70FA3124I00000002 SSN RFI FY25 Pivot OM.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

541511

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OR70FA31

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

11/27/2023 1600 ES

11/02/2023

202-714-5281Judith Hicklin (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

70FA3124I00000002

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 6 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

WASHINGTON DC 20472

500 C STREET SW 3RD FLOOR

DEVELOPMENT AND SUSTAINMENT

INFORMATION TECHNOLOGY

FEDERAL EMERGENCY MANAGEMENT AGENCY

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$34

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

70FA31

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Federal Emergency Management Agency (FEMA) Sources Sought Notice (SSN)/Request for Information (RFI)

Project Title: FY-25 Federal Insurance Directorate/National Flood Insurance Program – Pivot

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED

Cornell E. House

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

6 2 of

Federal Emergency Management Agency

Federal Insurance Directorate/National Flood Insurance Program – Pivot

Sources Sought Notice (SSN)/Request for Information (RFI)

#70FA3124I00000002

November 2, 2023

SOURCES SOUGHT NOTICE (SSN)/RFI SUMMARY: The Department of Homeland Security (DHS), FEMA, Federal Insurance Directorate (FID) National Flood Insurance Program (NFIP) Pivot (referred to hereafter as “Pivot” or “NFIP Pivot”) serves as the NFIP’s System of Record for all flood insurance claims and policies and is considered a mixed-financial system. Currently in its Operations and Maintenance (O&M) phase, Pivot requires a wide array of IT services including SecDevOps in FEMA’s Enterprise Google Cloud Platform utilizing the Scaled Agile Framework (SAFe) methodology, holistic software quality assurance, systems security, data reporting and analytics, program/project management, and various support services.

The Contractor will provide subject matter expertise to FEMA staff as they support the NFIP’s execution of flood insurance business operations via Pivot and related NFIP applications. The Contractor will support activities such as tracking, collecting, disseminating, maintaining, and updating information on the Pivot System and applications.

While the work performed by the Contractor is UNCLASSIFIED, it should be noted that a substantial amount of data is Personally Identifiable Information (PII) or Sensitive Personally Identifiable Information (SPII) and shall be handled as required by FEMA, DHS, Office of Management and Budget, and applicable federal statutes.

THIS SOURCES SOUGHT NOTICE IS NOT A REQUEST FOR PROPOSAL: This is a market research tool being used for information only to determine the availability and adequacy of eligible business sources in order to meet FEMA NFIP Pivot Program- and system-related needs. No reimbursement will be made for any costs associated with providing information in response to this SSN or any follow up information requests. The Government is not obligated to and will not pay for any information received from industry sources as a result of this SSN. Respondents will not be notified of the results of the SSN or resulting market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents shall identify any proprietary information in their SSN responses. Information submitted in response to this SSN will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. FEMA reserves the right to utilize any non-proprietary technical information in the anticipated NFIP Pivot Program Performance Work Statement or solicitation.

Although it is not necessary to address in their response, respondents shall be aware of any potential, actual, or perceived organizational conflicts of interests. Any real or potential conflicts must be sufficiently mitigated prior to a contract award. For further guidance, refer to the Federal Acquisition Regulation, Part 9.5.

NAICS CODE: 541511 - Custom Computer Programming Services

PRODUCT SERVICE CODE (PSC): DH01 IT and Telecom – Platform Support Services: Database, Mainframe, Middleware (Labor)

ANTICIPATED PERIOD OF PERFORMANCE START DATE: June 16, 2025

PLACE OF PERFORMANCE: The primary place of performance shall be at the Contractor’s Work Site or Contractor-approved telework/remote locations. FEMA’s facilities located within 400/500 C St SW, Washington, D.C. may be used if approved by the Contracting Officer’s Representative. The location of FEMA offices may shift during the period of performance based on HQ realignment.

The Contractor shall have at least one site within the National Capital Region and some Key Personnel must be located at that site. FEMA may require that some Contractor personnel are able to be at the Government’s site in the metropolitan Washington, D.C. area within a two-hour notice. Not all personnel are required to be in the National Capital Region.

ATTACHMENT: Requirements Document (Statement of Objectives)

SUBMISSION OF CAPABILITY PACKAGES: Interested parties shall submit their SSN responses electronically to Eric Robertson, Contracting Officer, at Erik.Robertson@fema.dhs.gov, and Contract Specialist, Judith Hicklin at Judith.hicklin@fema.dhs.gov no later than 10:00AM Eastern Time (ET), November 21, 2023. Questions regarding this RFI/SSN are due no later than 10:00PAM ET, November 14, 2023.

“SSN Response for Pivot Operations and Maintenance Support” shall be in the subject line of your e-mail. All responses shall be unclassified, with any proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inches and shall use a type-pitch that is no smaller than a standard 11-point font, with the exception of charts, graphs, or tables, which shall use a pitch no smaller than 10-point font. Responses shall not exceed ten (10) pages in length including images, data displays, charts, graphs, and tables. Page limitation does not include: one (1) cover page. Do not include promotional materials.

SSN Capability Packages shall include a Cover Page with the following information:

1. Company Name

2. Company Address

3. UEI Number

4. Company Point of Contact - Name, Title, Phone, and Email address

5. Statement of current business size status (i.e., HUBZone small business concern, service-disabled veteran-owned small business firm, 8(a) contractor, woman-owned small business, small business, or large business concern). Also, business size in relation to the NAICS code size standards assigned to this acquisition.

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

The remaining pages of the SSN Capability Package submission should describe demonstrated experience in, at minimum, the identified objective areas and whether your firm was the prime contractor. Additionally, descriptions of past performance should:

• Involve contracts of comparable size and complexity with government agencies and private industry;

• Address the key program and project management parameters of technical and management capability, quality of work within an agile environment, and managing multiple development pipelines; and

• Provide references (including name, affiliation, phone number, and email address).

1. IT Operations, Maintenance and Development: Utilize SecDevOps (including low-code/no-code) to sustain current capabilities and maintain the current existing applications hosted in the FEMA Enterprise Cloud Google Cloud Platform. Continuously, iteratively improve or enhance Pivot’s system architecture and capabilities, existing or new applications or products, and other related tools or resources, ensuring existing or improved customer/user experience and security practices/posture while complying with all DHS and FEMA regulations, requirements, policies, and practices for a FEMA technology system. This objective includes integrating components of Pivot and/or other FEMA FID systems, as required.

2. Software Quality Assurance: Implement and utilize a test automation framework to deliver high quality, production-ready functionality with minimal disruption to users, continuous releases, and rapid resolution when issues arise. Track escaped defects into production environment and demonstrate a trend of reduced escaped defects as evidenced by User Acceptance Testing, Independent Verification and Validation, and/or Helpdesk defect reporting. Rigorously execute performance and stress testing in a designated environment.

mailto:Erik.Robertson@fema.dhs.gov mailto:Judith.hicklin@fema.dhs.gov

3. System Security: Perform a wide range of SecDevOps and Security focused work including: Security Engineering, Incident Response, Audit/Vulnerability tracking, and third-party audit assessment support. Security engineering work includes (but not limited to) install, setup, manage, and utilize security scanning tools; limited penetration testing; managing firewall rules; certificate installation; and container security. Security Operations Center staff monitor network traffic, application performance monitoring tools, audit logs, respond to incidents, and support external auditing.

4. Reporting and Data Analytics Capabilities: Provide data science, data management, data analytics, and data reporting services to develop and support NFIP data and analytics capabilities to meet FID’s mission and business needs. Provide the ability to report and share the results of data analytics in multiple visual and/or digital formats to appropriate stakeholders and customers in a timely manner, including but not limited to: dashboards or on-demand reports for Pivot users, quick-turn major disaster or flood event support reporting, monthly reporting and support, quarterly reporting and support, biennial or biannual or other audit related reporting and support, and/or other data or reporting related support as required by request to meet mission and business needs.

5. User Support: Provide tiered Contact Center and/or Helpdesk operational services support (possibly 24/7/365), which includes managing a high volume of incoming user/customer requests, including but not limited to: emails, calls, and messages. Enter customer/user requests into a ticket tracking and management system. Support responsibilities responding to production emergencies (outages) and/or critical issues. Support user requests, triaging and assessing the urgency and criticality of the request, as well as the appropriate level of service required to address and resolve the issue (e.g., Tier 1, Tier 2, etc.). Apply proactive SAFe principles and strategies to production systems and customer support of enterprise applications to provide world-class customer experience and effective outcomes. Track and report on user support using Contact Center/Helpdesk Key Performance Indicators/Parameters or other metrics as requested.

ADDITIONAL QUESTIONS:

1. Describe how your company has managed providing O&M while concurrently updating and enhancing the system and business operations.

2. What is your experience with Federal clients implementing technology capabilities using an agile framework such as SAFe?

3. Provide specific examples of how your company has achieved or exceeded customer expectations in the following areas:

o Utilized data visualization tools and best practices (including use of cutting-edge business intelligence tools or other technology capabilities) to provide effective reporting/visualization functionality or capabilities.

o Utilized data analytics, data management, and/or data quality tools and best practices (including the use of cutting-edge data analytics tools or other technology capabilities) to provide effective modeling or analytics information functionality or capabilities.

4. Quality Assurance (QA) and Quality Control (QC) enables system stability and instills confidence in customers and leadership. Discuss your company’s approach and success in executing a QA/QC program.

How would you ensure effective QC on a technology system in the Federal sector?

5. Please provide any feedback you have regarding the attached draft requirements document, including how best to balance broad objectives with specific requirements to enable innovative solutions while meeting NFIP needs and expectations.

Sheet1

70FA3124I00000002 FY25 Pivot OM Q&A

Document Name Page # Section Reference Question Answer tc={3E690D75-C208-4A44-A976-B0D6A197C531}: [Threaded comment]

Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924

Comment:

But should licenses still be priced on the BPA? Along with the training credits?But should licenses still be priced on the BPA? Along with the training credits?

1 | P a g e

National Flood Insurance Program

Federal Insurance Directorate Office of Resilience

Information Technology, Systems Operations, Maintenance & Development

Statement of Objectives (SOO)

November 2, 2023

2 | P a g e

Statement of Objectives

Background

The U.S. Department of Homeland Security’s Federal Emergency Management Agency (FEMA) is procuring contracts to support the National Flood Insurance Program (NFIP). The NFIP aims to reduce disaster suffering by providing affordable insurance to property owners, renters, and businesses as well as encouraging communities to adopt and enforce floodplain management regulations. The NFIP is conducting transformation activities that will update the products, processes, and procedures that support the program. NFIP contracts will support the direct sale and servicing of NFIP policies, communications, operations and maintenance of IT systems, standard business operations, and project management. Universal objectives are provided below. Additional information specific to each contract will be provided through additional industry engagement methods deemed appropriate.

3 | P a g e

Universal Assumptions and Constraints

1. All activities will align to DHS/FEMA/Resilience/FID strategies and intents.

2. The NFIP has several systems to manage its technology work, including the NFIP Pivot (Pivot) system.

3. Pivot is NFIP’s System of Record (SOR) for flood insurance policy and claims information and financial transactions.

4. FEMA is updating the NFIP’s policy forms, and although some will be finalized, not all will be completely in place at the time of contract award.

5. The NFIP will continue to operate according to current statutory authorities and regulations, but Pivot operations and development must remain flexible and agile given changes that may arise from FEMA policy and program initiatives, updated regulations, or passage of new legislation.

6. The NFIP will embrace data and fraud analytics to drive better operations through improved oversight, speed, quality, and customer service.

7. The NFIP will embrace industry-standard customer experience models (digital sales, mobile claims through smartphone applications, agents at the call center, etc.).

8. The NFIP will strengthen and expand partnerships with the private sector, including through appropriate performance incentives tied to achievement of FID’s program objectives.

9. Pivot communications and outreach activities are coordinated, integrated, and consistent with NFIP messaging.

10. Data security and privacy issues are a major focus of the Federal Government’s IT efforts. All program activities shall be compliant with the Government Information Security Reform Act, OMB policies, DHS policies and mandates, and FEMA requirements.

11. Solutions shall include transition plans, detailing how continuity of services will be maintained (e.g., operations of IT systems in various states of health and development, ongoing marketing and sales efforts, project management, etc.).

12. Issues that arise to impact continuity of service will require documented root cause analyses (RCAs) and resolution(s) when an outage occurs.

1. Scope

FEMA requires a Contractor, hereinafter referred to as “Contractor,” to provide project management, data reporting and analytics, DevSecOps utilizing the Agile SAFe methodology, and support services for the Pivot system which serves as the NFIP’s System of Record (SOR), as well as other affiliated applications in support of the NFIP. This means that FEMA requires a wide array of IT services in support of a mixed-financial system. Sections 1.1 – 1.6 provide details for the major functions that need to be provided by the Contractor. Where applicable, these sections contain references to supporting documentation that further define the requirements for that section.

The Contractor will serve as a subject matter expert (SME) and a source of information for FEMA staff, Write-Your-Own (WYO) insurance companies, and the NFIP Direct Servicing Agent (NFIP Direct) contractor as they work to provide the information required by the NFIP to execute flood insurance business operations, leveraging Pivot and other NFIP applications. The Contractor shall support activities that include tracking, collecting, disseminating, maintaining, and updating information on the NFIP applications.

4 | P a g e

The work that the Contractor will perform shall be UNCLASSIFIED. It should be noted that a substantial amount of data is considered Personally Identifiable Information (PII) or Sensitive Personally Identifiable Information (SPII) and shall be handled as required by FEMA, DHS, OMB, and all applicable federal statutes.

Operating Assumptions and Constraints

Pivot became the NFIP’s System of Record (SOR) in October 2019 and attained Full Operating Capability (FOC) in the Fall of 2020. The Contractor shall present solutions to develop, operate, and maintain the NFIP’s applications to meet the program’s current and future needs. All data, licensed software, custom-coded software, and ancillary systems are owned by FEMA and are transferable to subsequent FEMA contractors.

Table 1 identifies the operating assumptions and constraints:

Assumptions and Constraints

1) The NFIP is frequently reauthorized and reformed through legislative processes, changes to regulations, and FEMA policy and program initiatives. The support provided in this contract shall use the Agile SAFe methodology to provide flexibibility and to rapidly adapt to and incorporate program changes and deliver solutions through the NFIP’s IT systems, often within short time constraints. While exact programmatic changes and turnaround requirements cannot be specified, the types of skills and services provided through this contract shall be sufficient to meet program needs.

2) Pivot and NFIP systems are primarily Agile SAFe development projects but may require non-Agile development support.

3) Solutions shall align to DHS/FEMA strategic goals and constraints, FEMA’s Target Enterprise Architecture, including the Technical Reference Model (TRM) and be a cloud-based solution hosted within the FEMA Enterprise Cloud.

4) The Contractor solution shall be aligned with required DHS/FEMA Security, Quality Assurance (QA), Quality Control (QC), and Continuous Monitoring activities to maintain a DHS Authority to Operate (ATO). All program activities shall be compliant with the Government Information Security Reform Act, OMB policies, FEMA, and all applicable DHS requirements.

5) The Contractor shall utilize existing environments as necessary for development, testing, beta, staging, pre-production, production, and sustainment activities. FEMA will also have access to these environments.

6) The Contractor shall fully comply with applicable statutes and demonstrate working knowledge and understanding of applicable regulations, policies, guidelines, and specifications that affect the NFIP, FEMA, and DHS.

7) The Contractor shall establish and maintain interfaces with systems that are both internal and external to FEMA for all NFIP systems. These interfaces shall be documented in ISAs, MOA’s, or MOUs, as applicable.

8) FEMA shall provide the designated Information System Security Officers (ISSOs) for the systems supported by this contract, though the Contractor shall have cybersecurity experts on staff to support development, operations, incident response, security, and maintenance activities.

9) The Contractor shall ensure that the system meets or exceeds the Key Performance Parameters (KPPs) as defined within the Pivot Operational Requirements Documents (ORD) and Acquisition Program Baseline (APB), as well as the Measures of Performance (MOP) within the Test and Evaluation Master Plan (TEMP).

10) Pivot is currently categorized as a Federal Information Processing Standard (FIPS) 199 “Mod/Mod/Mod” system and requires commensurate levels of system security.

5 | P a g e

a. The target solution requires a security authentication and authorization process that shall integrate with DHS Enterprise Security and shall comply with DHS Sensitive Systems Policy Directive 4300A, Homeland Security Presidential Directive 12, and any other applicable DHS security requirements such as Personal Identify Verification (PIV) enablement and Single-Sign-on (SSO).

b. The Contractor shall have the ability to design and implement changes to raise the FIPS 199 categorization levels to “High/High/High” (confidentiality, integrity, and availability) or other options should the need arise.

11) The security authentication and authorization for Pivot and other NFIP systems shall comply with the security control families set forth in the latest version of the NIST Special Publication (SP) 800, Security and Privacy Controls for Federal Information Systems. The Contractor shall have ability to build to future standards when published and applicable.

12) The Contractor shall maintain systems to be compliant with all relevant security controls outlined in NISTs FIPS (Federal Information Process Standards) and the Federal Information Security Management Act (FISMA) that enables the FEMA to perform activities defined by the DHS Risk Management Framework.

13) Solutions shall utilize and support open source technology as defined by FEMA Enterprise Architecture (EA).

All technology and software shall be approved for use and added to DHS’s TRM (Technical Reference Model).

14) Applications will range from internal use to public access, and services or support (user access/support).

These shall be secure and scalable to account for these varied use cases.

Table 1: Operating Assumptions and Constraints

6 | P a g e

1.1 Objective 1 – IT Operations, Maintenance and Development

Objective: Sustain current capabilities and maintain the current existing applications hosted in the FEMA Enterprise Cloud (FEC) Google Cloud Platform (GCP), identified by FEMA’s Office of the Chief Information Officer (OCIO) as the FEMA Cloud Environment (FCE) Google platform. Continuously improve and evolve Pivot’s system architecture, customer experience (CX), user experience (UX), and security practices. This objective includes integrating components of Pivot and other FEMA/Federal Insurance Directorate (FID) systems.

At a minimum, the Contractor shall:

Development:

1. Perform comprehensive development activities using Agile project management methodologies for NFIP applications to deliver new functionality; including cybersecurity, 508 accessibility compliance, application performance, etc. (Note: additional cybersecurity and privacy specific objectives are listed in the section below.)

2. Deliver enhancements and bug fixes to NFIP applications, focusing on accessibility, usability, and user acceptance of the system.

3. Continuously improve Pivot system integration to ensure interoperability with other FEMA systems and applications. (Note: A current list of planned interfaces is provided in the list of attachments, though any future development is not limited to the list attached.)

4. Develop and maintain proper documentation of all conducted activities throughout NFIP application development lifecycles including, but not limited to: development-related documentation (e.g. requirements backlog, risk register, Security documentation (e.g System Design Documentation), Release documentation (e.g. Security Scans, Test Plans, Configuration Management Plan), Testing documentation (e.g. Quality Assurance/Quality Control Plan, Test cases), and other system documentation to support system change control activities.

5. Mobile device application development, including iOS and Android, and responsive website development for NFIP systems on all user interfaces on multiple devices.

6. Implement and utilize cloud based development or Cloud Native Development.

7. Conduct business analyses to gather and implement requirements, including but not limited to storing, tracking, and tracing all requirements to applicable documentation, requirements, tests, or other applicable repositories or work products.

8. Conduct research and development (R&D) activities to discover and realize efficiencies, leverage advances in technology, and support the evolution of the NFIP, including the development of new applications, integration and incorporation of new tools, and integration with other non-Pivot applications and data sets.

9. Provide support to address and close out all Operational Test Agent (OTA) activities and findings.

IT Operations

10. Create, support, and maintain required DHS System Engineering Life Cycle (SELC) updates and documentation, and participate in stage gate reviews.

11. Support various program audit activities, including but not limited to Government Accountability Office (GAO), Office of Management and Budget (OMB), DHS Office of the Inspector General (OIG), KPMG, FEMA OCFO A- 123, and internal audits.

12. Proactively communicate and document updates for various system elements to users and stakeholders, including:

a. System outages, downtime, updates, upgrades, other important system communication to all relevant stakeholders, including Root Cause Analysis (RCA) reporting on system and application or sub-system outages.

7 | P a g e

b. New system features, data, reports, to relevant stakeholders.

c. Architectural improvements to leverage new technogy or adapt to changing requirements.

Maintenance

13. Support Hosting Services. (Note: the Contractor shall not provide the hosting site for the Systems currently developed and maintained within this contract. FEMA may plan to add or migrate systems or applications;

therefore, as technology evolves or other hosting solutions become advantageous, the Contractor shall support research on potential platforms or other service offerings.)

a. If a need is identified, then the Contractor shall perform the migration of NFIP systems or applications to the new hosting solution.

b. If a need is identified, then the Contractor shall perform the research and propose solutions for integration and architecture, including asking and answering key questions related to these new or changing requirements.

14. Maintain and enhance different developmental, application integration, and other non-production environments to support testing and data analytics activities.

15. Maintain and monitor system security, availability, and performance utilizing tools that track, predict, and alert various teams and FEMA to outages and security incidents.

16. Provide personnel with extensive IT SecDevOps, integration, and operational support experience such that they can properly configure each Commercial Off the Shelf (COTS) component, custom software, and/or potential Government Off the Shelf (GOTS) product, to integrate with necessary components.

17. The contractor shall work with the system owner and information system security officer to track vulnerabilities, provide artifacts for Plan of Action and Milestones (POAM’s), and implement changes to close out the POAM’s.

18. Improve the Search Engine Optimization (SEO) capabilities and utilitilization of social media platforms for NFIP systems.

19. Additional operations, maintenance, development, and support elements and tasks may be identified throughout the course of performance.

1.2 Objective 2 - Software Quality Assurance (QA)

Objective: Implement and utilize a test automation framework to deliver high quality, production-ready functionality that allows minimal disruption to users, continuous releases, and rapid issue resolution as they arise. Track escaped defects into Pivot Integration Environment (PIE) maintaining a high quality of code being released into production each application release and demonstrate a trend of reduced escaped defects as evidenced by UAT, IV&V and help desk defect. Rigorously execute performance and stress testing prior to the transition of any code from Development test environment to Pivot Integration Environment (PIE), in order to anticipate any reduced performance impact by newly introduced code, and ensure the responsiveness and stability of the application and the systems that are integrated with it are maintained or improved prior to being released into Pivot Production and Operational environment.

The Contractor shall provide appropriately qualified personnel to execute testing duties to include but not limited to:

1. Perform testing in accordance with the DHS SELC guidelines for Agile development, common industry accepted standards, and the SAFe methodology.

2. Design and implement test automation solutions for all testing activities using appropriate automation tools to enable SecDevOps implementation.

3. Create and implement automated test solutions and test suite that includes, but are not limited to: functional, progression, regression, performance, security, integration, Section 508 compliance, and data

8 | P a g e preparation/loading/reset testing at both the application or sub-system level and systems integration level in each environment including PIE for validation.

4. Demonstrate system resilience and the ability to meet transaction response requirements requirements at a minimum or exceeding as specified in Pivot Key Performance Parameters (KPPs) in the Operational Requirements Document (ORD), and other program measures being monitored as agreed upon with the Program team in Quality Assurance Surveillance Plan (QASP).

5. Track code quality for release user stories/ epics including trends of errors from development to production into lifetime of that code. Demonstrate improving trends over time.

6. Provide dedicated personnel with extensive experience with monitoring tools such as audit logging, system and application performance monitoring, and Security Event Incident Management.

7. Have test personnel within the Quality Control team with industry recognized certifications such as CSQA (Certified Software Quality Analyst Certification), International Software Testing Qualifications Board Certifications (ISTQB), Certified Software Tester (CSTE), ISTQB Foundation Level (CTFL), DHS Trusted Tester or any other industry accepted certifications.

8. Have test personnel who have extensive experience with all facets of testing IT solutions to perform QC activities including but not limited to front end, backend, whitebox, blackbox, performance, test automation, and Section 508 test activities.

9. Implement a defect and resolution tracking mechanism within the testing infrastructure for tracking issues identified during discovery, documenting, and conducting of tests, through issue resolution.

10. Support third party testing activities in addition to conducting its own testing activities, such as NFIP User Acceptance Test (UAT), FEMA OCIO led independent verification & validation (IV&V) activities, and FEMA/DHS audits.

11. Develop and provide a robust, detailed Quality Control Plan (QCP) that identifies a clear end-to-end test strategy across all Pivot environments to support sustainment of current applications, change requests, and future development activities over a common Continuous Integration/ Continuous Deployment (CI/CD) pipeline or other SecDevOps release train as the the Pivot architecture evolves.

12. Develop QCP that documents the test plan and procedures to manage test activities according to industry best practices that includes, but is not limited to:

a. The QCP defines and address the Contractor’s Quality Management Approach towards Quality Control and Quality Standards implemented for Pivot in alignment with required KPPs, KPIs, and other metrics and requirements as applicable.

b. The QCP is the means by which the Contractor controls the quality of the work performed, and shall capture the process of the contractor to ensure quality that is consistent with the objectives specified in this document.

c. The QCP is sufficiently detailed to provide the government information of various positions and functions of team members who support and monitoring quality control activities.

d. The QCP identifies the reports that will be produced by the contractor to inform government of the results, reports, defect tracking trends, along with the process that inform the reports.

e. The Contractor shall provide the required QCP to FEMA’s Program COR no later than 30 days after contract award, and within five (5) business days when changes are made thereafter.

13. Use the Test-Driven Development (TDD) methodology to ensure software requirements are being converted to test cases before software is fully developed, and tracking all software development by repeatedly testing the software against all test cases.

14. Additional support elements and tasks may be identified through the course of performance.

9 | P a g e

1.3 Objective 3 – System Security

Objective: Support the development of all security authorization processes and generate all required security authorization artifacts. Work with and support the System Owner (SO) and Information System Security Officer (ISSO) to ensurse all Pivot application security complies with all DHS, FEMA, and NIST Special Publication (SP) 800-53 Revision 5, security standards.

Cybersecurity and protection of Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII) are critical to the NFIP. The Contractor shall develop, understand, and implement procedures and mechanisms to ensure security and protect PII and SPII, and support any and all related efforts:

1. The Contractor shall provide qualified personnel with industry certifications and extensive experience managing a program level security operations center (SOC).

2. The SOC team will conduct daily monitoring of the system for anomalous behavior and respond to any incidents.

3. The SOC team will conduct audits of users, applications, and databases as required by the program.

4. The Contractor shall provide qualified personnel with industry certifications and extensive experience to conduct security reviews and compliance monitoring activities, in support of the NFIP applications, maintaining an Authority to Operate (ATO), and pursuing and obtaining an Ongoing Authorization (OA) through FEMA and DHS.

5. The contractor shall hire a third-party assessment organization (3PAO) to conduct, at a minimum, penetration testing annually.

6. The Contractor shall:

a. Conduct and provide scans to the ISSO and any appropriate FEMA parties.

b. Analyze test results.

c. Create and update Remediation Plan documentation when changes are required.

d. Set up, maintain, and utilize FEMA approved security scanning tools.

7. Support Disaster Recovery (DR) solutions:

a. Support DR research for potential innovative solutions (e.g. leveraging multiple hosting solutions)

b. Support an annual Disaster Recovery exercise within the FEMA Google Cloud Environment.

c. Develop and maintain BIA (Business Impact Analysis), Contingency Plan and Continuity of Operations

(COOP) plans, inclusive of notifications and risk management.

d. Should a disaster be declared, the Contractor shall be responsible for the switch over to the alternate site in Google or other approved DR site.

e. If a need is identified, the Contractor shall conduct the migration of disaster recovery sites.

8. Additional support elements and tasks may be identified through the course of performance.

1.4 Objective 4 - Data Analytics (DA) and Reporting Capabilities

Objective: Provide data science, data management, data analytics (DA), and data reporting services to develop and support NFIP data and analytics capabilities to meet FID’s mission and business needs. Provide the ability to report and share the results of data analytics in multiple visual and/or digital formats to appropriate stakeholders and customers in a timely manner, including but not limited to: dashboards or on-demand reports for Pivot users, quick-turn major disaster or flood event support reporting, monthly reporting and support, quarterly reporting and support, biennial or

10 | P a g e biannual or other audit related reporting and support, and/or other data or reporting related support as required by request to meet mission and business needs.

The data in Pivot, the NFIP SOR, is one of FEMA’s largest assets. The NFIP must enhance its data analytics and reporting capabilities to better leverage this information to guide decision making, advance program priorities, and improve outcomes for NFIP policyholders, stakeholders, and other customers. The Contractor shall support these efforts and adhere to Federal, DHS and FEMA requirements, in alignment with the FEMA Data Strategy, the Federal Data Strategy, as well as other Data Governance and Management, Data Analytics, and Data Reporting statutes, directives, or other policies, as applicable. Additional support elements and tasks may be identified through the course of performance.

The Data Analytics and Reporting section has been divided into three groups, to streamline and simplify these objectives. The three groups are: Data Governance and Management, Data Analytics, and Reporting Capabilities. These analytics and reporting capabilities are critical both in preparation for and during and after flood events and require significant dedicated staff. Note: some items grouped below may cut across multiple categories.

Data Governance and Management

1. Support data governance at the program level by providing subject matter expertise to governance boards, facilitating engagement with Pivot user communities, enforcing and maintaining standards, and performing data cleaning and standardization as required.

2. Support FID’s development or enhancement of a Data Governance framework, including but not limited to:

a. Policies, processes, procedures, metrics, and reporting to advance data governance through, at a minimum:

i. Clear roles and responsibilities for FEMA offices, the NFIP Direct, and WYO companies and their vendors;

ii. A data model and data definitions;

iii. Data management rules and procedures;

iv. Implementation of, and compliance with, federal, DHS, and FEMA data sharing and data exposure directives and strategies;

v. Data quality assessment, metrics, and reporting; and

vi. Establishment and enforcement of data quality standards, including validation of data received from the NFIP Direct and WYO companies and their vendors.

b. Geospatial data standards to make Pivot a fully geospatially-enabled system, including at minimum requirements for:

i. Horizontal accuracy of structure locations for policies in Pivot;

ii. Vertical accuracy of structure first floor height data for policies in Pivot;

iii. Acceptable sources of structure location and first floor height data;

iv. Metadata documenting the availability and accuracy of structure location and first floor height data for all policies in Pivot;

v. Access to data on all insurable-but-uninsured structures in the United States;

vi. The timeframes when these geospatial data standards apply; and

vii. Validation and quality assurance for geospatial data and attributes.

3. Consistent with the Data Governance Plan, develop a Data Management Plan identifying how FID will manage NFIP data, data-related initiatives and associated timeframes, and risks. The Data Management Plan shall include, at a minimum, plans for developing and delivering the capabilities needed to meet FID’s data governance and management goals and processes for identifying and evaluating applications, standards, and tools to advance those capabilities.

11 | P a g e

4. Provide SMEs for standardization, integration, inventorying, reporting, storage, querying, and analysis of data to include structured, semi-structored, and/or unstructured data.

5. Improve capabilities and processes to report, share, or otherwise provide access to data for other FEMA programs, approved partners, customers, and stakeholders.

6. In compliance with the FEMA Data Strategy, data will be considered accessible to users, with the assurance that all data that is sensitive or may put the agency or policyholders at risk will be protected to prevent and/or minimize data leakage.

7. Produce and maintain thorough documentation of Pivot’s structure, business rules, and data including but not limited to a data dictionary and source data documentation to accompany data and analyses shared externally. Regularly update Pivot documentation amid ongoing Agile development of the system.

8. Enhance Pivot capabilities to efficiently copy SOR data and replicate or transform it for DA and reporting applications in near-real time while maintaining data integrity and quality, together with robust documentation and procedures for validation, reconciliation, and audits. The data will be controlled and contained in such a way that the SOR data is protected from other non-SOR data sets or manipulations.

9. Develop or enhance Pivot capabilities to record and maintain (e.g. a ledger) the history of all underwriting, claims, and financial transactions related to a policy, enabling analysis and reporting without need for periodic policy data freezes.

10. Ability to quickly make additions or updates to address new data governance or data management requirements.

Data Analytics Capabilities

11. Enhance Pivot capabilities to enable rapid and Agile DA within the Pivot environment to meet business and disaster-related needs, including but not limited to predictive analytics and fraud analytics by, at a minimum:

a. Leveraging data repositories and other architectural or related environments or capabilities;

b. Creating space and processes for testing and deploying DA tools; and

c. Enabling authorized users to conduct “self-service” analysis without additional custom development, with minimal developer support required.

12. Enhance DA application functionality by establishing or further developing two or more separate DA environments (e.g. sandboxes) to enable experimental analytics, modeling, or other business-related needs and efforts, including but not limited to: the incorporation of authorized or approved external data, data migration if necessary, data transformation, data sharing, as well as the ability to handle or manipulate multiple different data sets within the Pivot DA environments.

a. The data may consist of internal (FEMA/DHS) and /or external-entity data sets, including but not limited to geospatial and commercial data sets, either purchased or delivered as a subscription via API. These data sets may reside within a defined data analytics space within the FCE Google platform, as appropriate.

b. The data in the DA spaces may include external data that has been approved for use within the Pivot system by Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), Interconnection Security Agreement (ISA), Interagency Authorization Agreement (IAA), or other appropriate authorization document approved by the System Owner (SO).

c. The data may be analyzed at a macro (millions of records) or micro (single record) level.

d. The data may be delivered in multiple different formats to stakeholders or requestors, depending on their needs and requirements.

e. The data will be protected such that data leakage is prevented and/or minimized, with only authorized users with a need to know receiving SPII or PII.

12 | P a g e

f. The data shared to external users for transparency uses (e.g. OpenFEMA, FloodSmart reports) shall be cleansed of all SPII and/or PII to ensure required and needed protections of user data are met.

g. The data will be controlled and contained in such a way that the SOR data is protected from other non- SOR data sets or data manipulations.

13. Support NFIP data studies and geospatial analysis, including but not limited to integration of NFIP data with other FEMA and external datasets.

14. Perform ad hoc data analysis and reporting in support of the NFIP including but not limited to:

a. Support responses to Freedom of Information Act (FOIA) requests with ad hoc reporting or data analysis.

b. Support responses to quick-turn requests from the FEMA Administrator, DHS Secretary, Congressional offices, or other leadership with ad hoc reporting and/or data analysis.

c. Produce disaster-related reports for delivery to key FEMA and external stakeholders to meet mission and business needs on tight timelines under high levels of scrutiny.

d. Support development of Congressional reports and responses to internal and external audits with ad hoc reporting or data analysis.

e. Provide “Tier 1” data analysis support in the form of simple counts, extracts, or other basic data to authorized requestors on short notice within timeframes requested.

f. Provide “Tier 2” data analysis support in the form of short-term or longer-term analysis projects with guidance and oversight from FEMA analysts.

g. Develop and implement code/query management solutions and quality assurance protocols to ensure the consistency and quality of the Contractor’s ad hoc data analysis support.

15. Ability to quickly make additions or updates to incorporate new system, technology, or business requirements.

Reporting Capabilities

16. Enhance Pivot capabilities to deliver reliable dashboards and reports displaying accurate and timely data by, at a minimum:

a. Leveraging data repositories and other architectural or related environments or capabilities;

b. Providing on demand access to dashboards and reports through a streamlined user experience;

c. Utilizing commercial Business Intelligence (BI) COTS products to develop dashboards and reports faster and more effectively, reducing the time to meet business and disaster-related needs; and

d. Enabling mapping components for geospatial display and analysis of data in dashboards and reports.

17. Support the creation and implementation of a standard process for dashboard and report development that defines roles and procedures for requesting dashboards or reports, gathering and verifying requirements, setting priorities, developing and deploying solutions, and tracking and analyzing usage to inform future changes.

18. Provide the ability for authorized users to perform self-service reporting, including limited capabilities for downloading or otherwise extracting information from Pivot, if authorized or approved for the user type, in accordance with applicable data governance policies and plans, cybersecurity requirements, and data sharing…