Swaps Services Draft SOW - 2020-09-29.docx

STATEMENT OF WORK

DATE

TITLE: Securities Based Swaps Data Services; Securities Based Swaps Market Surveillance Services

Primary Contracting Officer's Representative (COR):

Name:

Address:

Voice:

Fax:

Email:

Alternate COR:

Name:

Address:

Voice:

Fax:

Email:

l. BACKGROUND

The Securities and Exchange Commission (SEC) is an independent federal agency lead by a bipartisan five-member Commission. It consists of a number of divisions and offices, among them the [Office / Division Name], and regulates certain U.S. financial markets, including markets for various derivative financial instruments, among them a type of derivative known as security-based swaps (“SBS”).

The SEC’s Regulation SBSR (17 CFR 242.900 et seq.) governs regulatory reporting and public dissemination of SBS transactions and is expected to become operative in early November 2021. Regulation SBSR will require:

· Creation of registered security-based swap data repositories (“SDR’s”)

· Reporting of each SBS transaction to a registered SDR

· Provision of direct electronic access to SDR’s by the Commission (or any designee of the Commission)

Whereas the mission of the SEC is to protect investors; maintain fair, orderly, and efficient markets; and facilitate capital formation, effective monitoring and surveillance of the SBS market is essential. Under SBSR, access to SBS transaction data held in registered SDRs by the SEC and its designees will enable those capabilities, thus facilitating investor protection and maintenance of a fair, orderly and efficient market for SBS derivative instruments.

In order to implement an effective and efficient monitoring of the SBS market [Office / Division Name] requires effective, efficient and secure automated information technology (IT) solutions that:

· (1) Receive, ingest, store, process, normalize, and enrich SBS data that are received and maintained by registered SDRs;

· (2) Provide SBS data and reports to the SEC; and/or

· (3) Support operation of services performing market monitoring and surveillance of the SBS market on the Commission’s behalf, based on the transaction data obtained from registered SDRs.

Thus, the work described in this Statement of Work (“SOW”) implements requirements that relate to similar efforts at the [Office / Division Name] and other SEC Offices and Divisions to collect, store, analyze, and share financial market monitoring and surveillance data in order to detect anomalies and protect investors.

Optimally, the [Office / Division Name] is interested in solutions that provide a suite of integrated IT capabilities that address the requirements of all three of the above items. It is recognized, however, due to the novelty and/or uniqueness of those requirements, vendors may be capable of responding to only a subset and/or may have developed new or innovative approaches, techniques and/or architectures not having a demonstrated record of use. In such cases, [Office / Division Name] will consider, based on the same pricing and technical factors which would be applied to a thoroughly integrated solution, proposals to perform parts of this SOW, provided that the vendor presents in their proposal an acceptable and feasible technical approach and plan to integrate that part of the solution into an overall solution addressing the entirety of the requirements of the three areas, together with appropriate and complete related pricing information; and, will also consider new or innovative approaches, techniques and/or architectures leading to a superior solution which are likewise supported by appropriate, adequate technical exposition and pricing documentation.

Furthermore, while [Office / Division Name] is interested in receiving responses from established vendors of financial regulatory data platforms and existing market surveillance solutions, provided by one or more vendors that have shown demonstrated track record(s) of robust data protection and storage of sensitive regulatory data systems and managed services, responses from vendors able to provide new, innovative, more powerful, and/or more cost effective monitoring and surveillance architectures, products or services are most welcome. In all cases, the solutions proposed in response to this SOW must provide fully managed, robust and secure services suitable for use with sensitive regulatory information that meet or exceed the SEC’s security requirements, including the controls described by the National Institute of Standards and Technology (“NIST”) Special Publication 800-53.

2. OBJECTIVES

Overview The ultimate purpose and objective of the efforts described in this SOW is the development and deployment of a suite of IT solutions that provide rapid, effective, secure, insightful monitoring and surveillance of the SBS market with the interrelated objectives of detecting trading anomalies, providing market analytics and reporting of market activities.

Goals The goals of the efforts performed under this SOW encompass development and deployment of a comprehensive, efficient and cost-effective monitoring and surveillance IT services suite to support SBS market analytics, activity analysis and trading anomaly detection in furtherance of the SEC missions to protect investors and to maintain fair, orderly, and efficient markets. They are:

· Development, operation, maintenance, hosting and securing of a data and/or platform service that receives, ingests, processes, and stores SBS data from each registered SDR, normalizes and consolidates those data, conducts analytics, and compiles and provides reports based on those data to the SEC

· Development and deployment of data and/or platform services using industry best practices to pull and/or receive, normalize, and consolidate SBS data, as well as services that analyze the data, detect patterns, and generate reports

· Operation of services in compliance with industry standard service level agreements

· Maintenance of services and tools in compliance with rule requirements and consistent with SEC needs

· Hosting of the services in a high-performance, secure environment supplying compute and storage capabilities capable of matching demands

· Provision of capabilities to receive, ingest and process SBS data from multiple registered SDRs on an intraday basis consistent and in harmony with the Commodity Futures Trading Commission’s (“CFTC”) processes for obtaining swap transaction data from CFTC-registered SDRs

· Provision of capabilities for normalization of SBS data from registered SDRs, compliant with SEC schemas and technical requirements on a batch/micro-batch intraday basis

· Operation of services to verify, validate, correct, recollect and reprocess SBS data from the registered SDRs

· Provision of facilities to produce reports on matters such as identifying improperly filed transaction reports (e.g., missing or invalid data fields, late reports, etc.) and other anomalous data, and showing updated and corrected transaction reports along with associated data lineage

· Provision and maintenance of web services that produce human readable (e.g., JavaScript Object Notation/JSON, Comma Separated Values file/CSV) response formats of SBS data extracts utilizing industry best practices, (e.g., Representational State Transfer/RESTful, Python language application programming interface/APIs)

· Provision and maintenance of Web services that produce human readable (e.g., JSON) responses to requests for metadata and reference data including, but not limited to data inventory, lineage and error correction statuses

· Development and deployment of, and provision of support for, capabilities to, on an ad-hoc or periodic basis, receive, ingest and process batch supplemental data from other U.S. regulators such as the CFTC or international swap regulators

· Provision of capabilities to, contingent upon the terms of relevant information-sharing arrangements to be concluded and specified at a future date, combine SBS data with swap data from CFTC-registered SDRs and/or foreign regulators and trade repositories

· Provision of access and delivery of raw, normalized and enriched data sets to the SEC and authorized regulators on a continuous, on-demand basis

· Provision of customized reports and dashboards to the SEC and authorized regulators on a continuous, on-demand basis

· Development, operation and maintenance of SBS market monitoring and surveillance services based on the SBS data from registered SDRs

· Provision of capabilities to identify patterns, and provide actionable tips, alerts, and reports concerning potential securities law violation (e.g., insider trading) to the SEC, and support SEC queries of the relevant transaction reports;

· Recommend enhancements and provision of customization and continuous improvement of SBS monitoring and surveillance patterns, algorithms, models and approaches in cooperation with SEC staff and authorized regulators

· Development and deployment of a solution secured with FISMA moderate controls, and preferably using FedRAMP products. The solution will incorporate best practices for system vulnerability testing and related mitigations, oversight from a highly qualified and accredited Chief Information Security Officer, and best-in-class secure access monitoring tools

3. SCOPE

The scope of this SOW is limited to the development, deployment, operation and maintenance of a suite of integrated IT solutions addressing the high level requirements associated with the materials presented in the Background and Objectives sections of this document, and the management activities necessary to perform oversight and control of those efforts. In particular, the scope of each of those elements is as follows:

· Solution Development Planning and Management The scope of planning for and managing the activities described in this SOW will be limited to expenditure of the management labor hours necessary to provide program, project and task oversight during execution of the activities pertaining to development of the solutions described in this SOW; and, preparation of the following deliverables and the management labor hours necessary to produce them:

1. Project Charters

2. Project Plans

3. Project Schedules

4. Project Review Meeting Materials

5. Project Review Meeting Minutes

6. Project Closeout Materials

· Solution Requirements Analysis and Specification The scope of the requirements analysis and specification of the solutions described in this SOW shall be limited to documentation of the software and system requirements to implement each of those features, prepared in a format appropriate to the development methodology determined (e.g., Software Development Lifecycle, Agile, Hybrid). The scope of the associated activities shall be limited to gathering, analyzing, organizing and reporting those requirements in the format determined.

· Solution Development The scope of the development effort for the solutions described in this SOW shall be limited to the interpretation of the requirements gathered, analyzed and documented in the Solution Requirements Analysis and Specification necessary to construct system designs and write detailed instructions sufficient to allow qualified professionals to produce operating computer code implementing those requirements; and, the production of that computer code using the tool sets determined by Solution Planning to be the best available environment for computer code product development.

· Solution Testing and Quality Control The scope of the testing effort for the solutions described in this SOW shall be limited to the production of the unit, module, integration and system testing artifacts necessary to determine proper function of the computer code produced such that the code function is traceable to and implements the requirements documented; the planning of such testing; the execution of such testing; the reporting of any errors, discrepancies or anomalies observed during such testing; and, the resolution of those errors, discrepancies or anomalies by defined, repeatable processes executed by a Test Incident Review Board or similar body and utilizing project personnel as appropriate to achieve a level of error-free operation and system availability as defined in Service Levels determined between SEC and the vendor during Solution Development Planning and Management.

The scope of the quality assurance effort for the solutions described in this SOW shall be limited to the review of project artifacts for their correctness, clarity and freedom from technical error, the maintenance and management of project artifact version and configuration; the maintenance of solution development coding, testing, staging and production environments; and, the preparation, maintenance and reporting of project quality assurance plans, artifacts and records.

· Solution Deployment The scope of the deployment effort for the solutions described in this SOW shall be limited to the activities necessary to plan, coordinate and execute the transfer of project solution software objects from coding, testing and staging environments; the installation into and general functional testing of solution software objects in the production environment after installation; and, those activities necessary to return the production environment to the state preceding any installation if necessary; such deployment activities to be carried out in either a discrete or continuous integration/continuous deployment mode, as determined by mutual agreement between SEC and the vendor.

· Solution Operation and Maintenance The scope of the operations and maintenance effort for the solutions described in this SOW shall be limited to the routine, daily operation of solution software deployed on behalf of the SEC to the designated production environment, whether on-premise or in the cloud, and whether SEC- or contractor-maintained; the production and storage of system and data backup copies; coordination with the solution deployment team to install any necessary software corrections (“patches”) or version updates; the performance, as directed by SEC, of disaster response and recovery drills and exercises; and, as necessary performance of actual disaster response and recovery of the SBS solution software and data.

4. SPECIFIC TASKS

This section presents the SOW tasks as the high-level components of a Work Breakdown Structure (“WBS”), to which prospective vendors should respond by expanding upon each at a level of detail sufficient for technical evaluation of the proposed approach and methods. To the greatest extent possible, prospective vendors should respond by considering and presenting what they propose, when and where the activities to achieve that proposed outcome will be performed, and how those outcomes are to be achieved, using the initial task descriptions as guidance.

1. Task 1: Solution Development Planning and Management Under this task, all necessary planning, management and execution oversight for the remaining tasks in the SOW will be performed. The following sections present the major deliverables identified in Section 3, Scope and discuss their preparation and provision to the Government.

1.1. Project Charters

The actions performed in the execution of this SOW must be organized into one or more projects. For each such project, a project charter must be prepared, presenting, at a minimum, the project business case, a rationale for execution of the project, identification of project stakeholders, team members, managers and leaders, and a communications plan.

1.2. Project Plans

Each project performed under this SOW must have a project plan prepared for it, presenting, at a minimum, (a) a project work breakdown structure (WBS) specifying and describing the tasks which comprise the project together with statements of (b) estimated staffing and (c) levels of effort (LOEs), in labor hours, necessary to complete those tasks. Project plans must also include (d) a risk management plan which identifies salient risks and strategies for their mitigations and (e) a project schedule, described more fully in the next section. Each project plan must also clearly indicate (a) the technical approach(es) to be used to execute the project WBS tasks; (b) present the development methodology to be employed and the rationale for its use; and, (c) the nature of significant agreements between the SEC and the vendor pertaining to issues such as service levels, test incident resolution or, for example, in cases where Agile methodology is employed, a mutually agreed Definition of Done.

1.3. Project Schedules

Each project performed under this SOW must have a project schedule that indicates the temporal and precedence relationships of the tasks which constitute the project WBS. Where the project is part of a larger program, the schedule must be prepared in such a manner as to allow for it to be readily integrated with a master program schedule. Schedules should either follow defined SDLC project phase gates, a well ordered arrangement of Agile sprints or another scheduling paradigm consistent with another development methodology, should that be selected instead.

1.4. Project Review Meeting Materials

Project schedules must include regular project review meetings, to be held no less than once a month and to include the major client stakeholders. Appropriate materials to be prepared for such meetings for presentation to stakeholders include slide presentations and graphics depicting project status, progress, expenditures, completion and projected activities for future periods.

1.5. Project Review Meeting Minutes

Formal minutes of each project review meeting are required deliverables. Such minutes must include a list of attendees, an agenda and a record of the proceedings that reflects any and all decisions made.

1.6. Project Closeout Materials

Upon completion of each project, materials documenting that completion must be prepared, and include final accountings of resource expenditures and the materials and minutes of a Lessons Learned Review meeting.

2. Task 2: Solution Requirements Analysis and Specification Under Task 2, the requirements for SBS monitoring and surveillance solutions will be gathered, analyzed, defined and specified in forms of documentation consistent with the development methodology (e.g., SDLC, Agile, Hybrid) determined in Task 1.

2.1. Requirements for Receipt, Ingestion and Processing of SBS Data Under this task, the requirements will be determined for implementing a secure platform and/or service that receives, ingests and processes and hosts? SBS data from each registered SDR, normalizes and consolidates those data, conducts analytics, and compiles and provides reports based on those data to the SEC, providing additional capabilities for (a) normalization of SBS data from registered SDRs, compliant with SEC schemas and technical requirements on a batch/micro-batch intraday basis; (b) capabilities to receive, ingest and process SBS data from multiple registered SDRs on an intraday basis consistent and in harmony with the Commodity Futures Trading Commission’s (“CFTC”) processes for obtaining swap transaction data from CFTC-registered SDRs; (c) provision of support for capabilities to, on an ad-hoc or periodic basis, receive, ingest, normalize, and process batch supplemental data from other U.S. regulators such as the CFTC or international swap regulators; and, (d) access and deliver raw, normalized and enriched data sets to the SEC and authorized regulators on a continuous, on-demand basis.

2.2. Requirements for SBS Trading Pattern and Anomaly Detection Under this task, the requirements will be determined for implementing the capability to perform automatic identification of behavioral patterns in SBS trading, provide alerts, actionable tips and reports as to possible inappropriate or illegal actions, and to support SEC queries of the relevant transaction reports, with additional provision of facilities to (a) produce reports to the SEC on matters such as identifying improperly filed transaction reports (e.g., missing or invalid data fields, late reports, etc.); (b) show updated and corrected transaction reports with their data lineage.

2.3. Iterative Requirements Gathering and Analysis for Customization and Continuous Improvement of SBS Monitoring and Surveillance In order to provide continuous improvement of SBS monitoring and surveillance, an iterative process of requirements gathering and analysis, using, in accordance with the development methodology selected in Task 1, such techniques and sources are appropriate to it, will be conducted, with regular transmission of those requirements to the solution development team for implementation, testing and deployment in defined, scheduled releases of the solution software. Such iterative requirements analysis will include but not necessarily be limited to SBS monitoring and surveillance patterns, algorithms, models and approaches, and be conducted in cooperation with SEC staff and authorized regulators.

2.4. Requirements for SBS Monitoring and Surveillance Web Services and Interfaces Under this task, the requirements will be determined for capabilities that will provide SEC with SBS monitoring and surveillance Web services that (a) produce human readable (e.g., JSON, CSV) response formats of SBS data extracts utilizing industry best practices, (e.g., RESTful, Python APIs); (b) produce human readable (e.g., JSON) responses to requests for metadata and reference data including, but not limited to data inventory, lineage and error correction statuses; and, (c) provide customized reports and dashboards to the SEC and authorized regulators on a continuous, on-demand basis.

2.5. Requirements for SBS Information Sharing and Combination Under this task, requirements will be determined for features that provide SEC with capabilities to, contingent upon the terms of relevant information-sharing arrangements to be concluded and specified at a future date, combine SBS data with swap data from CFTC-registered SDRs and/or foreign regulators and trade repositories.

2.6. Requirements for Solution Security Features

Under this task, requirements will be determined to provide solution security consistent with FedRAMP and FISMA moderate-level compliant controls, using best practices for system vulnerability testing and related mitigations; incorporating planned oversight from a highly qualified and accredited Chief Information Security Officer; and, employing best-in-class secure access monitoring tools.

3. Task 3: Solution Development Under Task 3, solutions will be developed via interpretation of the requirements gathered, analyzed and documented in Task 2, Solution Requirements Analysis and Specification to an extent necessary for the construction system designs and the writing of detailed instructions sufficient to allow qualified professionals to produce operating computer code implementing those requirements; and, subsequently, via the production of that computer code using the tool sets determined by Solution Planning to be the best available environment for computer code product development.

3.1. Receipt, Ingestion and Processing of SBS Data

Based on the requirements determined in Task 2, designs and code implementing a secure platform and/or service that receives, ingests and processes SBS data from each registered SDR, normalizes and consolidates those data, conducts analytics, and compiles and provides reports based on those data to the SEC will be constructed, providing additional capabilities for (a) normalization of SBS data from registered SDRs, compliant with SEC schemas and technical requirements on a batch/micro-batch intraday basis; (b) capabilities to receive, ingest and process SBS data from multiple registered SDRs on an intraday basis consistent and in harmony with the Commodity Futures Trading Commission’s (“CFTC”) processes for obtaining swap transaction data from CFTC-registered SDRs; (c) provision of support for capabilities to, on an ad-hoc or periodic basis, receive, ingest and process batch supplemental data from other U.S. regulators such as the CFTC or international swap regulators; and, (d) access and deliver raw, normalized and enriched data sets to the SEC and authorized regulators on a continuous, on-demand basis.

3.2. SBS Trading Pattern and Anomaly Detection

Based on the requirements determined in Task 2, designs and code will be developed to provide the capability for automatic identification of behavioral patterns in SBS trading, provide alerts, actionable tips and reports as to possible inappropriate or illegal actions, and to support SEC queries of the relevant transaction reports with additional provision of facilities to (a) produce reports to the SEC on matters such as identifying improperly filed transaction reports (e.g., missing or invalid data fields, late reports, etc.); (b) show updated and corrected transaction reports with their data lineage.

3.3. Customization and Continuous Improvement of Monitoring and Surveillance Based on the ongoing, iterative requirements analysis including but not limited to SBS monitoring and surveillance patterns, algorithms, models and approaches, conducted in cooperation with SEC staff and authorized regulators described in Task 2, designs and code will be developed which allow for customization and continuous improvement of monitoring and surveillance features of the solution software.

3.4. SBS Monitoring and Surveillance Web Services and Interfaces Based on the requirements determined in Task 2, designs and code will be developed to provide SEC with SBS monitoring and surveillance Web services that (a) produce human readable (e.g., JSON, CSV) response formats of SBS data extracts utilizing industry best practices, (e.g., RESTful, Python APIs); (b) produce human readable (e.g., JSON) responses to requests for metadata and reference data including, but not limited to data inventory, lineage and error correction statuses; and, (c) provide customized reports and dashboards to the SEC and authorized regulators on a continuous, on-demand basis.

3.5. SBS Information Sharing and Combination

Based on the requirements determined in Task 2, designs and code will be developed to provide SEC with capabilities to, contingent upon the terms of relevant information-sharing arrangements to be concluded and specified at a future date, combine SBS data with swap data from CFTC-registered SDRs and/or foreign regulators and trade repositories.

3.6. Solution Security Features

Based on the requirements determined in Task 2, designs and code will be developed to provide a solution security consistent with FedRAMP and FISMA moderate-level compliant controls, using best practices for system vulnerability testing and related mitigations; incorporating planned oversight from a highly qualified and accredited Chief Information Security Officer; and, employing best-in-class secure access monitoring tools.

4. Task 4: Solution Testing and Quality Control Under Task 4, solutions developed under Task 3 will be tested to verify that the solutions meet and are traceable to the requirements for them defined in Task 2. The configuration and versioning of software and database objects comprising the solutions developed under this SOW will also be maintained under Task 4, as will be the quality of all documentation produced thereby.

5. Task 5: Solution Deployment Under Task 5, solutions developed under Task 3 and tested under Task 4 will be deployed from the solution staging environment to the SEC production environment. Industry best practices will be used to deploy solutions that (a) pull and/or receive, normalize, and consolidate SBS data; (b) services that analyze the data, detect patterns, and generate reports of those analyses and patterns; and, (c) provide support for capabilities to, on an ad-hoc or periodic basis, receive, ingest and process batch supplemental data from other U.S. regulators such as the CFTC or international swap regulators. All deployments must observe and be compliant with FedRAMP and FISMA moderate-level compliant controls, including (a) best practices for system vulnerability testing and related mitigations; (b) oversight from a highly qualified and accredited Chief Information Security Officer; and (c) best-in-class secure access monitoring tools.

6. Task 6: Solution Operation and Maintenance Under Task 6, deployed SBS monitoring and surveillance solutions will be operated and maintained as well as backed up on a regular basis and recovered from disasters when necessary, in compliance with industry standard service level agreements. Solution operation and maintenance will include hosting and securing of data and/or platform services that (a) receive, ingest and processes SBS data from each registered SDR; (b) normalize and consolidates those data; (c) conduct analytics; (d) compile and provide reports based on those data to the SEC; (e ) operate services to verify, validate, recollect and reprocess SBS data from the registered SDRs; (f) host the services in a high-performance environments supplying compute and storage capabilities capable of matching demands; (f) are services and tools supporting solution development; (g) are Web services that produce human readable (e.g., JSON, CSV) response formats of SBS data extracts utilizing industry best practices, (e.g., RESTful, Python APIs); (h) are Web services that produce human readable (e.g., JSON) responses to requests for metadata and reference data including, but not limited to data inventory, lineage and error correction statuses; (i) are SBS market monitoring and surveillance services based on the SBS data from registered SDRs; or, (j) provide support for capabilities to, on an ad-hoc or periodic basis, receive, ingest and process batch supplemental data from other U.S. regulators such as the CFTC or international swap regulators.

5. DELIVERABLES/DELIVERY SCHEDULE

State the deliverables and due date for each deliverable by a task(s) THINK: what, when, where, how, format, medium.

Data Requirements: All deliverables shall be formatted by the contractor. All deliverables shall be prepared using Microsoft Office Suite applications. All deliverables shall be delivered electronically to the COTR.

6. GOVERNMENT-FURNISHED EQUIPMENT (GFE}/GOVERNMENT FURNISHED INFORMATION (GFO

Identify any GFE or GFI that will be provided to the contractor.

7. SECURITY

State the appropriate security requirements for the work to be performed; i.e., Unclassified, Confidential, Secret, Top Secret.

Recommend seeking guidance from the security office

8. PLACE OF PERFORMANCE

Specify whether the work to be performed is Government cite or contractor site

9. PERIOD OF PERFORMANCE

Specify the period of performance; e.g., 365 calendar days, base year with 4 option years, etc.

1 0. OTHER CONSIDERATIONS

State anything not covered in the previous paragraphs; e.g., travel.