii. Microsoft SQL Server for database management;

iii. HP Storage Area Network for SQL Server databases;

iv. Microsoft System Center Configuration Manager for administering patches, critical fixes and service packs;

v. IIS for applications hosting;

vi. Office 365 and on-premise hybrid Exchange for DFA OCSE mail and system mail functions;

vii. Cisco Umbrella for web content and site filtering;

viii. Visual Voice for automated voice response system;

ix. SNA for host data replication;

x. Cisco Firepower for intrusion detection and prevention with ASA firewall; and

xi. F5 BigIP load balancing.

3. Workstation: Windows 10 business class desktops and laptops are standard workstations with 22-inch or larger flat screen monitors. Workstation standards are maintained through various group policies and limitations on administrator’s privileges.

4. Printers: Standard network-based printing is used as the print solution. Each printer on the network will be IP addressable. Most printers are multi-function devices capable of printing, scanning, copying, and faxing when appropriate.

D. Regulatory Compliance: The ARCSIS application as well as all information technology infrastructure within the State must abide by the following regulatory guidance.

1. IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (http://www.irs.gov/pub/irs-pdf/p1075.pdf).

2. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations, (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf).

3. Federal OCSE Automated Systems for Child Support Enforcement: A Guide for States.

(Automated Systems for Child Support Enforcement: A Guide for States | The Administration for Children and Families (hhs.gov)).

4. Biennial APD System Security Review (45 CFR 95.621).

E. System Metrics:

1. Organizational Structure including current O&M contractor staff (See Attachment 1).

2. Program Complexity (See Attachment 2):

a. Screens

b. Batch Jobs

c. Forms

d. Reports

e. Helpdesk Tickets/Production Support Tickets

f. Work Items (IT staff work items, ARCSIS maintenance work items, and development tasks)

F. Security:

1. Contractor shall develop and maintain managerial, operational, and technical procedures and standards relevant to support operations as is necessary to maintain compliance with regulatory standards specified in section 2.2.D. All procedures, technical diagrams, and other materials developed by the Contractor pursuant to the performance of Contractor’s duties must be the property of DFA.

2. Contractor staff shall adhere to DFA security policy when performing work.

3. Information regarding DFA Information Systems, processes, and procedures, must remain the property of DFA. The Contractor shall not disclose information obtained through the performance of its duties to any third-party and information obtained shall only be accessed by those individuals as is necessary for the performance of Contractor’s duties. The requirement of this section shall live in perpetuity.

4. Contractor shall develop an annual security plan in accordance with applicable regulatory standards specified in section 2.2.D subject to approval by the DFA Chief Information Security Officer.

http://www.irs.gov/pub/irs-pdf/p1075.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://www.acf.hhs.gov/css/training-technical-assistance/automated-systems-child-support-enforcement-guide-states https://www.acf.hhs.gov/css/training-technical-assistance/automated-systems-child-support-enforcement-guide-states

5. Contractor shall participate in regulatory audit, inspection, and risk assessment activities as is required by the regulatory standards as specified in section 2.2.D.

6. Contractor shall participate in vulnerability and penetration testing exercises as is deemed necessary by the DFA Chief Information Security Officer.

7. Contractor shall utilize best practices in development and modification of systems configurations, software, and applications. Development and implementation practices must align with the applicable elements of the SANS Institute “Securing Web Application Technologies” Checklist (Securing Web Application Technologies : [SWAT] Checklist | SANS Institute) and the Department of Transformation of Shared Services Division of Information Systems “Securing Web Applications Policy” (See Attachment 11).

8. In the event of a Cybersecurity Incident, Contractor shall notify the DFA Primary Point of Contact and the DFA Chief Information Security Officer as soon as feasible, but not longer than 24 hours after any discovery of a Cybersecurity Incident. The initial report must include, but is not necessarily limited to:

a. Date and time of discovery;

b. Date and time of incident;

c. Scope description of incident detailing available information regarding exposure of information, systems impacted, and current status; and,

d. Initial mitigation actions taken, if any.

2.3 SERVICE REQUIREMENTS

A. DFA OCSE is looking for a Contractor to provide qualified resources for each of the areas listed below. Attachment 3 details the expected duties and qualifications of the resources the Contractor shall provide.

B. In coordination with the DFA OCSE IT Coordinator, the Contractor shall provide services in the following areas:

1. Project Management:

a. Contractor shall provide qualified project management oversight of all operations, maintenance, and development tasks covered under the Contract. This must include all project schedules, work plans, issue management, and risk management activities, as well as weekly and monthly reporting requirements as defined by the State.

b. Key operations and maintenance work and activity must be managed through industry standard project management processes and practices including already established operational plans (software development, release management, change management, etc.)

and project management plans.

c. The Contractor shall, as part of the ongoing baseline application maintenance and support of ARCSIS, consistently improve the application by incorporating business needs and best practice, addressing new State and Federal requirements, improving operational performance, and incorporating new technology when appropriate.

d. The Contractor shall provide services that are inclusive of all the requirements, tasks, services, in scope activities, and deliverables outlined herein. Application maintenance and development activities must be inclusive of project initiation, planning and management, requirements, functional design, system design, construction, testing, implementation and post-implementation, and any related batch process support.

e. A detailed list of duties and qualifications for project management resource(s) can be found in Attachment 3.

https://www.sans.org/cloud-security/securing-web-application-technologies/ https://www.sans.org/cloud-security/securing-web-application-technologies/

2. Helpdesk Support: (See Attachment 4)

a. The Contractor shall staff and manage a helpdesk to provide support to end users. The Contractor shall coordinate with and help the State helpdesk to support end users. This must include attending and participating in helpdesk ticket triage sessions, research, analysis, and troubleshooting of helpdesk tickets submitted by end users.

b. The Contractor helpdesk staff shall be responsible for receiving and logging all helpdesk tickets. The Contractor shall provide support for analyzing and resolving helpdesk tickets that include both functional and technical end user support. This must be coordinated with State resources after Contractor analysis, as there may be a need to add maintenance items to the ARCSIS workload.

c. Helpdesk operations must work within a two (2) hour expected turnaround of logged items, either resolved or escalated to another section of DFA OIS unless the accumulated time is due to waiting on follow-up from the requestor. See Section 2.9 for additional details.

d. A detailed list of duties and qualifications for helpdesk resource(s) can be found in Attachment 3.

3. Database Administration:

a. The Contractor shall provide operational support services for the State database, manage the DBA staff, plan, organize and control overall activities of the database systems.

b. The Contractor shall provide database expertise with respect to system changes and upgrades, beyond the standard management tasks related to the database.

c. The Contractor shall provide support for operations related help desk tickets from State staff to support system monitoring.

d. The Contractor shall provide overall system monitoring and performance management, including monitoring, identifying, and resolving any system related tickets while continuing to ensure all system performance metrics are met.

e. A detailed list of duties and qualifications for database administration resource(s) can be found in Attachment 3.

f. Database operations must perform at ninety-nine percent (99%) efficiency. See Section 2.9 for additional details.

4. Network and Systems Administration:

a. The Contractor shall provide technical operations and infrastructure support services.

These services include support for application builds, configuration changes, performance-related changes, and any other infrastructure changes. The Contractor shall also be responsible for the overall application and system performance monitoring to meet performance metrics defined by the State.

b. State staff will be responsible for the acquisition and physical installation of infrastructure for systems, including but not limited to physical servers, network equipment, and security/firewall appliances.

c. Contractor staff shall be responsible for virtual servers, software installation and initial configuration for all development, test, and production environments.

d. Contractor shall provide support for operations, code promotion, and deployment in all environments including any modifications to system parameters. The Contractor shall also provide support in all environments including the following activities:

i. System Management: This includes the management of all development servers within the infrastructure: web, application, database, interface servers, batch servers, and any other components.

ii. Database Management: Besides the standard management tasks related to the Database, also provide database expertise with respect to system changes, upgrades, SQL programming, and tuning.

iii. Technical Support: This includes support for operations related helpdesk tickets to support system monitoring.

iv. System Monitoring: This includes overall system monitoring and performance management. Monitor, identify, and resolve any system related tickets while continuing to ensure all system performance metrics are met.

v. Security Operations: This includes operational tasks as defined by the State’s Chief Information Security Office as well as tasks related to State security operations.

Examples include research/resolution of any security findings/reports, assistance with security audits, or technical projects related to security tools such as data masking.

vi. Tools Support: Contractor shall provide support of all system development tools utilized by the project. Many of the tools may reside on State systems, however, operations are still the responsibility of the Contractor.

e. The Contractor shall provide support for Team Foundation Server (TFS) as well as the back-up and maintenance thereof.

f. The Contractor shall be required to work with State staff to implement disaster recovery (DR) solutions and conduct any necessary DR tests.

g. A detailed list of duties and qualifications for network administration resource(s) can be found in Attachment 3.

h. Network operations must maintain a ninety-nine percent (99%) uptime of network resources during normal business hours. See Section 2.9 for additional details.

5. Operations and Maintenance:

a. Contractor shall provide support of all operations and maintenance tasks covered under the Contract. This must include all operation and maintenance schedules, work plans, issue management, and risk management activities, as well as weekly and monthly reporting requirements as defined by the State.

b. The Contractor shall, as part of the ongoing baseline application maintenance and support of ARCSIS, consistently improve the application by incorporating business needs and best practice, addressing new State and Federal requirements, improving operational performance, and incorporating new technology when appropriate.

c. The Contractor shall provide services that are inclusive of all the requirements, tasks, services, in scope activities, and deliverables outlined herein. Operation and maintenance activities must be inclusive of issue description, analysis, requirements, design changes, issue resolution, construction, testing, implementation and post-implementation, and any related batch process support.

d. A detailed list of duties and qualifications for operations and maintenance resource(s) can be found in Attachment 3 including technical architect, systems analyst, developer, and business analyst.

e. The Contractor shall ensure that the system be made available ninety-nine percent (99%) of scheduled time available. See Section 2.9 for additional details.

6. Development Tasks:

a. Contractor shall provide support of all development tasks covered under the Contract. This must include all project schedules, work plans, issue management, and risk management activities, as well as weekly and monthly reporting requirements as defined by the State.

b. The Contractor shall provide services that are inclusive of all the requirements, tasks, services, in scope activities, and deliverables outlined herein. Application development activities must be inclusive of project initiation, planning and management, requirements, functional design, system design, construction, testing, implementation and post-implementation, and any related batch process support.

c. Contractor shall provide support in the following System Development Life Cycles

i. Requirements analysis and management

ii. System design

iii. System development

iv. System testing

v. Release management

vi. Change control management

vii. Batch operations, scheduling, and management

viii. Problem resolution, analysis, and troubleshooting

d. A detailed list of duties and qualifications for development resource(s) can be found in Attachment 3 including technical architect, systems analyst, developer, and business analyst.

C. If there is a need for the State to exceed the number of hours included in items 5 and/or 6 above during the Contract term, DFA OCSE IS will request approval from the DFA OCSE Administrator. If approved, DFA OCSE IS and the Contractor shall work together to develop the appropriate project documentation for the requested scope of work. The cost for any hours approved beyond the allotted hours must be billed at the appropriate rate (Tab 3 of the Official Solicitation Price Sheet) for the resource(s) being utilized.

D. During the Contract term, the State shall not commit to using all hours included on Tab 3 Table 1 and/or Table 2 of the Official Solicitation Price Sheet. The State may use more or less depending on need.

E. The State is not looking to replace or modernize the current ARCSIS application. ARCSIS underwent a technology infrastructure upgrade in 2014 and continues to remain current to industry standards.

Any such replacement or modernization that may occur will require full review and approval of Federal OCSE and will follow the APD.

F. The State is not looking to change its data center or hosting infrastructure.

G. The State reserves the right to enter into an Addendum to the Contract at any time to allow for emerging technologies not identified elsewhere in the Contract if there are repeated requests for such emerging technology or the State determines it is warranted to add such technology.

2.4 STATE ROLES AND RESPONSIBILITIES

A. The following are State responsibilities under the Contract.

1. State Staffing Roles: (See Attachments 1 and 7)

2. Staff Participation:

a. State staff normal work hours are 8:00 AM – 4:30 PM Central Time, with some staff flexing their schedules. State staff may be required to be available to participate in testing, batch support, production infrastructure support, and problem resolution outside normal working hours.

B. System Availability: During State business days, the production systems are normally available from 7:00 A.M. to 6:00 P.M. Central Time. Production systems may be taken down earlier on specific monthly dates to accommodate particularly heavy batch schedules.

2.5 CONTRACTOR WORK ASSIGNMENT

A. To achieve the mission of DFA OCSE, State management will work with the primary business stakeholders to define work items necessary for the effective operation of the IT infrastructure. These items may include system changes related to the following areas:

1. Federally mandated changes to the child support process.

2. State mandated changes based on State laws or mandates.

3. DFA OCSE identified changes, including minor perfective changes to system functionality.

4. User defined items to correct system flaws or enhance business functionality.

B. Primary stakeholders include DFA OCSE executive management and their designees.

C. Once a work item is defined, it will be assigned a work number and provided to the Contractor to perform an initial assessment (See Attachment 5).

D. Upon assignment of a task by DFA OCSE Management, Contractor shall complete an assessment of work and determine the scope of work in terms of hours required to complete the work item.

1. If the anticipated work is less than 8 hours, the Contractor shall notify the DFA OCSE IT Coordinator and complete the work for review by DFA OCSE State Technical Staff.

2. If the anticipated work is less than 240 total hours, the Contractor shall submit to DFA OCSE Management an issue resolution document within ten (10) days of receipt (see Attachment 6).

3. If the estimate of work exceeds 240 hours, Contractor shall submit a project scope statement following the Software Development Life Cycle approach within twenty (20) days of receipt (See Attachment 6).

4. The document should outline the problem or change, the high-level solution and a breakdown of hours by resource and work.

5. Hours spent on any maintenance work items and on projects must not exceed fifteen percent (15%) of the approved hours outlined in an issue resolution document, project scope statement, or any subsequent change order. See Section 2.9 for additional details.

E. If a change in task is requested by the business stakeholder or identified after by the Contractor during the assignment, Contractor shall submit a change request document. The document should outline the additional work needed along with any additional hours by resource necessary to complete the work.

F. DFA OCSE Management will review the scope of work defined in an issue resolution document, scope statement or change request to determine if it meets the business need and can be performed in an acceptable amount of time. Upon approval, DFA OCSE Management will define the timeframe for when work will begin.

G. Contractor shall deliver and implement approved system enhancements and updates based on a mutually agreed upon, baselined schedule. See Section 2.9 for additional details.

H. A nonconformity means, with respect to the ARCSIS system, a material deviation from the applicable requirement or the documentation for that system, as determined by the State. Such nonconformities are material and will have substantial economic impact upon the State.

1. Nonconformities will be recorded throughout the Contract period as “Incidents” and will be classified by the State and at the sole discretion of the State. See Section 2.9 for additional details.

I. Document Templates will be provided by DFA OCSE Management at time of contract award.

2.6 CONTRACTOR ROLES AND RESPONSIBILITIES

A. Resources:

1. The Contractor shall administer and manage the contracted resources performing the work on this project.

2. All resources must be exclusive to Arkansas DFA OCSE and shall not be assigned by the Contractor to other projects.

3. Resources contracted by the Contractor that are not full-time employees of the Contractor shall be considered Subcontractors. For example, Company A contracts with XYZ Consultants to provide resources to work on the project, XYZ Consultants would be considered a Subcontractor.

4. If a resource leaves employment of the Contractor or the State requires a replacement resource, the Contractor shall replace the resource within 14 calendar days. If that timeframe cannot be met, the Contractor shall request an extension from DFA OCSE.

a. Replacement resources must meet or exceed the qualifications and skills for the position listed in Attachment 3.

b. As directed by 45 CFR 75.308(c)(1), any replacement of key personnel must receive prior approval from HHS OCSE before beginning work on the project.

5. DFA OCSE prefers for all work to be performed on-site at State facilities. During the first year of the Contract, the Contractor and all resources shall work on-site at State owned facilities. DFA OCSE will review productivity and performance during the first year and determine if remote or hybrid work will be allowed for selected resources. If approved, DFA OCSE and the Contractor shall develop a plan to transition resources to remote or hybrid work. Even if remote work is approved by the State, certain resources may be required to be on-site full time and/or meet other on-site requirements. Any resource approved for remote work must report on-site upon request.

a. For resources working on-site, the DFA OCSE will provide the following: office space, furniture, phone (as needed), network connectivity, State issued laptop, and software.

b. For resources working remote, the DFA OCSE will provide the following: State issued laptop. The Contractor must provide Internet connectivity if remote work is permitted.

c. During the term of the Contract, at least one Contractor project manager must be on-site and manage the project from the Contractor perspective and serve as chief liaison for the State’s DFA OCSE IT Coordinator. This position is defined as one of the Contract’s Key Personnel. The project manager has authority to make the day-to-day project decisions from the Contractor perspective. This Contractor project manager must participate in meetings with Subject Matter Experts (SME) to review business processes and functions, along with the organization, functions, and data of existing information systems relevant to the Contract.

6. Offshore services shall not be provided for under the Contract. State data shall not be used or accessed internationally for troubleshooting, or any other use not specifically provided for herein without the prior written permission, which may be withheld in the State’s sole discretion, from the appropriate authorized representative of the State.

7. The State is closed in observance of the following holidays: New Year’s Day, Dr. Martin Luther King Jr.’s Birthday, President’s Day, Memorial Day, Independence Day, Labor Day, Veterans Day, Thanksgiving Day, Day after Thanksgiving (by Governor Proclamation), Christmas Eve, and Christmas Day.

B. Reports/Timecards/Invoices:

1. The Contractor shall provide the following monthly documents/deliverables on or before the last day of month following the services being reported:

a. The time-keeping process must be performed by the Contractor and submitted to the DFA OCSE IT Coordinator monthly.

b. A report showing the time worked by each resource outlining each resource’s time spent on any assigned task in fifteen (15) minute increments.

i. The report must be in an electronic format such as Microsoft Excel or a text file that can be imported into Microsoft Excel or Microsoft Word including timesheets (.pdf or tiff format.) for each resource.

ii. This report will be used in validation of the monthly invoices by the State and must, at a minimum, include the following:

a. Resource’s name.

b. Designated internal DFA OCSE tracking number by project/task.

c. Number of hours worked on that project/task.

c. Timesheets for all resources in fifteen (15) minute increments outlining the hours worked each day.

i. Timesheets do not need to indicate individual project/tasks.

ii. Timesheets will be used in validation of the monthly report of hours and monthly invoices by the State.

d. Invoices must list each resource’s monthly summary of hours. Errors and omissions must be handled as a separate invoice to be submitted in the next monthly invoice submission.

C. Transition Services:

1. Upon award of a contract, the Contractor shall work with DFA OCSE and any other organizations designated by DFA OCSE to ensure an orderly transition of services and responsibilities under the Contract and to ensure continuity of those required services.

2. Phase-In Transition: The Contractor shall work in an organized method with DFA OCSE’s incumbent contractor for the purpose of effecting a smooth and timely transition. The Contractor shall work with the incumbent to establish a joint transition management team capable of providing overall management and logistical support of all transition activities to be effectively and efficiently administered. At a minimum, the Transition Plan must provide for the following:

a. Activities related to transition (should the transition be required) must be conducted over a period not to exceed six (6) months.

b. A resource-loaded project management schedule including milestones and measurable commitments in the schedule that will be used to ensure a smooth transition from the incumbent to the successor.

c. A milestone chart detailing the timelines and stages of transition from the effective date of contract performance until the new Contractor assumes sole responsibility for the work.

d. An organizational chart that displays internal and external organizational relationships.

The organizational chart must identify the individuals (at all levels) who will be responsible for the transition and their respective roles; detail the lines of communication and how the successor will interface with the State and the incumbent during this phase-in of contract performance.

e. The Contractor shall regularly report status in periodic meetings and regular written reports.

f. A plan to…