SSN_Attachment 1 - DRAFT SOW (ADaPTS 2.0) (02.29.2024).pdf

U.S. Department of Homeland Security

Office of the Chief Information Officer (OCIO)

Statement of Work (SOW) for

Architecture, Development, and Platform Technical Services (ADaPTS) 2.0

2.0 Statement of Work

2.1 Background

The Department of Homeland Security (DHS), Office of the Chief Information Officer (OCIO) is responsible for leading the engineering of DHS’ Digital Transformation by providing knowledgeable and innovative insights into technology products or services across all Information Technology (IT) portfolios, strengthening cybersecurity, IT acquisition, IT security, executive oversight, and promoting the use and deployment of best of breed technologies using a unified framework for collectively managing IT investments.

The OCIO provides enterprise technical architectural planning and delivery of enterprise IT services. In addition, OCIO is the DHS lead for Cloud based computing, in the private, hybrid and public Clouds.

OCIO manages multiple, unrelated IT projects in the design, development, testing and staging phases.

OCIO seeks to provide innovative business solutions, lower costs through shared services, and reduce the time spent marketing for new capabilities. As the foundation for customer-centric service delivery, OCIO establishes a secure utility computing environment where innovation, re-use, and quality are core principles. OCIO promotes the adoption of standardized solutions and services across the department.

Additionally, DHS needs to modernize several of its existing business applications to migrate off unsupported platforms and improve the efficiency of OCIO’s application delivery functions. OCIO’s intent is to build these applications based on a suite of reusable services.

2.2 Objective

The objective of this procurement is to obtain highly specialized technical contractor support services to assist the OCIO in executing and accomplishing its mission objectives.

The key mission objectives are listed below:

• Implement and manage Cloud based commodity computing services

• Perform end-to-end technical requirements management for enterprise IT services

• Maintain and track application service level agreements and performance measurements

• Support Government-Off-The-Shelf (GOTS) / Commercial-Off-The-Shelf (COTS) application integration and interoperability for customer developed components

• Perform application and service compliance and performance monitoring (e.g., FedRAMP, DHS Directive 4300A, NIST Guidance, Federal Information Security Management Act of 2002 (FISMA), Privacy,Section 508 of the Rehabilitation Act of 1973, as amended, 36 CFR Part 1194, “Electronic and Information Technology (EIT) Accessibility Standards”

• Plan, develop and manage enterprise application development and delivery

• Provide an integrated approach to enterprise application capabilities (e.g., user interface, application logic, workflows, access to data and security, etc.)

• Perform application delivery and systems assurance including configuration management

• Provide Strategy, Policy and Governance Support

• Provide Architecture and Planning Support

• Provide Development and Implementation Support

• Provide Strategic Communications Support

• Provide Audit, Tasker, and Executive Clearance Support

• Provide Operations and Maintenance Support

• Provide Operations/Database Support

• Identify and recommend products (preferably open source) to streamline processes and add efficiencies

• Provide User Experience/Customer Experience research, design, and consulting support

• Implement and manage technology platforms with numerous customers/tenants based on infrastructure, software, and cloud services

• Provide customer chargeback models and financial operations (FinOps) support

2.3 Scope

The scope of this effort includes the contractor support services necessary to provide a full range of IT and program support services. All services and products that will be provided must comply with Government security, Section 508, and architecture requirements. The scope of the services and products to support these services required includes:

• Program and project management

• Agile Software Development Processes

• Security/Development/Operations (SecDevOps) Processes

• Engagement and facilitation of key stakeholders

• Business Analysis and Requirement management

• Application, service and cloud architecture support

• Application and Service Design, Development, Implementation and Migration

• Unit, System, User Acceptance, Section 508, and Automated Testing

• User Interface / User Experience Design

• Business Intelligence, dashboard and analytics support

• Business process re-engineering and change management

• Integration with databases and applications

• Analytics and reporting

• Release management

• Training support

• Data Standardization, Quality, and Analytic Support Services

• Platform Support and Disaster Recovery (DR)

• User guides and system documentation

• Acquisition Lifecycle Framework (ALF) Support

• Systems Engineering Lifecycle (SELC) Support

• Operational Analysis (OA) and other Post-Deployment Support

• Manage Cloud based commodity computing services and Shared Services

• Knowledge management, communications, and graphics support

• Audit, Tasker, and Executive Clearance Support

• Security Support Services

• Security Engineering Services

• Zero Trust Strategy Development and Implementation

• Configuration Management Support

• Robotic Process Automation (RPA) Support

• Artificial Intelligence/Machine Learning/Natural Language Processing (NLP) Support

• Support for other new and evolving technologies

• Accessibility Subject Matter Expert Support

• Electronic Content Accessibility Support

• Accessibility Compliance Support

• Technical Editor Support

• Applicable documents:

The Contractor shall comply with the latest version of all Federal, DHS technology standards and architecture policies, processes and procedures applicable to the support of the OCIO IT environment in the following categories:

DHS Agile Guidebook DHS Systems Engineering Life Cycle Guidebook DHS ServiceNow Development Governance Policy DHS Information Governance and Privacy Requirements DHS Records and Information Management DHS Sensitive Systems Policy Directives 4300A DHS Section 508 of the Rehabilitation Act DHS Paperwork Reduction Act (PRA) DHS Cybersecurity Requirements DHS Cloud Best Practices and Policy DHS Configuration Management Plan

Please note that if newer versions of these documents are officially released, the

Contractor shall comply with the updated versions within the timeframe established by the government.

3.0 Specific Task Requirements

To support the agency mission, projects and system requirements, the Government requires highly specialized information technology systems support services in the following task areas.

3.1 TASK ONE. Program and Project Management

Effective program and project management are essential components of OCIO’s mission. OCIO has the responsibility of developing and implementing a comprehensive program and project management capability for overseeing and controlling program and project activities.

The Contractor shall:

• Employ a comprehensive project management approach following the Project Management Body of Knowledge (PMBOK), which will include development and oversight of project schedules and key management plans for Government review and approval. The Contractor shall facilitate Government project teams and key stakeholders to gain consensus on key project parameters, including scope, resource requirements, project plans, and schedule dependencies. The Contractor shall ensure that scope, performance expectations, and resource requirements are clear, well-defined and thoroughly documented.

• Employ Agile project management methodology to enrich traditional project management methodologies. Agile uses iterative, incremental development, which allows requirements and solutions to evolve through collaboration in an integrated project team environment. The Contractor shall promote adaptive planning, evolutionary development and delivery, in a time-boxed iterative approach, and encourage rapid and flexible response to change using the Agile methodology.

The Contractor shall perform project management activities including:

• Provide the ability to manage projects that are at varying phases of the project lifecycle (e.g., project initiation or maintenance).

• Ensure the team delivers agile development artifacts, which will include Project Sprint/Product/Release

Backlogs, Burn-downs/ups, Team Velocity, User Story Acceptance Criteria, User Story Estimation, Sprint Review, Definition of Done, and Release Retrospective.

• Provide recommendations and process for implementing improvements.

• Develop and manage project performance, including integrated project schedules, and plans using

Microsoft Project and kept in sync with Maestro JIRA (JIRA) and Maestro Confluence (Confluence).

• Manage and monitor projects with transparency with schedule, budget, and quality reviews.

• Perform risk management, including identifying, prioritizing, and mitigating risks, and communicating and escalating risks and issues where appropriate.

• Maintain project scope in accordance with industry standard project management best practices.

• Ensure the project adheres to DHS standards, methodology, and compliance requirements.

• Interface with key stakeholders as defined by the Government.

• Follow configuration best practices and OCIO guidelines to ensure proper management and configuration control of project documentation and source code.

• Deliver defined reports per the schedule agreed to by the Government and, where applicable, ad-hoc reports.

• Designated contractor leadership will coordinate closely with the assigned Federal functional team leader; ensuring functional support activities are prioritized.

• Work closely with managers and all other team members to plan, manage, and deliver releases.

• Participate in required meetings for project status, governance, and demonstrations.

• Facilitate activities through training, testing, go-live, and post go-live support.

3.2 TASK TWO. Business Analysis and Requirements Management

The Contractor shall perform business analysis and requirements management that employ industry best practices for soliciting, sizing, and sequencing user stories supporting Agile-based projects. The Contractor shall coordinate with the Business Owners in shaping and prioritizing requirements. User stories will be written by the Contractor with the Business Owners concurrence for implementation in the form of a backlog. The Product Owner will provide prioritization of user stories. This support shall be provided on existing and new projects, as assigned by the Government.

The Contractor shall perform business analysis and requirements management to include:

• Provide expertise in business analysis and requirements management standards and best practices to perform distillation of complex business requirements into epics/user stories.

• Elicit, document, and analyze business requirements in alignment with technical requirements and successfully translate requirements into usable information as defined by the Government.

• Develop business process and flows according to business and technical requirements as defined by the Government.

• Apply the Agile development framework to size and sequence user stories to deliver incremental functionality to validate project objectives.

• Use of JIRA and Confluence for development and management of use cases, user stories, requirements, test cases, project artifacts and metrics.

• Deliver defined reports per the agreed to schedule and, where applicable, ad-hoc reports.

• Participate in required meetings: daily standup meetings, weekly status meetings, and ad hoc meetings.

• Assist in the development of data driven decisions initiative for DHS that emphasizes data, analytics and evidence-based decision making.

• Develop and expand DHS Data Stewardship Provide - The contractor shall assist in the identification, establishment, and productivity of DHS data stewardship bodies. DHS data stewards are identified for functional areas, domains, families of data and communities of practice. The contractor shall also assist working groups formed to define and drive the adoption of DHS data standards (e.g., reference data, syntactic data standards, exchange data standards). Support of data stewardship organizations will include assistance in establishing new working groups, as well as subject matter expertise and guidance for difficult stewardship issues, and participation in working groups with DHS equities.

• Be responsible to ensuring that all Plan of Action and Milestones (POA&Ms) are addresses and resolved in a timely manner.

The Government has defined complexity levels to accommodate the variety of projects that will be collecting and defining user stories. The Contractor shall define a team of business analysts and technical experts to meet the needs of the effort. Complexity is defined by the number of prime-users and the expected number of user stories generated. A prime-user is considered a major stakeholder, a subject matter expert, or a product owner.

• The Contractor shall develop for Government review, a standard requirements management process for implementation that provides traceability across the full lifecycle of service and application development. This process shall provide and align with DHS Enterprise Architecture (EA) processes to ensure potential services are appropriately vetted prior to committing resources for implementation.

• The Contractor shall support a fully automated suite of software (currently Atlassian) with the following capabilities:

Figure 1: Requirements Software Capabilities

The contractor shall use these capabilities and processes to manage requirements through their lifecycle.

3.3 TASK THREE. Application, Service, and Cloud Architecture Support

The Contractor shall provide support for the definition of application and service architectures, as well as the evaluation and definition of standards. The Contractor shall assess leading edge and emerging technologies and conduct analyses of their applicability and viability for DHS applications and services.

The Contractor shall assist the Government with leadership and management of service planning, enablement, directory services and services analyses.

Software Capabilities Key Characteristics

Phase of System Lifecycle

* Automated Bi-directional Traceability across tiers of requirements (Higher level business requirements down through to detailed technical requirements).

* Automated Bi-directional Traceability across life cycle elements (Requirements to design elements to code/module to test script).

* Tracking of requirements by attributes (i.e., functional area, source, date, iteration).

* Easy reporting and measurement tracking.

Requirements Management Requirements/ Design/ Development/ Testing

The Contractor shall support the OCIO in the on-going development of the Cloud Architecture to include:

• Provide an integrated approach to enterprise application capabilities (e.g., user interface, application logic, access to data and security, etc.).

• Establish target/reference architectures, aligned to DHS 4300a, for implementing hybrid cloud based applications and services, while ensuring that the following critical functions are incorporated: Log Management, Artifact Repository, Vulnerability Scanning, Secrets Management, Discovery, Intrusion Detection, Source Code Management, Identity and Access Management, Lightweight Directory Access Protocol, Domain Name System, Forward Proxy, Reverse Proxy, Automation Orchestration, Configuration Management, Container Orchestration, Cloud Security, Data Protection, Data Segregation, Mobility and Data Tracking.

• Assist OCIO in driving reusable services and capabilities to reduce the number of interfaces, services, and service buses by using DHS defined or well-known industry standards.

• The Contractor shall interface with and support the Office of the Chief Information Officer (OCIO). In this role, the Contractor shall propose application development standards for Government review and foster the use of Agile development to ensure enterprise services provide scalable, reusable components to meet future customer requirements.

In addition, the Contractor shall work across OCIO to assist with the design, development, testing, staging, and production environments for HQ and enterprise applications and services. The Contractor shall develop a proposed to-be infrastructure for Government approval to leverage virtualization and cloud computing.

3.4 TASK FOUR. Application and Service Design, Implementation and Migration

The Contractor shall support the OCIO by providing database and development services on multiple, simultaneous projects and services. In addition, the Contractor shall support the migration of applications, data, and services to newly developed platforms and services.

The Contractor shall provide the following:

• The Contractor shall design and develop applications and platform services for use by DHS. DHS will retain source code developed by the Contractor. The design and development activities shall leverage prior efforts where directed by Federal program manager and/or the COR. The Contractor will document codes and annotate in plain language. All efforts shall use the Agile methodology unless approved by the functional federal lead to do otherwise in accordance with the waiver process detailed in the DHS Agile Instruction. To the extent practicable, the Contractor shall also use the SecDevOps process for software delivery. The design and development shall include the creation of frameworks and tools for deployment and support of the application and service. The Contractor shall perform trade off analyses to include analysis of alternatives, cost benefit analysis, total cost of ownership and usage, and technical tradeoffs.

• The Contractor shall plan and support capacity and performance management of the Cloud or Virtual Service environments.

• The Contractor shall create and refine prototypes for Government approval in a rapid development environment.

• The Contractor shall implement applications and services to include obtaining approvals;

setting up and configuring infrastructure; integrating to other applications, services and data stores; migrating code, frameworks and data; supporting reviews and testing; and creating documentation.

• The Contractor shall update and maintain applications and services whether in the DHS Enterprise Data Centers, the DHS Private or Public Clouds, or through a third-party provider.

• The Contractor shall support Digital Identity Management and Digital Rights Management, information management and e-discovery capabilities.

• The Contractor shall support Digital Asset Management capabilities to organize, store and disseminate digital imagery to include photos, videos, audios, and documents.

• The Contractor shall support direct mail, one way, and interactive communication capabilities for the DHS enterprise.

• The Contractor shall design, develop, test and deploy applications and services in a highly virtualized environment using select applications and Integrated Development environments.

Technologies that will be supported include:

• Microsoft technologies: The Contractor shall provide support to, and proven expertise in, developing, maintaining, and administrating Microsoft applications to include troubleshooting issues, on-boarding and off-boarding new customers, and implementing product enhancements. The Contractor shall also tune and manage the health of the databases. The Contractor shall provide development and platform support using the following technologies to include emergency technologies that are a follow-on platform to include the existing systems/programs below:

o Microsoft Azure Infrastructure as a Service and Platform as a Service Products o Office 365 Services o SharePoint o Forefront Identity Manager (FIM) o Active Directory (AD) o SQL Server Database Services o SQL Server Analysis Services (SSAS) o SQL Server Integration Services (SSIS) o SQL Server Reporting Services (SSRS) o Microsoft .NET Framework & C# or Visual Basic o Dynamics Customer Relationship Management (CRM) o Power BI

• VMware: VMware is the basis for the DHS private development, test pre-production and production Cloud servers. There are hundreds of these servers in use by OCIO today. The contractor shall create, manage, support and troubleshoot these servers using the following technologies (at a minimum):

o vCloud Director o vCenter o ESXi o View

• Oracle: The Contractor shall provide support to, and expertise in, developing, maintaining and administrating the Oracle Platform and applications using the Oracle Platform to include troubleshooting issues, on-boarding and off-boarding new customers, and implementing Oracle product enhancements. The Contractor shall also tune and manage the health of the databases.

The Contractor shall provide development and platform support using the following Oracle technologies.

o Oracle Business Intelligence Enterprise Edition (OBIEE) o Oracle Visual Analyzer o Oracle Database o Management Pack o Oracle Enterprise Manager o Hyperion o Master Data Management

• Tableau: The Contractor shall provide support to, and expertise in, developing, maintaining and administrating the Tableau Server Platform and applications using the Platform to include troubleshooting issues, on-boarding and off-boarding new customers and implementing product enhancements.

• Applications, Open Source Tools, and Languages: Where possible, the OCIO is using Applications, Open Source Tools, and Languages in developing, maintaining and supporting applications and services. The Contractor shall provide support and be capable of creating, managing, supporting and troubleshooting open-source tools similar to the following applications, tools and technologies:

o Apache o Atlassian JIRA o DROOLS o Drupal o Eclipse o Fisheye o GRADLE o Grails o HADOOP o JAVA o MOODLE o MySQL o PHP o Python o Red Hat Linux o Red Hat Ansible o Spring o Tungsten o Zenoss o AngularJS o Bootstrap o JQuery o Terraforms o Power BI o ElasticSearch o Node JS o Neo4J o Nest o Matmo o Kibana

• Direct Mail Solution: The Contractor shall provide support to use this solution to help headquarters and components deliver email and newsletters to the public as well as internal communication Currently the solution in use is GovDelivery.

• JAZZ: The Contractor shall provide support to use this solution in managing the application lifecycle, especially while using Agile methodologies.

• MQ Series: Used as a message-oriented middleware and is part of many mainframe applications. The Contractor shall provide support to understand how to input data to and obtain data from MQ Series ques.

• Web Sphere: This suite of products will be a major part of the support that is provided to some enterprise services. The Contractor shall create JAVA based applications using these technologies, as well as the Web Sphere bus.

• BMC Software Applications o Blade Logic: The Contractor shall be able to provide support and configure this solution.

o Remedy: The Contractor shall provide support by resolving tickets input into the system.

• Cloud Computing: OCIO is the DHS lead for Cloud computing and currently provides multiple Cloud services. The Contractor shall support OCIO Cloud Services that are provided to the Department to include:

o DHS Enterprise Cloud (currently serving Amazon Web Services and Microsoft Azure) o ServiceNow o Application Lifecycle Management as a Service o Authentication and Access Management as a Service o Business Intelligence as a Service o Customer Relationship Management as a Service o SharePoint as a Service o Email as a Service o Identity Proofing as a Service o Platform as a Service (PaaS includes Infrastructure as a Service and Dev/Test as a

Service) o Workplace as a Service o Web Content Management as a Service

Google Cloud Search Enterprise Content Delivery as a Service Granicus communication cloud (GovDelivery) IdeaFactory (currently leveraging IdeaScale)

3.5 TASK FIVE. Unit, System, User Acceptance, Section 508 and Automated Testing

The Contractor shall provide a full range of application and service testing. Specifically, the Contractor shall:

• Support the development and implementation of repeatable testing frameworks that encompass functional, regression, unit, system, integration, stress, and load testing procedures.

• The Contractor shall support the Agile process by providing continuous integration and builds

• The Contractor shall provide services and software that support the following capabilities:

Figure 2: Requirements Software Capabilities

Software Capabilities Key Characteristics Phase of System

Lifecycle

Automated/ Manual Function Testing

• Allows automated traceability of test scripts to requirements.

• Automates testing using stored inputs and outputs.

• Have the ability to write scripts and provide engine/harnesses to automate tests.

• Provides reporting and measurement tracking on the failure rate of test scripts against approved requirements.

Testing

Automated Load Testing / Performance Modeling

• Provides load testing tools that may increase and decrease the performance load on various parts of the infrastructure, application, services, and data stores.

• Enables the software team to find out exactly how much stress (i.e., maximum number of users) each infrastructure, application, service, and data store can handle to validate that it performs at specified or higher than expected production values

Testing

The Contractor shall provide Section 508 testing of various Information and Communications Technology (ICT) using the current version of the DHS approved assessment methods and test reporting tools and formats. The Contractor must use the DHS Trusted Tester Version Section 508 Conformance Test Process for Web (or later) and be certified by DHS to test using Trusted Tester Version 5.0 (or later).

The Contractor shall provide Section 508 testing services that include:

• Conducting technical evaluations of Accessibility Conformance Reports using DHS guidance materials, including reviewing vendor conformance claims and assigning an overall score consistent with technical guidelines.

• Developing accessibility test plans.

• Advising on how to interpret accessibility test results and remediate Section 508 defects.

3.6 TASK SIX. Business Process, Reengineering, Change and Release Management

The Contractor shall provide business analysis support to document key business processes, analyze them for service-enablement, identify and describe candidate services for implementation, develop recommendations for process improvement, and create service orchestration specifications for use in application development efforts. The Contractor shall provide recommendations to help DHS optimize the flexibility and impact of its service offerings.

The Contractor shall support the OCIO Change Management processes by:

• Developing and executing communication plans for stakeholders (serving as the formal method to communicate and advise stakeholders of the changes being made, timeframes, responsibilities, resulting impacts, and expectations).

• Providing organizational change management (OCM) support which includes training to institutionalize the recommended changes and educate the business users and staff about the communication plans.

• The contractor shall communicate the changes for all documented processes and procedures to the entirety of the DHS OCIO.

• The Contractor shall define, for Government review and implementation, standard mechanisms for building and releasing software across development, testing, staging, and production environments. Release management shall be organized by platform, system, service or environment, depending on the specific objectives of the release cycle.

• The Contractor shall support the Agile process by providing continuous integration and builds, as well as unit, functional and integration test execution, with incremental automated deployment of an application or service.

The Contractor shall provide services and software that support the following capabilities:

Figure 3: Release Management Capabilities

Capabilities Key Characteristics Phase of System

Lifecycle

Deployment/ Migration Tool

• Provides processes, procedures and automation for consistent, reliable builds and migrations.

• Allows rapid deployment of software environments based on definable policies and controls.

• Creates “snapshots” of systems manually and in an automated process.

• Provides for Continuous Data Protection (CDP) when used to replicate a system.

• Uses various techniques, such as ghosting/imaging and virtualization to allow a development team to rapidly create virtualized servers with the exact same image as their production boxes for development purposes.

• Provides processes, procedures and tools to “sanitize” data.

• Helps automate and manage a solution over its lifecycle.

• Manages patch deployment.

• Facilitates capacity planning and efficient resource use.

Development/ Testing / Operations & Management (O&M)

3.7 TASK SEVEN. Training Support

The Contractor shall provide training on all applications developed under each individual task order. The training will be conducted for three (3) separate target audiences:

• Business users of the application or service

• Staff that will support the application or service

• Staff that will continue working on the application or service

The business users training shall result in business users understanding and correctly using the application or service.

The support staff training shall include the content from the business users’ training in addition to a walkthrough of the application’s functionality and documentation. It shall prepare support staff to address questions on the application or service and determine the point at which the support efforts should be rolled over to the next level of support.

The developer training shall include the content from the business user and support staff training, as well as a walkthrough of each functional module of code. The developer walkthrough and training shall be structured so that the developer is able to understand the way the application or service was developed and leave with a complete knowledge of all aspects of the application or service’s functionality and support requirements.

Training will include development of enterprise data literacy insights and training programs related to the elevation of DHS data skills.

3.8 TASK EIGHT. Platform Support and Disaster Recovery (DR)

For each application or service supported, the contractor shall provide support for advanced application or service issues that the customers cannot address (as defined in their Operations & Maintenance Handbooks and their Memorandum of Agreements), both during the daily work hours and after hours, via an on-call service. The Contractor shall provide this service using staff that participates in the application or service development where possible.

The Contractor shall provide services and software that support the following capabilities:

Capabilities

Key Characteristics

Phase of System Lifecycle

Help Desk (Level 1-3 support of deployed applications)

• Provides ability for development staff to enter, obtain, update and close tickets.

• Provides ability to define issues seen.

• Provides ability to enter actions taken on issues.

O&M

Level 2-3 platform support

• Production Deployments

• Monthly Patching

O&M

Backup / Restore / Disaster Recovery

• Allows an organization to make backups of code bases and application configurations and then restore them quickly should any fault happen to the system.

• Provide Standard Operating Procedure (SOP) that shows the process for back-up and recovery

• Creates “snapshots” of systems manually and in an automated process.

• Provides for Continuous Data Protection (CDP) when used to replicate a system.

• Provides geographic site failover for production.

O&M

The Contractor shall support demonstrations to Product Owner and end users as requested by the ITPM and Product Owner. The Contractor shall provide a training plan to include a schedule, relevant material, practical exercises, logistics, and training methods. The Contractor shall also co-facilitate training sessions with the Business Owners. The Contractor shall walk through user screens, text displays and practical exercises during training sessions.

The Contractor shall setup and manage a training environment, including appropriate data, for all releases.

3.9 TASK NINE. Manage Cloud Based Commodity Computing Services, Shared Services and “X“ as a Service (XaaS)

The Contractor shall support the OCIO in the implementation and management of Cloud based commodity computing services and Shared Services. This includes:

• Obtaining and documenting business, functional and technical requirements

• Evaluating and making recommendations on technology and design trade offs

• Providing processes, procedures and documentation to support on-boarding and off- boarding customers

• Integrating applications and services (Infrastructure as a Service, Platform as a Service &

Software as a Service) into current architecture, including all back-office systems

• Migrating applications and data from the current DHS datacenters to approved cloud solution offerings

• Providing technical assistance in maintaining and tracking application service level agreements and performance measurements to include:

o Resource and workload utilization rates o Measurements of usage o Availability o Serviceability o Creating and evaluating root cause analyses for incidents

• Recommending enhancements to the services

• Providing Operations and Maintenance Support for the service

• Support the OCIO application and service compliance activities, as well as provide performance monitoring in support of FedRAMP, DHS Directive 4300A, NIST Guidance, Federal Information Technology Reform Act (FITARA), Federal Information Security Modernization Act of 2014 (FISMA), Privacy, Rehabilitation Act of 1973 (a.k.a. Section 508) and other applicable legislation.

The Contractor shall manage and track the system and service security posture.

3.10 TASK TEN. User Guides and System Documentation

The Contractor shall develop all documentation and deliverables required using industry best practices such as PMI Project Management Body of Knowledge (PMBOK), Information Technology Infrastructure Library (ITIL), Capability Maturity Model Integration (CMMI), and Institute of Electrical and Electronics Engineers (IEEE).

The Contractor shall develop all documentation and deliverables in accordance with Acquisition Directive 102-01, Acquisition Management Instruction/Guidebook 102-01, Appendix B: Software Engineering Life Cycle (SELC).

3.11 TASK ELEVEN. RESERVED

3.12 TASK TWELVE. Security Engineering Services

The Contractor shall engineer, architect, implement, deploy, maintain, and administer commercial and open-source products. The Contractor shall provide personnel that are “hands-on,” highly technical, expert security engineers with the ability to engineer, implement, and support security applications, as well as, generate supporting technical documentation. The Contractor shall maintain existing tools and systems as well as support the security activities associated with the evaluation and introduction of new security technologies into the CIO environment. This includes the following:

• The Contractor shall provide support on all information security activities at the program level including policy development, compliance inspections, audits, reviews and communications security.

• The Contractor shall provide support and work on the development phases of information security systems development lifecycle.

• The Contractor shall oversee, evaluate, and support the documentation, validation, and accreditation processes necessary to assure that new IT systems meet the organization’s IA requirements and ensures compliance from internal and external perspectives.

• The Contractor shall conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations, enterprise or local policy, assess the level of risk, and develop and/or recommend appropriate mitigation countermeasures in operational and non-operational situations.

• The Contractor shall document incident correlation requirements, select incident correlation engines and recommend configuration guidelines. The Contractor shall perform analysis to determine the optimum configuration of network and host sensors. This analysis includes traffic load analysis, performance impacts of monitoring, determination of potential attack characteristics based on mission and infrastructure, and determination of site-specific data collection requirements.

• The Contractor shall analyze and recommend resolution of information security problems based on knowledge of the major information security products and services, an understanding of their limitations, and a working knowledge of the disciplines of information security.

3.13 TASK THIRTEEN. Configuration Management Support

The Contractor shall provide Configuration Management (CM) support activities to the OCIO. These include the following:

• The Contractor shall support CM Boards and Project Teams through activities and deliverables such as project status reports, design documents, design validation, migration planning, service delivery guidance, and implementation support documents.

• The Contractor shall develop, maintain, update, and implement CM plans and procedures, control configuration baselines, conduct functional and physical configuration audits, and formal qualification reviews.

• The Contractor shall submit proposed changes to DHS systems or to project baselines to the Change Control Board (CCB) and the Technical Working Group (TWG), maintain a record of all submitted and approved changes, and maintain a schedule of deliverables showing both the scheduled and actual delivery dates.

• The Contractor shall develop, maintain, update, and implement a Configuration Management Data Base (CMDB), an engineering release system, a configuration item development record (including the configuration index and change status listing), configuration status accounting, and support the CCB.

3.14 TASK FOURTEEN. Support for New and Evolving Technologies

The dynamic nature of the OCIO mission results in rapidly changing requirements. There may be work surges to support changing priorities due to new and updated initiatives and additional resources may be needed to assist with these efforts. As such, the technologies that the Contractor shall support will change. The Contractor shall assist the Government with support for these evolving technologies as they are introduced to DHS. At a minimum, the Contractor shall provide policy adaptation and support in implementation for the following specific evolving technologies:

• Robotic Process Automation (RPA)

• “Low Code” solutions

• Artificial Intelligence (AI)

• Machine Learning

• Natural Language Processing (NLP)

• Other Emerging Technologies

3.15 TASK FIFTEEN. Engagement and Facilitation of Key Stakeholders

The Contractor shall provide engagement and facilitation support activities to the OCIO including project kickoffs, weekly meetings, monthly touchpoints, and other facilitation projects as needed by the OCIO. Support the Data Governance Council (DGC) - The contractor shall provide administrative assistance to the DGC meetings such as: meeting planning, managing mailbox and provide stakeholders with responsive updates to all inquiries, preparation, logistics, note taking and publication of the meeting minutes on the SharePoint once reviewed and approved. The contractor shall also provide subject matter expertise to promote technical comprehension for DHS Enterprise and extended Enterprise stakeholders in the form of document reviews and collaborative working groups or tiger teams. The contractor shall assist working groups and tiger teams established by the DGC to address data management initiatives.

3.16 TASK SIXTEEN. User Interface / User Experience Design

The Contractor shall provide support activities to improve usability, user experience, and driving user adoption and engagement. This includes conducting user research, analysis & synthesis, persona development, interaction design, and usability testing to create products in support of the OCIO customers.

The Contractor shall actively participate in CX (Customer eXperience) meetings and briefings. This includes:

• Sharing key takeaways from meetings and briefings and reporting on behalf of CDOD when requested.

• Maintaining and updating CX materials and reporting tools

• Provide input and planning to support research into existing CX tools, services, and support.

• Satrategic advisory insights, recommendations and guidance that promote data insights into the existing Department CX infrastructure

• Setting and establishing a data-centric approach including roadmap documents, guidance, communication, and briefs for Department wide use and visibility

3.17 TASK SEVENTEEN. Integration with database and applications

The Contractor shall provide an integration and database application service to ensure that various applications and data store across the enterprise work together seamlessly. The Contractor shall assist with systems administration, database and system design, including the design and implementation of the next-generation database and multi-tier solutions for both new and existing data bases and client-server applications.

The Contractor shall provide enterprise application integration to enable data propagation and business process execution across various applications to support complex operational business functions such as fulfilling a customer mission.

3.18 TASK EIGHTEEN. Analytics and Reporting

The Contractor shall provide analytics and reporting support activities to the OCIO. These include the following:

• Review existing analytic metrics for effectiveness and make recommendations for the metrics

• Review existing reports for effectiveness and make recommendations for reporting content

• Provide expertise for project reporting as well as portfolio reporting for the divisions.

• Support ad hoc and ongoing analysis and reporting of data for OCIO and stakeholders to support enterprise architecture planning, governance, compliance, and knowledge management activities.

3.19 TASK NINETEEN. Knowledge management, communications, and graphics support

The Contractor shall provide knowledge management, communications, and graphics support activities to the OCIO. These include the following:

• Development of communication artifacts such as emails, newsletters, surveys to increase knowledge and engagement of stakeholders as well as identify potential new clients.

• Create information packets, presentations, and informational one page “slick sheets” to increase awareness of OCIO programs to increase adoption.

• Create graphics for web and print media.

• Update existing repositories of information to encourage sharing, re-use and adoption of specific OCIO initiatives.

• The contractor shall assist/draft communication materials in the form of briefings, white papers, slick sheets, web sites, etc. to promote DHS data standards, insights practices and guidelines.

• The contractor shall provide on demand strategic advisory insights, recommendations, and guidance to set and establish the DHS data strategic direction. Assist/draft strategic plans, roadmaps documents, policies, communications, directives and briefs for Department wide use and visibility. The contractor shall assist in the development of executive level communications and materials for DHS executive leadership.

• Assist/draft and publish approved DHS enterprise strategic documents and guidance - The contractor shall provide on demand strategic advisory insights, recommendations, and assistance and recommendations to set and establish the DHS data strategic direction.

Assist/draft strategic plans, roadmaps documents, policies, communications, directives and briefs for Department wide use and visibility. The contractor shall assist in the development of executive level communications and materials for DHS executive leadership.

3.20 TASK TWENTY. Data Standardization, Quality, Business Intelligence, and Analytic Support

The Contractor shall assess the type, quantity, and quality of data in order to verify that the data is suitable for its intended purpose. The Contractor shall assess the source of data and its refresh rates to determine where the source systems are for the data and how frequently the data is updated.

The Contractor shall provide the ability to perform Extract Load and Transformation that includes the ability to output data in the format that is required for the system, data store, service or application.

The Contractor shall support system integration and reporting capabilities to illustrate data and information sharing with technologies used for the data analysis and management of business information. Common functions of business intelligence technologies include reporting, online analytical processing, analytics, dashboard development, data mining, process mining, complex event processing, business performance management, benchmarking, text mining, predictive analytics, and prescriptive analytics.

3.21 TASK TWENTY-ONE. Electronic Content Accessibility Support

The Contractor shall conduct Section 508 evaluation and perform document remediation for electronic documents and forms (including Microsoft Office, current version, and Adobe PDF). The Contractor must use the Accessibility Tests for Documents endorsed by the Federal CIO Council Community of Practice.

The Contractor shall provide technical assistance via one-on-one, classroom, onsite and/or remote delivery on how to evaluate and perform document remediation for electronic documents and forms ((including Microsoft Office and Adobe PDF).

3.22: TASK TWENTY-TWO. Accessibility Subject Matter Support

The Contractor shall provide Section 508 technical assistance and respond to Section 508 questions that arise throughout the planning, acquisition, design, and development process, consistent with the DHS accessibility technical, life cycle, and service delivery model guidance, including assisting project teams with:

• Identifying the level of accessibility risk and potential user impacts for ICT to be provided through project activities.

• Identifying what activities are necessary to address Section 508 in the planning process.

• Identifying applicable Section 508 requirements for ICT deliverables.

• Addressing accessibility requirements in market research and alternatives analysis.

• Incorporating the needs of users with disabilities in customer and user experience design activities.

• Advising on how to use accessible design standards, pattern and code libraries, developer accessibility technical guidance and accessibility testing tools.

• Developing accessibility test plans.

• Advising on how to interpret accessibility test results and remediate Section 508 defects.

• Identify an alternative means of access to product functionality until full Section 508 compliance can be supported.

• Advising on the Section 508 review of IT products going through the department’s enterprise architecture and network service change processes.

• Preparing for SELC gate reviews

3.23 TASK TWENTY-THREE. Accessibility Compliance Support

The Contractor shall identify appropriate information resources to support internal and external reporting requirements.

• The Contractor shall perform DHS Component Section 508 Program Health Assessments, that identify how consistently, and effectively Component Section 508 Program follow DHS policies and procedures for obtaining Section 508 Program Maturity, provide recommendations for improvement, and provide executive level reporting of performance metrics, issues, and recommendations.

• The Contractor shall review and interpret web accessibility test results based on automated scans, compare automated test rule sets and remediation guidance to DHS compliance testing methodologies, conduct trend analysis, and produce reports of findings and recommendations tailored to multiple audiences (including executives, Section 508 Program Managers, and web teams).

3.24 TASK TWENTY-FOUR. Technical Editor Support

The Contractor shall provide expert technical editing support for communications, web content, and other technical resources, including editing for plain language, active voice, appropriate level of detail, consistency, and effective content organization to ensure readability and improve ease of understanding by target audiences.

3.25 TASK TWENTY-FIVE. Operational and Maintenance

The vehicle will provide O&M support for the applications. This operational support will encompass general support of maintenance, bug fixes, enhancements, which includes support of all new and existing systems and their data sources, database support, user management, reporting support, and system administration. In close coordination with OCIO direction, the Contractor shall provide staffing to perform the following activities, as assigned by the Government (see Section 5.9 for all existing BSD systems).

• Provide O&M based on industry standards and best practices, while being able to adjust and tailor accordingly based on the Government’s methodology and requirements.

• Provide recommendations for improvements, as appropriate.

• Troubleshooting and configuration of ServiceNow and Microsoft Power Platform and

Dynamics 365 apps

• Provide O&M for ServiceNow and Microsoft-based applications previously built by

DHS OCIO

Software development changes to OCIO applications are based upon the submission and approval of system change request (SCR) or user story. The Contractor shall be responsible for documenting, tracking, and implementing SCRs.