Attachment_A_-_Performance_Work_Statement.docx

140R8119Q0109 Attachment A: Performance Work Statement 01/28/2019 Attachment A: Performance Work Statement

1. Information Technology (IT) Requirements

Specific IT Requirements will be defined at the Task Order level. All software licenses and upgradesshall be fully compatible with Active Directory (AD), Lightweight Directory Access Protocol (LDAP), Security Assertion Markup Language (SAML), and support the Department policies governing Federal Identity, Credential, and Access Management (FICAM) policies. FICAM specific guidance and polices will be provided at the Task Order level.

The Contractor shall support the Bureau of Reclamation’s eDRAWS IT solution with labor categories for system configuration and upgrade projects., .

The Government understands that the addition of other supported sites could affect the architectural IT design and could require added software or hardware resources and components. In this case the Contractor will work with the Government in all planning and execution phases.

2. Service Support. Vendors/Offerors must be BlueCielo approved solution partners.

Professional services and support activities may include, but are not limited to;

· Supporting the Bureau of Reclamation help desk in creating user accounts

· Supporting the Bureau of Reclamation help desk in modifying user accounts

· Providing solutions and guidance to Government staff on system issues submitted through trouble tickets or e-mail requests for help

· Provide and Install software patches and system upgrades.

3. Data Requirements

All data/metadata is Government owned information and the property of the U.S. Government and must be made available in an exportable format (prevailing technology). The Government will have the right to remove any and all data within sixty (60) calendar days of the Government's written notice to the contractor. The contractor will provide technical support and work with the Government to define an exportable format for compatibility and acceptability to a new platform. No invoices shall be paid until the exportable format is received and accepted by the Government. The data/metadata is to be provided at no cost to the Government; however, if this is an incorrect assumption, the contractor MUST provide a price in the price quote as an OPTION LINE ITEM to be evaluated, otherwise, all data/metadata which is Government -owned information and the property of the U.S. Government must be made available in an exportable format (prevailing technologies) to the Government within forty-five (45) calendar days of the Government’s written request and will be at no additional cost to the Government.

The Government shall have the right to modify, adapt, or combine the eDRAWS or data/metadata with other computer software and create derivative works in the Saas.

The Government shall have the right in working with the Offer to have other software hosted within the Saas environment with the understanding that additional hosting costs could be applied.

The contractor must indefinitely maintain backups of all records (including backups of alterations, changes, and deletions). Additionally, these Government records must be accessible and returned to the Department upon request within forty-five (45) calendar days. This is to be at no cost to the Department; however, if this is an incorrect assumption, the contractor MUST provide a price in the price quote as an OPTIONAL LINE ITEM to be evaluated, otherwise, all records (including backups of alterations, changes, and deletions) will be accessible and returned to the Department upon request within forty-five (45) calendar days at no additional cost to the Department.

4. Training Requirements

The Contractor shall provide applicable required training on a Task Order basis to include possible onsite, and remote training.

The Contractor will offer training based on the Task Order procured software, and hardware to include Administrative, Power User, and user training.

The Contractor will work in support of any needed training documentation as required at the Task Order level.

5. IT Security Requirements - The following are the IT Security Requirements for the existing eDRAWS system:

Authority to Operate. The eDRAWS system has undergone an initial security assessment and authorization and has received the Authority to Operate.

Certification and Accreditation (C&A). The contractor will work with Department to complete re-accreditation every year or whenever there is a major change that affects security as determined by the Government system owner. C&A documents will be provided to the COR in both hard copy and electronic forms. The contractor must follow current NIST Special Publications, Federal Information Processing Standards, the associated Department guides/templates, the Department Security Test & Evaluation (ST&E) Guide, and the Department Privacy Impact Assessment. NIST documents are available on the Internet at http://csrc.nist.gov/publications/nistpubs. FIPS documents are available the internet at http://csrc.nist.gov/publications/nistpubs. The contractor may request copies of Department documents by contacting the COR.' Federal Information Security Management Act (FISMA). At all times, the Contractor shall comply with FISMA and 0MB Circular A-130 to the extent applicable. This compliance shall be shown through the completion and the maintaining of a C&A of eDRAWS. The maintenance of the C&A is a requirement of the business relationship between the Department and the Contractor. Continued utilization of the service provided by the contractor shall be dependent upon the completion and maintenance of the C&A. Department will track this using existing internal processes and systems, including the CSAM system.

The Contractor shall perform security assessment and authorization reviews consistent with the Government’s obligations under FISMA requirements and NIST guidance. These obligations are outlined in more detail in NIST Special Publication 800-37. If deemed appropriate by both the Contractor and the Government, the Government’s staff or authorized representatives will, where necessary, execute a mutually agreeable Non-Disclosure Agreement to protect any of the Contractor's trade secrets, sensitive, or proprietary information that may be either intentionally or inadvertently disclosed to the Government during the required review(s).

The contractor shall work with the Government and the Government’s IT Security Office on all security related issues and provide proof of closure of any vulnerability found during the security assessment.

The IT Security Plan and all associated documents in support of the security assessment and authorization will be provided to the COR in both hard copy and electronic forms.

The application must be reauthorized every three years or whenever there is a significant change that affects security as determined by the Government system owner.

The contractor, and the existing eDRAWS system, adhere to current National Institute of Technology Standards (NIST) standards, Federal Information Processing Standards (FIPS), and all applicable IT security regulations, policies and directives, in accordance with current FISMA requirements.

The contractor, and the existing eDRAWS system, must also adhere to current Security Technical Implementation Guide (STIG) process.

6. Support Service Requirements

The contractor shall provide a Support Level Agreement (SLA) for each Task Order.

At a minimum, the Contractor shall provide a common universal technical support web-based platform that encompasses a single SLA to include the following minimal components:

i. Online 24x7x365 support site with:

1. Case Management

2. Case History Management

3. Automated Email Reporting

ii. Frequently Asked Questions:

1. Searching

2. Printing

3. Bookmarking

iii. Patch and full software downloads

Specific components for all individual Bureau implementations will be described at the Task Order level.

7. Deliverable Format - All deliverables must be Section 508 compliant and submitted electronically in PDF searchable format or MS-Word.

8. Labor Categories - The following labor categories, and associated rates, are requested to be provided under this IDIQ. Please see Attachment B and Attachment C.

Labor categories in attachment B will be used for eDRAWS system projects including, but not limited to, software updates, patches, or eDRAWS system upgrades; configuration enhancements including updates, patches, or upgrades to previsouly integrated applications or operating sytems; and future integration and support of additional external software applications. Additional support could include on-site training and/or documentation of the post-project eDRAWS system configuration.

9. Privacy

Use of Personally Identifiable Information (PII). The Contractor shall comply and agree to at all times to protect the Government's information and data in accordance with the terms of this contract. The Contractor shall not use any Personally Identifiable Information, E-mail Groups, Lists, or contract information for any purpose other than those activities necessary to the performance of this contract and any resulting TOs.

Transfer of Personally Identifiable Information (PII). Personal information collected or otherwise processed by the Contractor in the performance of this IDIQ may be transferred to, stored and processed in the United States. The primary locations shall be the primary and back-up data centers located in the United States. In addition, other locations include the location of the Contractor support teams who provide support to the Government support teams in resolving issues involving the eDRAWS system or locations where back up or archiving facilities may be agreed to with the Government or where the antivirus and other security scans are performed.

10. Quality Assurance and Acceptance. A detailed quality assurance surveillance plan will be developed at the Task Order level.

Deliverable Acceptance and Review. Unless otherwise specified, the Government will have a maximum of ten (10) business days from the day the draft deliverable is received to review the document, provide comments back to the Contractor approve or disapprove the deliverable(s). The Contractor will also have a maximum of (10) business days from the day comments are received to incorporate all changes and submit the final deliverable to the Government. All days identified in the Deliverables Schedule are intended to be business days unless otherwise specified.

General Acceptance Criteria. General quality measures, as set forth below, will be applied to each work product received from the Contractor under this performance work statement.

i. Accuracy - Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

ii. Clarity - Work Products shall be clear and concise. Any/All diagrams shall be easy to understand and be relevant to the supporting narrative.

iii. Consistency to Requirements - All work products must satisfy the requirements of this performance work statement.

iv. File Editing - All text and diagrammatic files shall be editable by the Government.

v. Format - Work Products shall be submitted in Microsoft Word and PDF (where applicable).

vi. Timeliness - Work Products shall be submitted on or before the due date specified in this performance work statement or submitted in accordance with a later scheduled date determined by the Government.

Deliverable Quality Assurance. The COR will review, for completeness, preliminary or draft documentation that the Contractor submits, and may return it to the Contractor for correction. Absence of any comments by the COR will not relieve the Contractor of the responsibility for complying with the requirements of this work statement. Final approval and acceptance of documentation required herein shall be by letter of approval and acceptance by COR. The Contractor shall not construe any letter of acknowledgment of receipt material as a waiver of review, or as an acknowledgment that the material is in conformance with this PWS. Any approval given during preparation of the documentation, or approval for shipment shall not guarantee the final acceptance of the completed documentation.

11. Place(s) of Performance. Place of performance will be identified at the Task Order level.

12. Travel. Travel will be identified on the Task Order Level.

13. Orientation Briefing. Within five (5) business days of Task Order awards, the Contractor shall conduct an orientation briefing for the Government. This briefing will be conducted remotely. The intent of the briefing is to initiate the communication process between the Government and the Contractor by introducing key task participants and explaining their roles, reviewing communication ground rules, and assuring a common understanding of subtask requirements and objectives. The Contractor's proposed Project Management Plan shall be presented during the orientation.

14. Contractor Interfaces. The Contractor and/or its subcontractors may be required as part of the performance of this effort to work with other Contractors working for the Government. Such other Contractors shall not direct this Contractor and/or their subcontractors in any manner. Also, the Contractor and/or its subcontractors shall not direct the work of other Contractors in any manner.

15. Payment for Unauthorized Work. No payments will be made for any unauthorized supplies or services or for any unauthorized changes to the work specified in this document. This includes any services performed by the Contractor of its own volition or at the request of an individual other than a duly appointed CO. Only a duly appointed CO is authorized to change the specifications, terms, and conditions under this effort.

16. Contractor Personnel - Roles and Responsibilities. The Contractor shall be responsible for managing and overseeing the activities of all Contractor personnel, as well as any subcontractors used in performance of this effort. The Contractor's management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in the PWS.

17. Security Requirements. The following outlines the minimal security requirements related to the IDIQ and all Task Orders awarded under this IDIQ. Additional security requirements will be defined at the Task Order level.

FERC/NERC. The system shall have the capabilities to provide Federal Energy Regulatory Commission (FERC) / North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection and provide solution architecture design to assure that the critical information is protected according to FERC/NERC requirements.

Security Incident Reporting. Upon becoming aware of any unlawful access to any Government Data stored on Contractor equipment or in Contractor facilities, or unauthorized access to such facilities or equipment resulting in loss, disclosure or alteration of any Government Data (each, a "Security Incident"), the Contractor as applicable will: (i) promptly notify the CO and COR's via email with details of the Security Incident (Security Incident Report); (ii) investigate the Security Incident and provide the Government with detailed information about the Security Incident; and (iii) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

Security Controls. In the development or maintenance of any custom applications, the Contractor shall, with the knowledge and concurrence of the Government system owner, be responsible for Information Technology (IT) security for all non-Government-owned systems used in the development of and systems intended for eventual delivery to the Department in fulfillment of contract requirements. This includes hardware, software, databases, networks, and telecommunications systems. Notwithstanding the provisions of this paragraph, these parties do not anticipate any software development under this agreement and agree that any software development will be subject to a separate agreement.

Clearances for Contractor Personnel. All Contractor employees working on this contract must pass a National Crime Information Center (NCIC) background investigation before working onsite.

Physical Security. The Contractor shall be responsible for safeguarding all Government property provided for Contractor use. At the end of normal duty hours and/or after normal duty hours, all Government facilities, equipment and materials must be secured.

Access to Government Property or Facilities. The Contractor will be allowed limited access to the Government's facilities. In order to maintain a healthy and safe working environment for all employees and to assist in preventing a pandemic, for Contractor employees working at a Government facility, the Government reserves the right to refuse a Contractor employee access to the Government facility if the individual is displaying symptoms of a contagious illness, such as the flu. If such a situation arises, the COR shall communicate the Government's decision regarding the employee to the Project Manager.

Identification of Contractor Employees. Contractor personnel shall be easily recognized as Contractor employees by wearing a security identification badge at all times while on Government premises. When Contractor personnel attend meetings, answer phones, and work in other situations where their status is not obvious to third parties, they must identify themselves as such to avoid creating the impression that they are Government employees.

Section 508 Requirements. Any/all electronic and information technology (EIT) procured through this effort must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.section508.gov.

Government-Furnished Property/Information

i. Government-furnished property (GFP) (material, equipment, and/or information) may be provided under this effort. At the request of the Government, or at completion of this effort, the Contractor shall immediately return any Government-provided property, material, equipment, or information provided by the Government for the Contractor to use to complete this effort.

ii. GFP will be identified at the Task Order level.

Government Furnished Equipment Inventory. An inventory of Government-furnished equipment (GFE) must be completed no later than five (5) business days after start of this effort and not later than five (5) business days before completion of each Task Order. The Contractor and the COR or other Government representative must jointly determine the working order and condition of all equipment and document their findings on the inventory.

Government Furnished Equipment Replacement. The Contractor must submit requests for replacement of Government-furnished equipment to the COR for processing. Such requests must specify the reason for the replacement request.

18. Permits and Licenses

In performance of work under this award, the Contractor shall, without additional expense to the Government, be responsible for obtaining any necessary licenses and permits, and for complying with any federal, state, and municipal laws, codes, and regulations applicable to the performance of the work.

The Contractor will also provide all manufacturer End User License Agreements (EULAs) to the COR in relation to each Task Order.

19. Task Order Procedures

18. A detailed PWS will be issued by the government for each Task Order to be placed against IDIQ contract awarded from this PWS. The detailed PWS will include the period of performance; place of performance; travel requirements (if necessary); description of the task or tasks to be performed; deliverables; minimum qualifications for individuals to perform the task, work schedule (if necessary), and other information pertinent to the task.

The detailed PWS may require individual(s) providing the services to be physically located at the offices/sites requiring the services or at their home office.

Unless the detailed PWS allows additional days, the contractor will be allowed up to 10 business days to respond. The response will include the contractor’s approach for performing the tasks, qualifications for employee(s) who will perform the tasks, price for performing the tasks, and assumptions used in preparing the response to meet all the requirements of the detailed PWS. Reclamation will evaluate responses on technical merit and consideration of price. Reclamation may accept or reject the response or request further clarification and/or revisions to the response. The contractor shall respond to requests for clarifications or revisions by the close of the next business day.

After a task order is issued, the contractor may need to make a substitution. In these instances, the contractor will provide employee qualifications for substitutes or replacements of employees accepted in the proposal. Substitute and replacement employee qualifications will be at least equal to or exceed the qualifications of the employee they are substituting for or replacing or provide consideration. Reclamation will evaluate the qualifications of the substitutes or replacements. Reclamation must accept the substitute or replacement employee prior to the employee mobilizing and performing the detailed PWS. All costs incurred as a result of the substitution (i.e. travel, labor for transferring task order knowledge, overlapping time on site, recruitment, differential pay, etc.) will not be an expense to the government.

Issuing task orders. Task orders may only be issued by the Bureau of Reclamation Denver Contracting Office. No other offices have authority to issue a task order.