SSN26-7571-CDC96901 - SOO.pdf

1. Purpose

The purpose of the SOO is to obtain contractor support with the knowledge, skills and abilities for supporting the Centers for Disease Control and Prevention (CDC), Office of Science (OS), Knowledge Management (KM) and with the implementation of the KNOWLEDGE MANAGEMENT TECHNICAL SUPPORT SERVICES (KMTSS).

2. Scope

This SOO addresses work associated with the following KMTSS activities:

1. Provide IT product design, development, enhancement, and operations and maintenance support that includes a DevSecOps approach to the following: help desk, quality assurance, data cataloging, agile software development, systems and software deployment, systems operations, information management, and enterprise data capabilities.

2. Seeks multi-functional, full stack agile software development teams qualified to provide the required IT Capabilities to Knowledge Management across the portfolio of activities identified in the Statement of Objectives (SOO).

3. Provide expert support for open science initiatives at CDC including scientific data, publication, and code release.

4. The SOO tasks are outlined and detail the IT products and services needed. All IT products and services delivered must be consistent with the CDC EPLC guidelines.

5. Knowledge Management will identify product owners to interface with industry requirements management teams and support the agile development process for each IT product and service.

3. Period and Place of Performance

PERIOD OF PERFORMANCE:

BASE PERIOD: September 30, 2026 – September 29, 2027 (12 Months) OPTION PERIOD ONE: September 30 , 2027 – September 29, 2028 (12 Months) OPTION PERIOD TWO: September 30 , 2028 – September 29, 2029 (12 Months) OPTION PERIOD THREE: September 30 , 2029 – September 29, 2030 (12 Months) OPTION PERIOD FOUR: September 30 , 2030 – September 29, 2031 (12 Months)

PLACES OF PERFORMANCE:

Teleworking is both permitted and preferred.

When on site work is required work is to be performed in a normal office environment.

Hours of operation 8:00am to 5:00pm with extended hours for KM Help Desk. When on site work is required, the majority of the work will be accomplished in Atlanta, GA in the government facilities listed below.

Atlanta Locations:

Roybal Campus 1600 Clifton Road Atlanta GA 30333 Chamblee Campus 4770 Buford Highway Chamblee, GA 30341 Century Center Campus Century Blvd. Atlanta, GA 30345 Corporate Square Campus Corporate Square Campus 30341 District at Chamblee Brandywine Road Atlanta, GA 30341

4. Background

4.1 OVERVIEW OF KEY OFFICE OF SCIENCE / KNOWLEDGE MANAGEMENT SERVICES

The Centers for Disease Control and Prevention (CDC), Office of Science (OS), Knowledge Management (KM) designs, develops, deploys, supports, and enhances a portfolio of public and internally facing enterprise business information systems for CDC and its partners. Over the past several years, Knowledge Management has expanded its portfolio to provide IT solutions and services to CDC’s Centers Institutes and Offices (C/I/Os) as well as the United States Department of Transportation (USDOT), the National Oceanographic and Atmospheric Administration (NOAA), the Federal Deposit Insurance Corporation (FDIC), and the Minority Business Development Agency (MBDA). The applications in this portfolio must continuously respond to changing user needs and evolve in a technically sound and efficient manner. It is also vital that the KM system have the ability to harvest as well as share data with a number of CDC systems. The core applications to Knowledge Management are eClearance, Publishing Reporting, CDC Stacks, and the Data Scanning Tool.

4.2 ROLE OF CONTRACTORS IN EXECUTING KEY KM SERVICES

The Knowledge Management team was established to provide help desk, quality assurance, application development, data management, operations support and related services across this portfolio of applications for the purpose of providing high quality, reliable, and available software featuring advanced functionality. The products and services developed, managed, and maintained by Knowledge Management are used across CDC and directly support numerous important CDC centers and groups in achieving the Agency’s public health objectives. As public health missions and needs evolve, Knowledge Management must continually monitor and update its software and information management capabilities to meet those needs.

Knowledge Management operations are supported, in part, by Contractor personnel tasked with a full range of support functions across the application development lifecycle and consistent with CDC’s implementation of the HHS/CDC Enterprise Performance Lifecycle (EPLC). KM utilizes an Agile framework to continuously evaluate and improve the efficiency and effectiveness of its applications and seeks a Contractor who will bring experience-based perspective to the blending of the multiple technologies needed for delivery of the portfolio of KM applications.

4.3 MODERNIZATION EFFORTS

The Knowledge Management modernization roadmap is not a standalone effort. It aligns with, supports, and interfaces with other enterprise modernization efforts including:

• CDC AI Strategy – Knowledge Management is leading the way for CDC’s use of Artificial Intelligence in both the development of the systems as well as improving the support KM provides authors, scientists, and other CDC staff

• CDC Public Health Data Modernization Initiative - the purpose of which is to improve data collection and analysis using innovative and interoperable data collection and analysis technologies. The Knowledge Management group is a leading element in the CDC’s implementation of new Data Use Agreements

(DUA)

• CDC Gold Standard Science Strategy – Knowledge Management supports the administration’s goal of gold standard science at CDC. With the core tennet of scientific transparency, KM provides assistance with the release of scientific data and code associated with CDC publications.

• System Connections – Interoperability is a core tenant of the KM systems. This requires KM systems to both send and receive data from a number of CDC as well as external systems.

5. Knowledge Management KMTSS Objectives:

• Provide application planning, design, development, testing, deployment, operations, maintenance, help desk and enhancement services in a manner consistent with the HHS/CDC EPLC and utilizing application development best practices such as Agile development;

• Provide these responsive, efficient, and cost-effective IT application support services in compliance with appropriate technical and security requirements and considerations;

• Evaluate, analyze, design, configure, maintain, develop, implement, support, and document business and information requirements and needs to support automation of software and information management capabilities;

• Support CDC staff, including programmers, statisticians, analysts, center administrators, executives, public affairs officers, and information specialists in using Knowledge Management applications and services;

• Advise Knowledge Management in all areas of application development, operations, and maintenance including technology and application trends and directions, upgrades and enhancements;

• Evaluate, recommend and implement new advances in business and scientific applications, data management, application delivery, tools and technology.

6. Task Order Objectives, Contract Administration and Functional Support Areas

6.1 TECHNICAL OBJECTIVES

6.1.1 AI usage. The contractor shall ensure the proper use of AI tools in all aspects of system development and support based on HHS and CDC guidelines.

6.1.2 Replacement of Documentum/OpenText. The contractor will continue to support the migration away from the Documentum/OpenText backend system to a more data driven platform.

6.1.3 Systems Support. The contractor shall support all of the Knowledge Management software and systems infrastructure. This includes all aspects of the system development lifecycle including the updates necessary to support CDC’s Cloud Strategy. The contractor will be required to have detailed knowledge of the software stack, both onsite and AWS systems environments, and operational duties necessary to run Knowledge Management systems without significantly increasing Capability cost, hindering Capability performance (no degradation in performance) or lengthening schedule (no more than 2- week delay)..

6.2 CONTRACT ADMINISTRATION AND MANAGEMENT.

The contractor shall provide administrative and management support as outlined below. This support is considered integral to the management and execution of the contract.

a. Contract Management and Administration. The contractor shall identify a single point of contact for all official communication regarding performance and communicate this POC’s information to the government PM, COR and contracting officer. The contractor shall respond to Government requests in a timely fashion, generally the same day of the request, with either the requested information OR the date the information can be reasonably provided. The contractor shall make travel arrangements for its employees if travel is required by the government.

b. Contract Administration Related Meetings. The contractor shall schedule and hold meetings with the

COR to discuss contract related items, such as deliverables, performance, quality, and progress. These meetings will typically occur monthly or on an as needed basis per recommendation by the COR. The contractor shall provide the COR meeting materials including, but not limited to, an agenda, at least two days before the date and time of the meeting. This responsibility may be delegated by the COR to a technical monitor or other appropriate staff member.

c. Status Reports. Submit a Monthly Status Report no later than the fifth business day of the succeeding month that provides a narrative regarding, as applicable to core and/or exercised optional requirements, testing planned and executed, test results, automated test code coverage, test-related metrics, progress on key projects, metrics, bugs/fixes status, AIR application downtime, status of pending documents and/or deliverables, progress on sprints, next major milestones, status of significant contract management issues such as personnel vacancies, significant risks or concerns, and government support required to enhance performance. Additional technical updates or reports may be required.

d. Orientation Briefings. Within one week of award, the contractor will request to schedule an initial orientation briefing with the government. The orientation briefing will be held at a location and date and time mutually agreed upon by both parties, or remotely. At the briefing, the contractor will outline the approach and schedule for the requirement as well as address the control and management mechanisms they will use to oversee their work. The contractor will also identify key and supporting personnel and sub-contractors’ firms that will be used to accomplish the tasks. As applicable, the briefing should also address contractor transition items such as recruiting, retention of incumbent personnel, roles and responsibilities of key personnel on the contractor’s staff, task order communication management (means, methods, frequencies, and responsibilities), security, badging, onboarding, etc., including a milestone chart.

e. Meetings and Coordination. Participate in internal and external meetings, stand-ups, conference calls, and engagements as required for performance. Participation is active, engaged, and value-added.

Contractor personnel with the appropriate skills and experience are identified to participate. As required, schedule, coordinate, prepare for, assist with, and support meetings. Prepare agendas, disseminate preparatory materials, and prepare meeting summaries and/or minutes along with tracking assignments / action items, their status and completion. Apply subject matter expertise to determine relevant topics, agendas, and determine functional and technical content.

f. Briefings. Prepare, develop, design, update, revise, and maintain briefings as required for performance. Be prepared to brief senior leaders and senior executives on within-scope topics as needed.

g. Contract Kick-Off. Within 10 business days of award, the contractor shall meet with relevant OAS and

KM personnel to review and clarify the scope of work and delivery schedule for this contract and address contractual matters (e.g., invoice procedures). In consultation with KM, the contractor shall develop, prepare and distribute an agenda 2 days prior to the Kick-Off Meeting.

a. Discussion topics may include, but are not limited to the following:

b. Review of program purpose, goal, functional areas, and expected products;

c. A discussion of the program management approach;

d. An overview of existing program issues, include transition from the incumbent contractor to the new contractor;

e. Development of the performance plan to guide the overall direction of the program, including identification of both program and project risk and proposing risk mitigation strategies;

f. A discussion of the format and timetable for deliverables;

g. A review of the program governance strategies including requirements tracking, project scope, cost, schedule, and performance management; and

h. Any other questions or issues identified by the Contractor.

6.2.1 Transition Out. The Contractor shall plan and implement a transition from the incumbent to the incoming contractor/government personnel at the expiration of the contract. This includes coordination with Government staff and/or successor contractor staff. Provide a Transition Plan no later than 180 days prior to expiration of the contract for government inspection/acceptance. The Plan must identify at a minimum how the contractor will transfer the following:

1. Points of contact established with KM customers

2. Location of documentation, archives, artifacts, procedures, models, etc.

3. Transfer of source data or code for current and developing Capabilities

4. Transfer of files, in a coherent and organized manner, from corporate servers and individual accounts related to completed Capabilities

5. Status of ongoing work

6. Appropriate contractor to contractor coordination to ensure a seamless transition

7. Transition of personnel, if applicable

8. Transition schedule and milestones

9. Identify actions required of the Government

10. Inventory of software licenses, warranties, maintenance agreements, customer accounts associated with KM software, product keys, and installation discs and packaging.

At the end of the task order term, the electronic copies of all materials acquired, developed and operated as part of the contract, shall be delivered to the COR. The contractor, at the direction of the COR shall develop a transition plan that includes a process and schedule for the transition of materials acquired, developed, and operated during the period of performance of the contract, to be reviewed and approved by the COR not less than six 6) months before the end of the period of performance for the contract. The contractor shall provide necessary information and consultation to the new contractor on the design, management, and operation of such materials, upon delivery. The transition will be complete when the COR approves, in coordination with KM that all materials acquired, developed, and managed during the period of performance have been transferred to KM in readable and executable form.

6.3. FUNCTIONAL SUPPORT AREAS

6.3.1 Project Management. KM has developed a robust project management process to track project progress and manage project financials. The contractor team will be responsible for managing various types of KM projects (e.g., eClearance, STARS, CDC Stacks. SWAT, Publishing Reporting etc.). To support KMs project management requirements, the contractor will be responsible for developing project management artifacts in the JIRA system for each project, to appropriately tailor HHS/CDC EPLC framework rigor to the project requirements. In addition, the contractor will develop plans for each of these aspects of project management, while managing the balance across them as changes occur throughout the project lifecycle.

The contractor will also be responsible for developing detailed project schedules in KM’s project management system of record JIRA including all required project tasks, assignment of resources to all project activities, and tracking actual work performed on each task within the tool. The contractor must provide actual hourly rates of every team member for the purposes of estimating project costs, tracking actuals, and automating the reporting of cost variances within the project management tool.

In addition, the contractor will be responsible for producing all Project Management documentation in accordance with HHS/CDC EPLC and KM guidance as well as monitoring and reporting on project status and milestones in regular project status reviews/reports. The contractor will be responsible for escalating high-impact risks to the KM COR to facilitate mitigation.

Principal Tasks to be performed by the contractor shall include:

a. Performing project initiation

b. Performing project planning

c. Gaining approval of Business Need Statement within 10 days of project activation

d. Develop Project Management Plan

e. Develop and manage project scope,

f. Performing design and development;

g. Executing testing;

h. Executing implementation;

i. Manage and maintain project-specific SharePoint sites and associated content;

j. Managing project risks and issues;

k. Reporting project status and metrics;

l. Ensuring successful project delivery;

m. Performing project change management via Project Change Requests;

n. Ensuring Sprint Ceremonies are held

i. Conduct Sprint Planning meetings before the start of each sprint, gaining Product Owner approval Conduct Sprint Reviews at the end of each sprint, gaining Product Owner approval

ii. Conduct Sprint Retrospective at the end of each sprint with project team

iii. Conduct Project Retrospective at the end of each project

o. Conducting project kick-offs within 10 days of project activation for development, modernization and enhancement projects

p. Providing Stage Gate deliverables at least 15 days prior to the Stage Gate

q. Conducting project schedule baselines within 5 days of project activation or within 5 days of gaining Baseline Stage Gate approval

r. Developing Closeout Reports and the end of each project

6.3.2 Knowledge Management Systems

KM has three primary enterprise systems:

1. Document Operations and Clearance System (DOCS) is a system built on top of Documentum and encompasses four functional applications or workflows.

a. eClearance – This provides the workflow and approval process necessary to support the clearing of publications prior to publication or distribution. This can include journal articles, pamphlets, posters, videos, and/or audio clips

b. Data Use Agreements - This supports the workflow and approvals for agreements that include the CDC as a whole with external parties. The objective of these agreements is to allow individual data scientists to have access to data from, or share data with, an external source without having to create an individual agreement.

c. STARS – This supports the workflows for Data Management Plans, Paperwork Reduction Act filings, and Human Subjects clearance.

d. Publishing Reporting – This system provides reporting related to publication statistics and workflow status for center administrators and divisional management officials.

e. Tipster – Built on JIRA, this system provides helpdesk ticketing and development feature tracking for KM projects. It also serves as the main tool for tracking the Agile sprints.

2. CDC Public Access Platform (CPAP)- An AWS deployed application environment that is replicated for other Federal Agencies. CDC, FDIC, NOAA, and USDOT are currently supported;

however, support for additional Federal Agencies may be added during the period of performance.

a. Stacks – This is the front-end, anonymous access, public website that supports the distribution of publications. It includes cataloging data, meta-data and the digital retrieval of such through the OAI-PMH open standard. All distributed documents are full-text searchable and include historical versions (if historically updated and the historical version is still available).

b. SWAT - The Stacks Workflow Administration Tool is the back-end administration interface for CPAP. The system is PIV only authentication and requires integration with CDC, FDIC, NOAA and USDOT PIV issuance certificate authorities. SWAT is used by the data catalogers to create/manage catalogs, upload documents and manage the supporting metadata for the documents.

3. CDC Vault – An non-public version of CPAP that requires all users to be PIV Authenticated.

This supports MODERATE rated catalogs of data for internal, non-public use. This also includes a section for data being preserved as federal records and the automated migration of those records to the National Archives and Records Administration (NARA) based on the record retention schedule for each specific document.

4. Data Scanner – The data scanner is a tool that allows any staff member at CDC to scan a document for PII or other sensitive information before being released to the public. This system is built using Ground Labs as the backend engine with a custom front end for an easier user interface.

Knowledge Management supports an Agile sprint schedule for developing, quality testing, and security testing functional updates on a ad-hoc basis, focusing on ensuring high quality and timely releases to agency staff.

The backlog of enhancements for each platform will be prioritized and decisioned on a per sprint basis via status meetings with critical stakeholders and users.

To support the continued growth of KM’s systems, the contractor will be responsible for partnering with KM to review prioritized platform enhancements and determining implementation timelines. KM and the contractor will review each platform’s short, and long-term release plans during sprint review meetings, to review progress against development budgets, technical risks, changes in priorities, and technical roadblocks.

The contractor will also be responsible for providing technical solution architects to partner with KM’s technical staff to define the strategic business and technical roadmaps for each platform.

Principal Tasks to be performed by the contractor shall include:

a. Providing dedicated full stack DevSecOps teams that can manage the full lifecycle of the systems, from development, testing, security, deployments, and infrastructure.

b. Ensuring that development work aligns KM’s goals for systems consolidation and modernization, as defined by our modernization roadmaps.

c. Ensuring that each platform releases high-quality, function releases.

d. Ensuring that each release conforms to integrate latest federal requirements (508, security, etc.)

6.3.3 User Experience and User Design. KM envisions User Experience and User Design to encompass both usability and accessibility. This includes meeting WCAG 2.0/2.1 AA success criteria and complying with Section 508 of the Rehabilitation Act for ACL services, systems and websites, and other digital content.

The contractor shall ensure that service and system development, enhancement, and operations work includes user experience and user design participation and review. UX and UD deliverables may include design options represented as wireframes; design standards for systems and websites; design standards for UX support on mobile device platforms; and other documents that both the customers and development team can use to review, approve, and incorporate into systems and websites. The contractor shall work with KM staff to ensure all new and enhanced systems, services, and websites are tested for and meet WCAG 2.0/2.1 AA success criteria and have been assessed and evaluated by users interacting with the system with assistive technology such as screen readers or voice interaction tools.

The contractor may review and report on other work products or materials that include but are not limited to documents, presentations, webinars, and audio and video content for distribution, applications, and systems, with meeting WCAG 2.0/2.1 AA success criteria and complying with Section 508. The contractor shall also work with KM staff to ensure automated accessibility testing of systems, services, and websites. Finally, the contractor shall utilize usability testing and analysis on systems that have been in production to identify potential enhancements that inform future releases.

a. Performing User Interface design for desktops and mobile platforms;

b. Promoting and enabling Section 508 compliance;

c. Participating in User Interface design reviews;

d. Developing automated 508 and quality testing;

e. Performing usability testing; and

f. Participating in project planning activities.

6.3.4 Application Design/Development. KM has three major system designed, developed on multiple technology platforms. The primary development platforms and technologies include:

• IIS

• Apache Web Server

• Apache Tomcat

• Java

• PHP

• Python

• MySQL

• Microsoft Server (2012, 2016, 2019)

• Microsoft SQL (2016, 2019)

• Red-Gate

• MS Visual Studio

• Eclipse

• Documentum

• Opentext

• SOLR

• Drupal

• Islandora

• Jenkins

• GIT

• SVN

• MediaWiki

• Chef Automate

• PRTG

• Splunk

• Groovy

• Katalon

• Apache JMeter

• Microsoft Power Shell

• ERStudio

• Visio

• Kubernetes

• Docker

When developing or performing major enhancements to KM applications, the contractor will ensure that all systems conforms to all current or future CDC and KM technical standards and guidelines.

The contractor will also be responsible for working with KM customers to document requirements, business rules, and process workflows. The contractor will also be responsible for defining user stories based upon customer requirements, which can be converted into technical or system requirements.

The contractor technical team will also be responsible for working with KM business, technical and security stewards to ensure that the technical designs meets KM and CDC technical standards, and that any additional software packages or technologies are approved for use by KM and the CDC.

As part of the development and enhancement of KM systems, the contractor will be responsible for meeting the automated testing code coverage requirements defined by KM for each system. KM will provide the contractor guidance on automated testing code coverage goals on a system-by-system basis.

KM has implemented automated code quality checks into system releases using SonarQube. The contractor will be responsible for meeting the code quality score set by KM for each system and ensuring that the code quality score improve with each release.

KM has also invested in automated security scanning tools that evaluate each system for security vulnerabilities during each release. The contractor will be responsible for ensuring that all identified security vulnerabilities are mitigated prior to any production releases of a system. The contractor will also ensure that all systems updates comply with federal 508 standards for accessibility.

a. Coordinating, contributing to, managing, and maintaining required application documentation, including but not limited to:

1) Business rules

2) Access Control rules and framework

3) User stories with Acceptance Criteria

4) User Interface Wireframe/Mockup

5) Activity Diagrams/Analysis Assets

6) Process Flow Diagrams

7) Non-functional requirements

8) Technical design documents

9) User Guides, as needed

10) Configuration Management Plan, as needed

11) Operations and Maintenance Plan

12) Disposition Plan

b. Working with Business, Technical, and Security Stewards to ensure application is developed in accordance with CDC and KM architectural principles

c. Developing automated unit and integration tests that meet KM’s code coverage goals per system

d. Developing applications that adhere to 508/WCAG guidelines for compliance

e. Developing applications that meet CDC mandated security requirements

f. Developing applications that meet code quality standards defined by KM

g. Identifying / correcting application performance bottlenecks and optimizing data access

h. Developing Records Management processes and mechanisms to manage records retention as mandated by Records Management Policies

6.3.4.1 Application Quality Control.

The contractor will also be responsible for regular regression testing of applications to ensure that changes to the code, environment or hardware have not impacted the associated applications. The contractor is required to include regression testing with each code update. The contractor shall be responsible for the development and execution of fully automated regression tests, using Groovy defined tests with Katalon, manual testing and performance tests using Apache JMeter.

To support KM’s production support activities, the contractor will be responsible for monitoring application defects or enhancement requests reporting by customers through the Knowledge Management helpdesk or other channels. The contractor will be responsible for reviewing system change requests with KM management for prioritization and partnering with KM to determine implementation timelines.

a. Performing systems quality analysis and troubleshooting for application defects and performance issues

b. Performing application releases

c. Performing regression testing;

d. Performing performance testing of the core KM systems

6.3.4.2 Application Release Management.

For systems development, the KM is modernizing its system release processes to take advantage of Dev DevSecOps release automation best practices.

The contractor will be responsible for the creation and maintenance of automated systems deployment workflows through the KM’s release management tools Jenkins and Terraform. The contactor will also be responsible for the automation of all required release approvals, as defined by KM or OCISO change management processes. The contractor will be responsible for the integration and automation of system security and testing technologies as part of the release pipeline.

When scoping and prioritizing application releases, the government will provide guidance. Although maintenance releases do not necessarily need to follow the Stage Gate Review process of formal projects, the Contractor shall keep all application documentation up to date to reflect the changes in the maintenance release.

a. Preparing production and maintenance releases for approval

b. Planning release windows

c. Measuring and monitoring maintenance release progress

d. Developing and executing deployment plans and implementation plans

e. Coordinating go-live activities

f. Developing release reports

g. Participate in post-implementation reviews

6.3.5 Knowledge Management Helpdesk and Training KM’s informatics workstream focuses on providing workflow support to CDC scientists, authors, and administrators by through the use and operation of Knowledge Management tools and services

In order to support the KM’s helpdesk activities, the contractor will be responsible for providing staff who are subject matter experts in Knowledge Management systems and are capable of interacting with both customers and directly addressing the problems with KM infrastructure (such as Microsoft SQL).

In addition, the contractor will be responsible for creating the training material and offering regularly scheduled, instructor lead, training classes for users of KM systems. The training will cover the proper use and expectations for DOCS and it’s subsystems for internal users and SWAT for both internal users and users from partnered federal agencies.

a. Providing helpdesk based Subject matter/ domain expertise of Knowledge Management systems. .

b. Facilitating Stakeholder and external partner training coursework and instructor lead classes

6.3.6 KM Operations. KM has a predominantly CDC cloud infrastructure hosted environment. The contractor will need to coordinate and often lead work done by the Applications Hosting Brach and Network Technology Branch for all KM infrastructure such as the containerized environment and the server-based systems. For the containers, the contractor will need to support the creation, maintenance, security and monitoring of the terraform deployment and the associated container images. The contractor will ensure that the environment conforms to all security policies and standards. In addition, the contractor will provide support for the creation, maintenance, and monitoring of server-based KM resources, including web servers, application servers, database servers, and support servers. The contractor will ensure that each server performs optimally and are designed to minimize unscheduled downtimes. The contractor will be responsible for the creation and monitoring of on-premise infrastructure dashboards, resolving performance and functional issues, and ensuring infrastructure software and servers are patched with the latest software versions and security updates.

For KM’s cloud infrastructure, the contractor will be responsible for providing cloud architects with knowledge of AWS and Azure to support cloud infrastructure solutions. The contractor will design and deploy cloud infrastructure solutions with server-less technologies when available and develop infrastructure as code and automated software deployment as appropriate. The contractor will also be responsible for supporting the KM with cloud management tasks, such as cost optimization, infrastructure monitoring, infrastructure support and cost projections.

For both the on-premise and cloud infrastructure, the contractor shall create and maintain infrastructure design documents and document all changes that occur through infrastructure change requests.

a. Administration of websites, container images, cloud resources, virtual machines, and servers

b. Administration of cloud networking, including VPCs and Hybrid Cloud Networks, and integration with the HHS and CDC networks

c. Creation and maintenance of monitoring solutions for infrastructure and applications

d. Performing systems analysis and troubleshooting for on-premises and cloud infrastructure

e. Designing and implementing infrastructure, both on-premises and in the cloud, to support KM’s systems and services

f. Performing impact analysis of infrastructure updates and changes

g. Performing analysis on configuration defects found in the production environment;

h. Performing and supporting maintenance releases;

6.3.7 Database Operations and Maintenance Support. The KM primarily utilizes Microsoft SQL Server technologies but does have MySQL and PostgreSQL for some specific open-source software stacks.

The contractor will be required to create, design, and manage both on-premises and cloud-based databases. The contractor will be required to monitor the health of the database environment, maintain cross-country replication, manage and support data ingest processes, support developer coding efforts and helpdesk service tickets, and stay current with database security both industry standard and CDC specific.

The contractor will be responsible for responding to database issues, incidents, and problems reported through the KM help desk. This includes the day-to-day tasks of assuring database availability, optimizing databases for performance and efficiency, and ensuring proper security and authorized access to database objects and data.

The contractor will also be responsible for reporting on environmental inconsistencies between each database environment (development, testing, UAT, training, staging, and production), and coordinating database change management with the operations and development teams.

Principal Tasks to be performed by the contractor shall include:

a. Adhere to all data management security rules and processes (e.g., authentication, authorization, encryption, auditing, and intellectual property).

b. Propose, develop and implement enhancements to security rules and processes.

c. Adhere to database management processes and procedures.

d. Propose, develop and implement enhancements to database management processes and procedures.

e. Ensure data is managed and maintained to support records management criteria.

f. Ensure database production environment meets all up-time requirements and identify potential impacts and solutions that may result in database production downtime.

g. Ensure business continuity of database management environment to include, but is not limited to high availability, disaster recovery and migrations and upgrades.

h. Monitor and troubleshoot development, testing and staging servers for deadlocks, performance issues and resource issues.

i. Performance tune queries and offer expertise on set-based operations

j. Performance tune onsite and cloud based database servers and identify and resolve system bottlenecks

k. Offer consulting on optimal architecture and data model

l. Eliminate obsolete database objects and configuration settings.

m. Evaluate error, audit and transaction logs to identify issues or areas of concern.

n. Evaluate and implement performance improvement techniques (e.g., indexing, database checkpoints, etc.) to prevent long running or inefficient queries.

o. Ensure appropriate creation and management of database transaction-logs.

p. Evaluate data for accuracy, relevancy and consistency.

q. Detect, analyze, and resolve data quality issue(s).

r. Create and manage data modeling and normalization to ensure that databases are designed to promote data integrity.

s. Observe data quality standards to safeguard data integrity and data value.

6.3.8 Communications. The contractor will provide communications support across all KM applications.

As application new releases are rolled out or experience issues, the contractor will support KM by providing communication support for stakeholders and systems users. In addition, the contactor will support keeping Publishing Assistant content current for KM.

a. Developing communications plans for projects and production systems;

b. Providing communications coverage during the KM Helpdesk established support hours;

c. Assisting with the maintenance/modification of application training and use content on the

Publishing Assistant site.

d. Documenting and maintaining communication processes, procedures, and templates updated at least quarterly.

6.3.8.1 Reports Development. The contractor shall develop application reports required to generate data and information for new/updated and enhanced applications. This development is for the generation of canned or custom reporting interfaces to support development projects. As part of application development efforts, reports developers are responsible for supporting data warehouse integration efforts. The contractor shall also support and perform various types of standard and non-standard reporting including ad-hoc reporting and self-service reporting.

6.3.8.2 Documentation. The contractors shall document as appropriate the design, architecture, infrastructure, and operating and user guidance for applications, services, systems, and websites it develops and operates under this SOW. The contractor shall ensure its documentation is accurate, free of jargon and typographical errors, and meets KM’s requirements for accessibility and usability. The documentation shall be maintained according to formats specified by CDC project leads and stored in a CDC document management repository.

6.3.8.3 Training. The contractor shall develop simple, easy to use training materials in support of the services, systems, applications and websites developed and operated in the other objectives and tasks. The contractor may be asked to facilitate, conduct, or participate in training based on the materials it has developed.

The training materials must meet WCAG 2.0/2.1 (AA) success criteria to address the usability and accessibility needs of the people using the services, systems, applications and websites.

Training includes all activities related to developing and delivering training and educational materials and tools in support of projects for system development/deployments and production support (operations and maintenance). The contractor is responsible for developing and maintaining all training and user guides, frequently asked question (FAQs), release notes and training materials for KM developed and/or supported applications, including web and computer-based training (CBT). The contractor will, as needed, develop and provide training for requested systems, in person or through web-based and/or computer-based training tools.

a. Developing and maintaining training processes and procedures

b. Developing training plans for KM-developed systems

c. Creating and updating user guides/training materials

d. Conducting annual review and updates of application user guides and training materials for KM systems

e. Creating/updating computer-based training

f. Developing materials and conducting classroom and web-based training

g. Researching and recommending training methods, tools, and technologies

h. Evaluating KM Helpdesk tickets to identify customer training needs;

i. Developing recommendations for measuring and tracking training effectiveness; and

j. Conducting survey/evaluation of training effectiveness.

6.3.9 KM Helpdesk. The KM Help Desk is a single call center supporting all KM customer requests for user support of all KM applications.

The contractor will be responsible for providing helpdesk and user support for applications and systems supported by KM. The contractor will be responsible for providing Tier I support by creating tickets and routing calls, as well as Tier II and Tier III support and escalations for troubleshooting known issues specific to KM supported applications. The contractor will be responsible for the use and management of the helpdesk tools such as the JIRA ticket tracking system.

The contractor will also be responsible for utilizing analysis of helpdesk trends both proactively and reactively. Reactive analysis includes the development of frequently asked questions and proposed system changes based on trends discovered in analysis of common user problems. Real-time analysis includes the live identification of potential system or network problems based on a spike in calls from users in a specific organization or of a specific system. The contractor will also be responsible for performing this analysis in real-time to ensure that issues in the production environment are uncovered and resolved quickly.

Principal Tasks to be performed by the contractor include operation, management and maintenance of the call center environment including Automated Call Distributor, Interactive Voice Response, and associated call center systems in addition to;

a. Providing Tier 1 Support including call screening and triage

b. Providing Tier 2 Support including issue resolution

c. Providing Tier 3 Support and escalation including subject matter expertise support

d. Management of trouble tickets

e. Maintaining the content of the knowledge repository/self-service portal

f. Providing help desk and customer standardized ad-hoc reporting

g. Establishing help desk metrics and monitoring and reporting as requested

h. Generating standardized reports every sprint

i. Providing proactive management of problem areas

j. Recording and report problems and resolution in the designated user support tracking system

k. Developing and supporting self-help capabilities

l. Developing lessons learned and utilize the lessons learned to aid in process improvements

m. Support IMS activations with extended service hours.

6.3.10 Open Science. In order for federal science to be reproducible, research outputs such as datasets, analytic code, and software need to well documented and shared with the public so that interested parties can test hypothesis and conclusions. This contract supports CDC scientist in the creation of open science packages with include scientific publication as well as the data and code that was used to develop the conclusions documented in the scientific work. This support entails working directly with CDC scientists as well as assisting with procedures for releasing and interlinking the components of an open science package. Based on requirements gathered, multiple KM systems will need to updated to meet future needs.

6.3.11 Information Assurance (IA) Support. The contractor IA Support team includes the activities necessary to ensure the security of KM applications and the adequacy of security controls meet all the

IT Security and Privacy Requirements for Federal systems, as defined by law, regulation, and HHS, DHS, CDC and OMB policy and guidance.

The contractor will be responsible for working directly with the KM Security Steward in the development of security plans, instructions, guidance, and operating procedures. The contractor will provide expertise throughout the application lifecycle and participates in security planning, risk assessments, drafting of IA policies and procedures, and development of security requirements.

The contractor will monitor and advise on IA-related requirements, mandates, Presidential Directives and regulations and ensures analysis, tests, and reviews are conducted in a timely manner. The contractor will also assist the KM Security Steward to develop Security Assessment and Authorization (SA&A) packages under the direction of the KM ISSO and reviews and evaluate the adequacy of security controls, including completing the Privacy Impact Assessment (PIA) document.

The contractor must have a proficient understanding and experience with the National Institute of Standards and Technology (NIST) Special Publications as well as cloud technologies such as, but not limited to, Azure and Amazon Web Services in order to evaluate vulnerabilities and risk in going through an accreditation for systems deployed and hosted at cloud service providers. KM is currently working with cloud providers with a FedRAMP certification, therefore the contractor must be familiar and have experience with performing a SA&A on systems hosted on a FedRAMP ATO.

a. Assisting with the development of KM SA&A packages, including data and privacy documentation

b. Processing KM SA&A packages annual deliverables including Annual Assessments and Business

Continuity Plans / Information System Contingency Plans at least 30 to 60 days before the due date

c. Coordinating and collaborating with the Cybersecurity Program Office (CSPO) as needed in support of the SA&A process, change management and ongoing continuous monitoring

d. Working with Project Teams on security requirements which includes attending project meetings, advising the Project Teams on the SA&A process and timelines, and collaborating to complete the required documentation to obtain an ATO or change request

e. Working with KM to implement IA activity efficiencies and process improvements including updating team SOPs and suggesting SA&A process improvements for internal team efficiency

f. Monitoring implementation of Corrective Action Plans (CAP), weakness management and Plans of Action and Milestones (POA&M)

g. Obtaining artifacts and drafting CAPs, POAM closures and assessing if the artifacts are sufficient to meet the control deficiency for POAM closure

h. Tracking SA&A deliverables and their due dates ensuring no deliverable is past due and Managing the document repository

i. Reporting to the KM Security Steward and ISSO on SA&A deliverables status

j. Performing proactive security analysis and testing of KM systems by self-reporting POAMs to

CSPO if a deficiency is identified during the annual assessment or during the course of business;

k. Developing and conducting IA training by scheduling training sessions with Project Managers, developers and Business Analyst to ensure an understanding of the SA&A process and change management process;

l. Performing KM information security support activities including, but not limited to, vulnerability scans using Nessus, Web Inspect, Fortify and other tools as they become available; and

m. Integrating security with enterprise architecture (EA), and capital planning and investment control (CPIC) by completing stage-gate reviews for projects within TSB.

6.3.12 Data Curation.

To ensure that CDC science is easily discoverable proper document/data curation must occur. This requires document curation expertise that can guide the collection development plan for the CDC repositories, provide original cataloging of documents with no current metadata record, and work with content creators to ingest new documents and ensure that they are acceptable for posting in an external repository. This includes support for the federal records storage and transfer project guided by the Strategic Business Initiatives Unit. This project is designed to import and store permanent and nonpermanent federal records into CDC Vault then transfer those records to the National Archives and Records Administration. Data curation requirements go beyond publication cataloging. Special expertise will be required to catalog scientific datasets as well as code. Assisting CDC staff members on the proper curation of their scientific output will also be required

6.3. 13 KNOWLEDGE MANAGEMENT IT PRODUCT DESIGN, DEVELOPMENT, ENHANCEMENT,

AND OPERATION AND MAINTENANCE

(APPLICABLE TO ALL PERIODS )

6.3.13.1 Document Operations and Clearance System (DOCS)

DOCS has multiple subsystems, including eClearance, STARs, Data Use, Publishing Reporting, and TiPSTER. DOCS is currently undergoing a major system refresh. This includes a major software update, a system migration and a system architecture update are all occurring in concert. The contractor will be required to have staff that is capable of supporting this effort without significant delay or interruption of service.