Source_sought_Multi-Channel_Information_Collection_Tool_Software(CX).docx
DOCX document 45 KB Posted
- Solicitation number
- 12314419R0011
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Office of Customer Experience Multi-Channel Information Collection Tool Software Source Sought July 08, 2019
Objectives:
USDA seeks to obtain an enterprise agreement for a multi-channel information collection and listening tool.
Scope:
The Office of Customer Experience is seeking sources for an information collection and listening solution to enable USDA to systematically collect and analyze qualitative and quantitative data on customer/employee expectations, preferences, aversion, behaviors and sentiment analysis when interacting with the Department through multiple channels, including surveys, website analytics, social media, mail and contact/call centers. The platform must be encapsulated and able to perform all functions verbalized in Addendum A without the requirement of supplemental or additional platforms and/or software.
Please indicate if you provide these services on a GSA contracting vehicle.
Attachment A:
USDA Multi-Channel Information Collection Tool: Functional Requirements Matrix Use the codes below to indicate your level of support for each of the features.
| SUP |
| Supported as delivered "out-of-the-box" |
| MOD |
| Supported via modifications (screen configurations, reports, GUI tailoring, etc.) |
| 3rd |
| Supported as a third-party solution |
| CST |
| Support via customization (changes to source code) |
| FUT |
| Will be supported in a future release |
| NS |
| Not supported |
| ID# |
| Software Function / Requirement |
| Support Level |
| Notes |
1.0 Environment / Integration
| 1.1 |
| Section 508 compliant See details on Addendum A |
| 1.2 |
| FedRAMP certification |
| 1.3 |
| Single sign-on using USDA electronic authentication methods; secure data transfer (In-Transit and At-Rest) between respondents and the agency, secure agency role assignment and administration of users to allow secured access of specific information collections. |
| 1.4 |
| Accessible from a desktop or mobile device (i.e. tablet and/or cellular phone). |
| 1.5 |
| Ability to check mobile compatibility and access no matter the carrier or system platform (i.e. iOS or Android). |
| 1.6 |
| Allows compatibility with Customer Relationship Management (CRM) tools to send surveys to specific respondent communities and trigger collections based on touch-points, keywords, events or operational data. |
| 1.7 |
| Ability to create multiple large specific datasets of USDA customers/respondents with sub-agency or topically relevant attributes for sample determination, sorting/filtering, and export. Integration of data with other agency systems and operational data for administration and implementation of information collections. |
| 1.8 |
| Ticketing Systems - Allows for the compatibility with ticketing systems such as Customer Relationship Management (CRM) and IT services management (ITSM) tools to trigger surveys based on ticket events (e.g. resolved incident) |
| 1.9 |
| SSL Encryption – Encapsulated encrypted surveys shall meet OMB and USDA Sensitive But Unclassified (SBU) data requirements for platforms as a Service (PaaS), Infrastructure as a Service (IaaS), and Managed Hosting offerings. SSLv3 should be used with 128-bit encryption for data In-Transit to protect results as they transverse between respondent and survey tools or equivalent technologies to protect the information. |
| 1.10 |
| Browser(s) - Fully functional and compatible on common browsers (Chrome, Firefox, Internet Edge, Internet Explorer and Safari) used by USDA and customers |
2.0 Survey Design Capabilities
2.1
2.1a
Ability to create and save both custom and unique titles/names for information collection including the ability to insert form references, legal disclaimers, graphics, themes, or logos, text, form/document and other complex response recognition and analytics as needed.
USDA want to explore Optical Content Reader (OCR) machine learning capabilities as an option for document automation of forms, free form text, or open-ended data with a minimum industry threshold accuracy of 85%. Award platform shall possess this capabilty
| 2.2 |
| Introduction page - Allows for a space/page to be dedicated for greeting respondents and provide a textual description of information collection; includes area for introductory text in question block. |
| 2.3 |
| Variation of Question Types – Ability to include custom question formats or standard survey question formats to render quantitative and qualitative data points for sentiment analysis. |
| 2.4 |
| Variation of Response Types - Multiple Choice (single or multiple selection) with industry standard or custom scale, Checkboxes, Star Ratings, Dropdown, Matrix Scale, Comment Box, Single Textbox, Slider, Ranking, Matrix of Dropdown Menus, Multiple Textboxes with defined character limits, Date/Time, Contact Information, Skip logic, Question branching, Embedded Data (data forwarding for use in later questions), and Question Blocks for sets of questions that have a common scale |
| 2.5 |
| Add “Other” or “Comment” or another custom field to questions with the ability for respondents to provide details and or an alternate answer. |
| 2.6 |
| Custom routing of information collections to respondents providing the ability to designate a unique code/survey for each respondent or aggregate the data in a way to correlate respondent data with their known attributes. |
| 2.7 |
| Question Numbers - Ability to custom question numbering or indicator removal |
| 2.8 |
| Tool shall provide a question library and FAQ development with the capacity to expand with continued use. |
| 2.9 |
| Clear step-by-step user guide and online resources to institute best practices for survey question development structural flow. |
| 2.10 |
| Page Numbers - Survey allows option to display page numbers and progress toward completion. |
| 2.11 |
| Ability to embed survey questions into a website (rather than taking the user to a different page). For reference, the website is built on Grav, but ideally, USDA would have the ability to use this tool on the Hub, which will be built on Drupal and other various platforms. (Note: Programs may prefer to use links instead.) |
| 2.12 |
| Answer Validation - Includes certain string validation (i.e., numbers, phone numbers, and emails) |
| 2.13 |
| Preview Capabilities- Create a virtual testing environment (SandBox) to allow use testing of deliverables before they go live. The SandBox shall include unlimited testing of surveys, dashboards and or reports on varying devices (mobile phone, tablet, PC and Mac), with varying users and locations. Approved staff shall possess the ability to edit and/or approve the aforementioned deliverables and/or surveys. |
| 2.14 |
| The ability to check, edit and correct grammatical and spelling inconsistencies is a requirement (no exception). |
| 2.15 |
| Exit Link- Tool displays an exit link on all survey pages for easy access to exit the survey and possess the ability to return to the survey at the point of exit. |
| 2.16 |
| Ability to track and control version edits of surveys by authorized change control administrator/agents to ensure transparency and versioning control. Additionally possess the ability to roll-back any unauthorized changes and/or edits. |
| 2.17 |
| Shall provide summary and breakout aides to end users to include specific guidance and tips on how to read, filter and understand the survey data. |
| 2.18 |
| Optional purchase of statistically representative ID panels for agricultural producers, which can be delineated by crop types and region, and preferably by acreage grown. Preferably, these panel data can be seamlessly integrated with the survey system for security reasons. |
3.0 Collection Capabilities
| 3.1 |
| Multi-channel Data Collection and Listening Options - Web links, emails, website (embedded), social media (Facebook, Twitter, LinkedIn) data import from other sources and manual data entry. |
| 3.2 |
| Custom survey URLs |
| 3.3 |
| An integrated platform for a respondent directory/database that houses response data for that user (with export capabilities, filtering, and data exploration functions) with controlled access. |
| 3.4 |
| Ability to create a survey for mailings and take in mailed survey data via electronic or manual means. |
| 3.5 |
| Multiple Responses On/Off - Allows a survey to be taken multiple times from the same device or turn this feature off, so a survey can only be taken once. Ability to only allow each user to reply once per request. Flag duplicate requests. |
| 3.6 |
| Response Editing - Allows respondents to edit their responses while completing the survey |
| 3.7 |
| Anonymous Responses -. the survey tool provides the option to turn on/off IP collection at the discretion of the agency administering the survey |
| 3.8 |
| Cutoff Date/Time - Sets cutoff date/time when the survey will close and no longer accept responses. Ability to extend deadline as needed |
| 3.9 |
| Ability to attach metadata to survey responses and define metadata prior to collection for specific variables. |
| 3.10 |
| Unlimited responders |
4.0 Analysis Capabilities
| 4.1 |
| Filtering Capabilities - Survey tool allows filter functions based on certain criteria (question, collector, completeness, key words, time period, respondent). |
| 4.2 |
| Ability to randomize respondents or responses to protect the identity of participants for reporting and data analysis if needed. |
| 4.3 |
| Exports Results - Survey tool export will download complete survey data, specific data fields, any saved view, or a single question summary. This includes raw data, any graphs/charts that were created with Microsoft Office applications (e.g., XLSX, PPT), Minitab, PDF and other CRM platforms . These results are available directly to the licensee(s). |
| 4.4 |
| Quantitative and Qualitative Analysis: Ability to aggregate and analyze structured and non-structured data, data, sort/view by different data attributes or metadata, and run statistically sound analyses for reports. Qualitative analytic capabilities including text analysis and recognition from collection forms or graphics such as those used on applications, AB testing or tables. |
| 4.5 |
| Reporting - Ability to roll up results of one or more information collections into dashboards, reports and graphics to be delivered to specific staff, or across varying platforms. Reporting and trending features are available for year-over-year comparison, performance and/or metric development and tracking progress over time. Ability to import and align operational data to survey data to discover high impact touch-points. The software/system shall be able to perform reporting, data delineation and aggregation, metric development, sentiment analysis and dashboard formulation without a dependency on other software and/or systems that would cause an additional financial or investment obligation to USDA. This encapsulation is a mandated requirement (no exceptions). |
| 4.6 |
| Import Capabilities - Survey tool will be able to import partial or complete survey data, any saved view, or a single question summary. This includes graphics (graphs and charts) raw data and any data points importable from other platforms that were created. (Compatible with Microsoft Office applications (e.g., XLSX, PPT) and PDF). These results are available directly to the licensee(s). |
| 4.7 |
| Data Visualization Customization - Allows the capability to create custom and standardized reports allowing users to customize chart type, format, (bar, vertical bar, stacked horizontal and vertical bar, pie chart, line comparison, text) and other display options. These results shall be made available to each user and/or collection |
| 4.8 |
| Individual Responses - Allows the capability to see individual survey results for each respondent to include date started/completed, time spent on survey, IP address (if applicable), and other specific metadata. These results shall be made available directly to each specific user and/or collection |
| 4.9 |
| USDA mandates Sole Intellectual Control and Ownership of ALL data At-Rest or in Transit. Data gathered for the purpose of importing, exporting and analyzing in its entirety no matter the usefulness shall be governed by the aforementioned stipulation. No data shall be used mal-intent nor commercial gain. Any additional uses requires explicit consent from USDA Approved Authority |
| 4.10 |
| Role and Access controls shall be aligned to specific users providing them the ability to work with the data, specific information collection or specific results as needed. The platform shall provide results to multiple users on the network in real time allowing users to act on information and record actions in the record. |
5.0 Support
| 5.1 |
| Latest version of Software |
| 5.2 |
| Telephone technical assistance |
| 5.3 |
| Problem resolution |
| 5.4 |
| Email technical assistance |
| 5.5 |
| Online Technical knowledge base support |
| 5.6 |
| Support for custom integration with the agency data warehouse/systems. |
Section 508 and Security: See Sources Sought Addendum A
Addendum A: USDA Requirements
1. IT Accessibility Requirements Section 508 – Accessibility of Information and Communications Technology
(a) This software would be subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection 508(a)(1) requires that when the Federal Government procures Information and Communications Technology (ICT)[footnoteRef:1], the ICT shall allow Federal employees and members of the public with disabilities comparable access to and use of information and data provided to Federal employees and members of the public without disabilities. [1: Please note that the term Information and Communications Technology (ICT) is synonymous with Electronic and Information Technology (EIT), the previously used term. The term ICT will be used to meet international standards after the release of the Section 508 Refresh. ]
(b) The ICT accessibility standards as 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board (also known as the Access Board) and apply to contracts, task orders, and indefinite quantity contracts on or after June 25, 2001.
(c) Each Information and Communications Technology (ICT) product or service furnished under this contract shall comply with the Information and Communications Technology Accessibility Standards (36 CFR 1194), as specified in the contract, at a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within a period of time specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:
1) Cancellation of the contract, delivery, or task order, purchase or line item without termination liabilities; or
2) In the case of custom Information and Communications Technology (ICT) being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the non-compliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.
(d) The contractor shall ensure that all ICT products and services that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the most current compliant products or services available to satisfy the contract requirements.
(e) For every ICT product or service accepted under this contract by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.
Section 508 Compliance The Software shall comply with the standards, policies, and procedures below. In the event of conflicts between this document and the referenced document, this document shall take precedence.
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
3) http://www.access-board.gov/sec508/508standards.htm (Section 508 standards)
4) FAR 39.2 (Section 508)
5) http://www.ocio.usda.gov/document/departmental-regulation-4030-001 (USDA standards, policies, and procedures for Section 508) In addition, all contract deliverables are subject to these standards.
All web content or communications materials produced, regardless of format (text, audio, video, etc.), shall conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities comparable access to and use of information and data provided to Federal employees and members of the public without disabilities. All contractors (including sub-contractors) and consultants responsible for preparing or posting content shall comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document above. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in this document shall be the responsibility of the contractor or consultant.
The following Section 508 provisions apply to the products and/or services identified in this request:
· 36 CFR Part 1194.21 provisions a-l
· 36 CFR Part 1194.22 provisions a-p
· 36 CFR Part 1194.23 provisions a-k[4]
· 36 CFR Part 1194.24 provisions a-e
· 36 CFR Part 1194.25 provisions a-j[4]
· 36 CFR Part 1194.26 provisions a-d
· 36 CFR Part 1194.31 provisions a-f
· 36 CFR Part 1194.41 provisions a-c The following Section 508 provisions apply for software development material identified in this request:
For software development, software applications, and operating systems Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.21 provisions a-l
b. 36 CFR Part 1194.31 provisions a-f
c. 36 CFR Part 1194.41 provisions a-c For web-based applications (intranet, internet information and applications, 16 rules), the Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.21 provisions a-l
b. 36 CFR Part 1194.22 provisions a-p
c. 36 CFR Part 1194.31 provisions a-f
d. 36 CFR Part 1194.41 provisions a-c For telecommunication products and services, the Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.23 provisions a-k
b. 36 CFR Part 1194.31 provisions a-f
c. 36 CFR Part 1194.41 provisions a-c For video and multimedia applications (including training materials), the Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.24 provisions a-e
b. 36 CFR Part 1194.31 provisions a-f
c. 36 CFR Part 1194.41 provisions a-c For self-contained and closed products, the Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.21 provisions a-l
b. 36 CFR Part 1194.25 provisions a-j
c. 36 CFR Part 1194.31 provisions a-f
d. 36 CFR Part 1194.41 provisions a-c For desktop and portable computers, the Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.21 provisions a-l
b. 36 CFR Part 1194.26 provisions a-d
c. 36 CFR Part 1194.31 provisions a-f
d. 36 CFR Part 1194.41 provisions a-c For help desk and other support services, the Vendor shall comply with the following standards, policies, and procedures:
Section 508 Accessibility Standards
1) 29 U.S.C. 794d (Rehabilitation Act as amended)
2) 36 CFR 1194 (Section 508 standards)
a. 36 CFR Part 1194.31 provisions a-f
b. 36 CFR Part 1194.41 provisions a-c If the help desk or other support services include training, Vendor shall also comply with the following standards, policies, and procedures in addition to 36 CFR Part 1194.31 provisions a-f and 36 CFR Part 1194.41 provisions a-c:
a. 36 CFR Part 1194.21 provisions a-l (installable and web-based training)
b. 36 CFR Part 1194.22 provisions a-p (web-based software)
All Information and Communications Technology (ICT) subject to the 36 CFR 1194 standards will have a Section 508 usability and acceptance test where Section 508 compliance will be validated. This test shall be administered by a Federal Section 508 Testing Center.
All maintenance for Information and Communications Technology that requires upgrades, modifications, installations, and purchases will adhere to the Section 508 standards and 36 CFR 1194.
WCAG 2.0 Compliance The Software shall comply with the standards, policies, and procedures below. In the event of conflicts between this document and the referenced document, this document shall take precedence.
Custom ICT Development Services When Vendor provides custom ICT development services pursuant to this contract, Vendor shall ensure the ICT fully conforms to the applicable Revised 508 Standards prior to delivery and before final acceptance.
Installation, Configuration, and Integration Services When Vendor provides installation, configuration, or integration services for equipment and software pursuant to this contract, the offeror shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised 508 standards.
Maintenance, Upgrades, and Replacements Vendor shall ensure maintenance upgrades, substitutions, and replacements to equipment and software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 standards at the time of the contract award.
Service Personnel Vendor shall ensure the personnel providing the labor hours possess the knowledge, skills, and ability necessary to address the applicable Revised 508 standards defined in this contract and shall provide supporting documentation upon request.
Hosting Services When providing hosting services for electronic content provided by the agency, Vendor shall not implement the hosting services in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 standards. Throughout the life of the contract, the agency reserves the right to perform testing on a vendor or contractor’s hosted solution to verify conformance with this requirement.
Validation for ICT Items When purchasing ICT where 1) 508 validation is not possible prior to award, 2) when ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, Vendor shall test and validate the ICT solution for conformance to the Revised 508 standards, in accordance with the requirement testing methods, as defined by the agency. Throughout the life of the contract, the agency reserves the right to perform testing to verify conformance with this requirement.
Documentation Vendor shall maintain and retain full documentation of the measures taken to ensure compliance with the applicable requirements, including records of any testing or demonstrations conducted.
Conformance Reporting Prior to acceptance, Vendor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR shall be submitted for each ICT item, and shall be completed according to the instructions provided by ITI.
When the contractor is required to perform testing to validate conformance to the agency’s accessibility requirements, Vendor shall provide a Supplemental Accessibility Conformance Report (SAR) that contains the following information:
· Accessibility test results based on the required test methods.
· Documentation of features provided to help achieve accessibility and usability for people with disabilities.
· Documentation of core functions that cannot be accessed by persons with disabilities.
· Documentation on how to configure and install the ICT item to support accessibility.
· When an ICT item is an authoring tool that generates content (including documents, reports, videos, multimedia productions, web content, etc.)., provide information on how the ICT item enables the creation of accessible electronic content that conforms to the Revised 508 Standards, including the range of accessible user interface elements the tool can create.
· Before final acceptance, the contractor shall provide a fully working demonstration of the completed ICT Item to demonstrate conformance to the agency's accessibility requirements. The demonstration shall expose where such conformance is and is not achieved.
Before acceptance, the agency reserves the right to perform independent testing to validate that the ICT solution provided by the contractor conforms to the applicable Revised 508 standards.
Non-Compliance Before final acceptance of any ICT item, including updates and replacements, if Vendor claims its products or services satisfy the applicable Revised 508 standards specified in the contract vehicle, and the contracting officer determines that any furnished ICT item is not in compliance with such requirements, the contracting officer will promptly inform Vendor in writing of the non-compliance. Vendor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.
2. INFORMATION SECURITY
2.1. Contractor Access to USDA IT Systems
2.2. Immediately following contract award, the Contractor shall provide Contracting Officer’s Representative a complete list of employee names, approval to work and current FY year completion certificate of USDA Information Security Awareness Training.
2.3. Each contractor is required to utilize a Personal Identity Verification (PIV) card to access USDA IT systems and Sensitive Information. Using shared accounts to access USDA IT systems and Sensitive Information is strictly prohibited. USDA may disable accounts, and access to USDAIT systems may be revoked and denied if contractors share accounts. Users of the systems will be subject to periodic auditing to ensure compliance with USDA and USDA policies.
2.4. Each contractor is required to utilize government furnished equipment as appropriate.
2.5. In coordination with the Contracting Officer Representative (COR) USDA may suspend or terminate the access to any systems and/or facilities when an Information Security Incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as USDA determines that the situation has been corrected or no longer exists.
2.6. Upon request of USDA, the Contractor shall immediately return all Government issued equipment including, but not limited to government issued external storage media (i.e. external drives, thumb drives).
2.7. Copying of USDA information outside of USDA controlled space or technology is prohibited, provide contractor shall request permission from the COR to remove any data from the USDA environments. Upon request of USDA, the Contractor shall immediately return all Government information and attest by non-disclosure agreement the government information is properly and securely removed from media that is not government furnished equipment.
2.8. The Contracting Officer’s Representative (COR) shall be notified at least 5 days prior to a contractor being removed from a contract. For unplanned terminations or removals of contractors from the organization that occur with less than five days’ notice, the COR shall be notified immediately. PIV cards issued to contractors shall be returned to the COR prior to departure.
2.9. All access to USDA IT systems will be accomplished using Personal Identity Verification (PIV) credentials, in accordance with NIST FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors. At USDA the PIV credential is branded “LincPass”.
3. Compliance with Security IT Policies
3.1. Information systems and system services provided to USDA by the Contractor shall comply with the current USDA IT security and privacy policies and guidance.
3.2. Contractors are also required to comply with current Federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974; E-Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP); Office of Management and Budget (OMB) memoranda; USDA Information Security Program policies and other relevant Federal laws and regulations with which USDA shall comply.
3.3. House Resolution 83-15 “Consolidated and Further Continuing Appropriations Act, 2015” requires that USDA demonstrate each project/investment is “being managed in accordance with applicable lifecycle management policies and guidance.” This mandates that USDA development projects are required to follow the Agency’s System Development Lifecycle (SDLC). All projects listed in USDA’s Plan for Expenditure (PFE) can expect to be audited for compliance. Audits may occur at any time after the PFE is submitted to Congress.
3.4. The main web page for SDLC is http://www.USDA.usda.gov/USDA/sdlcapp?area=home&subject=sdlcovr&topic=landing.
4. Security Assessment and Authorization
4.1. This contract requires the Contractor to develop, deploy, and/or use information systems to access and/or store Government information, including Sensitive Information. The Contractor shall cooperate and support the USDA Information Security Office in the development of required documentation and artifacts.
4.2. All information systems that input, store, process, and/or output Government information shall be provided an Authority to Operate (ATO) signed by the authorizing official as identified by the CIO. The contractor shall adhere to current USDA policies, procedures, and guidance for security Assessment and Authorization (A&A) activities.
5. Privacy Act Compliance
5.1. Contractors shall comply with the Privacy Act of 1974 requirements in the design, development, or operation of any system of records containing PII developed or operated for USDA or to accomplish an USDA function for a System of Records (SOR)
5.2. “System of Records” is defined as a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.
5.3. In the event of violations of the Act, a civil action may be brought against USDA when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an USDA function, and criminal penalties may be imposed upon the officers or employees of USDA when the violation concerns the operation of a SOR on individuals to accomplish an USDA function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an USDA function, the Contractor is considered to be an employee of the agency.
6. Federal Reporting Requirements
6.1. Contractors operating information systems on behalf of USDA shall comply with Federal Information Security Modernization Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by USDA. Contractors shall provide USDA with the requested information based on the timeframes provided with each request. Reporting requirements are determined by the Office of Management and Budget (OMB), and may change each reporting period. The Contractor will provide USDA with all information to fully satisfy FISMA reporting requirements for contractor systems.
7. Security and Privacy Awareness Training
7.1. All Contractor personnel shall complete USDA-provided mandatory security and privacy training prior to gaining access to USDA information systems and provide their completion certificate to the COR or supervisor. Non-compliance may result in revocation of system access.
7.2. Security and privacy refresher training shall be completed on an annual basis. USDA will provide notification and instructions on completing this training.
8. Specialized Security Awareness Training
8.1. Specific contractors will be identified by USDA as required to complete specialized security training based on role-based requirements. The Contractor is required to report training completed to ensure competencies that address this training.
File details come from the government source that posted it.