RFI 70FA3021I00000003 WebEOC 2021 02 11 rv 1.pdf

pg. 1

Request for Information

Web Emergency Operations Center (WebEOC) Crisis Management System

Operations, Maintenance and Development Support Services

Federal Emergency Management Agency Response Directorate

Office of Response and Recovery

February 11, 2021

RFI 70FA3021I00000003 – FEMA WebEOC

pg. 2

1 Synopsis

Federal Emergency Management Agency (FEMA), a component of Department of Homeland Security (DHS), is the nation’s preeminent emergency management agency. FEMA’s primary mission is to reduce the loss of life and property and protect the Nation from all hazards, including natural disasters, acts of terrorism, and other man-made disasters, by leading and supporting the Nation in a risk-based, comprehensive emergency management system of preparedness, protection, response, recovery, and mitigation.

FEMA operates under several statutory authorities including the Robert T. Stafford Disaster Relief and Emergency Assistance Act, PL 100-707, the Homeland Security Act of 2002, PL 107–296, and the Homeland Security Appropriations Act of 2007, PL 109-295.

FEMA intends to procure continued upgrades and support for the WebEOC Crisis Management System as well as maintain access to the Commercial Of The Shelf (COTS) product owned by Juvare. As part of the research, FEMA is issuing this Request For Information (RFI) to gather vendor information pertaining to availability of devices that will meet our requirements.

In accordance with Federal Acquisition Regulation (FAR) 10.002(b)(2)(i) this notice is issued soley for the purpose of market research. This request is for planning purposes only, and does not constitute a solicitation or an indication the government will contract for the items contained in this notice. This notice is not to be construed as an acquisition Request for Proposal (RFP), nor is any commitment on the part of the government to award a contract implied, nor does the government intend to pay for any information submitted as a result of this request. The government does not reimburse respondents for any cost associated with submission of the information being requested or reimburse expenses incurred to interested parties for responses to this notice. Any response received will not be used as a proposal. FEMA is not, at this time, seeking proposals and will not accept unsolicited proposals.

After reviewing responses to this RFI, FEMA may allow respondees to provide a demonstration of their devices for the purpose of market research.

2 Purpose

The purpose of the RFI is to acquire market research on contractual support in the continuation of the successful operations, maintenance, support and system evolution of FEMA’s WebEOC Crisis Management System. The government is seeking information in the following areas:

continued network systems support, installations, integrations, external interconnections, board development, maintenance, documentation and training system capabilities encompass the areas of operations, planning, logistics, while also providing situational awareness to our Federal, state, tribal and local strategic partners.

pg. 3

3 Description of FEMA’s Web Emergency Operation Center

FEMA’s WebEOC Crisis Management System (CMS) is a core DHS/FEMA mission essential system used in supporting Response and Recovery disaster-based operations by providing communications to the field 365 days a year. The system supports FEMA and its partners such as FEMA Headquarters, Regions, Field units, all federal interagency members, and States, Local, Territories and Tribes (SLTT) partners participating in both National and Regional Disaster Activations and National Events.

The WebEOC CMS is securely deployed on the Amazon Cloud and provides FEMA and its strategic partners with the seamless access to time-critical event information to maintain an effective level of situational awareness. Its web interface allows access from a wide array of internet-enabled platforms that provides response workers the flexibility needed as they respond to disasters. Authorized users can monitor and manage emergency operations during planning, mitigation, and response/recovery phases from anywhere in the world.

The system currently supports over 18,300 users an increase of 1500% since launching in 2012 exceeding all expectations. FEMA’s WebEOC currently supports Response and Recovery disaster-based operations that rely on WebEOC 365 days a year throughout the lifecycle of disasters for the following:

• Work orders such as Mission Assignments (MA) that FEMA issues to another federal agency directing the completion of a specific request for assistance in response to, a Presidential declaration of an emergency or a major disaster.

• Joint Field Office/Joint Recovery Offices’ Management Records & Reports

• Disaster Relief Fund Resource Requests, Tracking, and Auditing

• Incident Action Planning (IAP), & National/Regional Support Plans (NSP/RSP)

• Situational Awareness (e.g., Lifelines, Disaster Information Collection, Resources)

• Tools that assist in the coordination of Lifeline Stabilization & Recovery via Operations, Planning, Logistics, and Finance

• Job Aids for Just-in-Time Learning (e.g., Micro-Learning)

• Operational readiness through uninterrupted WebEOC service 365 days a year, 24/7

4 Specific Questions

1. What knowledge and experience does your company have in the overall process of WebEOC/CMS?

2. How would you acquire, operate and maintain a DHS compliment of automated security assessment tools and use them to assess the evolving WebEOC/CMS system according to the DHS 4300A Sensitive Systems Handbook?

pg. 4

DHS 4300A mandates DHS Components procuring Commercial off the Shelf (COTS) information systems must ensure security requirement planning is built into all aspects of the System Engineering Life Cycle (SELC) process.

3. Describe your experience in simultaneous management of multiple tiered operational incidents at the national level. Please provide program points of contact and their contact information.

4. Describe how you would keep WebEOC in compliance with requirements to maintain a current & valid Authority to Operate (ATO) certification to include: Security Plans, Configuration Management Plans, Contingency Plans, Contingency Plan Tests, Incident Response Plans, Vulnerability Remediation Plans and other artifacts as needed in accordance with:

1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for

Official Use Only) Information

2) DHS Sensitive Systems Policy Directive 4300A

3) DHS 4300A Sensitive Systems Handbook and Attachments

4) DHS Security Authorization Process Guide

5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program

7) DHS Information Security Performance Plan (current fiscal year)

8) DHS Privacy Incident Handling Guidance

9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible htttp://csrc.nist.gov/groups/STM/cmvp/standards.html

10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html.

5 RFI Response Instructions

5.1 Response Format Requested

Your responses must be provided in narrative or tabular format no later than 5:00 pm EST March 1, 2021 to Hal Vernon at hal.vernon@fema.dhs.gov and Marianne McCallum at marianne.mccallum@fema.dhs.gov.

Please answer the questions in Section 4 above. As applicable, provide any additional information on products that your company provides along with a brief description of the approach your organization would take in providing the products contemplated in this RFI.

http://csrc.nist.gov/publications/PubsSPs.html mailto:hal.vernon@fema.dhs.gov mailto:marianne.mccallum@fema.dhs.gov

pg. 5

Responses are to be a maximum of 10 pages.

The responses to this RFI will be reviewed by staff from the FEMA Response and Recovery Directorate, Operations Division, Operationas Capability Office, WebEOC/Crisis Management System Program Management Team and might be used to develop requirements for future acquisitions.

5.2 Information for the Response

The release of this RFI does not guarantee that the government will complete an acquisition. This RFI is for information and planning purposes only and does not constitute a solicitation for bids, proposals, or quotes and is not to be construed as a commitment by the government to issue a request for proposal/quote or award of a contract as a result of this request. This announcement is not a Request for Proposal (RFP) nor a Request for Quote (RFQ). The government will not reimburse respondents for any cost associated with information submitted in response to this request.

Small businesses are encouraged to provide responses to this RFI, in order to assist FEMA in determining the potential levels of interest, competition, and technical capability within the Small Business community.

5.3 How to Deliver the Response

Questions and requests for clarifications on this RFI must be received no later than 5:00 pm EST February 24, 2021.

Response packages should be sent via email.

Response Due Date: Responses must be submitted no later than 5:00 PM, EST March 1, 2021.