1 | P a g e

ANNEX B

Terms of Reference

Maintenance and Enhancements of the CTBTO Organizational Management Programme Achievement Status System (COMPASS)

2 | P a g e

TABLE OF CONTENT

1 INTRODUCTION 3

2 BACKGROUND 3

2.1 The Current Technology stack 3

2.2 Application overview 3

2.3 Application server 4

2.4 Authentication and authorization 4

2.5 Reporting 4

2.6 Document management 4

2.7 Workflow engine 5

2.8 Database 5

2.9 SAP interface 5

2.10 E-mail communication 5

2.11 Instances 5

2.12 Development environment 5

3 SCOPE OF WORK 6

3.1 The Requested Work 6

3.2 Task-Based Development Process 6

3.2.1 Regular Review meetings 6

3.2.2 Installation and Configuration 7

3.2.3 Testing and Acceptance 7

3.2.4 Delivery of Enhancements 7

3.2.5 Software Documentation 7

3.2.6 Warranty 7

3.3 Support Services 7

4 PERFORMANCE OF WORK 8

4.1 Work Orders 8

4.2 Ancillary Costs 8

4.3 Initiating Work 8

4.4 Plan of Work 8

4.5 Optional Extensions 9

5 ORGANIZATION OF WORK 9

5.1 On-site Work at the Premises of the Commission 9

5.2 Off-site Work Performed at the Contractor’s Facilities 10

5.3 Input by the Commission 10

5.4 Required Resources 10

3 | P a g e

1 INTRODUCTION

The Preparatory Commission for the Comprehensive Nuclear-Test-Ban Treaty Organization (hereinafter referred to as the “Commission”) is the international organization setting up the global verification system foreseen under the Comprehensive Nuclear-Test-Ban Treaty (hereinafter referred to as the “CTBT”), which is the Treaty banning any nuclear weapon test explosion or any other nuclear explosion.

The Headquarters of the Preparatory Commission are in Vienna (Vienna International Centre of the United Nations).

The Commission has implemented and deployed a web-based system “COMPASS” (CTBTO Organizational Management Programme Achievement Status System) to manage information on strategy and planning, programme and project planning, internal activities, time sheet management and time tracking. COMPASS is for internal use only. It is hosted on the CTBTO Web infrastructure and used by all employees of the organization.

The Commission seeks a qualified provider for maintenance and enhancements of the COMPASS application.

2 BACKGROUND

2.1 The Current Technology stack

The COMPASS technology stack consists of:

- Java - Spring framwork - Javascript/HTML5/CSS3

- Sencha ExtJS 4 - Twitter Bootstrap - Jasper Reports - Alfresco 3 ECM

- Oracle 11g

2.2 Application overview

The COMPASS front end application is built using Ext JS 4.2 Javascript framework. It uses Ajax based REST calls to the back end for CRUD operations and run back end actions.

The COMPASS back end component is Java based. It employs Spring framework including Spring MVC and Spring Security. It exposes a REST interface between the front- and back-end services. Any action toward database, reporting subsystem, document management subsystem, and authentication and authorization subsystem is managed by the back-end services. The application uses JDBC to access the database and Hibernate 3 as an ORM layer.

4 | P a g e

Alfresco ShareAlfresco

ShareCOMPASS Front-EndCOMPASS Front-End

Apache Tomcat

COMPASS Back-End

COMPASS Front-End

REST

HTTP

Oracle 11gRDBMS

JDBC

Active Directory

LDAP

Alfresco Enterprise

REST HTTP

HTTP

Alfresco Share

HTTP

<Opens>

SAP ERP

Core COMPASS Components

Other CTBTO systems and infrastructure

HTTP<Listen>

<Creates>

XML

Figure 1 Overall system architecture

2.3 Application server

COMPASS runs on Apache Tomcat 6.0.24. Application deployment and management is performed through the Probe interface.

2.4 Authentication and authorization

COMPASS uses the organization Active Directory server to authorize users. The authorization subsystem allows an administrator to create user roles, assign predefined privileges to roles and assign roles to users. Access to application functionalities and project data is restricted by user role privileges, user organizational role and the project workflow status. There are two groups of user roles: application-wide and project specific. (Existing) overnight jobs synchronize user information between COMPASS and Active Directory.

2.5 Reporting

COMPASS uses embedded Jasper Reports to create a variety of reports in PDF format. The flexible reporting subsystem allows reports to be started from a specific context or through a specialized reporting module. Another mode of reporting is provided by generic export to Microsoft Excel, a functionality that exists on every data grid in the application.

2.6 Document management

COMPASS uses Alfresco Enterprise 3.3.5 as document repository, workflow engine and user collaboration tool. Every COMPASS project has its own space in the Alfresco repository to store project related documents and reports. Also, every COMPASS project is accompanied with an Alfresco Share site which is used as a project collaboration tool. It allows team members to store and

5 | P a g e

exchange project documents and other project information in the form of wiki pages, forums, multimedia content and so on. Every project member has access to the Alfresco Share site. The site membership and roles are managed by the COMPASS application. The Alfresco COMPASS module implements custom-made Web scripts used to exchange information between COMPASS and Alfresco.

2.7 Workflow engine

COMPASS uses a JBPM engine built in the Alfresco. It is used to run the project workflow and coordinate project activities and approval processes among project and organizational roles. A single workflow definition is used as basis for the project management process. The workflow communi-cates with users by means of tasks presented through the COMPASS application inbox and email messages.

2.8 Database

COMPASS uses the Oracle 11g database. The database schema consists of approximately 60 tables and views with around 1500 columns.

2.9 SAP interface

COMPASS imports actual project costs from the organization SAP ERP system. The SAP system exports data into a CSV file overnight. COMPASS retrieves the file via an HTTP interface, processes it and imports the data into its own database. Project data retrieved from SAP and COMPASS data are linked by the shared project code and common work breakdown structure.

2.10 E-mail communication

COMPASS communicates with end users through email messages. There are three basic types of email messages: information on new workflow tasks, warning notifications (e.g. on overdue tasks) and updates to an administrator (e.g. on successfully performed synchronization job). Both the COMPASS back-end application and Alfresco (workflow) can be the source of such emails. Email is based on FTL or Velocity templates.

2.11 Instances

There are two system instances in use: test and production. The test instance is used for acceptance testing and end user training. The production instance is periodically replicated to the test instance. The instances are available on separate application servers on two Red Hat virtual servers hosted on the organization infrastructure. The Alfresco instances are shared among several applications within the organization.

2.12 Development environment

The current development environment consists of Eclipse, Maven, Alfresco Community 3.3, Oracle 11g XE. Source code is stored in the organization version control system (Git).

6 | P a g e

3 SCOPE OF WORK

3.1 The Requested Work

The Contractor shall maintain and enhance the COMPASS application, using the existing technologies and installed software as a baseline. This may include enhancements or modifications to any of the components of the application currently in use.

3.2 Task-Based Development Process

Upon request by the Commission, and following the procedure outlined herein below, the Contractor shall implement specific enhancements, ie. changes and additions to the existing COMPASS application software, in writing. A formal workflow system shall be maintained by the Contractor, to keep track of such enhancement requests and their progress or conclusion, following best industry practices.

3.2.1 Regular Review meetings

a. The Commission and Contractor shall meet regularly, and review the list of requested enhancements. Review meetings may be be conducted in-person or by remote facilities, as deemed necessary by the Commission.

b. The Contractor will analyse, and where appropriate, gather sufficient user requirements to estimate the volume of work required to implement any requested enhancement or feature and submit the results to the Commission for consideration.

c. Following review by the Commission, the Contractor may be requested to implement tasks as

deemed appropriate by the Commission in accordance with Section 4 below.

d. Review meetings shall also address the state of previously requested enhancement tasks, and accept completed tasks.

e. The Workflow system (see item 3.2) shall be used to track progress and register issues arising

from each enhancement request.

f. Formal review of progress shall be agreed upon between the Contractor and the Commission. Prior to such reviews, the Contractor shall provide the finished work unit(s) to the Commission thus enabling the users to adjust their requirements as necessary.

g. As far as feasible, no modification or enhancement should impose dependencies on program-

ming languages, software or vendors on the Commission, such as but not limited to forced upgrade, maintenance and licenses.

h. At the regular meetings, the Contractor shall submit to the Commission a summary report of the satisfactory completion of the particular on-request service(s), including, without limitations, detailed description of all work performed, review of all project activities, lessons learned and recommendations.

7 | P a g e

3.2.2 Installation and Configuration

The Contractor shall install and configure the enhancements into the code base and runtime system at the Commission. The Commission uses the source control system ‘Git’ for its code base; this shall be utilized for these enhancements as well. Communication of source code and related items between the Commission and Contractor may proceed through the (external) ‘github’ site, as arranged and agreed between the parties.

3.2.3 Testing and Acceptance

The Commission will have the primary responsibility for testing and will accept each enhancement or feature, assisted by the Contractor, as required. A Testing and Acceptance Plan shall be developed by the Contractor for each task. This shall be reviewed and approved by the Commission prior to implementation of the software enhancements. Final acceptance of the software enhancements by the Commission will be based on the agreed Testing and Acceptance Plan.

All tests must be driven by established requirements, use cases and written design constraints. This refers to such requirements as were communicated in the original request for work, or subsequent refining of requirements in cooperation between the parties.

3.2.4 Delivery of Enhancements

For each requested change or enhancement, the Contractor shall deliver :

a. A complete set of code to implement the change (via ‘github’ or as otherwise agreed)

b. Any required documentation or change/update to existing documentation that will adequately describe the modified software or behaviour of the applicaiton.

3.2.5 Software Documentation

The Contractor shall document software development (i.e. source code), implementation and config-uration where appropriate, in the English language.

3.2.6 Warranty

Following the installation and acceptance of the various enhancements, the Contractor shall provide warranty for the delivered software modules/enhancements for a period from the Commission’s acceptance up to the 12th month following the entry into force of the Contract or, subject to Section 4.5 below, of the relevant Call-off Period (as defined in Section 4.1).

3.3 Support Services

In addition to the Warranty of delivered software enhancements, the Contractor shall provide support for all modules during the relevant Call-off Period, as defined in Section 4.1 below, or as it might be extended in accordance with Section 4.5 below. Work shall include, but shall not be limited to, help-desk calls, product patches, bug fixes and feature upgrades on the installed system as suggested by the Commission and in compliance with the Commission’s guidelines.

8 | P a g e

4 PERFORMANCE OF WORK

4.1 Work Orders

The Commission shall have the right but not the obligation, to call-off the work in the form of Work Orders (WO) from the entry into force of the Contract until 12 months thereafter or until the performance of 150 man-days by the Contractor, whichever occurs first (“Call-off Period”). The work so called-off is to be carried out within the confines of these WOs, assigned as units of 25 man-days of on- and/or off-site work. A portion of these days may be defined either for enhacement (Section 3.2 above) and/or as support services for the maintenance of the system (to carry out bug fixes, corrections to the system, etc.) (Section 3.3 above). The Commission may therefore call-off a maximum of six Work Orders during the Call-off Period, that is, a maximum of 150 man-days of work.

4.2 Ancillary Costs

If applicable, each WO shall include and clearly detail such ancillary costs as may be deemed necessary to complete on-site work at the Commission in accordance with the Contract. Such costs may include, but may not be limited to,

a. On-site daily allowance

b. On-site accommodation

c. Transportation to the Commission’s facilities

d. Travel Insurance

4.3 Initiating Work

The Commission will request the initiation of the Work in the form of WOs. The Contractor shall not perform any Work if not requested by the Commission and described in WO. The Contractor may propose WOs for the Commission’s evaluation.

4.4 Plan of Work

Before the issuance of a WO to the Contractor and upon receipt of a written request, containing elaborations and definitions as to the nature of the particular requested service(s), the Contractor shall provide, at a minimum, within one (1) week of receiving the written request, the following information in the form of a work plan for each requested service identified in the written request:

a. Work plan and key schedule to accomplish the requested service; b. Assumptions, constraints, and key risks that could affect the requested service

completion and methods to manage the risks; c. Number of man-days to be allocated to the requested service; d. Place of work (on-site / off-site); e. Commencement date and completion date of the requested service.

After review of the work plan for each requested service identified in the written request, and only after acceptance by the Commission, will the WO(s) be issued to the Contractor.

The Commission will forward WOs to the Contractor with adequate advanced notice and containing all necessary details, expected deliverables, and minimum requirements for satisfactory performance.

9 | P a g e

The Contractor shall perform work only after receipt of the WO from the Commission. The Commission shall not be liable for service(s) which have been performed before and/or without the issuance of a WO to the Contractor.

Upon entry into force of the Contract, the Contractor shall draft a WO work plan template for review and acceptance by the Commission.

The Contractor shall issue invoices in units of completed WOs, which shall include, if applicable, the ancilliary costs incurred during the execution of that WO.

If requested by the Commission in a WO, upon completion of the on-request service(s) under the WO, the Contractor may be required to provide an oral presentation (including slides/handouts as required) to the Commission at its Headquarters in Vienna, Austria.

The deliverable and the summary report, after being evaluated under reasonable performance criteria and accepted as satisfactory by the Commission, will form the basis for invoicing and payment of a particular on-request service performed under a WO.

4.5 Optional Extensions

At the end of the Call-off Period, the Commission shall have the option to extend the Call-off Period for 4 (four) additional periods of 12 months each at the terms and conditions set out in this Contract. The effort under each extension shall be limited to a maximum of six WOs (150 man-days).

5 ORGANIZATION OF WORK

Work may be executed on-site at the Commission’s headquarters in Vienna, Austria, or off-site at the Contractor’s facilities.

5.1 On-site Work at the Premises of the Commission

For on-site work (if necessary), the Commission will provide at its premises a suitable work environment (office, room for meetings, presentations and trainings, stationary, Internet connection and/or fax service for the Contractor’s personnel to perform the services under the Contract, as required. The Commission will also arrange access to Commission’s personnel, documentation, and databases and other necessary identified sources of information.

The Contractor shall arrange for laptop computers and mobile telephones required to execute the on-site work. The Contractor will report directly to a single nominated point of contact in the Commission. The Contractor and its personnel shall conform to the Commission’s working hours (8 hrs/day) and days when working on-site at the premises of the Commission.

Progress meetings to discuss enhancements and their progress shall normally be conducted via remote meeting facilities, ie. not in person, not necessarily at the Commission. However, if requested by the Commission, the Contractor shall participate in Contract performance meetings, which may be organized at the Commission’s Headquarters in Vienna or at the Contractor’s facilities. During these meetings, planning and performance under the Contract, as well as any other relevant topic related thereto may be reviewed, discussed and recorded.

It is expected that the Contract shall be initiated with a kick-off meeting, lasting up to one day, at the Commission’ premises in Vienna.

10 | P a g e

5.2 Off-site Work Performed at the Contractor’s Facilities

For off-site work, the Contractor shall provide their own infrastructure, hardware and software environment necessary for the completion of the work under the Contract. In particular, the Constractor shall maintain at their premises a software/hardware platform that is similar enough to the Commission setup that thorough testing of the deliverables is possible. The Contractor shall communicate with the Commission by telephone, or electronic mail, as appropriate. All costs incurred by the Contractor as a result of such communication with the Commission for the performance of work under the Contract, shall be borne by the Contractor.

5.3 Input by the Commission

The Commission will be responsible for overall supervision of all on-site operations, including the physical database environments, and physical requirements for design, development, testing and production.

For designated Contractor Personnel, and to the extent necessary for the Contractor to fulfil the requirements of these Terms of Reference when carrying out work approved by the Commission on-site, the Commission will provide:

a. Infrastructure, including office space and standard office supplies, hardware and software. b. Access to e-mail, telephone and facsimile. c. Physical access to selected areas of the Vienna International Centre; however, strict

conditions and limitations on access and use of any accessed code or documentation described above will apply as contained in the Contract. Access will be granted upon request and approval by the relevant internal bodies.

The Commission will make all necessary and available documentation and source code available to the Contractor.

The Commission will make qualified staff available to assist and cooperate in responding to informa-tion requests from the Contractor in order to allow the Contractor to carry out the Work.

For designated Contractor Personnel, and to the extent necessary for the Contractor to fulfil the requirements of these Terms of Reference when carrying out work approved by the Commission off-site, the Commission will provide remote secure shell access to parts of the Commission’s test and production environments.

5.4 Required Resources

5.4.1 General Requirements for the Contractor

- The Contractor must demonstrate that it has a quality assurance system in place (e.g. ISO9000). - The Contractor must possess the necessary hardware and software tools to perform the work. - The Contractor must be sufficiently large and stable in order to guarantee the level of long-term

maintenance support foreseen in these Terms of Reference.

5.4.2 Requirements for Contractor’s Personnel

The Contractor’s personnel for the Work shall have:

a. A record of at least two successfully completed and relevant projects utilizing the technologies required of this Terms of Reference must be provided. Specifically, The

11 | P a g e

Contractor shall provide personnel for the Work whose technical knowledge must cover the following areas:

i. Practical knowledge of Java Enterprise Software Development Environment ii. Practical knowledge of Oracle 11g RDBMS

iii. Practical knowledge Alfresco ECM iv. Spring framework v. Sencha ExtJS4

vi. Twitter Bootstrap vii. Jasper Reports

viii. Practical knowledge of Web Services ix. UNIX and Linux operating system knowledge (Red Hat Enterprise Linux)

b. Ability to work with evolving user requirements and to use initiative and experience to

refine such requirements. Evidence of this ability should be provided in the form of brief descriptions of previous work undertaken.

c. Ability to communicate with the Commission’s staff. The Contractor’s Personnel must include someone able to produce clear and concise reports for the users and technical staff of the Commission in English.

5.4.3 Acquisition of Software

a. The Commission will procure all required software licenses (see, however, item 3.3.g above).

b. The Commission’s software standards (available upon request) and guidelines must be followed for all modifications or enhancements.

c. Modifications to documentation and new documentation must conform to the Commission’s software documentation standards and templates.

5.4.4 Maintenance of Third Party Software

The Commission shall be responsible for the maintenance and update fees of any installed 3rd party software acquired and used to implement any enhancement. Prior approval by the Commission’s at the progress meetings shall be required for any software that the Contractor might like to introduce.