Inactive

Sources Sought: SBIC Web Operations and Maintenance (O&M) THIS IS A SOURCES SOUGHT NOTICE, ONLY, for the purpose of conducting market research to identify parties having an interest in and the resourc... Sources Sought: SBIC Web Operations and Maintenance (O&M) THIS IS A SOURCES SOUGHT NOTICE, ONLY, for the purpose of conducting market research to identify parties having an interest in and the resources to support an Operations and Maintenance (O&M) contract where a major responsibility is to provide support of ongoing operations of SBIC Web which is a key web-based application that allows SBICs to file complex financial statements that must occur at regular intervals which are either monthly or annually. At the moment, SBIC Web stores approximately sixty help desk tickets each month. To resolve help-desk tickets, OII is seeking software developers having experience in working with object-oriented programming languages and relational databases such as SQL Server and .Net programming. Experience using a Microsoft technology stack is preferred but experience working with other technology platforms such as Oracle and Java will be considered under this requirement. *See Attached Statement of Objectives for a Complete Description of the requirement. There is no solicitation at this time. This request for capability information does not constitute a request for quotes or proposals; submission of any information to include pricing estimates in response to this market survey is purely voluntary. The Government assumes no financial responsibility for any costs incurred. Not responding to this notice does not preclude participation in any future Solicitation, if issued. Any information submitted by respondents to this notice is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the Respondent. Interested parties are responsible for adequately and clearly marking proprietary, restricted, or competition sensitive information contained in their response. Information obtained through this market research may inform SBA’s approach to acquiring these services. BACKGROUND: The Office of Investment and Innovation (OII) is a program within the Small Business Administration that guarantees debentures to Small Business Investment Companies (SBICs) which obtain funds to lend to small businesses within their portfolio. As of December of 2020, there are approximately 300 SBICs within the SBIC program which has outstanding loans to approximately 4,000 small businesses. This requirement is for an O&M contract where a major responsibility is to provide support of ongoing operations of SBIC Web which is a key web-based application that allows SBICs to file complex financial statements that must occur at regular intervals which are either monthly or annually. At the moment, SBIC Web stores approximately sixty help desk tickets each month. To resolve help-desk tickets, OII is seeking software developers having experience in working with object-oriented programming languages and relational databases such as SQL Server and .Net programming. Experience using a Microsoft technology stack is preferred but experience working with other technology platforms such as Oracle and Java will be considered under this requirement. This requirement will entail supporting a production and test environment of SBIC Web and providing technical assistance so that SBICs can complete their filings in a timely manner. As of March 31st of 2021, approximately 98 percent of SBICs were able to file their financial filings on time. A key factor in having a filing rate this high was having technical support to assist OII staff members in troubleshooting tickets related to SBIC filings of financial information. This process entailed IT contracting staff to work with OII program managers to fixing pre-existing and new issues within SBIC Web. *See attached Statement of Objectives for a complete description of this requirement. RESPONSE: Interested parties may submit Capabilities Statements or information in alternative formats. All submissions should be concise, and clearly demonstrate the full spectrum of a company’s ability to provide the services described within the attached Statement of Objectives (SOO) document. Request that you address the following: FIRST: Provide a Cover Page that lists the information below Name of your Company (include POC’s) Duns number Socioeconomic Status (Large or Small Business) GSA Contract # (if applicable) SEWP Contract # (if applicable) NITAAC GWAC Contract # (if applicable) SECOND: After reviewing the Statement of Objectives address the following in your response: (i) Operations. The purpose of this task is to update and modernize the SBIC Web application to make more SBIC Web more stable and more easily supportable. This effort will be accomplished in several areas which are the following: (a) Continuity of Operations. -- SBIC Web is one of the key enterprise systems that the offeror shall need to support where both new and existing modules will need to be supported. SBIC Web has more than a thousand external users and it is imperative that SBIC Web has few or no bugs upon deployment. If bugs are inadvertently released in a deployment, they must be fixed within or rectified within a twenty-four hour time period. In the event of a bug when releasing an SBIC Web version, the OII Project Manager should be notified. (b) Ensuring Data Integrity and Accuracy – SBIC Web is a data driven application that captures key financial data that exists within filings contained within the Forms 468, 1031, and Capital Certificate. Not only must the data elements or fields be consistent within a period for these forms, but it must also be financially consistent across time periods. -- It is expected that the offeror thoroughly tests out existing functionality as well as any bug fixes within SBIC Web so that there is 100% percent accuracy not only within the current time-period but across time periods. Currently SBIC has financial information captured contained within key forms. The information entered by users is enforced by business rules within a form, across forms and across time periods. (c) 365/7/24 Coverage. SBIC web is to be operational 365 days of the year, 7 days a week and 24 hours a day and 7 days a week. In case of an outage, the contractor will be required to identify key personnel that will be able to troubleshoot SBIC Web. This member of the contracting staff may have to work off-hours and work with other vendors as well as with SBA staff to trouble-shoot any issues that may arise where SBIC Web is non-operational. (d) Take Remedial Measures to Remove Latency of Forms and Reports. The contractor will have to ensure that there are no latencies in terms of rendering a form within SBIC Web. In addition, there should be no delays of saving data to SBIC Web to its underlying tables. Any forms that require more than 25 seconds to load or to save back to the database will not satisfy a requirement that SBIC Web acts in an efficient manner that will negatively affect the user experience of the application. In the event of such latency within the refreshing of a form or report or the saving of data to the underlying database of SBIC Web, the issue shall need to be looked into if prioritized by the OII COR. (e) Filing Submissions (High Submission Rates) – As of March 2021, SBIC Web users were able to file with a 98% completion rate. It is expected that the selected contractor will be able to maintain and approve on this rate of filing accuracy. (f) Ensure Smooth Rollouts of Application Builds and Releases. SBIC Web currently resides on un-structured code that may be hard to maintain. This underlying feature of SBIC Web’s underlying source code may make it hard for SBIC Web to build releases in a timely manner which are error free and without bugs. To prevent the smooth operations of SBIC Web, it shall be necessary that the contractor should work on making the underlying source code of SBIC Web to be more stable. This stability is needed as OII’s is envisioning SBIC Web to capturing financial information in the same sense that a modern day financial or bank would. To make SBIC Web more stable, it is expected that the contractor creates adequate documentation such as a system design and system architecture document. In addition, the source code must be in a standardized location that manages builds and releases. Code reviews will be necessary and the creation of a knowledge base will be used to manage tickets which identify their underlying causes as well as resolutions. (ii) Using an Agile Scrum Project Management Methodology to Monitor and Assign Work. The SBA and OII is increasingly moving towards iterative processes for managing IT projects, especially software development. It is required that the contactor use an Agile/Scrum project management methodology that has the following features: (a) Daily Contractor/Government Meetings. Daily stand-up meetings with both Government and contracting staffs. Meetings should discuss what each person is working on, any issues that may have arose and any roadblocks that may exist hindering work assignments. (b) Using Project Management Tools. Storing operations artifacts such as documents, source code, solutions to bug fixes and creating a knowledge base for SBIC Web issues using tools such as Jira, SharePoint, Git Hub, Asana or Microsoft Dev Ops. (c) Measuring Performance. Using units of measurements such as story points to prioritize the velocity of tickets being worked on each week. (d) Analyzing Tickets and their Resolution. Creating at the end of each week showing the following statuses: • Tickets Received • Tickets Closed • How issue was resolved • Identifying the root cause of an issue • Formulate an assessment of permanently fixing an issue • Pending Tickets or Bugs needing to be addressed (e) Prioritizing Emergency Tickets -- Acting at the direction of the COR to prioritize emergency tickets against any existing application maintenance and all project related activities. (f) Using Project Management Tools to Make Staffing Changes. Using units of measurement such as story points and sprint velocity along with project status reports such as the product backlog reports to make potential contracting staffing changes. (g) Creating a Knowledge Database for OII’s IT Systems. Create a knowledge base that can be used to assist users in a timely manner. This knowledge base can be used to make the application more efficient. (iii) Data Transfer/Migration. OII has IT systems that contain thousands of data elements. In addition, OII is planning on installing and configuring servers that will be used for storage of documents as well as for developing reporting solutions. The envisioned architecture will be having SBIC Web (which is a SQL Server/.NET application) reside on the SBA’s PaaS architecture. OII is anticipating having internal reporting and document management on an IaaS environment. To support this environment, the contractor shall be responsible for the following: (a) Transferring Data on Variegated Architectures. The contractor shall transfer data from one environment to another with data residing on different architectures. To accomplish this task, the contractor shall use techniques and protocols to transfer data such as (a) backing up and restoring database files (b) employing database connectivity tools such as ODBC, JDBC, ADO, DAO, ADO.Net (c) configuration tools such as replication which enable transferring of data from one environment to another upon an CRUD (Create, Read, Update and Delete) actions that are performed on the source database. (b) Safeguarding Sensitive Data. The contractor shall work with sensitive data and be able to migrate data from different environments such as Test, Development and Production which would include applications such as SBIC Web and other OII applications. In transferring data across different environments, the contractor shall take measures to support encryption techniques such as anonymization, encryption at rest, and encryption in transit. (iv) Quality Assurance. The contractor shall take measures to maintain data integrity within OII applications in the following areas: (a) Ensuring Data Accuracy in Every Build – The contractor will perform regression testing on every release showing aggregated values such as the amount of leveraged capital and regulatory capital that is contained within the new release is similar and on trend to data that is captured within a production environment. (b) Cross-Checking Identical Information in Different Sources – The contractor shall take reports that have identical information (namely fields) that exist on more than one report within OII systems and shall ensure their data consistency. This entails that fields that are replicated on different reports must be identical in terms of value. (c) Pre-Existing or New Bugs – The contractor shall prioritize (at the direction of the Government COR) any data related issues that are deemed as pre-existing or new bugs that have been detected by the contractor, SBA staff or external users. (d). Quality Assurance and Operations -- The contractor shall be responsible for providing operations reports that provide aggregate level funding and loan values that exists within OII Systems as well as a summary of fields values contained in reports or database across sprints. (v). System Configuration/Integration/Maintenance. The contractor shall configure server architectures, databases and applications operating on PaaS, IaaS, SaaS and on-premises architectures. The contractor shall be responsible for the following tasks: (a) The contractor shall work with OCIO and other staffs related to configuring servers, databases and applications on different SBA platforms and architectures. (b) The contractor shall be responsible for implementing security measures on different SBA architectures where OII applications reside. (vi). Review Audit and System files. Troubleshoot system generated audit files pertaining to the operations of SBIC Web and other OII applications. The contractor shall support the following areas: (a) Review and Analyze Auditing Data from Operating System Logs-- The contractor will review audit logs from Windows based operating systems and troubleshoot OII system related issues. The contractor may also be asked to create reports on data extracted from the server and network logs. (b) Review and Analyze Auditing Data from Database System Logs-- The contractor shall review audit logs from database(s) and troubleshoot OII system related issues. The contractor may also be asked to created reports on data extracted from the Database logs. (c) Review and Analyze Auditing Data from Web Server Logs-- The contractor shall review audit logs from Web Servers and troubleshoot OII system related issues. The contractor may also be asked to created reports on data extracted from the Web Server logs. (d) Review and Analyze Auditing Data from SBA Network Logs-- The contractor shall review audit logs from SBA Networks and troubleshoot OII system related issues. The contractor may also be asked to created reports on data extracted from the SBA network logs. (e) Merging Data from Operating System, Database, Web Server and Network Logs. The contractor shall merge information contained in network, operating system, database and web server logs to troubleshoot issues. The contractor may also be asked to merge data from the different log types and create reports from them. (vii). Supporting Mirrored Test and Production Environment. The contractor shall be responsible for maintaining databases and applications that have data that will be synced at least twice a month or more frequently. The following are areas that the contractor will be responsible for: (a) Refreshing Applications and Data Across Different Environments. Implementing procedures that ensure Production, Development and UAT environments of SBIC Web have data that is in sync and not stale. Database or application changes made within either the test, development or production environments should be seamlessly replicated to other environments after source code changes. A change, for example, made within the development environment should be able to be migrated over to a production environment. (b) Creating and Maintaining Standard Operating Procedures to Migrate and Transfer Data Across Different Environments. The contractor shall create, maintain, and update standard operating procedures related to database and application builds, backups and restorations across different environments. This documentation should be stored in a centralized document repository. (c) Timeliness of Creating Application and Database Builds Across Different Environments. Once a standard operating procedure is created, builds of applications and databases should be done within a four hour turn around period. (viii). Initiating and Supporting Responses for Annual Security Accreditation. OII’s IT systems are currently categorized as posing a medium level of security risk. If required, higher levels of risk assessments may be dictated by the SBA’s OCIO’s Office. The contractor shall satisfy any controls, settings, configuration and the creation of system related procedures and documentation related to the annual security accreditation. The following are tasks that the contractor shall implement and support: (a) Configuring a backup strategy and implementing database level encryption so that the underlying database data and logs files are encrypted. (b) Implementing and ensuring that data is encrypted in transit by using protocols such as the Security Sockets Layer (SSL) on internet connections – both for internal and external users. (c) Implementing security roles within SBIC Web and other applications or access to folders such that information is viewed on a need-to-know-basis. (d) Training SBA users and other vendors on how to mask and unmask data that is encrypted. For example, SQL statements may need to use certain de-ciphering functions to allow users to view the original unencrypted data that a user has entered. The contractor shall be responsible for having procedures in place on un-encrypting data for SBA users and other vendors/contractors. (e) Managing procedures as well as collaborating with SBA/OII staff on certificates and passwords that are used in the encryption process so that the original SBA/OII staff can access data that has been secured. SBA/OII staff should have the necessary keys, certificates, passwords and procedures to view data that the contractor supports which belongs to the SBA. (f) The contractor shall work with the OCIO’s security staff on all documentation that is required for the annual security accreditation such as working on the system security plan, privacy assessments, and system architectural document as well as other required documents needed for OII to obtain an Authority to Operate. (ix) Working with Other SBA Staffs and Vendors. The Office of Investment is currently trying to modernize its IT systems. Part of the responsibility will be to work with SBA staffs in addition to outside vendors: The contractor shall need to work with other staffs which are the following: (a) OCIO’s Office – All Staffs (b) OII – All staffs (c) Office of General Counsel (OGC) – staff members representing the agency on security issues. (d) Representatives from Industry Trade Groups – examples would be the Small Business Investment Alliance (SBIA) or other organizations that work with SBICs. (e) Outside vendors –external firms such as staffs working for SBICs or other financial institutions. (f). Government COR– The COR will be in most meetings with other staffs but if not present, should be notified by email of meeting discussions with other staffs. (x). System Documentation. (a). Developing Adequate Documentation of OII system. The contractor shall create system documentation including system architectural and design documentation as well as entity diagrams of OII Systems such as SBIC Web. The goal of this documentation is to ensure that new employees working on SBIC Web and other OII systems have sufficient documentation so that they can be assigned tasks to meet milestones within an efficient manner. (b). Government Involvement in Documentation Creation. If the contractor cannot create this documentation which is caused by project priorities or cannot create this documentation at a standard meeting the approval of the Government COR, the contractor will then be responsible to answer any technical questions about any of the OII Systems such as SBIC Web or other systems. (c) Documentation and Coding Repositories. The documentation and underlying source code for OII applications shall be stored in one or more tools to manage software development and the management of maintaining and enhancing OII applications. All source code and project management tools shall be stored in applications such as Jira, Asana, Microsoft Dev Ops, GIT, Visual Source Safe or other tools that are selected by the contractor. (d) Ownership of Source Code and System Documentation – The Government is the sole owner of the data, source code and documentation of all OII systems which cannot be used or sold to non-SBA/OII parties. (e) Passwords, userids, keys, and certificates. The contractor shall provide all system-based userids, passwords, certificates and keys (both public and private) to the Government COR on request. In order to ensure adequate security measures, the passwords, userids, keys and certificates shall be stored in an electronic vault. Submit your response to the Contracting Officer via email at pedro.arritola-vazquez@sba.gov by 5pm EST, May 6, 2021. Vendor participation in this response or any informational session is not a promise of future business with the SBA. Pursuant to FAR 52.215-3, your attention is required to the following provision: Request for Information or Solicitation for Planning Purposes (Oct 1997) (a) The Government does not intend to award a contract on the basis of this request for information or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation. (b) Although “proposal” and “offeror” are used in this Request for Information, your response will be treated as information only. It shall not be used as a proposal. (c) This solicitation is issued for the purpose of obtaining the information described above. Note that this is NOT a solicitation but is a Sources Sought Notice only. Responses may be used in the development of a potential future acquisition. Contracting Office Address: Small Business Administration Acquisition Division 721 19th St Denver, CO 80202