SOO - FEMADex Agile Delivery.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

Federal Emergency Management Agency

1.1 STATEMENT OF OBJECTIVES (SOO) FOR:

FEMA Data Exchange (FEMADex)

Agile Delivery Services

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within Federal Emergency

Management Agency (FEMA) only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

DHS Statement of Objectives (SOO)

Learn more at fema.gov 2

Statement of Objectives (SOO) for

FEMADex Agile Delivery

Background

Enterprise Data and Analytics Modernization Initiative (EDAMI) Program

For years, FEMA has struggled with deficiencies in data analytics across the enterprise. Both simple reporting and complex analysis are limited in speed, quality, and accuracy. These limitations reduce the Agency’s ability to deliver the information, tools, and insight that its internal stakeholders and external partners need to help people before, during, and after disasters.

FEMA’s current data analytics capabilities rely, in part, on an existing system known as the Enterprise Data

Warehouse (EDW). Designed prior to Hurricane Katrina (2005), EDW interfaces with roughly 20 percent of the

Agency’s source systems to meet data warehousing and reporting requirements. However, EDW is severely limited in scope and functionality. The system employs inflexible and antiquated technology, provides slow and unreliable data, and is expensive to update. Moreover, it cannot easily adapt to evolving data needs, scale to meet changes in demand, or exchange data with external stakeholders. These shortcomings restrict FEMA’s ability to rapidly scale capabilities, incorporate and share data, develop integrated reports, generate useful insight, create predictive models, and use modern analytic tools to support decision-making.

These issues also generate unnecessary expenses. The EDW model of storing data onsite and procuring additional storage is inefficient, time-consuming, and costly. Expanding the system’s computational power and available memory is similarly difficult. Programs must pay prohibitive amounts of money for EDW enhancements, diverting resources from projects with more immediate concerns. Collectively, these problems have left the system unable to rapidly ingest, store, and analyze large amounts of new data, leading to delays during critical operations that cost the Agency time, money, and trust. Upgrades and the incorporation of new technologies have not addressed EDW’s limitations or reduced the costs of use which have discouraged FEMA programs from utilizing the system. In addition, a DHS Office of the Inspector General audit (OIG-19-58) found that analysts must often create complicated and time-consuming workarounds to access, assemble, clean, and use data from EDW and more than 100 other systems across the Agency.

To address FEMA’s data and analytics gaps, the Office of Policy and Program Analysis (OPPA) established the

Enterprise Data and Analytics Modernization Initiative (EDAMI) Program to create an enterprise analytics capability by making improvements in people, process, and technology. The EDAMI Program is a DHS Level 2 Information

Technology (IT) Acquisition Program and change management effort focused on user-centric, business-driven design using Agile methodologies. One of the most critical improvements is the replacement of EDW with a modernized, cloud-based data and analytics platform known as the FEMA Data Exchange or FEMADex.

Learn more at fema.gov 3

FEMADex Objectives and Pilot Phase

FEMADex is a cloud-based data and analytics platform designed to meet five core mission needs:

• Discover, access, and gather data from internal and external sources;

• Maintain data integrity, security, and confidentiality;

• Integrate cross-cutting and disparate datasets;

• Analyze data to identify meaningful insights; and

• Disseminate data and insights through reports and visualizations.

Close and ongoing collaboration with users is key to ensuring that FEMADex successfully delivers value to customers and supports the Agency mission. The FEMADex user community consists of staff at FEMA headquarters, across the

10 FEMA regions, and the FEMA disaster workforce; members of other federal agencies; state, local, tribal, and territorial (SLTT) partners; private sector organizations; and the public.

FEMADex will ingest structured, semi-structured, and unstructured data of analytic value to the Agency from FEMA and non-FEMA source systems into a central, secure environment. Once the data is in the system, users will be able to create their own workspaces where they can combine, manipulate, and analyze multiple datasets as their roles allow. Users can choose to share content within team workspaces to collaboratively develop analytic products such as reports, datasets, models, scripts, algorithms, dashboards, visualizations, and accompanying documentation.

Users can then disseminate finalized, approved products to a wider audience within an enterprise workspace.

Products approved for external release will be made available to FEMA’s external emergency management partners and the public as well.

The EDAMI Program uses Agile methodologies to deliver the FEMADex solution, emphasizing the incremental release of system software, features, and updates in many small deployments rather than in fewer, larger releases. This approach delivers critical functionality to users more quickly and gives development teams the flexibility to gauge effectiveness, correct issues, and incorporate lessons learned early and often. It also creates the opportunity to integrate new technologies as they emerge, extending the viable lifespan of the system.

The EDAMI Program is currently in the FEMADex Pilot Phase, in which FEMADex will be stood up in a Microsoft Azure

Commercial environment within the FEMA Enterprise Cloud, hardened to obtain Authorization to Proceed (ATP), connected to FEMA source systems, and used to ingest FEMA program data. The Pilot Phase will target the core capabilities required to support the mission needs described above, pursuant to an early learning milestone known as the FEMADex Minimum Viable Product (MVP). The five use cases identified for the FEMADex MVP milestone are:

1. Curate Data: Users will be able to identify the data they want to pull into FEMADex, arrange for its ingestion and storage, ensure that it is usable and up-to-date, and make it available to other users throughout FEMA.

2. Analyze Data: Users will be able to access multiple datasets in FEMADex, combine datasets to create new ones, conduct analysis, and develop new data analysis products such as dashboards, reports, and visualizations.

3. Share Analysis (With a Team): Users will be able to share draft data analysis products with other members of their team for further collaboration and refinement before publishing them to a wider audience within FEMA.

Learn more at fema.gov 4

4. Share Analysis (With FEMA): Users will be able to ask to share finalized products with other users across

FEMA. This request process includes review and adjudication to ensure that products meet FEMA data quality standards.

5. Consume Analysis: Users will be able to search the FEMADex data catalog and find data analysis products that can help them answer a particular business question or support a decision.

Initial tools identified for the FEMADex technology stack during the Pilot Phase include:

▪ Data Ingestion, Storage, and Processing: Databricks, Azure Data Lake Storage, StreamSets, Azure Data

Factory, Databricks Machine Learning (ML), Databricks SQL Warehouse, GitLab

▪ Data Governance, Management, Sharing, and Security: Databricks Unity Catalog, Immuta, Alation, Azure Key

Vault, Databricks Delta Sharing, Camunda

▪ Data Analysis and Reporting: Tableau, Power BI, Microsoft Excel, ArcGIS

A limited subset of users known as “First Adopters” will leverage the MVP system throughout the Pilot Phase to perform data analysis to answer key business questions in support of Agency operations. The Pilot Phase serves as an opportunity to test and evaluate core FEMADex capabilities – and supporting business processes, such as a federated data management model centered on domain-based data stewardship -- within an operational context to determine how effectively they meet FEMA’s mission needs before pursuing scaled Agile delivery during the

FEMADex Development Phase.

Purpose The purpose of this contract is to acquire professional Agile IT product design, development, and delivery services to support the FEMADex Development Phase, which will begin in 2024 and continue until FEMADex reaches Full

Operating Capability (FOC) in 2026. During the Development Phase, the EDAMI Product Management Branch will establish the vision, strategy, and roadmap for FEMADex to ensure the delivery of high-priority capabilities and value to system users. The Product Management Branch will consist of the FEMADex Chief Product Officer, Product

Owners, and Chief Product Team.

The EDAMI Product Delivery Branch, with which the services of this contract align, will be responsible for designing, developing, delivering, and maintaining the FEMADex system in accordance with the vision and roadmaps set by the

EDAMI Product Management Branch. The Product Delivery Branch will be supported by multiple Agile development teams leveraging Scaled Agile Framework (SAFe) methodologies to incrementally release high-priority capabilities and value to FEMADex users.

Agile IT delivery services will support the EDAMI Program in:

• Developing a comprehensive solution architecture, including business, system, data, information security, technology, and application architecture, for FEMADex.

• Incrementally delivering the FEMADex solution to end-users by leveraging effective scaled Agile frameworks and processes.

• Implementing the cloud-based services, containers, tools, network configurations, and zero-trust architecture required to support a secure and scalable system within a FEMA enterprise cloud environment.

Learn more at fema.gov 5

• Achieving and maintaining Authorization to Operate (ATO) for FEMADex, including ensuring compliance with all requirements associated with a FISMA High Impact system as well as the protection of sensitive personally identifiable information (SPII) and personally identifiable information (PII).

• Developing a custom user interface (UI) for FEMADex that is easy to navigate and compliant with all Federal requirements for web-based applications.

• Supporting transition activities associated with sunsetting the legacy EDW system and onboarding new source systems and user groups to FEMADex.

• Supporting the FEMADex data migration team in the establishment and automation of data pipelines to ingest unstructured, semi-structured, and structured data into FEMADex from a variety of FEMA and non-

FEMA sources.

• Supporting the implementation of FEMA Data Governance Council (DGC) guidance, policies, and standards for data management, quality assurance, and sharing through FEMADex.

• Evaluating, improving, and reporting on product performance to ensure FEMADex’s ability to effectively provide value to users and meet mission needs within an operational context.

• Managing ongoing administration and operations of all FEMADex infrastructure, databases, services, and assets, including database design, performance testing and scaling, database installation and configuration, and data security.

• Identifying, researching, and analyzing new cloud technologies and services for incorporation into FEMADex to meet mission needs and bring new data and analytics capabilities to the enterprise.

• Providing cybersecurity-focused systems engineering support throughout FEMADex design, development, and delivery, including cybersecurity risk assessment (e.g., threats, vulnerabilities, and impacts in the deployment environment) and cybersecurity testing and validation to ensure secure design in alignment with established security protocols, certification and accreditation processes, and contingency plans.

Scope or Mission The scope of this effort includes direct support for the EDAMI Program in providing Agile IT development services to ensure the incremental delivery of critical FEMADex functionality and business value to the system’s end-users.

The Contractor shall support the EDAMI Program in the design, development, testing, release, operation, and maintenance of FEMADex solutions to ensure their alignment with mission needs and user requirements. These services should be based on SAFe principles and best practices to support effective alignment, collaboration, and development effort across multiple Agile teams. They should also demonstrate effective implementation of cloud-based technologies for data extraction, transformation, loading, processing, streaming, modeling, analysis, security, and sharing within enterprise-level architecture, networking infrastructure, and policy frameworks.

The scope of Agile delivery services for this contract consists of three components:

• FEMADex Pilot Phase Evaluation and Development Phase Planning

• FEMADex Initial Operating Capability (IOC)

• FEMADex Full Operating Capability (FOC)

Learn more at fema.gov 6

Period of Performance The period of performance for this SOO shall consist of a one 12-month Base Period and two Option Periods.

Place of Performance The primary place of performance shall be a combination of work locations including FEMA Headquarters in

Washington, D.C., and Contractor facilities. Program meetings and other key briefings are anticipated to be performed primarily at FEMA Headquarters located at 400/500 C Street SW, Washington, D.C. 20472, or other

Government-specified locations.

Partial telework will be available to staff on this contract. Telework schedules must be coordinated with and approved by the Contracting Officer Representative (COR), Technical Monitor, and EDAMI Director (or leadership delegate) after contract award.

Performance of Objectives and Deliverables The objective of this SOO is to acquire Agile IT design, development, and deployment services for the FEMADex

Development Phase to incrementally deliver IOC and FOC system capabilities while maximizing value for FEMADex customers. The Contractor shall provide support to meet the requirements described below.

1. FEMADex Pilot Phase Evaluation and Development Phase Planning

The Contractor shall evaluate the outcomes of the FEMADex Pilot Phase and develop a comprehensive plan for launching the FEMADex Development Phase.

▪ The Contractor shall review all documentation from the FEMADex Pilot Phase and propose modifications to the program’s solution architecture design and delivery where necessary to better address identified mission needs, capability gaps, and user requirements. Areas for review and consideration include:

▪ The complete solution architecture proposed for FEMADex;

▪ The objectives, measures of success, and performance metrics from the FEMADex Pilot

Phase, Minimum Viable Product (MVP), and First Adopter Program;

▪ The developmental testing, operational assessment (OA), user acceptance testing (UAT), and user feedback results from the FEMADex Pilot Phase;

▪ The performance measurement, evaluation, and reporting methodologies demonstrated during the FEMADex Pilot Phase; and

▪ The SAFe, SecDevOps, and DataOps practices demonstrated during the FEMADex Pilot

Phase.

▪ The Contractor shall develop, maintain, and mature a comprehensive plan describing the goals, objectives, methodologies, milestones, and performance metrics for the FEMADex Development

Learn more at fema.gov 7

Phase. The plan should align with all relevant program Acquisition Lifecycle Framework (ALF) and

Systems Engineering Life Cycle (SELC) documentation.

2. FEMADex Initial Operating Capability (IOC)

The Contractor shall use scaled Agile delivery methodologies to deliver all FEMADex IOC capabilities in alignment with the threshold key performance parameters (KPPs), operational effectiveness requirements (OERs), and operational suitability requirements (OSRs) described in the approved FEMADex Operational Requirements

Document (ORD), as well as within the schedule threshold parameters described in the approved EDAMI

Acquisition Program Baseline (APB).1

a. Solution Architecture and Design

▪ The Contractor shall continuously guide, develop, maintain, and refine a comprehensive set of solution architecture documentation, process flows, and diagrams for FEMADex in alignment with DHS ALF and SELC guidance for Level 2 IT Acquisition Programs.

▪ The Contractor shall continuously guide, develop, maintain, and refine all additional supporting system documentation necessary to ensure the effective planning, execution, operations, and maintenance of FEMADex IOC system capabilities.

▪ The Contractor shall support all stakeholder and user engagement activities as necessary to build knowledge of the system, understand user requirements, evaluate system outcomes, and validate solutions.

▪ The Contractor shall research, analyze, and identify opportunities to leverage emerging technologies to successfully meet FEMADex requirements within program cost, schedule, performance, and quality parameters.

▪ The Contractor shall provide subject matter expertise and advisory services to the FEMADex

Product Delivery Branch Chief and Product Owners on the use of emerging cloud technologies, including data processing, data analytics, machine learning (ML), and generative artificial intelligence (AI) tools, to enhance FEMA’s ability to leverage Agency data to drive decision-making in steady-state and disaster operations.

b. Scaled Agile Development, Delivery, and Maintenance

▪ The Contractor shall support and participate in quarterly Program Increment Planning (PIP) to produce three- to six-month roadmaps for FEMADex delivery, taking into consideration:

▪ Business Priorities: Roadmaps should incorporate and reflect an understanding of which capabilities are most important to the Agency and FEMADex users.

1 Though subject to change, the EDAMI Preliminary Acquisition Program Baseline (P-APB) identifies the IOC schedule parameters as Q2 FY25 (objective) and Q4 FY25 (threshold).

Learn more at fema.gov 8

▪ Milestones: Roadmaps should identify clear milestones that can be used to gauge progress within each increment, support identification and monitoring of risk, and provide a clear path to achieving IOC.

▪ Enablers: Roadmaps should identify and incorporate the SAFe enablers needed to establish a solid architectural runway for prioritized business functionality.

▪ Dependencies: Roadmaps should account for dependencies in solutioning and development, such as processes associated with change request approvals, new tool procurements, and security prerequisites.

▪ Requirements Traceability: Roadmaps should provide full traceability of epics and features to the operational requirements, capability gaps, and mission needs described in FEMADex ALF and SELC documentation.

▪ The Contractor shall deliver all FEMADex IOC capabilities in alignment with approved increment roadmaps, release management processes, and Product Owner direction. This includes working closely with the FEMADex Product Owners and Product Delivery Manager to:

▪ Support the Product Management Branch in executing all Scrum of Scrum ceremonies to ensure alignment and effective task management across multiple Scrum teams, using

Agile project management tools such as Jira and Confluence to organize work.

▪ Plan and facilitate all Scrum ceremonies within each Scrum team, using Agile project management tools such as Jira and Confluence to organize work.

▪ Support the definition, scoping, prioritization, and assignment of features, epics, and user stories within the FEMADex backlog.

▪ Drive, track, and communicate progress toward sprint objectives and release requirements.

▪ Identify, monitor, and mitigate risks, blockers, and dependencies that could impact successful execution of increment roadmaps and delivery of value to FEMADex customers.

▪ The Contractor shall support and participate in quarterly Inspect and Adapt (I&A) sessions at the end of each increment to present, evaluate, and validate the FEMADex capabilities delivered in pursuit of IOC within each increment with the Chief Product Officer, Product Owners, user representatives, EDAMI Program leadership, and other key stakeholders.

▪ The Contractor shall manage the ongoing operations and maintenance of FEMADex, including software updates, bug fixes, patches, and enhancements; database configuration and administration; and monitoring usage and performance of network infrastructure, cloud services, and applications.

c. Quality Assurance and Customer Experience

▪ The Contractor shall develop and execute testing and evaluation (T&E) methods to continuously assess the performance of the FEMADex system, its components, and its data assets to ensure product quality and operational effectiveness.

Learn more at fema.gov 9

▪ Methods of evaluation should align with SAFe practices and incorporate automated testing into the FEMADex continuous integration/continuous delivery (CI/CD) pipeline where feasible.

▪ Methods of evaluation should align with the T&E frameworks, strategies, and methodologies identified in the FEMADex Test and Evaluation Master Plan (TEMP).

Examples of testing activities include unit, security, smoke, integration, functional, regression, accessibility, performance under load, degraded mode, recovery, continuity of operations, contingency plan, data access, data migration, and user acceptance testing.

▪ Methods of evaluation should support Agile Value Management (AVM) methodologies for determining progress in IT Agile delivery against program cost, schedule, and performance metrics.

▪ Methods of evaluation should support all goals, objectives, measures of success, and metrics identified by the EDAMI Program to gauge progress associated with specific phases, milestones, increments, and workstreams within FEMADex delivery roadmaps.

▪ The Contractor shall leverage the results of independent testing activities and OAs to identify and recommend improvements to system outcomes.

▪ The Contractor shall work with Product Owners and business analysts to gather and evaluate user requirements, user acceptance testing results, and other forms of user feedback to recommend, prioritize, and implement system enhancements to continuously improve the

FEMADex customer experience.

▪ The Contractor shall design and deliver FEMADex functionality in alignment with the approved

FEMADex Customer Experience (CX) Strategy; Executive Order (EO) 14058; the 21st Century

Integrated Digital Experience Act; U.S. Web Design System (USWDS) best practices; Section 508 accessibility requirements; and all other applicable Federal, DHS, and FEMA CX guidance to optimize the experience of FEMADex customers.

▪ The Contractor shall support the FEMADex Help Desk Team in evaluating, resolving, and closing help desk tickets in alignment with the process and timelines approved by the EDAMI Program.

▪ The Contractor shall support the FEMADex User Training Team in onboarding new users and provide training materials associated with leveraging the system within the FEMADex user interface.

▪ The Contractor shall support the EDAMI Program in developing an initial business model describing how FEMADex costs will be shared among the FEMA Office of the Chief Information

Office (OCIO), EDAMI Program, and FEMADex tenants.

d. Security and Compliance

▪ The Contractor shall deliver all FEMADex IOC system capabilities in alignment with all applicable

Federal cybersecurity and cloud-based regulations, including Federal Risk and Authorization

Management Program (FedRAMP), National Institute of Standards and Technology (NIST), and

Federal Information Security Modernization Act (FISMA) requirements associated with

FEMADex’s High-High-High categorization.

Learn more at fema.gov 10

▪ The Contractor shall implement and continuously mature SecDevOps practices within the Agile delivery pipeline, in alignment with DHS SecDevOps maturity models and guidance, to ensure the effective incorporation of security from the early stages of system design through the release of developed functionality.

▪ The Contractor shall identify, develop, implement, and maintain compliance with the security controls, documentation, and hardened security posture required to obtain and maintain

Authorization to Operate (ATO) for FEMADex.

▪ The Contractor shall propose and implement a continuous monitoring framework, leveraging scanning and testing tools, to proactively identify, analyze, mitigate, and remediate threats and vulnerabilities relevant to the FEMADex system and its software components, data assets, and users.

▪ The Contractor shall support the development of all security and technical requirements documentation required to establish new system interfaces with FEMADex.

e. Data Governance and Management

▪ The Contractor shall design, develop, and deliver the FEMADex IOC system in alignment with all applicable Federal, DHS, and FEMA data governance and management guidance, directives, and instructions to ensure alignment between Agency policy and technology. This effort includes alignment with the federated data management model and domain-based data stewardship practices on which the FEMADex solution architecture is based.

▪ The Contractor shall work closely with the FEMADex Data Migration Team and Product Owners to design and deploy the FEMADex IOC system in alignment with the approved FEMADex Data

Management Plan. This includes ensuring that FEMADex:

▪ Supports the successful ingestion of structured, semi-structured, and unstructured data from

FEMA and non-FEMA sources;

▪ Supports the transformation, wrangling, and cleansing of ingested data to prepare it for analytic use;

▪ Supports the accessibility and discoverability of ingested data by users with the appropriate permissions;

▪ Supports the security of data based on its designated sensitivity levels and access restrictions; and

▪ Supports effective data stewardship, management, and quality assurance of datasets and data products within FEMADex.

f. Software Deliverables

Upon EDAMI Program confirmation that the IOC capabilities described in the FEMADex ORD have been achieved, and at any time specified by the CO or COR, the Contractor shall provide the following to the

Federal government:

Learn more at fema.gov 11

▪ All Operable and Executable Source Code: The Contractor shall deliver the complete, compilable, and operable source code, and any relevant executable binaries, for the FEMADex IOC system in the DHS-approved language via source or version control (or an agreed-upon alternative).

▪ All Files and Directories: The Contractor shall deliver all files, images, folders, and directories necessary for all websites, applications, and software associated with the FEMADex IOC system to be fully functional and transferable to personnel with standard skillsets in computer programing to operate, maintain, update, modify, and perform all operations required to perpetuate the utility of the system. Delivery shall occur via source or version control (or an agreed-upon alternative).

▪ All Solution Architecture and Software Documentation: The Contractor shall deliver all diagrams, design files, wireframes, workflows, programmer notes, and other documentation of the

FEMADex IOC system and its architecture, hardware, software, workflows, operations, and significant design characteristics so that personnel with computer programming skillsets in the approved language is able to operate, maintain, update, modify, and perform all operations required to perpetuate the utility of the system. Documentation should include docstrings for functions and methods; in-code descriptions of classes, packages, and modules; and automatically generated documentation from the previous two items.

▪ All Test and Evaluation Documentation: The Contractor shall deliver all test plans, scripts, results, and analysis produced to evaluate the performance of the FEMADex IOC system.

▪ Description of All Third-Party Licenses Used: To the extent that the Contractor has included either

DHS-approved open-source content or software content subject to proprietary licenses in the

FEMADex IOC system, the Contractor shall provide each of those licenses and deliver a text file describing those licenses.

3. FEMADex Full Operating Capability (FOC)

The Contractor shall use scaled Agile delivery methodologies to deliver all FEMADex FOC capabilities in alignment with the threshold KPPs, OERs, and OSRs described in the approved FEMADex ORD, as well as within the schedule threshold parameters described in the approved EDAMI APB.2

a. Solution Architecture and Design

▪ The Contractor shall review the complete solution architecture proposed for FEMADex, evaluate the outcomes of the OA conducted of the FEMADex IOC system, and propose modifications to the solution architecture where necessary to better address identified mission needs, capability gaps, and user requirements.

2 Though subject to change, the EDAMI Preliminary Acquisition Program Baseline (P-APB) identifies the FOC schedule parameters as Q3 FY26 (objective) and Q1 FY27 (threshold).

Learn more at fema.gov 12

▪ The Contractor shall continuously guide, develop, maintain, and refine a comprehensive set of solution architecture documentation, process flows, and diagrams for FEMADex in alignment with DHS ALF and SELC guidance for Level 2 IT Acquisition Programs.

▪ The Contractor shall continuously guide, develop, maintain, and refine all additional supporting system documentation necessary to ensure the effective planning, execution, operations, and maintenance of FEMADex FOC system capabilities.

▪ The Contractor shall support all stakeholder and user engagement activities as necessary to build knowledge of the system, understand user requirements, evaluate system outcomes, and validate solutions.

▪ The Contractor shall research, analyze, and identify opportunities to leverage emerging technologies to successfully meet FEMADex requirements within program cost, schedule, performance, and quality parameters.

▪ The Contractor shall provide subject matter expertise and advisory services to the FEMADex

Product Delivery Branch Chief and Product Owners on the use of emerging cloud technologies, including data processing, data analytics, ML, and generative AI tools, to enhance FEMA’s ability to leverage Agency data to drive decision-making in steady-state and disaster operations.

b. Scaled Agile Development, Delivery, and Maintenance

▪ The Contractor shall support and participate in quarterly PIP to produce three- to six-month roadmaps for FEMADex delivery, taking into consideration:

▪ Business Priorities: Roadmaps should incorporate and reflect an understanding of which capabilities are most important to the Agency and FEMADex users.

▪ Milestones: Roadmaps should identify clear milestones that can be used to gauge progress within each increment, support identification and monitoring of risk, and provide a clear path to achieving FOC.

▪ Enablers: Roadmaps should identify and incorporate the SAFe enablers needed to establish a solid architectural runway for prioritized business functionality.

▪ Dependencies: Roadmaps should account for dependencies in solutioning and development, such as processes associated with change request approvals, new tool procurements, and security prerequisites.

▪ Requirements Traceability: Roadmaps should provide full traceability of epics and features to the operational requirements, capability gaps, and mission needs described in FEMADex ALF and SELC documentation.

▪ The Contractor shall deliver all FEMADex FOC capabilities in alignment with approved increment roadmaps, release management processes, and Product Owner direction. This includes working closely with the FEMADex Product Owners and Product Delivery Manager to:

▪ Support the Product Management Branch in executing all Scrum of Scrum ceremonies to ensure alignment and effective task management across multiple Scrum teams, using

Agile project management tools such as Jira and Confluence to organize work.

Learn more at fema.gov 13

▪ Plan and facilitate all Scrum ceremonies within each Scrum team, using Agile project management tools such as Jira and Confluence to organize work.

▪ Support the definition, scoping, prioritization, and assignment of features, epics, and user stories within the FEMADex backlog.

▪ Drive, track, and communicate progress toward sprint objectives and release requirements.

▪ Identify, monitor, and mitigate risks, blockers, and dependencies that could impact successful execution of increment roadmaps and delivery of value to FEMADex customers.

▪ The Contractor shall support and participate in quarterly I&A sessions at the end of each increment to present, evaluate, and validate the FEMADex capabilities delivered in pursuit of

FOC within each increment with the Chief Product Officer, Product Owners, user representatives, EDAMI Program leadership, and other key stakeholders.

▪ The Contractor shall manage the ongoing operations and maintenance of FEMADex, including software updates, bug fixes, patches, and enhancements; database configuration and administration; and monitoring usage and performance of network infrastructure, cloud services, and applications.

c. Quality Assurance and Customer Experience

▪ The Contractor shall continue to execute and mature T&E methods to continuously assess the performance of the FEMADex system, its components, and its data assets to ensure product quality and operational effectiveness.

▪ Methods of evaluation should align with SAFe practices and incorporate automated testing into the FEMADex CI/CD pipeline where feasible.

▪ Methods of evaluation should align with the T&E frameworks, strategies, and methodologies identified in the FEMADex TEMP. Examples of testing activities include unit, security, smoke, integration, functional, regression, accessibility, performance under load, degraded mode, recovery, continuity of operations, contingency plan, data access, data migration, and user acceptance testing.

▪ Methods of evaluation should support AVM methodologies for determining progress in IT

Agile delivery against program cost, schedule, and performance metrics.

▪ Methods of evaluation should support all goals, objectives, measures of success, and metrics identified by the EDAMI Program to gauge progress associated with specific phases, milestones, increments, and workstreams within FEMADex delivery roadmaps.

▪ The Contractor shall leverage the results of independent testing activities and OAs to identify and recommend improvements to system outcomes.

▪ The Contractor shall work with Product Owners and business analysts to gather and evaluate user requirements, user acceptance testing results, and other forms of user feedback to

Learn more at fema.gov 14 recommend, prioritize, and implement system enhancements to continuously improve the

FEMADex customer experience.

▪ The Contractor shall design and deliver FEMADex functionality in alignment with the approved

FEMADex CX Strategy; EO 14058; the 21st Century Integrated Digital Experience Act; USWDS best practices; and all other applicable Federal, DHS, and FEMA CX guidance to optimize the experience of FEMADex customers.

▪ The Contractor shall support the FEMADex Help Desk Team in evaluating, resolving, and closing help desk tickets in alignment with the process and timelines approved by the EDAMI Program.

The Contractor shall complete the build-out and refinement of a mature help desk portal within the FEMADex UI.

▪ The Contractor shall support the FEMADex User Training Team in onboarding new users and provide training materials associated with leveraging the system within the FEMADex user interface. The Contractor shall complete the build-out and refinement of a mature training portal within the FEMADex UI.

▪ The Contractor shall support the EDAMI Program in refining the business model describing how

FEMADex costs will be shared among FEMA OCIO, the EDAMI Program, and FEMADex tenants.

The Contractor shall complete the build-out and refinement of a mature cost management portal within the FEMADex UI.

d. Security and Compliance

▪ The Contractor shall deliver all FEMADex FOC system capabilities in alignment with all applicable

Federal cybersecurity and cloud-based regulations, including FedRAMP, NIST, and FISMA requirements associated with FEMADex’s High-High-High categorization.

▪ The Contractor shall implement and continuously mature SecDevOps practices within the Agile delivery pipeline, in alignment with DHS SecDevOps maturity models and guidance, to ensure the effective incorporation of security from the early stages of system design through the release of developed functionality.

▪ The Contractor shall identify, develop, implement, and maintain compliance with the security controls, documentation, and hardened security posture required to maintain ATO for FEMADex.

▪ The Contractor shall implement and continuously mature a continuous monitoring framework, leveraging scanning and testing tools, to proactively identify, analyze, mitigate, and remediate threats and vulnerabilities relevant to the FEMADex system and its software components, data assets, and users.

▪ The Contractor shall support the development of all security and technical requirements documentation required to establish new system interfaces with FEMADex.

e. Data Governance and Management

▪ The Contractor shall design, develop, and deliver the FEMADex FOC system in alignment with all applicable Federal, DHS, and FEMA data governance and management guidance, directives, and instructions to ensure alignment between Agency policy and technology. This effort includes

Learn more at fema.gov 15 alignment with the federated data management model and domain-based data stewardship practices on which the FEMADex solution architecture is based.

▪ The Contractor shall work closely with the FEMADex Data Migration Team and Product Owners to design and deploy the FEMADex FOC system in alignment with the approved FEMADex Data

Management Plan. This includes ensuring that FEMADex:

▪ Supports the successful ingestion of structured, semi-structured, and unstructured data from

FEMA and non-FEMA sources;

▪ Supports the transformation, wrangling, and cleansing of ingested data to prepare it for analytic use;

▪ Supports the accessibility and discoverability of ingested data by users with the appropriate permissions;

▪ Supports the security of data based on its designated sensitivity levels and access restrictions; and

▪ Supports effective data stewardship, management, and quality assurance of datasets and data products within FEMADex.

f. Software Deliverables

Upon EDAMI Program confirmation that the FOC capabilities described in the FEMADex ORD have been achieved, and at any time specified by the CO or COR, the Contractor shall provide the following to the

Federal government:

▪ All Operable and Executable Source Code: The Contractor shall deliver the complete, compilable, and operable source code, and any relevant executable binaries, for the FEMADex FOC system in the DHS-approved language via source or version control (or an agreed-upon alternative).

▪ All Files and Directories: The Contractor shall deliver all files, images, folders, and directories necessary for all websites, applications, and software associated with the FEMADex FOC system to be fully functional and transferable to personnel with standard skillsets in computer programing to operate, maintain, update, modify, and perform all operations required to perpetuate the utility of the system. Delivery shall occur via source or version control (or an agreed-upon alternative).

▪ All Solution Architecture and Software Documentation: The Contractor shall deliver all diagrams, design files, wireframes, workflows, programmer notes, and other documentation of the

FEMADex FOC system and its architecture, hardware, software, workflows, operations, and significant design characteristics so that personnel with computer programming skillsets in the approved language is able to operate, maintain, update, modify, and perform all operations required to perpetuate the utility of the system. Documentation should include docstrings for functions and methods; in-code descriptions of classes, packages, and modules; and automatically generated documentation from the previous two items.

▪ All Test and Evaluation Documentation: The Contractor shall deliver all test plans, scripts, results, and analysis produced to evaluate the performance of the FEMADex FOC system.

Learn more at fema.gov 16

▪ Description of All Third-Party Licenses Used: To the extent that the Contractor has included either

DHS-approved open-source content or software content subject to proprietary licenses in the

FEMADex FOC system, the Contractor shall provide each of those licenses and deliver a text file describing those licenses.

Operating Constraints

1. General Requirements

Within 10 business days of contract award for the Base Period and Option Periods of the contract, the

Contractor shall hold a kickoff meeting that includes:

• Introductions between the EDAMI Director, COR, Technical Monitor, and Federal leads and the

Contractor leads.

• A presentation from the Contractor on key contract management topics including the staffing plan, deliverable quality assurance and timeline management, and any additional information pertinent to successful delivery of the contract.

• Demonstrated understanding and confirmation from the Contractor of the work to be accomplished under the contract.

Within 10 business days of the kickoff meeting, the Contractor shall submit a formal Work Plan providing the expected submission timelines for draft and final deliverables; progress checks and major milestones toward completing the deliverables; and a reporting cadence to ensure successful cost, schedule, performance, and quality management for the delivery of this contract.

The COR and Technical Monitor will be responsible for technical administration of the contract and will ensure proper government surveillance of the Contractor’s performance. To minimize the performance management burden, the government will use simplified surveillance methods to evaluate contractor performance when appropriate. The primary methods of surveillance are:

• The COR, Technical Monitor, and/or EDAMI Director (or leadership delegate) will perform random monitoring of performance and deliverable progress.

• The COR, Technical Monitor, and/or EDAMI Director (or leadership delegate) will meet with the

Contractor as needed to discuss the status, completion, and quality of deliverables and projects.

• The Contractor will deliver work products to the COR, Technical Monitor, and EDAMI Director (or leadership delegate) by the agreed-upon due dates. The EDAMI Program will review and comment on the work products within 10 business days of delivery or an alternate agreed-upon timeline. The Contractor will incorporate the comments or provide feedback to the EDAMI Program within three business days or an alternate agreed-upon timeline.

• The Contractor will deliver Monthly Status Reports (MSRs) describing progress toward meeting the deliverables and project requirements of the contract within 10 business days after the end of each month within the period of performance.

Learn more at fema.gov 17

With the consent of the COR, status reporting on contract execution may be combined with progress meetings.

The Contractor will promptly notify the COR, Technical Monitor, and EDAMI Director (or leadership delegate) when an issue that may violate a law or regulation is detected during work performed under this contract.

The Contractor shall agree to the non-disclosure of acquisition information and be restricted by law and regulation from participation in contracts involving acquisition of the identified options.

1.1 TRANSITION OUT

At the completion of this contract, whether through the end of the period of performance or termination, the Contractor shall fully support the transition of the Contractor’s work to the EDAMI Federal staff or to a successor Contractor entity. The Contractor shall assist with the transition-out requirements and timelines outlined by the COR, in coordination with the EDAMI Director (or leadership delegate), for this contract. Formal notifications regarding the completion of this contract and how work will be turned over will be provided in writing by the Contracting Officer (CO) and/or COR.

2. Roles and Responsibilities

FEMA oversight and management of this contract will be provided primarily by the COR, Technical Monitor, and

EDAMI Director (or leadership delegate). These responsibilities will align with the DHS COR Guidebook. The CO is the only person authorized to approve changes to any of the requirements under this contract.

The Contractor shall designate a Project Lead to support the management and oversight of Contractor performance, staff, and deliverables for this contract.

The Contractor Project Lead must have experience in scaled Agile IT product management, delivery, evaluation methods, quality assurance, and business processes and tools in the U.S. Government. The Contractor Project

Lead must also have experience producing deliverables in alternate formats including Microsoft Word, Microsoft

PowerPoint, Microsoft Excel, SharePoint, Jira, and Confluence.

1.2 QUALIFIED PERSONNEL

The Contractor shall provide qualified personnel to perform all requirements specified in this contract.

The designated Project Lead must have at least five years of experience with SAFe Agile IT product management and delivery. All Contractor staff must have at least two years of experience with Agile IT product delivery; experience with SAFe methodologies and best practices is preferred.

The designated Scrum Masters must have at least two years of experience in facilitating Scrum ceremonies in alignment with SAFe methodologies and best practices. The Scrum Masters must also have advanced experience in common Agile requirements and task management tools such as Jira and

Confluence.

1.3 CONTINUITY OF SUPPORT

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for

Learn more at fema.gov 18 all hours of the workday. If for any reason Contractor staffing levels are not maintained due to vacation, planned leave, appointments, or other requirements, and replacement personnel will not be provided, the Contractor shall provide written notification to the COR, Technical Monitor, and EDAMI Director (or leadership delegate) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement for the employee.

1.4 KEY PERSONNEL

All Contractor staff on this contract are designated as Key Personnel. The Contractor shall submit a resume (maximum of two pages) describing the qualifications and experience of each staff member supporting this contract to the COR, Technical Monitor, and EDAMI Director (or leadership delegate). The

CO and/or COR will provide written approval or disapproval for all proposed Contractor personnel.

Before removing, replacing, or diverting any personnel, the Contractor shall:

1. Notify the CO and COR with reasonably advanced notice, and

2. Submit justification and proposed substitutions in sufficient detail to permit evaluation of staffing change impacts to contract delivery.

The Contractor shall not divert any personnel without written consent from the CO and/or COR.

3. Quality Assurance and Quality Control

All deliverables shall be provided to the COR, Technical Monitor, and EDAMI Director (or leadership delegate).

Inspection and acceptance of all work performance, reports, and other deliverables under this contract will be performed by the COR, Technical Monitor, and EDAMI Director (or leadership delegate). The COR will coordinate deliverable reviews with additional stakeholders as necessary. Deliverables shall include minimal content errors and shall be polished to ensure proper scope, clarity, cleanliness, professionalism, and formatting in alignment with the standards described in the EDAMI Quality Assurance Standard Operating Procedure (SOP). The

Contractor shall conduct kickoff meetings with EDAMI Federal staff prior to beginning work to ensure deliverable alignment with the program’s strategic direction and priorities.

At the conclusion of each task, the Contractor shall provide FEMA all pertinent source documents, materials, code, or other data obtained by the Contractor on behalf of the Agency to support performance of this contract.

The Contractor shall provide source materials in such a way as to ensure that U.S. Government employees and other Contractors can access and edit the content using software readily available to FEMA personnel.

The U.S. Government shall evaluate the Contractor’s performance under this contract in accordance with the

Quality Assurance Surveillance Plan (QASP). The QASP is primarily focused on what the U.S. Government must do to ensure that the Contractor has delivered service in accordance with the identified performance standards.

It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rates.

Learn more at fema.gov 19

4. Security

All personnel require access to information up to the Sensitive But Unclassified (SBU) For Official Use Only

(FOUO) level. The Contractor must ensure that Contractor employees receive a favorably adjudicated Public Trust suitability prior to entry on duty (EOD). All individuals must be U.S. citizens. The Contractor shall follow the standards established within DHS and FEMA policy.

4.1 UNAUTHORIZED DISCLOSURE OF CLASSIFIED OR UNCLASSIFIED INFORMATION:

Contractors and Sub-Contractors working on this contract shall receive Unauthorized Disclosure of

Classified or Unclassified Information…