277-23-0606 Attachment 1c DTM-OC Deliverables and Specific Requirement Deliverables.pdf

RFP No. 277-23-0606 SAMHSA Workplace Helpline

Attachment 1c

2021v1.0 Page 1

List of Deliverables Based on Division of Technology Management (DTM) and Office of Communication (OC) Requirements:

Item Timeline To Section 1 Final Information

Technology (IT) Plan 60 calendar days after award. Review annually

DTM through Contracting Officer's Representative (COR)

II

2 Meeting on systems or website migration from third-party hosted service to SAMHSA

At least 60 calendar days or earlier before the planned migration date

DTM Infrastructure Team through COR

III

3 IT and Web Cost Reports

Twice a year (July and November)

DTM Federal Information Technology Acquisition Reform Act (FITARA) Team through

COR

IV

4 IT Investment Factsheet 90 calendar days after award and update annually

DTM FITARA Team through

COR

IV

5 Website Domain Registration

When registered and when requested

DTM FITARA Team through

COR

IV

6 Privacy Threshold Analysis (PTA)

30 calendar days after award

Privacy and Chief Information Security Officer (CISO) and Info.Privacy@samhsa.hhs.gov through COR

V. A. 1. 5). b

7 Entity, data type and relationship diagrams

No later than 30 calendar days after award

CISO and Info.Privacy@samhsa.hhs.gov through COR

V. A. 1. 5). c

8 Draft system’s Privacy Impact Assessments (PIAs) if full PIAs are needed

No later than 45 calendar days after contract effective date

(CED)

Privacy Officer and Info.Privacy@samhsa.hhs.gov through COR

V .A. 1. 5) .f

9 Encryption Key if applicable

When requested or at the end of the contract

Info.Privacy@samhsa.hhs.gov and COR

V. A. 1.

10) .h

10 Information Security Awareness and Privacy training

Within 30 calendar days after CED and annually

COR V. A. 3. 1)

11 Security and Privacy Role-based Training

Within 30 calendar days after CED and annually

COR V. A. 3. 2)

12 Security and Privacy Training Records

Within 35 calendar days after CED and annually

COR V. A. 3. 3)

13 Read and sign Rules of Behavior

Within 35 calendar days after CED and annually

COR V. A. 4

14 Staff Roster Within 30 calendar days after CED and 10 days when staffing changes

COR V. A. 5. 2)

mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov

2021v1.0 Page 2

Item Timeline To Section 15 Project

Closeout/System Decommission meeting

At least 30 calendar days before project closeout/system decommission

DTM through COR V. A. 6

16 Initiate security assessment and authorization (SA&A) process

No later than 30 calendar days after

CED

CISO through COR V. B. 2. 3)

17 System Authorization to Operate (ATO)

Before system goes live

CIO and CISO V. B. 2. 4)

18 Information System Security Plan (ISSP) (with supporting artifacts and documents listed on the ATO package and the Security Checklist.)

Part of ATO package, before system goes live

CISO and security email box infosecurity@samhsa.hhs.gov

V. B. 2. 6) b V. B. 2. 6)

19 E-Authentication Questionnaire (Risk Assessment)

Within 30 calendar days after CED

CISO and infosecurity@samhsa.hhs.gov.

Template can be requested by emailing CISO and ISSO.

V. B. 2. 9)

20 Privacy and security kickoff meeting

Within four (4) weeks of CED

COR and CISO Work plan

21 Annual Penetration Testing Summary Report

Annually, any time during a contract year

COR and DTM Security Team V. B. 2. 15)

22 Vulnerability scan reports for database, application, and operation system

Every 30 days after ATO is granted

Upload to SAMHSA Sharepoint Site directed by the SAMHSA Security team and COR

V. B. 3. 4)

23 Vulnerability “Change Report” and Cloud Security Continuous Monitoring Reporting

Every 30 days after ATO is granted

Upload to SAMHSA Sharepoint Site directed by the SAMHSA Security team and COR

V. B. 3. 4) V. C. 4 2)

24 Permanent electronic records

60 days prior to period of performance expiration

DTM Records Management Officer

VI. B.5

25 Records management training and provide Contractor Records Management Training Completion Memorandum

Within 30 days of contract award or new contract staff start date and then annually for the life of the contract.

COR

VI. B. 11

26 Electronic Systems Questionnaire

Responses within 4 weeks after the CED and 30 days prior to modifications to system

DTM through COR during the kickoff meeting

VI. B. 12

mailto:infosecurity@samhsa.hhs.gov mailto:infosecurity@samhsa.hhs.gov

2021v1.0 Page 3

Item Timeline To Section 27 HHS Accessibility

Checklist Each content deliverable

COR OC

requirements I. G

28 Content Development and Management Plan

Within 60 days after

CED

OC and DTM (including Records Officer) through COR

OC

requirements

IV. A

29 Web Content Approval No later than 3 weeks prior to the planned initial posting of document

COR OC

requirements

IV. C

30 Web Content Migration Plan including a demo

Within 60 days after CED; demo within 30 days after CED

COR and DTM (including Records Officer) through COR

OC

requirements

IV. D

31 Meeting on IT transition activities related to data, software, web content, and electronic records

Within 30 days after

CED

COR/ACOR, DTM, and OC OC requirements

IV. E

32 Reports of actual Web-related IT costs

Twice a year (July and November)

OC and DTM through COR (could be combined with IT and Web Cost reports, see #3)

OC

requirements

IV. F

33 Transition Task Schedule meeting with COR and DTM to discuss transition activities

COR and DTM Transition Task

Specific Requirements Deliverables

TASK DESCRIPTION/ITEM QUANTITY DELIVERY DATE

1 Answer telephone/e-mail inquiries if follow-up information is needed.

Varies Immediately or within one

(1) business day of receipt within one (1) week prior from receipt of inquiry.

2 Document each inquiry verbal and/or written response

Varies Immediately or within one

(1) business day

3 Provide technical evidence-based information/assistance.

Representative replacement if needed.

Varies Immediately or within one

(1) week if research is required. Provide resume/CV of qualified individual to COR within one (1) week.

4 Provide sources of publications Varies Immediately or within one

(1) week if research is required

5 Refer callers to other resources Varies Immediately or within one

(1) business day

2021v1.0 Page 4

TASK DESCRIPTION/ITEM QUANTITY DELIVERY DATE

6 Program consultation and/or training via teleconference As needed;

training 1 hr or less

Scheduled within two (2) days after the request

7 Follow up/Call-back Varies Quarterly 8 Summary Reports 2-3 pages Quarterly no later than 15th day of the preceding month and reports may be requested by COR on an ad hoc basis.

Not to exceed 1 per month as needed

9 Federal agency inquiries, reports, and SOPs Include materials and answers to questions on new or changes to urine or oral fluid mandatory guidelines including hair testing once implicated.

Varies Inquiries: Immediately or within one (1) business day;

Reports: Quarterly and as needed by the COR on an ad hoc basis and not to exceed 1 per month SOPs: Within six (6) months from EDOC, and revisions reviewed and approved by COR when necessary.

10 Turnover at the end of contract/transition

All electronic delivery to the

SAMHSA

extranet and links provided

Transition and training materials on meeting when necessary or within 6 months prior to the end of the contract. COR will notify contractor 120 days prior to expiration, TA, an training materials.