47QPCA25Q0006_RFQ-Att.3.1_SOW_2024-12-16.pdf

Ac qD iv

General Services Administration Federal Acquisition Service

Technology Transformation Services 1800 F St NW | Washington, DC | 20405

Statement of Work Login.gov Kantara Assessor FY25

1.0 Program Information

2.0 Background

3.0 Place of Delivery/Performance

4.0 Tasks and Deliverables

5.0 Quality Assurance

6.0 Personnel

7.0 Post Award Administration

8.0 TTS Policies

1.0 Program Information

In 2017, TTS designed and developed Login.gov, a shared authentication platform, to provide citizens with simple, secure access to online government services. This results in a government-provided “digital identity” for each user, established at National Institute of Standards and Technology (NIST) 800-63-3 Identity Assurance Levels (IAL) 1 or 2 and Authentication Assurance Level (AAL) 2. The resultant digital identity provides users the ability to sign in with a single set of credentials for all participating government programs.

iv

2.0 Background

2.1 Objective

To successfully achieve the mission of the program, Login.gov participated in the Kantara Assurance Program and was awarded the IAL2 & AAL2 Full Service Kantara Trust Mark in accordance with NIST 800-63-3 on September 25, 2024. To remain compliant with the program requirements, Login.gov is required to submit two (2) Annual Conformity Reviews (ACR).

In addition, Login.gov may pursue FAL2 Trust Mark approval in accordance with NIST 800-63-3, requiring a submission of a Triennial application and Triennial assessment.

2.2 Scope

The contractor shall perform two (2) Annual Conformity Review assessments in accordance with the Kantara Initiative KIAF 1340 – Service Approval Handbook. The first ACR is due by September 1, 2025 and the second is due on September 1, 2026.

The scope of this contract also includes an optional FAL2 Assessment under SOW Section 4.2. The timeframe for submitting an application for the FAL2 accreditation is unknown at the time of contract award.

3.0 Place of Delivery/Performance

The primary place of performance will be at the contractor's facility or telework.

The assessment may require an on-site visit at a USPS site or at the GSA Headquarters building, 1800 F St, NW, Washington DC, 20270.

Travel is not authorized under this contract.

iv

4.0 Tasks and Deliverables

4.1 (Task 1) Annual Conformity Review Assessment

a. The contractor shall provide evidence that the assessment will be conducted by an approved Kantara Initiative assessor listed on the Kantara Initiative assessors page (https://kantarainitiative.org/800-63-rev-3-accredited-assessors/) at the time of award.

b. The contractor shall review and provide recommendations on the Login.gov Annual Conformity Review application and artifacts using the criteria within the Kantara-IAF-1340-Service-Approval-Handbook. The scope of the review shall include the following assessments:

i. NIST 800-63-3A (IAL2)

ii. NIST 800-63-3B (AAL2)

c. The contractor shall conduct an ACR following the criteria within the Kantara-IAF-1340-Service-Approval-Handbook and provide an initial and final assessor report for each ACR.

Login.gov will provide the following documentation and additional documentation as requested.

i. Kantara application

ii. Service Description (S3A)

iii. Organizational Control Assessment workbook (CO_SAC)

iv. Kantara 63A control assessment workbook (63A SAC_SoCA)

v. Kantara 63B control assessment workbook (63B SAC_SoCA)

vi. Other documents referenced in the above.

https://kantarainitiative.org/800-63-rev-3-accredited-assessors/ iv

Deliverables Related to Task 1

Related

PWS

Section

Deliverable Description Due Date & Format

4.1.A Proof as a Kantara Accredited Assessor

At time of award, format varied.

4.1.C Written report providing suggestions for Login.gov to remain in continued compliance with the conformance criteria. (i.e. Assessor may add remarks to the Service Assessment Criteria worksheet highlighting areas that could use further risk mitigation or monitoring

Agreed upon after award, agreed upon format.

4.1.C Initial Draft Login.gov Kantara Annual Conformity Review Assessor Report based on scope reviewed in 4.1.B

Agreed upon after award, Kantara Assessor Report Format

4.1.C Final Login.gov Kantara Annual Conformity Review Assessor Report based on scope reviewed in 4.1.B

September 1 of the year the ACR is due, Kantara Assessor Report Format

4.2 (Task 2) FAL2 Application (Optional) Login.gov’s initial Triennial application did not include FAL2. During the PoP of this order, Login.gov may pursue FAL2 trust mark approval. If Login.gov pursues FAL2 approval, the contractor shall:

A. Review and provide recommendations on the Login.gov FAL2 Triennial application and artifacts using the Kantara audit criteria posted at https://kantarainitiative.org/trustoperations/classes-of-approval/. The scope of the audit shall include the following assessment:

● NIST 800-63-3C

iv

B. Conduct a Kantara assessment following the scope of the Login.gov Kantara application and artifacts to provide an initial and final assessor report following the Kantara format.

Login.gov will provide the following documentation and additional documentation as requested.

vii. Kantara application

viii. Service Description (S3A)

ix. Organizational Control Assessment workbook (CO_SAC)

x. Kantara 63C control assessment workbook (63C SAC_SoCA)

xi. Other documents referenced in the above.

Deliverables Related to Task 2

Related

PWS

Section

Deliverable Description

Government Data Rights

Due Date & Format

4.2.A Login.gov Kantara application and artifact report.

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Agreed upon after award, agreed upon format.

4.2.B Internal written report providing suggestions for Login.gov to remain in continued compliance with the conformance criteria. (i.e. Assessor may add remarks to the Service Assessment Criteria worksheet highlighting areas that could use further risk mitigation or monitoring)

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Agreed upon after award, agreed upon format.

iv

4.2.B Initial Draft Login.gov Kantara Assessor Report based on scope reviewed in 4.2.A

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Agreed upon after award, Kantara Assessor Report Format

4.2.B Final Login.gov Kantara Assessor Report based on scope reviewed in 4.2.A

Unlimited Rights, per FAR 27.404-1(a) and 52.227-14

Agreed upon after award, Kantara Assessor Report Format

4.3 General Deliverables

The following deliverables are not specific to one task, but are applicable to the entire order.

7.1 Contractor Project Management

Plan

Due at Kickoff meeting, Agreed upon after award

4.4 Basis of Deliverable Acceptance

The inspection and acceptance of deliverables will be conducted in accordance with FAR clause 52.212-4, paragraph (a) Inspection and Acceptance. In addition, the Government will inspect all the deliverables received from the contractor within ten (10) business days of receipt. If the Government provides the contractor with comments on the deliverable submission, the contractor will address all comments and return a final version of the deliverable within five (5) business days from receipt of the Government comments. The contractor can expect up to three rounds of review and comments for all submitted deliverables. The inspection of deliverables will be performed by the Government COR and Technical Lead. The COR will approve and accept all deliverables. The Contracting Officer and COR are the only authorized Government personnel who can accept a deliverable under this contract.

iv

5.0 Quality Assurance

5.1 Performance Standards

The assessment shall be in accordance with Kantara Initiative KIAF 1340 – Service Approval Handbook.

6.0 Personnel

6.1 Key Personnel

The government considers Key Personnel to include all contractor team members (e.g.

firm employees, independent contractors, subcontractor employees, etc.) necessary to demonstrate the contractor’s technical capability to deliver the requirements of this Purchase Order. Designation as Key Personnel is not tied to any specific labor category, function, or level, and is at the sole discretion of the contractor.

At a minimum, the contractor shall identify one member of the Key Personnel that:

● Has a full understanding of the technical approach discussed during the negotiations and at the kickoff meeting with the contractor after award;

● Will be a direct liaison to the CO, COR and GSA Client Product Owner. In this capacity, this individual shall be responsible for the supervision and management of the contractor’s personnel, technical assistance, and interface. All costs associated with these functions shall be incorporated into the FFP.

6.2 Non-Personal Services

The support services provided under this contract are not related to Federal employment requirements nor do they involve temporary help services that may be authorized under 5 CFR Part 300. This contract will not be for personal services. In order to preclude an employer/employee relationship, the Government shall only provide technical, task related instructions sufficient for Contractor’s employees to properly perform services under the contract. See FAR Part 37 for more details.

iv

Performance under this contract will be by individuals employed by a private sector firm.

The Contractor, and not the U.S. Government, is the legally responsible employer and supervisor and will maintain that relationship during the contract’s period of performance. Discipline issues shall be the responsibility of the employer, not the Government.

7.0 Post Award Administration

7.1 Technical Kickoff Meeting

The government's team, CO/COR and the tech lead and team, will hold a kickoff meeting with the contractor within 7 calendar days of the acquisition award, unless otherwise agreed upon by all parties in writing (email will be sufficient). This kickoff will include the contractor’s team and other relevant government staff to review and clarify the project’s objectives, expectations from the government, and address any questions the contractor may have. This meeting will be held via video-conference. The contractor shall present, for review and approval by the government, a Contractor Project Management Plan Package that details the intended approach, work plan, and a project schedule. The government team will provide feedback and suggestions for revision to the contractor three (3) days after the kickoff meeting.

The contractor shall provide the government team a final version of the Contractor Project Management Plan three (3) days after receiving feedback and revisions from the government team. The package shall include a work planning and delivery approach, milestone schedule, and constraints.

7.2 Limitations on the Release of Contract Award

Information to the Public, News Media, and Members of Congress

7.2.1 General

The Contractor, its affiliates, agents, or subcontractors, and respective employees:

Shall not issue press releases or provide other information to the public, news media, or Members of Congress regarding any TTS contract award without prior written authorization by the Contracting Officer (CO) specified in the contract.

iv

Must cooperate with the TTS Outreach Team and CO in releasing unclassified information to the public, news media, and Congress regarding TTS policies, programs, and activities directly related to the contracting effort outlined herein.

Are typically restricted from statements to the media or from issuing press releases regarding their services, under the contract.

Must notify the CO or Acquisition Division (AcqDiv) immediately upon receipt related to activities or situations that may attract regional or national news media attention and of non-routine inquiries from national news media relating to the effort performed under the contract, upon immediate discovery.

Shall not issue or sponsor advertising or publicity that states or implies that the federal government agency endorses, recommends, or prefers the Contractor's services.

Shall not use the agency’s logo, or other material, without agency permission.

7.2.2 Guidance

Contactor’s shall submit all requests for press release approval to the CO specified in the contract. Requests for approval shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit requests to the CO at least 15 business days before the proposed date for release. The CO will review the press release and forward it to the Technology Transformation Services (TTS) Outreach Team for their concurrent review and approval. Depending on the nature and/or content of the release, the TTS Outreach Team may elevate the request to the Office of Strategic Communication (OSC) for their review and approval.

Contractors may proceed with issuing a press release once written approval has been granted by the CO. Final approval may take up to ten business days to be granted.

The Contractor agrees to include a similar requirement process in each subcontract under this contract. Subcontractors shall submit requests for authorization to release through the prime contractor to the CO.

7.3 Government Furnished Information (GFI)

The government will furnish any necessary data throughout the PoP. All GFI will be approved by the TTS COR. All contractor personnel supporting the contract shall receive a GSA.gov email and GSA network access. When a GSA.gov email is created, the GSA.gov email shall be used for correspondence between the contractor and government to the maximum extent possible.

iv

Anticipated information includes:

● GSA.gov email

● GSA network access (ENT)

7.4 Government Furnished Equipment (GFE)

GFE will not be issued for this contract.

7.5 Security Clearances

In accordance with FAR 52.204-9 and GSAR 552.204-9, the contractor shall comply with GSA personal identity verification requirements. Contractor personnel shall be required to obtain and maintain security badges and adhere to the applicable installation security requirements. For work associated with this contract, a T2 level clearance is required. Homeland Security Presidential Directive (HSPD-12) mandates the issuance of a common form of identification for all federal employees and contractors for use in accessing government-controlled facilities and information systems. If applicable, contractor employees that require access to GSA facilities (including IT systems) for six months or more will be required to pass a National Agency Check with Credit background investigation and obtain the HSPD-12 Tier 2 level clearance, if necessary for performance, before receiving computer access. The contractor shall be responsible for the cost of complying with HSPD-12 requirements.

CIO 21001P GSA Information Technology Security Policy, January 31, 2024 or superseding GSA order will be incorporated into this task order.

Note: The contractor will not be issued personal identity verification cards.

7.6 Travel/Other Direct Costs/Order-Level Materials

Travel expenses are not authorized.

7.7 Transition Period/Plan

The contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the government or another contractor, may continue them. Up to eight (8) weeks before the end of the period of performance, at the CO’s request, the contractor will:

iv

1. Document and provide support for transition of services to another environment, if necessary.

2. Provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

3. Exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

4. Provide all requested data assets to the government team in the format specified.

The government team will need sufficient time to complete data verification procedures and will need access to the contractor team for discussions and any data format revisions. It will be the contractor’s responsibility to correct any errors found during the Government’s verification process at no extra charge.

7.8 Termination

If the contract expires (including if an option period is not exercised) or is terminated early, the vendor shall transfer all project materials to the CO/COR and the Tech Lead immediately upon receiving notice of termination or non-exercise of option, or three weeks prior to expiration. In addition, the vendor shall hand over anything that was completed and not delivered in accordance with section Deliverables. This will be completed within two weeks of the CO/COR’s and the Tech Lead.

8.0 TTS Policies

8.1 Section 508 Compliance

The contractor shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed.

Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) requires that when Federal agencies develop, procure, maintain, or use electronic information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public iv seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

The contractor should review the following websites for additional 508 information:

https://www.section508.gov/buy/standards-exceptions/ https://www.access-board.gov/ict/ http://www.w3.org/WAI/Resources}}

8.2 Privacy Act

Performance of this contract may require that personnel have access to Privacy Information. The contractor personnel shall adhere to the Privacy Act, Title 5 of the U.S.

Code, Section 552a and any other applicable rules and regulations.

8.3 Protection of Information

The contractor shall be responsible for properly protecting all information used, gathered, disclosed, or developed as a result of work under this Task Order. The contractor shall also protect all Government data by treating information as sensitive. All information gathered or created under this Task Order shall be considered as Controlled Unclassified Information (CUI). The performance of work under this Task Order may require contractor personnel to have access to Personally Identifiable Information (PII), as defined in OMB memorandum M-07-16 and as further governed by the Privacy Act, Title 5 of the United States Code, Section 552a, and other applicable law. Contractor personnel shall comply with all applicable rules, regulations, and policies governing the use and safeguarding of PII.

All contractor key personnel, employees, agents, subcontractors and subcontractor personnel who will have access to documents or data during the performance of their duties under the contract shall execute a Non-Disclosure Agreement and return it to the CO within 5 calendar days of award and before being given access to such information or documents.

8.4 Data Rights and Ownership of Deliverables

All deliverables shall be delivered to the Government with Unlimited Government Rights per FAR 27.404-1(a) and FAR clause 52.227-14.

Additionally, TTS intends that any data or deliverable created as a result of the work performed under the task order be publicly accessible without restriction.

https://www.section508.gov/buy/standards-exceptions/ https://www.access-board.gov/ict/ http://www.w3.org/WAI/Resources iv

Ownership of code repositories furnished as Government-Furnished Information (GFI) and Government-provided data entered into any and all systems shall reside with the Government.

The contractor shall place the following copyright notice on all materials, documents, deliverables, etc. developed during performance of this contract.

COPYRIGHT NOTICE: This work, authored by {{Contractor}} employees, was funded in whole or in part by federal funds under U.S. Government contract [number] and is, therefore, subject to the following license: The Government is granted for itself and others acting on its behalf a paid-up, nonexclusive, irrevocable, worldwide license in this work to use, reproduce, modify, prepare derivative works, disclose, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government.

All other rights are reserved by the copyright owner.