70FA3124I00000002 FY25 Pivot OM Statement of Work.pdf

1 | P a g e

National Flood Insurance Program

Federal Insurance Directorate Office of Resilience

Information Technology, Systems Operations, Maintenance & Development

Statement of Objectives (SOO)

November 2, 2023

2 | P a g e

Statement of Objectives

Background

The U.S. Department of Homeland Security’s Federal Emergency Management Agency (FEMA) is procuring contracts to support the National Flood Insurance Program (NFIP). The NFIP aims to reduce disaster suffering by providing affordable insurance to property owners, renters, and businesses as well as encouraging communities to adopt and enforce floodplain management regulations. The NFIP is conducting transformation activities that will update the products, processes, and procedures that support the program. NFIP contracts will support the direct sale and servicing of NFIP policies, communications, operations and maintenance of IT systems, standard business operations, and project management. Universal objectives are provided below. Additional information specific to each contract will be provided through additional industry engagement methods deemed appropriate.

3 | P a g e

Universal Assumptions and Constraints

1. All activities will align to DHS/FEMA/Resilience/FID strategies and intents.

2. The NFIP has several systems to manage its technology work, including the NFIP Pivot (Pivot) system.

3. Pivot is NFIP’s System of Record (SOR) for flood insurance policy and claims information and financial transactions.

4. FEMA is updating the NFIP’s policy forms, and although some will be finalized, not all will be completely in place at the time of contract award.

5. The NFIP will continue to operate according to current statutory authorities and regulations, but Pivot operations and development must remain flexible and agile given changes that may arise from FEMA policy and program initiatives, updated regulations, or passage of new legislation.

6. The NFIP will embrace data and fraud analytics to drive better operations through improved oversight, speed, quality, and customer service.

7. The NFIP will embrace industry-standard customer experience models (digital sales, mobile claims through smartphone applications, agents at the call center, etc.).

8. The NFIP will strengthen and expand partnerships with the private sector, including through appropriate performance incentives tied to achievement of FID’s program objectives.

9. Pivot communications and outreach activities are coordinated, integrated, and consistent with NFIP messaging.

10. Data security and privacy issues are a major focus of the Federal Government’s IT efforts. All program activities shall be compliant with the Government Information Security Reform Act, OMB policies, DHS policies and mandates, and FEMA requirements.

11. Solutions shall include transition plans, detailing how continuity of services will be maintained (e.g., operations of IT systems in various states of health and development, ongoing marketing and sales efforts, project management, etc.).

12. Issues that arise to impact continuity of service will require documented root cause analyses (RCAs) and resolution(s) when an outage occurs.

1. Scope

FEMA requires a Contractor, hereinafter referred to as “Contractor,” to provide project management, data reporting and analytics, DevSecOps utilizing the Agile SAFe methodology, and support services for the Pivot system which serves as the NFIP’s System of Record (SOR), as well as other affiliated applications in support of the NFIP. This means that FEMA requires a wide array of IT services in support of a mixed-financial system. Sections 1.1 – 1.6 provide details for the major functions that need to be provided by the Contractor. Where applicable, these sections contain references to supporting documentation that further define the requirements for that section.

The Contractor will serve as a subject matter expert (SME) and a source of information for FEMA staff, Write-Your-Own (WYO) insurance companies, and the NFIP Direct Servicing Agent (NFIP Direct) contractor as they work to provide the information required by the NFIP to execute flood insurance business operations, leveraging Pivot and other NFIP applications. The Contractor shall support activities that include tracking, collecting, disseminating, maintaining, and updating information on the NFIP applications.

4 | P a g e

The work that the Contractor will perform shall be UNCLASSIFIED. It should be noted that a substantial amount of data is considered Personally Identifiable Information (PII) or Sensitive Personally Identifiable Information (SPII) and shall be handled as required by FEMA, DHS, OMB, and all applicable federal statutes.

Operating Assumptions and Constraints

Pivot became the NFIP’s System of Record (SOR) in October 2019 and attained Full Operating Capability (FOC) in the Fall of 2020. The Contractor shall present solutions to develop, operate, and maintain the NFIP’s applications to meet the program’s current and future needs. All data, licensed software, custom-coded software, and ancillary systems are owned by FEMA and are transferable to subsequent FEMA contractors.

Table 1 identifies the operating assumptions and constraints:

Assumptions and Constraints

1) The NFIP is frequently reauthorized and reformed through legislative processes, changes to regulations, and FEMA policy and program initiatives. The support provided in this contract shall use the Agile SAFe methodology to provide flexibibility and to rapidly adapt to and incorporate program changes and deliver solutions through the NFIP’s IT systems, often within short time constraints. While exact programmatic changes and turnaround requirements cannot be specified, the types of skills and services provided through this contract shall be sufficient to meet program needs.

2) Pivot and NFIP systems are primarily Agile SAFe development projects but may require non-Agile development support.

3) Solutions shall align to DHS/FEMA strategic goals and constraints, FEMA’s Target Enterprise Architecture, including the Technical Reference Model (TRM) and be a cloud-based solution hosted within the FEMA Enterprise Cloud.

4) The Contractor solution shall be aligned with required DHS/FEMA Security, Quality Assurance (QA), Quality Control (QC), and Continuous Monitoring activities to maintain a DHS Authority to Operate (ATO). All program activities shall be compliant with the Government Information Security Reform Act, OMB policies, FEMA, and all applicable DHS requirements.

5) The Contractor shall utilize existing environments as necessary for development, testing, beta, staging, pre-production, production, and sustainment activities. FEMA will also have access to these environments.

6) The Contractor shall fully comply with applicable statutes and demonstrate working knowledge and understanding of applicable regulations, policies, guidelines, and specifications that affect the NFIP, FEMA, and DHS.

7) The Contractor shall establish and maintain interfaces with systems that are both internal and external to FEMA for all NFIP systems. These interfaces shall be documented in ISAs, MOA’s, or MOUs, as applicable.

8) FEMA shall provide the designated Information System Security Officers (ISSOs) for the systems supported by this contract, though the Contractor shall have cybersecurity experts on staff to support development, operations, incident response, security, and maintenance activities.

9) The Contractor shall ensure that the system meets or exceeds the Key Performance Parameters (KPPs) as defined within the Pivot Operational Requirements Documents (ORD) and Acquisition Program Baseline (APB), as well as the Measures of Performance (MOP) within the Test and Evaluation Master Plan (TEMP).

10) Pivot is currently categorized as a Federal Information Processing Standard (FIPS) 199 “Mod/Mod/Mod” system and requires commensurate levels of system security.

5 | P a g e

a. The target solution requires a security authentication and authorization process that shall integrate with DHS Enterprise Security and shall comply with DHS Sensitive Systems Policy Directive 4300A, Homeland Security Presidential Directive 12, and any other applicable DHS security requirements such as Personal Identify Verification (PIV) enablement and Single-Sign-on (SSO).

b. The Contractor shall have the ability to design and implement changes to raise the FIPS 199 categorization levels to “High/High/High” (confidentiality, integrity, and availability) or other options should the need arise.

11) The security authentication and authorization for Pivot and other NFIP systems shall comply with the security control families set forth in the latest version of the NIST Special Publication (SP) 800, Security and Privacy Controls for Federal Information Systems. The Contractor shall have ability to build to future standards when published and applicable.

12) The Contractor shall maintain systems to be compliant with all relevant security controls outlined in NISTs FIPS (Federal Information Process Standards) and the Federal Information Security Management Act (FISMA) that enables the FEMA to perform activities defined by the DHS Risk Management Framework.

13) Solutions shall utilize and support open source technology as defined by FEMA Enterprise Architecture (EA).

All technology and software shall be approved for use and added to DHS’s TRM (Technical Reference Model).

14) Applications will range from internal use to public access, and services or support (user access/support).

These shall be secure and scalable to account for these varied use cases.

Table 1: Operating Assumptions and Constraints

6 | P a g e

1.1 Objective 1 – IT Operations, Maintenance and Development

Objective: Sustain current capabilities and maintain the current existing applications hosted in the FEMA Enterprise Cloud (FEC) Google Cloud Platform (GCP), identified by FEMA’s Office of the Chief Information Officer (OCIO) as the FEMA Cloud Environment (FCE) Google platform. Continuously improve and evolve Pivot’s system architecture, customer experience (CX), user experience (UX), and security practices. This objective includes integrating components of Pivot and other FEMA/Federal Insurance Directorate (FID) systems.

At a minimum, the Contractor shall:

Development:

1. Perform comprehensive development activities using Agile project management methodologies for NFIP applications to deliver new functionality; including cybersecurity, 508 accessibility compliance, application performance, etc. (Note: additional cybersecurity and privacy specific objectives are listed in the section below.)

2. Deliver enhancements and bug fixes to NFIP applications, focusing on accessibility, usability, and user acceptance of the system.

3. Continuously improve Pivot system integration to ensure interoperability with other FEMA systems and applications. (Note: A current list of planned interfaces is provided in the list of attachments, though any future development is not limited to the list attached.)

4. Develop and maintain proper documentation of all conducted activities throughout NFIP application development lifecycles including, but not limited to: development-related documentation (e.g. requirements backlog, risk register, Security documentation (e.g System Design Documentation), Release documentation (e.g. Security Scans, Test Plans, Configuration Management Plan), Testing documentation (e.g. Quality Assurance/Quality Control Plan, Test cases), and other system documentation to support system change control activities.

5. Mobile device application development, including iOS and Android, and responsive website development for NFIP systems on all user interfaces on multiple devices.

6. Implement and utilize cloud based development or Cloud Native Development.

7. Conduct business analyses to gather and implement requirements, including but not limited to storing, tracking, and tracing all requirements to applicable documentation, requirements, tests, or other applicable repositories or work products.

8. Conduct research and development (R&D) activities to discover and realize efficiencies, leverage advances in technology, and support the evolution of the NFIP, including the development of new applications, integration and incorporation of new tools, and integration with other non-Pivot applications and data sets.

9. Provide support to address and close out all Operational Test Agent (OTA) activities and findings.

IT Operations

10. Create, support, and maintain required DHS System Engineering Life Cycle (SELC) updates and documentation, and participate in stage gate reviews.

11. Support various program audit activities, including but not limited to Government Accountability Office (GAO), Office of Management and Budget (OMB), DHS Office of the Inspector General (OIG), KPMG, FEMA OCFO A- 123, and internal audits.

12. Proactively communicate and document updates for various system elements to users and stakeholders, including:

a. System outages, downtime, updates, upgrades, other important system communication to all relevant stakeholders, including Root Cause Analysis (RCA) reporting on system and application or sub-system outages.

7 | P a g e

b. New system features, data, reports, to relevant stakeholders.

c. Architectural improvements to leverage new technogy or adapt to changing requirements.

Maintenance

13. Support Hosting Services. (Note: the Contractor shall not provide the hosting site for the Systems currently developed and maintained within this contract. FEMA may plan to add or migrate systems or applications;

therefore, as technology evolves or other hosting solutions become advantageous, the Contractor shall support research on potential platforms or other service offerings.)

a. If a need is identified, then the Contractor shall perform the migration of NFIP systems or applications to the new hosting solution.

b. If a need is identified, then the Contractor shall perform the research and propose solutions for integration and architecture, including asking and answering key questions related to these new or changing requirements.

14. Maintain and enhance different developmental, application integration, and other non-production environments to support testing and data analytics activities.

15. Maintain and monitor system security, availability, and performance utilizing tools that track, predict, and alert various teams and FEMA to outages and security incidents.

16. Provide personnel with extensive IT SecDevOps, integration, and operational support experience such that they can properly configure each Commercial Off the Shelf (COTS) component, custom software, and/or potential Government Off the Shelf (GOTS) product, to integrate with necessary components.

17. The contractor shall work with the system owner and information system security officer to track vulnerabilities, provide artifacts for Plan of Action and Milestones (POAM’s), and implement changes to close out the POAM’s.

18. Improve the Search Engine Optimization (SEO) capabilities and utilitilization of social media platforms for NFIP systems.

19. Additional operations, maintenance, development, and support elements and tasks may be identified throughout the course of performance.

1.2 Objective 2 - Software Quality Assurance (QA)

Objective: Implement and utilize a test automation framework to deliver high quality, production-ready functionality that allows minimal disruption to users, continuous releases, and rapid issue resolution as they arise. Track escaped defects into Pivot Integration Environment (PIE) maintaining a high quality of code being released into production each application release and demonstrate a trend of reduced escaped defects as evidenced by UAT, IV&V and help desk defect. Rigorously execute performance and stress testing prior to the transition of any code from Development test environment to Pivot Integration Environment (PIE), in order to anticipate any reduced performance impact by newly introduced code, and ensure the responsiveness and stability of the application and the systems that are integrated with it are maintained or improved prior to being released into Pivot Production and Operational environment.

The Contractor shall provide appropriately qualified personnel to execute testing duties to include but not limited to:

1. Perform testing in accordance with the DHS SELC guidelines for Agile development, common industry accepted standards, and the SAFe methodology.

2. Design and implement test automation solutions for all testing activities using appropriate automation tools to enable SecDevOps implementation.

3. Create and implement automated test solutions and test suite that includes, but are not limited to: functional, progression, regression, performance, security, integration, Section 508 compliance, and data

8 | P a g e preparation/loading/reset testing at both the application or sub-system level and systems integration level in each environment including PIE for validation.

4. Demonstrate system resilience and the ability to meet transaction response requirements requirements at a minimum or exceeding as specified in Pivot Key Performance Parameters (KPPs) in the Operational Requirements Document (ORD), and other program measures being monitored as agreed upon with the Program team in Quality Assurance Surveillance Plan (QASP).

5. Track code quality for release user stories/ epics including trends of errors from development to production into lifetime of that code. Demonstrate improving trends over time.

6. Provide dedicated personnel with extensive experience with monitoring tools such as audit logging, system and application performance monitoring, and Security Event Incident Management.

7. Have test personnel within the Quality Control team with industry recognized certifications such as CSQA (Certified Software Quality Analyst Certification), International Software Testing Qualifications Board Certifications (ISTQB), Certified Software Tester (CSTE), ISTQB Foundation Level (CTFL), DHS Trusted Tester or any other industry accepted certifications.

8. Have test personnel who have extensive experience with all facets of testing IT solutions to perform QC activities including but not limited to front end, backend, whitebox, blackbox, performance, test automation, and Section 508 test activities.

9. Implement a defect and resolution tracking mechanism within the testing infrastructure for tracking issues identified during discovery, documenting, and conducting of tests, through issue resolution.

10. Support third party testing activities in addition to conducting its own testing activities, such as NFIP User Acceptance Test (UAT), FEMA OCIO led independent verification & validation (IV&V) activities, and FEMA/DHS audits.

11. Develop and provide a robust, detailed Quality Control Plan (QCP) that identifies a clear end-to-end test strategy across all Pivot environments to support sustainment of current applications, change requests, and future development activities over a common Continuous Integration/ Continuous Deployment (CI/CD) pipeline or other SecDevOps release train as the the Pivot architecture evolves.

12. Develop QCP that documents the test plan and procedures to manage test activities according to industry best practices that includes, but is not limited to:

a. The QCP defines and address the Contractor’s Quality Management Approach towards Quality Control and Quality Standards implemented for Pivot in alignment with required KPPs, KPIs, and other metrics and requirements as applicable.

b. The QCP is the means by which the Contractor controls the quality of the work performed, and shall capture the process of the contractor to ensure quality that is consistent with the objectives specified in this document.

c. The QCP is sufficiently detailed to provide the government information of various positions and functions of team members who support and monitoring quality control activities.

d. The QCP identifies the reports that will be produced by the contractor to inform government of the results, reports, defect tracking trends, along with the process that inform the reports.

e. The Contractor shall provide the required QCP to FEMA’s Program COR no later than 30 days after contract award, and within five (5) business days when changes are made thereafter.

13. Use the Test-Driven Development (TDD) methodology to ensure software requirements are being converted to test cases before software is fully developed, and tracking all software development by repeatedly testing the software against all test cases.

14. Additional support elements and tasks may be identified through the course of performance.

9 | P a g e

1.3 Objective 3 – System Security

Objective: Support the development of all security authorization processes and generate all required security authorization artifacts. Work with and support the System Owner (SO) and Information System Security Officer (ISSO) to ensurse all Pivot application security complies with all DHS, FEMA, and NIST Special Publication (SP) 800-53 Revision 5, security standards.

Cybersecurity and protection of Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII) are critical to the NFIP. The Contractor shall develop, understand, and implement procedures and mechanisms to ensure security and protect PII and SPII, and support any and all related efforts:

1. The Contractor shall provide qualified personnel with industry certifications and extensive experience managing a program level security operations center (SOC).

2. The SOC team will conduct daily monitoring of the system for anomalous behavior and respond to any incidents.

3. The SOC team will conduct audits of users, applications, and databases as required by the program.

4. The Contractor shall provide qualified personnel with industry certifications and extensive experience to conduct security reviews and compliance monitoring activities, in support of the NFIP applications, maintaining an Authority to Operate (ATO), and pursuing and obtaining an Ongoing Authorization (OA) through FEMA and DHS.

5. The contractor shall hire a third-party assessment organization (3PAO) to conduct, at a minimum, penetration testing annually.

6. The Contractor shall:

a. Conduct and provide scans to the ISSO and any appropriate FEMA parties.

b. Analyze test results.

c. Create and update Remediation Plan documentation when changes are required.

d. Set up, maintain, and utilize FEMA approved security scanning tools.

7. Support Disaster Recovery (DR) solutions:

a. Support DR research for potential innovative solutions (e.g. leveraging multiple hosting solutions)

b. Support an annual Disaster Recovery exercise within the FEMA Google Cloud Environment.

c. Develop and maintain BIA (Business Impact Analysis), Contingency Plan and Continuity of Operations

(COOP) plans, inclusive of notifications and risk management.

d. Should a disaster be declared, the Contractor shall be responsible for the switch over to the alternate site in Google or other approved DR site.

e. If a need is identified, the Contractor shall conduct the migration of disaster recovery sites.

8. Additional support elements and tasks may be identified through the course of performance.

1.4 Objective 4 - Data Analytics (DA) and Reporting Capabilities

Objective: Provide data science, data management, data analytics (DA), and data reporting services to develop and support NFIP data and analytics capabilities to meet FID’s mission and business needs. Provide the ability to report and share the results of data analytics in multiple visual and/or digital formats to appropriate stakeholders and customers in a timely manner, including but not limited to: dashboards or on-demand reports for Pivot users, quick-turn major disaster or flood event support reporting, monthly reporting and support, quarterly reporting and support, biennial or

10 | P a g e biannual or other audit related reporting and support, and/or other data or reporting related support as required by request to meet mission and business needs.

The data in Pivot, the NFIP SOR, is one of FEMA’s largest assets. The NFIP must enhance its data analytics and reporting capabilities to better leverage this information to guide decision making, advance program priorities, and improve outcomes for NFIP policyholders, stakeholders, and other customers. The Contractor shall support these efforts and adhere to Federal, DHS and FEMA requirements, in alignment with the FEMA Data Strategy, the Federal Data Strategy, as well as other Data Governance and Management, Data Analytics, and Data Reporting statutes, directives, or other policies, as applicable. Additional support elements and tasks may be identified through the course of performance.

The Data Analytics and Reporting section has been divided into three groups, to streamline and simplify these objectives. The three groups are: Data Governance and Management, Data Analytics, and Reporting Capabilities. These analytics and reporting capabilities are critical both in preparation for and during and after flood events and require significant dedicated staff. Note: some items grouped below may cut across multiple categories.

Data Governance and Management

1. Support data governance at the program level by providing subject matter expertise to governance boards, facilitating engagement with Pivot user communities, enforcing and maintaining standards, and performing data cleaning and standardization as required.

2. Support FID’s development or enhancement of a Data Governance framework, including but not limited to:

a. Policies, processes, procedures, metrics, and reporting to advance data governance through, at a minimum:

i. Clear roles and responsibilities for FEMA offices, the NFIP Direct, and WYO companies and their vendors;

ii. A data model and data definitions;

iii. Data management rules and procedures;

iv. Implementation of, and compliance with, federal, DHS, and FEMA data sharing and data exposure directives and strategies;

v. Data quality assessment, metrics, and reporting; and

vi. Establishment and enforcement of data quality standards, including validation of data received from the NFIP Direct and WYO companies and their vendors.

b. Geospatial data standards to make Pivot a fully geospatially-enabled system, including at minimum requirements for:

i. Horizontal accuracy of structure locations for policies in Pivot;

ii. Vertical accuracy of structure first floor height data for policies in Pivot;

iii. Acceptable sources of structure location and first floor height data;

iv. Metadata documenting the availability and accuracy of structure location and first floor height data for all policies in Pivot;

v. Access to data on all insurable-but-uninsured structures in the United States;

vi. The timeframes when these geospatial data standards apply; and

vii. Validation and quality assurance for geospatial data and attributes.

3. Consistent with the Data Governance Plan, develop a Data Management Plan identifying how FID will manage NFIP data, data-related initiatives and associated timeframes, and risks. The Data Management Plan shall include, at a minimum, plans for developing and delivering the capabilities needed to meet FID’s data governance and management goals and processes for identifying and evaluating applications, standards, and tools to advance those capabilities.

11 | P a g e

4. Provide SMEs for standardization, integration, inventorying, reporting, storage, querying, and analysis of data to include structured, semi-structored, and/or unstructured data.

5. Improve capabilities and processes to report, share, or otherwise provide access to data for other FEMA programs, approved partners, customers, and stakeholders.

6. In compliance with the FEMA Data Strategy, data will be considered accessible to users, with the assurance that all data that is sensitive or may put the agency or policyholders at risk will be protected to prevent and/or minimize data leakage.

7. Produce and maintain thorough documentation of Pivot’s structure, business rules, and data including but not limited to a data dictionary and source data documentation to accompany data and analyses shared externally. Regularly update Pivot documentation amid ongoing Agile development of the system.

8. Enhance Pivot capabilities to efficiently copy SOR data and replicate or transform it for DA and reporting applications in near-real time while maintaining data integrity and quality, together with robust documentation and procedures for validation, reconciliation, and audits. The data will be controlled and contained in such a way that the SOR data is protected from other non-SOR data sets or manipulations.

9. Develop or enhance Pivot capabilities to record and maintain (e.g. a ledger) the history of all underwriting, claims, and financial transactions related to a policy, enabling analysis and reporting without need for periodic policy data freezes.

10. Ability to quickly make additions or updates to address new data governance or data management requirements.

Data Analytics Capabilities

11. Enhance Pivot capabilities to enable rapid and Agile DA within the Pivot environment to meet business and disaster-related needs, including but not limited to predictive analytics and fraud analytics by, at a minimum:

a. Leveraging data repositories and other architectural or related environments or capabilities;

b. Creating space and processes for testing and deploying DA tools; and

c. Enabling authorized users to conduct “self-service” analysis without additional custom development, with minimal developer support required.

12. Enhance DA application functionality by establishing or further developing two or more separate DA environments (e.g. sandboxes) to enable experimental analytics, modeling, or other business-related needs and efforts, including but not limited to: the incorporation of authorized or approved external data, data migration if necessary, data transformation, data sharing, as well as the ability to handle or manipulate multiple different data sets within the Pivot DA environments.

a. The data may consist of internal (FEMA/DHS) and /or external-entity data sets, including but not limited to geospatial and commercial data sets, either purchased or delivered as a subscription via API. These data sets may reside within a defined data analytics space within the FCE Google platform, as appropriate.

b. The data in the DA spaces may include external data that has been approved for use within the Pivot system by Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), Interconnection Security Agreement (ISA), Interagency Authorization Agreement (IAA), or other appropriate authorization document approved by the System Owner (SO).

c. The data may be analyzed at a macro (millions of records) or micro (single record) level.

d. The data may be delivered in multiple different formats to stakeholders or requestors, depending on their needs and requirements.

e. The data will be protected such that data leakage is prevented and/or minimized, with only authorized users with a need to know receiving SPII or PII.

12 | P a g e

f. The data shared to external users for transparency uses (e.g. OpenFEMA, FloodSmart reports) shall be cleansed of all SPII and/or PII to ensure required and needed protections of user data are met.

g. The data will be controlled and contained in such a way that the SOR data is protected from other non- SOR data sets or data manipulations.

13. Support NFIP data studies and geospatial analysis, including but not limited to integration of NFIP data with other FEMA and external datasets.

14. Perform ad hoc data analysis and reporting in support of the NFIP including but not limited to:

a. Support responses to Freedom of Information Act (FOIA) requests with ad hoc reporting or data analysis.

b. Support responses to quick-turn requests from the FEMA Administrator, DHS Secretary, Congressional offices, or other leadership with ad hoc reporting and/or data analysis.

c. Produce disaster-related reports for delivery to key FEMA and external stakeholders to meet mission and business needs on tight timelines under high levels of scrutiny.

d. Support development of Congressional reports and responses to internal and external audits with ad hoc reporting or data analysis.

e. Provide “Tier 1” data analysis support in the form of simple counts, extracts, or other basic data to authorized requestors on short notice within timeframes requested.

f. Provide “Tier 2” data analysis support in the form of short-term or longer-term analysis projects with guidance and oversight from FEMA analysts.

g. Develop and implement code/query management solutions and quality assurance protocols to ensure the consistency and quality of the Contractor’s ad hoc data analysis support.

15. Ability to quickly make additions or updates to incorporate new system, technology, or business requirements.

Reporting Capabilities

16. Enhance Pivot capabilities to deliver reliable dashboards and reports displaying accurate and timely data by, at a minimum:

a. Leveraging data repositories and other architectural or related environments or capabilities;

b. Providing on demand access to dashboards and reports through a streamlined user experience;

c. Utilizing commercial Business Intelligence (BI) COTS products to develop dashboards and reports faster and more effectively, reducing the time to meet business and disaster-related needs; and

d. Enabling mapping components for geospatial display and analysis of data in dashboards and reports.

17. Support the creation and implementation of a standard process for dashboard and report development that defines roles and procedures for requesting dashboards or reports, gathering and verifying requirements, setting priorities, developing and deploying solutions, and tracking and analyzing usage to inform future changes.

18. Provide the ability for authorized users to perform self-service reporting, including limited capabilities for downloading or otherwise extracting information from Pivot, if authorized or approved for the user type, in accordance with applicable data governance policies and plans, cybersecurity requirements, and data sharing agreements.

19. Ability to quickly make additions or updates to incorporate new system, technology, or business requirements.

13 | P a g e

1.5 Objective 5 - Program Management Support

Objective: Manage the end-to-end implementation, innovation, and efficient delivery of IT services, using industry best practices in program and project management in accordance with the DHS SELC, and the Pivot SELC plan. Plan and lead tactical support (operations and maintenance) and strategic support (development, modernization, and enhancement) leadership that achieves operational and cost efficiencies, while positioning stakeholders and their respective business partners to fulfill their missions, in accordance with DHS and FEMA policies and reporting requirements.

Support includes but is not limited to:

1. Creating, updating, and maintaining Acquisition Lifecycle Framework (ALF) and System Engineering Life Cycle (SELC) documentation.

2. Assisting with program management activities including but not limited to:

a. Capitol Planning Investment Control activities

b. Tracking/managing program cost (i.e. Burn rate chart, etc.)

c. Tracking and managing risks.

d. Program schedule

e. Quality management

f. Program metrics

3. Perform various analyses including, but not limited to: Cost Benefits Analysis, Market Surveys, Alternative Analyses, and Gap Analyses.

4. Create and maintain project roadmaps, project plans, network and system diagrams, Standard Operating Procedures, and program and project strategies/processes as required.

5. Perform market research and procure any and all necessary licenses, software, and/or hardware (as deemed necessary) to fully run and maintain NFIP applications.

6. Track and manage system logistics elements, such as expiration of licenses and certificates to help avoid lapses in service or system use.

7. Support human capital planning. Including the following:

a. On/Off boarding

b. GFE Management

c. Key Personnel management

8. Conduct risk management and support FID enterprise risk management efforts

a. Triggering risks and issues management and escalation when implementation schedule, performance, or costs are affected.

b. Recommending and maintaining approved risk management processes including identifying, addressing, and monitoring existing and future risks related to current project initiatives.

c. Reviewing risks for interdependencies, gathering context and mitigation information, updating reporting tools, and reviewing current risk status with project team.

9. Provide executive support such as subject matter expertise and materials (talking points, slide decks, attend meetings, etc.) in support of Pivot and FID’s executives' and leaderships’ interactions with internal and external stakeholders regarding the status of the program.

10. As necessary, support the planning and execution of legacy application decommissioning and disposition.

11. Provide Program level strategic management of requirements, priorities, tech debt, and milestones.

12. Additional support elements and tasks may be identified through the course of performance.

14 | P a g e

1.6 Objective 6 - User Support

Objective: Provide tiered Contact Center and/ or Helpdesk operational services support, which includes managing a high volume of incoming user/customer requests, including but not limited to: emails, calls, messages. Enter customer/ user requests into a ticket tracking and management system. Support responsibilities responding to production emergencies

(outages) and/ or critical issues. Support user requests, triaging and assessing the urgency and criticality of the request, as well as the appropriate level of service required to address and resolve the issue (e.g. Tier 1, Tier 2, Tier 3+, etc.).

Apply proactive Scaled Agile Framework (SAFe), lean, and/ or Agile principles and strategies to production systems and customer support of enterprise applications to provide world-class customer experience (CX) and effective outcomes.

Track and report on user support using Contact Center/ Helpdesk Key Performance Indicators (KPIs), KPPs, or other metrics as requested.

User Support shall include, but is not limited to:

1. The Contractor shall utilize tools to track issues and, resolutions, reporting, and/or metrics for user support for

Contact Center/ Helpdesk, including but not limited to: Key Performance Indicators (KPIs), KPPs, or other metrics as requested. The Contractor shall apply proactive Scaled Agile Framework (SAFe), lean, and/ or Agile principles and strategies to production systems and customer support of enterprise applications

2. The Contractor shall provide User Support that is scalable, with the ability to rapidly ramp up or down as needed, in the event of increased system use because of major disasters, flood events, or other causes.

3. The Contractor shall propose for Pivot Program Office approval support tiers to support the objectives above, and update or otherwise maintain these support tiers as appropriate.

4. The Contractor shall communicate issues, improvements, and suggestions to the development teams for system enhancements.

5. The Contractor shall develop and maintain a knowledge base (KB) for internal staff to support training and cross-team support of users.

6. The knowledge base shall be made available to FEMA staff as well to support their user care activities.

7. Additional support elements and tasks may be identified through the course of performance.

1.7 Objective 7 – Ramp-Up Phase

Objective: For each objective listed above, the Contractor shall:

1. Collaborate and cooperate with the existing contractors working on the Pivot system to develop, ramp up or down, or otherwise handle operational and maintenance (O&M) support of the system.

2. Provide a Ramp-Up Phase Plan that contains the strategy for ramping up its operations, communicating with the existing contractors working on the Pivot system, and other stakeholders including federal staff. This plan shall contain a timeline of milestones and completion dates for activities associated with this phase. A draft Ramp-Up

Phase Plan shall be delivered within 15 business days of award. A finalized Ramp-Up Phase Plan shall be delivered within 30 business days of award.

15 | P a g e

1.8 Objective 8 – Transition of Services

The Contractor shall prepare a transition-out plan to facilitate a smooth and orderly transition such that there is no disruption of any services contained within this SOO.

The Contractor shall:

• Facilitate, support, and conduct transition-out activities as directed by the government and in cooperation with current government Contractors to transition-out support services inclusive of functionalities, data and capabilities.

• Fully support transition-out, including, but not limited to: identifying, developing, and providing supporting documentation.

• Conduct detailed overview sessions with the government to provide visibility and insight into the support services.

• Within 30 days from notice from the COR or CO, deliver a Transition-Out Plan for transferring services to a successor.

1. Key Personnel

Specific expertise and experience in Program/Project Management (P/PM), Cloud Architecture, Configuration Management (CM), and Information Security is essential for accomplishing the tasks outlined in this Statement of Objectives (SOO). The Contractor shall provide resumes for any individual(s) who Contractor proposes to fill the five Key Personnel positions identified below at minimum. Submitted resumes shall be redacted to prevent disclosure of personally identifiable information (PII). For any individuals proposed as Key Personnel who are not current employees of your company, a signed letter of intent will be required. The Key Personnel positions and redacted resumes of individuals who shall fill the key personnel positions shall be included as an attachment to the contract.

Minimum Required Key Personnel:

1. Senior IT Program/Project Manager (P/PM)

2. Senior Computer Systems Engineer/Architect

3. Senior Software Applications Developer

4. Senior Software Quality Assurance (QA) Engineer

5. Senior Software Test and Evaluation (T&E) Test Engineer

6. Certified 508 Accessibility Tester

7. Senior Computer Systems Analyst

To ensure successful performance of the requirement, the Contractor shall satisfy the following:

• The Contractor shall assign one Senior IT P/PM, Senior Computer Systems Engineer/Architect, Senior Software

Applications Developer, Software Quality Assurance Engineer, Software T&E testing engineer, and Computer

Systems Analyst as Key Personnel whose résumés are submitted with its response quotation.

• Key Personnel must have a full understanding of the technical approach discussed in the proposal.

• Senior IT P/PM must have an Associate Degree or higher and/or five (5) to 15 year’s experience and hold an active PMI Project Management Professional (PMP) certification.

• All other Key Personnel must have a Bachelor’s Degree or higher, industry certifications, and/ or have at minimum 10-year’s experience in their applicable field, including demonstration of their their leadership, knowledge, and experitise.

16 | P a g e

• Key Personnel shall be a direct liaison to the Contracting Officer Representative (COR) and the FEMA Product

Owners (POs).

• Key Personnel shall be responsible for the supervision and management of the Contractor’s personnel, technical assistance, and interfacing with FEMA.

During the first 90 days of performance, the Contractor shall not replace or substitute Key Personnel that the Contractor proposed pre-award unless the replacement is necessitated by illness, death, or termination of employment. Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer (CO) in writing no less than 15 business days in advance, including written justification for the replacement, and will also include the name(s) and qualifications for any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key Personnel being replaced, unless otherwise approved by the CO. The Contractor shall not replace Key Personnel without written approval and acknowledgment from the CO. Note: The Government may designate additional Contractor personnel as Key at the time of contract award.

After the initial 90 days, any personnel the Contractor offers as substitutes for the above identified Key personnel positions shall have the ability and qualifications equal to or superior than the Key Personnel being replaced, and shall meet or exceed the qualifications designated for that Key Personnel position. If any change to a Key Personnel position becomes necessary, the Contractor shall immediately notify the PM and COR in writing. Whenever possible, Contractor shall notify the PM of substitutions in personnel in writing 30 calendar days prior to making any change in Key Personnel, including a detailed explanation of the circumstances necessitating the proposed substitution and details demonstrate that the proposed replacement personnel are of equal or superior ability and qualifications to those of the individual originally proposed for that position. The proposed replacement shall meet or exceed the qualifications designated for that Key Personnel position, as outlined and required.

The Contractor agrees that it has a contractual obligation to mitigate the risks and consequences of the loss of Key

Personnel, and shall promptly secure any necessary replacements in accordance with (IAW) this section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue, shall be considered a condition endangering contract performance and may provide grounds for default termination.

5. Government Furnished Equipment (GFE)

The Government may provide GFE (e.g. a government furnished laptop) to individual contract staff members, if deemed necessary, after receiving any and all requisite COR approval(s), as well as any and all required authorizations.

6. Place of Performance

Place of Performance Location(s) The primary place of performance shall be at the Contractor’s Work Site. FEMA’s facilities located within 400/500 C St

SW, Washington, D.C. may be used, if approved by the COR. The location of FEMA offices may shift during the period of performance based on HQ realignment. For planning meetings or other essential work-related sessions, on-site attendance at the place of performance may be required for staff located within the National Capital Region (NCR)/ metropolitan Washington, DC area.

17 | P a g e

Location of Contractor Site(s) The Contractor shallhave at least one site within the National Capital Region and some Key Personnel must be located at that site. FEMA may require that some Contractor personnel are able to be at the Government’s site in the metropolitan Washington, DC area within two-hour's notice. Not all personnel are required to be in the National Capital Region.

7. Travel Contractor travel is anticipated for this requirement. All required Contractor official Government business travel must be approved and will be reimbursed to the Contractor in accordance with the Federal Travel Regulations (FTR) and FAR

31.205-46. The Contractor shall be responsible for obtaining COR and/ or CO approval in writing or via email for any and all reimbursable travel. COR and/ or CO approval must be received in advance of each travel event to be eligible for reimbursable travel. Approved travel expenses will be reimbursed based on actual costs incurred.

18 | P a g e

Appendix A: TBD

19 | P a g e

Appendix B: Required Deliverables

DELIVERABLE FREQUENCY DELIVER TO

Quality Assurance / Quality Control Plan (QA/QCP)

Due within thirty (30) calendar days after contract award Contracting Officer Representative

(COR)

Program Management Plan (PMP)

Due within thirty (30) calendar days after contract award

COR

Weekly Activity Report

Due every seven (7) days COR

Team Calendar – (identifying telework, office, leave, training schedule)

Due every fourteen (14) days COR

Resource Expenditure Report

Updated on an agreed upon cadence on Jira/ Confluence COR

Program Performance Summary

Service Desk Report

Updated on an agreed upon cadence on Jira/ Confluence COR

Software Inventory Status Report

Updated on a cadence on Jira/ Confluence COR

GFE Inventory Report

Trusted Tester Report

Updated on an agreed upon cadence on Jira/ Confluence COR

White Papers (product evaluations, presentations, process

20 | P a g e improvement diagrams, etc.)

Technical Research Documents

Updated on an agreed upon cadence on Jira/ Confluence COR

Working Products Per Requirements

Updated on an agreed upon cadence on Jira/ Confluence COR

Root Cause Analysis (RCA)

AS needed and submitted within 5 days of the incident COR

Data Governance Plan (Policies, Processes, Procedures)

Updated on an agreed upon cadence on Jira/ Confluence COR

Data Governance (Artifacts, Diagrams, Reports)

Updated on an agreed upon cadence on Jira/ Confluence COR

Data Management Plan

Updated on an agreed upon cadence on Jira/ Confluence COR

Training Plans Updated on an agreed upon cadence on Jira/ Confluence COR

Training Materials

Updated on an agreed upon cadence on Jira/ Confluence COR

Status Reports Updated on an agreed upon cadence on Jira/ Confluence COR

Configuration Management Plan

Updated on an agreed upon cadence on Jira/ Confluence COR

Briefing Materials

Updated on an agreed upon cadence on Jira/ Confluence COR

Meeting Minutes

Updated on an agreed upon cadence on Jira/ Confluence COR

Communications Plan

Updated on an agreed upon cadence on Jira/ Confluence COR

Project Charter Updated on an agreed upon cadence on Jira/ Confluence COR

Change Management Plan

21 | P a g e

Account Management Plan

Updated on an agreed upon cadence on Jira/ Confluence COR

Remediation and Vulnerability Management Plan

Updated…