Sol_140A1621Q0095_Amd_0001.pdf

(x)

140A1621Q0095 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

A16

Reston VA 20191 Contracting Office 12220 Sunrise Valley Drive

BIA CENTRAL 00016

08/03/20210001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

07/30/2021

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to re-attach the PWS.

Period of Performance: 09/16/2021 to 09/15/2022

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Nancy Shah

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

This Document Contains Controlled Unclassified Information (CUI)

Version 1.0

20 July 2021

Financial Assistance and Social Services —

Case Management System

(FASS-CMS Cloud)

Technical Support, Operational Helpdesk

Support Services, and Engineering Support

Performance Work Statement

U.S. Department of the Interior Indian Affairs

Office of Indian Services, Division of Human Services

Technical Support, Operational Helpdesk Support Services, and Engineering Support

Office of Information Management Technology i

Table of Contents

Revision History .......................................................................................... Error! Bookmark not defined.

1.0 EXECUTIVE SUMMARY ............................................................... Error! Bookmark not defined.

Stakeholders ............................................................................. Error! Bookmark not defined.

2.0 SCOPE ............................................................................................... Error! Bookmark not defined.

Service Definition ..................................................................... Error! Bookmark not defined.

Security Compliance

Government Task Lead

Key Personnel Qualifications ................................................... Error! Bookmark not defined.

Deliverable Requirements ........................................................ Error! Bookmark not defined.

3.0 REQUIREMENTS AND ASSUMPTIONS ...................................... Error! Bookmark not defined.

SERVICE ASSUMPTIONS ..................................................... Error! Bookmark not defined.

4.0 OUT OF SCOPE ............................................................................... Error! Bookmark not defined.

5.0 SUPPORT ......................................................................................... Error! Bookmark not defined.

Specific Support Tasks ............................................................. Error! Bookmark not defined.

Tier Support

Severity Levels and Incident Management

Incident Response

Emergency/After Hours Support .............................................. Error! Bookmark not defined.

5.5.1 Emergency Tasks ........................................................ Error! Bookmark not defined.

5.5.2 Compensatory Time During Emergencies .................. Error! Bookmark not defined.

5.5.3 Overtime During Emergencies .................................... Error! Bookmark not defined.

5.5.4 Requirements and Conditions for OT During Emergencies ...... Error! Bookmark not defined.

5.5.5 Limitations .................................................................. Error! Bookmark not defined.

After Hours Support Tasks ....................................................... Error! Bookmark not defined.

5.6.1 Compensatory Time for Afterhours Support ............... Error! Bookmark not defined.

5.6.2 Overtime for Afterhours Support ................................ Error! Bookmark not defined.

5.6.3 Requirements and Conditions for OT During Afterhours Support .. Error! Bookmark not defined.

5.6.4 Limitations .................................................................. Error! Bookmark not defined.

Service Maintenance

System Recovery

System Change Management Procedures

Definitions of TIER support

Abbreviations and Acronyms

OIS, Division of Human Services ii

List of Tables

Table 1: Sample Hours of Operation ......................................................... Error! Bookmark not defined.

Table 2: Service Center Tier Structure

Table 3: Severity Levels and Priority Ratings

Table 4: Service Request Timeframes

Table 5: Service Exceptions

Table 6: Service Maintenance

Table 7: System Backup Schedule

Office of Information Management Technology 1

1.0 General

This is a non-personnel services contract to provide IT Help Desk Services. to the Department of the

Interior, Bureau of Indian Affairs (BIA), Office of Indian Services (OIS), Division of Human Services

(DHS). The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the

Contractor who, in turn is responsible to the Government.

2.0 Background

The BIA OIS mission is to facilitate support for tribal people and tribal governments by promoting safe and quality living environments, strong communities, self-sufficient and individual rights, while enhancing protection of the lives, prosperity and well-being of American Indians and Alaska Natives.

Under the OIS, there are five divisions including the DHS. The mission of DHS is to promote the safety, financial security and social health of Indian communities and individual Indian people. The DHS consists of direct funding and activities related to social services, welfare assistance, Indian child welfare, and program oversight. The objective of this activity is to improve the quality of life for individual

Indians that live on or near Indian reservations and to protect the children, elderly and disabled from abuse and neglect. The activity also provides child abuse and neglect services and protective services to

Individual Indian Monies (IIM) supervised account holders who are minors, adults in need of assistance, adults under legal disability, and adults found to be non-compos mentis.

The Indian Affairs’ (IA) FASS programs is intended to provide assistance when comparable financial assistance or social services is not available or is not provided by state, tribal, county, local, or other federal agencies. The program is a secondary or residual resource to other local, state, or federal assistance programs, and cannot be used to supplant or supplement those programs. Ultimately, recipients of the IA FASS program are those most in need in Indian Country.

3.0 Objectives

This effort includes daily operations of FASS-CMS Cloud and restoration of service in the event of scheduled or unscheduled outages. The following tasks and services are required:

1. Help Desk Support & Services

2. End-User Account Administration and Services

3. Technical Engineering Support, Software Development and Maintenance

4.0 Period of Performance: 16 Sep 2021-15 Sep 2022 with 4 option years.

4.1 Type of Contract: Firm Fixed Price

4.2 Place of Performance:

Support is required in both urban and rural areas. The Contractors place will be at their designated location and is authorized to work remotely to provide support. Support at sites other than the places of performance will be considered travel and will be subject to the terms of the contract. All Contractor support activities throughout this SOW must be performed in full support of Systems located at all Assistant Secretary-Indian Affairs, BIA, and Bureau of Indian Education sites, and also for those Systems that are “cloud” based or hosted. The Contractor must also fully support “cloud-first” initiatives as they pertain to all IA Systems. The Contractor must support

Systems moving to and from the “cloud” hosted providers.

4.3 Government Furnished Items or Services:

The Government will provide government furnished equipment (GFE) in support of this contract.

This includes a computer and PIV Card. The government will also provide services in support of the GFE to the contractor. The contractor will be required to travel to the closest BIA location to

OIS, Division of Human Services 2 receive IT support on GFE, if any IT related issues on the GFE cannot first be addressed remotely. Federal Acquisition Regulations, Part 45 will apply to all GFE provided to the

Contractor. The government will provide the Contractor access to IA’s Service Manager

Helpdesk Ticketing System.

4.4 Contractor Furnished Items or Services:

The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this contract that are not listed under Section 4.3.

5.0 Scope

Help desk services are required for the FASS-CMS Cloud, which is an automated social service case management system to serve the BIA, OIS, DHS social service workers, management, and tribal users.

The system is provided as a Software-as-a-Service (SaaS) application, hosted in the Microsoft

Government Community Cloud (GCC), which is FedRAMP-approved and FISMA moderate. This architecture supports the DOI’s direction to move to cloud computing technologies.

There are approximately 175 users who access the FASS-CMS Cloud system. Users are in all twelve

BIA regions throughout the United States. The FASS-CMS Cloud application uses Microsoft Dynamics

365 (D365), which has been configured and customized to meet the business needs of OIS, DHS.

The current version of FASS-CMS Cloud was implemented in 2018. It replaced an on-premises version of the system that was implemented in 2011. May 2018 is when the on-premises versions of FASS-CMS

Cloud and SharePoint were upgraded and migrated to the cloud. All instances of the word System in this document refer to the following IT System or service: Financial Assistance and Social Services – Case

Management System (FASS-CMS Cloud).

The new cloud version was designed to better meet the goals of the IA FASS program. It was intended to improve the case worker’s productivity and decision-making process, by providing more complete case information and conforming to the case worker’s workflow, while enabling better resource management.

The FASS-CMS Cloud’s process flows are built based on federal laws and regulations, as well as direct-social services practices in the field. The FASS-CMS Cloud automates the application process, ensuring compliance with eligibility criteria, automates case workflow, providing adequate tracking and records management, supports the financial payments to eligible Indian clientele and third-party vendors; and provides adequate management reporting for performances and compliance management. It is a comprehensive social services case management system for BIA Agency Direct Social Services locations.

In addition, the number of D365 end-user licenses that have been purchased will support a growing user base.

FASS-CMS Cloud is a menu-driven application that contains financial, budgetary, and statistical data, which is used to request Treasury checks for eligible individual Indians, and to maintain individual files for authorized tracking and reporting purposes. Approximately 25-30% of the total assistance payments—an estimated $26 million out of a total of $86 million—are made through this system. The system is also used to generate correspondence and expenditure reports, and to track historical case information. System users include IA staff and tribal users. The individual Indian recipients of financial assistance payments are FASS-CMS Cloud stakeholders.

The system provides the following features and functionality:

• FedRAMP cloud-based system – FASS-CMS Cloud is FedRAMP compliant. FedRAMP is a unique government program that is at the epicenter of cloud technology, cybersecurity, and risk management. FedRAMP provides a standardized framework to security assessment, authorization, and continuous monitoring for cloud products and services. This framework uses a

“do once, use many times” approach that saves an estimated 30-40% of government authorization https://acquisition.gov/far/current/html/FARTOCP45.html

OIS, Division of Human Services 3 costs, by reducing both time and staff required to conduct Agency security assessments. BIA uses

Microsoft government cloud-services.

• Case Type – The BIA’s Financial Assistance and Social Services programs under 25 CFR Part

20 are custom built into FASS-CMS Cloud. This includes the financial components of General

Assistance, Child Assistance, Adult Care Assistance, Burial Assistance and Emergency

Assistance. This includes the non-financial assistance components including Services to Children, Elders and Families, Individual Indian Money (IIM) Accounts, and Indian Child Welfare Act

(ICWA) Notification and Tracking.

• Case File Management - A robust case management system to capture, view, assess, update and monitor activities associated with on-going case management services to eligible clientele. Case records/ files provide an ongoing “picture” of the nature of the BIA’s involvement with children, families and clients and the progress toward achieving outcomes, and the basis of decisions that eventually lead to case closure. The process of record-keeping itself helps to clarify and focus

BIA social services work by providing accountability for the BIA and the caseworkers to the client. FASS-CMS Cloud was designed to create a more efficient process to assess the degree to which policies and procedures are implemented, and other aspects of accountability and quality controls are being met. The outcome to the client is greater accountability and quality of services.

Case records can demonstrate the way in which the caseworker and the individual child and family collaborate to define the purpose of interactions and work, including the goals and outcomes, and serve to evaluate the progress toward them. Case files help organize the caseworker’s thinking about the work. Structured presentation of factual information leads to greater in-depth assessment and treatment planning.

• Child and Family Services Component - The users have the ability to document and track critical information and decision-making pertinent to a case including the intake, alleged perpetrator history, investigation, assessment of the child and family, individualized case plans for the child and caregiver, home visits, out-of-home placements, background check information as required by the Native American Children’s Safety Act of 2016 (NACSA), Pub. L. 114-165, and supervisory case reviews.

• Document Capture and Management – capturing, classifying, retaining, and retrieving documentation pertaining to individual case files and decisions associated with financial assistance and/or services provided. Documentation is stored in SharePoint Online, which is housed in Microsoft’s GCC.

• Regulatory Compliance – System is designed to enforce the rules and regulations that guide the operation of the BIA’s FASS program at 25 CFR Part 20, 23, 63, and 115.

• Payment Processing - Creating, verifying, and tracking payments to recipients who receive financial assistance from DHS FASS. Generates a payment file for financial assistance payments to eligible clientele and third-party vendors through the DOIs, Financial Budgetary Management

System (FBMS) and Treasury. This includes the issuance of Treasury Checks and Electronic

Fund Transfers (EFT).

• Automated Application Forms Processing - Capturing applications for assistance via an electronic form, based on the Office of Management and Budget’s (OMB) approved paper application for FASS for General Assistance, Child Assistance, Adult Care Assistance, Burial

Assistance, Emergency Assistance, Service Only, and Information and Referral Only.

• Tracking and Reporting Data – Collecting data necessary for reporting; child abuse and neglect data, data required in accordance with the Government Performance and Results Act (GPRA) and the Indian Child Protection and Family Violence Prevention Act of 1990, Pub. L. 101-630, tracking cases, payments, performances, and other key data pertaining to DHS FASS.

• Notification and Alerts - Automatically notifying users when certain conditions exist; setting up personal reminders and alerts based on due dates, critical dates, follow up dates, approval notifications, etc.

OIS, Division of Human Services 4

• Search and Retrieval - Searching for and retrieving information based on user-specified criteria, including the ability to query clients, cases, applications, assessments, payments, alleged perpetrator history, and other activities for active and historical information

• Interfacing with an External System - Interfacing with the Financial and Business Management

System (FBMS) for updating payee information in that system and for requesting payments.

• System Administration – Managing and controlling user access to data. User authentication is controlled by DOI/BIA’s Active Directory Federated Services (ADFS) and Azure Active

Directories (AD).

o User Administration – User access is controlled by DOI’s Identity Information System

(IIS) and the FASS-CMS Cloud System Administrator. User requests for access to the system must be approved by the requestor’s supervisor and the FASS-CMS Business

Owner (BO) before access is granted.

o Security Roles – FASS-CMS Cloud has various security roles. Security roles in

Microsoft Dynamics 365 are a matrix of privileges and access levels for the various entities. The table below contains the list of all security roles.

Security Roles

Role Description

BIA – Agency

Case Worker

Allows the user to create and update Contacts, Cases, Applications, Assessments, Case Plans, Client

Placements, Vendors, Vendor Licenses, Purchase of Service Agreements and Payments for all service types, for a specified Region(s) or Agency(s).

Allows the user to create and update IIM Accounts, Distribution Plans, IIM Reviews, and Distribution

Plan Tracker records.

BIA – 638

Encoder

Allows the user to perform all the Agency Case Worker functions, PLUS:

Create 638 Payments

BIA – Agency

Reader

Allows the user to view information about almost any entity in the system. For some entities, the user is restricted to viewing only information about a particular Region(s) or Agency(s). This role cannot create or update any information in the system.

BIA – Agency

Supervisor

Allows the user to perform all the Agency Case Worker functions and also screen in or screen out Intakes for child and adult protection.

For some entities the supervisor can view or use records for all Regions / Agencies rather than being restricted to a particular Region / Agency.

BIA – BLO

Allows the user to perform all the Agency Case Worker functions, PLUS:

Create GA rates using the State Temporary Assistance for Needy Families Tables issued by each State

Approve Payments

Approve Purchase of Service Agreements

BIA – FASS-

CMS

Administrator

Allows the user to create and update records for all entities in the system for all Regions / Agencies.

BIA – ICWA

Worker

Allows the user to create and update ICWA children, requesters, and notices, and generate ICWA letters for any Region.

Allows the user to create and update Tribe Affiliations and to update information about existing Federally

Recognized Tribes

BIA – Regional

Social Worker

Allows the user to perform all the Agency Case Worker and 638 Encoder functions, PLUS:

Create and update Budgets for specific Region(s)

Create and update Allocations for specific Region(s)

Create and update Child Care, Adult Care, and General Assistance rates

Create and update Tribe Affiliations and update information about existing Federally Recognized Tribes

System Flow/Processing

User Access/Data Flow

FASS-CMS Cloud users access the Microsoft Dynamics cloud application (CRMOL-G) via government-provided equipment, directly from within the IA domain or through the public internet using standard

HTTPS protocols on Port 443. Regardless of the entry point into the application, the system requires that

OIS, Division of Human Services 5 users authenticate their identity by using their DOI IA Personal Identity Verification (PIV) card. PIV card authentication is tied to the user’s domain credentials as registered in the DOI IA Active Directory

(DOI IA AD) Service. Access to the DOI IA AD is provided by Active Directory Federated Services

(ADFS), which is enabled by a DOI authorized extension (ADFS) of the DOI Domain and the Microsoft

Azure AD services.

All access to FASS-CMS Cloud must be requested using the DOI’s Identity Information System (IIS).

The end user initiates an IIS request for new or modified access to FASS-CMS Cloud. The request must then be approved by the user’s supervisor and the FASS-CMS Cloud Business Owner (BO). For new users, the M365 Global Administration then assigns a D365 license to the user and adds the user to the

Azure AD groups for the FASS-CMS Cloud Development and Production environments. Likewise, the

Active Directory System Administrator adds the user to the Development and Production AD groups for the ADFS. After these steps have been completed, the FASS-CMS Cloud System Administrator assigns the user to the approved Agency/Region role-based teams within the FASS-CMS Cloud.

Application Administrator (System Administrator) Access Data Flow

There are three groups involved in managing FASS-CMS:

• The Microsoft Dynamics cloud team has primary responsibility for administering D365, the base system upon which FASS-CMS Cloud is built.

• The DOI’s Microsoft 365 (M365) Global Administrators are responsible for adding and removing users and assigning user licenses.

• FASS-CMS Cloud System Administrators manage user roles, configure forms, views, and reports, and deploy modifications to the various system environments.

There is also a cloud-only system account (CRM Test2) that is generated when the D365 Organization is created. Only FASS-CMS System Administrators are authorized to use this account. This account is not documented in IIS. It is used in two ways:

1. As a service account that runs all workflows and plug-in code during execution; this includes the daily batch processes.

2. As a development account for modifying the system.

FBMS Data Transfer

Each day, there are two file transfers that occur nightly between FASS-CMS Cloud and the Department of the Interior’s Financial Budgetary Management System (FBMS), which resides at the ADC. The files contain new and updated payee (aka vendor) information and requests for payments to clients and vendors.

A web service running at the ADC queries FASS-CMS Cloud via Application Program Interface (API) calls, and then generates the files on a Secure FTP (SFTP) client services. The DOI Data Exchange moves the files from the SFTP to FBMS. After FBMS processes the records, it sends files back to FASS-

CMS Cloud, which contain acknowledgement records and/or error messages.

Outgoing FTP transfer

A flat file is transmitted using HTTPS protocol, Port 443 to a DOI IA hosted domain member server running a secure FTP client, Port 22 for subsequent nightly data transfer to the FBMS environment.

Incoming FTP transfer

Incoming data from the FBMS server is received via a domain member server hosted in the DOI IA domain and then passed to FASS-CMS Cloud via HTTPS protocol, Port 443.

OIS, Division of Human Services 6

System Authorization Boundary Components Function

FASS-CMS SharePoint 2016 Server - FASS- CMS SharePoint web front end interface and document archiving for legacy files.

FASS-CMS Member Server with Smart FTP Client to move data from the FASS-CMS system to the FBMS system.

MSCRM-addons Documents CorePack (DCP) - interfaces with FASS-CMS as a tool to create letters and documents.

6.0 Specific Tasks

Task 1: Help Desk Support & Services

The Contractor’s general role and responsibilities associated with providing Helpdesk Support and

Services includes:

• Serving as the single point of contact on FASS-CMS Cloud Help Desk Tickets opened by FASS-

CMS Cloud end-users.

• Providing Tier 2 and Tier 3 FASS-CMS Cloud support services for all trouble tickets regarding

FASS-CMS Cloud function and use (Reference Appendix A).

• Serve as a liaison on Tier IV tickets to internal and external partners. For example, with

Microsoft Cloud-Services and the Department of the Interior, Office of the Chief Information

Officer, Enterprise Services Division to help coordinate FASS-CMS Cloud system resolution issues, on an as needed-basis.

• Receiving, coordinating, documenting, tracking, troubleshooting, and managing all FASS-CMS

Cloud end-user service requests, inquiries and problem notification. This includes logging and documenting all service requests and problem identification using the BIA’s Service Manager

(Helpdesk Ticket Management system).

• Providing end-to-end problem identification, categorize/prioritization, escalation, and resolution for all FASS-CMS Cloud service requests. This includes providing a written response via email to the FASS-CMS Cloud end-user before closing a ticket.

• Managing the Root Cause Analysis process on recurring Service Incidents

• Providing additional support to communicate planned and unplanned events including issuing broadcasts or other notices to FASS-CMS Cloud end-users in coordination with the OIS, DHS.

• Providing a report bi-annually to the OIS, Division of Human Services related to FASS-CMS

Cloud Helpdesk metrics and recommendations to improve service delivery and reduce ticket volume (i.e. additional end-user training, self-help opportunities for end-users, Root Cause

Analysis, etc.).

• Maintaining normal office hours and staffing as required by the government and in accordance with Table 1 – which outlines the hours of operational support needed. If a Helpdesk Support request is initiated during regular support hours, no lead-time may be provided.

• After hours support outside of Table 1 must be approved first by the designated government representative and will be on a case-by-case basis.

• Performing helpdesk center capacity monitoring and planning which is defined as monitoring and maintaining appropriate staffing levels for anticipated and planned call volumes.

• Provide user support for configuration and administration of specialized technologies as identified by the government.

• All calls, faxes, and emails shall be documented in the BIA’s Service Manager. Problems shall be resolved to the Customers’ satisfaction as indicated on Closing of Tickets procedures. The

Contractor shall keep the user informed during the troubleshooting and resolution period until the ticket is closed.

OIS, Division of Human Services 7

• For Monitor Problem Notifications, the Contractor shall review and monitor all network status messaging systems and software in place to determine current System and network statuses. The

Contractor shall maintain awareness of all reported issues that can potentially affect FASS-CMS

Cloud. Notification concerning Systems and software will include Service Manager, voicemail, email status reports, intranet, and other means of Customer notification.

• The Contractor shall determine and document the scope, impact, and urgency of the problem based on documentation. The Contractor shall comply with Service Manager Severity levels and response times. The Contractor shall apply temporary fixes where appropriate while permanent solutions are developed. For Service Manager Incident tickets closed on initial call, the

Contractor shall review the original problem description and resolution to ensure they appropriately match. If the Customer reported the original problem incorrectly, the problem description shall be changed to match the resolution. The Contractor shall communicate to the

Customer the direction the resolution efforts are going, and also give the Customer the Service

Manager ticket number to allow them to follow up on any progress made.

• For the Remote Configuration and Administration, the Contractor shall use Government furnished software to provide remote assistance, troubleshooting, and problem resolution for desktop computers, network attached storage, network printers, and other devices where remote assistance through the IA network is possible.

• The Contractor shall work toward resolution of all Service Manager Incident tickets opened in their queue, and, within their scope, to achieve Customer satisfaction. When required, the

Contractor shall coordinate efforts with other IA Government offices to resolve the problem promptly. If it is determined to be another IA Government office’s responsibility, the Contractor shall notify that office of the problem and assign the ticket to that specific entity. The Contractor shall determine that entity’s information requirements and shall ensure that all necessary information is documented in the Service Manager ticket.

• The Contractor shall follow up with Customers, vendors, or IA components, as required, to resolve problems. The Contractor shall update Service Manager Incident tickets any time with the following: (a) resolution efforts that have been taken; (b) a change in the status or impact of the problem has occurred; (c) any contact with a Customer, vendor, or IA component has been made;

or (d) as regulated by the priority of the ticket or service target date and accompanying text description. Customer contacts and follow-up shall be provided as negotiated with the Customer.

The frequency of updates and follow-ups, based on the priority of the ticket, are listed. The

Contractor shall document and maintain an audit trail of the complete problem resolution.

• The Contractor shall update and close appropriate Service Manager Incident tickets. All steps taken to resolve the issue must be completely documented in the ticket. The Contractor shall review the original problem description and resolution to ensure they match. If the Customer reported the original problem incorrectly, the problem description shall be changed to match the resolution.

• The Contractor shall open a Master Problem ticket and associate all related problems to this ticket when multiple problem reports related to the same failure are received. The Contractor shall document the call and log all necessary information into Service Manager. The Contractor shall open a Master Problem ticket at the request of another IA component who is informing the OIMT of a distributed client/server or telecommunication problem trend. The Contractor shall associate all new related tickets to this Master Problem ticket based on criteria identified by the IA component.

• The Contractor shall continue to follow up on the progress of Service Manager incident tickets opened by the Contractor but assigned to another component for resolution. The Contractor shall monitor their progress and escalate any lack of service, repeatedly missed required ticket updates, or other service delivery issues, to the Government Service Center Task Leader to ensure

Customer satisfaction.

OIS, Division of Human Services 8

• The Contractor shall coordinate, when directed, formal, and informal meetings and consultations among IA components, third party vendors, and management to address unresolved complex problems, overlapping component ownership, and trends involving service delivery issues.

• The Contractor shall follow current and newly developed specialized procedures based on problem types, urgency, and priority. Such procedures will often require special notifications, reports, and paging on escalation or transfer. For each problem report, the Contractor shall determine whether a specialized procedure is indicated or not. If so, the Contractor shall follow

IA’s established specialized procedures.

• For high impact-high urgency issues, the Contractor shall prepare a report detailing all open high impact-high urgency issues encountered up to the time of the report creation and submit it to government task lead within 24 hours of its identification. The Contractor will make reasonable efforts to ensure the government task lead is made aware of the high impact-high urgency issues by telephone or email within 2 hours of the incident identification.

• The Contractor shall provide Tier 2 and Tier 3 application-specific Service Center support to assist users in the functionality and use of the applications. Application support shall include (but not be limited to) commercial software and IA-specific hardware and software.

• Customer Satisfaction Surveys should be made available to end-users on all open-tickets, through the use of automated means.

• The Contractor shall compile the Customer satisfaction survey results and submit them to the

Government Task Leader for review, comments, and approval, bi-annually.

• The Contractor shall document any Customer complaints received by phone or email regarding undelivered services from the Contractor, vendors, and IA Components within 24 hours of the complaint. The Contractor shall include a list of customer complaints to the Government Service

Center Manager during the bi-annual report.

• The Contractor shall provide problem analysis and statistical reports as required by IA to include statistics on new Systems deployed, aging equipment, and general call/problem statistics and trending. The Contractor shall identify and deliver new reports required to analyze trends affecting call intake volume or problem resolution performance.

• The Contractor will open tickets daily 100% of the time using the IA Service Center ticketing system. All tickets will be opened and managed according to the Service Center SOP and IA service delivery standards.

• Support will be available from 7:00 a.m. Eastern Standard Time (EDT) to 8:00 p.m. EDT (13

Hours), Monday through Friday, excluding Federal holidays. The Contractor will be responsible for accessing the IA Service Center to respond to all FASS-CMS Service Center tickets that require Tier 2 and Tier 3 support during aforementioned Service Center hours. However, the

System application will be available to users during the defined availability hours, Monday through Sunday, excluding scheduled maintenance and the time required to accomplish weekly

System backups. Hours of operational support are detailed in Error! Reference source not found..

Table 1: Hours of Operational Support

Date Application On-line Availability

Monday–Friday 7:00 a.m. – 8:00 p.m. a

Saturday Noneb

Sunday Noneb

Federal Holidays Noneb

a. Support hours are defined by EDT. This means that desktop support is available starting at 7:00 a.m. EDT and ends at 8:00 P.M. EDT.

OIS, Division of Human Services 9

b. Except for the noted maintenance times, the application will be available 24 hours a day. However, should an issue arise, and the application becomes unavailable, the issue will be addressed immediately during the Monday through

Friday support coverage.

At the outset, services will be provided to internal IA system users and agreed Tribal users, external offices, and additional parties at the discretion of the Government.

Task 2: End-User Account Administration and Services

The Contractor will support user account maintenance of FASS-CMS Cloud. The Contractor’s role and responsibilities associated with providing FASS-CMS Cloud End-User Account Administration and

Services includes:

• Performing and coordinating employee end-user account administration such as creating, changing and de-activating FASS-CMS Cloud user accounts in accordance with the BIA’s

Security Policies.

• Receiving and tracking Service Requests for End-User account activation, changes and terminations/ de-activations. Tickets will be assigned for creating new, modifying, and suspending accounts within FASS/CMS Cloud.

• Working with and assisting OIS with annual audit review of FASS-CMS user accounts to ensure

100% compliance of end-user accounts between FASS-CMS Cloud and the BIA’s Identity

Information System (IIS), bi-annually or as requested by the BIA Security Office.

• Working with the COR & OIS, DHS to review and document requirements and policy changes, regarding End-User Administration in FASS-CMS Cloud, as needed.

• Coordinate as necessary with other BIA offices to manage end-user accounts.

Task 3: Technical Engineering Support, Software Development and Maintenance

The contractor shall provide support services from qualified and experienced personnel to support the planning, analysis, design, engineering, development, programming and maintenance of web and system software applications and database projects. FASS-CMS Cloud is a mature system that will not require major code development. The contractor shall provide software maintenance, technical support, minor upgrades for the ongoing operations of FASS-CMS Cloud.

Specific tasks include, but are not limited to:

• Tracking all system enhancement requests by FASS-CMS Cloud end-users in the BIA Service-

Manager System.

• Developing and releasing minor system enhancements to improve usability, correct minor defects, or address specific problems identified within the FASS-CMS Cloud.

• Aiding and technical expertise to OIS to help address open security concerns on FASS-CMS

Cloud Plans of Action & Milestone Report (POA&Ms), annually.

o Any defects or POA&Ms requiring major code development would be addressed in a new Task Order.

• Coordinating with FASS-CMS Cloud end-users and quality testers during acceptance testing.

• Administration of the underlying databases used by the system.

• Maintaining a mirror system that is used for demos, user training, and other presentations.

• Identifying, diagnosing, and rectifying any issues in the FASS-CMS Cloud hardware, software, services, and applications. This includes coordinating with BIA, OIS, DHS, OIMT, DOI Federated Services, and Microsoft, i.e. deprecation of software/hardware, and the migration to new versions.

• Providing technical support on key FASS-CMS Cloud deliverables and documents to comply with Departmental requests and security requirements. This includes supporting the OIS, DHS in

OIS, Division of Human Services 10 the preparation and submission of key documents, as requested by OIS, DHS. This includes participating on Ad-Hoc data calls and participating in working sessions to meet internal deadlines as requested and specified by OIS, DHS and the IA, Office of Information Management

Technology. This includes but is not limited to the following documents/tasks:

a. FIPS 199

b. CSAM System Description

c. CSAM Technical Description

d. CSAM Hardware and Software Inventory

e. CSAM System Security Plan with signatures

f. CSAM Security Assessment Report

g. Incident Response Plan

h. Continuous Monitoring Plan

i. Security Control Assessment

j. Plan of Action & Milestones (POA&M)

k. Privacy Impact Assessment

l. Privacy Plan

m. System of Records Notice

n. Information Collections

o. SSN Use Reduction Planning

p. Check Reduction Initiative to comply with Department of Treasury and DOI mandates

q. Financial Investment Portfolio

r. IIS Account Reconciliation

s. IT Portfolio Reviews

t. Joint Planning Document Issued

u. Departmental Budget Submission (POB), with Exhibit 6F for IT

v. IMT Acquisition Strategic Plan

w. High Level Planning Objectives Memo (HLPO) Issued

x. ACIO/BBO Joint Certification Statements

y. Cyber Security Budget Data Request (BDR)

• Assisting OIS, DHS as needed on updating process guides as needed, to reflect changes or updates in the business processes.

• If major enhancements are needed to the system regarding the FASS-CMS Cloud, the

Government will then work with the CO and Contractor to explore options to address this.

Task 4: Training Support

The Contractor shall provide training to FASS-CMS Cloud end-users to optimize their use and understanding of FASS-CMS Cloud. The Contractor shall:

• Provide FASS-CMS Cloud-specific, role and scenario-based end-user training through an online format of the Contractor’s choice and in agreement with the government, i.e. Zoom, Microsoft

Teams, Google Meet, or Web-ex.

• Training shall be provided minimally twice a year on the following programs areas within the system: General Assistance, Child & Family Services, IIM, ICWA Notices, Burial Assistance, and Payment Reconciliation between FASS-CMS Cloud and FBMS.

• Each Training session will be no longer than 2 hours and shall be recorded.

• The contractor will use existing process guides and training material provided by the government.

Security Compliance

The Contractor shall ensure compliance with Federal, Department of the Interior (DOI), OIMT, and security rules, regulations, and policies. The Contractor shall report suspected computer security breaches to the Computer Incident Response Team, Contracting Officer’s Representative (COR), and the

OIS, Division of Human Services 11

Government task manager as soon as the breach is received, heard of, or found to the OIMT Service

Center. All contract employees are required to take the Federal Information Security Assessment before starting, and annually thereafter. They are required to adhere to all of the laws, regulations, policies, and directives, and the Rules of Behavior defined within.

Government Task Lead

The Government Task Lead for each Functional or Task area defined below works with the COR and will serve as the day-to-day decision-maker, technical lead, and Subject Matter Expert for the Government in the respective technical fields. The Contractor assigned will receive work assignments from the

Government Task Lead and will provide the Government Task Lead with recommendations in regard to work assignments.

Deliverable Requirements

The Contractor shall complete routine deliverables, in a format required by the Government Task Lead, COR, or CO, on an established schedule as requested by the COR or Government Task Lead. Routine deliverables are for items such as:

• Daily/Weekly/Monthly reporting activities.

• Root Cause Analysis reports per event.

• Workflows for all operational processes.

• Operational Procedures for all operational processes.

• Operational Process Improvement Plans for existing processes.

• Meeting and conference call action items.

• Reference Materials used in the creation of all documentation.

• All System Documentation as defined in the DOI System Life Cycle v3.1.

• Ad hoc reporting from OIMT ticketing systems, systems monitoring tools, network monitoring tools, and all operational management systems.

• Integration of operational process workflows, and associated reporting of metrics.

General quality measures, as set forth below, will be applied to each work product received from the

Contractor under this Contract, and all resultant task orders.

• Accuracy – Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity – Work Products shall be clear and concise. All diagrams shall be easy to understand and be relevant to the supporting narrative.

• Consistency to Requirements – All work products must satisfy the requirements of this SOW.

• File Editing – All electronic files shall be editable by the Government using the standard IA software applications.

• Format – Work Products shall be submitted in hard copy (where applicable), and in media mutually agreed upon prior to submission. Hard copy formats shall follow IA specified directives or manuals.

• Timeliness – Work products shall be submitted on or before the due date specified in this SOW or submitted in accordance with a later scheduled date determined by the Government.

Government Responsibilities

• Provide FASS-CMS software and licenses.

• Access the Service using the IA Identify Information System.

• Review the appropriate incident prioritization as outlined in Incident Priority Model section.

• Adhere to advanced scheduling of all planned service-related requests and other planned special services with the Contractor. Timeframe will be determined on level of effort and priority to meet the service level agreement.

OIS, Division of Human Services 12

• Use the OIMT’s Service Center for all service requests and have an associated work ticket created to be deemed a valid request. Any requests made that do not have an associated work ticket are considered invalid and do not require the Contractor to meet the defined service objectives.

• Provide timely availability of the work ticket initiator or designated representative when the

Contractor is resolving a service-related incident or request.

• Designate testers who will participate in testing and accepting security updates, patches, and version updates. The testers can be members of the user group or other representatives identified by the Government. Typically, the Government is required to perform this testing and acceptance monthly, but the Government could be required to perform this function should a critical update be required outside of the monthly update cycle.

• Train all appropriate staff on appropriate System use.

• Provide all annual security requirements, as appropriate, to include the completion of Internal

Control Reviews and Federal Information Security Management Act (FISMA) compliance activities. This includes providing all requested documentation on time.

• Support FISMA compliant Assessment and Authorization (A&A) package development and the

Plan of Action and Milestones (POA&M) to reduce the risk of the vulnerability identified.

Provide proper funding to support A&A and POA&M.

• Support Continuity of Operations testing and planning for all program and business operational activities and issues related to the System. This effort includes providing all requested documentation on time.

• Provide 60-day lead time for all future releases and updates. Exceptions include releases that are correcting defects that may not have been encountered during testing, and releases as a result of upgrades initiated by the Contractor.

• Fund all hosting costs related to the System.

• The Government agrees to pay for software licenses and software maintenance, including additional client licenses above and beyond the current production installations. All Systems and

System dependent software will be paid for by the Government. The payment terms will adhere to the terms of all licensing agreements as managed through the change management office, software asset manager, and software custodian.

Table 2: Service Center Tier Structure

Tiera Area of Support Responsibility

Tier 1 Access issues IA

Tier 2 Technical issues FASS-CMS Contractor

Tier 3 Functional issues FASS-CMS Contractor

Tier 4 Software issues Microsoft aSee Appendix A for definitions of tiers.

Severity Levels

a. Incident—For purposes of this SOW, an incident is defined as an operational or procedural event that is not part of the standard operation of the System. An incident will have an impact on the System, although this may be slight, and may even be transparent to users. An incident may have an effect on a single user’s ability to operate the System. An incident can escalate into a problem when a remedy cannot be determined and/or applied in a short time frame.

b. Problem—For purposes of this SOW, a problem is defined as the underlying cause of one or more incidents, the exact nature of which has not yet been diagnosed. Resolving a System operational

OIS, Division of Human Services 13 problem is broken into two aspects: incident management and problem management. Details are as follows:

Incident Management

The operational process focusing on restoring the System as soon as possible. The Government’s objective is to have the least possible service disturbance. In the case of a service disturbance, no matter the cause, normal service levels must be restored as quickly as possible in order to allow the Government to continue normal work activities.