A. BACKGROUND 

The World Bank (WB) and the European Union (EU) has been implementing a Trust Fund (TF) financed project called Strengthening Governance in Mongolia aimed to support the efforts of the Government of Mongolia (GOM) to improve fiscal discipline, public financial management (PFM), and transparency and accountability processes for strengthened governance in the public sector in Mongolia.   

This TF, through both Recipient Executed (RE) and Bank Executed (BE) interventions, serves two main purposes. Firstly, it complements and expands the ongoing technical assistance the WB is providing through the Strengthening Fiscal and Financial Stability (SFFS) Project. Secondly, this TF supports the GOM in advancing the current efforts toward increasing transparency, participation and accountability in fiscal matters as well as in strengthening its capacity to deal with non-technical drivers of the reform process that prevent state agencies from implementing policies and regulations as intended.  

The Component 2 of the TF primarily focuses on supporting the specific needs of the GOM to establish sound fiscal discipline, to improve expenditure management by strengthening the budget credibility, to establish the foundations for medium-term budgeting, and to re-orient public investment to strategic projects linked to the diversification of the economy. Five priority areas constitute the core of the component: (i) development and implementation of a public financial management reform plan and inter-agency coordination; (ii) strengthening budget preparation and execution towards results-based medium-term budgeting; (iii) improving budget reporting and transparency by increasing the comprehensiveness of fiscal and financial information and reporting; (iv) improving the management of contingent liabilities, through enhancing the existing governance framework for recognizing, managing, and disclosing contingent liabilities; and (v) strengthening public investment management, through the development and implementation of mechanisms for prioritizing capital project proposals and cost-benefit analysis.

The Ministry of Finance is operating more than 12 fiscal and financial related nation-wide information systems. As the number of independent systems increasing, the requirement of data sharing and exchange is more in demand.

MoF created a working group to conduct an analysis on implementing a solution for an integrated system and on improving connectivity among all of its systems. Also, under the subcomponent of Strengthening Fiscal and Financial Stability Project (SFFSP) on strengthening the public financial management institutional capacity, the WG conducted analyses of MoF systems, their interconnectivity solutions, user requirements and planned the project schedule.

MoF has been implementing Point-to-point micro web services solution on each systems because of its simple and straightforward approach and urgent business needs, however it is the least recommended solution from the WG since such approaches are not sustainable regarding cost, ineffective data exchange without any standards, increased complexity and more.

Also, traditional system development approaches created chaotic situation when different vendor usage different choices of technology, platform, framework and it became difficult to maintain interoperability among the systems. Considering these issues, it is necessary to take more strategic, holistic and integrated approach for this problem. Hence it is necessary to develop enterprise architecture and platform which will comprise principles, reference models, standards and guidelines.

Therefore, MoF is planning to implement Intermediate Data Exchange solution among all of the MoF systems, as well as with other ministries and agencies as a mid-term development plan under the PFM strategy. The plan is listed as an activity “Provide interconnectivity of financial systems and Develop PFMIS” under the objective “Improving financial management information system”.

B. OBJECTIVE OF THE ASSIGNMENT 

Hub and Spoke architecture (also API and Service management, developer system) based on interoperability platform is the most widely used approach nowadays to ensure flexible, secure, and reliable data exchange between a number of systems within the same organization, as well as with other public and private organizations. This approach benefits with interoperability standards and predefined key requirements for web services/APIs and let authorized internal systems and ministries/agencies/units connect their systems to this service platform for secure data exchange.

There are free open-source service Enterprise Service Bus (ESB) and interoperability solutions available (WSO2, Dream Factory, Gov Talk and more). According to latest World Bank studies and reports Estonia, Bhutan, Moldova, Albania, and other countries are using these platforms effectively and saving millions by avoiding hundreds of direct connections between systems (Spaghetti pattern).

Within the scope of “Direction of the policy to be adhered to on the governmental information exchange system” by the Communication and Information Technology Authority, National Data Center has been developing the “KHUR” governmental information exchange system supporting on the open-source platform with the architecture “Enterprise Service Bus”. This platform is more focused on and implemented as an inter-organizational Whole of Government (WoG) approach. Also, deploying new services and accessing the existing services require some time and activities of contracting for any organizations. 

Considering the increased demand of the information availability on different systems as well as the data exchange requests from other organizations, MoF is planning to create its own Data Exchange Platform based on the open-source platform WSO2 which is best practiced in the industry. The task will cover the following two main assignments.

1. Design, implement, and setup a WSO2 data exchange solution for MOF.
2. Develop and publish APIs to the platform

C. TECHNOLOGY SPECIFICATION

i. MAIN FEATURES

• Service reusability
• Single unified development – not required to develop interface protocols on each system.
• Secure data exchange
• Supports various data sources
• Centralized management for authentication, authorization, and a data access control
• Centralized monitoring for data exchange and performance
• Standard communication protocol and ability to connect with other organization through KHUR system.
• Easier and faster deployment of new services.

ii. REQUIREMENTS

• Must provide comprehensive management and monitoring with a web console with enterprise level security. 
• Manage API/Service visibility and restrict access to specific agencies or systems
• Manage API/Service lifecycle
• Ensure API/Service security by restricting API access tokens to domain/IPs, validating APIs payload contents against a schema, applying security policies to APIs authentication and authorization and provide threat protection
• System should have proper capabilities to manage and scale API traffic and enforces rate limiting and dynamic throttling based on usage quotas and bandwidth quotas.
• System should have high performance pass-through message routing with minimal latency
• System should have provision to do the proper/required integration with SSO System
• System should provide developer portal to search APIs by provider, to provision the API keys, subscribe API, notification for new version of subscribed APIs and view of the API consumer analytics.
• Portal will have functionalities for automatic generating service interfaces (for example from WSDL and Database queries) and service aggregation tools (results of the one service are used as a parameter for other service).
• System should have the ability to publish new APIs/Services to the platform and portal in easy way
• The platform must support HTTP, HTTPS, Web Socket, SMTP and other standard Transport Protocols.
• Must provide message formats and protocol like JSON, XML, REST API, WSDL, SOAP and FTP.
• Should be able to connect with various data store like RDBMS, CSV, Excel, ODS, etc.
• The platform must support database queries, views, procedures, functions, tables, etc. and generate web service interfaces.
• Should be able to connect with any existing APIs/Services.
• Must be able to provide horizontal scaling via clustering with stateless server architecture
• Must ensure long-term execution stability with low resource utilization
• Must ensure load balancing for scalability and failover for high availability of service endpoints

iii. SECURITY

• The vendor should follow any of the industry standard secure development methodology
• The vendor should consider (but not limited to) common vulnerabilities such as SQL Injection, Cross Site Scripting (XSS) etc.
• Vendor will undertake responsibility for Input Validation Controls, Authorization/Authentication Control and other security controls in place in both test and production environment of application.
• The following vulnerabilities must be prevented and ensured security from the beginning:

            o Cross Site Request Forgery (CRSF)

            o Cross Site Scripting (XSS)

            o Session hi-jacking

            o Session Fixation

            o SQL Injection and Code Injection

            o Input Validation/Filtering

            o Output Escaping

            o Secure File Access

D. SCOPE OF THE WORK

Task 1. Conduct analysis on the current systems, databases, and the IT environment.

• MOF IT environment including database and Information systems based on the previous study and findings.
• Review and analyse relevant reports and recommendations available.
• The government data exchange platform KHUR.
• Discuss and get approval on a list of API services, queries to be developed on the current systems, which will be deployed to the platform. /Up to 25 services/
• Prepare a detailed work plan /schedule a full task list/ and get approvals from MOF and PIU.
• Estimate the required hardware resources.

Task 2. Design, setup, and configure the data exchange platform.

• Defining solutions and deployment architecture which will enable efficient, secure, and standardized service-oriented environment for MOF.
• Installing and configuring all necessary components and tools of WSO2 platform (API Manager, Enterprise Integrator, Identity server)
• Develop and customize the API Manager Portal site
• Connecting and configuring current data sources and the ODS to the platform to make the systems ready for new services development.
• Conduct analysis on the current and future data transfer, processing needs, and estimate required hardware resource and scalability plan.
• Perform performance and security tests. This may include other tests.

Task 3. Developing and deploying APIs to the platform

• Analyze existing database structures of MOF systems for API development
• Developing, configuring, and deploying new APIs on the platform as planned and approved at the task 1 with the help of functional administrators and MOF IT officers. (GFMIS, Fiscal, PIMIS, DMFAS, ODAMIS, LFDMIS, E-Report, E-Balance, Payroll, License)
• Creating and deploying APIs to the platform from existing APIs of the MOF systems

Task 4. Prepare all necessary documents and tutorials.

• Design and architecture documents including diagrams.
• Step by step installation and configuration manual for system administrators
• User manuals for all stakeholders (Developing, deploying, configuring, and managing APIs)
• System backup or easy installation package including scripts, backups, docker files etc.
• Organize trainings for system administrators.

Task 5. Administration and maintenance for 6 months after delivering the first 4 tasks.

• Monitoring and maintenance if necessary, execute additional configuration for the platform.
• Consult on the platform operations and cooperate with developers on database queries and API deployment
• Further develop and improve the existing APIs
• Developing and configuring new APIs to the platform /Up to 20 services/
• Administration of the platform 

E. WARRANTIES AND SUPPORT

All software modules delivered shall be considered to be under warranty at least 1 year and possibly for a further period to be negotiated at contract award. 

• Any errors reported (defined broadly as unexpected system behaviors that would have caused the system to fail acceptance testing) shall be resolved promptly during this period. 
• For purposes of this assignment, critical errors that halt operation of the system shall be addressed within one day and resolved, or a work around provided, within two days. 
• Timely and necessary operational support shall be provided under the warranty through a dedicated help desk, to be maintained at the Consultant's premises. 
• Amendments and enhancements to platform shall be negotiated under the terms of warranty.

F. SUPPORT TO BE PROVIDED BY THE CLIENT

The client will provide all the information, documentation, access and co-operation that may reasonably be expected under this assignment including, but not limited to, the following: 

• Organizing workgroup meetings with departments and personnel who is responsible for the systems.
• Close cooperation for developing user requirements, architectures, and solutions.
• Provide limited access to system databases.
• Close cooperation for developing any web services and database queries.
• Provide access to MOF systems.
• Full access to studies and documentations of MOF information systems.
• Any other support needed within the scope of this assignment.

G. QUALIFICATIONS REQUIREMENTS

The consulting firm must prove that they have solid technical background and operational strength to undertake and take this work forward without any hindrances. Bidder must also have adequate technical ability, resources, human resources and processes. As such, following are defined as minimum eligibility criteria: 

• Minimum 5 years of general experience in ICT business;
• At least 3 years of experience in designing, developing and implementing enterprise information systems of similar nature;
• Must have vast experience to deploy scalable system in clustered environment or experience to develop fully componentized middleware platform;
• Have successfully developed similar two or more software systems in terms of cost and complexity within the last 2 years to ensure the use of the latest technology and IT based solutions available in the market and when possible in open and reusable formats;
• Have successfully developed one or more software systems in Agile development within the last 2 years;
• Needs to have Test Environment ready with equipped devices at vendor’s premise;
• Proven record of maintaining software development professionals on the regular payroll of the firm; 
• Current skills in relevant database technologies including Oracle Database management system, MSSQL, MySQL, PLSQL and T-SQL;
• Current skills in relevant web service standards such as XML, JSON, REST API, SOAP and WSDL.

Key professionals and their qualifications

The assignment will require several types of professional skills and varying levels of input, depending on the Module and the overall progress of system development and implementation. The main roles anticipated, and the minimum qualifications required for those roles are listed below (Table - 2). 

Subject to timing and availability, it is possible that some team members of the selected firm may be able to perform more than one role and offer multiple skills. Such combined roles will be accepted subject to feasibility, at the discretion of the Client, and will be agreed at appropriate times during the contract. The implementation schedule will be a key criterion when evaluating the feasibility of such combined roles. 

The team members should meet the following requirements in addition to the detailed qualification requirements included in table 2:

• Excellent interpersonal skills, ability to work in a group and multicultural team environment is required to deal effectively with staff at all levels;
• Be able to perform the task at high quality in a timely manner;
• Experience in similar systems development.

• The consulting firm represented by the Project Manager will report directly to the Director-General of the Public Administration and Management Department, the Head of the Financial Information Technology Division (FITD) and will work on a day-to-day basis with the officials appointed by the Head of the FITD to review progress with the work program and to resolve any outstanding issues.
• The consultancy firm is expected to develop the system using Agile software development approach. This means the consultancy firm shall carry out Agile ceremonies and include in the Sprint review meetings the officers of the FITD.
• The consultancy firm will prepare monthly progress reports detailing the achievements and impediments in executing the entire work plan effectively. These progress reports shall be submitted to the FITD of Public Administration and Management Department and the PIU.

70120582