ODOS IV PWS Industry Day 11.4.2024.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

United States Citizenship and Immigration Services (USCIS)

Outcome-based Delivery and DevSecOps Services (ODOS)

IV

Performance Work Statement (PWS) DRAFT October 24, 2024

DRAFT

Contents

1. OVERVIEW

2. AGENCY MISSION GOALS

3. BACKGROUND

4. SCOPE

4.1 Technical Landscape

5. TASKS – DevSecOps and UXD/IxD Services

5.1 Provide DevSecOps Services

5.2 DevSecOps Development Tasks

5.2.1 DevSecOps Tasks for ELIS and Global

5.2.2 Outside of Normal Duty Hours Production Support

5.2.3 DevSecOps Tasks for CLAIMS 3 and Benefits Hub Migration

5.3 UXD/IxD Tasks for ELIS and Global

5.4 DevSecOps Administrative Activities

5.5 Key Personnel

5.5.1 Project Management Lead

5.5.2 Technical Lead

5.5.3 Lead Business Analyst

5.5.4 Lead UX/IX Designer

6. TASKS – Infrastructure and Integration Services

6.1 Provide Infrastructure and Integration DevSecOps Services

6.2 Infrastructure and Integration Service Tasks

6.2.1 Infrastructure Maintenance Service Tasks

6.2.2 Architecture Integration Service Tasks

6.2.3 Outside of Normal Duty Hours Production Support

6.2.4 Infrastructure Maintenance Service Tasks for CLAIMS 3 Decommissioning

6.3 Infrastructure and Integration Administrative Activities

6.4 Key Personnel

6.4.1 Project Management Lead

6.4.2 Technical Lead

6.4.3 Lead Database Administrator

7. ODOS IV TEAM COMPOSITIONS

7.1 DevSecOps Teams Composition

7.2 UXD/IxD Supplemental Staff (Optional)

7.3 Examples of DevSecOps Resource Staffing

7.4 Infrastructure and Integration Teams Composition

7.5 Optional CLINs – DevSecOps

7.6 Optional CLINs – UXD/IxD

7.7 Optional CLINs – Infrastructure and Integration

7.8 Optional CLINs -OFF Hour CLIN

8. TRANSITION AND SUPPORT

8.1 Transition-In Tasks - DevSecOps

8.2 Transition-In Tasks – Infrastructure and Integration

8.3 Transition-In Support

8.4 Transition Out Tasks

9. DELIVERABLES

9.1 Task Order Management Artifacts

9.2 Deliverable Schedule

9.3 Inspection and Acceptance

10. TASK ORDER ADMINISTRATION DATA

10.1 Place of Performance

10.2 Hours of Operation

10.3 Government Furnished Property

10.4 Travel

10.4.1 Travel Reimbursements

11. QUALITY ASSURANCE

11.1 Quality Control Plan

11.2 Performance Requirements Summary

Attachment 1 – ODOS IV Technical Landscape

Technical Landscape (Consolidated list for all)

Attachment 2 – Accessibility Requirements (Section 508)

ODOS IV Section 508 Requirements

Section 508 Requirements for Technology Services

Section 508 Deliverables

Attachment 3 – Outside of Normal Duty Hours Support

Attachment 4 – Key Personnel Qualifications and ODOS IV Labor Category Descriptions

Key Personnel Minimum Qualifications

ODOS IV Labor Categories - DevSecOps

ODOS IV Labor Categories – Infrastructure and Integration

1. OVERVIEW

U.S. Citizenship and Immigration Services (USCIS) Office of Information Technology (OIT) Transformation Program is seeking to acquire highly qualified DevSecOps teams in support of USCIS’s Transformation Business Portfolios and Adjudicative Directorates for delivering value faster and sustainably. Outcome-Based Delivery and DevSecOps Services (ODOS) IV will be part of an ecosystem consisting of multiple major case management systems. ODOS IV contractors will be participating with federal employees and other contractors in a team-based DevSecOps approach to deliver mission critical functionality and business value frequently (daily), cost-effectively, responsively, while enabling automation, securely, with a zero defect-high quality product.

The OIT Transformation Delivery Division (TDD) is responsible for building the USCIS Electronic Immigration System (ELIS), an end-to-end digital case management and processing ‘system-of-services’ that offers a seamless user experience for USCIS employees to perform highly complex processing and adjudicative tasks for the Agency’s highest-volume workloads within the Immigrant, Citizenship, and Humanitarian lines of business. ELIS was created to transition USCIS from paper-based business processes to an integrated electronic operating environment, and currently handles over 80% of the agency’s immigration case management workload. In addition to migrating the remaining benefit processing from legacy systems into ELIS, USCIS continues to expand ELIS’ capabilities to respond to the ever evolving and urgent needs of the U.S. immigration system.

In addition to ELIS, USCIS developed Global to serve as the primary benefit case management system to support the Asylum Division and the International and Refugee Affairs Division (IRAD) within the Refugee, Asylum, and International Operations (RAIO) Directorate. Global is comprised of a series of capabilities to support the full adjudication lifecycle of humanitarian benefit processing for asylum and refugee applications.

ELIS, Global, C3 and Benefits Hub are all USCIS Enterprise Case Management applications that were developed using state-of-the-art, industry-wide cloud best practices architecture and development processes that have become a showcase for other federal agencies who want to implement industry best DevSecOps processes and practices using Continuous Integration/Continuous Deployment (CI/CD) framework for continuous delivery, automated testing, alerting and monitoring observability, shift-left secure development, JavaScript based open-source tools and technologies, Ruby on Rails, C#,/.Net framework, microservices based architecture on Amazon Elastic Kubernetes Service (EKS) Platform, API-driven architectures and containerized and serverless development when delivering its capabilities in the Amazon Web Service (AWS) public cloud and achieve high software quality.

The Government oversees the architecture design, development, and delivery of the IT systems.

The ODOS IV contractors will be responsible for developing secured high performing enhancements and quality business functionality as required, performing adaptive and follow-on maintenance, with cloud and Site Reliability Engineering (SRE) best practices and principles.

2. AGENCY MISSION GOALS

USCIS oversees lawful immigration into the United States. USCIS secures America’s promise as a nation of immigrants by providing accurate and useful information to our customers, granting immigration and citizenship benefits, promoting an awareness, and understanding of citizenship, and ensuring the integrity of our immigration system.

USCIS Enterprise Case Management applications are used for the adjudication of various immigration benefits. Through Global application, the RAIO Directorate leverages their domestic and international presence to provide protection, humanitarian, and other immigration benefits and services throughout the world, while combating fraud and protecting national security. It administers the refugee and asylum programs for qualified individuals who suffered past persecution or fear future persecution in their country of origin.

3. BACKGROUND

USCIS processes millions of immigration benefit requests each year. USCIS’ current electronic processes evolved from a paper-based processes for the purpose of verifying identities of applicants, adjudicating benefit requests, and sharing information with other government agencies.

Through the transformation process of USCIS operations and achieving paperless government records, ELIS, Global, CLAIMS 3, and Benefits Hub were developed to deliver a web-based solution for case management. These applications allow USCIS to take full advantage of existing and newly available digital capabilities for streamlining operations, making the case processing, tracking, and the adjudication process more effective, ensuring the availability of relevant and accurate information is delivered to USCIS immigration officers when making case decisions.

This new effort will be the fourth version of ODOS. ODOS III is the current effort consisting of 4 separate task orders with 45 DevSecOps teams across all 4 task orders, with 9 personnel per team. There are 3 Integration Configuration Services (ICS) and 2 User Experience Design (UXD) teams as well.

In the next generation of innovation and leadership, the USCIS Transformation Program is concentrating on is the agencies most central lines of business to drive innovation and business process re-engineering. USCIS is looking for partners with industry leaders in providing DevSecOps services to achieve processing of approximately 75% of the agency’s workload in our combined IT systems through, increasing sustainability, superior system resilience and performance, improved code quality and security, improved Mean Time To Respond (MTTR) by alerting and monitoring, eliminating any system defects or technical debts, and refactoring legacy functionality into smaller chunks of code using microservices on AWS cloud platform.

To deliver USCIS business requirements, the case management systems have adopted an industry standard Continuous Integration/Continuous Delivery (CI /CD) pipeline that includes automated build and compile processes, automation of unit testing and smoke testing, code quality, security checks and ultimately promotes the solution to automated acceptance testing and production readiness within these self-service capabilities for the developers.

The case management systems also utilize UXD, to include user research, content strategy, information architecture (IA) and usability assessments, as well as visual and Interaction Design (IxD). These services are needed to support ongoing design and development of the systems.

4. SCOPE

The scope of ODOS IV has two separate requirements that will be awarded as separate task orders. The primary requirement is for the Contractor to deliver DevSecOps and UXD/IxD Services to support the development, delivery and operations for ELIS and Global business.

DevSecOps will incorporate all the technical, business integration, UXD/IxD, adaptive maintenance to deliver features at the current cadence, carried out on-time and without disruption.

The secondary requirement is for the Contractor to deliver Infrastructure and Integration Services to support ELIS, Global, CLAIMS 3 and Benefits Hub, which has the objective of ensuring continuous software quality, reducing release time, improving monitoring/logging/alerting for running systems, adopting a shift-left security approach, and equipping development teams with tools for code promotion across environments with zero downtime, and to deploy code multiple times daily.

USCIS has implemented a CI/CD environment in the AWS public cloud for development, integration, and testing. Production builds are automated to publish in this environment using build-in automation process and infrastructure as services. All applications aim to uphold and enhance open-source solutions and platform-agnostic software, facilitating seamless deployment on the standard DHS private cloud infrastructure or secure public Cloud as a Service (CaaS) platforms like AWS.

Using open-source platforms and tools wherever possible, the Contractor shall provide a platform for services and tools to establish standardize and execute a repeatable, automated build process and environment to enable frequent integration, testing, monitoring, infrastructure cluster management, shift-left security approach, application and infrastructure security posture, alerting, monitoring, cost projections and control and Amazon Relational Data Services (RDS) management. Government requires a design framework, style guidelines, design prototypes, build automated tools for the developers’ community on their laptops so the developers can develop code, debug, and promote it to various environments, enforce Application Program Interface (API) task orders on how to interact, set up/maintain a CI/CD environment and assist in continuous delivery of the software.

These services require using collaboration within the DevSecOps services and processes in parallel to provide a strong integration function that can pull the disparate work products into a coherent, operational baseline to establish a continuous delivery environment.

The Government requires that software is maintained in a releasable state, rapid feedback is provided to DevSecOps teams when issues arise, and acceptance criteria is maintained by providing several automated tools and paths using Docker/AWS EKS platform solutions and various other supporting tools and CI/CD pipelines to support production. Expertise is necessary in the current design tools and user feedback collection to improve the overall user experience and interaction design, performance, alerting and monitoring, continuous security improvements, Site Reliability Engineering (SRE) principals and overall application resiliency. Providing a platform of standards and automated services for configuration and integration will be an essential component of USCIS’ strategy for rapid software development and continuous integration. Configuration and integration standards and operating procedures will be required, as will services, for the configuration management and integration support.

The goal is to improve design, user experience, the quality of software, decrease the time it takes to release, improve the overall security posture and code quality, enhance monitoring/logging/alerting of running systems, 24/7 on-call production support and provide tools to the DevSecOps teams to promote small chunks of code to all the environments on an on-demand basis and with zero downtime. To be successful, the Contractor shall minimize the risk of defects in the code base, detect bugs early, detect production problems early, and make debugging easier and faster. This can and has been accomplished through the incorporation of continuous integration practices and automated testing and proactively improves the overall architecture of these systems. Continuous integration and automated testing practices must reduce human error during deployment, and create visibility into the software’s health attributes, such as complexity. Government requires reduction in repetitive and ad hoc activities across projects to accelerate time to deployment, such as code compilation, database integration, testing, inspection, deployment, and feedback. By building automated tools for the development community, this task order should empower the DevSecOps teams to build and promote bug free code to various cloud environments, and ultimately to production, with zero downtime and multiple times a day.

USCIS will create and maintain system roadmaps, project plans, product and release backlogs, reliability metrics, and usage metrics that will be the basis for the ODOS IV Contractor’s work.

The Government will prioritize the user needs based on business value and technical dependencies in Maestro Jira repository and maintaining/updating information on the confluence to reflect current system status.

Each vendor may be eligible to receive up to twenty (20) teams. Vendors may receive additional teams based on their demonstrated ability to secure qualified staff with appropriate skill sets.

Additionally, as the contract progresses, vendors may be awarded additional CLINs or have CLINs terminated for convenience or cause based on the performance of their existing teams and the outcomes reflects throughout the lifecycle of the contract. Frequent turnover or delay of replacement of Key Personnel may reflect negatively in scorecard and/or CPARS The determination as to whether to exercise or terminate optional CLINs for additional teams will be entirely within the Contracting Officer (CO)'s discretion.

4.1 Technical Landscape

The Government seeks services from contractors with proven experience in the tools and technologies outlined in the ODOS IV Technical Landscape (Attachment 1). Since the architecture of these case management applications is always evolving, the tools and technologies specified may change during the task order period. The USCIS technical landscape has shifted to a wide adoption framework that is based on the open-source platform. Under this move, the ELIS, Global, CLAIMS 3, and Benefits Hub architecture is now deployed with a stack of predominately open-source tools for standardization across development teams.

The USCIS technical landscape has shifted from a costly, proprietary, Commercial-Off-The- Shelf (COTS) based framework to a wide adoption of open source and flexible offerings for majority of the developer tools and platform. The current development architecture has demonstrated success with a stack of predominately open-source Development and Testing (Dev/Test) tools that are currently under consideration for standardization across DevSecOps teams at USCIS.

Open-Source solutions and platform agnostic software has been employed wherever possible to create the possibility of more easily deployable solutions in AWS. Besides maintaining the integrated CI/CD environment in the AWS environment, ELIS continues to focus on new initiatives to enhance the development with containerized Microservices on EKS platform, configuring several monitoring and alerting tools, API Gateway configuration, rolling our new AWS tools such as comprehend, AWS System Manager (SSM), Lex, Kendra, AWS Well- Architected Framework, CheckMarx, and other tools used in design/GUI prototyping, building wire frameworks, and improving user experience.

Therefore, Contractor’s DevSecOps and Infrastructure and Integration team members shall be expected to gain an understanding of the complete technical landscape and cadence, so they can recommend technology solutions that benefit USCIS users.

5. TASKS – DevSecOps and UXD/IxD Services The Contractor shall work closely with the Government. The Contractor’s responsibilities will be to maintain ELIS, Global, CLAIMS 3, and Benefits Hub code repository of deployed releases and to deliver innovative and secure business solutions as required, decommissioning of CLAIMS 3 system and any associated migration/archiving activities, and integration of Global and Benefits Hub functionality into ELIS. The tasks identified in the following sections describe the work that will occur to accomplish this vision.

ODOS IV contractors shall provide teams that are able to perform the tasks as described, while conforming with the expectations and with expertise and abilities to support and utilize the technologies stated in Attachment 1: Technical Landscape. As the technical landscape evolves, the skills of the contractor’s teams must also evolve.

5.1 Provide DevSecOps Services

The Government requires DevSecOps services allowing for parallel development and a strong integration function that can pull the disparate work products into a coherent, operational baseline to establish a continuous delivery environment. The Government requires code to be deployed to AWS. It is expected the Contractor will partner with OIT operational staff to ensure that software runs accordingly and keep the cadence of deploying quality software daily.

The Government requires support and deliverance of practical processes and fostering of collaboration between development and IT operations. The Government requires a platform for services and tools to establish, standardize and execute a repeatable, automated build process and environment to enable/maintain and monitor frequent integration, testing, monitoring, infrastructure cluster management and database management, using open-source platforms and tools wherever possible. The Government requires developers to participate in the delivery of the code, infrastructure maintenance and UX/design from creation to running in the pipeline, to deployment, and then maintenance.

The Government requires DevSecOps services that facilitate parallel development and provide a robust integration capability to unify various work products into a cohesive, operational baseline, supporting a continuous delivery environment. The code must be deployed to AWS, with the Contractor expected to collaborate closely with IT operations staff to ensure the software functions as intended and maintains the pace of daily quality software deployments. The Government also requires the implementation of practical processes and the promotion of collaboration between development and IT operations teams.

Additionally, the Government seeks a platform that offers services and tools to establish, standardize, and execute a repeatable, automated build process. This platform should support frequent integration, testing, monitoring, infrastructure cluster management, and database management, preferably utilizing open-source platforms and tools. Developers will be involved in every phase of the process, from code delivery, infrastructure maintenance, and UX/design, through pipeline operation, deployment, and ongoing maintenance

The Government requires and expects all deliverables to conform to the architecture, infrastructure, cloud best practices, UX and design provided and maintained by Transformation Delivery Division/United States Citizenship and Immigration Services (TDD/USCIS) and the Industry Standard Agile processes and satisfy completion of performance objectives for these services.

5.2 DevSecOps Development Tasks

5.2.1 DevSecOps Tasks for ELIS and Global

a) The Contractor shall provide rapid daily delivery in small batches increasing the frequency and pace of releases applying the continuous integration and continuous delivery practices.

b) The Contractor shall continue to innovate and foster new ideas to integrate security into DevSecOps workflow in a collaborative way by employing a "DevSecOps" approach and delivering the system with shift-left security strategy.

c) Each member of Contractor’s team shall be responsible for mitigating and addressing any security finding to comply with ongoing authorization. The Contractor shall maintain the security status quo posture and mitigate all critical, high, and medium application and infrastructure vulnerabilities.

d) The Contractor shall employ design patterns that enable code simplicity, users’ needs, and future maintainability.

DRAFT

https://aws.amazon.com/devops/continuous-integration/ https://aws.amazon.com/devops/continuous-delivery/ https://aws.amazon.com/devops/continuous-delivery/

e) The Contractor shall employ microservices architecture on AWS EKS Platform as a design approach to build ELIS and Global applications functionality.

f) The Contractor shall review and participate in redesigning monolith application functionalities into manageable microservices.

g) The Contractor shall take the ownership of maintaining and managing the applications functionalities, Microservices and updating/adding new functionality to the existing software. The Contractor shall take full accountability of the quality and security of the software.

h) The Contractor shall have estimation and planning skills for breaking down epics into manageable user stories.

i) The Contractor shall be responsible for providing continuous production and maintenance support.

j) The Contractor shall implement, enhance, and introduce innovative ideas in monitoring, alerting system, and logging practices to help stakeholders stay informed of performance in real-time.

k) The Contractor shall ensure that systems comply with DHS/USCIS security policies, Federal Information System Management Act (FISMA) guidelines to mitigate all the findings to safeguard the system against external and insider threats.

l) The Contractor shall evaluate and embrace a zero-trust framework in all 5 pillars (Identity, Devices, Network, Data, and Applications and Workloads) of the maturity zero-trust model. The Contractor shall work with the Information System Security Officer (ISSO) to ensure we follow the DHS/USCIS information security guidelines and implement them wherever possible. This applies to infrastructure and applications code baseline.

m) The Contractor shall ensure that teams implement proactive approaches to reduce vulnerabilities and to improve responsiveness to unforeseen events.

n) The Contractor shall ensure that systems have quality build-in for availability, maintainability, observability, security, resilience, and reliability.

o) The Contractor shall ensure that the applications and Infrastructure key performance parameters (KPPs) are maintained to DHS/USCIS standards.

p) The Contractor shall adhere to the industry Site Reliability Engineering (SRE) framework to keep the application reliable.

q) The Contractor is responsible for the availability, latency, performance, efficiency, change management, monitoring, emergency response, and capacity planning of enterprise programs and services by adhering to rules of engagement and USCIS principles.

r) The Contractor shall collaborate and cooperate with government and other contractor teams to improve ELIS, Global, and Benefits Hub user experience and to baseline and re-establish key performance parameters for the system and address all the gaps as part of continuous improvement and collaboration.

s) The Contractor shall fix escaped critical functional defects within 24 hours.

t) The Contractor shall adopt USCIS design and coding standards during their application development, infrastructure maintenance and governance policies.

u) The Contractor shall provide technical methods, techniques, and concepts that are innovative, practical, cost-effective, and conducive to the Agency’s processes and quality standards.

v) The Contractor shall develop applications based on requirements that are evolving and emerge as the business climate shifts. It is expected that all code developed by the teams will be for new functionality or critical changes to existing functionality as identified and prioritized by the Government product owners.

w) The Contractor shall develop software that adherers to industry-standard code coverage and security practices., ensuring high-quality and maintainability, and integrity of the code. The Contractor shall proactively assist Government eliminating existing technical debt, rewriting issues to remove bad designs and security issues from the code base. The Contractor shall architect, develop, and deploy software in accordance with industry best practices. This includes, but is not limited to: following 12 Factor App development practices (12factor.net), cloud native (cncf.io), National Institute of Standards and Technology (NIST) Risk Management Framework, building/deploying microservices on AWS EKS Platform, Site Reliability Engineering (SRE) principles, and deploying software with zero downtime on AWS public cloud platform. The Contractor shall stay fluent with industry best practices as they evolve.

x) The Contractor shall maintain the current code quality coverage and provide innovative ideas to improve upon

y) The Contractor shall be responsible for creating test cases and automated test scripts to support test automation activities and thoroughly testing the code. The Contractor shall perform alpha and beta testing.

z) The Contractor shall collaborate with other teams to support test-driven, continuous code integration.

aa) The Contractor shall collaborate and communicate with other TDD and other OIT teams on application and infrastructure improvements, suggestions, mitigation, and enhancements transparently.

bb) The Contractor shall monitor and respond immediately to the application and infrastructure alerts for all internal and external functional end points. The Contractor shall engage the Government leads in communicating with the stakeholders and remain engaged until the situation is resolved.

cc) The Contractor shall monitor and respond immediately during core business hours, to any issues to development tools and development infrastructure within the agreed MTTR. The Contractor shall work with the Government liaison should there be a need to support development teams off hours or weekend to support any agency critical business priorities.

file://VTW-RS-C1-03/section/CISCON/FY16/AboveSAT/Sellears_FADS/1_Preaward/Solicitation/Amend%201/12factor.net

dd) The Contractor shall monitor, participate, and respond to all Microsoft (MS) Teams critical channels internally and with other stakeholders.

ee) The Contractor key personal shall participate in key initiatives, as directed, to support the infrastructure platform, application software updates and other engineering activities.

ff) The Contractor shall share test scripts (manual and automated) as needed with other testing entities.

gg) The Contractor shall assist with constructing validation steps (both positive and negative testing) for user acceptance testing on an as needed basis.

hh) The Contractor shall support the activities of the infrastructure operations team to ensure the automatic build and deployment process works effectively across all environments, including the Contractor’s dev/test enclave. Deployment and testing in the dev/test environment should mimic closely the actions performed for deployment and testing in staging and production. The Contractor will leverage the AWS cloud and EKS Platform to fullest extent possible.

ii) The Contractor shall thoroughly test changes and remediate all known security issues before committing them into the deployment pipeline.

jj) The Contractor shall use their DevSecOps personnel to perform deployments of some or all code directly to production, as directed by the Government.

kk) The Contractor shall not depend on independent inspections to achieve quality and security.

ll) The Contractor shall confer with the Performance Test Team and other development teams, which are external service providers to the ODOS development team, to troubleshoot issues during the build process in the various environments. This is especially crucial in maintaining the deployment cadence for the program.

mm) The Contractor shall create a Quality Assurance Surveillance and shall ensure development related activities are in accordance with the contractor’s quality management plan.

nn) The Contractor shall maintain the system design documents, RDS schema design documents, RDS data dictionary document, architecture related documents, CI/CD design documents, Section 508 testing documents, and all necessary Release Readiness Review (RRR) documents.

oo) The Contractor shall work closely with the Government to integrate the case management systems into a unified platform. Furthermore, the Contractor shall be required to perform decommission activities as directed by the Government when appropriate. The Contractor shall work with Government liaison in identifying the priorities and task, while implementing them using industry best practices for cloud implementation and Site Reliability Engineering (SRE) framework.

pp) The Contractor shall respond to production incidents such as runtime errors of functionality, system outages, performance problems, security incidents, or user complaints. This responsibility includes but is not limited to: investigating and triaging incidents, rolling systems back to earlier states, developing and deploying fixes (on software they may or may not have developed), engaging with other contractors and federal employees to fix related systems, and running incident retrospectives to ensure permanent fixes or any proposed recommendations.

qq) The Contractor shall be responsible for the development of new functionality code, maintaining and updating existing code baseline, collaborate with operation and other development teams in production of the capabilities as they develop.

rr) The Contractor shall work with infrastructure operations team to build application monitoring triggers to effectively reveal production issues in a timely fashion.

ss) The Contractor shall ensure that the system is monitored to reveal user analytics and interactions and provide the capability to automatically report on such activities.

tt) The Contractor shall support development teams by exploratory proofs of concept and via development of internal and enterprise-wide tools, techniques, and frameworks. The Contractor shall research and evaluate all kinds of software tools and plugins that add value and implement in production environment where applicable.

uu) The Contractor shall continuously provide Business Process Modeling and Data Mapping support for USCIS programs that is based on best practices, tools, and methodologies.

vv) The Contractor shall provide component and agency-wide support to DHS Enterprise Data Management Office (EDMO) to ensure DHS data is understandable, trusted, visible, accessible, and interoperable.

ww) The Contractor shall work with The Office of Performance and Quality (OPQ) data governance and the data stewards to ensure the integrity of Enterprise and Reference Data and provide support in areas that include but are not limited to Reference Data Governance Issues and Operationalized Standards.

xx) The Contractor shall support all data governance or data architecture requests, including ad-hoc data calls.

yy) The Contractor shall seek opportunities to expand interface testing to focus on the outcomes of business processes.

5.2.2 Outside of Normal Duty Hours Production Support

a) DevSecOps teams will be assigned rotating role and responsibility for responding to off hour production support. The assigned Contractor shall monitor their Government furnished equipment (GFE) phones during off hours and weekends as required by TDD management. Attachment 3 will provide additional information.

b) The Contractor shall monitor, participate, and respond to all Microsoft (MS) Teams critical channels internally and with other stakeholders in TDD incident escalation plans.

c) The Contractor shall monitor and respond immediately to all production alerts during off hours and weekends within the agreed MTTR.

5.2.3 DevSecOps Tasks for CLAIMS 3 and Benefits Hub Migration

a) The Contractor shall ensure they are compliant with all practices and procedures as listed in 5.2.1 of the PWS as applicable in performing tasks related to the decommission of CLAIMS 3 and integrating cases management systems into one platform.

b) The Contractor shall create a decommissioning plan and execute relevant decommissioning tasks for CLAIMS 3, data and in-flight case migration to ELIS, data archival tasks, code repos archival, relevant documentation, Notify Stakeholders, Checklist and Disposition tasks, any associated data migration activities, and work with IT Security to develop a Disposition Letter to remove the system from DHS Security records.

c) The Contractor shall work on integrating the Benefits Hub functionality into ELIS, identify the priorities to come up with a integration plan, database and code migration wherever its required, redesign the application and infrastructure CI/CD pipelines, recode legacy code migration functionalities into Java and microservices, implement shift-left security strategies, implement alerts and monitoring, logging, and industry best practices for cloud implementation and Site Reliability Engineering (SRE) framework of the functionality of the Benefits Hub into ELIS.

d) The Contractor shall work closely with the Government to integrate the case management systems into a unified platform. Furthermore, the Contractor shall be required to perform decommission activities as directed by the Government when appropriate. The Contractor shall work with Government liaison in identifying the priorities and task, while implementing them using industry best practices for cloud implementation and Site Reliability Engineering (SRE) framework.

5.3 UXD/IxD Tasks for ELIS and Global

a) The UXD/IxD multi-vendor team will comprise of four teams will have one UXD/IxD lead and two UXD/IxD team members. Each vendor should have a UXD/IxD lead as well as one UXD/IxD team member per two teams; UXD team members will be embedded to the individual, specialized teams that focus on a particular piece of software, so they can easily collaborate with their lead BAs, product managers, and developers on a regular basis for quick turnaround and smooth handoff of research and design requirements. They will work directly with their individual teams daily. All IxD team members will collaborate with each other on a weekly basis to contribute to the design system, conduct design critiques and reviews, and present and share research insights that can inform each other’s team’s work. IxD team members will collaborate with the USCIS design community monthly (i.e. community of practice meetings.) They will utilize internal design systems and USCIS design materials and templates. Artifacts will be maintained through SharePoint and Teams channels, to be centralized and accessible to all Design Program Leadership: Work with TDD division and branch leadership, business stakeholders; Field Operations Directorate, Service Center Operations and Refugee, Asylum, and International Operations (FOD, SCOPS and RAIO respectively), and delivery teams to better integrate design across all product lines.

a) Collaborate with other designers across the enterprise to share best practices and showcase design solutions.

b) Provide regular critiques of other design solutions.

c) Advocate for the user’s perspective and involvement in the development of new features or changes to existing as a member of a product development team.

d) Act as surrogate when users are unavailable to weigh-in or speak to various stakeholders, users, and fellow DevSecOps teams about problem statements, design process, and design choices based on prioritization, evidence, and feasibility.

e) UX research: Perform research and design to improve the interactions between people and the systems, tools, data, screens, and screen elements those people use as part of the U.S. immigration process.

f) Employ qualitative and quantitative research tools and techniques to investigate and translate business-oriented goals, adjudication officer needs and performance objectives into digital experiences that produce desired operational outcomes.

g) Collaborate with TDD leadership to define a user research strategy that supports business goals and delivers actionable, high-impact insights that drive demonstrable business value.

h) Work with product managers, team leads, business analysts, and designers to identify and facilitate qualitative and quantitative research activities to support feature releases and explore future opportunities.

i) Create and maintain a repository of research findings and innovate other methods to share insights across the organization. In collaboration with TDD leadership, define best practices for user research and maintain operational standards across design teams.

j) Content strategy: Collect, create, and curate content appropriate for DevSecOps teams while applying plain language best practices.

k) Information architecture: Structure product information to align it with overall product strategy and maximize the likelihood that people can quickly act on what they need.

l) Product / user experience design (UXD): Implement scalable UXD strategy/solutions across USCIS organizations that support distinct business operations and different lines of business. This includes organizing visual elements in ways that create consistency and usability to achieve desired goals.

m) Interaction design (IxD): Conduct research on user / business needs and employ best practices to create clear, intuitive user interfaces (via tested through wireframes and prototypes) that allow USCIS users to achieve their objective(s) efficiently and effectively.

n) Use USCIS internal data including web data analytics along with qualitative data to inform design decisions.

o) Front-end development: Work closely with business analysts, developers and other designers to develop wireframes and prototypes and bring from tested concepts to delivery to craft solutions that address user problems.

p) Design system management: Work in collaboration with designers across DevSecOps teams to develop and maintain a cohesive design system consisting of visual style, UI components, copy/content and other product guidelines.

q) Continue to build upon and mature an existing design system.

r) Collaborate with other user experience (UX) professionals to develop user prototypes for

ELIS and its microservices to identify their specific needs using data and experience from field research.

s) As required; create wireframes and prototypes to explain complex solutions and to test those solutions in the field.

t) Usability testing and assessment: Examine how stakeholders utilize designed solutions to identify areas for improvement and provide optimized solutions.

u) Participate in user testing as a regular part of the development process. Design and test concepts, prototypes and beta products with users and improve iteratively; as well as develop new and innovative functionality for immigration digital systems.

v) Design, lead, and analyze user research and usability testing results.

w) Facilitate product development team analysis of usability testing.

x) Maintain and assure compliance with design and content standards such as Section 508.

y) Establish a relationship with the following when ensuring coordination and compliance:

• USCIS Plain Language Division for compliance with USCIS Plain Language Regulations

• USCIS Office of Privacy when determining if the services require access to sensitive information and if the access is considered high risk, specifically personally identifiable information (PII).

5.4 DevSecOps Administrative Activities

a) The Contractor shall collaborate with stakeholders, support contractors, and third-party vendors throughout system integration, performance, security, Section 508, system acceptance, user acceptance, usability, and test and evaluation reporting.

b) The Contractor shall manage all contractor resources and supervise all contractor staff in the performance of work on this task order. The Contractor shall manage and coordinate its team(s) on a day-to-day basis and ensure plans are communicated to team members.

Likewise, the Contractor must ensure that the health and progress against those plans are adequately reported.

c) The Contractor shall organize, direct, and coordinate planning and execution of all task order activities.

d) Vehicles for transparency, such as but not limited to the USCIS Agile Application Lifecycle Management (ALM) tool (e.g., Jira), shall be maintained with data so that reports and charts can be generated as needed, and so that user stories, defects, and tasks and their status are available to stakeholders. Task boards and SharePoint sites, meetings, and demos can be used to share information and report progress.

e) The Contractor shall have lean documentation as part of the definition of done.

f) The Contractor shall comply with OIT asset management, on-boarding and off-boarding process within the agreed timeframe identified in the notification.

g) The Contractor shall comply with OIT Information Security guidelines and be responsible for the Government GFE safety.

5.5 Key Personnel

Key Personnel are required for successful performance of this task order. The Contractor shall provide resumes for individuals identified as key personnel within ten (10) business days after the date of the award.

Contractors shall provide a minimum of one (1) resume for each of the key personnel positions:

• Project Management Lead,

• Technical Lead,

• Lead Business Analyst,

• Lead UX/IX Designer.

The Project Management Lead shall be a full-time employee of the prime contractor or lead CTA member. The Contractor may fill the other key positions with a CTA member or subcontractor(s). The Contractor shall identify key personnel who shall be the Project Management Lead for the task order as a whole and identify additional key personnel as follows:

• One (1) Technical Lead for every four (4) DevSecOps teams,

• One (1) Lead Business Analyst for every four (4) DevSecOps teams,

• One (1) Lead UX/IX Designer.

Minimum qualifications for all key personnel positions are included in Attachment 4. The name and resume of key personnel shall be designated in writing to the CO for review. The Government desires key personnel to be employed and performing on the ODOS IV contract for a minimum of one (1) year without substitutions. The Contractor will be evaluated by the Government on their ability to execute the contract, specifically the timeliness, completeness and quality of staffing, corrective action, cooperative behavior, customer satisfaction, and communication with government personnel.

Prior to removing, replacing, or diverting any key personnel, the Contractor shall notify the CO no less than thirty (30) days in advance and shall submit a proposed replacement for government review at least 21 days prior to the departure. The Government retains the right, at its discretion, to reject any proposed replacements of key personnel.

5.5.1 Project Management Lead

The Project Management Lead shall ensure that all work on this task order complies with task order terms and conditions and shall have access to contractor corporate senior leadership when necessary. The Contractor’s Project Management Lead shall be the primary interface with the USCIS Contracting Officer’s Representative (COR) and Contracting Officer (CO) and shall attend status meetings and ad hoc meetings with stakeholders and be accompanied by the Technical Lead(s) when requested. The Project Management Lead shall be a single point of contact for resolution of task order-related issues. The Project Management Lead shall ensure that there is support for off-hours for any emergencies such as maintenance work or outages.

5.5.2 Technical Lead

The Technical Leads shall ensure that all work performed by the teams complies with technical, security and USCIS IT policy guidelines. Technical Leads shall ensure DevSecOps teams successfully perform the required tasks applying strong understanding and experience that spans Java, CI/CD Jenkins, infrastructure and code automation, Kubernetes, alerting and monitoring tools, application and infrastructure-application logging, security tools, GitHub, code quality tools, secrets management, AWS services suite, etc., Site Reliability Engineering (SRE) framework, Infrastructure, UXD/IxD development methodologies, and Infrastructure Maintenance Operations experience using the tools included in the Development/Test Tool Suite identified previously and passion to embrace and enhance technical landscape. They also shall lead the requirements, design, development, testing, implementation, and documentation of enhancements. They shall evaluate technical trends and provide recommendations for technology and architecture to meet business objectives.

5.5.3 Lead Business Analyst

The Lead Business Analysts shall lead the business requirements and integration across complex, enterprise-level, services, and systems. Leads will comfortably and effectively work very closely with USCIS staff and other DevSecOps team members (business analyst (BAs), user interface/user experience (UI/UX) designers, engineers, technical leads) to design solutions that meet business objectives. Lead Business Analysts will be expected to gain a deep understanding of the functional and technical landscape so they can effectively integrate solutions. They shall serve as consultants capable of helping USCIS business representatives and subject matter experts (SME) understand the new capabilities and solutions will meet business objectives. They shall lead the business requirements and integration and documentation of epics, user stories, end-to-end workflows for new development and enhancement of existing functionality. They shall evaluate functional trends and provide recommendations for features and capabilities to meet business objectives.

5.5.4 Lead UX/IX Designer

The Lead UX/IX Designers shall lead the user experience and user interaction design of complex, enterprise-level, services and systems. Leads will comfortably and effectively work very closely with USCIS staff and other DevSecOps team members (business analyst (BAs), user experience/interaction (UX/IX) designers, engineers, and technical leads) to design solutions that meet business objectives. Lead UX/IX Designers will be expected to gain an understanding of the functional and technical landscape so they can effectively design solutions that benefit users.

They shall serve as consultants capable of helping USCIS business representatives, subject matter experts (SME) and other non-designers understand the essential role of design in product development and as needed, suggesting organizational tactics for improving design solutions.

They shall collaborate with other UX professionals across all DevSecOps teams to develop standards and craft solutions that address user problems. They shall be responsible for working in collaboration and alignment with other Lead UX/IX Designers on the technical direction and standard framework for building out design-led solutions.

DHS requires Section 508-compliant user interfaces. Lead UX/IX Designers will be responsible ensuring and maintaining compliance with Section 508 design and content standards.

6. TASKS – Infrastructure and Integration Services The Contractor shall work closely with the Government. The Contractor’s responsibilities will be to maintain ELIS, Global, CLAIMS 3, and Benefits Hub code repository of deployed releases and to deliver innovative and secure business solutions as required, decommissioning of CLAIMS 3 system and any associated migration/archiving activities, and integration of Global and Benefits Hub functionality into ELIS. The tasks identified in the following sections describe the work that will occur to accomplish the vision.

ODOS IV contractors shall provide teams that are able to perform the tasks as described, while conforming with the expectations and with expertise and abilities to support and utilize the technologies stated in Attachment 1: ODOS IV Technical Landscape. As the technical landscape evolves, the skills of the contractor’s teams must also evolve.

6.1 Provide Infrastructure and Integration DevSecOps Services The Government requires…