SOO Risk MAP CDS OM - RFI 70FA3124I00000009 2.14.2024.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

Federal Emergency Management Agency

Risk Mapping, Assessment, and Planning (Risk MAP)

Customer and Data Services (CDS)

Operations and Maintenance (O&M) Support

Sources Sought Notice (SSN)/Request for Information (RFI)

RFI # 70FA3124I00000009

STATEMENT OF OBJECTIVE (SOO)

February 16, 2024

PROCUREMENT SENSITIVE INFORMATION

DEPARTMENT OF HOMELAND SECURITY (DHS)

DHS Statement of Objectives (SOO) DRAFT

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 2

Statement of Objectives (SOO) Risk MAP CDS O&M Support

Purpose The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Risk Assessments, Planning & Information Directorate (RAPID) [formerly Risk Management Directorate (RMD)], Risk Mapping, Assessment, and Planning Information Technology (Risk MAP IT) program, seeks to identify potential cloud knowledgeable offerors who possess experience using Amazon Web Services (AWS) in federal environment to operate and maintain its legacy applications while simultaneously applying modernization practices to update and enhance its Portfolio. Using an Adaptive Maintenance approach (also referred to “Modernize in Place,” by DHS

Information Technology Strategic Plan, FY24 - 28), Risk MAP IT seeks to achieve goals established by the FEMA Risk

MAP Program through continuous, systematic improvements to its system architecture, technology stack, and code base for 40+ applications and sub-applications hosted within a single system boundary on FEMA’s Enterprise AWS

Cloud.

Scope or Mission The Risk MAP IT program is one of two Acquisition Programs that comprise the Risk MAP program. The Risk MAP IT and Risk MAP Non-IT Acquisition Programs are beyond Acquisition Decision Event (ADE) 3 and in the Support phase of the Department of Homeland Security (DHS) Acquisition Lifecycle Framework (ALF), per a DHS Acquisition

Program Management Division Acquisition Decision Memorandum (ADM) dated February 3, 2010.

The Risk MAP Information Technology touches nearly every facet of the Risk MAP mission and directly affects the quality, availability, and accessibility of the flood hazard, flood risk, and mitigation planning information produced by the Risk MAP Program. The Risk MAP IT Portfolio is comprised of multiple systems, platforms, and software including:

The Risk MAP’s Risk Analysis & Management (RAM) categorized as the most complex system within FEMA, provide support for the NFIP through the development, interaction, or administration of internal and external facing flood mapping services, web applications, the distribution of flood map products, and customer support for Federal

Insurance and Mitigation Administration (FIMA) stakeholders including federal, state, local, and tribal governments;

their partners; and public customers. The functionality and data provided by the applications hosted on the RAM system are vital to equipping the public with actionable information about flood hazard. Two of the largest applications hosted on the RAM system, the Mapping Information Platform (MIP) and Map Service Center (MSC), are the official public source of flood hazard and risk data used to determine the purchase of flood insurance through

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 3 the NFIP. The RAM system hosts, operates, and maintains 40+ applications and sub-applications that is made up of an amalgam of new and old technologies, architectures, platforms, virtual servers, and tools that include a wide variety of PC-based, client/server, web-based and service-oriented components developed by FEMA using a variety of service providers. Add to this complexity, the aging infrastructure; obsolete codes; siloed architecture; lackluster performance; user functionality gaps; and high cost to maintain makes the RAM system unsustainable.

Applications hosted within the RAM system serve over 1.1K authenticated FEMA users, 200,000 public users with

Online LOMC accounts, and the public to support the following program processes:

• Produce flood hazard information in support of the NFIP.

• Create and track map development projects to sequence work and determine how to best to advance program mission.

• Make nation-wide preliminary data available in a centralized and easily accessible location, along with

FEMA’s other flood hazard mapping products.

• Maintain the National Flood Hazard Layer, a geospatial database of the nation’s effective flood hazard data, for FEMA’s NFIP.

• Make flood risk study, revision, and amendments project information and artifacts available to federal personnel, contractors, and Cooperating Technical Partners, supporting the Risk MAP program.

• Provide regulatory flood hazard information in a Geographic Information Systems (GIS) applications to public and power users.

• Receive and process Letter of Map Change (LOMC) Requests

• Provide software for risk assessments along with a library of assessment data, structure assessment information and export capabilities.

• Track and report mitigation plans and related data elements and query information and provide geospatial database access to view plan information by jurisdiction.

• Ability to transfer files/data and provide collaboration space between Risk MAP Providers, FEMA HQ and regional staff, contractors, and public stakeholders.

Applications and sub-applications within the RAM system uses 6 programming languages (Angular 2.0, C#, Java, JavaScript, PHP, Python/Django) and supports 243 virtual machines, 1000+ PIV-authenticated users, and over 500 terabytes of file data currently hosted on-premises at Allegany Ballistics Laboratory (ABL) in West Virginia. In addition, certain RAM applications also interface with external systems (eg., PIVOT, CIS) to push or pull data via services such as API which is necessary for the business process which these systems support. The RAM system on-prem boundary currently includes three physical locations: 1) the Allegany Ballistics Laboratory (ABL) Data Center facility located in Rocket Center, WV hosts the development, test, and production hosting environments; 2) IBM CDS in Fairfax, VA hosts support servers, Risk MAP IT Help Desk; and 3) the FEMA Engineering Exchange Library, FMIX

Call Center, and LOMC Clearinghouse, in Alexandria, VA.

Risk MAP’s IT infrastructure is now more than 10 years old and requires a significant investment to bring it into compliance with federal cyber security standards, maintain continuity of service, create efficiency in program delivery, and complete the transition to digital map production. At present customers experience performance issues due to infrastructure capacity and data growth as the RAM system is not able to ingest or transfer large amounts of data in the current configuration. Some of these will be alleviated by virtue of moving to the Cloud;

however, most of the applications are not cloud-native and thus may not provide an ideal, cost-effective solution to performance problems. Absence of an integrated repository precludes users depending upon the nature of their query constraints viewing, accessing, and analyzing datasets that stored outside of the central repository which

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 4 require manual intervention that is costly and inefficient. The current architecture is not conducive for collaboration that make processes painstaking laborious, time consuming and duplicative.

Risk MAP IT maintains and manages its IT portfolio using a Scaled Agile Framework (SAFe) Solution Train methodology. This CDS Solution Train is comprised of two independent Agile Release Trains (ARTs) and a collection of shared service teams that work across the ARTs to drives program-wide initiatives, upgrades, defects, security and software patching to existing applications and sub-applications.

Risk MAP IT has started its cloud journey by migrating its on-prem RAM system to the FEMA Enterprise Cloud (FEC)

Amazon Web Services (AWS) environment using a “lift and shift” approach that involves minimal changes to the existing RAM application architecture and code and enables a faster, less labor intensive, and less costly migration compared to alternative options. The Customer and Data Services (CDS) team, in coordination with the FEMA FEC team, expects to complete the cloud migration by Fall 2024. Once in cloud, the RAM Cloud system boundary will include all RAM applications, middleware, databases, and operating systems hosted within the FCE cloud environment. The RAM Cloud system boundary will inherit controls from AWS as the cloud hosting provider and FCE as the FEMA Cloud shared services provider.

With completion of the RAM system migration to cloud, Risk MAP IT hopes to realize the following benefits:

• Introduction of a staging environment and expansion of testing environment, which will mirror the production environment.

• Architecture that is adaptable, accessible, interoperable, connected, secure, and maintainable.

• Enhanced business capability to include advanced statistical analytics.

• Management of large dataset

• Resource and cost realization

• Environment to begin the next phase of its adaptive maintenance (i.e., modernization in place) efforts, which consists of incremental and iterative changes to its portfolio of IT systems and applications to support program needs.

With the baseline of the Risk MAP IT Portfolio Analysis completed in Spring 2023, and using the 7R’s of Application

Modernization, FEMA will lay-out a roadmap to optimize the RAM system performance in the AWS cloud infrastructure. One of the key takeaways from the IT Portfolio Analysis was identification of the following common gaps:

• Data Availability/Credibility – The ability for an organization to provide data that is complete, accurate and appropriately available whenever/wherever required.

• System Performance – The reliability of a system to perform, without limitation, in the way it was designed.

• Functionality & User Experience –The ability of a system to meet user functionality needs and meet them in an effective and easy manner.

• IT Portfolio Maintenance – The maintenance of systematic processes and content development to manage the IT Portfolio and individual systems.

To address these objectives, the Risk MAP IT Program intends to modernize in place, likely using the strangler method to incrementally enhance its technology stack to address the numerous architectural and technological challenges present in the current system. This Risk MAP IT Portfolio Analysis provides an initial baseline for Risk

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 5

MAP to rearchitect existing code bases, refactor existing code, decommission obsolete applications, and enhance required functionality. This large adaptive maintenance effort will replace the multitude of monolithic applications with an integrated ecosystem that is customer centric, and data driven. Risk MAP IT will prioritize its adaptive maintenance roadmap to:

• Decrease silos and unnecessary redundancies across the portfolio.

• Improve UI/UX, data quality and accessibility for stakeholders and end users, and

• Allow to store and share probabilistic flood hazard analyses and large data-set

• Provide an integrated environment for Technical SMEs and Risk MAP contractors across regions to collaborate.

Period of Performance The Government plans for a base period of one (one) year, and four (one year) option periods for a total duration of five years as depicted in the table below. This includes a 90-day transition-in period during base year, and 90-day transition-out period in Option Period 4, Period Duration Start Date End Date

Base Period 1 year 06/09/2025 06/08/2026

Option Period 1 1 year 06/09/2026 06/08/2027

Option Period 2 1 year 06/09/2027 06/08/2028

Option Period 3 1 year 06/09/2028 06/08/2029

Option Period 4 1 year 06/09/2029 06/08/2030

Total Period 5 years 06/09/2025 06/08/2030

Place of Performance The primary place of performance shall be at the Contractor’s Work Site. FEMA’s facilities located within 400/500 C

Street SW, Washington, D.C. may be used, if approved by the COR. The location of FEMA offices may shift during the period of performance based on HQ realignment. For planning meetings or other essential work-related sessions, on-site attendance at the place of performance may be required for staff located within the National Capital Region

(NCR)/ metropolitan Washington, DC area.

Background As part of the Department of Homeland Security (DHS), the Federal Emergency Management Agency (FEMA) operates the Risk Mapping, Assessment, and Planning (Risk MAP) program working with federal, state, tribal and local partners across the nation to identify flood risk. Risk MAP forms one of the foundational legs of the National

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 6

Flood Insurance Program (NFIP), through its role in providing authoritative flood hazard and flood risk maps, products (Regulatory and non) and tools that allow for assessment of flood risk, mitigation planning, and outreach support to communities.

Under the Risk MAP Program there are several established support programs that advance the missions related to mapping, risk assessment, mitigation planning, which include:

• The Natural Hazards Risk Assessment Program (NHRAP) supports natural hazard assessment through risk modeling tool development, data development, methodological guidance, and program integration support of risk assessment fundamentals across FEMA.

• Mitigation Planning helps state, local, tribal, and territorial community (SLTT) partners build resilience to future natural events. SLTTs use the planning process to manage actions that reduce long-term risks from natural hazards.

• The Cooperating Technical Partners CTP Program works with tribal, state, regional and local partnerships, nonprofits, and universities. The CTP program strives to show areas where floods may occur, to increase knowledge of the harmful effects of flooding, and to support the community in making safe growth choices.

Risk MAP, as a critical program aimed at reducing the nation's vulnerability to flood hazards, has a legal responsibility to maintain an ongoing flood mapping program and to ensure that flood hazard data are current and up to date. To meet this responsibility, Risk MAP primary focus is to produce and maintain regulatory flood maps that communities use to inform land use decisions. The Risk MAP program is undergoing changes to ensure that the best possible flood risk information is available in an equitable manner to all American communities. These changes are driven primarily by the need to meet unmet statutory requirements and by recent executive orders which emphasize equity, climate resilience, evidence-based policymaking, and customer experience.

Since the start of Risk MAP in 2009, FEMA has learned a lot about both what is effective in achieving the program goals and what needs to be improved to better address the capability gaps. Risk MAP updated its Multi-Year Plan to outline the program’s strategy, objectives, and updated goals for the next five years (2023-2027). Performance measures indicating mission success for Risk MAP include:

• Finishing 1,078 mapping projects to achieve 80% New, Valid, and Updated Engineering (NVUE)-Attained.

• The National Flood Insurance Reform Act of 1994 requires the review of all hazards every five years, as primary stakeholders have no other alternatives to map, assess and plan mitigations against flood risk.

• Updating IT infrastructure, included required security upgrades and system modernization to o Expeditiously remediate weaknesses and maintain continued authority to operate for all Risk MAP IT systems.

o increase SLTT stakeholders, individuals, and FEMA partners’ ability to readily access tailored risk information.

o maintain the ability to process and store large volumes of data produced by modern flood hazard and flood risk modeling methodologies.

o ensure system availability meets or exceeds 99.9% and application availability exceeds 99.5%

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 7

The NFIP has learned that a binary depiction of flood risk is insufficient for pricing, managing, and communicating flood risk. The NFIP transformation to a risk-informed program is also demanding that Risk MAP develop a more comprehensive understanding of flood risk. To meet this demand, Risk MAP program is (1) building and testing a new flood hazard and flood risk analysis framework; (2) developing a consistent communication approach refined for specific audiences; (3) improve integration of hazard mitigation planning with other community planning activities; and (4) design a modern IT system architecture and incrementally transform the existing IT portfolio, to provide more precise flood mapping products, risk assessment tools, and planning and outreach support to strengthen the community’s ability to make informed decisions about reducing risk.

Performance Objectives

1. Contract Management

a. Service Transition Management (Transition-In and Transition-out)

b. Contract Management

c. Staffing and Resource Management

d. Training

e. Contract Risk Management

f. Cost & Procurement Management

2. Risk MAP IT Program Management

a. Program (Schedule and Scope) Management Plan

b. Modernization Change Management

c. Configuration Management

d. Risk Management

e. Risk MAP IT System Performance Management

f. Service Level Agreement (SLA) Management

g. Reporting

3. Operations & Maintenance (O&M) of Risk MAP IT Portfolio Legacy Application(s)

a. O&M Plan & Management

b. Solution Architecture and Design Management

c. System Security

d. Authority to Operate (ATO)

e. Decommissioning

4. Modernize the Risk MAP IT Portfolio in Place

a. Modernization Plan & Management

b. Solution Architecture and Design Management

c. Application Readiness

d. System Security

e. Code Management

f. Authority to Operate (ATO)

5. Risk MAP IT Requirements Management

a. Persona Mapping

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 8

b. Use Case Management

c. Business Process Flow Map

6. Risk MAP IT Business Analyst

a. User Acceptance Testing

b. Business Relationship Management

7. Risk MAP Data Management & Reporting Support

a. Analytics

b. Compute

c. Data Architecture and Design

d. Data Quality

e. Data Integration

f. Data Encryption (At Rest, Transit, and Motion)

g. Data Privacy Safeguard

h. Data Retention and Disposal

8. Risk MAP Digital User Experience Management

a. Digital CX Technology Strategy & Development Roadmap

b. CX Technology Maturity Assessment

9. Risk MAP Product (Regulatory & Non-Regulatory) Support

a. Flood Map Processing

b. Letter of Map Change (LOMC) Clearinghouse

c. Fee Processing

d. Digital Map Request

e. FOIA and Departmental Inquiries

f. Federal Mapping and Insurance exchange (FMIX) contact center

g. Partner & Stakeholder Engagement – Communication & Collaboration (User Group, Conferences, Training)

10. Risk MAP IT Service Desk Operations

a. Help Desk

b. Access Management

c. Event, Incident and Problem Management

d. Technical/Application User Guides &Training

e. User Feedback

Operating Constraints

- All developers and contractors supporting or managing the application development, operations, and maintenance process must maintain use government furnished equipment that can only be accessed with a

PIV card issued by DHS/FEMA. FEMA is exploring use of Virtual Desktop as an alternate option.

- The FMIX contact center utilizes the FEMA Enterprise Voice Network (EVN)’s Voice over IP (VoIP) network solution Cisco Unified Communication Manager (CUCM). The CUCM is integrated with Cisco Unified Contact

Center Express (UCCX) and Cisco Finesse.

Learn more at fema.gov Risk MAP CDS O&M SOO_DRAFT 9

Government Furnished Equipment (GFE) The Government may provide GFE (e.g., a government furnished laptop) to individual contract staff members, if deemed necessary, after receiving any and all requisite COR approval(s), as well as any and all required authorizations.