RAIDD = Risks, Assumptions, Issues, Dependencies, Decisions — the single log referenced throughout the Task Order Management Plan, Governance Model, Dashboard, and Steering Deck. Several of the highest-severity risks here trace directly back to the ATO gate, since nothing goes live in a federal environment without it. Risk authority (who can accept, escalate, or fund a response) is defined in Governance Model §7 — this page is the record of what those risks, issues, and decisions actually are.
6
Risks
5
Assumptions
5
Issues
5
Dependencies
4
Decisions
Risks
Risk Register
Score = Likelihood × Impact, each rated 1–3 (Low/Medium/High), for a 1–9 scale. 1–3 low · 4–6 medium · 7–9 high. The Low/Medium/High pair shown next to each score is (Likelihood/Impact).
| ID | Risk | Score | Owner | Status | Response |
|---|---|---|---|---|---|
| R-01 | ATO assessment surfaces a security finding that delays Milestone Gate 1 beyond Dec 14, 2026 | 9 (High/High) | T. Abernathy (ISSO) | Watch | Pre-assessment scan run 60 days ahead of formal submission specifically to surface findings early; POA&M template pre-staged so any finding has a remediation path ready same-day |
| R-02 | Legacy applicant data has inconsistent formatting that complicates the migration validation | 6 (Medium/High) | K. Lindqvist | Watch | Automated field-level profiling ahead of each conversion dry run; extends CDRL A009 timeline only if root-cause cleansing proves insufficient |
| R-03 | Original 7-person staffing estimate had no developers — realized as an actual planning gap, not just a hypothetical risk | 4 (Low/High) | C. Tyrrell | Mitigated | Realized — see D-02; drove the Resource Plan correction to 13 people, reflected in the Task Order Budget's $3,550,000 baseline |
| R-04 | Cumulative contract modifications (11 to date, net +$4,154,000 — 117% growth on the $3,550,000 award baseline) could mask underlying scope creep if not tracked against the original PWS baseline | 6 (Medium/High) | A. Reyes (CO) | Monitoring | Every mod traced individually in the Contract Mod Log against the original PWS section it amends, and every post-award requirement is carried in the Requirements Traceability Matrix against the Mod that introduced it; CO reviews cumulative growth at each monthly status meeting. Likelihood raised to Medium/High on Jul 2, 2026 after P00011 (+$4,040,000) more than doubled the Task Order value in a single modification |
| R-05 | All-onshore staffing constraint (no offshore permitted under this Task Order) limits surge capacity if a developer or QA resource attrites mid-Option-Period | 6 (Medium/High) | D. Ferris (Deputy PM) | Monitoring | Pre-cleared onshore bench candidates identified with Acme Federal Systems' staffing team as a contingency; no offshore substitution permitted regardless of severity |
| R-06 | Section 508/ATO compliance knowledge is concentrated in two named individuals (P. Duvall, T. Abernathy); either's unplanned absence would stall a compliance-gated deliverable | 3 (Low/Medium) | C. Tyrrell | Mitigated | Cross-training documented in the Governance Model's succession section; QA Lead (N. Castellano) cross-trained as 508 conformance backup reviewer |
Assumptions
Assumptions
| ID | Assumption | Owner |
|---|---|---|
| A-01 | FOPBA will provide legacy system read access within 15 days of Task Order start | C. Tyrrell |
| A-02 | The Option Period will be exercised based on satisfactory Base Period performance (CPARS rating of Satisfactory or better). Did not hold as written — the Option Period was exercised in Month 2 by Mod P00010 (Jul 2, 2026) on a FAR 17.207 determination driven by FY2026 appropriations timing, not by performance to date. Performance was in fact satisfactory at the time of exercise, but the assumption's stated trigger was not the operative one | C. Tyrrell |
| A-03 | No additional offshore staffing will be authorized at any point during the Option Period, consistent with the PHI/ATO onshore-only requirement stated in the Task Order PWS | D. Ferris |
| A-04 | FOPBA's existing network and security infrastructure is sufficient to support the modernized portal without a separate agency capital investment | K. Lindqvist |
| A-05 | The Section 508 conformance baseline established during the Base Period will not require full re-testing after minor Option Period enhancements, only delta-testing of changed components | P. Duvall |
Issues
Issue Log
| ID | Issue | Owner | Status | Resolution | Target / Actual Closure |
|---|---|---|---|---|---|
| I-01 | COR review turnaround on CDRL A001 ran 5 business days over the QASP-implied cadence | C. Tyrrell | Closed | An expedited review track for schedule-critical CDRLs was agreed with the COR going forward; captured as LL-10 in Lessons Learned | Closed Jun 30, 2026 |
| I-02 | Independent Section 508 auditor's first-pass review flagged 2 minor conformance gaps in early UI components | P. Duvall | Resolved | Both gaps remediated and re-tested clean ahead of CDRL A004 acceptance | Closed Jul 17, 2026 |
| I-03 | Early UAT cycle surfaced a data-mapping discrepancy between the legacy DB2 benefit-type schema and the new platform's schema for one benefit category | J. Okonkwo | Closed | Resolved via joint review with FOPBA business data owners; mapping table corrected and re-validated in the next dry run | Closed Jul 9, 2026 |
| I-04 | Contract Modification P00007 (schedule-only, no cost) took longer than expected to fully execute due to a CO staffing gap on the government side | A. Reyes | Closed | Executed; no downstream schedule impact since the mod itself was schedule-related and self-contained | Closed Jul 2, 2026 |
| I-05 | Intermittent VPN latency to FOPBA's government furnished environment (GFE) affected DevOps deployment windows during two sprints | S. Vance | Open | Tracking with FOPBA's internal IT. Original Aug 15, 2026 target missed — the root cause sits inside FOPBA's network, outside Acme's control, so the issue was escalated to the COR on Aug 27, 2026 and is now carried as a Government-side dependency. Interim workaround remains scheduling deployments outside peak GFE network hours, which has held the schedule but constrains the deployment window as build volume rises post-P00011 | Revised target: Oct 30, 2026 (orig. Aug 15, 2026, missed) |
Dependencies
Dependency Log
| ID | Dependency | Owner | Status |
|---|---|---|---|
| DEP-01 | ATO package (CDRL A007) cannot be submitted until Section 508 report (CDRL A006) is accepted | T. Abernathy | At Risk |
| DEP-02 | Front-end/back-end developer onboarding depends on the DevOps Engineer's cloud environment being provisioned first | S. Vance | On Track |
| DEP-03 | Production cutover cannot proceed until COR final acceptance is recorded against every Base Period CDRL, not just the ATO package | M. Whitcombe (COR) | On Track |
| DEP-04 | Option Period exercise decision depends on a satisfactory CPARS rating being filed for Base Period performance | A. Reyes | On Track |
| DEP-05 | Section 508 VPAT final sign-off depends on the independent auditor completing a second conformance pass after I-02's remediation | P. Duvall | On Track |
Decisions
Decision Log
| ID | Decision | Decided By | Date |
|---|---|---|---|
| D-01 | Section 508 testing will use an independent government auditor rather than contractor self-attestation. Implemented by Mod P00001, executed May 29, 2026 | M. Whitcombe (COR) | May 19, 2026 |
| D-02 | Correct the Resource Plan from 7 leadership-only roles to a 13-person team including developers, DevOps, and a second QA tester. Taken during Task Order planning, before kickoff — which is why the Kickoff Deck already shows a 13-person team on Day 1 | C. Tyrrell | May 6, 2026 |
| D-03 | Pursue a phased ATO (interim authorization for lower-risk components) rather than holding all functionality for a single full ATO gate, to reduce the R-01 schedule exposure | M. Whitcombe (COR) / A. Reyes (CO) | Aug 19, 2026 |
| D-04 | Route all scope changes through the formal Contract Modification process rather than absorbing them within existing CDRL baselines, even schedule-only changes | A. Reyes (CO) | Sep 3, 2026 |