RFP 277-20-0550 Attachment 1c Delivery Schedule (Amended).pdf

Reference No. 277-20-0550

Attachment 1c. Delivery Schedule

Schedule of Deliverables and/or Reporting Requirements

General Deliverables - List of Deliverables Based on Division of Technology Management

(DTM) and Office of Communication (OC) Requirements:

Item Timeline To Section

1 Final Information

Technology (IT) Plan

60 calendar days after award. Review annually

DTM thru Contracting Officer's

Representative (COR)

II

2 Meeting on systems or websites migration from third-party hosted service to SAMHSA

At least 60 calendars days or earlier before the planned migration date

DTM Infrastructure Team thru

COR

III

3 IT and Web Cost

Reports

Twice a year (July and November)

DTM Federal Information

Technology Acquisition Reform

Act (FITARA) Team thru COR

IV

4 IT Investment Factsheet 90 calendar days after award and update annually

DTM FITARA Team thru COR IV

5 Website Domain

Registration

When registered and when requested

DTM FITARA Team thru COR IV

6 Privacy Threshold

Analysis (PTA)

30 calendar days after award

Privacy and Chief Information

Security Officer (CISO) and

Info.Privacy@samhsa.hhs.gov thru COR

V. A. 1. 5). b

7 Entity, data type and relationship diagrams

No later than 30 calendar days after award

CISO and

Info.Privacy@samhsa.hhs.gov thru COR

V. A. 1. 5). c

8 Draft system’s Privacy

Impact Assessments

(PIAs) if full PIAs is needed

No later than 45 calendar days after contract effective date

(CED)

Privacy Officer and

Info.Privacy@samhsa.hhs.gov thru COR

V .A. 1. 5) .f

9 Encryption Key if applicable

When requested or at the end of the contract

Info.Privacy@samhsa.hhs.gov and COR

V. A. 1.

10) .h

10 Information Security

Awareness and Privacy training

Within 30 calendar days after CED and annually

COR V. A. 3. 1)

11 Security and Privacy

Role-based Training

Within 30 calendar days after CED and annually

COR V. A. 3. 2)

12 Security and Privacy

Training Records

Within 35 calendar days after CED and annually

COR V. A. 3. 3)

13 Read and sign Rules of

Behavior

Within 35 calendar days after CED and annually

COR V. A. 4

14 Staff Roster Within 30 calendar days after CED and

COR V. A. 5. 2)

mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov

10 days when staffing changes

15 Project

Closeout/System

Decommission meeting

At least 30 calendar days before project closeout/system decommission

DTM thru COR V. A. 6

16 Initiate security assessment and authorization (SA&A) process

No later than 30 calendar days after

CED

CISO thru COR V. B. 2. 3)

17 System Authorization to

Operate (ATO)

Before system goes live

CIO and CISO V. B. 2. 4)

18 Information System

Security Plan (ISSP)

(with supporting artifacts and documents listed on the ATO package and the

Security Checklist.)

Part of ATO package, before system goes live

CISO and security email box infosecurity@samhsa.hhs.gov

V. B. 2. 6) b

V. B. 2. 6)

19 E-Authentication

Questionnaire (Risk

Assessment)

Within 30 calendar days after CED

CISO and infosecurity@samhsa.hhs.gov.

Template can be requested by emailing CISO and ISSO.

V. B. 2. 9)

20 Privacy and security kickoff meeting

Within four (4) weeks of CED

COR and CISO Work plan

21 Annual Penetration

Testing Summary

Report

Annually, anytime during a contract year

COR and DTM Security Team V. B. 2. 15)

22 Vulnerability scan reports for database, application, and operation system

Every 30 days after

ATO is granted

Upload to SAMHSA Sharepoint

Site directed by the SAMHSA

Security team and COR

V. B. 3. 4)

23 Vulnerability “Change

Report” and Cloud

Security Continuous

Monitoring Reporting

Every 30 days after

ATO is granted

Upload to SAMHSA Sharepoint

Site directed by the SAMHSA

Security team and COR

V. B. 3. 4)

V. C. 4 2)

24 Permanent electronic records

60 days prior to period of performance expiration

DTM Records Management

Officer

VI. B.5

25 Records management training and provide

Contractor Records

Management Training

Completion

Memorandum

Within 30 days of contract award or new contract staff start date and then annually for the life of the contract.

COR

VI. B. 11

26 Electronic Systems

Questionnaire

Responses within 4 weeks after the CED and 30 days prior to modifications to system

DTM thru COR during the kickoff meeting

VI. B. 12

mailto:infosecurity@samhsa.hhs.gov mailto:infosecurity@samhsa.hhs.gov

Specific Deliverables - The contractor shall deliver the following items in accordance with the stated delivery schedule:

Task

Description/Items

Quantity

Due Date

General

Requirements

IT Security Plan 2 of each, 1 draft

1 final

Final due not later than 90 calendar days after CED

Prepare an IT Plan that will include the design, development, implementation, and maintenance for all IT applications and major IT milestones and implementation dates of the project.

2 of each, 1 draft

1 final

Final due not later than 90 calendar days after CED

Content Development and Management

Plan

2 of each, 1 draft

1 final

Final due within 60 days after the CED, the

Contractor shall submit

“Electronic Versions” and

“Hard Copies”.

Task 1

Contract

Management

27 HHS Accessibility

Checklist

Each content deliverables

COR OC

requirements

I. G

28 Content Development and Management Plan

Within 60 days after

CED

OC and DTM (including Records

Officer) thru COR

OC

requirements

IV. A

29 Web Content Approval No later than 3 weeks prior to the planned initial posting of document

COR OC

requirements

IV. C

30 Web Content Migration

Plan including a demo

Within 60 days after

CED; demo within 30 days after CED

COR and DTM (including

Records Officer) thru COR

OC

requirements

IV. D

31 Meeting on IT transition activities related to data, software, web content, and electronic records

Within 30 days after

CED

COR, DTM, and OC OC requirements

IV. E

32 Reports of actual Web-related IT costs

Twice a year (July and November)

OC and DTM thru COR

(could be combined with IT and

Web Cost reports, see #3)

OC

requirements

IV. F

33 Transition Task Schedule meeting with COR and DTM to discuss transition activities

COR and DTM Transition

The Contractor shall conduct a kick-off meeting.

Within 2 weeks of Contract

Effective Date (CED).

Subtask 1.1

Subtask 1.2

Meetings shall be held weekly between the Contractor, the COR, and other relevant parties. The Contractor shall provide agendas and summary of discussions, and documentation of decisions made prior to and following each meeting.

52 Agendas --at least two (2) business days in advance of each meeting. Meeting

Summaries shall be provided within three (3) business days following each meeting

Subtask 1.3 The Contract Project Director shall prepare and submit an annual operational budget by task, listing all expenses associated in accomplishing each task.

1 Annual, 3 Updates

Annual operational budget should be submitted via

Excel Spreadsheet at the start of each contract year, and quarterly thereafter.

One (1), copy of the annual operational budget updated quarterly should be submitted to the COR and one (1) copy to the CO.

Task 2

Reporting

Requirements

Monthly report

2 of each, 1 final

Drafts due at the end of each month, final due on or before the 10th day of the following month

Subtask 2.1

Subtask 2.2 Annual Report 2 of each, 1 draft

1 final

Drafts are due 45 days prior to end of award period with final due within 30 calendar days before the end of the award period of performance

Subtask 2.3 Final Report 2 of each, 1 draft

1 final

Drafts are due 45 days prior to termination of the contract with final due within 30 calendar days before the termination of the contract

Task 3

OMB Clearance

Package

Draft and submit OMB evaluation plan for review of SAMHSA OMB Clearance

Officer.

2 of each

1 final

Drafts due 45 calendar days of CED , Final due no later than 90 calendar days after CED

Subtask 3.1 Review evaluation plan with SAMHSA

OMB Officer.

1 Drafts are due 45 calendar days of CED, Final due no later than 90 calendar days after CED

Subtask 3.2 Draft OMB Clearance Package and prepare any additional documents necessary for OMB data collection clearance, including revising proposed

State questionnaires.

2 of each

1 Final

Draft OMB clearance package within 21 days of approval of the Evaluation

Plan, final OMB Clearance

Package within seven (7) calendar days following initial draft submission.

Subtask 3.3 Draft 60 day Federal Register Notice

(FRN)

2 of each

1 draft

1 Final

Draft 60 day Federal

Register Notice (FRN) shall be submitted within

28 days of approval of the

Evaluation Plan, and the final 60-day FRN within seven (7) calendar days following initial draft submission.

Subtask 3.4 Draft 30 day Federal Register Notice 2 of each

1 draft

1 Final

Draft submitted within 45 days of the 60-day FRN, with final 30 day FRN submitted within seven (7) calendar days following initial draft submission.

Subtask 3.5 Final OMB Clearance Package 2 of each

1 Final

Within 30 days after the end of the 60 day FRN comment period

Task 4

Annual Report to

Congress

Develop the annual report to congress on national efforts to reduce underage drinking and state reports on the prevention and enforcement of underage drinking activities.

1 Final

+ Drafts

Draft Annual RTC and SR due 90 days prior to estimated publish date

Subtask 4.1 Review the RTC prepared in the prior year and recommend changes for

1 format per year and 1

Upon COR approval upcoming Annual RTC and SR for revision.

final report per year

Subtask 4.2 Draft a severable executive summary for the RTC.

+ drafts

Subtask 4.3 Develop the upcoming year RTC and

Executive Summary, revise reports as needed and make them 508 compliant.

Submit drafts for approval.

+ drafts

Subtask 4.4 Provide information needed for SR and assemble for each state.

51+ drafts

As state information becomes available

Subtask 4.5 When information is not available in

APIS, collect and assemble additional information.

As needed As needed

Subtask 4.6 Modify the State Questionnaire based on comments solicited as a result of the

Federal Register Notice and OMB’s feedback.

1 Within 1 month of receiving comments

Subtask 4.7 Survey states with approved questionnaire and provide technical support to States to ensure that the information that has been provided is consistent with the intent of the questionnaire.

Minimum of

51 contacts with states

Beginning one (1) month after questionnaire revision and OMB approval

Subtask 4.8 Develop State Reports organized by HHS region

51 + Within two (2) months of receipt of all State questionnaires to COR

Subtask 4.9 Continue preparation for upcoming years

RTC/SR, develop, and implement quality controls and record keeping.

As needed As needed

Subtask 4.10 Revise and submit drafts of the RTC &

SRs as well as provide professional copy editing and ensuring that it is 508 compliant and submit final document.

1 Final

Report (RTC w/SR)

Within two (2) months of receiving revisions to draft, submit to COR

Subtask 4.11 Conduct at least one (1) meeting of interested parties to consider potential changes, prepare additional documents, and submit to COR for review and modify state questionnaire accordingly.

1 Two (2) months after submission of current year final State Report

Subtask 4.12 Implement process for selecting new topics for SR with input from interested parties.

As Needed Within 2 months of new topic selection

Subtask 4.13 Document all operational procedures employed in developing the RTC and canvassing the states for the SRs.

As needed As needed

Task 5

Web-based questionnaire &

TTA

Develop, maintain, and update web-based questionnaire and provide technical support to states and the District of

Columbia

1 plan As needed upon COR review and approval

Subtask 5.1 Provide maintenance, testing, and, as necessary, website design, revision, and repair for questionnaire website. Ensure that existing functionality incorporated in the design of the questionnaire website operates as intended, and that links (both internal and external) are operational and connect to the intended web pages.

12 Provide COR with updates in monthly report

Subtask 5.2 Provide and perform quality assurance procedures and develop a report related to development of questionnaire.

1 outline

1 report

An initial outline two (2) months after start of award;

a full report at the end of each contract year. First report is due after one (1) full year of award is completed

Subtask 5.3 Document all operational procedures employed in operating questionnaire website.

1 outline

1 report

An initial outline two (2) months after start of award;

a full report at the end of each contract year.

Subtask 5.4 Develop a plan for providing technical support to state agency staff filling out questionnaire.

1 plan No later than three (3) months after contract is awarded and plan is approved by COR

Subtask 5.5 Develop and maintain a technical support website to be housed on www.stopalcoholabuse.gov

1 website Completed two (2) months after TA plan is approved by COR

Subtask 5.6 The Contractor, in consultation with the

COR, shall answer any questions and post frequently asked questions (FAQs) that may be useful for others on the website.

As needed As needed

Task 6

Development of

Analytic Papers

Task 6.1 Identify, acquire, and develop papers describing underage drinking related policies that provide descriptive overviews and detailed characterizations of specific alcohol-related policies provisions.

5 per year These papers will be due one (1) – three (3) months after identification of issue, depending on complexity

Subtask 6.2 Identify experts in topic areas to provide data analysis and information relevant to the development of RTC and SR.

TBD Experts shall be confirmed one (1) month after contract award and within two (2) weeks of need being identified

Subtask 6.3 Prepare scientific journal articles approximately 10-20 pages related to current scientific trends, policy programs, practices and lessons learned.

2 Upon approval of COR

Task 7

Concept facilitation and consultation

Subtask 7.1 The Contractor shall identify national experts in topic areas to provide data analysis, staff development, and information to support the ICCPUD data committee. The Contractor shall be responsible for the qualifications for consultants recruited by them in response to the tasks of this contract.

3 consultant per year, at

25 days each, with no more than six (6) trips.

Upon approval of the COR

Subtask 7.2 The Contractor shall negotiate a daily rate with proposed consultants on a per

TBD As needed upon COR/CO review and approval http://www.stopalcoholabuse.gov/ assignment basis. This rate should not exceed $450.00 per day unless the

Contractor requests an exception and can document an approved federal rate for the consultant for similar work and the

Contracting Officer approves this rate.

Subtask 7.3 The Contractor will develop learning products and workshops on information contained within the RTC/SR to enhance the federal prevention workforce.

Two workshops and related learning products

Upon approval of the COR

Task 8

Meeting/Work shop Facilitation

Contractor to plan for 3 two-day meetings/workshops for approximately

50 interested parties/federal staff.

TBD Upon approval of the COR

Subtask 8.1 Prior to each workshop or meeting, the

Contractor and the COR shall meet to discuss meeting plans, proposed consultants in detail and development of invitation list.

TBD When possible six (6) weeks before the meeting

Subtask 8.2 Provide the COR with a Plan of

Performance for meetings/workshops that should meet the requirement outlined in the SOW.

Draft invitation letters for signature

Final invitation letters for signature

Submit final agendas for review

3 per year Six (6) weeks before event

Five (5) weeks before event

Four (4) weeks before event

Four (4) weeks before event

Subtask 8.3 Hire consultants (on as need basis). 3 per meeting/ workshop

At least six (6) weeks before meeting/workshop when possible

Subtask 8.4 Determine with COR virtual or face to face meeting, if the meeting is face to face, then Contractor to assist in identifying government facilities for meeting sites and arrange for meeting rooms, and as required microphones and public address systems as approved by the COR.

3 meetings/ workshops per year

At least five (5) weeks before workshop/meeting

Subtask 8.5 Provide 2 staff to manage logistics and prepare registration packets for each

At least 50 per meeting/

Four (4) weeks prior to the workshop/meeting, the attendee. Assist if necessary, the organizing and setting up display materials and recording of meeting minutes.

Contractor shall develop a meeting evaluation form to record comments made by participants and provide results to COR.

workshop contractor shall submit sample packet to COR for approval.

Three (3) weeks prior to the workshop/meeting

Subtask 8.6 In addition to the evaluation forms, develop a mechanism to capture the number of attendees, amount of discussion, as well as impressionistic information on level of interest, quality of the presentations.

Contractor shall prepare a summary analysis of the meeting/workshop including, but not limited to the outcome of the evaluation as well as the major recommendations and points made.

TBD Submitted to COR two (2) weeks after meeting/workshop

Task 9

Transition Plan

Task 9.1

Transition Plan

Draft and submit a plan for transfer of the project to either the government or a new contractor as applicable.

1 No later than the eight (8) months of the final performance period and initiate transition actives sixty (60) calendar days prior to contract expiration.