Attachment_4_SOW.docx

ATTACHMENT 4

SOW

STATEMENT OF WORK

TABLE OF CONTENTS

SECTION A – GLOSSARY

Administrator – SSA staff responsible for managing all aspects of the application, including administrative functions using the administrative interface.

CO –Contracting Officer (government)

Developer – SSA staff responsible for maintaining and making changes to the public facing web-based end-user interfaces. (Same definition as Web Developer)

External Customer/User – Anyone who can login to their MySSA account.

FedRamp- government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

Internal Customer/Users – SSA staff user

ITSSC Contractors working on this effort-- This term means any employees of an entity that has a contractual relationship with SSA because of one of the ITSSC contracts, all employees of which are bound by Non-Disclosure Agreements. This term includes, but is not limited to, corporations, limited liability partnerships, and individuals. ITSSC contractors specifically anticipated to work on this project may include ACCENTURE, CGI, and/or any subcontractors or business partners, each of which is governed by the same NDA restrictions.

PII - Personally Identifiable Information. SSA follows the definition of PII provided by the Office of Management and Budget in OMB Memorandum OMB M-07-16.

Subject Matter Expert (SME) – SSA staff who has expertise in a specific area and provides knowledge in the project area.

Snippet - Small piece of programming code.

Solution – The entire combined package of deliverables and services the Contractor will provide to meet the requirements outlined in the SOW.

Web Developer – SSA staff responsible for maintaining and making changes to the public facing web-based end-user interfaces. (Same definition as Developer)

SECTION B – MANDATORY REQUIREMENTS

B-1 Background Office and Mission Social Security Administration (SSA) Office of Systems (OS) Office of Chief Technology Officer (CTO) 6401 Security Boulevard Baltimore, Maryland 21235

SSA is responsible for administering national social insurance programs and social welfare programs, and for providing operational systems support to other Federal and State agencies. With retirement, disability, and survivors’ benefits, Social Security is one of the most successful anti-poverty programs in our nation's history.

The Office of Systems is responsible for the Information Management (IM) and Information Technology (IT) Programs at the Social Security Administration, and leads the development and implementation of an enterprise information technology infrastructure across SSA. Within OS, the Office of the Chief Technology Officer (CTO) is a future focused group, responsible for the incubation of advanced technologies and processes to improve SSA. The CTO works to leverage the power of technology and data to provide innovative solutions for organizational priorities and to engage components across the Agency to incubate new technologies, determine the viability of these new ideas at the least cost, risk and obligation to the Agency.

The current SSA framework for addressing customer inquiries, such as presenting options as to the date to retire, is based upon the client service environment of the past. Often the methods rely on traditional face-to-face interaction, either in person or on the telephone, which requires a significant time investment of agency personnel with each client, as well as extensive and on-going informal Systems Administrator level training. These methods were adequate when localized claims processing was the norm. Clearly, new methods of service delivery and advances in technology, along with the increase in Social Security Administration customers, have brought with them challenges in maintaining the agency’s well-deserved reputation for a high quality of service for individual customers.

Project Summary

The contractor will assist SSA with implementing and incorporating Virtual Assistant Customer Service Support Software (VACSS) technology to help agency staff deal with the increased workload, and also to allow for a better online “self-service” experience for customers. We want the virtual assistant to interact with users in a conversational manner using Artificial Intelligence (AI) and Machine Learning

B-2 Scope of Work

B-2.1 Scope SSA plans to incorporate VACSS technology to help agency staff deal with the increased workload, and also to allow for a better online “self-service” experience for customers. The contractor shall provide to the Agency the requisite software licenses, software maintenance, informal Systems Administrator level training, technical support and administrative management of any required Contractor personnel for this effort.

NOTE: SSA is looking for an already existing, Commercial-Off-the-Shelf solution that can act as a Virtual Assistant; while some customization of scripts, but not of product, may be required, the solution shall be one that is already successfully in production elsewhere.

B-2.2 Expected Outcome

SSA expects to gain an efficient, high quality Virtual Assistant Customer Service Support Software (VACSS), and related support services. The support services will assist the SSA project team located in SSA headquarters in Woodlawn MD in the technical and business process configuration, implementation, operation and maintenance of the VACSS. The SSA project team consists of SSA staff and ITSSC Contractor Staff.

As a first step to implementing such a tool, SSA plans in incorporate the use of a VACSS tool with our Benefit Eligibility Center within the “my Social Security” portal; this will help applicants understand the options regarding time to file for retirement, referred to as Month of Election (MOEL). We want the Virtual Assistant to interact with users in a conversational manner using Artificial Intelligence (AI) and Machine Learning, which can help online retirement applicants understand the different MOEL options they may have. The VACSS will allow SSA to modernize its customer service options, and ease the workload on an already overtaxed staff.

Multiple awards are anticipated for Phase I. During Phase I each contractor shall provide services and deliverables, including any necessary trial licenses, at SSA headquarters in order to stand up a POC (Proof of Concept) VACSS on an SSA provided testbed. If needed, consultants will travel to SSA headquarters but will not access PII.

Each solution will be required to demonstrate the ability to meet or exceed identical technical standards, and to undergo the same performance tests and to meet the performance standards as outlined in SECTION B-5.3.2 Processing and Operational Capacity.

BASE YEAR 1 PHASE 1 will be awarded on a FIRM FIXED PRICE basis, and will be a SEPARATELY PRICED CLIN. The entire dollar value of the Phase I including all deliverables and services, shall NOT EXCEED $50,000.00

For each contract, the government will decide whether or not to exercise the option to continue beyond Phase I.

B-2.4 Base Year, Phase 2: Pilot Months 4-12 Multiple Contractors may be selected for Phase II. During Phase II each contractor shall provide services and deliverables, including any necessary trial licenses, at SSA headquarters in order to stand up a PILOT VACSS on an SSA provided testbed. If needed, consultants will travel to SSA headquarters but will not access PII. Each solution will be required to demonstrate the ability meet or exceed additional identical technical standards, and to undergo the same performance tests and to meet the performance standards as outlined in SECTION B-5.3.2 Processing and Operational Capacity.

If exercised, BASE YEAR 1 PHASE II will be awarded on a FIRM FIXED PRICE basis and shall not exceed $100,000.00. It shall be e an OPTIONAL SEPARATELY PRICED CLIN.

For each contract, the government will decide whether or not to exercise the option to continue beyond Phase 2.

B-2.5 Option Years 1,2,3 and 4: National Roll-out and Further Implementation Months 13-60

The government anticipates having only 1 contractor working on the project by this point.

During each Option Year, the contractor shall provide deliverables, including any necessary licenses, at SSA headquarters in order implement a production version NATIONAL ROLL OUT, per SECTION B-5.3.2 Processing and Operational Capacity.

The licenses and maintenance required for each Option Year will be awarded on a FIRM FIXED PRICE BASIS, by means of an OPTIONAL SEPARATELY PRICED CLINs.

Any desired services shall be ordered by means of TASK ORDER(s), placed against an existing IDIQ CLIN on the base order, for the applicable Option Year. Each IDIQ CLIN will be for $0, and will state the possible labor categories and fixed hourly rates for each. Any resulting TASK ORDER may be Firm Fixed Price, Time and Materials, or Labor hour, as the government decides.

The government currently anticipates, but does not guarantee, a requirement for services as outlined in the portion of the SOW B-5.3.3 ORDERING SERVICES BEYOND THE BASE YEAR.

If needed, consultants will travel to SSA headquarters but will not access PII.

No Travel or Other Direct Costs will be reimbursed.

For each contract, the government will decide whether or not to exercise any option to continue. There will be additional option years as well; the total contract life may be as much as 60 months.

B-2.6 Assumptions The assumptions listed below apply to this requirement:

B-3 General Requirements

B-4 Virtual Assistant Capabilities

B-4.1 The Contractor shall:

B.1.

B.2.

B.3.

B.4.

4.1.

4.2.

B-4.1.1 Provide a Commercial Off the Shelf (COTS) solution that has been continuously in production for the past 3 years by multiple organizations, of which at least one must be a federal or state agency, and shall meet or exceed these characteristics In addressing Experience - It is not sufficient to merely state that past or ongoing contract(s)/ engagement(s) is/are similar in size, scope and complexity to the requirements of this solicitation. Contractors shall provide information about past and current efforts and also provide evidence to convincingly demonstrate that such efforts are indeed similar in size scope, and complexity as outlined below:

B-4.1.1.1 Size Demonstrated experience working with corporations or government entities for an enterprise solution that has 30,000 concurrent users or more.

B-4.1.1.2 Scope Demonstrated experience in integrating virtual assistant into an on or offsite customer cloud infrastructure.

B-4.1.1.3 Complexity Integrating into multiple systems, and legacy systems where the private cloud environment accesses existing legacy systems, serving both public and internal employees.

B-4.1.2 Demonstrated experience in providing informal Systems Administrator level training

B-4.1.3 Provide a solution to be hosted by SSA, behind the SSA firewall, on SSA’s ACI cloud platform.

B-4.1.4 Ensure that SSA retains ownership of all data, templates, clones, and scripts/applications created with this Statement of Work as well as maintaining the right to request full copies at any time.

B-4.1.5 Provide JSON, or XML format as the mechanism for SSA to retrieve all data, scripts, software, and so forth such as mirroring or copying to SSA.

B-5.1.1 Installed and run on agency ACI Cloud instance (AWS/Azure).

B-5.1.2 Consistently accurate interactions (see B-5.8 Quality Control Requirements)

B-5.1.3 Capable of supervised and unsupervised learning.

B-5.1.4 Ability to remember user and human agent actions and contextual information provided during conversations, also known as state management, to allow for multiple and complex conversation flows.

B-5.1.5 Ability to leverage captured information to refine future responses to other users.

B-5.1.6 Provides a User Interface (UI) to allow business experts to define and refine business rules, responses and response patterns.

B-5.1.7 Supports testing of user inputs and intent as well as conversation flow.

B-5.1.8 Solution requires minimal informal Systems Administrator level training for use by SSA or SSA contractor personnel to enable technology to provide responses and outcomes.

B-5.1.9 Ability to capture, maintain and utilize conversation information across channels and sessions.

B-5.1.10 Solution should provide analytics capability.

B-5.1.11 Ability to deliver a customer service experience that includes:

B-5.1.11.1 Ability to refine inquiries through interactive conversations B-5.1.11.2 Ability to aid users in completion of tasks which will be defined by SSA

B-5.1.12 Ability to provide capabilities across multiple channels:

B-5.1.12.1 Text (Web/Chat) B-5.1.12.2 Voice B-5.1.12.3 Video B-5.1.12.4 Mobile

B-5.1.13 Ability to support multiple goals during a single customer interaction from request through completion.

B-5.1.14 Ability to support human-like conversations where the primary goal may be interrupted with various sidebars and utterances while maintaining the ability to retain focus on the primary goal.

B-5.1.15 Ability monitor and analyze word usage in order to detect incidences of potential user frustration, and, if advisable, to respond by routing to live agent

B-5.1.16 Contractor solution shall have the ability to provide monthly reporting of the quality control data demonstrating virtual assistant accuracy against existing Agency standards (see B-5.8 Quality Control Requirements).

B-5.1.17 Compliance with Internet Protocol Version Six (IPv6) When Acquiring Information Technology

B-5.1.17.1 The contractor shall ensure that products and services that use the Internet Protocol provide full feature functionality in both dual stack (IPv4 and IPv6) and IPv6-only environments comply with National Institute of Standards and Technology United States Government version 6 Testing Program, see Special Publication 500-267, A Profile for IPv6 in the U.S. Government – Version 1.0.

5.1.17.2 Upon request, the contractor shall provide documentation that an accredited laboratory tested the product and showed it to be IPv6 capable/compliant.

5.1.17.3 Following acquisition and installation, if the agency finds a product is not IPv6 capable/compliant, despite the contractor’s SDOC, the contractor must remedy the deficiency to the agency’s satisfaction and at no cost to the agency.

B-5.1.18 Solution provides access control capabilities to provide unique user ID’s and integration into enterprise authentication services

B-5.1.19 Solution must contain the ability to divide sensitive actions to multiple employees

B-5.1.20 Multitenant controls for separation of users and data within the service

B-5.1.21 Application layer vulnerability scans need to be permitted/conducted/ and a report generated

B-5.1.22 Ability for data to be encrypted in transit and at rest FIPS 140-2

B-5.1.23 Solution has the capability to auto generate status and problem reports on a scheduled and on demand basis

B-5.1.24 Must be able to communicate effectively in English

B-5.2 Delivery of Software Capabilities The Contractor shall maintain all associated software. Upgrades shall be provided, but shall not be installed until the contractor receives written approval by the Contracting Officer’s Technical Representative (COTR)

B-5.3 Operational Controls

B-5.3.1 Governance Process Contractor shall provide a formally documented governance process used for deployment and configuration/change management.

B-5.3.2 Processing and Operational Capacity

B-5.3.3 ORDERING SERVICES BEYOND THE BASE YEAR

All services for the BASE YEAR PHASE I and BASE YEAR PHASE II shall be included in the FFP price for each period.

Any desired SERVICES beyond the Base Year shall be ordered by means of TASK ORDER(s), placed against an existing IDIQ CLIN on the base order, for the applicable Option Year. Each IDIQ CLIN will be for $0, and will state the possible labor categories and fixed hourly rates for each. Any resulting TASK ORDER may be Firm Fixed Price, Time and Materials, or Labor Hour, as the government decides.

The government currently anticipates, but does not guarantee, a requirement for services as outlined in ATTACHMENT 3 LABOR CATEGORIES.

B-5.4 Information Security Requirements

B-5.4.0 Definitions The following terms are defined for the purposes of this clause:

“Federal information” means any information created, collected, maintained, used, shared and disseminated by or for the Federal Government.

“Federal information systems” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of Federal information.

“SSA Sensitive information” means any information, the loss, misuse, or unauthorized access to, or modification of which could adversely affect the national interest or the, conduct of Federal programs, or the privacy to which individuals are entitled under the Privacy Act of 1974 (5 U.S.C. § 552a) or other federal laws, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Sensitive information includes but is not limited to personally identifiable information, federal tax information (see 26 U.S.C. § 6103), sensitive procurement-related information, and sensitive information pertaining to pending security and legal investigations, and all other non-public government information or information obtained in the execution of this contract that is not publically available outside of the Contractor’s association with SSA.

B-5.4.1 Information Security Compliance Prior to accessing, collecting, processing, storing, maintaining, disseminating, or otherwise handling any SSA sensitive information, the Contractor must provide and document adequate security for federal information and federal information systems in accordance with all applicable federal laws and related requirements, including but not limited to:

· Federal Acquisition Regulation (FAR) Part 52, Solicitation Provisions and Contract Clauses, including clauses 52.239-1 and 52.204-21 Basic Safeguarding of Covered Contractor Information Systems

· Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules

· FIPS 199, Standards for Security Categorization of Federal Information and Information Systems

· FIPS 200, Minimum Security Requirements for Federal Information and Information Systems

· Federal Information Security Management Act (FISMA) of 2002, 44 U.S.C. §§ 3541-3459, as amended by the Federal Information Security Modernization Act of 2014 (Pub. L. 113-283)

· Federal Risk and Authorization Management Program (FedRAMP), Moderate Baseline

· Homeland Security Presidential Directive (HSPD) 12, Policy for a Common Identification Standard for Federal Employees and Contractors

· National Institute of Standards and Technology (NIST) Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems

· NIST SP 800-52 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

· All DHS Binding Operational Directives (BOD)

· NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Moderate Baseline

· NIST SP 800-88, Guidelines for Media Sanitization

· NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

· NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

· Office of Management and Budget (OMB) Circular A-130 Management of Federal Information Resources

· OMB Memorandum M-14-03, Enhancing the Security of Federal Information and Information Systems

· OMB Memorandum M-06-16, Protection of Sensitive Agency Information

· The Privacy Act of 1974.

The Contractor must comply with all applicable SSA standards, policies, and procedures, as provided by the SSA CO and/or COR upon contract award, including but not limited to the Information Security Policy (ISP) and the Administrative Instructions Manual System (AIMS).

B-5.4.2 Location and Origin The Contractor and by extension all subcontractors must not have any associations with foreign governments or entities that support international terrorism or have a “significant interest” to conduct SSA business per 10 U.S.C. § 2327. The United States Department of State Bureau of Counterterrorism maintains a list of State Sponsors of Terrorism and a list of Foreign Terrorist Organizations.

The Contractor and by extension all subcontractors must be located in the Contiguous United States (CONUS). This includes but is not limited to the primary headquarters facility, physical location of all information systems, and geographical origin of software used in the execution of this contract. Upon request, the Contractor shall provide the SSA CO and/or COR with the specific address for the physical location of the facility hosting information systems relevant to the execution of this contract, access to the hosting facility for inspection, and a list of all associated businesses if deemed necessary.

The Contractor shall notify the SSA CO and/or COR at least 30 days prior to moving its physical site and within 24 hours when the location of SSA data changes servers or devices. The new location must meet or exceed SSA security requirements.

B-5.4.3 Security Assessment and Authorization Prior to accessing, collecting, processing, storing, maintaining, disseminating, or otherwise handling any SSA sensitive information, the Contractor must satisfy SSA’s Security Assessment and Authorization (SA&A) requirements as follows:

The Contractor must submit security documentation to the SSA CO and/or COR and receive written authorization from SSA prior to the transmission of SSA sensitive information to the Contractor system. The Contractor must prepare and submit a System Security Plan (SSP) that documents the implementation status of required security controls. The SSP must:

· Incorporate all entities and agents of the contractor who must have access to sensitive information, including subcontractors.

· Provide an overview of architecture and security requirements of the system used for collection, storage, maintenance, transmission, and disposal of sensitive information.

· Describe the implementation status of all security controls required to protect moderate impact level information, including supporting rationale for the implementation status.

· If the Contractor provides services or makes resources available to SSA via a third-party Cloud Service Provider (CSP), the Contractor’s SSP shall cite the CSP’s completed FedRAMP SSP for details of security controls and implementation status applicable to the CSP cloud service or resource.

The Contractor must conduct an information system security categorization in accordance with NIST SP 800-60 and FIPS 199. The Contractor must conduct an independent security assessment of the implementation status of the security controls defined by NIST required for the FIPS 199 security categorization. The Contractor must provide these assessment results to SSA. The Contractor must provide access and information as requested in support of SSA’s Security Authorization Process, which includes on-site security testing and evaluation of the system’s security posture by SSA or an independent contracted representative of SSA. This may result in remediation actions that the Contractor must implement prior to the system receiving authorization to operate.

The Contractor must continuously monitor the status of implemented security controls to ensure their continued effectiveness. The contractor must demonstrate continuous monitoring by determining the security impact of proposed or actual changes to the Information System and its environment of operation; and recording relevant information about specific changes to hardware, software, firmware, environment (e.g., hosting networks, mission / business use of the system, threats), or risk management in the SSP. For changes affecting the security state of the system, the contractor must take corrective actions and revise appropriate documents, including the Security Assessment Report, SSP, and POA&M).

B-5.4.4 Cloud Service Provider If provided service is Cloud hosted solution, then the solution must be compliant with the Federal Risk and Authorization Management Program (FedRAMP) at the time of proposal submission. FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

FedRAMP Information Technology Systems Security Requirements In accordance with Federal Information Processing Standard (“FIPS”) 199, the SSA has determined that its security categorization for a cloud computing based solution is Moderate. The provider shall apply the appropriate set of impact baseline controls as required in the FedRAMP Cloud Computing Security Requirements Baseline document to ensure compliance to security standards. The FedRAMP baseline controls are based on National Institute of Standards and Technology (“NIST”) Special Publication 800-53, Revision 4, Recommended Security Controls for Federal Information Systems and Organizations (as amended), and also includes a set of additional controls for use within systems providing cloud services to the federal government. The provider shall maintain a security management continuous monitoring environment that meets or exceeds the requirements in the latest edition of FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements.

B-5.4.5Sensitive Information Handling The Contractor must only make SSA sensitive information accessible to persons satisfying personnel suitability requirements as prescribed in the Security and Suitability clause of the contract.

The Contractor must retain all SSA sensitive information within safeguarded SSA information systems that comply with the federal security standards and requirements outlined above, and prevent unauthorized dissemination of SSA sensitive information.

The Contractor must restrict access to all SSA sensitive information only to the minimum number of individuals required to satisfy the duties of the contract. Each Contractor employee having access to SSA sensitive information under this contract shall complete the SSA non-disclosure agreement (NDA), as applicable. The Contractor must submit a copy of each signed and witnessed NDA to the SSA CO and/or COR prior to viewing, processing, or accessing SSA sensitive information. The Contractor must only use SSA sensitive information provided to the Contractor or collected by the Contractor on behalf of SSA for carrying out the provisions of this contract and the Contractor must not disclose or make this information known in any manner to any persons except as necessary and authorized in the performance of the contract. Unauthorized disclosure of information is subject to termination and/or prosecution as governed by the SSA sanction policies; 18 U.S.C. 641, Criminal Code: Public Money, Property or Records; 18 U.S.C. 1905, Criminal Code: Disclosure of Confidential Information; and 44 U.S.C. Chapter 35, Subchapter I, Paperwork Reduction Act.

The Contractor must report to the SSA CO and/or COR, any potential data breach of the information systems that may affect SSA sensitive information and any potential loss of SSA sensitive information in accordance with the procedures outlined in the Protecting and Reporting the Loss of PII clause of the contract.

The Contractor must return to SSA control, destroy, and/or hold as directed by the SSA CO and/or COR in writing, all SSA sensitive information when no longer required for fulfillment of this contract. The contractor must destroy SSA sensitive information in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

For systems that handle Federal Tax Information (FTI), the Contractor must adhere to IRS Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies, as applicable.

B-5.4.6 Hypertext Transfer Protocol Secure (HTTPS) The Contractor must securely configure all websites used in execution of this contract with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) and instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

B-5.5.2 The Contractor shall also establish and implement plans for an orderly phase out of operations at the termination of this Contract that insures data security and integrity while data is in transit.

B-5.5.3 The Contractor’s phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business.

B-5.5.4 The plan shall fully describe how the Contractor will, at a minimum, provide SSA any work-in-progress at contract end.

B-5.5.5 Contractor shall perform any other actions required to ensure continuity of operations.

B-5.5.6 The plan shall be submitted to the COTR for approval no later than 60 calendar days prior to Contract completion date.

B-5.5.7 The Contractor shall provide the COTR copies of changes and revisions to the plan for review and approval prior to implementation of the plan.

B-5.5.8 SSA will assume ownership of all knowledge base obtained during this contract. The Contractor shall provide the knowledge base to SSA in a manner that is exportable to our systems i.e. JSON or XML format.

B-5.6 Training Contractor shall provide informal, Systems Administrator level training about the solution to members of the CTO and SSA Systems staff. This training shall consist of the Contractor discussing the following with an anticipated 4-6 SSA personnel as the topics arise

· each step in the written instructions as the steps are being performed,

· on-site training on the software installation process

· details about System setup, deployment and support,

· System Administration training (setup, deployment, and support), and

· business user training (intent mapping, use, and VA training).

This training shall also include written documentation about on the configuration of software related to installation, as well as maintenance of solution after it has been installed.

This shall be provided as user guides, and other available written and electronic materials.

B-5.7 Kickoff Meeting

B-5.7.1 Within two weeks of award the Contractor will participate in a kickoff meeting, which may either be in-person, by teleconference or video conference at SSA’s discretion and shall:

B-5.7.1 Review the Contractor’s Work Plan from the proposal, to include how the Contractor will address the dates in the milestones. The requirements for the Work plan are outlined in B-6.2.1 Work Plan.

B-5.7.2 Provide a Product Demonstration that will include an overview of their software and the administrative interface.

B-5.7.3 A Kick Off meeting will be required as follows

At the start of Base Year 1, Phase 1 At the start of Year 1, Phase 2 At the start of Option Year 1 At the start of Option Year 2

B-5.8 Quality Control Requirements

The standards of quality that must be met by the solution are available in the SSA Program Operations Manual System (“POMS GUIDE”) which will be provided to the contractor by the government at time of award.

POMS is a centralized repository of agency guidance, designed to provide the “public facing” SSA and DDS employees with all the information they need, beginning with policy stated in general terms, through specific procedures required to implement that policy. POMS is now part of the larger PolicyNet, an SSA intranet site which is regularly updated, The contractor shall provide with their proposal a QUALITY CONTROL PLAN addressing quality control. This plan shall include

5.8.1 A system for verifying and maintaining a desired standards of quality for the interactions with the VACSS.

5.8.2 System for verifying the extent of actions (% of units to be tested from a pre-defined “bucket” of interactions over a pre-defined period of time)

5.8.3 System for reporting to the government on a predetermined timeline

# of units that FAILED do not meet pre-defined standards of quality

DIVIDED BY

# of units processed

5.8.4 The minimum acceptable performance level (no more than 15% of units processed failed)

5.8.5 Proposed Types of Corrective Action (defective code corrected, end user who received poor service contacted and advised, additional service provided at no additional cost to government) and the time frame for implementation once the need for corrective action is discovered.

5.8.6 A plan to improve services if a pre-agreed level of failure is detected over a predetermined length of time.

This plan shall be updated on a monthly basis, and included as part of the overall Monthly Contract Summary report.

B-6.0 Project Planning, Reporting Requirements, Deliverables and Acceptance Criteria

B-6.1 General

All deliverables will be delivered to the COTR, and any other program officials designated by the COTR.

Written documentation shall be delivered in Microsoft Office format and other deliverables shall be provided via e-mail.

All working copies of deliverables, in either electronic or printed form, will be surrendered to the COTR upon project completion or termination. The contractor will not maintain archived material relating to the PII or any security concerns uncovered in the project. The contractor will certify, in writing, that any server backup media will be purged of related material pertinent to this project. The due date for this certification shall be agreed upon as outlined in B-5.5 Contract “end of Life” Phase.

The contractor shall treat all deliverables and other written reports as “sensitive but unclassified,” and ensure appropriate markings (e.g., proprietary information herein, Contractor bid or proposal information herein, etc.) appear in the legend. Unless otherwise specified, all deliverables and other written reports must contain appropriate restrictions (e.g., encryption password, permission and editing restrictions, digital signature, etc.) commensurate with the information therein.

Contractor must implement effective document management for all deliverables and other written reports to include version control and comment resolution such that each release has clear inventory of comments that were accepted or rejected as part of the version.

In the event of Task Orders for services, any periodic reporting requirements and other formal meetings and documentation that may be required which are not detailed in this contract will be addressed in the individual task orders.

All documents, databases, software and other deliverables will remain the property of the Government and may be distributed by the Government.

There shall be no marking on any deliverable which would imply that its contents are copyrighted, proprietary to the organization that created it, or that the contents were developed for SSA's exclusive use only. Any such marking will cause the deliverable to be unacceptable.

B-6.2 Plans and Reports

B-6.2.1 Work Plan

In the proposal, the contractor shall provide a Draft Initial Work plan which details their understanding of the requirements for Phase 1, including delivery of software licenses, installation instructions, and best practices from other government or commercial clients including lessons learned, if applicable. The plan will also propose consultation services that will enable SSA to implement the software in our environment. See below

Each Work Plan will address the following:

· the technical approach for this portion of the work (what is your process to install, what is plan for configuration, how to teach the software, etc.). The technical approach shall, at a minimum, address the Milestones as identified in the Schedule of Deliverables below.

· contractor’s organizational resources allocated for this effort, including The Contractor’s contract management structure and its relationship within/to the company.

· contractor’s governance process, which shall enable the contractor to meet schedule requirements for completion of project deliverables throughout the period of performance.

If all options are exercised, the contractor shall provide similar Work Plans as follows:

· At the Kick Off meeting for Base Year 1, Phase 1

· At the Kick Off meeting of Base Year 1, Phase 2

· At the Kick Off meeting of Option Year 1

· At the Kick Off meeting of Option Year 2

The specific content, format, and method of delivery for this collection of report(s) must be agreed upon with the COTR prior to the due date of each Work Plan.

B-6.2.2 Monthly Electronic Technical Progress Report (eTPR):

This report is required until the government has given written notice that it is no longer needed. It shall be used to measure the progress from initial testing through full implementation.

The contractor shall submit a Monthly eTPR to the COTR, on or before the 2nd Thursday of each month.

The contractor shall distribute the report(s) electronically via email, by SharePoint, or other specified mutually agreed to form of delivery specified by the COTR. Each eTPR shall contain the following information for work completed during the reporting period:

General Information Include the following information in the heading of the report:

· Title “Monthly Technical Progress Report,”

· Contractor’s name,

· Contract number,

· Reporting period,

· Date report prepared, and

· Person reporting.

Status Information A narrative assessment of the Contractor's progress toward completion of the work including:

· Description of status and progress for each milestone and deliverable reached in the work-plan.

· Explanation of the reasons for any differences between planned and actual progress.

· Description of any unplanned accomplishments, efforts, or expenses during the reporting period.

· Specific accomplishments planned for the coming month.

· Opportunities or problems foreseen by the Contractor that need to be brought to the attention of the Government.

· Any contractor other recommendations

· Opportunities or problems (errors/roadblocks) encountered and the actions taken during the reporting period.

B-6.2.3 Monthly Contract Summary Report

The contractor shall submit a Monthly Contract Summary Report to the COTR, by the 15th calendar day of each month. This report shall be used to measure the overall performance of the solution, and is intended to provide an overview of contract resource expenditures, and a workload summarization.

It will include

B-6.2.3.1 Identification of any significant issues concerning the Contract or its administration needing to be brought to the attention of the Government. Note: Issues that have been previously reported and resolved need not be repeated in subsequent reports. Issues that have been previously reported and not yet reported as resolved must be updated.

B-6.2.3.2 Identification of any “cloud related” issues

B-6.2.3.3 Identification of any templates, scripts or applications that have been created in conjunction with this project

B-6.2.3.4 Potential OCI issues, and other information as required under section B-7 Conflict of Interest.

B-6.2.3.5 Listing of what organizations outside of CTO want to pilot this tool, and for what project

B-6.2.3.6 Any failure to meet IPv6 Standards, if applicable, and remediation plan

B-6.2.3.7 Any applicable information/deliverables relevant to Information Security requirements

B-6.2.3.8 Listing of any relevant training document/deliverables made available in this time period.

B-6.2.3.9 Performance metrics, including

B-6.2.3.9.1 An updated Quality Control plan, as outlined in the SOW.

B-6.2.3.9.2 The highest/lowest number(s) of simultaneous users that have been dealt with successfully that month.

B-6.2.3.9.3 Any performance tests run and the outcome that month

B-6.2.3.9.4 Any performance standards in place for this time and outcome that month

B-6.2.3.10 For T&M or LH Task orders, overall list of

B-6.2.3.10.1 billable work performed and ODCs incurred

B-6.2.3.10.1.1 this month

B-6.2.3.10.1.2 for the task order overall

B-6.2.3.10.2 Listing of amount actually invoiced so far

B-6.2.3.10.3 Amount of payment received from the government so far

B-6.2.3.10.4 Anticipated date upon which contractor will have incurred invoices of 85% of the amount obligated for Labor and ODCs.

B-6.3 Schedule of Deliverables

PHASE 1

3 days after award

MILESTONE

Installation and Configuration for ACI/AWS platform

B-5.3.2 Processing and Operational Capacity end of Phase 1

Monthly, by the 15th calendar day of each month.

PHASE II

Requirements End of Phase II

Requirements End of Phase II

B-5.3.2 Processing and Operational Capacity End of Phase II

Monthly, by the 15th calendar day of each month.

OPTION YEAR 1

MILESTONE ramp up user base.

facilitate 8,000 users

SOW,

B-5.3.2 Processing and Operational Capacity

• Months 13-16

MILESTONE ramp up user base.

facilitate 12,000 users

SOW,

B-5.3.2 Processing and Operational Capacity

• Months 17-20

MILESTONE ramp up user base.

facilitate 20,000 users

SOW,

B-5.3.2 Processing and Operational Capacity

• Months 20-24

End of OY 1

Monthly, by the 15th calendar day of each month.

OPTION YEAR 2

MILESTONE ramp up user base.

facilitate 12,000 users

SOW,

B-5.3.2 Processing and Operational Capacity

• Months 25-30

MILESTONE ramp up user base.

facilitate 12,000 users

SOW,

B-5.3.2 Processing and Operational Capacity

• Months 31-36

End of OY 2

Monthly, by the 15th calendar day of each month.

OPTION YEAR 3

B-5.3.2 Processing and Operational Capacity From Day 1 of OY 3

Monthly, by the 15th calendar day of each month.

OPTION YEAR 4

B-5.3.2 Processing and Operational Capacity From Day 1 of OY 4

Monthly, by the 15th calendar day of each month.

END OF LIFE

60 days prior to termination or expiration of contract

per the Phase Out plan

B-6.4 Acceptance of…