MANAGED SOFTWARE DEVELOPMENT AND MAINTENANCE … · MANAGED SOFTWARE DEVELOPMENT AND MAINTENANCE SERVICES WHITE PAPER Page 1 YOUR MANAGED SOFTWARE DEVELOPMENT SOLUTION Digital Prospectors

MANAGED SOFTWARE DEVELOPMENT AND MAINTENANCE SERVICES WHITE PAPER

Page 1www.dpcit.com

YOUR MANAGED SOFTWARE DEVELOPMENT SOLUTIONDigital Prospectors Corporation (DPC) is your preferred choice to provide managed software development and maintenance. DPC has extensive experience in providing software development and maintenance in a managed service environment from its various efforts within the US Air Force’s Global Combat Support System – Air Force (GCSS-AF) enterprise infrastructure. Experience and innovations applied within that environment will help your firm have an effective and efficient transfer to its managed software development services solution. Below is some basic information for our firm: Company Name: Digital Prospectors CorporationAddress: 100 High Street, Bldg B, Exeter, NH 03833Phone Number: (603) 772-2700Fax Number: (603) 772-2828Website: www.dpcit.comPoint of Contact Information: Mr. Don Catino, Sales Manager, (603) 772-2700, [email protected] CODE: 3DAY2 DPC is an award winning small woman owned Information Technology and Engineering consulting services company with a proven ten year track record servicing government and commercial clients. DPC holds a Top Secret FCL and GSA Schedule 70 contract. DPC’s core offering include data warehouse and data exposure solution development, systems and applied research analysis, and IT and medical skills placement. DPC personnel have been on the leading edge of many key Air Force and Joint SOA solutions, including Global Force Management (GFM) and the Chief of Staff’s Leadership Dashboard; as well as key technical roles with US TRANSCOM. DPC brings a unique blend of system solution experience combined with quality technical professionals well versed in the exploitation of Air Force and Joint enterprise services. Some DPC corporate highlights:• Founded in 1999 • Current work force of ~200 employees engaged at client sites• Revenue of $26M+ for 2012• Headquartered in NH with Branch offices in MA & OH• Top Secret Facility Clearance• 60%+ of staff has active Secret, Top Secret or Top Secret with SCI Clearances• Certified Small Women Owned Business (SBA / WBENC) • Proprietary Six Point Prospecting™ Methodolgoy

DPC has also been recognized in the industry for its achievements:• Top IT Services Company – Inc. Magazine• Diversity.Com - Top 100 minority owned companies in the US - (2006 – 2012) • Excellence.Gov award for our LIMS-EV solution to the USAF

The following sections outline DPC’s offering and approach to providing managed software development and maintenance services for your firm.

Page 2www.dpcit.com

PEOPLE/PROCESS/TOOLPeopleDPC will leverage the skills and expertise of its Total Solutions Group for the your Managed Software Development and Maintenance efforts. The Solutions Group will enable the team to bring to bear experienced resources on Day 1 to support key transition activities. The Solutions Group will provide additional value to the continuing Managed Software Development and Maintenance efforts. In this era of continued pressure on information technology budgets, it is key for the Government to get the maximum value for its system development and maintenance dollar. Using a flat organizational structure coupled with an integrated, experienced team resident in the Total Solutions Group, DPC will provide your firm the maximum value for its system development and maintenance dollar. This is demonstrated by the most recent CPAR (US Government customer satisfaction ratings) from the Government for DPC’s GFM-DI support of all Excellents.

Should there be a need to personnel with skills not available in the DPC Total Solutions Group, DPC will leverage its highly effective Six Point Prospecting™ methodology—delivering uniquely qualified technology professionals quickly and cost effectively.

ProcessDPC will utilize an iterative spiral development process for Managed Software Development and Maintenance software releases. The process will be accelerated by combining sub-phases to permit design and development to proceed in parallel where applicable. DPC uses an Agile development process modified to accommodate DoD and Government customers who require a more traditional phased methodology with standard reporting and review milestones. This approach offers the flexibility of iterative internal feature release, continuous testing, and close user involvement through prototyping, without sacrificing standard project management activities. It allows for a standard process with similar milestones and artifacts across all projects. The graphic to the right outlines the different phases for the development process and the associated deliverables for each phase.

Requirements PhaseDPC has a team of senior business analysts and solution architects that are responsible for the Requirements and Design phase of all projects. This guarantees that the customer will have access to our most experienced technical leads and benefit from the shared best practices from other industry leaders. The team engages the customer in a series of 2-4 hour meetings over approximately a two week period where


Page 3www.dpcit.com

they capture requirements, document use cases, build a source-to-target map for interfaces, and create a prioritized feature list that will eventually be mapped to an internal release plan. If the project involves migrating or modifying an existing system the team will thoroughly familiarize themselves with the system and any of its interfaces. Where possible, DPC installs the system in their development lab for the length of the engagement.

Design PhaseDuring the Design phase DPC works with the users to build the wireframes document, containing workflows, screens, business logic, and the data mapping. The wireframes are completed as soon as possible in order to create a clickable prototype that will eventually be used for delivering features in the incremental build phase. The wireframes are important because they provide a visual layout of a given set of requirements or features that can be easily understood and agreed upon. DPC tries to make the wireframes look as close as possible to the final screens the user will see, showing not only how the user will interact with the screens but also what data the users will see and what it will look like in context.

Build and Test PhaseAs each feature (or function point) is identified and mapped it is given a high-level estimate by the team. If the estimate is too large to fit into a build increment then the feature is broken down into smaller features. It is important that the customer is part of this process so that the features are well understood by both user and developer. Next, each feature is decomposed into build tasks, resulting in a more detailed estimate. The tasks are then mapped to specific design artifacts such as wireframe elements, data elements, interfaces, ETL, or workflows. The test plan is built as the feature tasks are identified. Once the feature decomposition is completed a detailed schedule is produced.

The internal release plan is created at the beginning of the Build phase; it defines the number of two week increments with features mapped to each increment. The first increment is used to build an overall framework and prototype. DPC uses an open source tool called Jenkins to schedule builds, execute unit and system tests, perform code analysis, and generate graphs. The resulting reports are web based and made available to the customer throughout the build phase.

The development team uses a test-driven process where the tests for the feature are built first and hooked up to the automated build and test framework. Progress is determined as tests turn from red to green over the length of the iteration. All tests are executed nightly, including tests from previous increments, assuring that all features have been thoroughly regression tested by the end of the build phase. At the completion of each increment there is an internal release of the prototype to the customer where comments and discussions are reviewed and changes incorporated into the next iteration.


Page 4www.dpcit.com

A two week system test concludes the Build phase. This test exercises the entire system, including interfaces, install scripts, bad path and error logic, performance, security, and feature coverage. During this period all failures are documented in the Problem Report and fixed immediately.

Release Phase The Release phase starts with the User Acceptance Test. The group of users for this test is expanded from those who have been testing the system during the incremental releases. Discussions, problems, and comments are documented and reviewed. Problems are fixed and retested. Upon completion of User Acceptance Testing and the software release is approved for deployment, the DPC Team will provide a Release Artifacts Package. This artifacts package will include a: Deployment Plan, Installation Instructions, Version Description Document, Application Source Code, and associated User Documentation.

ToolsDPC has the tools and environments to provide managed software development environment from its work supporting the US Air Force on GFM-DI and LIMS-EV which can be readily leveraged for use by your firm for its Managed Software Development and Maintenance efforts. DPC has development, test, and integration environments in its Dayton, OH development facility that can be leveraged by your firm for its Managed Software Development and Maintenance activities. Most software required is already resident within these environments (Oracle, Java, ASP.net, SQL Server) as well as others (Informatica, Teradata, IBM Websphere) to be applied for managed software development and maintenance. Any discrepancies can be readily added to these existing environments. In addition, DPC already has implemented within these environments many of the automation and process tool components that will yield innovation and benefits to your firm for its Managed Software Development and Maintenance activities. Several of these are included within the next section. Also, personnel required to maintain and support the environments are available and can be leveraged for use by your firm for support of the different environments.

DPC is able to also provide for having dual physical environments to support your firm’s Managed Software Development and Maintenance efforts. DPC will leverage its existing Dayton, OH personnel and development environments for software development activities. These environments will be used for the development/build activities. DPC can also use or leverage you firm’s existing physical location for its test/validation environment and management support efforts. Independent test and C&A personnel would reside in this second location along with business analysts and management personnel. This dual physical location approach will help to optimize the need to retain key personnel and experience (if essential) with the advantages of using existing development facilities.

ExperienceDPC has extensive experience in software development planning and management for Air Force systems from its seven years’ experience in defining, developing, and managing software releases for the Global Force Management – Data Initiative (GFM-DI) and Global Combat Support System – Air Force (GCSS-AF) Data Services development activities. DPC personnel have experience in the development and management of over 50 GCSS-AF Data Services releases and over 8 GFM-DI software releases over that six year period. The majority of these releases have been in support of GFM-DI and the Logistics, Installations, and Mission Support – Enterprise View (LIMS-EV) corporate software applications. DPC involvement in each of these efforts has been from the beginning; taking high-level Joint/Air Staff goals and objectives and translating those into an architectural framework to which incremental software releases can be deployed to provide immediate impact to user


Page 5www.dpcit.com

productivity and corporate return on investment. The software development process outlined above was utilized on each of these efforts and the numerous software releases associated with them. In addition, DPC personnel Mr. Schroeder and Mr. Jaster in their roles as Program Manager and Lead Architect for GCSS-AF Data Services were responsible for the programmatic and technical management of up to twenty different concurrent LIMS-EV spirals.

To support the management of multiple concurrent software development efforts, DPC has implemented an open source tool called JIRA to assist in the management of each project. This tool provides a detailed tracking and monitoring capability that can be shared with the customer through a web based dashboard.

DPC Managed Software Development and Maintenance InnovationsDue to DPC’s over seven years’ experience managing and performing software development, DPC has a variety of innovations that can be leveraged by your firm immediately to generate improved performance and/or cost savings. Three innovations which will likely be used to great effect are:• DPC’s Automated Test Program (ATP) – leveraging the Jenkins Framework• JIRA – for project and task management and reporting• Enterprise Data Quality Measurement Service – for performing data quality assessments and reporting

DPC’s Automated Test Program (ATP)DPC’s Automated Test and Build Strategy is an End-to-End process improvement that leverages the capabilities of an open source toolset. The approach allows for full requirements traceability as well as feature mapping to development increments. The process consists of a test first approach to development that allows for incremental feature completion. The open source toolset allows for automated development increment and regression testing, including detailed test logs of the results of the automated testing. The process and associated toolset allow for management and customer visibility into the build progress and produces status charts that can be used by management and customer’s to assess the progress of development activities.The process starts with the Design Phase activities, where each requirement is broken down into features. Then each feature has a build time estimated along with a corresponding risk factor. The Build, or Development, Phase is then divided into two week increments, where each increment’s maximum capability is calculated. Features are then scheduled across the development increments. Tests are then defined for each feature and stubbed out. The test harness is also defined for each increment. Then Jenkins open source test framework is then configured to run increment tests. The Jenkins test framework is defined to build code from the SVN code repository. Before each increment, the test manager works with developers to build the tests that are schedule for that build increment. Jenkins then builds and executes all tests each week and provides a dashboard showing summary and detailed results available for management use.

JIRAWith JIRA DPC is able to see all activities across multiple projects or drill down into the detail of a single project. Over time DPC has developed a standard set of JIRA task types to include Action Item, Production Problem,


Page 6www.dpcit.com

Requirement, Use Case, Build Task, Bug, Test, Help Ticket, CR, DR, Enhancement, and others that provide us with the ability to manage all tasks associated with a project.

Enterprise Data Quality Measurement Service (EDQMS)The Enterprise Data Quality Management Service (EDQMS) leverages the MITRE research work conducted over the past two years under the sponsorship of AFMC/ESC in the area of data quality. EDQMS is vendor agnostic, uses industry standard SOA principles, and adheres to a reusable XML vocabulary. DPC was selected to lead the EDQMS development team. The production system includes a set of enterprise services for measuring and assessing the six data quality dimensions defined by the DoD, alert notifications based on assessment thresholds, a Data Quality Meta-Exchange (DQME) XML language, and a rich internet dashboard with leadership and analysis views. The system was designed to be vendor and tool agnostic, so that any system can use it by simply sending DQME messages to the EDQMS event bus. EDQMS provides the Air Force with a standard method for measuring data quality across all systems and can be used for validating contract thresholds.

MANAGED APPLICATION MAINTENANCEApproach/ExperienceDPC has the knowledge, skills, and expertise to maintain applications within a managed service environment. DPC has been providing maintenance support to both its developed software and other developed software within the GCSS-AF enterprise infrastructure (managed service environment). DPC recognizes the maintenance activities are different in a managed service environment than those that would occur in a stand-alone operational environment. DPC has a detailed understanding of this environment and its procedures from its work maintaining the GFM-DI and LIMS-EV applications as well as being a part of the Global Combat Support Systems – Air Force (GCSS-AF) Data Services Operations & Sustainment group. The GCSS-AF enterprise infrastructure is a set of enterprise services that is hosted within Defense Information Systems Agency (DISA)


Page 7www.dpcit.com

Defense Enterprise Computing Center (DECC) environments at Maxwell AFB – Gunter Annex, AL and Wright-Patterson AFB, OH, with selected Continuity of Operations COOP functionality at Hill AFB, UT.

As can be seen in the graphic above, there are four major players involved in the operations and sustainment of GCSS-AF hosted applications. The first, DISA, provides the operations and support for the transport and computing services. This includes day-to-day support and resolution associated with the servers, operating systems, data transmission (“the pipe”) used for the supported applications. The second, GCSS-AF, provides the operations and support for the core GCSS-AF services. This includes day to day support for core services that include the Air Force Portal, Enterprise Service Bus (ESB), and Security Services (e.g. TAM) used for the supported applications. The third, the application maintainer, provides the operations and support for the application code and functionality resident within the application. The fourth, the Functional SPO, provides operations and support for the functional aspects of the supported applications.

In the case of your firm’s Managed Software Development and Maintenance activities, the Managed Hosting Service Provider would provide an equivalent functionality to that provided by GCSS-AF (possibly including DISA) in the model above. The Managed Software Development and Maintenance Provider (e.g. DPC) would provide equivalent functionality to the application sustainer and your firm would provide equivalent functionality to the Functional SPO. DPC sees this execution model, tried and proven within the Air Force for over a dozen years, as the ideal managed service scenario for your firm’s Managed Software Development and Maintenance needs.

DPC has extensive experience maintaining applications within the GCSS-AF operational environment and resolution of issues within the GCSS-AF environment. Because of the different support players involved, the role and techniques used by the application maintainer (e.g. DPC) differs depending on the issue encountered. For maintenance issues associated with the application code, DPC will provide “classic” sustainment support: namely, identify issue, investigate cause, define resolution, implement change, and validate change. For maintenance issues associated with the servers, operating systems, or use of GCSS-AF core services, DPC will provide “enterprise application” maintenance support: namely, identification of issue, routing of ticket to operations entity (DISA or GCSS-AF) for resolution, support to change implementation, and validation of change. In addition, DPC supports the Functional SPO in defining and communicating the functional implications of technical support issues and changes.

To provide effective resolution in this environment, it is important to know more than the published processes and procedures. Hands-on experience, coupled with a recognized reputation across the other support entities is key to timely resolution of maintenance issues. DPC has the unique blend of capability and experience in this regard that can be made immediately available to your firm. DPC personnel have been maintaining application capability in the GCSS-AF environment for seven years. The Program Manager, Chief Architect, developers, and testing support include personnel who were part of the GCSS-AF operations and support organization. This experience will ensure that your firm will receive prompt, effective, and complete attention and resolution of maintenance issues. DPC understands the language, written and unwritten, and processes necessary to successfully maintain applications within a managed service environment.

In addition to dealing with maintenance issues, DPC will be monitoring and reporting on sustainment-related metrics for the supported applications in the managed service operational environment. Concurrent usage and application response time are key performance metrics of the production application as well as releases coming


Page 8www.dpcit.com

into production. DPC will establish (if they are not in place already), monitor, and report on these metrics for your firm. Of note in DPC’s maintenance support within the GCSS-AF environment; DPC supported applications that were on the unclassified and classified GCSS-AF enterprise infrastructures. In addition, most of the GCSS-AF enterprise infrastructure is physically located in Montgomery, AL with the DPC application maintenance team residing in Dayton, OH. DPC has experience in providing proactive and effective application maintenance support to remote managed service locations.

are documented and reviewed. Problems are fixed and retested. Upon completion of User Acceptance Testing and the software release is approved for deployment, the DPC Team will provide a Release Artifacts Package. This artifacts package will include a: Deployment Plan, Installation Instructions, Version Description Document, Application Source Code, and associated User Documentation.

DPC Software Maintenance InnovationsDue to DPC’s over seven years’ experience maintaining applications within a managed services environment, DPC has a variety of innovations that can be leveraged by your firm immediately to generate improved performance and/or cost savings. One innovation which will likely be used is DPC’s Sustainment Management Console (SMC). DPC’s Sustainment Management Console (SMC) provides a comprehensive monitoring of all application system components. The console providesa real-time status as well as access to all log information. Focused primarily on data load and transformation processes, the DPC SMC provides for standardization of application component instrumentation as well as the data load/ETL process. The DPC SMC also provides an aggregation of application status reporting. Designed and developed with a flexible configuration, the DPC SMC provides a user interface for Administrators and other members of the application sustainment team. The DPC SMC provides for a real-time, automated review of all data load/ETL activity, all application component logs, as well as problem status alerts. In addition, the SMC emails a daily comprehensive report to Administrators and other interested parties. The solution is enabled via having all components write standards status rows to a set of database tables, providing the real-time information for use with the user interface. Combined with associated development/design pattern changes, the DPC SMC provides an automated, highly visible application maintenance solution that will result in increased productivity and cost savings from standard application maintenance methods.

RETENTION OF BEA KNOWLEDGE AND EXPERIENCEApproach/ExperienceDPC realizes that your firm’s Managed Software Development and Maintenance mission success depends not only on bringing in new and fresh approaches to meeting specific task order requirements, but also keeping personnel who have incumbent expertise and experience to provide continuity within the development function and to significantly reduce risk to your firm’s overall goals and objectives. Our Transition Management process is depicted in the following figure. Our plan is comprised of four stages and encapsulates activities including contract planning, stand-up management, staff transition, and knowledge/continuity capture. We begin many


Page 9www.dpcit.com

aspects of transition prior to contract award to ensure a lossless transition of the key incumbent workforce.

A likely unique element of your firm’s Managed Software Development and Maintenance transition will be the need for some geographic relocation of key incumbent personnel to the DPC Dayton, OH development facility. DPC is committed to the relocation of key people and has proven successful in the relocation of key personnel in a similar manner in its support of MIT Lincoln Labs. Relocation aspects of key incumbent personnel will also be called out within the transition plan and transition planning process.

Once your Managed Software Development and Maintenance efforts are under way, another key area of concern is the retention within your remaining corporate IT Team of the workload, status, and issues associated with on-going software development efforts. DPC has experience, from its GCSS-AF managed service software development experience, in helping to establish and support the appropriate Governance and Oversight mechanisms to allow for both tactical and strategic customer insight into the Managed Software Development and Maintenance activities. On the GCSS-AF effort, DPC supported weekly tactical project reviews with GCSS-AF Government personnel providing status, issues, and actions that allowed the GCSS-AF Government team to have knowledge and support (as required) actions to ensure successful development completion. DPC also supported periodic Program Reviews that reviewed the status and issues of development activities at a more strategic level. DPC would suggest (and support) your firm adopting similar mechanisms to help retain knowledge and experience of software development activities.Another method for retention of knowledge is DPC’s use of consistent development processes, practices, and techniques. With consistent and replicated tools, processes, and techniques it will be much easier for your firm’s personnel to productively engage with any managed software development effort.

ADHERENCE TO FORMAL WORK MANAGEMENT INDUSTRY STANDARDSApproach/ExperienceDPC has extensive experience in working to its customer quality standards. On its GCSS-AF and GFM-DI work, DPC has worked to CMMI Level 3 standards as adopted by the US Air Force Program Executive Office Business and Enterprise Systems (PEO BES) on a consistent basis. DPC has also performed these efforts under a large defense contractor’s CMMI Level 5 standards. DPC people, processes, and techniques are tried and proven to meet and exceed industry software development standards.

As part of its projected partnering strategy, DPC intends to partner with selected firms for IV&V and accreditation activities. DPC intends to utilize the services of firms who they have worked with on other Air Force efforts. Each of these firms is CMMI assessed and certified (Level 3) and will in their roles in these activities help to monitor, on an independent basis, DPC’s meeting and exceeding those software development standards.

Recommended InnovationOne unique innovation DPC would recommend to your firm in this area would be for your firm’s Managed Software Development and Maintenance activities to seek its own CMMI certification. While not the typical


Page 10www.dpcit.com

manner of certification (project vs. organization), project certification is really the most relevant for this kind of activity. It is not only the software development contractor (e.g. DPC) who must meet CMMI certification standards, but the integrated Managed Software Development and Maintenance team because of the various process and programmatic compliancesa associated with CMMI project certification. Seeking such certification will reinforce those processes and patterns of the integrated team required to provide the most effective and efficient software development efforts. DPC would suggest this kind of certification be performed in the second or third year of effort. DPC has experience in working with CMMI assessors and assessments as part of its other managed service software development activities.

ADHERENCE TO SOFTWARE QUALITY ASSURANCE RULES AND PROCESSESApproach/ExperienceDPC has extensive experience in not only adhering to software quality assurance rules and processes within its own software development efforts, but also through support of Government/Customer independent test and validation activities. Previous sections have outlined DPC’s development process and standards compliance. Worthy of note is DPC’s incorporation of these software quality assurance tests and audits within its build process activities. On its LIMS-EV and GFM-DI development effort, an independent organization (the Application Software Assurance Center of Excellence (ASACOE)) puts all application code through a defined series of tests to assess and categorize potential vulnerabilities. DPC has taken the ASACOE toolkit and incorporated it within its Automated Test Process and Jenkins framework. As a result of this integration of these tests within its build efforts, DPC was able to provide unheard of ASACOE results (less than 5 Category 1 violations for 1 million lines of code) in its most recent set of software releases.

As DPC’s Managed Service Development and Maintenance effort envisions a single development contractor, DPC would recommend that an independent test team be included within the Managed Software Development contractor’s team structure. This team would function integrated with, yet independent of the development organization with a unique reporting structure to allow for independent validation and issue resolution. DPC would partner an IV&V firm and embed them within our integrated Managed Software Development and Maintenance team.

FISMA CERTIFICATION (FEDRAMP)Approach/ExperienceDPC has extensive experience in providing software development artifacts and documentation in support of FISMA certification and accreditation activities. DPC has modified its software development design documentation to assist independent Air Force security assessors in obtaining system certification and accreditation via the DIACAP process on its LIMS-EV and GFM-DI efforts. DPC’s experience within the GCSS-AF managed service environment has been to support independent Certification and Accreditation (C&A) organizations. As such, DPC would recommend that an independent C&A team be included within the Managed Software Development contractor’s team structure. This team would function integrated with, yet independent of the development organization with a unique reporting structure to allow for independent activity and reporting. DSD would partner with an acknowledged expert C&A firm and embed them within out Managed Software Development and Maintenance team.


Page 11www.dpcit.com

WHAT SETS DPC APARTDPC is not your vanilla small-business IT firm. Our combination of personnel, processes, and experience are unique to the industry and to your firm’s Managed Software Development and Maintenance efforts. Key items that will set DPC apart from other potential contractors for this effort include:

• Over seven years’ experience providing software development and maintenance support within a government managed services environment• Proven track record of developing automated tools that improve software development reliability and decrease software development cost• Leveraging existing development and test environments and facilities thus providing more cost-efficient environment support• Partnering with proven, experienced independent test and certification firms• A never-ending focus on automation improvements in development and maintenance• Proven software development process that complies with the unique requirements within the government• Large enough to respond, small enough to focus


Documents

MANAGED SOFTWARE DEVELOPMENT AND MAINTENANCE … · MANAGED SOFTWARE DEVELOPMENT AND MAINTENANCE SERVICES WHITE PAPER Page 1 YOUR MANAGED SOFTWARE DEVELOPMENT SOLUTION Digital Prospectors