Onboarding_SOO_DRAFT.docx

Statement of Objective [Draft] Employee Onboarding System

UNITED STATES MINT

Table of Contents

Introduction The purpose of this project is to obtain a web-based (potentially cloud-based), secure commercial off the shelf (COTS) Employee Onboarding solution that provides the new employees a reliable, secure and easy to use system during the clearance process, joining the team and get training on the United States Mint processes. This also includes acquiring the industry best practice onboarding process which is user friendly.

This program shall work towards achieving the Mint strategic goals of Operating as “One Mint” working together across organizational boundaries to achieve common objectives.

Background The United States Mint, a bureau within the United States Department of the Treasury, was created by Congress in 1792 and is mandated to produce circulating, precious metal, and commemorative coins, medals, and related items for commerce. The primary mission of the United States Mint is to produce an adequate volume of circulating coinage to enable the nation to conduct its trade and commerce.

The United States Mint’s administrative functions are performed at its headquarters facility located in Washington, DC. These functions include policy formulation and central agency administration, program management, research and development, marketing operations, management of the organizational business units, and development and management of the www.usmint.gov website services (excluding catalog.usmint.gov). The United States Mint has five (5) field/production operations facilities, located in: Philadelphia, PA; Denver, CO; San Francisco, CA; West Point, NY; and Fort Knox, KY.

The United States Mint is divided up into organizational business units as follows: Manufacturing Department; Bullion and Numismatic Department; Protection Department; Workforce Solutions Department; Information Technology Department; Financial Department; and the Director’s Office (including the Office of the Chief of Staff, Office of the Deputy Director for Management, Office of the Deputy Director for Manufacturing, Office of Coin Studies, Legislative and Intergovernmental Affairs, Office of Corporate Communications, and Design Management Division). The Office of Chief Counsel is part of the Department of the Treasury Legal Division and the United States Mint is the client agency.

DEFINITIONS:

Onboarding is the process of integrating new employees into the United States Mint, preparing them to succeed at their job, and helping them become fully engaged, productive members of the Bureau. It is a comprehensive process that begins the day applicant is offered the position and continues through the employee’s first year and includes in-processing and orientation.

Technical Onboarding is the process of collecting information that is needed by Security, IT, Human Resources (HR), and facility services to perform the tasks required to equip the new employee with the necessary credentials and resources to be effective on day one.

Onboarding Experience is the processes, tools, and activities designed to reaffirm the new hire’s employment decision, orient the employee to the United States Mint culture and background, encourage social integration, make new employees feel welcome and comfortable in their new work environment, and provide growth and learning opportunities to enable success.

Employee Sponsorship Program: According to the Partnership for Public Service, a key component of a successful onboarding program is the ability to provide the new employee with a peer who can help them understand the organizational culture, learn how to navigate the organization, answer questions, and help identify resources (e.g., intranet sites, POC, information). We would feel that the creation of a “Buddy Program” as part of the overall onboarding program at the Mint will allow new employees to have a “go-to” person to answer questions, provide support, introduce them to colleagues, and provide general help throughout the process.

Scope The Contractor shall establish an onboarding process for United States Mint and provide the personnel, management, materials, and equipment necessary to implement an employee onboarding system. This system shall be a turnkey, COTS solution preferably in a cloud that enables United States Mint staff and new employees a common easy to use platform for onboarding which starts after the receipt of offer acceptance until one year after joining United States Mint.

The scope of this solution includes:

· Industry Best practice Onboarding Processes

· Hardware

· Software

· System security (Physical and cyber security to include FedRAMP)

· Training

· Integration with internal and external systems

· Employee Sponsorship Program

· A separate onboarding activities for each United States Mint field site

· Communication from Senior United States Mint staff

· Content for web based activities

· Feedback Mechanism (New Employees provide Feedback on the onboarding program)

· Online and offline interactions

· Reporting

· Gap analysis of onboarding procedures and policies, web based activities, and training offerings for new employees by location

· Best practices in a shared service environment into the onboarding program

· New employee, supervisor, and sponsors tool kits

· New employee Orientation

· Biweekly briefings and progress reports

· Communications plan for announcing new program

The SOO overview and scope above describe basic onboarding activities. The United States Mint is looking for a commercial business provider with extensive onboarding expertise to deliver to the United States Mint a comprehensive turnkey solution.

Tasks The United States Mint seeks a contractor who can use an Agile Methodology to perform the following minimum Performance Work Statement tasks.

Program Management This task shall identify the work required to manage and perform all the activities in this scope of work up to the point of completing the transition-out. The Contractor shall provide and manage resources to execute tasks and produce deliverables including but not limited to the deliverables defined.

The contractor Program Management Team will provide:

· A central contact point for the United States Mint.

· Regular business activity and performance summary reporting.

· Action, Issues, Risk list administration and progress reporting.

· Participation in the United States Mint’s planning processes.

· Recommendations for procedural improvements.

The Program Management team assigned to the United States Mint shall be responsible for but not limited to the following key processes:

1. Program/Schedule Management:

2. Development Life Cycle / Change Control.

3. Risk Management:

4. Communication Management:

5. Reporting:

As a part of the discovery and design phases of the implementation project, the contractor shall define standard reporting requirements with the United States Mint. Those reports will be provided ongoing by contractor Program Management.

Discovery This task requires the Contractor to develop and execute a discovery plan to understand the current state of employee onboarding processes. This task includes interviews and meetings with United States Mint staff in HQ and field sites, review of documentation. At the conclusion of this task, the Contractor shall provide an analysis and recommendation document Requirements This task requires the Contractor to develop and execute a plan to understand and identify the gaps for the future desired state of United States Mint employee onboarding functions and processes.

Design/ Build This task, as a minimum, shall include any necessary updates to the plans identified in the logical design phase, configuration and coding (if necessary), preparation of production environment(s), the execution of testing activities, integration, United States Mint staff training, and deployment.

Development:

This task includes the creation of the Configuring the COTS solution and development of necessary changes specific to United States Mint. For the web content, the United States Mint style Guide used in non-commerce site www.usmint.gov shall be followed.

The contractor shall follow the agile methodology.

Testing:

During the testing phase, contractor shall work with the United States Mint to verify and validate the application against the requirements and design. Contractor shall document and prioritize any defects and track the status to ensure critical issues are closed out in a timely manner.

Contractor shall perform at least the following testing:

· Unit Testing

· Quality Assurance Testing

· User Acceptance Testing

· Section 508 Compliance Testing

· Security Vulnerability Testing Cutover and Deployment:

The contractor shall develop a cutover plan in collaboration with the United States Mint. This task shall document the full deployment plan for cut over from test environment to production. This cutover plan will include the cutover communication plan and the timing and steps for deployment activities.

Training The contractor shall provide training schedule, training documents, training execution before go-live.

Contractor shall provide Training Materials and Training Schedule Transition This task shall address the orderly termination of the system and preservation of the data processed or stored by the system so that the data is effectively migrated to another system or archived in accordance with applicable Records management, NARA Privacy Act, and FOIA requirements. The Contractor shall develop a Disposition/Transition out Plan that identifies necessary steps, decisions, and milestones

Deliverables The Contractor shall prepare a list of deliverables including IT security deliverables in agreement with United States Mint. The Government will have final approval of all deliverables.

Security The following salient characteristics are required for security:

FedRAMP Security:

The contractor shall apply the appropriate set of Moderate impact baseline controls to the system as required in the FedRAMP Cloud Computing Security Requirements Baseline document to ensure compliance to security standards. The FedRAMP baseline controls are based on NIST Special Publication (SP) 800-53 Security and Privacy Controls for Federal Information Systems and Organizations, as amended. The contractor shall adhere to FedRAMP requirements, processes, guidelines, and templates. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

As required by FedRAMP, the contractor shall utilize a 3PAO from the FedRAMP list of accredited 3PAOs (http://cloud.cio.gov/fedramp/accredited-3PAOs) to perform an assessment of the system’s security controls to determine the extent to which security controls are implemented correctly, operate as intended, and produce the desired outcome with respect to meeting security requirements.

System Assessment and Authorization

1. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the SA&A is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization of Moderate and the scope of controls that pertain to the SaaS.. The Contractor shall adhere to the most current FedRAMP processes, requirements, and templates pertaining to Security Assessment and Authorization (SA&A) and Continuous Monitoring (http://cloud.cio.gov/fedramp/csp and http://cloud.cio.gov/fedramp/templates).

2. Information systems must be assessed by an accredited 3PAO whenever there is a significant change to the system’s security posture, which shall be determined in accordance with the process for determining significant changes defined in Section 3.2 of the FedRAMP Continuous Monitoring Strategy and Guide.

3. The Government reserves the right to perform Penetration Testing. If the Government exercises this right, the contractor shall allow Government employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements. Review activities may include but are not limited to scanning operating systems , web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

4. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor's implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require them to be remediated before the security authorization is issued.

5. The contractor is responsible for mitigating all security risks found during SA&A and continuous monitoring activities. The Government will determine the risk rating of vulnerabilities.

Reporting and Continuous Monitoring:

Maintenance of the FedRAMP Authorization will be through continuous monitoring and periodic audit of the operational controls within a contractor’s system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to the Government as required by FedRAMP Requirements, including the FedRAMP Continuous Monitoring Strategy and Guide. The contractor shall adhere to the FedRAMP Continuous Monitoring Strategy and Guide and develop a Continuous Monitoring Plan tailored for the Mint. The submitted deliverables) provide a current understanding of the security state and risk posture of the information systems. The deliverables will allow the Government to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring Plan. The Cloud Service Provider shall support interoperability with the Government’s Continuous Mitigation and Diagnostics (CDM) capabilities.

Point of Contact The Contractor shall designate an individual to serve as a primary point of contact for all Information Technology (IT) Security operational and compliance issues and also serve as an Information System Security Office (ISSO). This person shall have sufficient demonstrated knowledge and/or experience with Federal IT Security Requirements, FedRAMP, NIST, OMB, Risk Management Framework, Security Assessment and Authorization, and Continuous Monitoring to effectively communicate and document security requirements and issues between the Contractor and the United States Mint.

Physical Security Compliance

· The Contractor shall document in the System Security Plan and implement the Physical and Environmental Protection (PE) controls required in the FedRAMP Cloud Computing Security Requirements Baseline document”.

· Provide documentation for a Physical Security Plan that includes but is not limited to how requirements are implemented and managed at data centers, how site surveys are conducted, and how physical compliance is ensured.

· Provide necessary resources to assist United States Mint or third party audits of Physical Security Plan both onsite and through documentation as applicable.

· Address and resolve gaps in Physical Security Plan identified by the United States Mint and/or a third party auditor as applicable.

Audit Support

· The Government reserves the right to conduct on-site inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation as requested.

· Provide physical and Logical access to systems, facilities and resources to authorized United States Mint personnel, or designated third parties, at any time to conduct security audits, reviews, and data calls.

· Support, comply, and consult on all internal and external security audits, reviews, and data calls including but not limited to: FISMA Reviews; OMB, Homeland Security, Departmental Inquiries and other continuous monitoring activities. Provide access to all requested data, systems, resources, and facilities.

· Provide recommendations and remediation plans based on the results of audits/reviews.

Mint Ownership of Data:

The Mint will retain unrestricted rights to government data. The Mint retains ownership of any user created/loaded data and applications hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time.

Quality Control The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements. The QCP shall, at a minimum, provide a method for performing inspections; identifying, correcting, and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

Quality Assurance The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements. The Government will make every effort to ensure that the surveillance methods described below are conducted in an objective, fair, and consistent manner.

image1.png