1.2.1-RFI_SESS PWS.docx

U.S. Department of Homeland Security Immigration and Customs Enforcement (ICE)

ICE TECS MODERNIZATION STABILIZATION, ENHANCEMENTS AND SUSTAINMENT SUPPORT (SESS)

Performance Work Statement (PWS)

Office of the Chief Information Officer (OCIO) 801 I Street, N.W.

Washington, D.C. 20536 ICE TECS MODERNIZATION STABILIZATION, ENHANCEMENTS AND SUSTAINMENT SUPPORT (SESS) PWS

Contents

(P00011 Awarded Option) Post deployment of the DRM system with Initial Operating Capabilities (IOC)

Post deployment of the DRM system with Initial Operating Capabilities (IOC) . 29 6 3.4 The contractor shall support any surge DRM Tier 2

1.0 BACKGROUND

The U.S. Immigration and Customs Enforcement (ICE) Homeland Security Investigations (HSI) is the principal investigative arm of DHS and the second largest investigative agency in the Federal government. HSI’s primary mission is to promote homeland security and public safety through the criminal and civil enforcement of Federal laws governing border control, customs, trade, and immigration.

HSI is continuing the process of transforming the Agency’s Information Technology (IT) investment approach and processes for acquiring and delivering enhanced investigative capabilities to its 9,500-person global workforce. To this end, the ICE TECS Modernization Program has created an information technology solution that provides a broad set of mission focused functions as a replacement for the Customs and Border Protection (CBP)-managed legacy TECS system. This ICE TECS Modernization system now provides the core toolset used by HSI agents worldwide to develop and document their criminal investigations. Its functionality includes:

· Case Management – management of information relevant to investigative cases, including investigative reports and approval workflows

· Subject Management – management of information relevant to the various subjects under investigation, including people, businesses, vehicles, etc. and includes the sharing of subject information with CBP for lookout and seizure tracking purposes

· Search – ability to conduct unified searching across multiple systems both internal and external to ICE, primarily regarding subject-related information, around, and in support of investigative processes as well as supplying this data to additional consuming systems within ICE (eg. FALCON, LEISS, etc.).

· Data Warehousing – ongoing management of an HSI data repository which supports both the routine and ad hoc reporting needs of ICE/HSI as well as the sharing of permitted information with external international, national, state and local/tribal law enforcement agencies

Investigative Case Management’s (ICM) Initial Operating Capabilities (IOC) were delivered to HSI on June 26, 2016, and have been followed by regularly scheduled (monthly) enhancement/bug fix releases resulting in delivery of the Full Operating Capability (FOC) on August 20, 2017. Regularly scheduled enhancement/bug fix releases, in support of operations and maintenance (O&M), have and will continue.

ICE Office of the Chief Information Officer OCIO and ICE HSI desire to continue to enhance the culture of innovation developed during the delivery of ICE TECS Modernization, where the needs of the investigative personnel can be quickly realized, often within a matter of weeks. Continuing improvements to ICE’s Agile efforts will be enabled via the recent (December 2018) adoption of ICE cloud-based hosting and the ICE Development/Operations (DevOps) toolkit, as well as the continued leveraging of a business-centric approach to system design, which optimizes the adoption of common functionality and reduces the overall complexity associated with systems maintenance.

2.0 SCOPE OF WORK

The scope of this effort includes employing proven Agile Software Development techniques to deliver, maintain, and manage ICE TECS Modernization systems functionality in support of HSI’s mission by identifying, investigating, tracking, and documenting offenses against Federal Law in the areas of border control, customs, trade, and immigration. As such, the Contractor shall provide enhancement and O&M support services for each of the following components in ICE TECS Modernization using an Agile-driven approach:

· Solutions Integration

· Interfaces Support

· Data Warehouse Support

· Infrastructure Engineering and Configuration Management Support

· Security Engineering Support

· Digital Records Management Support

· OPTIONAL TASKS:

· Ingestion of New Data Sources in Data Warehouse

· Connecting to New Data Sources

· Providing data to new destinations (Interfaces)

· Providing Surge Support These activities are expected to continually align and evolve with full consideration of all ICE privacy and information assurance policies, regulations and guidelines pertaining to the creation, maintenance, and operation of systems technology.

The ICE TECS Modernization program is conducted under the direct oversight of ICE OCIO and the Executive Sponsor, HSI. The program is currently organized into an ICE TECS Modernization Program Office and a series of Integrated Project Teams (IPTs). Each IPT focuses on a critical portion of the program. An IPT is comprised of a Government team leader who is accountable for the team mission, objectives and deadlines, and contractor IPT members who are key stakeholders owning responsibility for accomplishing a portion of the IPT’s objectives.

IPTs will be created, maintained and/or decommissioned based on program progression and agile adoption and evolution. Continuous coordination and communication between the various teams is essential and critical to the success of the program. The IPT structure provides defined roles and responsibilities to ensure accountability, enhance communication within the project, and enable more effective tracking of program goals and objectives by management. The IPTs work together to ensure that risks and issues are identified, addressed, and elevated when necessary. IPTs will require interaction with external project teams periodically, both inside and outside of ICE, when Program requirements depend upon such collaboration to accomplish system-to- system or external interface integration with ICE TECS MOD.

The Offeror shall support these IPTs as required, as well as provide feedback on areas to adapt, evolve, and further align to the agile framework in support of Program deliverables to the mission. The structure of the ICE TECS MOD Program currently includes the following IPTs:

· Requirements

· Investigative Case Management (ICM)

· Interfaces/Data Migration

· Data Warehouse

· Technical Infrastructure

· Training and Communications

This PWS’s scope covers work performed within the Requirements, Interfaces/Data Migration, Data Warehouse, and Technical Infrastructure IPTs, as explained in more detail below. The Test and Evaluation Support, identified on the previous page as being within the scope of this requirement, will not be formally structured as an IPT but distributed across the Requirements, Investigative Case Management (ICM), Interfaces/Data Migration, Data Warehouse and Technical Infrastructure IPT’s in a fashion most appropriate to the Agile methodology. The ICM and Training and Communications IPTs are outside the scope of this PWS.

3.0 OPERATING ENVIRONMENT

As of mid-December 2018, the ICE TECS Modernization hosting environment for the components identified above consists of the AWS Govcloud (G-cloud) processing environment.

The following exhibit depicts the current ICE TECS Modernization overall systems architecture.

4.0 SYSTEM ARCHITECTURE

The graphic on the following page depicts the entirety of the current ICE TECS Modernization conceptual system architecture in a layered model view. To maximize portability and flexibility, ICE has standardized on a common architecture for all systems. This currently includes:

· Windows 7 (32-bit), Windows 8.1 (64-bit), and Windows 10 (64-bit) for Client Operating Systems

· Cross-browser functionality and compliance to include Internet Explorer 11, Microsoft Edge, Google Chrome, Firefox, and Safari

· iOS for Mobile Operating Systems (including mobile Safari)

· Bootstrap/AngularJS for responsive web design

· JBoss for application servers

· Spring/Hibernate for Java MVC framework

· Apache ActiveMQ for Web Services Transport

· NIEM for messaging specification in information exchanges

· Microservices software architecture

· Localization files for all text (to include multilingual support)

· REST for messaging protocol

· Informatica for Extract, Transform, and Load (ETL)

· Oracle (Transactional) / PostgreSQL or similar (Data Stores and Warehouses)

· Red Hat Linux (64-bit) for Server Operating Systems

As mentioned previously, ICE has transitioned current environments previously hosted at the DHS Data Centers to a FedRAMP compliant cloud environment, leveraging the following DevOps pipeline tools:

· Terraform and Chef for provisioning & configuration management

· GitHub, Maven (Nexus repository) and Jenkins for version control & deployment

· Nessu and Cloud watch (basic) for monitoring The AWS platform itself consists of EC2 instances, RDS instanced and E1Bs.

5.0 TASKS

The contractor shall provide qualified, experienced personnel to perform service and support for the continued operations, maintenance and enhancement of the systems, subsystems, databases and services of the stated ICE TECS MOD components and supporting architecture. The contractor shall deliver innovative, yet proven technology solutions developed and tested using an Agile driven approach capable of further enabling HSI’s investigative and case management capabilities.

The Government estimates that this PWS will require four (4) Integrated Program Teams composed of a total of Twenty-six (26) Full Time Equivalents (FTEs) in the Base Year (including Transition-In) and the four (4) subsequent Option Years.

5.1 Solutions Integration

The Solution Integration task includes Program oversight of the execution of requirements analysis, code development, testing, configuration, deployment, administration, monitoring, and maintenance of each identified ICE TECS MOD Component in this task order with an emphasis on insuring overall program communication, collaboration and integration among all of the Program’s operating components.

The Contractor shall provide integrated program management support, including personnel management, program reporting and cost management, technical risk and issue management, integrated scheduling, and technical oversight. The Contractor is also responsible for ensuring all code aligns with test-driven development and continuous integration best practices.

Additionally, as the Program is transitioning into O&M, the Contractor shall work closely with the Government IT Program Managers and HSI Product Owners to support continued enhancements, enhanced mission delivery capabilities and operational support activities better aligned to the Agile framework. Emphasis additionally needs to be maintained on supporting continuous integration and management within the DevOps pipeline, all to better support HSI’s mission needs.

The Contractor will provide release planning services that work closely with the Government IT Program Managers and HSI Product Owners to ensure streamlined, effective, and productive communications and work products. As part of this service, the Contractor shall provide a scrum master that leads and manages multiple sprints and their associated releases and helps evolve the Agile framework adoption within the Program. The scrum master shall provide management and oversight of the activities associated with sprint completion including:

· Creating product roadmaps;

· Maintaining the product backlog and agile release plans;

· Assisting the Product Owner to create user stories, and working with development teams to ensure story point sizing estimates are in place;

· Supporting the creation of architecture/design/process documents, as needed;

· Ensuring software components are using a test-driven approach;

· Establishing a daily/release scrum board within JIRA that can be easily shared with team members participating virtually, and;

· Establishing consistent use of agile practices across O&M support for contract to include enhancing current sprint/release deliveries and managing Tier II support activities and tasks.

User acceptance is based on the user stories mutually agreed upon by the Product Owner, Government Project Managers, and the Scrum Team. In addition, the Contractor shall be responsible for delivering applicable system documentation artifacts that contain business and technical information. The Contractor shall provide frequent updates to Atlassian JIRA (technical tasks, blockers, dependencies, story points, issue tracking), using the Program’s JIRA Handbook as reference and following the ICE Agile/DevOps Handbook. The Contractor shall provide applicable system documentation artifacts, as required, at each release unless a request for deviation has exempted them.

Overall, the Contractor shall support Solution Integration through key personnel, as outlined in this PWS, and the following functions:

· Program Management

· Technical Architecture

· Business Requirements

· Agile Development Coding Standards

· Data Design, Standards and Interoperability

· Quality Assurance

· User Interface/User Experience Design

5.1.1 Operations & Maintenance Support (Tier’s 2 & 3 Service Desk) The Contractor shall provide Tier 2 and 3 Operations and Maintenance Support for the specified ICE TECS MOD Components, which appear in Section 2.0 of this PWS. Support days/hours of operations will be 365x24x7, with normal business hours defined as 8:00 am until 8:00 pm Eastern Time, excluding Government Holidays. Tier 1 Service Desk Support will continue to be provided by the ICE Service Desk.

5.1.2 The Program’s expected service levels for Tier 2 responsiveness are as follows:

Tasks

Metric

Tier 2 Software Support

Tier 2 Software Support

Tier 2 Software Support

Tier 2 Software Support

placed in the Tier 2 queue for action to the time it appears as closed or referred, system, divided by the total number of tickets.

Tier 3 support will be utilized for tickets that are not impacting day to day operations and may require more complicated technical fixes or prioritization with other business requirements. Tier 3 support expected levels will be defined by component and by criticality as described below.

The Contractor shall provide technical resources available that have an understanding of how to assist Tier 2 resources in restoring the system to full operating capability. The Contractor shall perform analysis and apply, or coordinate the application of, appropriate corrective measures. After-Action summaries and any revised troubleshooting scripts for Tier 1 support must be completed within 7 business days of problem resolution/closure.

Tier 1 - Support for basic customer issues such as solving usage issues and fulfilling service desk requests that need IT involvement. If no solution is available, tier 1 personnel escalate incidents to a higher tier.

Tier 2 - Experienced and knowledgeable technicians assess issues and provide solutions for problems that cannot be handed by tier 1. If no solution is available, tier 2 support escalates the incident to tier 3.

Tier 3 - Technicians attempt to duplicate problems and define root causes, using product designs, code, or specifications. Once a cause is identified, the company decides whether or not to create a new fix, depending on what caused the problem. New fixes are documented for use by tier 1 and tier 2 personnel.

· Interfaces: The expected level of support needed for Tier 3 issues is an average of 8 issues per week, with resolution (which could take the form of a problem fix, transfer to appropriate non-PRIME support, creation of a User Story, Change Request, etc.) taking an average of 2 hours per issue. These may increase during release windows and/or integration issues caused by external parties that take additional time for research/support.

· Data Warehouse: The expected level of support needed for Tier 3 issues is an average of 5 issues per week, with resolution (which could take the form of a problem fix, transfer to appropriate non-PRIME support, creation of a User Story, Change Request, etc.) taking an average of 4 hours per issue. These may increase during release windows and/or integration issues that take additional time for research/support.

· Infrastructure Engineering: The expected level of support needed for Tier 3 issues is defined in the Infrastructure Playbook continually maintained by the Program. This can include routine-scheduled notifications of system performance daily, as well as responding to/resolving alerts of varying severity from automated monitoring tools or escalations from within the Program, outside components, and/or the ICE Incident Response Desk.

· Security Engineering: The expected level of support needed for Tier 3 issues is limited to security incidents escalated by the Program, ICE Incident Response Desk, outside components, and/or the DHS and ICE Systems Operations Center (SOC). These are not routine, nor common, though zero-day patches, critical infrastructure vulnerabilities, and significant application updates may require support within the scope of Tier 3 services.

· Digital Records Management: The expected level of support needed for Tier 2 issues in support of the DRM module IOC though FOC will increase the normal level of support provided by the contractor. Once FOC is complete the level of support needed for Tier 2 support of DRM will be within the O&M support guidelines. This support can include providing user issues above the skill level of Tier 1 support, including advanced inquiries and analysis and problem fixes. The expected level of support needed for Tier 3 issues post-FOC is an average of 10 issues per week, with resolution (which could take the form of a problem fix, transfer to appropriate non-PRIME support, creation of a User Story, Change Request, etc.) taking an average of 2 hours per issue. These may increase during release windows and/or integration issues caused by external parties that take additional time for research/support.

5.2 Interfaces Support

This task supports the operations and maintenance of the PRIME Interface Hub. PRIME communicates with systems external to the ICE TECS Modernization environment to accomplish all required data exchanges. The illustration on page 12 depicts the existing PRIME Architecture for internal and external sharing partners, and the existing Architecture stack. In general, PRIME accepts incoming requests from the Investigative Case Management (ICM) software solution (which, as mentioned previously, is outside the scope of this PWS) as well as other ICE consumers across both HSI and ERO with similar information sharing requirements. PRIME mediates incoming requests into subsequent requests for one or more external service providers. The general pattern implemented by the hub is to receive requests and quickly return a response that either provides acknowledgement that processing will proceed or that no back- end sources can be selected to service the request. If the request is supported, the PRIME hub directs a source-specific request to one or more providers and sends correlated asynchronous result messages back to the consuming ICM system. Results are not held nor aggregated but delivered as soon as provided by the backend provider. PRIME also monitors ICE and external partners for critical business events and automatically provides consumer information when subscribed to events are detected.

Statistically, PRIME handles, on average, 300K interface transactions weekly, with roughly 8% of those dispatching updated information to interfacing systems and the remaining 92% representing queries to external systems for information. This average number of weekly interface transactions has increased significantly as new ICE consumers of PRIME are introduced, and its processes are used more extensively. At present, PRIME accommodates 90 different interface types and 150 distinct operations.

The PRIME Interface track of TECS Modernization requires the Contractor to participate in IPTs comprised not only of resources from ICE‘s internal TECS Modernization program but also those individuals representing ICE’s DHS Internal and external (other International, Federal, State and Local/Tribal) data exchange partners.

The Contractor shall provide qualified personnel to support the operations and maintenance of the PRIME Interface Hub in order to provide the support necessary to ensure that the system operates as required, delivers to the Program Key Performance Parameters (KPPs) and within the bounds of established Service Level Agreements (SLAs). This includes:

· Implementation/operation of automated production service health monitoring measures and tools

· Support for trouble ticket responses from Tier 3 where necessary

· Defect correction when necessary

· Adding/Integrating additional services and endpoints as prioritized by the HSI customer when available within existing production data sources; or within the existing framework pattern for new data sources.

· Collaborating with other IPTs on the installation/management of required system software upgrades in support of the delivery architecture

· Providing Support for configuration changes

· Identifying and acting on opportunities to migrate to open-source software products/tools when practical and without loss of functionality

· Comparison of actual vs. estimated loads (number and volume of messages and data usage)

· Performance tuning, if necessary

· Utilize the Program’s established agile process and JIRA structure as required to capture and manage requirement, feature and problem tracking

· Support agile development approach with a focus on continuous integration and test-driven development

· Review, assess, and verify through use of test-driven development, automated regression, and manual testing (only where needed) release-candidates

· Document any software design or performance deficiencies in a defect tracking tool (i.e. JIRA, REMEDY) provided by the Government

· Capture interface activity in defined audit logs for reporting and internal investigative purposes

· Define and deliver using consistent sprint/release velocity

· Supporting 24x7 Tier 3 Help Desk as needed

User stories and tasks are prioritized by the Product Owner within each sprint planning session based on the stated velocity of each component, as identified by the development team.

Software currently used in the production solution, or in the development process is enumerated below, with a brief annotation as to its purpose. The contractor is responsible for assuming all operations and maintenance activities to support the PRIME Interface Hub, including existing technologies and enhancements/upgrades as needed.

· Servers:

· Red Hat Enterprise LINUX: Operating System

· Red Hat JBoss EAP:J2E Container

· Oracle 12: metadata and state database

· WebSphere MQ Queue Manager and Active MQ: asynchronous messaging

· Computer languages:

· Java: general programming language

· Spring Domain Specific Language (DSL): Camel route specifications

· XML: Message formatting

· XSD: XML Schema Specifications

· XSL/XSLT/XPATH: XML Message Mediation within Camel routes

· SQL: Structured Query Language for interaction with Oracle Database

· Frameworks:

· Apache Camel: mediation and routing

· Spring Core: Java enterprise runtime platform

· Spring Web Services: web service support

· Spring JMS: Underlying Camel JMS implementation

· log4j: logging

· Quartz: timed events

· Velocity: message templating engine

· Saxon: XML Parser

· Engineering tools:

· Red Hat JBoss Developer Studio

· Altova XMLSpy Mission Kit

· SmartBear soapUI

· Oracle SQLDeveloper and SQL*Plus

· Maven

· Jenkins continuous integration (CI) server

· Git for Source Control

JBOSS EAP and the IBM WebSphere MQ Queue Manager are each hosted on their own RHEL instances.

5.3 Data Warehouse

This task supports the analysis, reporting, and repository management of new and historical (legacy) subject records, cases, case reports, investigative referrals, case hours, and case and enforcement statistics. The case information within the HSI Data Warehouse includes some 20+ years of legacy data previously stored in legacy TECS and the CBP BEMS Data Warehouse (BDW), as well as CBP Legacy SEACATS data and the new ICM case management and accompanying data via a periodic feed (daily) from ICM. The ICE TECS Modernization HSI Data Warehouse also acts as the repository of HSI investigative and Case data made available to downstream applications for analytics and additional investigative purposes.

Software currently used in the production solution, or in the development process is enumerated below. The contractor is responsible for assuming all operations and maintenance activities to support the Data Warehouse, including existing technologies and enhancements/upgrades as needed.

User stories and tasks are prioritized by the Product Owner within each sprint planning session based on the stated velocity of each component, as identified by the development team.

The Contractor shall provide personnel qualified and experienced with the skills below to support the operations and maintenance of the HSI Data Warehouse (DW), including:

· Providing a highly skilled and experienced relational database administrator (DBA) to support all maintenance aspects of the HSI DW

· Providing analysts to structure and support complex reporting using COGNOS or a replacement BI Tool

· Maintaining the DW database schema to support business intelligence (BI) reporting, analytics, and complex queries of the data in the data warehouse

· Maintaining the ETL process for periodically refreshing the DW with changed data updates

· Maintaining data marts to support reporting requirements using Cognos or a replacement BI Tool

· Identifying and acting on opportunities to migrate to open source software products/tools when practical and without loss of functionality

· Supporting technology upgrades and transitions as needed to support the Program’s needs

· Maintaining and organizing physical data storage in a way that is scalable and optimized to meet performance requirements

· Supporting the deployment and operation of the DW in all environments

· Maintaining and supporting existing and new data sharing services with internal and external data partners. The Contractor shall support updates to system interfaces currently implemented due to DW changes or changes to data partner source systems.

· Review, assess, and verify through use of test-driven development, automated regression, and manual testing (only where needed) release-candidates

· Document any software design or performance deficiencies in a defect tracking tool (i.e. JIRA, REMEDY) provided by the Government

· Utilize the Program’s established agile process and JIRA structure as required to capture and manage requirement, feature and problem tracking.

· Support agile development approach with a focus on continuous integration and test-driven development.

· Capturing interface activity in defined audit logs for reporting and internal investigative purposes.

· Supporting the adoption and compliance to ICE’s enterprise data standards

· Define and deliver using consistent sprint/release velocity (using Fibonacci story point sizing)

· Supporting a 24x7 Tier 3 Help Desk as needed

· As needed, provide operational support in response to specific Office of Professional Responsibility (OPR) audit data analysis requests to include:

· Perform analysis of audit data across ICE TECS MOD program

· Summarize system activities associated with request

· Summarize data access and changes associated with request

· Provide detailed level reports of user activities and/or data extractions

· Provide assistance to OPR in generating of/understanding of/reporting on audit log entries

5.4 Infrastructure Engineering and Configuration Management Support

This task supports the Infrastructure Engineering and Configuration Management Support for the ICE TECS MOD Program, excluding the Software-as-a-service ICM component hosted in Amazon Web Services (AWS) -Cloud. The following depicts the existing ICE TECS Modernization Physical Architecture, from an infrastructure view.

The Contractor shall provide qualified personnel to support the Government in providing systems/infrastructure engineering, configuration management, and technical support to the program to include:

· Provisioning and managing infrastructure to support numerous environments and heterogeneous operating system platforms

· Performing software installation and configuration management, including databases, as needed and conduct software upgrades, systems patching and maintenance, as required

· Providing Configuration Management expertise to guide the program in Continuous Integration

· Utilizing existing tools to monitor system performance and response times, watching for related events impacting system performance

· Identifying and acting on opportunities to migrate to open source software products/tools when practical and without loss of functionality

· Providing customer support and troubleshooting of application performance and outage incidents, including assisting users in reviewing and analyzing system data

· Providing 24x7 status monitoring and on-call support for all infrastructure related issues

· Managing deployments, and facilitating development work where directory integration effort is required.

· Monitoring application logs, work tickets and performance metrics to ensure optimal operation of all environments.

· Confirming the integration of configuration items that have been readied for release

· Preparing and providing input to Program documentation following the existing processes and guidance as appropriate.

· Define and deliver using consistent sprint/release velocity (via Fibonacci story point sizing)

The overall scope of support categorized by areas includes the following:

Monitoring & Remedy Ticket Resolution

· Monitoring performance to identify and resolve potential issues before they can impact availability.

· External Interface Monitoring

· Monitoring & resolving Remedy issues assigned to infrastructure queue

· Continuously improving monitoring & alerting solution

· Managing software configuration baselines

· Deploying, configuring, and verifying software components

· Managing software configuration baselines

Systems Administration

· Coordinating with Application Services Branch (ASB)

· Access and user account management

· Provisioning and configuring infrastructure components

· Maintaining code repository, change management, agile, test driven development, and Continuous Integration tools.

· Provide Database management services to development and test teams

· Develop automated test and deployment scripts to support configuration management

· Access and user account management

Incident and Outage Coordination and Resolution

· Coordinating with Network Operations Center (NOC) & Incident Coordination Desk to resolve issues

· Coordinating with system engineers to resolve connectivity issues

· Resolving infrastructure/network issues impacting development and test activities

Security

· Coordinate and perform security patches

5.5 Security Engineering Support

This task supports Security Engineering Support for the ICE TECS MOD Program. The Contractor shall provide qualified personnel to support the government lead in all aspects of system security engineering and to work with the Government Information System Security Officer (ISSO), on behalf of the Program, to define and document requirements for, and support installation and configuration of, all security components in the overall system physical architecture.

The ISSO serves as the principal advisor to the Information System Owner (ISO) on all matters, technical and otherwise, involving the security posture of their assigned information system. The involvement of the ISSO is critical for integration of security into the development process and ensures security requirements are embedded in the system.

The Contractor ISSO will work with the Government team to participate in all phases of the NIST 800-37 Risk Management Framework to ensure the system is in compliance with NIST 800-53 and DHS 4300A. The Contractor ISSO prepares all security documentation, collects security artifacts and performs a self-assessment in advance of the security control assessment.

The Contractor ISSO will also evaluate the effectiveness of proposed solutions to audit findings, Security Control Assessments, Security Operations Center and other security control weaknesses and findings. Responsibilities will include performing root cause analysis of audit findings, developing requirements for security control remediation activities, reviewing scans from tools such as Nesses, WebInspect and DbProtect. The Contractor ISSO will also work with the Government Security Assurance Management (SAM) for Plan of Action and Milestones (POAM) closure requests and status reports for security control accuracy and completeness, interpreting security principles and requirements for remediation plans to brief the SAM and any support teams.

The Contractor ISSO will additionally perform security impact analysis of proposed configuration changes; develop security control implementation statements, review procedures and work instructions for security coverage, and review and update the System Security Plan and its supporting documents.

Additionally, the Contractor ISSO is responsible for multiple ongoing activities once a system is operational. These activities are reoccurring ad hoc, daily, weekly, monthly, quarterly, and annually based on the activity requirements and the information system and are documented within the system’s continuous monitoring plan. The ISSO works with the Government IT Program Managers (ITPMs) and support staff to review and understand the security impact of any changes made to the system.

Activities include but are not limited to:

· Support all ATO and continuous authorizations needed for the Program

· Plan of Action and Milestone Management (POA&M) to ensure that identified system weaknesses are tracked to resolution;

· Information Security Vulnerability Management (ISVM) to review system scans at least monthly for new weaknesses, missed patches, unauthorized assets, or configuration changes;

· Patch Management to ensure all systems are patched regularly.

· Document and monitor any issues or inconsistencies;

· Review ISVM for applicability to the information system, and take action as required (e.g. create POA&M) for applicable ISVMs.

· Audit Log Monitoring and Event Management to periodically review audit logs for security incidents including unauthorized access attempts;

· Awareness and Training to ensure all system users complete security awareness and role- based security training annually.

· Working with Product Owner to prioritize security-related POAMs or enhancements into active sprints/releases.

· Supporting Ongoing Authorization activities

· Providing 365X24x7 on call support for any security incidents and escalations.

6.0 OPTIONAL TASKS (Labor Hours) (Optional CLINs)

6.1 Ingestion of new data sources into the Data Warehouse

The contractor shall support the ingestion of data from other data sources besides ICM into the Data Warehouse. The Contractor shall support all aspects of the data ingest to ensure the new data is successfully ingested and integrated into the Data Warehouse:

· Update as required, existing database schema and structures, data marts, data sharing services and reports to integrate and share the new data

· Perform testing, including integration testing with data sharing partners as required

· Support enforcement of access control rules to new data

Once the initial data ingestion and reporting has been established, the O&M support will be run as part of the existing Data Warehouse Support task. The Government does not anticipate that the increase of additional data sources to the data warehouse will increase the number of support instance beyond the requirement specified in Section 5.1.1.

The Government anticipates this CLIN will be leveraged no more than 2 times per period of performance to support additional data sources.

6.1.1 Migration of Legacy Parole Case Tracking System (PCTS) into the HSI Data Warehouse

The contractor shall support the migration and storage of data from the current PCTS server to the HDW.

Identified Tasks:

· The contractor shall create a compartmentalized data schema in HDW to store LPCTS data in both the production and pre-production environments.

· The contractor shall transfer LPCTS data in the Staging (STG) and Production (PRD) environments from a PCTS export file. The STG environment shall provide a testing area for the development team to test programming code without altering the PRD environment. Data in FQT shall be scrubbed and not contain real data. Empty Schemas shall be created for the Development and FQT environments and populated, as needed, with dummy records.

· The contractor shall add PRIME Services required to service LPCTS queries and reports from HDW.

6.1.2 Migration of Legacy Media Data into the Digital Records Management (DRM) Database

The contractor shall support the migration and storage of data from the current Investigative Case Management (ICM) system into a database in the HSIDW FISMA boundary.

Identified Tasks:

· Analyze media information currently stored in data warehouse and ICM

· Develop database migration tools which will allow DRM to acquire existing media records extracted from ICM

· Test database migration procedures and plan data migration for IOC

· Assist development team with construction and loading of test databases used during DRM development and testing

6.1.3 Post deployment of the DRM system with Initial Operating Capabilities (IOC)

The contractor shall complete the following tasks for DRM to achieve Full Operating Capability (FOC).

Identified Tasks:

· Migration of DRM containers to an ICE approved Kubernetes platform, provided adequate ICE Cloud and ASB support is available and appropriate governance structures are in place.

· Tier III support for help desk tickets which need additional support from developers and engineering staff.

· Design, develop, and test integration of mugshot publish functionality into DRM via PRIME Interface Hub, including coordination with ICM to allow ICM to display a mugshot thumbnail to Subject viewers.

· Create and expose additional services to expose mugshot data to ICM.

· Create exports of media information for consumption by HSIDW (currently this is limited to mugshot media export).

6.1.4 Post DRM FOC optimizations and Records Management compliance Identified Tasks:

· Migration of DRM containers to ICE-approved container solution

· Migration/ Enhancement of Availability and Metrics dashboards

· Design and integration of “paperless case” concept (context: discussion with HSI and ICM on defining the scope of fully paperless case artifact including planning for agents to digitize all elements currently stored in hard copy format. Related to eventual transmission to NARA

· + ICE records retention policy.)

· Design, development, integration testing of NARA FERMI Requirement for transfer of electronic case artifacts

· Improve alignment with Quality Assurance Branch standards and processes (i.e. TMD/Sonar)

6.2 Connect ICE TECS Modernization Components with additional Data Sources The contractor shall add one (or more) additional data sources with multiple endpoints to the PRIME architecture, requiring new implementation framework enhancements, message formats, Schema updates and processes as required for the purposes of:

· Providing additional subject or event information from a new source to ICE TECS MOD; thereby augmenting the investigative capabilities of the HSI user base, and/or

· Sharing HSI data warehouse information with internal or external law enforcement partners based on the mutual agreement of both parties.

This may include a new sharing Partner (internal or external) or may be a conversion of an existing relationship in the Agency into the PRIME architecture. In either case the contractor shall support the construction and integration efforts by

· Closely examining the pertinent user story, ensuring the business purpose for the data exchange is clearly understood

· Negotiating with ownership and technical representatives for the new endpoint as to the technologies and message formats to be employed in the data exchange

· Coordinating the end-to-end design of the PRIME updates with both ICM and the endpoint’s support team

· Collaborating with other IPTs, ICE OCIO networking, DHS Onenet and interface partners to ensure unfettered data communications access to all required endpoints, as well as the appropriate credentialing required to effect necessary data exchanges

· Constructing the required modifications to PRIME to enable communication with the designated endpoint and the transmission/receipt of the specified data

· Performing collaborative Unit, regression, integration and end-to-end testing with the involved interface partners.

· Supporting disposition activities of the legacy endpoint/data source as necessary.

Once the initial data source/destination has been established, the O&M support and additional service implementations will be run as part of the existing Interfaces Support task. The Government does not anticipate that the increase of additional data sources to the Prime Architecture will increase the number of support instance beyond the requirement specified in Section 5.1.1.

The Government anticipates this CLIN will be leveraged no more than 4 times per period of performance to support additional data sources/partners.

6.2.1 Develop and Deploy DRM Data Services used to manage Digital Records

The contractor shall support the development and deployment of new middle tier interface services used to manage digital media.

Identified Tasks:

· Develop services used to manage uploads of large media files with resumable restart in the event of upload interruption

· Develop secure proxy services which support secure download and streaming of digital content managed by DRM

· Develop services which call ICM to synchronize case, document, and subject information stored in the ICM database

· Develop services which manage all metadata and workflow information associated with digital records stored in DRM

· Develop services which allow for conversion of certain media types to standard formats which can be natively displayed/played in DRM

· Develop services which scan uploaded files for viruses and quarantine infected files as needed

· Develop services to accept document prints and discovery packages being transmitted from ICM

· Develop ability to manage level 4 material, including handling required notifications from ICM when level 4 material is being promoted/demoted

· Develop and manage scalable and highly available infrastructure topology required to meet the needs of projected HSI user community

· Provide all required functional and performance testing needed to validate that the DRM solution will support anticipated functionality and workloads

· Support IOC rollout of DRM to user community

· Provide tier 2 and tier 3 support of DRM components after IOC

· Support initial FOC enhancements after IOC

6.2.2 Post deployment of the DRM system with Initial Operating Capabilities (IOC) The contractor shall complete the following tasks for DRM to achieve Full Operating Capability (FOC).

Identified tasks:

· Resolution of security issues not critical for IOC but which must be resolved prior to achieving ongoing ATO.

· Develop a robust operational monitoring system capable of visualizing key performance, event, and usage indicators.

· HSI-prioritized bug fixes or minor enhancements (<5 sprint points) as reported by field users following IOC via a SNOW ticket or report to ICE TECS Mod NSCOs, Training & Communications, or HSI PMs.

· HSI-prioritized bug fixes or enhancements as deferred prior to IOC as an outcome of pre-IOC dev team integration testing or stakeholder UAT testing.

· Design, develop, and test integration of mugshot publish functionality into DRM via PRIME Interface Hub, including coordination with ICM to allow ICM to display a mugshot thumbnail to Subject viewers.

· Create and expose additional services to expose mugshot data to ICM.

· Create exports of media information for consumption by HSIDW (currently this is limited to mugshot media export).

· Upgrade media file deletion workflow including storage and display of such media, role-based permissions around such actions.

· Enhancements to provide new print view options, download options, historical index views.

6.2.3 DRM O&M and handling of varied records and media types

Identified Tasks:

· Additional support for management of Draft ICM Subjects

· Address Security Reviews and Resolve Findings

· Enable new native file types in DRM application to allow users to open files directly within DRM

· Add administrative tools to handle quarantined media items

· Conduct DRM Disaster Recovery (DR) test

· Post-FOC Operations & Maintenance of DRM components

· Bugs Identified Post-FOC

· Enhancements Identified Post-FOC

6.3 Surge Support

The contractor shall support the scope of work defined within this contract, but at an increased labor hour capacity. Once the initial surge effort is completed, any works produced will be managed as part of the normal O&M support defined within Section 5.0.

The Government anticipates this CLIN will be leveraged no more than 4 times per period of performance.

6.3.1 Develop and Deploy User Interface for Stored LPCTS Data

The contractor shall develop and deploy a UI providing users the ability to query, view and run limited statical reports on the stored LPCTS data.

Identified Tasks:

· The contractor shall create all back-end PRIME connections to allow for external access of the ingested LPCTS data.

· The contractor shall create a User Interface (UI) module to allow PLEPU users to choose to perform LPCTS case queries based on agreed upon search indicators and criteria.

· The contractor shall create a display for the detailed information of a queried record. If a query results in multiple record returns a list of the records shall be displayed with summary information consisting of agreed upon attributes as per requirements. The contractor shall provide the user the ability to select a record from the summary list to view the detailed record data.

· The contractor shall ensure UI Application access shall be Single Sign On (SSO) enabled and shall enforce access controls on the…