REQUEST FOR INFORMATION_Risk MAP CDS OM 2.14.2024.pdf

Federal Emergency Management Agency (FEMA) Risk Assessments, Planning & Information Directorate (RAPID)

Risk Mapping, Assessment, and Planning Information Technology (Risk MAP IT) Program

Sources Sought Notice (SSN)/Request for Information (RFI)

RFI # 70FA3124I00000009

February 16, 2024

THIS SOURCES SOUGHT NOTICE IS NOT A REQUEST FOR PROPOSAL:

REQUEST FOR INFORMATION (RFI) SUMMARY: The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Risk Assessments, Planning & Information Directorate (RAPID) [formerly Risk Management Directorate (RMD)], Risk Mapping, Assessment, and Planning Information Technology (Risk MAP IT) program, seeks to identify potential cloud knowledgeable offerors who possess experience using Amazon Web Services (AWS) in federal environment to operate and maintain its legacy applications while simultaneously applying modernization practices to update and enhance its Portfolio. Using an Adaptive Maintenance approach (also referred to “Modernize in Place,” by DHS Information Technology Strategic Plan, FY24 - 28), Risk MAP IT seeks to achieve goals established by the FEMA Risk MAP Program through continuous, systematic improvements to its system architecture, technology stack, and code base for 40+ applications and sub-applications hosted within a single system boundary on FEMA’s Enterprise AWS Cloud.

This Request for Information (RFI) is issued solely for information and planning purposes and does not constitute a solicitation for bids, proposals, or quotes and is not to be construed as a commitment by the government to issue a request for proposal/quote or award of a contract as a result of this request. This announcement is not a Request for Proposal (RFP) nor a Request for Quote (RFQ). The government will not reimburse respondents for any cost associated with information submitted in response to this request.

Interested parties must submit sufficient documentation in accordance with the instructions in this RFI and current industry best practices and standards, demonstrating their ability/experience to meet or exceed the Government’s requirements listed in this notice.

GENERAL INFORMATION: This RFI is issued solely for information gathering purposes to identify offerors that can provide support for the Risk Mapping, Assessment, and Planning Information Technology (Risk MAP IT) program. In accordance with FAR 15.201(e), RFIs may be used when the Government wants to obtain price, delivery, other market information, and capabilities for planning purposes. Responses to these RFIs are not offers and cannot be accepted by the Government to form a binding contract. This RFI shall not be construed as a commitment by the Government for any purpose, nor does it restrict the Government to an ultimate acquisition approach. Respondents are solely responsible for all expenses associated with their RFI response. Respondents will not receive additional information in response to their submittal to the RFI and will not be notified of the resulting market research.

PROPRIETARY INFORMATION AND DISCLAIMERS: Respondents shall identify any proprietary information in its RFI response. Information submitted in response to this RFI will be used at the discretion of the Government. Further, the information submitted will remain confidential insofar as permitted by law, including the Freedom of Information and Privacy Acts. FEMA reserves the right to utilize any non-proprietary technical information in the anticipated SOO or solicitation.

Although it is not necessary to address in their response, respondents shall be aware of any potential, actual, or perceived organizational conflicts of interests. Any real or potential conflicts must be sufficiently mitigated prior to a contract award. For further guidance, refer to the Federal Acquisition Regulation, Part 9.5.

NAICS and Product Service Code (PSC) The following tentative NAICS codes are being considered for this scope:

• 541512 Computer Systems Design Services

• 518210C Cloud Computing and Cloud Related Services

• 541518S IT Professional Services

ANTICIPATED PERIOD OF PERFORMANCE START DATE: June 09, 2025.

ANTICIPATED CONTRACT VALUE: > $130M

ANTICIPATED PERIOD OF PERFORMANCE

The Government plans for a base period of one (one) year, inclusive of a 90-day transition-in period, and four (one year) option periods for a total duration of five years as depicted in the table below.

Period Duration Start Date End Date

Base Period 1 year 06/09/2025 06/08/2026

Option Period 1 1 year 06/09/2026 06/08/2027

Option Period 2 1 year 06/09/2027 06/08/2028

Option Period 3 1 year 06/09/2028 06/08/2029

Option Period 4 1 year 06/09/2029 06/08/2030

Total Period 5 years 06/09/2025 06/08/2030

ANTICIPATED ACQUISITION STRATEGY: FEMA has not decided on the acquisition strategy for this competition and whether the solicitation will be unrestricted, a set-aside for small businesses, or some hybrid approach with some work being unrestricted or set-aside solely for small businesses. In all cases, FEMA reserves the right to select an acquisition strategy in the best interest of the Agency that will satisfy our mission need in the most effective, efficient, and economic manner.

One option the Government is currently contemplating awarding this acquisition as a single award IDIQ contract, providing Operations and Maintenance (O&M) and Modernize in Place, Requirements Gathering, and Program Support Services. Please incorporate any comments regarding the advantages and/or disadvantages for the proposed acquisition strategy, and/or recommendations for an alternate acquisition path/solution, in your response to the RFI Questions.

PROGRAM BACKGROUND:

As part of the Department of Homeland Security (DHS), the Federal Emergency Management Agency (FEMA) operates the Risk Mapping, Assessment, and Planning (Risk MAP) program working with federal, state, tribal and local partners across the nation to identify flood risk. Risk MAP forms one of the foundational legs of the National Flood Insurance Program (NFIP), through its role in providing authoritative flood hazard and flood risk maps, products (Regulatory and non) and tools that allow for assessment of flood risk, mitigation planning, and outreach support to communities. Many Risk MAP products are public facing and require a robust IT infrastructure to support program objectives and goals.

The Risk MAP Information Technology touches nearly every facet of the Risk MAP mission and directly affects the quality, availability, and accessibility of the flood hazard, flood risk, and mitigation planning information produced by the Risk MAP Program. The Risk MAP IT Portfolio is comprised of multiple systems, platforms, and software including:

The applications within the Risk MAP IT Portfolio serves, but not limited to:

• Program Users in headquarters based in Washington DC and the 10 FEMA Regional Offices;

• Members of the general public, including Property owners, developers, investors, and their representatives; realtors; certifiers, including but not limited to Registered Professional Engineers and Licensed Land Surveyors;

• State, territorial, or local government officials with authority over a community's floodplain management activities;

• Tribal and Indigenous government officials and community members;

• Community and city planners;

• Affordable housing advocates;

• Federal partners such as National Oceanic and Atmospheric Administration (NOAA), U.S.

Geological Survey (USGS), U.S. Army Corps of Engineers, Department of the Interior’s Geological Survey;

• Technical partners registered to use FEMA's information technology systems and collaboration sites; and

• Contractors supporting mission delivery.

Risk MAP, as a critical program aimed at reducing the nation's vulnerability to flood hazards, has a legal responsibility to maintain an ongoing flood mapping program and to ensure that flood hazard data are current and up to date. To meet this responsibility, Risk MAP primary focus is to produce and maintain regulatory flood maps that communities use to inform land use decisions. The Risk MAP program is undergoing changes to ensure that the best possible flood risk information is available in an equitable manner to all American communities. These changes are driven primarily by the need to meet unmet statutory requirements and by recent executive orders which emphasize equity, climate resilience, evidence-based policymaking, and customer experience.

The NFIP has learned that a binary depiction of flood risk is insufficient for pricing, managing, and communicating flood risk. The NFIP transformation to a risk-informed program is also demanding that Risk MAP develop a more comprehensive understanding of flood risk. To meet this demand, Risk MAP program is (1) building and testing a new flood hazard and flood risk analysis framework; (2) developing a consistent communication approach refined for specific audiences; (3) improve integration of hazard mitigation planning with other community planning activities; and (4) design a modern IT system architecture and incrementally transform the existing IT portfolio, to provide more precise flood mapping products, risk assessment tools, and planning and outreach support to strengthen the community’s ability to make informed decisions about reducing risk.

RFI OBJECTIVE:

This RFI seeks to explore the following objectives:

• Solicit feedback from industry on how Risk MAP IT can transform its 40+ existing monolithic applications and sub-applications within the Risk Analysis & Management (RAM) system incrementally into a flexible, scalable, and secure customer-centric digital ecosystem.

• Solicit feedback from industry on its experience and key lessons learned using the Strangler Fig pattern popularized by Martin Fowler to modernize a legacy system, in place, within a FedRAMP compliant cloud environment.

• Solicit feedback on viable alternatives and criteria the government should consider when selecting the best modernization methodology for its system and applications.

• Understand the current state of the market for o Cloud compute and storage services, data integration and data management services. In this context, data integration includes both integration with internal and external data sources/sinks.

o Advanced statistical analytics and data development intelligently informed by available geospatial information, products and data to make Risk MAP’s data more accessible, understandable, and usable to address complex and compounding hazards.

ATTACHMENT: Attached for reference are the following documents:

• Risk MAP IT CDS SOO_DRAFT

RFI RESPONSE SUBMITTAL INSTRUCTIONS:

Interested contractors shall submit their RFI responses electronically to Judith Hicklin, Contracting Officer, at Judith.Hicklin@fema.dhs.gov by Monday February 26, 2024, 3:00 PM Eastern Standard Time

(EST).

“RFI Response for Risk MAP CDS Operations and Maintenance (O&M) Support” shall be in the subject line of your e-mail. All responses shall be unclassified, with proprietary information clearly marked. The document format shall be either Microsoft Word (.doc or .docx), or Adobe Acrobat (.pdf) formats. Pages shall be 8.5 by 11 inch and shall use a type of pitch that is no smaller than a standard 11-point font type, with the exception of charts, graphs, or tables, which shall use a pitch not smaller than 10-point font.

Responses to RFI shall not exceed 10 (ten) pages in length including images, data displays, charts, graphs, and tables. Do not include promotional materials.

RFI Responses shall include the following information in the order below:

A. Cover Page with the following information:

1. Company Name

2. Company Address

3. UEI Number

4. Company Point of Contact - Name, Title, Phone, and Email address

5. Statement of current business size status (i.e., HUBZone small business concern, service-disabled veteran-owned small business firm, 8(a) contractor, woman-owned small business, small business, public benefit corporation, or large business concern). Also, business size in relation to the NAICS code size standards assigned to this acquisition.

6. GSA Schedule Number, Contract Number, and Period of Performance and/or DHS Strategic Sourcing Vehicle Category Name and Contract Number, if applicable

B. Contractor Capability Statement (No more than (2-page limit) in length)

1. Summarization of relevant projects showing capabilities

2. Past performance in applicable areas

C. Contractor RFI Responses to questions (No more than (5-page limit) in length) The responses received will assist FEMA with identifying the number and nature of the entities that consider themselves potential technical solution providers. Each respondent, by submitting a response, agrees that any cost incurred in response to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of the respondent. FEMA shall incur no obligations or liabilities whatsoever, to anyone, for any costs or expenses incurred by the respondent in responding to this RFI.

D. Contractor Questions/Feedback to SOO (No more than (2-page limit) in length) Feedback and questions from the Contractor will help FEMA improve the current state of the draft SOO.

REQUEST FOR INFORMATION (RFI) QUESTIONS

Interested companies must submit responses to the below RFI questions with sufficient information to facilitate FEMA’s understanding of industry and technology capabilities and shortcomings.

1. Describe your understanding and experience maintaining and managing legacy, monolithic, multi-application systems in AWS Cloud, while applying a ‘Modernize in Place’ approach to improve the Risk MAP IT portfolio and move towards an integrated, flexible, scalable, and secure customer-centric digital ecosystem incrementally and continuously. Describe your experience with:

a. Developing a modernization roadmap

b. Designing an infrastructure solution that addresses reliability, accessibility, and growth requirements using cloud-native approaches and best-of-breed languages and framework.

c. Implementing a system architecture that allows for high performance; data optimization;

secure; and cost sensible.

d. Incrementally modifying the legacy application architecture

e. Decomposing some or all legacy monoliths into microservices

f. Integrating microservices within AWS Cloud

g. Use of APIs for accessibility and collaboration

h. Enabling data persistence in micro services

i. Decommissioning legacy applications

j. Key metrics tracked and reported.

k. Managing through agile DevOps processes

l. Resource, Staffing and Pricing model to support O&M and Modernize in Place

m. Other capabilities or methods that are essential to successfully operating and maintaining a complex legacy system while incrementally modernizing that same system’s application architecture.

2. Briefly describe your company’s familiarity and experience with:

a. Flood and multi-hazard prediction algorithms

b. Flood models to inform and educate technical and non-technical stakeholders on flood risk

c. Open source and proprietary Geographic Information System (GIS) and Geospatial Data

Visualization cloud-native tools/applications within FedRAMP ecosystem

3. As part of its ‘Modernize in Place’ roadmap the Risk MAP program plans to overhaul an existing major application, the Mapping Information Platform (MIP) and associated minor applications.

Combined, the Mapping Information Platform, Coordinated Needs Management System (CNMS) and the Project Planning and Purchasing Portal (P4) support future year planning and current-year execution of map production projects. The applications capabilities include, but are not limited to project management, facilitating secure sharing of digital flood hazard data and maps with approved project stakeholders, case management, data validation, data repository, file transfer, Earned Value calculation and reporting, project status reporting, cost estimation, and customer collaboration. Briefly describe your experience designing, developing, and implementing an integrated Project/Workflow Management System that support this type of functionalities.

Integration with government enterprise resources like Outlook, SharePoint, and JIRA is ideal but optional.

4. The Risk MAP program is evaluating whether to split the ‘Operations & Maintenance of legacy applications’ and the ‘Modernize in Place’ scope so it is managed by two different vendors What advantages and what risks do you see with this approach. How could the Government best mitigate the risks you have identified?

This RFI is for market research purposes only. Therefore, any questions submitted along with your response may or may not be answered by FEMA.

SOO QUESTIONS/FEEDBACK

Attached for reference is the draft Risk MAP CDS O&M SOO for this requirement. We would kindly appreciate any feedback you may have on requirements and areas that may require clarification. Please provide any recommendations that will improve the current state of the draft SOO.

INDUSTRY DAY

Information from this RFI may lead to an Industry Day and or one-on-one market research discussions and other forms of industry engagement with the top three potential offerors if the Government deems it necessary to discuss capabilities statements submitted.