Federal programs don't start with a PM-authored charter the way a commercial project does. The government writes the requirements document — the PWS — and the PM's authorization to start work comes from the awarded Task Order itself, not an internal executive sign-off. That distinction shapes everything below: scope, funding, and success criteria are not proposed by the contractor and approved by a sponsor: they are specified by the government, and the contractor's job is to deliver against them exactly as written, with any deviation requiring a formal Contract Modification rather than a PM's discretionary call.
Task Order Authorization
| Contract Vehicle | Health Systems Support IDIQ (HSS-IDIQ) |
| Task Order | Task Order 3 — BenefitConnect Portal Modernization |
| Contract Type | Firm-Fixed-Price (FFP) |
| Issuing Agency | Federal Office of Public Benefits Administration (FOPBA) |
| Prime Contractor | Acme Federal Systems |
| Contracting Officer (CO) | A. Reyes |
| Contracting Officer's Representative (COR) | M. Whitcombe |
| Federal Business Owner / Sponsor | R. Osei |
| Task Order Program Manager (Contractor) | C. Tyrrell |
| Total Firm-Fixed Price (Baseline) | $3,550,000 (Base $2,695,000 + Option $855,000) |
| NAICS Code | 541512 — Computer Systems Design Services |
1. Background
FOPBA's citizen-facing benefits application portal runs on a legacy platform — built on an aging technology stack the incumbent vendor is sunsetting — that no longer meets current federal accessibility and security standards. The platform predates the current Section 508 conformance testing regime and was never subject to a modern Risk Management Framework (RMF) security assessment, meaning it operates today without a current Authority to Operate (ATO) in the strict sense the RMF now requires for any system handling applicant PII. Continuing to operate the legacy platform is not a viable long-term option regardless of cost: the incumbent vendor's own end-of-support timeline forces a modernization decision on FOPBA's schedule, not a discretionary one FOPBA could defer indefinitely. This Task Order modernizes the portal to a current, Section 508-conformant, RMF-authorized platform while maintaining continuity of service for existing applicants — nobody with an in-flight benefits application can be left without a working portal during the transition.
2. Scope of Work
- 2.1 Replatform the citizen-facing benefits application portal to a modern, accessible web application, covering account creation, benefits application intake, status tracking, and secure document upload
- 2.2 Achieve and document Section 508 accessibility conformance (WCAG 2.1 AA-aligned), independently audited rather than self-attested
- 2.3 Obtain Authority to Operate (ATO) under the Risk Management Framework prior to production cutover, including a System Security Plan, Security Assessment Report, and Plan of Action and Milestones (POA&M)
- 2.4 Migrate existing applicant data and in-flight applications from the legacy platform without service interruption to any applicant mid-process
- 2.5 Provide a 6-month Option Period of post-launch stabilization support, including continuous ATO monitoring and defect-fix sustainment, exercisable at FOPBA's discretion based on Base Period performance
- 2.6 Deliver all contract data items per the CDRL on the schedule specified, with each deliverable formally accepted (not merely submitted) by the COR before it is considered complete
Explicitly out of scope: case-worker-facing backend adjudication systems (a separate, previously modernized system this portal integrates with but does not replace); any change to benefit eligibility rules or program policy, which remains FOPBA's exclusive domain; and any work under a different NAICS code or labor category not listed on the HSS-IDIQ schedule.
3. Period of Performance
| 3.1 Base Period | 12 months — portal build, ATO authorization, data migration, and production cutover |
| 3.2 Option Period | 1 × 6-month option — post-launch stabilization support, exercised via Mod P00010 |
| Total Period of Performance | 18 months (if option exercised) |
The Option Period is priced into the Task Order at award (a standard IDIQ practice) rather than separately negotiated later — FOPBA's decision to exercise it is a formal Contracting Officer action (see Mod P00010 on the Contract Modification Log), not an automatic extension, and is explicitly contingent on satisfactory Base Period performance.
4. Deliverables (CDRL Summary)
4.1 All deliverables are enumerated with due dates, formats, and acceptance criteria in the Contract Data Requirements List — 10 line items in total, spanning the Project Management Plan (A001), Integrated Master Schedule (A002), Section 508 Test Plan and Report (A004/A006), System Security Plan and ATO package (A005/A007), Monthly Status Reports (A008), the data migration validation report (A009), and final closeout certification (A010). Each is formally accepted by the COR, not merely submitted — a distinction that matters because a submitted-but-rejected deliverable does not satisfy the contract, and re-submission timelines are tracked against the original due date, not reset by the rejection.
5. Success Criteria & Performance Standards
- 5.1 ATO granted and production cutover completed within the Base Period, with zero unplanned service interruption for applicants with in-flight applications
- 5.2 Independent Section 508 audit finds full conformance (or all findings remediated) prior to go-live
- 5.3 All 10 CDRL line items accepted by the COR, none rejected more than once
- 5.4 QASP surveillance metrics remain within acceptable range across the period of performance (see the QASP for the specific surveillance methods and metrics)
- 5.5 Total Task Order cost remains within the Firm-Fixed-Price baseline plus any Contracting-Officer-approved modifications — no unapproved cost growth
6. Constraints & Assumptions
Constraints: 6.1 all delivery-team personnel handling applicant PII or supporting the ATO/RMF security authorization must be U.S. persons performing work onshore — no offshore staffing is permitted on this Task Order, unlike the Agile suite's commercial program. 6.2 The Firm-Fixed-Price structure means Acme Federal Systems bears internal cost-overrun risk; FOPBA's exposure is limited to the negotiated price plus approved modifications.
Assumptions: FOPBA provides timely read access to legacy system data for migration planning (see RAIDD Log, Assumption A-01); the Option Period will be exercised based on satisfactory Base Period performance (RAIDD Log, Assumption A-02); no material change to benefit eligibility rules occurs during the period of performance that would require portal logic changes beyond the original PWS scope.
7. Place of Performance
7.1 Primarily remote/contractor-site performance. All personnel handling applicant PII or ATO/RMF-scoped work must be U.S. persons performing work from within the United States (see Constraints, Section 6) — this is an onshore-location requirement, not a requirement to work from a specific government facility. 7.2 Up to 4 on-site visits to FOPBA headquarters per Base Period are anticipated for Milestone Gate reviews, ATO briefings to the Agency Authorizing Official, and kickoff/closeout meetings; travel for these visits is priced into the Task Order rather than billed as a separate travel line item.
8. Government Furnished Property & Information (GFP/GFI)
| Item | Description |
|---|---|
| 8.1 Legacy System Read Access | FOPBA provides contractor read access to the legacy benefits portal database and application server logs for migration planning and validation (RAIDD Log, Assumption A-01) |
| 8.2 GFE Network / VPN | FOPBA-managed VPN connectivity into the government furnished environment (GFE) for deployment and testing against non-production instances |
| 8.3 Existing Eligibility Rules Documentation | FOPBA-maintained business rules documentation for benefit eligibility logic, provided as reference — the contractor does not alter eligibility rules (see Scope, Section 2) |
No government furnished equipment (hardware/software licenses) is provided — the contractor procures and is reimbursed for all development, cloud hosting, and testing tooling under the Task Order's FFP structure.
9. Performance Requirements Summary Matrix
Ties each measurable performance standard to its surveillance method and acceptable quality level (AQL) — the government's basis for monitoring contractor performance under this PWS. Full surveillance methodology, sampling approach, and remedies for unacceptable performance are in the QASP.
| Performance Standard | AQL | Surveillance Method |
|---|---|---|
| 9.1 CDRL deliverables submitted on or before the due date specified | 98% on-time submission rate | 100% inspection — Deliverable Acceptance Log |
| 9.2 Section 508 / WCAG 2.1 AA conformance on all delivered UI components | Zero unremediated Level A/AA failures at CDRL A006 acceptance | 100% inspection — independent VPAT audit |
| 9.3 Zero unauthorized applicant PII disclosure incidents | Zero tolerance | Continuous monitoring — customer complaint / incident reporting |
| 9.4 Data migration completed with no service interruption to in-flight applicants | Zero applicant-impacting incidents during cutover | 100% inspection — Data Migration Validation Report (CDRL A009) |
10. Applicable Federal Requirements
- 10.1 Federal Acquisition Regulation (FAR) clauses incorporated by reference in the Task Order
- 10.2 Section 508 of the Rehabilitation Act — accessibility conformance
- 10.3 Risk Management Framework (RMF) — security authorization prior to go-live (ATO)
- 10.4 All delivery-team personnel handling applicant PII or supporting the ATO/RMF security authorization must be U.S. persons performing work onshore — no offshore staffing is permitted on this Task Order
- 10.5 HSS-IDIQ labor category schedule — every billed role must map to a pre-negotiated labor category and rate ceiling on the underlying IDIQ contract, verified during the labor-category audit that produced Mod P00009