Attachment 1c DTM OC General Requirements Deliverables v1.3 and Specific Requirements.pdf

Technical Support for Drug Free Workplace RFP No. 277-24-0621

Attachment No. 1c

Page | 1 2024 v1.3

List of Deliverables Based on Division of Technology Management (DTM) and Office of Communication (OC) Requirements:

Item Timeline To Section 1 Final Information

Technology (IT) Plan 60 calendar days after award. Review annually

DTM thru Contracting Officer's Representative (COR)

II

2 Meeting on systems or websites migration from third-party hosted service to SAMHSA

At least 60 calendars days or earlier before the planned migration date

DTM Infrastructure Team thru

COR

V

3 IT and Web Cost Reports

Twice a year (July and November)

DTM Federal Information Technology Acquisition Reform Act (FITARA) Team thru COR

IV

4 IT Investment Factsheet 90 calendar days after award and update annually

DTM FITARA Team thru COR IV

5 Website Domain Registration

When registered and when requested

DTM FITARA Team thru COR IV

6 Privacy Threshold Analysis (PTA)

30 calendar days after award

Privacy and Chief Information Security Officer (CISO) and Info.Privacy@samhsa.hhs.gov thru COR

V

7 Entity, data type and relationship diagrams

No later than 30 calendar days after award

CISO and Info.Privacy@samhsa.hhs.gov thru COR

V.

8 Draft system’s Privacy Impact Assessments (PIAs) if full PIAs is needed

No later than 45 calendar days after contract effective date

(CED)

Privacy Officer and Info.Privacy@samhsa.hhs.gov thru COR

V

9 Encryption Key if applicable

When requested or at the end of the contract

Info.Privacy@samhsa.hhs.gov and COR

V.

10 Information Security Awareness and Privacy training

Within 30 calendar days after CED and annually

COR V.

11 Security and Privacy Role-based Training

Within 30 calendar days after CED and annually

COR V.

12 Security and Privacy Training Records

Within 35 calendar days after CED and annually

COR V.

13 Read and sign Rules of Behavior

Within 35 calendar days after CED and annually

COR V.

14 Staff Roster Within 30 calendar days after CED and 10 days when staffing changes

COR V.

mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov mailto:Info.Privacy@samhsa.hhs.gov

Page | 2

15 Project Closeout/System Decommission meeting

At least 30 calendar days before project closeout/system decommission

DTM thru COR V.

16 Initiate security assessment and authorization (SA&A) process

No later than 30 calendar days after

CED

CISO thru COR V.

17 System Authorization to Operate (ATO)

Before system goes live

CIO and CISO V.

18 Information System Security Plan (ISSP) (with supporting artifacts and documents listed on the ATO package and the Security Checklist.)

Part of ATO package, before system goes live

CISO and security email box infosecurity@samhsa.hhs.gov

V

19 E-Authentication Questionnaire (Risk Assessment)

Within 30 calendar days after CED

CISO and infosecurity@samhsa.hhs.gov.

Template can be requested by emailing CISO and ISSO.

V.

20 Privacy and security kickoff meeting

Within four (4) weeks of CED

COR and CISO Work plan

21 Annual Penetration Testing Summary Report

Annually, anytime during a contract year

COR and DTM Security Team V.

22 Vulnerability scan reports for database, application, and operation system

Every 30 days after ATO is granted

Upload to SAMHSA Sharepoint Site directed by the SAMHSA Security team and COR

V.

23 Vulnerability “Change Report” and Cloud Security Continuous Monitoring Reporting

Every 30 days after ATO is granted

Upload to SAMHSA Sharepoint Site directed by the SAMHSA Security team and COR

V.

24 Permanent electronic records

60 days prior to period of performance expiration

DTM Records Management Officer

XXXI 2. 3.

25 Records management training and provide Contractor Records Management Training Completion Memorandum

Within 30 days of contract award or new contract staff start date and then annually for the life of the contract.

COR

XXXI 2. 11.

26 Electronic Systems Questionnaire

Responses within 4 weeks after the CED and 30 days prior to modifications to system

DTM thru COR during the kickoff meeting

XXXI 2.12.

mailto:infosecurity@samhsa.hhs.gov mailto:infosecurity@samhsa.hhs.gov

Page | 3

27 HHS Accessibility Checklist

Each content deliverables

COR OC

requirements I. G

28 Content Development and Management Plan

Within 60 days after

CED

OC and DTM (including Records Officer) thru COR

OC

requirements

IV. A

29 Web Content Approval No later than 3 weeks prior to the planned initial posting of document

COR OC

requirements

IV. C

30 Web Content Migration Plan including a demo

Within 60 days after CED; demo within 30 days after CED

COR and DTM (including Records Officer) thru COR

OC

requirements

IV. D

31 Meeting on IT transition activities related to data, software, web content, and electronic records

Within 30 days after

CED

COR, DTM, and OC OC requirements

IV. E

32 Reports of actual Web-related IT costs

Twice a year (July and November)

OC and DTM thru COR (could be combined with IT and Web Cost reports, see #3)

OC

requirements

IV. F

33 Transition Task Schedule meeting with COR and DTM to discuss transition activities

COR and DTM Transition Task

Page | 4

Delivery Schedule – Specific Requirements Technical Support for Drug-Free Workplace

Task 1: Contract Management and Administration

Task 1.1: Develop and Finalize Work Plan

Task Description of Deliverable Quantity/Item Delivery Date

1. 1.1 Work Plan (Base Year only):

1.1.a.) Draft Work Plan

1.1.b.) Final Work Plan

1.1.a.) 1 draft Work Plan

1.1.b.) 1 final Work Plan

1.1.a.) No later than one (1) business day before Contract Management Kick-off meeting

1.1.b.) On date requested by COR

(approx. 10 business days after the requested revisions)

2. 1.1 1.1.c.) Annual Review of Work Plan (Option Years)

1 annual review of Work Plan per year, and update Work Plan as needed

No later than 10 business days after start of each contract Option Year

Task 1.2: Contract Management Meetings

Task Description of Deliverable Quantity/Item Delivery Date

3. 1.2 Contract Management Kick-off meeting (Base Year only):

1.2.a.) Participation

1.2.b.) Agenda

1.2.c.) Meeting Summary

1.2.a.) Participation in 1 meeting (approx. 3 hours)

1.2.b.) 1 meeting agenda

1.2.c.) 1 meeting summary

1.2.a.) As requested by the COR, approx. 10 business days after CED

1.2.b.) No later than 3 business days before Kick-off meeting

1.2.c.) As requested by COR

4. 1.2 IT Privacy & Security Kick-off meeting (Base Year only):

1.2.d.) Participation

1.2.e.) Agenda

1.2.f.) Meeting Summary

1.2.d.) Participation in 1 meeting (approx. 3 hours)

1.2.e.) 1 meeting agenda

1.2.f.) 1 meeting summary

1.2.d.) As requested by the COR, approx. 20 business days after the CED

1.2.e.) No later than 3 business days before the IT meeting

1.2.f.) As requested by COR

5. 1.2 Recurring Contract Management meetings:

1.2.g.) Participation

Participation in Meetings:

14 in Base Year;

12 in each Option Year

Approx. 1 hour per meeting Approx. 2 in-person meetings per year

On dates requested by COR; every 2 weeks for first 2 months of contract, then monthly for remainder of contract.

If COR determines necessary, approx. 2 in-person meetings could occur per year if Contractor is already in MD, and no additional travel costs are incurred.

Page | 5

Task 1.3: Administrative Reports

Task Description of Deliverable Quantity/Item Delivery Date

6. 1.3 1.3.a.) Monthly Progress Report consisting of:

1) Narrative

2) Expenditures

3) Annual Summary of Accomplishments – only in the 1 year-end monthly progress report for each contract year

12 monthly reports per year (approx. 20 pages each, in Word and Excel format):

• 11 monthly reports per year consisting of 2 parts: Narrative & Expenditures

• 1 monthly report at end of year consisting of 3 parts: Narrative, Expenditures, & Annual Summary of Accomplishments

Monthly, the same day the voucher is provided to SAMHSA

7. 1.3 1.3.b.) Information Technology (IT) Reports

See Division of Technology Management (DTM) Delivery Schedule (pages 1-3 of Attachment 1c);

approx. 20 IT reports in Base Year;

approx. 10 IT reports in each Option Year

See DTM Delivery Schedule (pages 1-3 of Attachment 1c)

8. 1.3 1.3.c.) Ad-hoc Administrative Reports

Approx. 4 ad-hoc reports per year As requested by COR

Task 2: Group and Workgroup Support

Task Description of Deliverable Quantity/Item Delivery Date

9. 2

Tasks 2.1 2.2

Meeting Support:

Task 2.1: Technical SME Meeting

Support 2.1.a.) Technical SME Meeting

Support

Task 2.2: Logistical Meeting

2.2.a.) Logistical Meeting

2.2.b.) DTAB Transcript and

Meeting Summary Package

Approx. 17 meetings per year:

2 DTAB/SME (in-person) 2 DTAB (virtual) 12 SME (virtual) 1 ad-hoc meeting (virtual)

Approximately:

15 out of 17 are virtual meetings;

2 out of 17 are in-person meetings

2.1.a.) Technical SME Support:

Total of approx. 19 technical SME support services per year, among all (approx.) 17 meetings

2.2.a.) Logistical Support:

Total of approx. 50 logistical support services per year, among all (approx.) 17 meetings

2.2.b.) DTAB Transcript and Meeting

Summary Package:

1 pkg. (4 components: transcript & meeting summary for each open & closed session) for approx. 4 DTAB meetings per year; approx.

4 packages per year

2.1.a.) As requested by

2.2.a.) As requested by

2.2.b.) Open session documents:

25 calendar days after DTAB meeting;

Closed session documents:

7 calendar days after DTAB meeting

Page | 6

Task 3: DFWP Annual Summary Report (ASR) / Agency Archive Data System

Task 3.1: Operate and Maintain ASR / Archive System

Task Description of Deliverable Quantity/Item Delivery Date

10. 3.1 Records Management:

3.1.a.) Create New Data Records

3.1.b.) Update Data Records

3.1.a.) New data records approx.

2 times per year

3.1.b.) Updated data records approx. 10 times per year

3.1.a. & 3.1.b.:

As requested by COR (approx. due 1 business day after COR’s request)

11. 3.1 Data Collection:

3.1.c.) Review Data Collection

Documents and Provide Recommended Revisions

3.1.d.) Revise Data Collection Documents

3.1.e.) Perform Data Collection

3.1.f.) Technical Assistance on Data Entry and Reporting

3.1.c.) 1 set of reviews and recommendations per year

3.1.d.) approx. 3 sets of revised documents

3.1.e.) 1 data collection per year, for approx. 3-month period

3.1.f.) 1 set of TA per year, to approx. 120 DPCs/partners

3.1.c. & 3.1.e.:

Annually each fiscal year, according to deadlines in ASR Annual Schedule in Deliverable 3.2.b., Task 3.2.

3.1.d.) As requested by COR and according to deadlines in ASR Annual Schedule

3.1.f.) Respond to requests no later than 1 business day after receiving request

12. 3.1 Data Analyses:

3.1.g.) Perform Data Analyses

Data analyses for approx. 2 ad-hoc requests per year

As requested by COR

13. 3.1 Data Quality:

3.1.h.) Correct Data

Ongoing corrections of data discrepancies

Within 1 business day after discrepancy is identified; or as requested by COR

14. 3.1 System Review:

3.1.i.) System Recommendations

Approx. 1 set of System Recommendations, per year

As requested by COR

15. 3.1 System Modifications/ Enhancements:

3.1.j.) System Updates

3.1.k.) System Upgrades

3.1.j.) 1 set of system updates and updated system documents, annually, each fiscal year

3.1.k.) 1 set of system upgrades, annually, each fiscal year

3.1.j.) As requested by COR, according to deadlines in

3.1.k.) As requested by COR

Task 3.2: ASR Annual Data Reporting

Task Description of Deliverable Quantity/Item Delivery Date

16. 3.2 Annual Schedule – for Data

Collection and Reporting:

3.2.a.) Draft Annual Schedule

3.2.b.) Final Annual Schedule

3.2.a.) 1 draft schedule (approx. 3 pages) per year

3.2.b.) 1 final schedule (approx. 3 pages) per year

3.2.a.) Oct. 15, or if needed, a later date set by COR

3.2.b.) As requested by COR

17. 3.2 DFWP ASR Annual Reports:

3.2.c.) Draft DFWP ASR Annual Aggregate Report

3.2.d.) Final DFWP ASR Annual Aggregate Report

3.2.e.) Agency Profile Annual Report

3.2.c.) 1 draft data report per year (approx. 100 pages)

3.2.d.) 1 final data report per year (approx. 100 pages)

3.2.e.) 1 set of approx. 120 system-generated agency profile reports approx. 10 pages each; annually; 1 per agency data submission

3.2.c.) Annually each fiscal year, approx. 2 months after reporting period closes according to deadlines in

3.2.d & 3.2.e.:

Annually each fiscal year, according to deadlines in

Page | 7

Task 3.3: Special Reports

18. 3.3 3.3.a.) Ad-hoc Special Data Reports Approx. 2 ad-hoc reports per year As requested by COR

Task 4: Certification and Maintenance of Federal Drug-Free Workplace Program (DFWP) Plans

19. 4 Technical Assistance to Agencies:

4.a.) Technical Assistance (TA) Responses

1 complete set of responses to each requester

Acknowledge request within 1 business day of receipt of request, and provide complete set of responses on date requested by agency

20. 4 Review Agency DFWP Plans:

4.b.) Plan Review Package

1 complete set of plan review activity, per plan version

No later than 6 weeks after each plan version is received for review

21. 4 Notification of Completed Reviews and Plans:

4.c.) Notification

4.d.) Comprehensive Package of Review Activity

4.c.) 1 email notification to COR of completed final review;

approx. 2 per year

4.d.) 1 complete final comprehensive package of review activities; approx.

1 per year

4.c.) No later than 6 weeks after final agency plan is received for review

4.d.) As requested by

22. 4 ICG-EC Plan/TDP Reviews:

4.e.) Plan/TDP Review Package

4.f.) Summary Report of ICG-EC Review (consolidated comments of ICG-EC reviews, with contractor’s final recommendations)

4.e.) approx. 1 plan/TDP review package, per year

4.f.) approx. 1 summary report per year

(approx. 5 pages)

4.e.) As requested by

COR

4.f.) No later than 10 business days after receipt of ICG-EC reviews of an agency plan/TDP list from the COR

23. 4 Contacting Agencies:

4.g.) Follow-up with Agencies

4.h.) Identify New Agencies

4.i.) New Contact with Agencies

4.g.) 1 set of completed follow-up with all agencies with pending plans (approx. 45 agencies)

4.h.) 1 comprehensive list of agencies needing a certified plan or an updated plan

4.i.) 1 COR-approved approach and notification of completed new contact with agencies

4.g.) As requested by COR

4.h.) As requested by COR

4.i.) As requested by COR

Page | 8

Task 5: Notifications to Congress

24.

5 5.a.) Draft Notification to Congress

5.b.) Final Notification to Congress

5.a.) approx. 1 draft package per year (package of approx. 186 pages)

5.b.) approx. 1 final package per year

(package of approx. 186 pages)

5.a.) On date requested by COR (approx.

15 business days after COR’s request)

5.b.) On date requested by COR

Task 6: DFWP Tools – Updates

25. 6 DFWP Tools documents:

• Model Plan (approx. 30 pages)

• DFWP Plan Review form

(approx. 15 pages)

• TDP Guidance

(approx. 10 pages)

• TDP List template

(approx. 1 page)

• TDP Review checklist

(approx. 3 pages)

• TDP Review package

(approx. 6 pages)

• Other DFWP tool (plan &

TDP tools) (approx. 6 pages)

6.a.) Review DFWP Tools

6.b.) Revise DFWP Tools

6.c.) Clearance Documents

6.d.) Final DFWP Tools

6.e.) Recommend Efficiencies

6.a.) 1 package of recommended revisions and updates on requested tools;

1 to 7 tools will be reviewed approx. 1 time per year

6.b.) 1 package of revised tools – consisting of 1 to 7 revised documents; approx. 3 sets of revisions per document; pilot testing and clearance packages as applicable; approx. 1 time per year

6.c.) 1 set of clearance documents, for approx. 1 tool document;

approx. 1 time in 5 years

6.d.) 1 package of final tool(s) (1 to 7 documents); approx. 1 time per year

6.e.) 1 document of recommendations; approx. 1 time per year

6.a.) As requested by COR

6.b.) As requested by COR

(approx. 10 business days after request)

6.c.) As requested by COR

6.d.) On dates requested by

6.e.) As requested by COR

Page | 9

Task 7: Dissemination of Information to DFWP Stakeholders

26. 7 Distribute Information Materials:

7.a.) Routine Distribution of HHS Certified Lab List

7.b.) Occasional Ad-hoc Distribution

7.a.) 1 HHS Certified lab list package, approx. 12 times per year (monthly) (approx. 7 pages)

7.b.) approx. 1 ad-hoc distribution per 2 years & notification to COR of completion

7.a.) Monthly, no later than 3 business days after contractor receives lab list; inform COR on same day mailing is completed

7.b.) DFWP Alert Notices:

Complete mailing same day as COR’s request, and inform COR on same day mailing is completed.

Other DFWP-related Materials: Complete mailing within 3 business days from COR’s request, or as specified by COR, and inform COR on same day mailing is completed.

27. 7 Mailing Lists of Stakeholders/Partners:

7.c.) Existing Mailing Lists

7.d.) New Mailing Lists

7.c.) approx. 2 existing electronic mailing lists per yr; approx. 10 requests for updates to existing mailing lists per year

7.d.) approx. 1 “other” new electronic mailing list per yr;

approx. 2 requests for new mailing list updates per year

7.c.) Update existing lists: No after COR’s request

7.d.) Create new lists: As requested by COR;

Update new lists: No after COR’s request

Page | 10

Task 8: Consultation – Briefings and Trainings

28. 8 Briefings and Trainings:

8.a.) Respond to Requests for Briefings/Trainings

8.b.) Provide Briefings/Trainings

8.a.) approx. 20 total requests per year

8.b.) 1 set of briefing/training activities (including coordinating dates, developing and updating presentation materials, and approx. 12 virtual briefings/trainings per year to approx. 2 or more federal agency staff at each briefing/training)

8.a.) Respond to briefing/training request within 1 business day of request; inform COR within 5 business days after request.

8.b.) As requested by COR and on scheduled dates

29. 8 Briefing/Training Materials:

8.c.) Other Additional Presentation Materials

Approx. 1 package of other additional presentation materials per year, i.e., a non-complex recorded audio narrated PowerPoint briefing/training (approximately 20 slides, 15 minutes duration)

As requested by COR

30. 8 Tracking DPC Briefings:

8.d.) Arrange, Schedule, Track DPC Briefing Requests

8.e.) Report Status of DPC Briefings

8.d.) 1 set of services (arrange, schedule and track briefing requests)

8.e.) Monthly, 12 times per year, in 2 deliverables:

1) Monthly Progress Reports (Deliverable 1.3.a., Task 1.3)

2) Verbally at Monthly Recurring Contract Management Meetings (Deliverable 1.2.g., Task 1.2)

8.d.) Ongoing, as needed to track completion

8.e.) Monthly in 2 Deliverables:

1) Deliverable 1.3.a.

2) Deliverable 1.2.g.

Task 9: Subject Matter Expert (SME) Activities / Special Projects

31. 9 9.a.) SME Special Projects Approx. 5 projects per year involving approx. 5 SMEs As requested by COR

Page | 11

Task 10: Transition / Transfer Activities – Contract Closeout

32. 10 10.a.) 90-Day Transition Plan One 90-day Transition Plan When notified by COR, approx.

4 months prior to end of contract

33. 10 Transition Activities:

10.b.) Implement Transition Plan

10.c.) Close-out Meetings

10.d.) Training

10.b.) 1 set of implemented Transition Plan activities

10.c.) approx. 5 meetings

(approx. 1 hour each)

10.d.) approx. 3 trainings (approx. 2 hours each)

10.b.) No later than 90 calendar days before contract expires

10.c.) According to 90-day

Transition Plan schedule

10.d.) According to 90-day

Transition Plan schedule

34. 10 Tranfer Activities:

10.e.) Transfer IT System

10.f.) Transfer Documentation

10.g.) Notify the COR – when work activity closeout and turnover are completed

10.e.) 1 complete transfer of the ASR/Archive system to SAMHSA IT environment

10.f.) 1 complete package of transferred documentation

10.g.) 1 email notification to the

COR

10.e.) & 10.f.)

According to IT requirements and 90-day Transition Plan schedule (approx. 3 months prior to end of contract)

10.g.) According to 90-day Transition Plan schedule

35. 10 System Migration:

10.h.) Work Plan

10.i.) Approvals for System

Migration

10.j.) Implement Work Plan

10.h.) 1 system migration Work Plan

10.i.) 1 set of approvals for system migration to the SAMHSA Cloud

10.j.) 1 completed system migration

10.h.) As requested by COR

10.i.) As requested by COR and according to migration Work Plan schedule

10.j.) As requested by COR and according to migration Work Plan schedule

Page | 12

Optional Task 11: Supplemental SME Activities / Special Projects

36. OPTIONAL

Task 11 11.a.) SME Special Projects –

Supplemental work to Core Task 9

(approx. 2 additional special projects)

Approx. 2 additional special projects; approx. 5 SMEs per project

May be exercised up to 20 times per year.

As requested by COR

Optional Task 12: Supplemental Meetings

Task Description of Deliverable Quantity/Item Delivery Date

37. OPTIONAL

Task 12 12.a.) Meeting Support –

Supplemental work to Core Task 2 (approx. 2 additional meetings)

Approx. 2 additional meetings

May be exercised up to 20 times per year.

As requested by COR