A1 RFI FEMA CMS 07-15-2021 - FINAL.pdf

RFI – FEMA Crisis Management System

1 Synopsis

Federal Emergency Management Agency (FEMA), a component of Department of Homeland Security (DHS), is the nation’s preeminent emergency management agency. FEMA’s primary mission is helping people before, during, and after disasters. FEMA protects the Nation from all hazards, including natural disasters, acts of terrorism, and other man-made disasters, by leading and supporting the Nation in a risk-based, comprehensive emergency management system of preparedness, protection, response, recovery, and mitigation.

FEMA operates under several statutory authorities including the Robert T. Stafford Disaster Relief and Emergency Assistance Act, PL 100-707, the Homeland Security Act of 2002, PL 107–296, and the Homeland Security Appropriations Act of 2007, PL 109-295.

FEMA currently utilizes ESI’s WebEOC for its Crisis Management System. As part of FEMA’s ongoing market research, it is issuing this Request For Information (RFI) to gather vendor information pertaining to availability of potential Commercial off the Shelf (COTS) solutions.

In accordance with Federal Acquisition Regulation (FAR) 10.002(b)(2)(i) this notice is issued solely for the purpose of market research. This request is for planning purposes only, and does not constitute a solicitation or an indication the government will contract for the items contained in this notice. This notice is not to be construed as an acquisition Request for Proposal (RFP), nor is any commitment on the part of the government to award a contract implied, nor does the government intend to pay for any information submitted as a result of this request. The government does not reimburse respondents for any cost associated with submission of the information being requested or reimburse expenses incurred to interested parties for responses to this notice. Any response received will not be used as a proposal. FEMA is not, at this time, seeking proposals and will not accept unsolicited proposals.

After reviewing responses to this RFI, FEMA may request respondees to provide a live demonstration of their capabilities and platform at FEMA HQ in Washington, D.C. for the purpose of market research.

2 Description of FEMA’s Web Emergency Operation Center

FEMA’s Crisis Management System (CMS) is a core DHS/FEMA mission essential system used in supporting Response and Recovery disaster-based operations by providing communications to the field 365 days a year. The system supports FEMA, its many locations across the country including FEMA Headquarters, Regions, and Field units, and its partners such as all federal interagency members, Non-Governmental Organizations (NGO’s), and State, Local, Territory and Tribal (SLTT) organizations participating in both National and Regional Disaster Activations and National Events.

The CMS is currently securely deployed on the Amazon Cloud and provides FEMA and its strategic partners with seamless access to time-critical event information to maintain an effective level of situational awareness. Its web interface allows access from a wide array of internet-enabled platforms that provides response workers the flexibility needed as they respond to disasters. Authorized users can monitor and manage emergency operations during planning, mitigation, and response/recovery phases from anywhere in the world.

The FEMA CMS currently supports Response and Recovery disaster-based operations for over 19,700 users, 365 days a year both CONUS and OCONUS for the following:

• Resource Requests

• Mission Assignments (MA) that FEMA issues to other federal agencies directing the completion of a specific request for assistance in response to, a Presidential declaration of an emergency or a major disaster.

• Requests For Information (RFI)

• Joint Field Office/Joint Recovery Offices’ Management of Records & Reports

• Disaster Relief Fund Resource Requests, Tracking, and Auditing

• Incident Action Planning (IAP), & National/Regional Support Plans (NSP/RSP)

• Situational Awareness (e.g., Lifelines, Disaster Information Collection, Resources)

• Tools that assist in the coordination of Lifeline Stabilization & Recovery via Operations, Planning, Logistics, and Finance

• Job Aids for Just-in-Time Learning (e.g., Micro-Learning)

• Operational readiness through uninterrupted service 24 hours a day 365 days a year

3 Specific Questions

1. What is your company name?

2. What is your DUNS number?

3. Who is your point of contact (name, phone number, e-mail)?

4. What is your business size and any special classifications?

5. Is your company on any GSA Schedules or GWACs? Which ones?

6. What COTS CMS solution does your company provide? Are you suggesting the use of one product or a combination of software products to meet the FEMA requirement?

Please describe your suggested solution.

a. Does your system have the capability of hosting more than 19,000 users in a single enterprise solution?

b. Do you have experience and the capability to seamlessly transfer millions of historical digital data records without loss of functionality?

c. Do you have the capability to transfer hundreds of thousands of live data records from another CMS to your solution while actively supporting hundreds of active disasters with no loss of functionality?

i. Please provide details on how you would facilitate the transition of data, from one production environment into another, while maintaining both integrity and availability.

d. Do you have experience in providing training and support for 19,000+ users before and after system cross over?

e. Please provide detailed examples of functionality in your solution, which mirrors current FEMA WebEOC Capabilities.

f. Please provide detailed examples of functionality in your solution, which is not currently available in FEMA’s WebEOC.

g. Please provide detailed examples on capabilities which would not be immediately comparable to current FEMA WebEOC functionality, and provide examples on how you would overcome that loss of capability.

h. Please provide detailed examples on how you have augmented, or would augment a COTS product to bridge any technilogical gaps.

i. What services does your company provide?

j. Are you an authorized WebEOC reseller?

i. If a WebEOC reseller, does your company have the capability and experience to address all the questions outlined above and provide the related services?

k. Is your system capable of addressing at an enterprise level multiple tiered operational incidents at the Continental U.S. (CONUS) / Outside Continental U.S.

(OCONUS) level?

l. Is your company a software license reseller?

m. Does your solution include an available API capability?

7. Can your company provide this solution on your own or would you partner with another company?

8. Can this system be scaled for users outside of DHS across any government agency?

Please explain how since each agency has its own special requirements regarding IT security.

9. Please provide details on how you have, or would, support existing system interconnections

10. What Development, Operations and Maintenance Support services does your company provide?

a. Does your company have government contract experience.

b. Does your company have experience in providing System Engineering Life Cycle

(SELC) process support

11. Does your company provide FedRAMP certified AWS Cloud Hosting Services?

a. If not AWS, which FedRAMP certified Cloud site do you utilize?

b. Please list level of FedRamp certification and what services are available?

c. Does your company have the capability to provided lift and shift services from one cloud to another?

i. Please provide details on how you would facilitate this transition. if neededWhat services are available?

12. Are you interested in providing a market research product demo either in-person in the Washington, D.C. region, or virtually via a DHS-compatible meeting platform using your own subscription?

13. What Government Agencies does your company currently support?

a. Do they have current Authority to Operate (ATO)?

b. Is your company familiar with the following:

1. DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information

2. DHS Sensitive Systems Policy Directive 4300A

3. DHS 4300A Sensitive Systems Handbook and Attachments

4. DHS Security Authorization Process Guide

5. DHS Handbook for Safeguarding Sensitive Personally Identifiable

Information

6. DHS Instruction Handbook 121-01-007 Department of Homeland Security

Personnel Suitability and Security Program

7. DHS Information Security Performance Plan (current fiscal year)

8. DHS Privacy Incident Handling Guidance

9. Federal Information Processing Standard (FIPS) 140-2 Security

Requirements for Cryptographic Modules accessible htttp://csrc.nist.gov/groups/STM/cmvp/standards.html

10. National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

11. 11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at

12. http://csrc.nist.gov/publications/PubsSPs.html.

4 RFI Response Instructions

4.1 Response Format Requested

Your responses must be provided in narrative or tabular format no later than 3:00 p.m. ET, July 27, 2021 to Hal Vernon at hal.vernon@fema.dhs.gov and Marianne McCallum at marianne.mccallum@fema.dhs.gov.

Please answer the questions in Section 3 above. As applicable, provide any additional information on products that your company provides along with a brief description of the approach your organization would take in providing the products contemplated in this RFI.

Responses are to be a maximum of 10 pages.

http://csrc.nist.gov/publications/PubsSPs.html mailto:hal.vernon@fema.dhs.gov mailto:marianne.mccallum@fema.dhs.gov

Please also provide a demo of your product to accompany your RFI.

The responses to this RFI will be reviewed by staff from the FEMA Response Directorate, Operations Division, Operations Capability Office, Crisis Management System Program Management Team and might be used to develop requirements for future acquisitions.

4.2 Information for the Response

The release of this RFI does not guarantee that the government will complete an acquisition. This RFI is for information and planning purposes only and does not constitute a solicitation for bids, proposals, or quotes and is not to be construed as a commitment by the government to issue a request for proposal/quote or award of a contract as a result of this request. This announcement is not a Request for Proposal (RFP) nor a Request for Quote (RFQ). The government will not reimburse respondents for any cost associated with information submitted in response to this request.

Small businesses are encouraged to provide responses to this RFI, in order to assist FEMA in determining the potential levels of interest, competition, and technical capability within the Small Business community.

4.3 How to Deliver the Response

Questions and requests for clarifications on this RFI must be received no later than 5:00 PM EDT on July 22, 2021.

Response packages should be sent via email. The subject line of email submissions must contain the RFIs number, 70FA3021I00000009.

Response Due Date: Responses must be submitted no later than July 27, 2021.