U.S. EPA Central Data Exchange (CDX)

Draft Statement of Work

**May 21, 2008**

![](media/image1.png){width="2.026388888888889in" height="2.25in"}

United States Environmental Protection Agency (EPA)

Office of Environmental Information (OEI)

Office of Information Collection (OIC)

[Background 3](#__RefHeading___Toc198603906)

[**CDX Stakeholders** 4](#__RefHeading___Toc198603907)

[**Mission, Vision and Strategy of CDX Branch**
4](#__RefHeading___Toc198603908)

[**CDX Program Current Initiatives** 5](#__RefHeading___Toc198603909)

[**CDX Program as a Solution Provider** 6](#__RefHeading___Toc198603910)

[**Cross Media Electronic Reporting Rule (CROMERR)**
6](#__RefHeading___Toc198603911)

[Business Support Services 7](#__RefHeading___Toc198603912)

[**Program Management Support** 7](#__RefHeading___Toc198603913)

[**CDX Business Model Support** 8](#__RefHeading___Toc198603914)

[**Project Management** 9](#__RefHeading___Toc198603915)

[**Technical Facilitation and Consulting**
10](#__RefHeading___Toc198603916)

[Primary Development Services 10](#__RefHeading___Toc198603917)

[**Standard Data Flow Development and Life-Cycle Management Process**
10](#__RefHeading___Toc198603918)

[**Systems Engineering** 12](#__RefHeading___Toc198603919)

[**Node and Exchange Network Flows** 13](#__RefHeading___Toc198603920)

[**Node Development and Deployment Assistance**
15](#__RefHeading___Toc198603921)

[**Quality Assurance (QA) and Shared Exchange Network Services Support**
16](#__RefHeading___Toc198603922)

[**Security Solutions** 18](#__RefHeading___Toc198603923)

[**Data Publishing** 20](#__RefHeading___Toc198603924)

[**Web Development Services** 20](#__RefHeading___Toc198603925)

[**Cross Media Electronic Reporting Rule (CROMERR) Services**
23](#__RefHeading___Toc198603926)

[**CDX Registration Services** 23](#__RefHeading___Toc198603927)

[**Reporting Centers (RC)/Data Processing Centers (DPC)**
24](#__RefHeading___Toc198603928)

[Additional Development Services 26](#__RefHeading___Toc198603929)

[**Enhanced Financial Reporting** 26](#__RefHeading___Toc198603930)

[**Dedicated Hardware and Software Support**
27](#__RefHeading___Toc198603931)

[**Routine Data Exchange Upgrades** 27](#__RefHeading___Toc198603932)

[**Outreach, Communication and Governance Support**
28](#__RefHeading___Toc198603933)

[**Quality Assurance Planning, Implementation and Reporting**
28](#__RefHeading___Toc198603934)

[Primary Operation and Maintenance Services
28](#__RefHeading___Toc198603935)

[**Data/Document Archiving and Tape Back Up Services**
30](#__RefHeading___Toc198603936)

[**Help Desk** 30](#__RefHeading___Toc198603937)

[Additional Operational and Maintenance Services
32](#__RefHeading___Toc198603938)

[**Dedicated Hardware and Software Support**
32](#__RefHeading___Toc198603939)

[**Elevated O&M Support Services** 32](#__RefHeading___Toc198603940)

[**Training for CDX Users** 33](#__RefHeading___Toc198603941)

[**Shared Services O&M and Deployment Assistance**
33](#__RefHeading___Toc198603942)

[**Database Management Services** 34](#__RefHeading___Toc198603943)

[**Systems Performance Monitoring and Reporting**
34](#__RefHeading___Toc198603944)

[Geospatial Services 35](#__RefHeading___Toc198603945)

[**Geospatial Exchange and Geospatial Data and Metadata Management
Support** 36](#__RefHeading___Toc198603946)

[**Geospatial Data and Metadata Technology and Tool Development**
37](#__RefHeading___Toc198603947)

[Transition Planning 38](#__RefHeading___Toc198603948)

[]{#__RefHeading___Toc198603906 .anchor}**Background**

The United States Environmental Protection Agency (EPA) is charged with
protecting human health and the environment. Since 1970, EPA has been
working for a cleaner, healthier environment for the American people.

EPA employs 17,000 people across the country, including our headquarters
offices in Washington, DC, ten regional offices, and more than a dozen
labs. EPA staff is highly educated and technically trained; more than
half are engineers, scientists, and policy analysts. In addition, a
large number of employees are legal, public affairs, financial,
information management and computer specialists. EPA is led by the
Administrator, who is appointed by the President of the United States.
The following are the primary work areas in which EPA has been tasked:

-   Develop and enforce regulations: EPA works to develop and enforce
    regulations that implement environmental laws enacted by Congress.
    EPA is responsible for researching and setting national standards
    for a variety of environmental programs, and delegates to states and
    tribes the responsibility for issuing permits and for monitoring and
    enforcing compliance. Where national standards are not met, EPA can
    issue sanctions and take other steps to assist the states and tribes
    in reaching the desired levels of environmental quality.

-   Offer financial assistance: In recent years, between 40 and 50
    percent of EPA\'s enacted budgets have provided direct support
    through grants to State environmental programs. EPA grants to
    States, non-profits and educational institutions support
    high-quality research that will improve the scientific basis for
    decisions on national environmental issues and help EPA achieve its
    goals.

-   Perform environmental research: At laboratories located throughout
    the nation, the Agency works to assess environmental conditions and
    to identify, understand, and solve current and future environmental
    problems; integrate the work of scientific partners such as nations,
    private sector organizations, academia and other agencies; and
    provide leadership in addressing emerging environmental issues and
    in advancing the science and technology of risk assessment and risk
    management.

-   Sponsor voluntary partnerships and programs: The Agency works
    through its headquarters and regional offices with over 10,000
    industries, businesses, non-profit organizations, and state and
    local governments, on over 40 voluntary pollution prevention
    programs and energy conservation efforts. Partners set voluntary
    pollution-management goals; examples include conserving water and
    energy, minimizing greenhouse gases, slashing toxic emissions,
    re-using solid waste, controlling indoor air pollution, and getting
    a handle on pesticide risks. In return, EPA provides incentives like
    vital public recognition and access to emerging information.

Further environmental education: EPA advances educational efforts to
develop an environmentally conscious and responsible public, and to
inspire personal responsibility in caring for the environment. More
information

More information about EPA's mission and strategy can be found at
www.epa.gov.

The Office of Environmental Information (OEI), headed by the Chief
Information Officer, manages the life cycle of information to support
our goal of protecting human health and the environment. The OEI Office
of Information Collection (OIC) collects, manages, provides and
safeguards environmental information.

As a result of increasing demand for electronic reporting and data
exchange among trading partners and the regulated community, in 1999 EPA
established the Central Data Exchange (CDX). CDX is the designated
gateway where environmental data is received from the regulated
community and processed for delivery to program offices in the Agency.
CDX also serves as the point of presence on the Environment Information
Exchange Network where currently State and Tribes routinely conduct data
transactions with EPA.

[]{#__RefHeading___Toc198603907 .anchor}**CDX Stakeholders**

The CDX Program has many stakeholders. Listed below are descriptions of
some of the various stakeholders.

-   ***EPA Program Offices and EPA Regional Offices*** -- They develop
    environmental rules that require submission of environmental data to
    EPA. Provide funding for CDX projects to the OEI CDX Program Team
    and develop business and technical requirements for submission of
    environmental data to EPA. These are the traditional CDX customers.

-   ***State, Local and Tribal Partners*** -- Typically wish to develop
    a presence on the Environmental Information Exchange Network. Most
    state, local and tribal partners receive grant money from EPA to
    help fund projects with the Exchange Network.

-   ***CDX Users*** -- Environmental rules developed by EPA Program
    Offices require CDX users to submit environmental data to EPA. CDX
    users do not typically provide funding for CDX services.

-   ***OEI CDX Program Team*** -- Works directly with the contractor to
    develop and deliver CDX services while ensuring project quality,
    scope, cost and schedule are maintained. Integrates new technologies
    into CDX services and leads governance of the CDX Program.

    []{#__RefHeading___Toc198603908 .anchor}**Mission, Vision and
    Strategy of CDX Branch**

The branch that manages the CDX Program for EPA is the Information
Exchange Technology Branch (IETB) and it is within EPA\'s Office of
Information Collection (OIC). Listed below are the IETB Vision, IETB
Mission and IETB Strategies.

***IETB Vision:***

-   To serve as EPA's center of excellence for electronic reporting and
    exchange of environmental data through the Central Data Exchange
    (CDX).

***IETB Mission:***

-   Support protection of human health and the environment by leading
    the Agency in electronic data exchange.

-   Provide EPA Programs, States, Tribes, and Industry data exchange
    options to meet their business needs through CDX.

-   Create CDX solutions and implement a Service Oriented Architecture
    in alignment with the Agency's architecture.

-   Maintain support services to internal and external customers that
    are comparable to the best in the business.

-   Assist EPA Programs to comply with their federal technical and
    policy requirements.

***IETB Strategies:***

-   Provide technical, contractual, financial, and project management
    expertise to assist exchange partners in developing data exchanges.

-   Work collaboratively with OEI and Program Offices on a consultation
    basis to support the development and maintenance of data exchanges
    that meet EPA and federal policies, standards, and regulations.

-   Provide expertise to Programs, States, Tribes, and Industry on
    regulatory programs to assist in data flow design.

-   Serve as a focal point in the Agency for Web services and Service
    Oriented Architecture activities.

-   Communicate CDX support services in a transparent way.

-   Keep abreast of federal requirements and guidelines involving
    project management, security, and investments.

-   Implement and maintain security standards, investment, and
    contractual requirements as specified by federal, EPA, and program
    requirements.

-   Develop and support options for exchange partner registration and
    authentication alternatives to meet program and regulatory
    requirements.

-   Provide messaging options to assist in informing customers on status
    of reporting and publishing requests.

-   Provide and implement options for complying with the Cross-Media
    Electronic Reporting Regulation (CROMERR) for all applicable
    partners.

    []{#__RefHeading___Toc198603909 .anchor}**CDX Program Current
    Initiatives**

CDX is currently supporting the flow of data of 38 programs in the
Agency. OIC is in the process of expanding CDX and the Exchange Network
to support data exchanges with other Federal Agencies in the U.S. and
internationally as well as provide the infrastructure and expertise for
assisting more EPA programs in an evolving electronic age.

[]{#__RefHeading___Toc198603910 .anchor}**CDX Program as a Solution
Provider**

From a business operations perspective, the CDX Program has matured to a
point where business processes and procedures are evolving to become
more efficient and effective overall. At the center of this evolution is
a focus to improve on the operational excellence that CDX Customers are
accustomed to receiving from the CDX Program Team.

The CDX Program is the data exchange solutions provider to the EPA and
other CDX Program stakeholders. The structure of this task order is
meant to facilitate successful management and delivery of CDX services
and solutions to CDX customers.

[]{#__RefHeading___Toc198603911 .anchor}**Cross Media Electronic
Reporting Rule (CROMERR)**

The Cross-Media Electronic Reporting Regulation (CROMERR) provides the
legal framework for electronic reporting (ER) under all of the
Environmental Protection Agency\'s (EPA) environmental regulations.
CROMERR applies to: (a) regulated entities that submit reports and other
documents to EPA under Title 40 of the Code of Federal Regulations, and
(b) states, tribes, and local governments that are authorized to
administer EPA programs under Title 40. §3.2000(b) of CROMERR sets
standards for electronic report receiving systems operated by states,
tribes, and local governments under their authorized programs. These
standards cover a variety of system functions, such as electronic
signature validation. The standards are designed to provide electronic
submittals with the same level of legal dependability as the
corresponding paper submittals.

For reports submitted electronically to EPA, CROMERR requires the
reports be submitted to the Central Data Exchange (CDX), or to a system
designated by the Administrator for the receipt of those reports. On
October 13, 2005, EPA published a Federal Register Notice (70 FR 59748)
designating as acceptable all EPA systems that were receiving electronic
reports as of that date to continue receiving those reports until
October 13, 2007. To receive electronic reports after October 13, 2007,
systems other than CDX must be re-designated by the Administrator.
Although CROMERR does not subject EPA systems to the standards, EPA has
decided that all of its systems will conform to the standards when they
operate to receive electronic submittals that are covered by the
regulation. In the Preamble to the regulation, EPA commits to meeting
the §3.2000(b) standards for its own electronic report receiving
systems. CROMERR also requires that states, tribes, and local
governments that wish to continue or begin using ER for their authorized
programs must revise or modify those programs to incorporate ER. CROMERR
details the process to obtain EPA approval of ER-related revisions or
modifications to an authorized program. See
http://www.epa.gov/Networkg/cromerr/

[]{#__RefHeading___Toc198603912 .anchor}**Business Support Services**

[]{#__RefHeading___Toc198603913 .anchor}**Program Management Support**

The CDX Program requires program management support that yields
effectively managed administrative and business functions of the CDX
program. The contractor shall provide support for the key components of
CDX Program Management. The key components of CDX Program Management
support are as follows:

-   Financial Management - Managing program costs responsibly and
    proactively suggesting technical and business operations
    improvements that will lower costs.

-   Performance Management - Ensuring that established goals for
    contractor performance are met.

-   Information Management - Enabling CDX stakeholders to easily access
    their respective CDX Program information and reporting CDX program
    information to them in a way that is user-friendly and meets
    stakeholders\' various needs.

-   Contracts Management - Managing contract activities effectively.

-   Communication Management - Ensuring clear and consistent message are
    being delivered from the contractor to the CDX Team, CDX Customers
    and other CDX Stakeholders.

On a quarterly basis, the contractor shall propose improvements to CDX
Program Management support and therefore, the number of program
management key components could increase or decrease.

Currently, CDX customers provide funding to pay for a portion of the
overall CDX Program Management support provided by the contractor. The
amount customers provide is a fixed percentage of their total CDX
services purchased. This approach is also mentioned in the Business
Model Support task because the CDX Program Team would like a more
innovative business model for having customers fund program management
activities that support the CDX services they purchase.

The contractor shall propose a system for managing and sharing
information securely with all CDX stakeholders. Information shared by
that system could include any of the following:

CDX Program Information

-   Service descriptions

-   Service pricing

-   CDX system technical documentation

-   Marketing materials

-   CDX system status & outage notification

Project Information

-   Schedule progress

-   Cost progress

-   Performance goal attainment

-   Log of schedule/cost changes

Customer Account Information

-   Services ordered

-   Funding balance/owed

-   Contact information

Contract Information

-   Deliverables

-   Modifications

-   Funding status

-   Contractor performance scorecard

*Communication*

In order to leverage the existing communications technologies available
to and used daily by CDX stakeholders, the contractor should also have
video conferencing capabilities that are compatible with EPA video
conferencing services.

[]{#__RefHeading___Toc198603914 .anchor}**CDX Business Model Support**

The CDX Program leads EPA and the Federal government in several areas of
technology management and has won awards because of this technical
excellence. The CDX Program has matured so that the program\'s business
model and business operations need to be improved in order to achieve
excellence in that area as well. The current business model has a
significant impact on CDX customers and improvements could potentially
benefit them in many ways.

The purpose of this task is to improve operational excellence, reduce
costs and increase efficiencies.

CDX Customer financial responsibilities changed starting in FY08:

-   Before FY08, CDX customers, typically EPA Program Offices, were only
    required to pay for CDX development services. Therefore, customers
    with data flows in the CDX production environment (using CDX O&M
    services) were not required to pay for any CDX services.

-   Starting in FY08, CDX customers were required to pay for all CDX
    development services, including enhancements to data flows in the
    CDX production environment. Additionally, customers share costs
    resulting from their usage of CDX O&M services.

Additionally, CDX customers pay for part of the overall CDX Program
Management support provided by the contractor. Currently, the amount
customers provide is a fixed percentage and is based on the amount of
CDX services purchased.

The contractor shall design, implement and maintain a business model for
CDX services. This business model shall, at a minimum, include a
long-term pricing strategy. A long-term pricing approach will improve
pricing stability for CDX services from year to year and allow the CDX
Program Team to provide improved budgeting information to CDX customers.
The contractor shall propose the other components of the CDX business
model. Potential items that could be included are:

-   Evaluation of the effectiveness of the current CDX business model

-   Business operations improvements that will increase efficiencies

-   Steps to enhance the perceived value of CDX services by CDX
    stakeholders

-   Benchmark CDX services against similar services

-   Implications for CDX governance structure

The contractor shall propose CDX services that can be offered as fixed
price services. The contractor shall outline the pros and cons of
offering those CDX services as fixed price.

[]{#__RefHeading___Toc198603915 .anchor}**Project Management**

The Contractor shall provide Project Management (PM) support during all
phases of CDX data flow projects: Definition, Development or
Acquisition, Implementation, Operation and Maintenance, and Termination.

-   Scope Management: Defining project boundaries and the process for
    change control

-   Integration Management: Integration with legacy systems, new systems
    and business processes

-   Time Management: Defining, sequencing, duration estimation and
    schedule control

-   Cost Management: Resource planning, cost estimating, resource
    leveling, cost control

-   Quality Management: Ensure projects satisfy the needs for which they
    were established, including acceptance testing

-   Risk Management: Identifying, assessing and developing solutions to
    threats against project time, cost and quality

-   Process Assessment: Reviewing business processes and identifying
    areas for improvement or compliance with federal and agency
    regulations

-   Configuration Change Management: Maintenance, improvement, tracking
    and coordination of the approved CDX procedures for configuration
    management control

-   Communications Management: Communications planning, information
    dissemination, performance and status reporting to stakeholders and
    managers

-   Work Breakdown Structure (WBS): Development, management, and
    tracking of WBS project plans to ensure system projects are on
    schedule, within budgeted costs, and of high quality. Maintenance
    and tracking of closure of program issues and technical and
    management concerns.

-   Requirements Management: Maintenance and tracking of system
    requirements through all of the phases of the system life cycle

-   System Life Cycle Documentation: Review, analysis, preparation, and
    maintenance of system life cycle documentation

-   Project Management Processes and Tools: Supporting EPA staff in the
    establishment and enforcement of standard project management
    processes and integrating project management tools, including
    providing training on the processes and tools.

    []{#__RefHeading___Toc198603916 .anchor}**Technical Facilitation and
    Consulting**

The CDX Program leads and participates in various technical meetings on
a routine and as needed basis. The contractor shall provide technical
facilitation support to the CDX Program and to CDX customers.

[]{#__RefHeading___Toc198603917 .anchor}**Primary Development Services**

CDX provides a number of primary or \"core\" services to all EPA program
offices and regions, States, tribal and other trading partners,
regulated entities who report and exchange data with EPA, and other
stakeholders. These primary services include the following:

1)  Standard Data Flow Development and Life-Cycle Management Process

2)  Systems Engineering

3)  Node and Exchange Network Flows

4)  Node Development and Deployment Assistance

5)  Quality Assurance (QA) and Shared Exchange Network Services Support

6)  Security Solutions

7)  Data Publishing

8)  Web Development Services

9)  Cross Media Electronic Reporting Rule (CROMERR) Services

10) CDX Registration Services

11) Reporting Centers (RC)/Data Processing Centers (DPC)

Each of the services and requirements for each are described in this
section.

[]{#__RefHeading___Toc198603918 .anchor}**Standard Data Flow Development
and Life-Cycle Management Process**

Data flows are developed collaboratively between EPA OEI, Program
Offices, States and other trading partners. Program Offices lead the
effort in defining the requirements and work with OEI and the contractor
to develop and maintain their data flows. OEI will work with the program
office to develop a statement of work that identifies the typical
activities, deliverables, and acceptance criteria in developing a data
flow.

Most dataflow projects will integrate and utilize existing CDX "core"
services and software components, ---leveraging service oriented
architecture consistent with the EPA's Enterprise Architecture following
the CDX Life Cycle Management Guide. Many data flows consist of
interconnectivity between a trading partner external to EPA (state,
Tribal or local agency or reporting industry), EPA's CDX, and a program
application/database located in the National Computer Center where
coordination is performed through Application Deployment Checklist
procedures.

The typical life cycle for data flow development for CDX Web and the
Exchange Network include a set of activities that need to be completed
to take a flow from conception with a program office to a fully deployed
flow in production. Flow development activities include, but are not
limited to, the following:

-   Document System Requirements. The contractor shall hold
    teleconferences and other follow-up communications with the OEI
    project lead and the program office representative to document the
    system requirements in a Systems Requirements Specification (SRS).

-   Provide Basis of Estimate. Based on the requirements, and for
    discussion purposes, the contractor shall prepare a brief Basis of
    Estimate (BOE) spreadsheet and submit it to the OEI for review and
    clarification. This is not a formal estimate.

-   Develop System Design. The contractor shall develop the system
    design document (SDD) for the transmission of the dataflow
    through CDX. The contractor shall leverage as much as possible
    generic documentation that could be utilized for this flow (for Web
    / Node flows). The design must utilize existing services and
    reusable CDX components where possible (including Network Node
    Services, CDX Lite, etc.), follow CDX and Exchange Network
    standards, guidance, business practices, and architecture, focus on
    maximum efficiency and cost effectiveness, and include features
    needed to ensure adequate system security. Typically, a system
    architect and an engineering board provides final review of the
    design.

-   Security Planning and Documentation. The contractor shall work with
    the OEI project lead and CDX security staff to ensure adequate
    security planning and documentation. See security planning and
    documentation and reference Security Solutions section of task
    order.

-   Design Readiness Review. The contractor shall first conduct a
    readiness review after the design of the data flow has been
    completed to ensure that it leverages core services and meets the
    requirements as described in the SRS (see Design Readiness Review
    and Development Readiness Review in references).

-   Develop/Modify Existing Code. The contractor shall develop the
    functionality listed in the SRS and the SDD and modify existing code
    or deploy new code as required.

-   Unit/Integration Testing. After the dataflow development is
    completed, the contractor shall conduct unit and end-to-end
    integration testing of the different components of the system
    in CDX. The contractor shall use test files of actual data that the
    program office will provide to the contractor.

-   Test Readiness Review. A test readiness review is conducted once the
    application has been developed to ensure the dataflow is ready for
    testing in CDX preproduction (see Test Readiness Review in
    references).

-   Prepare a Test Plan and Prepare a Test Report. The contractor shall
    prepare a test plan to test the requirements identified for the
    specific data flow. The contractor shall prepare a test report that
    identifies what system changes the contractor completed during
    dataflow testing.

-   User Acceptance Testing. The contractor shall provide support to
    user groups during testing. The contractor\'s support shall include
    ensuring the specific dataflow and system is fully operational in
    the CDX preproduction environment and shall monitor the system
    during this testing period.

-   Configuration Management. In moving from development to Test to
    production the contractor use the configuration processes and
    procedures described in Configuration Management and Change Control
    and utilize CM implementation processes and procedures for
    deployment.

-   Production Readiness Review. At the conclusion of system testing and
    the contractor has made any required changes to the system that were
    identified during testing, the contractor shall conduct another
    readiness review to ensure the system is ready for deployment to
    production. The contractor shall complete all readiness checklists
    during the readiness review and resolve any outstanding issues
    identified during the readiness review.

-   Successful Implementation. Ensure the successful implementation of
    the software without impacting other parts of CDX.

-   Prepare Draft Software Release Notes. The contractor shall update
    and revise software release notes one time for any contractor
    developed software. The contractor's notes shall reflect the final
    version of the software that is moved out of the development and
    preproduction environments and deployed to the production
    environment.

-   Prepare Draft O&M Guide. The contractor shall prepare a draft
    dataflow O&M Guide using the O&M guide template. The contractor
    shall ensure that the operation staff provides input during the
    readiness review.

The contractor shall serve as a knowledge base for CDX customers by
providing procedural and technical guidance on standards previously
approved by a CDX Engineering Board.

As part of a continual process improvement, the contractor shall provide
recommendations on how to streamline and reduce costs for the lifecycle
for data flow development (e.g., using generic documentation modified
for each flow, developing services/software components that enable
rapid/low cost deployment of standard data flows that do not require a
significant amount of customization).

[]{#__RefHeading___Toc198603919 .anchor}**Systems Engineering**

CDX System Engineering support includes activities related to the
growth, interoperability, and extension of the CDX service oriented
architecture. It revolves around research and development of new
engineering approaches. These consulting services are coordinated
through the CDX Engineering Board (EB) and all activities are approved
and managed by the chair of the engineering board. Current areas of CDX
research include SOA technologies and new web 2.0 technologies.

The contractor shall provide systems engineering support including, but
not limited to, the following activities:

-   Attendance and general support for the weekly EB activities and the
    monthly Web Services Community of Interest

-   Identification/tracking of high-level data flow development project
    milestones

-   Support consistent application of CDX engineering standards across
    CDX

Work products in this area could include generating best practice
guidelines and engineering-related reviews.

The contractor shall support CDX research activities. The contractor
shall support efforts to look at emerging technologies in order to
determine suitability for future use on CDX. This research will
generally involve special investigations and presentations to the CDX
EB.

[]{#__RefHeading___Toc198603920 .anchor}**Node and Exchange Network
Flows**

EPA's CDX, a cornerstone of the Agency's Enterprise Architecture, and
the Exchange Network (EN), are built on the use of Web Services and
Service Oriented Architecture (SOA). Many key CDX SOA infrastructure
components are currently in place or under development including:

-   Universal Description Discovery and Integration services

-   XML Gateway

-   Web Service orchestration using the Business Process Execution
    Language (BPEL)

These common SOA components are leveraged to provide services for the
CDX web site, CDX node, and Exchange Network shared security and quality
assurance support. This architecture is being used to support and
integrate CDX with Agency SOA initiatives as well such as the Identity
and Access Management (IAM) services. Information sharing /data
publishing via Network services is a primary goal of the Network and the
Office of Environmental Information's Information Access Initiative.

***Network Nodes***

CDX and the EN data flows utilize many of these services to exchange
data and messages among Network trading partners that are based on a
common specification for reusable software components known as Network
Nodes. Network Nodes are developed as both open source and proprietary
software deployed by trading partners on the Network. The behavior of
Network Nodes is defined in the Network Node Functional Specification.
The EN trading partners are upgrading their nodes from supporting the
initial Node 1.1 to the recently published Node 2.0 Specifications. CDX
currently supports both version of the node in order to support state
and internal EPA office nodes transition efforts.

CDX maintains nodes running on BEA WebLogic (Node1.1), JBOSS (Node 2.0),
and SQLDATA Soap server (Node 1.1/2.0 - Network Authentication and
Authorization Services and Quality Assurance services). In addition, a
.NET /Windows Workflow Foundation based node is being evaluated for use
on the Network.

Listed below are the main types of nodes provided to trading partners:

-   Full Nodes can both request data from the Network, as well as
    publish data to the Network in response to requests (e.g., a query
    or solicit) from other Network Nodes. Full nodes can potentially
    leverage the full capabilities of the Network for machine-to-machine
    interaction by sending requests for data, and publishing data for
    use by other Network partners.

-   Node/Network clients or "Network Desktops" can submit, request, and
    receive results from a request to a full node, but they cannot
    listen for/respond to queries from other nodes and as such cannot
    publish data on the Network. These clients are primarily for
    human-to-machine interaction and are normally used by trading
    partners that do not publish to the network.

-   Demonstrated Node Configurations are essentially the messaging layer
    of a node that has been tested for each major platform and made
    available for developers to build interoperable Nodes around.

-   Software Developer Kits are also available to integrate Network
    services into applications. It simplifies Network access down to a
    few lines of script that can be inserted into any application.

For more information on Nodes and Node Clients see
Exchangenetwork.net/node/index.htm.

***Next Generation Node***

The Next Generation Node (NGN) is a full node implementation in JAVA
that contains all of the software components that are required to host
an Exchange Network node from messaging to transaction management and
auditing. EPA provides open source Nodes, both Java and .Net Versions,
to trading partners. The JAVA version called the NGN is supported for a
variety of application server platforms including JBoss, Oracle,
Websphere, Tomcat and BEA Weblogic. The NGN distribution information,
design, and tools can be found at the following URL:
https://test.epacdxnode.net/ngn EPA's Network Nodes allow integration of
a variety of other services and applications. For example, the current
NGN includes integration of an open source Velocity mapper that can be
used by trading partners to map to their database to create XML files
for exchanges or as publishing services. EPA assists trading partners
and EPA Program Offices in deploying these nodes. Support for these
applications is handled through the Node and CDX Help Desks. Second tier
support is generally provided by the CDX developers.

[]{#__RefHeading___Toc198603921 .anchor}**Node Development and
Deployment Assistance**

The contractor shall continue the development of the network nodes and
node clients and assist EPA program offices and trading partners in
deploying nodes.

***Node Development***

The contractor shall support development activities to support the CDX
Node and EN data flows that includes but is not limited to:

-   Provide standard development and lifecycle management of each CDX
    and EN data flow

-   Improve existing NGN functionality by leveraging services and other
    reusable components (e.g., NAAS, IAM, QA, Standard Audit, Logging,
    and Workflow monitoring )

-   Facilitate more rapid and lower cost node deployment through the use
    of configuration driven service development and the use of
    streamlined development tools and procedures (e.g., BPEL
    orchestration, generalized common data flow patterns)

-   Port the NGN Node as necessary for other State platforms

-   Evaluate and develop new methods, tools and procedures to simplify
    data flow creation, new services and data publishing to reduce cost
    and time to market.

-   Port dataflows from node 1.1 to node 2.0 in support of partner
    upgrades

-   Integrate with other Agency SOA components

In order to reduce costs for future NGN data flows, the contractor shall
standardize common data flow patterns such that they can be readily
reused on the development of subsequent NGN data flows. The types of
reusable actions / workflow activities include (e.g., integrate Solicit
into generic NGN dataflow to provide application support for launching
publishing services (i.e., Velocity Mapper), transforming results, and
providing results to the service requester).

***Node Deployment Assistance***

The types of node flow configurations deployed for a particular data
flow vary, but (depending on the complexity of the business process,
timeframe, and funding) reflect one or many of the following:

-   Trading Partner Full Node ↔CDX Node ↔ Program Full Node

-   Trading Partner Node Client ↔ Full CDX Node ↔ Program Full Node

-   Trading Partner Node Client ↔ Full CDX Node ↔ Program Node Client

The contractor shall assist EPA and other trading partners as requested
in installing, configuring, and using Nodes for their data exchanges
including:

-   Meeting with program office support teams to provide current
    information on the Exchange Network, Agency SOA initiatives, CDX
    standard services and processes, and consult on requirements,
    architecture, and design in support of the other support team's
    dataflow

-   Reviewing available documentation, (e.g., process/architecture
    diagrams, requirements, design) to ensure that the solutions
    proposed by the internal developers/operations teams are consistent
    with CDX's and EN business practices and architecture. The
    contractor\'s input and comments shall recommend making best use of
    reusable CDX components; identify specific CDX and EN standards and
    guidance items that are not, (but should be), used in these
    documents; and identify requirements and design features needed to
    ensure adequate system security,

-   Performing analysis of key infrastructure components (e.g.,
    Universal Description Discovery and Integration services, the XML
    Gateway and web service orchestration using BPEL) to optimize and
    integrate these services whenever possible.

-   Assisting the State or EPA office in installing and demonstrating
    potential software solutions for Network dataflows that may include
    coordination with other support teams by providing code, installing
    and running these potential solutions in the dataflow
    environment(s).

-   Coordinate across internal development teams to ensure all teams are
    kept up to date on changes in software, procedures, environments,
    and services.

The contractor shall review existing CDX Node and EN Node
implementations in order to identify critical issues, identify and
review relevant emerging and new technologies in Web Services SOA and
business process management, prototype/evaluate new products, and make
recommendations for improving the overall efficiency and maintainability
of CDX and the EN.

[]{#__RefHeading___Toc198603922 .anchor}**Quality Assurance (QA) and
Shared Exchange Network Services Support**

***Network Authentication Authorization Service (NAAS)***

The Network Authentication Authorization Service is a set of security
web services that the Central Data Exchange (CDX) centrally manages. It
supports remote administration by the State and EPA Node Administrators.
The NAAS provides extensive security services for identity management,
user authentication, user authorization, and access control policy
management. These services support security for every message on the CDX
and the Exchange Network and as such their availability and performance
are critical to successful operations.

***Quality Assurance Services***

The Exchange Network Quality Assurance Services are a set of XML web
services for validating XML documents against the associated schemas and
extended business rules. It consists of two major services:

-   Schema Validator: This service verifies the structure of XML
    documents using definitions in one or more schema files. Basic
    content constraints are also checked.

-   Schematron Validator: This is an optional extension of the Schema
    service that further validates XML documents using custom business
    rules, look-up tables, and regular expressions that are not possible
    with the basic schema validation service.

The purpose of these services is to support data stewards data checking
prior to submission to CDX. Because these are Exchange Network SOAP
services, they can be easily invoked from applications that are web
service ready, and be integrated into automated data submission or
processing systems. The services can also be accessed using a web
browser. Users can send documents from their desktop and get results
either synchronously or asynchronously.

For more information, see:

-   http://www.exchangenetwork.net/exchanges/air/nei_xml_val.pdf

-   http://tools.epacdxnode.net/

***Exchange Network Discovery Service (ENDS)***

The Exchange Network Discovery Services are a set of web services
compliant with the Exchange Network Functional Specification that
support the discovery of services and related metadata necessary for
node clients and applications to easily provide user friendly query
builders against published Network data. Some of the primary meta data
types included are Node, service request, parameters, stylesheets
available, and costing information. Metadata can be collected directly
from the Network nodes and loaded into ENDS automatically via the
GetServices query in the Node 2.0 Specification. The ENDS is a network
wide service repository which contains service descriptions for all
nodes. ENDS offers not only a set of service publishing services, but
also provides service management capabilities.

***XML Gateway***

The XML Gateway is a message filtering appliance that is deployed in
front of CDX application servers to block invalid messages routed to
CDX, selected states, and Exchange Network Services. Valid Network
message structures and schemas are loaded into the gateway and used to
parse the incoming messages. It will serve as a gateway router for State
Nodes that are only accessible by CDX.

The contractor shall continue the operations and maintenance of the
Shared Service and assist Shared service developers in deploying
enhanced services as necessary.

The contractor shall support operations and maintenance activities for
the Shared Services that includes but is not limited to:

-   Deploying new service releases (e.g., server setup and
    configuration, node setup, unit testing, rolling between DEVTEST
    PROD environments, quality of service (QOS) monitoring

-   Communicating/releasing new versions of shared service software

-   Periodic Testing

-   Identify, test interoperability and deploy new versions of supported
    software to remain current and to ensure adequate support. Routine
    maintenance activities are described under O&M services task.

The contractor shall provide last tier operational support for the
Shared Services including: the Universal Description and Discovery
Integration Services (UDDI), Client Central Services, the Exchange
Network Discovery Services, the Network Desktop tool, the Network
Authentication / Authorization Services (NAAS), and the Quality
Assurance Services (QA) as required. Support issues associated with
other application integration, schema and Schematron deployments as they
are necessary. Assist in the redeployment of these services in the
various CDX and NCC environments based on the ongoing hardware refresh
activities.

The contractor shall develop, maintain, and update, as necessary, all
documentation detailing EN shared services.

[]{#__RefHeading___Toc198603923 .anchor}**Security Solutions**

One of the U.S. government\'s responsibilities is to protect American
resources, people, and their way of life. One complex task the
government has been faced with recently is protecting several critical
infrastructures from computer-based attacks. Infrastructures contain
their own vulnerabilities and if attackers disrupt these
infrastructures, the ramifications may be far reaching. Risk of
disruptions can be mitigated if appropriate security controls are in
place. Security has a wide base that touches on several different areas.
There are many areas of security that affect each other. For example,
physical security is interrelated with information security, database
security lies on top of operation system security, operations security
affects how computer systems are used, disaster recovery deals with
systems in emergency situations, and almost every instance has some type
of legal or liability issue tied to it. Lastly, technology, hardware,
people and procedures are woven together as a security fabric that
protects the integrity of the asset.

The contractor shall ensure the continued security of the CDX system and
development environments. The contractor shall be responsible for
maintaining security of all system supported under this task order in
accordance with laws, regulations, policies, procedures, etc.

For new data flow requirements, the contractor shall assess the impact
of a customer's security requirements on the CDX infrastructure. The
assessment could include:

-   Type of data

-   System sensitivity

-   System structure

-   Data transmission

The contractor shall remain cognizant of new directions in Federal/EPA
security guidance and CDX technologies. Some of those could include but
are not limited to the following:

-   Federal Information (FIPS)

-   NIST Special Publication

-   IEEE Standards

-   EPA Directive 2100, Information Resources Management Policy Manual

-   EPA Information Security Manual

-   OMB Circular A-130

The contractor shall ensure that the detection of new threats and
vulnerabilities to CDX are addressed and escalated according to the EPA
Security Escalation Procedures and Computer Security Incident Response
Capability (CSIRC) procedures.

The contractor shall keep all security procedure and planning documents
that are necessary to maintain the certification and accreditation of
the CDX system and development environments current and accurate. The
contractor shall fill out Firewall Rule Change Requests (FRR) and submit
it to the EPA. The contractor shall update or create Security Addendums
(SA) to the CDX system security plan. The contractor shall update the
EPA ASSERT system as necessary. Example -- When a security vulnerability
is found in CDX, the CDX Program staff creates an entry in the EPA
ASSERT system and the contractor updates the entry into the EPA ASSERT
system.

The contractor shall insert this clause in all subcontracts when the
subcontractor is required to have routine physical access to a
Federally-controlled facility and/or routine access to a
Federally-controlled information system.

-   Intrusion detection & protection systems

-   Firewalls

-   Hardware security

-   Router

-   Bridge

-   Switches

***Physical and Personnel Security***

The contractor shall ensure the existence of adequate personnel
security. An example would be to run a NACI background investigation on
a staff member joining the CDX Program.

The contractor shall maintain physical security of the CDX system
environments.

CDX customers frequently have requirements for security solutions that
are above what is normally offered in a standard CDX development
solution. The contractor shall provide security solutions to CDX
customers that meet their security requirements and are Engineering
Board approved extensions of the CDX security architecture. Examples of
elevated security requirements include the following:

-   Confidential Business Information (CBI) data reporting

-   Medium-level security system classification

-   High-level security system classification

The contractor shall stay abreast of all significant tasks performed in
CDX to ensure that the CDX system\'s protection is maintained
adequately, and that its development environments continue to mature and
change.

[]{#__RefHeading___Toc198603924 .anchor}**Data Publishing**

CDX defines Data Publishing as a framework of web services that make
data available for consumption by end users from EPA data stores through
the Exchange Network. All Network partners are encouraged to publish
data to make it more widely available. EPA and CDX are making a
concerted effort to make data available through data publishing
services. Two systems, the TRI State Data Exchange and the Air Quality
System (AQS) have publishing services available through the EPA node.

The contractor shall develop and maintain web services that operate
through the CDX node and make data available to end users and consumers.
Publishing services shall include those that operate on a push model,
such as in the TRI state data exchange, and a pull model, such as FRS.
Push model services include web services such as submit. Examples of
pull model services include query and solicit. Services shall be fully
compliant with the exchange network specifications and protocols. The
contractor shall develop monitoring capabilities that will allow EPA to
track data publishing transactions, including the success or failure of
that transaction. The contractor shall develop, maintain, and update, as
necessary, all documentation detailing publishing services.

[]{#__RefHeading___Toc198603925 .anchor}**Web Development Services**

In 2007 CDX supported 80,000 submissions and more than 2 million
transactions with external parties that conduct business with the Agency
in over 40 Programs. OEI provides a web interface that supports a
significant portion of these user submissions and other data exchanges
with EPA and external entities.

The contractor shall support development and operations activities to
support the web-based components of CDX. This may include the following:

-   Conducting functional, technical, and user requirements

-   Designing and developing web-based data flows in accordance with all
    applicable federal and EPA laws, regulations, policies and
    procedures

-   Conducting multiple levels of testing and assisting EPA program
    offices in the testing process

-   Conducting production readiness reviews

-   Deploying web data flows

The contractor shall also provide consulting services to programs that
elect to build themselves components of a web-based data flow that will
be hosted on CDX. The contractor shall serve as a knowledgebase for
program customers and their contractors to provide procedural and
technical guidance and standards previously approved by the CDX
Engineering Board.

***Web Application Development***

CDX-Web hosts approximately 30 web applications on a variety of
platforms that interface with web forms and other systems and services.
The purpose of these applications is to support the submission and
exchange of data with EPA and external parties.

The contractor shall support web application development activities that
interact with CDX forms and services according to Development Life Cycle
procedures. This may include conducting functional, technical, and user
requirements specifications; designing and developing applications in
accordance with all applicable federal and EPA laws, regulations,
policies and procedures; conducting multiple levels of testing and
assisting EPA program offices in the testing process; conducting
production readiness reviews and deploying applications; and making
post-production enhancements/bug fixes as part of a data flow or related
project.

The contractor shall also provide consulting services to programs that
elect to build themselves components of a web-based data flow
application that will be hosted on CDX. The contractor shall serve as a
knowledgebase for program customers and their contractors to provide
procedural and technical guidance and standards previously approved by
the CDX Engineering Board.

Development technologies include: J2EE, ASP.NET, Oracle, Lotus Notes,
Cold Fusion with a focus on JCE cryptography.

***Web Form Development***

CDX contains multiple web interfaces for users to submit and exchange
data with EPA, many of which are web forms. As of March 2008, CDX
supported web forms for about 40 different EPA programs. In the past,
OEI had an average increase of five to 15 new programs a year. Based on
new requirements and additional programs serviced by EPA, these web
forms require changes or new forms are built to support additional
programs. In addition, the core CDX infrastructure includes forms
associated with user registration, administration and provisioning.

The contractor shall support web form development activities that
interact with CDX services. This may include conducting functional,
technical, and user requirements; designing and developing web forms in
accordance with all applicable federal and EPA laws, regulations,
policies and procedures; conducting multiple levels of testing and
assisting EPA program offices in the testing process; conducting
production readiness reviews and deploying forms; and making
post-production enhancements/bug fixes as part of a data flow or related
project.

***CDX Lite***

CDX Web is comprised of several web based services which have been
consolidated to provide a complete table-based, custom, electronic
reporting solution. CDX Lite is comprised of the following:

-   Client-based Designer Tool

-   CDX Web based Design Submission

-   CDX Web design review and approval application

-   CDX Lite Registration Provisioning tool

The CDX Lite components allow customers to design and submit
requirements to be published as meta-data into CDX and incorporate:

-   Screen wording

-   Submission and connection criteria

-   Web services

-   Functions to fully implement CDX Web data flows

The contractor shall provide technical support to develop and integrate
new CDX Services into CDX Lite.

The contractor shall provide support for CDX customers that want a to
establish a CDX Lite dataflow. CDX Lite electronic data exchange support
shall include the following:

-   Design

-   Submission

-   Review

-   Test

-   Publication

-   Operational maintenance (Refer to CDX O&M Services)

The contractor shall ensure CDX Lite dataflows are designed, developed
and maintained in accordance with:

-   CDX Development Life Cycle procedures

-   CDX Operations & Maintenance procedures

-   Cross Media Electronic Reporting Rule if applicable to that specific
    dataflow

    []{#__RefHeading___Toc198603926 .anchor}**Cross Media Electronic
    Reporting Rule (CROMERR) Services**

The contractor shall assess design and development, and implementation
of new and existing applications for CROMERR, and recommend and provide
procedures, software, and documentation necessary for CDX electronic
reporting to be CROMERR compliant. The contractor shall support the CDX
Program's efforts to implement CROMERR in CDX system components and CDX
services for CDX customers.

The contractor shall periodically review current CROMERR solutions and
investigate whether advances in technology may be utilized to more
efficiently meet the provisions of CROMERR.

The contractor shall support customers that have dataflows which require
CROMERR compliance. That support shall include assisting CDX customers'
efforts to complete relevant CROMERR compliance checklists.

The contractor shall maintain and update documentation, including design
documentation, as it relates to CDX-CROMERR solutions. The contractor
shall maintain and ensure the adherence of all established standard
operating procedures including but not limited to help desk procedures
and maintenance of a submission copy of record, which are currently in
effect or placed into effect for CDX to comply with CROMERR.

[]{#__RefHeading___Toc198603927 .anchor}**CDX Registration Services**

CDX provides a multitude of application registration services that
support registration work flow procedures, and integration of identity
management, credential management, certificate management, electronic
sponsorship management, and access rights management through Web forms
and Web Services.

The contractor shall coordinate all CDX registration components with
other CDX services and provide development, integration, and operations
and maintenance support consistent with CROMERR, CDX Life Cycle
Management and CDX Operations & Maintenance.

The key electronic registration components supported by CDX are
comprised of:

-   Exchange Network Registration --web forms allowing Exchange Network
    Node owners to remotely administer credentials, access rights, and
    passwords to the Network Authentication &Authorization Service
    (NAAS).

-   CDX Open Registration --web forms allowing users to identify
    themselves, request credentials and authorization, and obtain
    sponsorship forms electronically for applications designated as
    "Open"

-   CDX Pre-Registration --allowing application owners to identify and
    pre-populate user identities, credentials, and access authorization
    to applications designated as "Open" or "Closed" and then allow
    users to validate pre-populated information through Open
    Registration.

-   CDX Closed Registration --allows application owners to restrict
    users requests for access, openly, and utilize CDX Pre-Registration
    exclusively for applications designated as "closed"

-   CDX Dynamic Registration --a dynamic workflow component enabling
    owners to specify table-driven criteria necessary to authorize
    "Open" registration users

-   CDX Registration Maintenance --a web based access rights management
    tool allowing for remote administration of access rights to role
    based applications managed by CDX.

-   CDX Exchange Network Integration for Identity Management and Reduced
    Sign On.

-   CDX Digital Certificate Management and Local Registration Authority
    support for Certificate Authorities.

The contractor shall provide technical support, coordination,
documentation, record keeping, and management for CDX Registration and
Exchange Network Registration procedures, as well as, provide PKI Local
Registration Authority procedures and management for electronic and
paper registration materials and records received. These procedures and
materials shall be managed consistent with all applicable laws, Federal
standards, Agency policies, and the CROMERR.

[]{#__RefHeading___Toc198603928 .anchor}**Reporting Centers (RC)/Data
Processing Centers (DPC)**

Data Processing Centers/Reporting Centers receive, process, record,
store and distribute print and other electronic media. The contractor
shall be responsible for configuring, installing, and maintaining data
entry and processing systems and all of associated modules and equipment
in optimal working condition. The contractor shall follow hardware and
system operations procedure guidelines as stated in various EPA
documents. The contractor shall maintain any DPC/RC related systems at
an optimal working condition during normal business hours (8:00 a.m. -
5:00 p.m. Eastern Standard Time) on all normal business days unless
otherwise directed by EPA. The Government considers optimal working
conditions as ones that do not impede or stop data entry or production
processing during 99 percent of normal business hours. The contractor
shall exclude downtime resulting from specific technical directions from
the EPA for the halting of data processing and data management
activities.

The contractor shall receive the current documentation from EPA on the
required Standard Operating Procedures (SOPs) for each of the programs
that operate a DPC/RC and shall follow those procedures as directed. The
contractor may suggest enhancements to the procedures but shall not
implement unless at the direction of EPA. The contractor shall be
responsible for maintaining and updating all procedure documentation
upon receipt, as required.

The contractor shall provide comprehensive systems life cycle services
for all software application systems in the DPC/RC and shall ensure that
all system-related products produced under this contract have adequate
documentation. The contractor shall refer to the Data System Development
and System Life Cycle Maintenance section of this SOW for information
regarding the regarding EPA system life cycle requirements. The
contractor shall ensure that the contractor maintains a high degree of
interaction between the contractor\'s technical staff and the
contractor\'s project managers while performing these services.

The contractor shall provide design recommendations as well as ideas for
the development and implementation of major enhancements. The contractor
shall include suggestions for where existing development, systems or
processes can be leveraged or adapted to maximize cost savings, where
feasible, to the Government.

The contractor shall identify innovative technologies that exploit WEB
capabilities to streamline the collection and dissemination of
environmental information to stakeholders. Contractor shall identify
mechanisms to publish data in appropriate formats to address the
analysis in response to stakeholder queries.

The contractor shall inventory, manage and maintain all government
property purchased or furnished for the operations of the DPC/RC
including items such as computers, furniture, office supplies, etc.

The contractor shall provide services which may include, but are not
limited to:

***Submission Receipt and Identification***

-   The contractor shall receive, identify, process, and track all
    submissions to the DPC/RC. The contractor shall receive submissions
    via a Post Office Box, as regular mail, or commercial express mail,
    and fax transmissions.

-   The contractor shall receive and process (e.g., date stamp and
    identify document type) all mail addressed to the DPC/RC. The
    contractor shall also pick-up and deliver documents to EPA. The
    contractor shall open, date stamp (with the date of receipt at the
    EPA RC) and process all "official" incoming mail. The contractor\'s
    processing procedures shall include document identification,
    document labeling (i.e., bar coding), placing materials (whether
    forms, disks, or other communications) in folders, recording
    postmark and received dates per received package, and entering the
    information into the Records Management System

-   The contractor shall assist EPA, as required, in the distribution of
    EPA mailings through the DPC/RC.

-   The contractor shall assist with electronic an print correspondence
    with end users, including e-mailing responses to requests.

-   The contractor shall perform the entry of data from
    paper/magnetic/optical media into repository databases.

-   The contractor shall support Data capture, identification,
    verification, reconciliation and validation.

-   The contractor shall be responsible for handling and acknowledging
    Claims of Trade Secrecy (Trade Secret documents) under EPCRA Section
    313.

***End User Support and Troubleshooting***

-   The contractor shall provide user and technical support services as
    defined and prioritized by the EPA to the user community by
    answering questions, responding to requests for documentation, and
    providing required help.

-   The contractor may receive requests for assistance directly from
    users, or EPA may refer them to the contractor.

-   The contractor shall respond to all inquiries within one (1)
    business day. The contractor shall notify users who leave messages
    that it is EPA's goal to respond to their inquiry within one (1)
    business day.

-   The contractor shall develop standard form answers for hotline and
    e-mail questions.

***Quality Assurance Control Procedures***

The contractor shall include Quality Assurance (QA) procedures that
ensure that the contractor constantly reviews hardware systems
operations procedures and practices for the DPC/RC and the contractor
shall provide enhancements as the contractor and EPA deem appropriate.

[]{#__RefHeading___Toc198603929 .anchor}**Additional Development
Services**

[]{#__RefHeading___Toc198603930 .anchor}**Enhanced Financial Reporting**

Enhanced financial reporting is defined as reporting that is above the
standard reports provided to customers by the CDX Program. The CDX
Program offers enhanced financial reporting to customers that request
it. Examples of enhanced financial reporting typically requested by
customers include:

-   Earned Value Management (EVM) reporting

-   Weekly Financial Reporting of CDX Services (monthly is currently the
    norm)

-   Return on Investment Reports

-   Capital Planning and investment Control

-   Additional OMB Reporting Requirements

As directed by EPA, the contractor shall provide enhanced financial
reporting services. Reporting services provided to EPA will depend on
CDX customer financial reporting requirements.

Specifically for EVM support, the Office of Management and Budget (OMB)
requires Federal Agencies to use Earned Value Management for major
information technology systems.

The contractor shall implement EVM methods to integrate cost, schedule,
performance and risk in accordance with ANSI/EIA-748 \"Earned Value
Management System Guidelines.\" The contractor shall provide EVM data
and, based on customer EVM reporting requirements, aggregate EVM data
from various contractors and deliver the EVM data to EPA, typically on a
monthly and/or quarterly basis. The due date for EVM submissions to EPA
is the last day of each month. Example: Q1 EVM submission is due January
31. This due date could change based on a customer's specific reporting
requirements.

[]{#__RefHeading___Toc198603931 .anchor}**Dedicated Hardware and
Software Support**

CDX stakeholders may require specialized hardware and software be
supported due to unique needs or to reduce risk in the primary CDX
system environment. Based on the requirements of CDX stakeholders\' data
flows, the contractor shall analyze the various facets of a dedicated
environment construct.

The contractor shall analyze the impact of supporting a dedicated
environment for a specific customer which could include custom or
dedicated:

-   Hardware

-   Operating system

-   Custom application

-   Physical environment

The contractor shall clearly delineate CDX infrastructure from the
program specific dedicated environment and document these components.
The contractor shall build out these environments as directed by EPA.
Additionally, the contractor shall maintain these environments in
accordance with EPA and program established practices and documented
policies.

[]{#__RefHeading___Toc198603932 .anchor}**Routine Data Exchange
Upgrades**

On a regular basis, individual data flows within CDX require routine
upgrades to enhance the functionality of the data flow. These upgrades
are usually made on an anual basis and are typically in response to one
of several things:

-   Changes in information collection requests (ICR)

-   New regulations that must be implemented within existing systems

-   Changes determined necessary by the sponsoring program as a result
    of user comment

-   Changes in technology that would result in an improved operation of
    an existing dataflow

Examples of changes could include things such as adding an additional
field to a web form, additional data quality checks, or new security
features.

The contractor shall develop capabilities or modify existing systems to
accommodate changes to data exchanges. These changes are expected to add
new functionality or technology to the existing system and are not
considered to be a complete redevelopment of the system.

The contractor shall use coding practices that limit the amount of
re-coding necessary when additional functionality is added as a result
of a routine data exchange upgrade. The contractor shall update existing
system documentation to reflect any changes as a result of routine data
exchange upgrades.

[]{#__RefHeading___Toc198603933 .anchor}**Outreach, Communication and
Governance Support**

The CDX Team requires outreach and communications support to the CDX
stakeholder community. The contractor shall prepare materials for
internal and public consumption and those materials could be in the form
of paper, web-based or other form. The contractor shall also provide
support to CDX governing bodies that address CDX related issues and
determine the future direction of CDX and the Exchange Network. Examples
of governance support include preparing agendas, meetings notes, and
action items.

[]{#__RefHeading___Toc198603934 .anchor}**Quality Assurance Planning,
Implementation and Reporting**

EPA requires support for managing data, project, program, performance or
other operational quality programs that relate to data systems. As
directed by EPA, the contractor shall develop, maintain or update
quality assurance plans for CDX or other systems and implement and
review those plans as appropriate.

[]{#__RefHeading___Toc198603935 .anchor}**Primary Operation and
Maintenance Services**

The Contractor shall be responsible for overall operations and
maintenance of the General Support System (GSS) environments for CDX
development, integration test, pre-production, and share support for
production and research and development in accordance with Agency and
Federal Information Processing Standards. CDX Operations & Maintenance
is documented in Change Control Board meetings and regular operations
meetings. All equipment and procedures are defined and maintained by CDX
Operations and may be found in the Technical and Security Procedures,
CDX Operations and Maintenance Guide, and CDX Contingency Plan.
Additional support for Procurement Requests (PR) is documented in the PR
Tracker spreadsheet.

-   Procurement and management of hardware, software, and
    telecommunications resources are performed according to FAR and
    documented in the PR Tracker spreadsheet.

-   Systems Integration and Implementation of Hardware, Software, and
    Telecommunications are performed according to Monthly Milestone
    schedules and project plans for significant activities. All changes
    to CDX architecture are coordinated with the CDX Engineering Board
    as outlined in the EB Charter.

-   Anti-Virus Scanning and Patchlink Operating System updates are
    managed in coordination with National Computer Center schedules and
    promotion schedules.

-   Infrastructure monitoring, repair and maintenance are performed
    according to Operations & Maintenance Guide, Contingency Planning,
    and performed to CDX SLA Matrix requirements.

-   Change Control / Configuration Management are performed according to
    Configuration Management Plan.

-   Contingency Planning is documented and routine testing is documented
    according to the CDX Contingency Plan.

-   Data Base Administration is performed to ensure the support for CDX
    and Program Systems for all Data Base environments as documented in
    the CDX Operations & Maintenance Guide

-   Regular coordination meetings shall be held between the Contractor
    with the National Computer Center Networking and Operations to
    ensure Development and Production environments are maintained in a
    timely and in a consistent manner.

-   CDX Application Operations and Maintenance and Infrastructure
    Operations & Maintenance support Separation of Duties as described
    in Separation of Duties Guide.

***Standard O&M Service Levels***

(1) The contractor shall notify EPA within thirty (30) days before the
    expiration of any renewals on software/hardware licenses.

(2) The contractor shall act on purchase requests within five (5)
    business days of receipt of approval on purchase requests from EPA.
    Contractor shall provide confirmation of purchase to EPA within
    one (1) business day of purchase.

***Node O&M***

The contractor shall support operations and maintenance activities for
the CDX Node and EN data flows that includes but is not limited to:

-   Deploying new CDX Node releases (e.g., server setup and
    configuration, node setup, unit testing, rolling between DEVTEST
    PROD environments, quality of service (QOS) monitoring

-   Supporting versions for Node 1.1 over a two year period of time

-   Communicating/releasing new versions of NGN software for trading
    partners

-   Periodic Testing

-   Identify, test interoperability and deploy new versions of supported
    software to remain current and to ensure adequate support

    []{#__RefHeading___Toc198603936 .anchor}**Data/Document Archiving
    and Tape Back Up Services**

The contractor shall ensure that all data/documents in CDX and the
DPC/RC are archived and/or periodically backed up on tape. Examples of
services the contractor shall provide include the following:

-   The contractor shall provide both on-site and off-site storage for
    data, files, electronic equipment, supplies

-   The contractor shall provide digital scanning and electronic
    archiving if requested by EPA.

-   The contractor shall backup DPC/RC related systems data files, and
    any other operating system, application program, and data files
    critical to the operations of the centers. Timeframe of backups and
    procedures will be specified by EPA. The contractor shall have an
    offsite storage facility where the contractor shall maintain the
    archived monthly backup tapes. The contractor shall maintain a hard
    copy log of the contractor\'s backup activities and securely store
    this information. The contractor shall keep a copy of the log,
    preferably in a secure offsite location

    []{#__RefHeading___Toc198603937 .anchor}**Help Desk**

To facilitate the submission and receipt of environmental data, CDX
provides technical submission assistance to internal and external
stakeholders of CDX and the Exchange Network nodes through the
establishment and continued management of a Help Desk. Activities under
this subtask span the broad range of CDX services intended to provide
technical support to users and increase awareness and understanding of
CDX and Network nodes across the spectrum of users.

The major benefits expected of this task include:

-   An integrated approach to customer support, rather than scattered
    support among EPA CDX tasks/flows

-   Standardized procedures for Help Desk operations and handling of
    security issues

-   Experienced customer support staff involved in full life-cycle
    development of CDX applications, and reference to and continuous
    updates to the Help Desk Support Manual.

The contractor shall provide CDX Help Desk Services that include three
core services:

(1) Assistance with CDX registration

(2) Basic data flow assistance

(3) Step-by-Step Troubleshooting of CDX technical issues, prior to
    escalation

The contractor shall provide CDX help desk support between 8:00 am and
6:00 pm EST Monday - Friday, except federal government holidays.
Additionally, the contractor shall provide support during emergency
situations which cause help desk hours to be extended.

EPA requires reporting on help desk activity. The contractor shall
generate reports for CDX Program staff on a routine and ad hoc basis as
specified by EPA. EPA will determine the elements of the report. On an
ongoing basis, the contractor shall make recommendations and, at the
direction of EPA, implement more eficient processes for generating and
disseminating reports and statistics.

The contractor shall address each CDX user's technical issues by
telephone, facsimile or email. The contractor shall supply an (800)
number during normal business hours, specified email address and fax
number. The contractor shall report connectivity, hardware or software
technical issues to the CDX Program staff immediately. When reporting
CDX user technical issues, the following user information shall be
captured by the contractor:

-   User's Name, Company name, telephone number, email address

-   EPACDX program being used

-   Description of the EPACDX problem, including error messages and user
    actions directly before the problem occurred

The contractor shall provide and implement a CROMERR Support procedure
including, but not limited to, identity proofing.

Currently, CDX help desk procedures include the following contractor
support:

-   The contractor shall create a new ticket for every problem or
    request submitted to the CDX help desk

-   The contractor shall generate tracking information and full
    description for each incident

-   The contractor shall assign the incident ticket to a contractor
    technical support analyst for action or closure after resolution

-   The contractor shall provide all CDX users that contact the CDX help
    desk with a "trouble ticket" number for future reference

-   The Contractor shall provide a multiple levels of support that are
    based on the severity of the issue

-   The contractor shall allocate response time appropriately

-   The contractor shall document based on level of support and
    turnaround time

-   The contractor shall respond to the CDX user that contacted the help
    desk within 24 hours

-   The contractor shall provide a 95% closeout of issues on the first
    call-back

-   For issues that extend beyond 24 hours, the contractor shall provide
    status updates to users every 24 hours unless otherwise specified by
    EPA

-   The contractor shall provide and implement an escalation procedure
    with performance goals to be determined

-   The contractor shall define operating procedures including, but not
    limited to ticket categorization

The contractor shall create and maintain a Help Desk Manual for help
desk contractor staff. The manual shall include detailed information on
CDX data flows such as user guides, frequently asked questions (FAQs),
Help Desk Implementation Handbooks, and other outreach materials.

The contractor shall provide EPA a plan in the event that the
contractor's staff is prevented from physically going to the help desk
facility. That plan shall include an escalation staffing plan in case
that help desk calls begin to outpace the ability of the help desk staff
to provide responses.

The contractor shall provide an emergency response procedure for
security violation. The contractor shall provide Contractor Related
Incident and CDX Related Incident procedures from opening a ticket,
providing contacts to telephone, email and fax procedures.

[]{#__RefHeading___Toc198603938 .anchor}**Additional Operational and
Maintenance Services**

[]{#__RefHeading___Toc198603939 .anchor}**Dedicated Hardware and
Software Support**

The contractor shall analyze all facets of a dedicated environment
construct when a dedicated environment is required. The contractor shall
analyze the cost of a dedicated environment for a specific customer
which will include many things such as hardware, software, support, etc.
The contractor shall clearly delineate CDX infrastructure from the
program specific dedicated environment and document these components.

[]{#__RefHeading___Toc198603940 .anchor}**Elevated O&M Support
Services**

Some CDX customers require elevated levels of O&M support. That can be
caused by a data flow being categorized as a "critical" system or for
other reasons.

The contractor shall provide elevated service levels to CDX systems.
Examples of elevated service levels include:

-   24x7 technical support

-   24x7 help desk support

-   Technical support beyond standard CDX help desk technical support

    []{#__RefHeading___Toc198603941 .anchor}**Training for CDX Users**

The contractor shall provide instructional guidance for end-users of CDX
data flows.

Types of training provided could be, but are not limited to:

-   Print products/manuals

-   Online text tutorials

-   Online video tutorials

-   Live web conference training sessions

-   In-person, on-site training sessions

The contractor shall conduct post-training surveys/assessments and
provide results to the CDX Team.

[]{#__RefHeading___Toc198603942 .anchor}**Shared Services O&M and
Deployment Assistance**

The contractor shall continue the operations and maintenance of the
Shared Service and assist Shared service developers in deploying
enhanced services as necessary.

The contractor shall support operations and maintenance activities for
the Shared Services that includes but is not limited to:

-   Deploying new service releases (e.g., server setup and
    configuration, node setup, unit testing, rolling between DEVTEST
    PROD environments, quality of service (QOS) monitoring

-   Communicating/releasing new versions of shared service software

-   Periodic Testing

-   Identify, test interoperability and deploy new versions of supported
    software to remain current and to ensure adequate support

-   Routine maintenance activities

The contractor shall provide last tier operational support for the
Shared Services including: the Universal Description and Discovery
Integration Services (UDDI), Client Central Services, the Exchange
Network Discovery Services, the Network Desktop tool, the Network
Authentication / Authorization Services (NAAS), and the Quality
Assurance Services (QA) as required. Support issues associated with
other application integration, schema and Schematron deployments as they
are necessary. Assist in the redeployment of these services in the
various CDX and NCC environments based on the ongoing hardware refresh
activities.

[]{#__RefHeading___Toc198603943 .anchor}**Database Management Services**

Typically CDX customers' data flow databases and data tables are hosted
and maintained outside of the CDX environment. A few customers choose to
have their systems hosted and maintained within the CDX environment.

The contractor shall provide database management services to those
customers that choose to keep their database and/or data tables within
the CDX environment. All processes, procedures and service levels
associated with standard CDX Operations and Maintenance service offering
still apply.

Examples of Database Management Services include the following:

-   The contractor shall provide assistance in the querying of the
    databases for the purposes of returning information requested by
    EPA.

-   The contractor shall conduct an active system maintenance program
    for the DPC/RC databases and related applications. The contractor
    shall perform regular database verification and validation routines
    and procedures to ensure the integrity of tables, files, and related
    systems. The contractor shall administer and perform diagnostic
    testing to identify problems within the databases and related
    applications.

-   The contractor shall be responsible for reliable, available and
    effective database management of the databases and related
    applications and shall ensure a secure platform that delivers
    optimal performance.

-   The contractor shall ensure the appropriate implementation and
    execution of the following database administration functions:

    -   Installing and upgrading the database software and options.

    -   Creating tables and indexes.

    -   Creating and managing table spaces.

    -   Managing control files, online redo logs, archived redo logs,
        job queues, and server processes.

    -   Creating, monitoring, and tuning data loading procedures.

    -   Adding users and groups, and implementing security procedures.

    -   Implementing security, backup, and recovery plans.

    -   Monitoring database performance and exceptions.

    -   Reorganizing and tuning the database.

    -   Troubleshooting database problems.

    -   Coordinating with appropriate vendor customer support services.

    -   Upgrading and Migrating Database Software to current and
        supportable releases and versions.

    -   Performing regularly scheduled system and database backups.

        []{#__RefHeading___Toc198603944 .anchor}**Systems Performance
        Monitoring and Reporting**

There is a certain level of performance monitoring that comes with the
standard CDX O&M service. Some CDX customers require additional system
performance monitoring and some CDX customers also request additional
reporting on their systems performance.

The contractor shall provide systems performance monitoring and
reporting services for CDX customers. This applies specifically to
customers that desired performance reporting that is above the reporting
that is normally provided as a part of the standard CDX O&M service.

[]{#__RefHeading___Toc198603945 .anchor}**Geospatial Services**

***All Geospatial Tasking Shall be Considered Optional Tasking***

Geospatial Services include the functions and associated technologies
associated with the storage, search, discovery, access and exchange of
geospatial data. The intention of this optional task is to provide a
range of services that could be accessed through CDX to support
geospatial services.

Over the last decade, there has been a virtual explosion in the interest
and capabilities to integrate environmental data to a spatial context.
Examples of this integration include the use of "visualization"
services, like Microsoft Virtual Earth and Google Earth, where
relatively simple application program interfaces to non-geospatial data
sources can suddenly be presented to the world on a map, or on top of
imagery. Whereas CDX was never considered a "geospatial system", aspects
of CDX support to the states, regulated entities and the public have
inevitably led CDX to incorporate limited geospatial tasking into their
overall services. Some examples of past support include:

-   Facility Registry System Update Service (FRS US). In this service,
    FRS data are presented to a regulated entity or other register users
    through a web-based visualization/mapping service (currently it is
    Google Earth) and the user is allowed to submit edits to that
    location using the mapping interface. By offering this service, EPA
    is able to collect more accurate locational data simply and
    effectively on facilities and everyone benefits.

-   GeoFinder Exchange Network Project. Geospatial analysis depends on
    rapidly gathering and integrating widely disparate information on
    places and presenting this on a map. One of the major obstacles to
    the geospatial community has been the shortcoming of existing search
    engines to crawl for geospatial data and metadata. The GeoFinder
    project leverages CDX security (Network Authentication and Access
    Service) to search geospatial metadata catalogues across agencies.

-   Heartland Emergency Response Exchange Geospatial services are
    critical during emergency responses, where responders need rapid
    access to widely-diverse state, local and federal data to make "on
    the ground" decisions. CDX has helped support an Exchange Network
    project to tie Exchange Network data flows to visualization
    capabilities like Google Earth.

-   Enterprise Geospatial Data Management and Planning. Over the last
    several years, CDX has supported the establishment of a "mini-CDX"
    known as the Geospatial Data Gateway (GDG) for collecting and
    managing geospatial metadata at the enterprise level within EPA. The
    GDG, along with associated architecture planning, business case
    development, guidance, and outreach has allowed EPA to manage EPA's
    geospatial metadata and associated data at an enterprise level. In
    addition, CDX has helped support broader strategic planning for
    geospatial services in the context of emergency response and other
    agency functions.

With rare exception, EPA's programs, regions and research operations use
geospatial data, but geospatial technologies for analyzing these data
aren't used widely. Over the next decade this is going to change, to the
point that geospatial data services could become a central focus of CDX.
Given the past experience, anticipated areas for future support CDX's
geospatial support can be broken down into the following categories:

-   Geospatial Exchange and Data Management

-   Geospatial Technology Testing, Integration and Deployment.

    []{#__RefHeading___Toc198603946 .anchor}**Geospatial Exchange and
    Geospatial Data and Metadata Management Support**

The contractor shall provide support for EPA's Geospatial Data and
Metadata Management Program, including the design and implementation of
geospatial data collections, flows, registries and warehouses. This may
include, but is not limited to the following activities:

-   Business process and technology planning and research

-   Standards development including but not limited to standards
    surrounding Geography Markup Language (GML), Web Map Services (WMS),
    Web Feature Services (WFS), ArcIMS and Keyhole Markup Language (KML)

-   Design, testing and deployment of schema or schema components and
    associated applications to facilitate discovery, sharing and
    publishing of geospatial data

-   Integration of geospatial data flows into enterprise components
    (e.g. registries, warehouses, datamarts, program databases, etc.)

-   Security planning and integration to support exchange between
    external parties and EPA (e.g., leveraging the CDX node to exchange
    data with a state or federal agency)

-   Geospatial data storage and registries (e.g., facility data, geodata
    gateway) including design, deployment and operations of geospatial
    data warehouses and registries for "orphan" data

-   Geospatial data stewardship, including working across communities of
    geospatial data providers to coordinate sharing, access and updating
    of geospatial data

-   Quality control including establishing quality assurance systems,
    plans and operations to support maintenance of high quality data.

Deliverables shall include:

-   Planning documentation, including business process models,
    requirements surveys and resulting analyses, business cases, project
    plans and return on investment documents

-   Schemas and associated data exchange template documentation
    including standards, guidance and resulting schema

-   Flow design and systems documentation including system management
    plans, security plans, architecture design documents, software
    requirements specifications, quality assurance plans

-   User guidance, including outreach materials, user guides, and best
    practices

-   Quality Assurance documentation including quality management plans,
    quality assurance operation procedures, best practices, error
    tracking programs, performance measurement systems.

    []{#__RefHeading___Toc198603947 .anchor}**Geospatial Data and
    Metadata Technology and Tool Development**

Under this task the contractor shall provide support by working with
commercial geospatial technology and open standard, OGC compliant
technology to enhance the quality and accessibility of EPA's data. This
should be done within the framework of EPA's National Geospatial Data
Policy, Geospatial Metadata Management Policy, Geospatial Metadata
Technical Specification and other relevant standards.

The contractor shall provide GIS technical services and products for the
enhancement of the CDX role in data exchange including:

-   Researching and evaluating new technologies for searching, access
    and visualizing data geospatially (e.g. Google Earth, Microsoft
    Virtual Earth)

-   Developing or integrating existing software solutions or services
    into CDX business process to facilitate search, access and
    publishing CDX data flows spatially

-   Conducting testing, enhancements and deployments to production CDX

-   Developing associated users support documentation, troubleshooting,
    outreach and training on software/services developed.

Deliverables shall include:

-   White papers, evaluations and other research documentation on topics
    ranging from specific products to broad commercial or non-commercial
    trends in geospatial software and services.

-   Requirements analyses, software specifications, design plans, source
    code and software documentation

-   Test plans, software solutions, deployment plans

-   User documentation, guidance, technical support, training and
    presentations.

    []{#__RefHeading___Toc198603948 .anchor}**Transition Planning**

**Transition In**

The contractor shall provide a transition plan for beginning the task
order and offering CDX services.

The contractor shall plan to ensure a seamless transition of the data
flows and CDX system.

Key aspects of the transition plans could include planning for transfer
of:

-   System documentation

-   System computer code

-   Physical assets (inventory)

-   Staff institutional knowledge

**Transition Out**

The contractor shall deliver a plan for transitioning to the next task
order and, potentially, the next contractor.

The contractor shall plan to ensure a seamless transition of the data
flows and CDX system.

Key aspects of the transition plans could include planning for transfer
of:

-   System documentation

-   System computer code

-   Physical assets (inventory)

-   Staff institutional knowledge