Agile Refactoring & Sustainment of Legacy Applications to Salesforce Public Sector Solutions (PSS)

Attachments added 11/17/2025

Disclaimer: This RFI is issued solely for information and planning; it does not constitute a solicitation or a commitment by the Government. The Government will not pay for information provided in response to this RFI and is under no obligation to award a contract as a result of this request.

1) Purpose & Disclaimer

AF/A1 is seeking information from qualified vendors regarding refactoring an existing portfolio of applications—predominantly Salesforce Lightning Web Components (LWC) built under older licensing—into the Salesforce Public Sector Solutions (PSS) licensing model, with select applications currently implemented in OutSystems and Angular potentially remaining in those technologies where mission/value dictates. This effort is Operations & Maintenance (O&M) funded and focuses on modernization via refactoring and sustainment, not net‑new capabilities. The Government also seeks input on acquisition/contract structure, performance metrics, and risk, schedule, and cost drivers.

2) Background

AF/A1 is modernizing elements of its HR portfolio by consolidating and refactoring legacy applications to a more sustainable, secure, and user‑centered architecture. Many applications were built in Salesforce LWC under older licensing constructs and require refactoring into Salesforce PSS to align with current licensing, data models, and platform capabilities. Additional applications exist in OutSystems (low‑code) and Angular (pro‑code). Some functions may remain on OutSystems/Angular where appropriate; the Government seeks to avoid technology lock‑in and maintain flexibility.

3) Anticipated Scope (High-Level, Non-Binding)

• Program & Project Management: Agile portfolio/program management, product backlog facilitation, metrics/velocity, and release planning with Government product owners.
• Agile Refactoring & Modernization: Iterative refactoring of LWC applications to PSS, using human‑centered design, Scrum events, and transparent metrics.
• Planning & Design: User‑centered design events, personas, architecture/design artifacts; emphasize usability, information architecture, and content strategy.
• Implementation & Testing: Refactor code to PSS data/process models; maintain functional parity for O&M; implement automated unit/integration/E2E testing and security scans.
• Deployment: CI/CD‑driven releases with versioning, artifact tracking, rollback plans, and smoke tests; change control and release management.
• Sustainment (O&M): Tier 2/3 support, defect triage, minor enhancements, security patches, monitoring, documentation upkeep, and backlog grooming.
• Cybersecurity & IA: RMF support, Zero Trust alignment, continuous monitoring, DFARS 252.204‑7012 reporting, CMMC alignment as applicable.

Non-functional/Compliance Expectations (for comment): Agile ceremonies, traceable user stories and acceptance criteria, Definition of Done, automated quality gates (tests, linting, 508, SAST/DAST), and build‑to‑deploy verification each sprint.

4) Technical Environment & Constraints

• Primary target: Salesforce Public Sector Solutions (PSS).
• Mixed‑stack portfolio: select applications may remain in OutSystems or Angular where mission and value dictate, with appropriate integrations.
• Development must occur within Government‑designated environments; all code, pipelines, and artifacts will be maintained in Government repositories.
• Contractor must propose an approach that minimizes vendor lock‑in and supports portability of code and data.

5) Vendor Qualifications (Self‑Screen – Provide Evidence in Response)

To improve the quality of responses, the Government is including a self‑screen checklist. These are not evaluation criteria for award at the RFI stage, but they indicate the capabilities the Government expects to see in any future solicitation. Respondents should address the following:

• Recent, relevant PSS refactor experience: ≥2 enterprise migrations in the last 3–5 years in which Salesforce LWC/Aura applications were refactored into Public Sector Solutions/Industries and deployed to production.
• Agile capacity: ability to field cross‑functional Agile teams (4–9 members) and report release burn‑up, planned vs. accepted points, escaped defects, and velocity.
• Key personnel (named individuals or example résumés): Program Manager (~10 years managing Agile portfolios), Salesforce Architect (Application or System Architect or equivalent), Public Sector Solutions SME (Accredited Professional or equivalent), ≥2 Platform Developer II (one may be JavaScript Dev I), ≥1 OmniStudio Developer/Consultant, ≥1 Data/Integration Architect, QA/Accessibility lead, and DevSecOps/Release engineer.
• Salesforce partner credentials (competition‑safe): current Salesforce partner tier and relevant Navigator/Accredited Professional recognitions in Public Sector/Industries, OR equivalent proof via recent PSS refactors and individual certifications.
• Proof artifacts from prior engagements: sanitized CI/CD configuration, automated test results, 508 scan output, SBOM, and release logs.
• Security and compliance: experience with RMF/ATO sustainment, Zero Trust, 508 conformance, and DFARS/CMMC obligations.

6) Questions for Industry

1. PSS Refactoring Approach: How would you migrate LWC (legacy licensing) to PSS, address data model alignment, OmniStudio/Industries patterns, and permissions/licensing migration while preserving functionality under O&M funding?
2. Hybrid Portfolio: How do you determine stay‑vs‑migrate for OutSystems/Angular components, and how do you manage UX coherence and integrations across stacks?
3. Functional Parity & Technical Debt: How will you ensure parity while reducing technical debt and improving maintainability/security?
4. Data Migration & Integrity: What is your approach for migration, rollback, and auditability with minimal disruption?
5. Agile Execution: Provide a sample cadence (planning, demos, retros), velocity tracking, and Definition of Done practices tailored to refactor/sustain work.
6. Quality & 508: How will you demonstrate automated tests, style/lint compliance, and 508 conformance each sprint?
7. DevSecOps & CI/CD: What toolchain and evidence (SAST/DAST, SBOMs, pipeline logs) will you provide for acceptance and ATO sustainment?
8. RMF & Zero Trust: Summarize your experience aligning Agile delivery to DoD RMF, continuous monitoring, and Zero Trust.
9. Tier 2/3 Sustainment: Propose an incident/defect intake model, SLAs/SLRs, hotfix strategy, and patch cycles compatible with Agile delivery.
10. KPIs in O&M: Which metrics best reflect performance in a refactor‑and‑sustain posture (e.g., availability, MTTR, escaped defects, velocity stability, 508 conformance, vulnerability closure time)?
11. Contract Type & CLINs: Provide pros/cons of FFP per iteration vs. FFP team‑capacity vs. hybrid (FFP capacity with limited T&M spikes).
12. Award‑Term Incentive: Thoughts on using award‑term (or similar) to reward sustained Excellent performance and objective thresholds to use.
13. Small Business Participation: Realistic opportunities for small business prime/sub participation (including socio‑economic categories).
14. Top Risks: Identify top risks for LWC→PSS migration under O&M and your mitigations.
15. Government Furnished: Assumptions about access to environments, repos, licenses, and SMEs you need from the Government.

6) Questions for Industry

1. PSS Refactoring Approach: How would you migrate LWC (legacy licensing) to PSS, address data model alignment, OmniStudio/Industries patterns, and permissions/licensing migration while preserving functionality under O&M funding?
2. Hybrid Portfolio: How do you determine stay‑vs‑migrate for OutSystems/Angular components, and how do you manage UX coherence and integrations across stacks?
3. Functional Parity & Technical Debt: How will you ensure parity while reducing technical debt and improving maintainability/security?
4. Data Migration & Integrity: What is your approach for migration, rollback, and auditability with minimal disruption?
5. Agile Execution: Provide a sample cadence (planning, demos, retros), velocity tracking, and Definition of Done practices tailored to refactor/sustain work.
6. Quality & 508: How will you demonstrate automated tests, style/lint compliance, and 508 conformance each sprint?
7. DevSecOps & CI/CD: What toolchain and evidence (SAST/DAST, SBOMs, pipeline logs) will you provide for acceptance and ATO sustainment?
8. RMF & Zero Trust: Summarize your experience aligning Agile delivery to DoD RMF, continuous monitoring, and Zero Trust.
9. Tier 2/3 Sustainment: Propose an incident/defect intake model, SLAs/SLRs, hotfix strategy, and patch cycles compatible with Agile delivery.
10. KPIs in O&M: Which metrics best reflect performance in a refactor‑and‑sustain posture (e.g., availability, MTTR, escaped defects, velocity stability, 508 conformance, vulnerability closure time)?
11. Contract Type & CLINs: Provide pros/cons of FFP per iteration vs. FFP team‑capacity vs. hybrid (FFP capacity with limited T&M spikes).
12. Award‑Term Incentive: Thoughts on using award‑term (or similar) to reward sustained Excellent performance and objective thresholds to use.
13. Small Business Participation: Realistic opportunities for small business prime/sub participation (including socio‑economic categories).
14. Top Risks: Identify top risks for LWC→PSS migration under O&M and your mitigations.
15. Government Furnished: Assumptions about access to environments, repos, licenses, and SMEs you need from the Government.

7) Response Instructions

Please submit a single PDF capability statement (max 15 pages, excluding cover/appendices) that:

• Addresses the Questions for Industry and the Vendor Qualifications self‑screen above.
• Provides up to three relevant past performance summaries (preferably within 3–5 years) involving PSS refactor/sustain or mixed‑stack portfolios.
• Includes a notional Agile release schedule and a sprint‑level quality checklist you typically use.
• States your preferred contract/CLIN structure and how you would price team capacity or iterations (with surge/drawdown options).

8) Proprietary Information

Mark and segregate any proprietary content. The Government may use non‑Government advisors (who will sign NDAs) to support market research.

9) Small Business Considerations

The Government encourages responses from small businesses and large firms proposing robust small business participation; input on realistic set‑aside strategies is requested.

10) Anticipated Next Steps (Informational)

Subject to market research, the Government may issue a draft solicitation. Any future solicitation will incorporate clear Agile deliverables, compliance expectations (RMF/508), and a where‑based structure focused on accepted user stories/iterations or accepted outputs of designated Agile teams.

Disclaimer: This RFI is issued solely for information and planning; it does not constitute a solicitation or a commitment by the Government. The Government will not pay for information provided in response to this RFI and is under no obligation to award a contract as a result of this request.

1) Purpose & Disclaimer

AF/A1 is seeking information from qualified vendors regarding refactoring an existing portfolio of applications—predominantly Salesforce Lightning Web Components (LWC) built under older licensing—into the Salesforce Public Sector Solutions (PSS) licensing model, with select applications currently implemented in OutSystems and Angular potentially remaining in those technologies where mission/value dictates. This effort is Operations & Maintenance (O&M) funded and focuses on modernization via refactoring and sustainment, not net‑new capabilities. The Government also seeks input on acquisition/contract structure, performance metrics, and risk, schedule, and cost drivers.

2) Background

AF/A1 is modernizing elements of its HR portfolio by consolidating and refactoring legacy applications to a more sustainable, secure, and user‑centered architecture. Many applications were built in Salesforce LWC under older licensing constructs and require refactoring into Salesforce PSS to align with current licensing, data models, and platform capabilities. Additional applications exist in OutSystems (low‑code) and Angular (pro‑code). Some functions may remain on OutSystems/Angular where appropriate; the Government seeks to avoid technology lock‑in and maintain flexibility.

3) Anticipated Scope (High-Level, Non-Binding)

• Program & Project Management: Agile portfolio/program management, product backlog facilitation, metrics/velocity, and release planning with Government product owners.
• Agile Refactoring & Modernization: Iterative refactoring of LWC applications to PSS, using human‑centered design, Scrum events, and transparent metrics.
• Planning & Design: User‑centered design events, personas, architecture/design artifacts; emphasize usability, information architecture, and content strategy.
• Implementation & Testing: Refactor code to PSS data/process models; maintain functional parity for O&M; implement automated unit/integration/E2E testing and security scans.
• Deployment: CI/CD‑driven releases with versioning, artifact tracking, rollback plans, and smoke tests; change control and release management.
• Sustainment (O&M): Tier 2/3 support, defect triage, minor enhancements, security patches, monitoring, documentation upkeep, and backlog grooming.
• Cybersecurity & IA: RMF support, Zero Trust alignment, continuous monitoring, DFARS 252.204‑7012 reporting, CMMC alignment as applicable.

Non-functional/Compliance Expectations (for comment): Agile ceremonies, traceable user stories and acceptance criteria, Definition of Done, automated quality gates (tests, linting, 508, SAST/DAST), and build‑to‑deploy verification each sprint.

4) Technical Environment & Constraints

• Primary target: Salesforce Public Sector Solutions (PSS).
• Mixed‑stack portfolio: select applications may remain in OutSystems or Angular where mission and value dictate, with appropriate integrations.
• Development must occur within Government‑designated environments; all code, pipelines, and artifacts will be maintained in Government repositories.
• Contractor must propose an approach that minimizes vendor lock‑in and supports portability of code and data.

5) Vendor Qualifications (Self‑Screen – Provide Evidence in Response)

To improve the quality of responses, the Government is including a self‑screen checklist. These are not evaluation criteria for award at the RFI stage, but they indicate the capabilities the Government expects to see in any future solicitation. Respondents should address the following:

• Recent, relevant PSS refactor experience: ≥2 enterprise migrations in the last 3–5 years in which Salesforce LWC/Aura applications were refactored into Public Sector Solutions/Industries and deployed to production.
• Agile capacity: ability to field cross‑functional Agile teams (4–9 members) and report release burn‑up, planned vs. accepted points, escaped defects, and velocity.
• Key personnel (named individuals or example résumés): Program Manager (~10 years managing Agile portfolios), Salesforce Architect (Application or System Architect or equivalent), Public Sector Solutions SME (Accredited Professional or equivalent), ≥2 Platform Developer II (one may be JavaScript Dev I), ≥1 OmniStudio Developer/Consultant, ≥1 Data/Integration Architect, QA/Accessibility lead, and DevSecOps/Release engineer.
• Salesforce partner credentials (competition‑safe): current Salesforce partner tier and relevant Navigator/Accredited Professional recognitions in Public Sector/Industries, OR equivalent proof via recent PSS refactors and individual certifications.
• Proof artifacts from prior engagements: sanitized CI/CD configuration, automated test results, 508 scan output, SBOM, and release logs.
• Security and compliance: experience with RMF/ATO sustainment, Zero Trust, 508 conformance, and DFARS/CMMC obligations.

6) Questions for Industry

1. PSS Refactoring Approach: How would you migrate LWC (legacy licensing) to PSS, address data model alignment, OmniStudio/Industries patterns, and permissions/licensing migration while preserving functionality under O&M funding?
2. Hybrid Portfolio: How do you determine stay‑vs‑migrate for OutSystems/Angular components, and how do you manage UX coherence and integrations across stacks?
3. Functional Parity & Technical Debt: How will you ensure parity while reducing technical debt and improving maintainability/security?
4. Data Migration & Integrity: What is your approach for migration, rollback, and auditability with minimal disruption?
5. Agile Execution: Provide a sample cadence (planning, demos, retros), velocity tracking, and Definition of Done practices tailored to refactor/sustain work.
6. Quality & 508: How will you demonstrate automated tests, style/lint compliance, and 508 conformance each sprint?
7. DevSecOps & CI/CD: What toolchain and evidence (SAST/DAST, SBOMs, pipeline logs) will you provide for acceptance and ATO sustainment?
8. RMF & Zero Trust: Summarize your experience aligning Agile delivery to DoD RMF, continuous monitoring, and Zero Trust.
9. Tier 2/3 Sustainment: Propose an incident/defect intake model, SLAs/SLRs, hotfix strategy, and patch cycles compatible with Agile delivery.
10. KPIs in O&M: Which metrics best reflect performance in a refactor‑and‑sustain posture (e.g., availability, MTTR, escaped defects, velocity stability, 508 conformance, vulnerability closure time)?
11. Contract Type & CLINs: Provide pros/cons of FFP per iteration vs. FFP team‑capacity vs. hybrid (FFP capacity with limited T&M spikes).
12. Award‑Term Incentive: Thoughts on using award‑term (or similar) to reward sustained Excellent performance and objective thresholds to use.
13. Small Business Participation: Realistic opportunities for small business prime/sub participation (including socio‑economic categories).
14. Top Risks: Identify top risks for LWC→PSS migration under O&M and your mitigations.
15. Government Furnished: Assumptions about access to environments, repos, licenses, and SMEs you need from the Government.

6) Questions for Industry

1. PSS Refactoring Approach: How would you migrate LWC (legacy licensing) to PSS, address data model alignment, OmniStudio/Industries patterns, and permissions/licensing migration while preserving functionality under O&M funding?
2. Hybrid Portfolio: How do you determine stay‑vs‑migrate for OutSystems/Angular components, and how do you manage UX coherence and integrations across stacks?
3. Functional Parity & Technical Debt: How will you ensure parity while reducing technical debt and improving maintainability/security?
4. Data Migration & Integrity: What is your approach for migration, rollback, and auditability with minimal disruption?
5. Agile Execution: Provide a sample cadence (planning, demos, retros), velocity tracking, and Definition of Done practices tailored to refactor/sustain work.
6. Quality & 508: How will you demonstrate automated tests, style/lint compliance, and 508 conformance each sprint?
7. DevSecOps & CI/CD: What toolchain and evidence (SAST/DAST, SBOMs, pipeline logs) will you provide for acceptance and ATO sustainment?
8. RMF & Zero Trust: Summarize your experience aligning Agile delivery to DoD RMF, continuous monitoring, and Zero Trust.
9. Tier 2/3 Sustainment: Propose an incident/defect intake model, SLAs/SLRs, hotfix strategy, and patch cycles compatible with Agile delivery.
10. KPIs in O&M: Which metrics best reflect performance in a refactor‑and‑sustain posture (e.g., availability, MTTR, escaped defects, velocity stability, 508 conformance, vulnerability closure time)?
11. Contract Type & CLINs: Provide pros/cons of FFP per iteration vs. FFP team‑capacity vs. hybrid (FFP capacity with limited T&M spikes).
12. Award‑Term Incentive: Thoughts on using award‑term (or similar) to reward sustained Excellent performance and objective thresholds to use.
13. Small Business Participation: Realistic opportunities for small business prime/sub participation (including socio‑economic categories).
14. Top Risks: Identify top risks for LWC→PSS migration under O&M and your mitigations.
15. Government Furnished: Assumptions about access to environments, repos, licenses, and SMEs you need from the Government.

7) Response Instructions

Please submit a single PDF capability statement (max 15 pages, excluding cover/appendices) that:

• Addresses the Questions for Industry and the Vendor Qualifications self‑screen above.
• Provides up to three relevant past performance summaries (preferably within 3–5 years) involving PSS refactor/sustain or mixed‑stack portfolios.
• Includes a notional Agile release schedule and a sprint‑level quality checklist you typically use.
• States your preferred contract/CLIN structure and how you would price team capacity or iterations (with surge/drawdown options).

8) Proprietary Information

Mark and segregate any proprietary content. The Government may use non‑Government advisors (who will sign NDAs) to support market research.

9) Small Business Considerations

The Government encourages responses from small businesses and large firms proposing robust small business participation; input on realistic set‑aside strategies is requested.

10) Anticipated Next Steps (Informational)

Subject to market research, the Government may issue a draft solicitation. Any future solicitation will incorporate clear Agile deliverables, compliance expectations (RMF/508), and a where‑based structure focused on accepted user stories/iterations or accepted outputs of designated Agile teams.