Support services for the internet-based IT procedure for a nationwide "Procedure Management for Large-Capacity and Heavy Transports (VEMAGS®)".

Lot 1: IT project management and IT quality assurance

Lot 2: Application Development

The service provider "IT Project Management and IT Quality Assurance VEMAGS Process Module 2023" is intended to support Hessen Mobil in the management of the IT project, IT project controlling and IT quality assurance vis-à-vis the IT service provider "Application Development VEMAGS®® Process Module". He acts as a consultant and supporter of the Project Management Hesse (PL-HE), i.e. he does not make any project decisions himself, but advises the PL-HE on the QA work to be carried out and supports it in process design and project management.

With regard to the scope of services and the suitability criteria to be applied, a distinction is made between the following two task packages:

•IT project management (Section 2.1.1 Service description)

•IT quality assurance (Section 2.1.2 Service description)

Scope of services IT project management task package

The service provider supports PL-HE in all areas of IT project management. In the following, exemplary support services for the wide-ranging areas of responsibility of the PL-HE, which are particularly in focus, are outlined. The list is therefore not to be regarded as exhaustive.

Project planning and schedule management

•Creation, accompanying processing and documentation of a rough project schedule

•Establishment and management of a project calendar and meeting system

•Deadline coordination and control as well as monitoring of deadlines

•Monitoring process compliance

•Participation in the preparation and plausibility check of effort estimates (time and costs)

Cost and budget management

•Management of a project accounting system oriented towards commercial law, including processing of the defined payment modalities and preparation of the associated documentation

•Preparation and documentation of a year-end financial statement

•Project controlling including communication with external contract/agreement partners

•Participation in budget planning for both operations and further development

Auftragnehmermanagement

•Participation and support in contract monitoring

•Participation and support in procurement procedures

Stakeholdermanagement

•Participation and support in the management or content-related and organizational preparation of committee meetings as well as other VEMAGS® events (e.g. technical tests)

•Participation in reporting and public relations (e.g. portal presence)

Data protection and data security

•Participation in GDPR contract management

•Participation in data protection management

•Participation in the maintenance of the security concept

Strategic Application Management

•Participation in breaking down the strategy and objectives of the overall system to the VEMAGS® process module

•Participation and support of the client in the development of a catalogue of criteria for quality assurance

•Participation in the assessment and implementation controlling of the prioritized requirements

Scope of services IT quality assurance task package

The service provider supports PL-HE in all areas of IT quality assurance. In the following, exemplary support services for the wide-ranging areas of responsibility of the PL-HE, which are particularly in focus, are outlined. The list is therefore not to be regarded as exhaustive.

planning

•Structure and maintenance QA manual

•Definition and updating of processes in the area of project and quality management including process goals and quality criteria

•Definition of the test procedures and the associated processes for the work results of the service providers for application development and operation

•Definition of the QA criteria for the work results of the service providers of application development and operation

Scrutinies

The following test areas are to be covered:

Examination of the work results of application development

•QA of the VEMAGS® system documentation (architecture, system description, development principles, style guide, functional descriptions)

•QA for requirement specifications/requirement specification according to the QA manual based on the criteria catalog

•Evaluation and analysis of the calculated expenses on the basis of the rough concepts

•Examination of the implementation against the target requirements

•QA of the test concepts as well as analysis and evaluation of test votes of the specialist testers

•QA of software quality in terms of compliance with software standards (layer model, redundancy reduction, security, etc.)

Examination of the results of the company's work

•QA of compliance with service level agreements

•QA of compliance with the safety framework

Testing of process quality

•QA of release and project planning

•Support in the acceptance process including analysis and evaluation of the releases before the start of production

•Release review including analysis and evaluation from productive operation

•Implementation of operational controlling (e.g. TB ticket system)

•QA of the functional and technical seals (Xvemags connection of third-party systems)

As a general rule, the checks to be carried out by the IT QA team are formal checks (completeness, consistency, requirement/order conformity, process conformity). There are no checks with regard to technical correctness, e.g. in terms of legal conformity. Likewise, no technical tests or acceptance tests are carried out by the IT QA team. Rather, its task is to evaluate the tests carried out in terms of test results and test coverage. The test results are documented and discussed with the authors/responsible persons of the respective work results. In particular, the IT QA team does not make any decisions and does not make any recommendations regarding the detachability of work results. These are reserved for the project management Hesse.

The service provider "Application Development VEMAGS Process Module 2023" is intended to support Hessen Mobil in particular in the new and further development as well as the ongoing maintenance of the VEMAGS®® Process Module application and the application development environment. Based on the federal government's V-Modell XT, the service provider will keep the JavaEE application operable with JBoss as an application server and a PostgreSQL database and implement new processes and functionalities. In this context, the replacement of outdated or unsuitable technologies (e.g. frontend, PDF render engine, qualified electronic signature) is a special requirement for competences.

With regard to the scope of services and the suitability criteria to be applied, a distinction is made between the following three task packages:

•Technical application support (Section 2.1.1 Service description)

•Technical application support (Section 2.1.2 Service description)

•Cross-sectional tasks in application development (Section 2.1.3 Service description)

Scope of services Task package Technical application support

The service provider supervises all areas of technical application support. In the following, exemplary services are outlined that are particularly in focus. The list is therefore not to be regarded as exhaustive.

Conception

•Analysis of (technical) requirements

•Creation of the rough concept of the specifications on the basis of the project client's specifications

Preparation of technical concepts (serves as an implementation decision template for the client body)

•Create surface designs

•Evaluation proposals with regard to the achievement of objectives in the implementation of requirements

•Participation in budget planning for both operations and further development

test

•Test of professionalism against technical concept and detailed IT concept

•Updating the test automation

•Organization and monitoring of the specialist tests

Anwendungsdokumentation

•Documentation of the application (e.g. with Enterprise Architect)

Operational support

•Technical sealing according to the 4-eyes principle against new third-party system manufacturers or when changing the Xvemags interface

•Specialist analysis of error tickets in the tool of the technical operator (ticket processing with the participation of Hessen Mobil)

Scope of services Task package Technical application support

The service provider supervises all areas of technical application support. In the following, exemplary services are outlined that are particularly in focus. The list is therefore not to be regarded as exhaustive.

Technical application development

•Creation of detailed IT concepts

•Software creation (mapping of new processes and functionalities) according to all levels of the layer model and software maintenance

•Development of a VEMAGS® app for iOS and Android mobile devices

•Conception and implementation of "reduction of technical debt" (replacement of obsolete or unsuitable technologies for public authorities).

For example, in the frontend, JSF 1.0 is to be replaced by Vue.js. Both technologies are in use at the same time, with the proportion of JSF 1.0 steadily decreasing compared to Vue.js.

•Evolve the PostgreSQL database

•Unit, module and integration/system tests

Testing the application against the detailed IT concept

•Technical documentation of the application, the development, test and deployment processes as well as the development standards

Delivery of the software (approved releases) to the technical operator (participation in deployment) on the basis of Flyway

Operational support

•Product support of the application VEMAGS® procedure module, the Xvemags interface and support for users of the signature software

•Technical sealing according to the 4-eyes principle vis-à-vis new third-party system manufacturers or, in the event of a change to the Xvemags interface, on the basis of a model contract (contract between contractor and third-party system manufacturer on the terms of the framework agreement between client and contractor)

•3rd level support for the technical operator (incl. support in case of malfunctions)

Scope of services Task package Cross-sectional tasks Application development

The scope of services of the service provider also includes all cross-section tasks of application development, most of which are in the area of service and consulting as well as support in project management. In the following, exemplary services are outlined that are particularly in focus. The list is therefore not to be regarded as exhaustive.

Management & Product Support

•Participation in the preparation of release and project planning

•Project, order and team management

•Preparation for regular reporting

•Calculation of the effort and determination of the implementation time on the basis of rough concepts (serves the client committee as a decision-making template and prioritization aid)

•User support as 1st and 2nd level support within the service period according to Section 3.3.1.1 (Advice and support of Hes-sen Mobil with the central VEMAGS® administration)

Provision and maintenance of the software infrastructure (see also section 3)

•Provision (incl. operation), administration and maintenance of the ticket system of the technical operator (Znuny) with the state representatives and the project management as ticket holders

•Provision (incl. operation), administration and maintenance of the bug tracking tool Mantis (predefined ticket system for application development) with the country representatives and the project management as ticket beneficiaries

Maintenance of content management system with TYPO3 (VEMAGS® homepage)

Quality requirements for the provision of services with regard to the scope of services Task package Technical application support

The following quality requirements must be taken into account when providing the services described.

Requirements for quality planning

Software maintenance, further development and optimization must be carried out in such a way that trained and experienced application developers who have mastered the underlying architecture and have read the documentation can easily further develop the VEMAGS® process module.

To ensure this, the following procedures must be applied to the provision of services:

•Documentation/updating of standards (programming guidelines, style guides, architecture)

•Creation and use of appropriate metrics to measure software quality

•Creation and updating of test cases. Continuation of the automated tests. This requires the following skills:

o Windows programming (cmd + bat)

o Linux shell programming

the FitNesse

Selenium

XML

o PostgreSQL DB-Administration

o PostgreSQL DB development in PL/SQL

o Java (for defining the methods that read FitNesse/Selenium data, interface adapters, etc.)

o Java-Script/HTML (for the definition of the UI elements that read Fit-Nesse/Selenium data)

In this context, the explanations t on technologies, tools and tools must be observed.

Specification of requirements for quality planning and operation of infrastructure

Analogous to the technical operation of the VEMAGS® Process Module application, a service time is defined from Monday to Friday (except on national holidays) from 8:00 a.m. to 5:00 p.m. During the service period, the availability of 98% applies to the Ti-cket systems (operation [currently Znuny] and software development [currently Mantis]) as a service level agreement (SLA) according to ITIL.

In accordance with the requirements for the accessibility of the VEMAGS Process Module application, the specifications for the response time also apply to the VEMAGS®® homepage during the service time

By taking appropriate measures, application development ensures that high availability of the ticket systems and the homepage is guaranteed even outside of service hours.

In the event of non-compliance with the requirements for quality planning, the operational SLA and the specifications for response times, a contractual penalty of 0.02% of the order value (12-month value) is due for each case of non-compliance (the check is carried out per release). In the first year of performance, the estimated value of the contract according to the award is used, in the subsequent years of performance, the previous year's value is used.

Requirements for quality inspections

With regard to quality inspections, the following procedures must be implemented as a minimum standard for the provision of services:

Checking for compliance with documented programming guidelines, the style guide and the architecture documentation to be handed over to the client

Statistical evaluation of the results of unit tests and the test completion of automated tests

Code analysis that identifies abnormalities (such as Sonarqube).

The test reports must be enclosed with the delivery of a release. Suitable threshold values must be defined by the application architect/quality manager. Compliance with them must be checked and demonstrated. In the event of deviations, code reviews must be carried out and verified.

For continuous monitoring of quality, the selected tool for continuous build integration Jenkins is used.

The VEMAGS® Process Module application is a browser application that can be accessed from the Internet. Accordingly, security mechanisms against common attack scenarios must be anticipated and implemented in coordination with the client. The application and its components must be continuously examined with regard to relevant catalogs (OWASP, CVE). If there is a need for action, this must be coordinated with the client without being asked to do so and without delay.

The software used to create and provide the executable application VEMAGS® Process Module, including all libraries, must be regularly checked for discontinued ("desupported") software for which the manufacturer no longer assumes any warranty, which is considered obsolete or is no longer being further developed.