Statement_of_Work_(SOW)_Attachment_A.pdf

Attachment A

STATEMENT OF WORK (SOW)

ENTERPRISE RISK MANAGEMENT SUPPORT SERVICES

1. INTRODUCTION

The Hollings Manufacturing Extension Partnership (MEP®) is a program of the U.S. Department of

Commerce’s National Institute of Standards and Technology (NIST). The MEP National Network™

(Network) comprises NIST MEP, 51 MEP Centers located in all 50 states and Puerto Rico, and its 1,300 trusted advisors and experts at nearly 600 MEP service locations, providing any U.S. manufacturer with access to resources they need to succeed. MEP Centers are funded by a combination of Federal, State, local and private resources; and focus on helping small and medium-size manufacturers (SMMs) generate business results and thrive in today’s technology-driven economy. MEP provides Federal financial assistance of more than $100 million per year through cooperative agreements (grants with substantial agency involvement) to the Network, comprised of eligible recipient organizations.

MEP’s mission is to enhance the productivity and technology performance of U.S. manufacturing by acting as a trusted, strategic advisor to promote business growth and connecting manufacturers to public and private resources essential for increased competitiveness and profitability. Centers tailor services to meet critical needs, ranging from process improvement and workforce development to specialized business practices, including supply chain integration, innovation, and technology transfer.

MEP's foundation is built upon its partnerships. Centers are the hub for manufacturers, connecting them with government agencies, trade associations, universities and research laboratories, state and federal initiatives, and a host of other resources to help them grow and innovate.

The NIST MEP program is a successful public-private partnership that encourages cooperation between the Federal government, state agencies, and manufacturing firms. The MEP program awards cooperative agreements to nonprofit organizations (defined for the purposes of determining eligibility as academic institutions, state agencies, and other 501(c)(3) organizations) consisting of Federal funding and cost shared (non-Federal) amounts, including cash and eligible in-kind contributions. These cooperative agreements are subject to and administered in accordance with the applicable Federal government cost principles and Department of Commerce (DOC) financial award terms and conditions. Many of the cooperative agreements include, as part of the scope of work, agreements with subrecipients and third party, in-kind contributors who work with the cooperative agreement recipients to achieve the MEP cooperative agreement project’s objectives.

Some references for this work described below can be found here:

A-123: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

A-11: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/a11_current_year/a11_2017.pdf

GAO Risk Management Framework: https://www.gao.gov/products/GAO-15-593SP

2. BACKGROUND

NIST recently completed a multi-year competitive process to select MEP Center Operators for each State and Puerto Rico, as well as an internal reorganization. These processes were conducted in phases and completed in April 2017. In conjunction with the re-competition process, NIST MEP implemented improved programmatic oversight procedures while eliminating duplication of effort and reporting burdens on recipients to the extent possible. For example, transitioning from the current year-to-year award process to multi-year (five-year) funding procedures in accordance with the provisions of Chapter https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/a11_current_year/a11_2017.pdf https://www.gao.gov/products/GAO-15-593SP

18 of the DOC Grants and Cooperative Agreements Manual (10/24/16). Through multi-year funded cooperative agreements, NIST MEP sought to reduce the level of effort required by recipients in preparing a full cooperative agreement application every year. Through these efforts, NIST MEP will improve its efficiency while ensuring that mechanisms and protocols are in place to provide sound oversight throughout the life of the cooperative agreements. Related to improvements in oversight, over the past two years, NIST MEP has engaged a contractor to review the financial risks associated with funded MEP Centers, including NIST MEP’s compliance risk posture. This work is on-going.

3. PURPOSE

NIST is seeking contractor support to review its current enterprise risk management posture, develop a framework for addressing risk management, and identify and implement additional procedures and protocols to improve the enterprise risk posture. The review shall cover the following risks: compliance, legal, legislative, operational, political, reporting, reputational, and strategic. Credit program, cyber information security, and financial risks have been excluded, as the program has no loan or loan guarantee programs, cybersecurity is a NIST responsibility, and, as noted in the background section, NIST MEP has an on-going effort regarding financial risks.

4. REQUIREMENTS AND TASKS

As a follow-up to the re-competition and the reorganization, NIST MEP requires a contractor with expertise in Federal enterprise risk management to assess the adequacy of the current state of the MEP

Program Office’s risk management, develop an actionable framework for the Program Office’s risk assessment, and assist in providing additional reviews, plans, and protocols to aid NIST MEP in evaluating, on an on-going basis, its enterprise risk management strategies and plans, and making substantive improvements in them.

TASK 1: PROJECT MANAGEMENT

The Contractor shall develop and maintain the following for the life of the contract:

Task 1.1: A comprehensive Project Management Plan. The Project Management Plan shall define how the Contractor shall apply its project management methodology to achieve maximum benefit for NIST.

Task 1.2: A Project Schedule that includes the following: task tracking, resources, planned start date, revised start date, actual start date, planned end date, revised end date, actual end date, percent complete, and task dependencies. The Project Schedule shall include all major tasks that will be required to complete the project including activities to be performed. The NIST Program Manager/Contracting

Officer Representative (COR) will review and approve the baseline Project Schedule.

Task 1.3: An initial Human Resource Management Plan. The Human Resource Management Plan shall include an organization chart showing how the Contractor proposes to staff the project. The Human

Resource Management Plan shall name key Contractor personnel and clearly describe all resource requirements (all personnel including, but not limited to title, function, etc.), roles, and responsibilities.

Task 1.4: A Risk Management Plan. The Plan shall include the Contractor’s approach to managing risk as well as describe the Contractor’s understanding of risk management. A risk register shall be updated on an ongoing basis and shall include: all project-related risks, initial risk prioritization (urgency), and potential risk impacts (each risk), risk responses (each risk), risk mitigation strategy (each risk) as well as risk mitigation / assignments (the Contractor staff member responsible for the mitigation / response to each specific risk).

Task 1.5: A project planning meeting will be held to discuss the deliverables and revise the Project

Management and related plans based on direction from NIST MEP management at the meeting.

TASK 2: NIST MEP ENTERPRISE RISK MANAGEMENT FRAMEWORK

Task 2.1: The contractor shall develop an actionable framework for the NIST MEP Program Office’s risk assessment on an on-going basis. The framework shall include and describe all risk types relevant to the

Program and describe how it impacts the Program. The framework shall be readily updateable as current risks are addressed and new risk assessments are completed.

Task 2.2: The contractor shall develop a Final Framework to incorporate all updates and feedback encountered or provided throughout this contract.

TASK 3: NIST MEP PROGRAMMATIC RISK EVALUATION AND RECOMMENDATIONS

Task 3.1: The contractor shall review the progress the MEP Program Office has made on the eight (8) recommendations specifically for the Program Office contained in “Programmatic Evaluation and

Recommendations Report, Version 1.0” and provide new prioritized recommendations for what areas and/or subareas the program should focus. The document will be shared only after an awardee is selected since it contains business confidential information.

Task 3.2: The contractor shall conduct interviews of NIST MEP staff including MEP senior management and other NIST officials central to the enterprise risk management process. MEP will provide a list of

MEP staff to interview, including Division Chiefs, Regional Managers, Federal Program Officers (FPOs), and other stakeholders.

Task 3.3: The contractor shall review current procedures and processes. MEP will provide the current procedures and processes to the extent that they are documented . Evaluate sufficiency of A-123 enterprise risk management requirements and the “Playbook: Enterprise Risk Management for the U.S.

Federal Government” as compared to the current state of NIST MEP’s risk management strategies and practices.

Task 3.4: The contractor shall provide recommendations and plans with respect to Task 3.3 for improvement of NIST MEP’s risk management approach. Recommendations shall be provided via a written report and the contractor shall brief NIST MEP officials via a formal presentation. The contractor shall review and address internal risk management areas.

5. DELIVERABLES AND DELIVERY SCHEDULE:

5.1 PROJECT MANAGEMENT DELIVERABLES

1.1 Comprehensive Project Management Plan within 30 calendar days of contract award.

1.2 Project Schedule within 30 calendar days after contract award and provided thereafter to the NIST

Program Manager at weekly status meetings and with the Contractor’s monthly report.

1.3 Initial Human Resource Management Plan within 30 calendar days after contract award.

1.4 Risk Management Plan within 30 calendar days after contract award, and updated as needed throughout the life of the contract.

1.5 Project planning meeting within 45 calendar days after contract award.

5.2 ENTERPRISE RISK MANAGEMENT FRAMEWORK DELIVERABLES

2.1 Draft Framework within 60 calendar days after contract award. NIST MEP will provide feedback for contractor to include in the final framework.

2.2 Final Framework within 90 calendar days after contract award.

5.3 PROGRAMMATIC RISK EVALUATION AND RECOMMENDATION DELIVERABLES

3.3 Draft Report on NIST MEP’s current enterprise risk management plans and processes in all relevant categories - compliance, legal, legislative, operational, political, reporting, reputational, and strategic – and sufficiency of those plans and processes with respect to A-123 within 180 days of contract award.

3.3 Final Report on NIST MEP’s current enterprise risk management plans and processes in all relevant categories - compliance, legal, legislative, operational, political, reporting, reputational, and strategic – and sufficiency of those plans and processes with respect to A-123 within 210 days of contract award.

Final report should include any changes/modifications as a result of the government’s review of the Draft

Report.

3.4 Draft Recommendations for improvement of NIST MEP’s enterprise risk management approach within 240 days of contract award. Recommendations should be actionable and specific. Plans, Standard

Operating Procedures, or action lists needed to implement the recommendations shall be included.

Recommendations shall be provided in both written form and in a presentation to NIST MEP senior management.

3.4 Final Recommendations for improvement of NIST MEP’s enterprise risk management approach within 270 days of contract award. Final recommendations shall be provided in written form.

5.4 DELIVERY SCHEDULE

Task Deliverable(s) Deliverable Due Date /

Expected Completion Date

1.1 Comprehensive Project Management Plan Not later than 30 Days from Award

1.2 Project Schedule Not later than 30 Days from Award

1.3 Initial Human Resource Management Plan Not later than 30 Days from Award

1.4 Risk Management Plan Not later than 30 Days from Award

1.5 Project Planning (Post Award) Meeting Not later than 45 Days from Award

2.1 Draft Enterprise Risk Management Framework Not Later than 60 Days from Award

2.2 Final Enterprise Risk Management Framework Not later than 90 Days from Award

3.3 Draft Current State Report Not later than 180 Days from Award

3.3 Final Current State Report Not later than 210 Days from Award

3.4 Draft Recommendations Not later than 240 Days from Award

3.4 Final Recommendations Not later than 270 Days from Award

NOTICE REGARDING LATE DELIVERY

The contractor shall notify the COR, as soon as it becomes apparent to the contractor, that a scheduled delivery will be late. The contractor shall include in the notification the rationale for late delivery, the expected date for the delivery and the project impact of the late delivery. The COR will review the new schedule and provide guidance to the contractor. Such notification in no way limits the Government's right to any and all rights and remedies up to and including termination.

6. PLACE OF PERFORMANCE

The place of performance is a combination of the contractor’s facility the NIST MEP Office in

Gaithersburg, MD to collect and process information necessary to complete the tasks and deliverables listed above.

7. PERIOD OF PERFORMANCE

The period of performance of this contract shall consist of 270 days after award.

8. GOVERNMENT-FURNISHED PROPERTY, DATA AND/OR INFORMATION

The contractor shall provide all services, personnel, facilities, equipment, and materials necessary to perform the required work.

All material (including but not limited to NIST MEP center cooperative agreement and policy documentation) provided by the Government in the performance of this task remains the property of the

Government and shall be surrendered to the government upon completion or termination of this requirement.

The contractor is responsible for maintaining the confidentially of all data and information accessed by the Contractor in conjunction with this scope of work.

9. TRAVEL

Travel shall be required to NIST MEP in Gaithersburg, MD, and will be reimbursed in accordance with the Federal Travel Regulation (FTR). It is expected that all travel costs required for completion of this work will be no more than $10,000. Therefore, the travel budget for the contractor is

$10,000. The contractor shall not exceed this amount in travel costs.

10. PAYMENT SCHEDULE

The Contractor shall invoice the Government upon receipt from the COR that a given deliverable is of acceptable quality and that all other assigned tasks are up to date.