02.04.01 70FA4026R00000010 CMDS RFP Amendment_Questions_Answers.pdf

70FA4026R00000010 Amendment/Questions & Answers

The Program has provided responses below to the questions received and would like to amend the request for price to include a short demonstration of the proposed software during the week of September 7-11, 2026.

Demonstration Dates

• Request for proposals responses due September 3, 2026, by 10:00am ET

• Vendors software demo time slot will not exceed (60 minutes) during the week of September 7-11, 2026 o Please provide at least two dates and times that work with your schedule on a separate cover sheet along with the below information o Please provide team members’ names and emails that will be present during presentation (limit to 4)

Zoom invites will be sent to each team member o Please provide a brief description or agenda for software demonstrations (what your company intends to discuss during your demo session)

• Anticipated award before or by September 22, 2026

• Vendors begin software data transfer (if applicable) September 23, 2026

Questions & Answers

1. Does the required solution need to provide and continuously maintain a licensed external media or stakeholder contact database, or will FEMA supply and maintain all contact records? If contractor-supplied data is required, please identify the required coverage, update frequency, data sources, and permitted licensing model.

Response:

The required solution must provide access to a contractor-maintained media contact database.

The SOW states that FEMA requires “seamless access to a database of media contacts,” including print, TV, radio, blogs, and other media contacts, as well as the ability to manage internal and non-media stakeholder contacts.

The contractor is responsible for populating and updating the media contact database at least every two weeks. The database must include accurate journalist and reporter contact information, including work email addresses and phone numbers. The SOW anticipates access to more than 50,000 journalist contacts, including national, local, and regional media contacts.

FEMA must also have the ability to add additional contacts to the database. FEMA will be responsible for customizing and adding non-media stakeholder contacts, such as FEMA, DHS, or White House staff, to designated distribution lists. The vendor is not responsible for tracking or updating non-media stakeholder lists.

The SOW does not prescribe specific data sources or a specific licensing model. Offerors should propose a licensing approach that supports the SOW requirements, including FEMA’s required use, access, update frequency, distribution needs, and data ownership or access requirements.

2. Please provide the anticipated number of named and concurrent users, contact records, distribution lists, annual messages, peak recipients per distribution, attachment sizes, and required communication channels so offerors can price licensing and delivery capacity consistently.

Response:

The SOW provides the following anticipated usage and capacity requirements:

• Named or active users: FEMA anticipates no more than 400 active accounts at any given point.

• Concurrent users: The solution must support a minimum of 50 concurrent users.

• Current/anticipated user population: FEMA currently has over 300 platform users.

• Media contact records: FEMA anticipates access to more than 50,000 journalist contacts, including national, local, and regional media.

• Legacy media contacts for transition: Approximately 5,000 existing media contacts currently exist in legacy contact lists.

• Distribution lists: The SOW states there shall be no maximum number of distribution lists and no maximum number of media contacts per distribution list, due to FEMA’s mission need to disseminate life-saving preparedness and disaster response information.

• Peak recipients per distribution: The system must be able to distribute emails to up to 10,000 contacts. Historically, FEMA has distributed to more than 700 recipients per news release.

• Message volume: The SOW estimates up to 20,000 pages per month, with an estimated monthly distribution average of 350 documents of 2 pages to 1,000 contacts. During peak disaster response, FEMA has distributed 144 news releases in English and Spanish per month.

• Media inquiries: During steady state, FEMA receives over 100 media inquiries per month.

During disaster activations, inquiries can exceed 600 per month.

• Attachments: The solution must support group and individual emails with up to 10 attachments. Attachment formats include, but are not limited to, PDF, PNG, and JPEG. The SOW also requires support for multiple attachments, documents, and links or hyperlinks ranging from 1 to 50 pages. Able to load photo attachments to press releases for photo release distribution to the media.

• Required communication channels: The SOW requires distribution of press releases, media advisories, fact sheets, attachments, and other external affairs campaign documents via email and/or wire services, 24 hours a day, 7 days a week.

• Supported client environment: The solution must be web-based, require no special software, and be accessible within the FEMA/DHS-secured network using Mozilla Firefox 78 or newer and/or Microsoft Edge 83 or newer. The solution should also be compatible with FEMA standard Windows-based systems and iOS mobile devices.

• Template Management: Upload and create new distribution templates to the platform— including press releases, media advisories, and photo releases—originating from FEMA headquarters, regional offices, joint field offices, long-term recovery offices, and transitional recovery offices.

3. Please identify the incumbent system and clarify which data must be migrated, including contacts, distribution lists, templates, message history, consent and suppression records, analytics, attachments, and audit logs, along with available export formats.

Response:

The SOW identifies the current system as Cision Public Relations/VOCUS.

The SOW requires the contractor to provide a transition plan and to support transition from FEMA’s current service provider or system to the new system to ensure continuity of operations and execution of daily tasks.

The SOW identifies the following data for transition:

• Current contacts, distribution lists, and recent activities from FEMA’s current service provider or system.

• Legacy communications between FEMA and media stakeholders.

• Existing contact lists and contact management data.

• Approximately 5,000 media contacts.

• Media inquiries, up to 100,000 activities.

• News releases and distributions from FEMA headquarters, regional offices, joint field offices, long-term recovery offices, and transitional recovery offices.

• Account users, while safeguarding FEMA employee contact information such as email addresses.

The SOW states that contact lists are currently saved in Microsoft Word, Excel, and/or PDF formats.

The SOW does not specifically identify templates, consent records, suppression records, analytics, attachments, or audit logs as required migration elements. Offerors may describe their approach to migrating any additional available data elements if supported by the incumbent system exports and consistent with the SOW requirements.

4. Please confirm the required federal security and compliance posture, including any FedRAMP authorization level, FEMA or DHS ATO requirements, FISMA categorization, PIV or SSO integration, Section 508 testing, records-retention obligations, data residency, and required security documentation at proposal submission.

Response:

The SOW requires the solution to meet applicable federal, DHS, and FEMA security protocols.

The following security, privacy, accessibility, and records requirements are identified in the SOW:

• DHS/FEMA security policies: The contractor must follow standards established within DHS and FEMA policy.

• Controlled Unclassified Information: Work may involve access to Controlled Unclassified Information, including information up to sensitive but unclassified/FOUO levels.

• Background investigations: Contractor personnel requiring access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information must undergo background investigations commensurate with the risk designation. The SOW identifies Low Risk, Moderate Risk, and High Risk investigation requirements and states that favorable adjudication is required prior to performing work unless otherwise permitted by FEMA Personnel Security Division procedures.

• U.S. person/citizenship requirement: The SOW includes a requirement that individuals will be U.S. citizens in the security section, and also includes HSAR language allowing U.S.

citizens or lawful permanent residents unless exceptions are approved by the Department’s Chief Security Officer or designee.

• Training: Required training includes, as applicable, Unauthorized Disclosure of Classified or Unclassified Information, OPSEC Awareness, Insider Threat Awareness, Privacy at DHS, CUI training, and IT Security Awareness Training. DHS Rules of Behavior must be signed before accessing DHS systems and sensitive information.

• Privacy: The SOW includes FAR 52.224-3 Privacy Training, Privacy Act Notification, Privacy Act clauses, and information sharing requirements. It states that the contractor will have limited access to FEMA employee PII, including FEMA email addresses, and access to media contact information collected and stored in the system. Full PIA coverage is pending for the FEMA Contact Management and Distribution System PIA.

• System of Records and PIAs: The information sharing is identified as authorized by DHS/ALL-002, DHS/ALL-004, DHS/ALL/PIA-006, and DHS/ALL/PIA-031, with a FEMA PIA for the Contact Management and Distribution System pending.

• ATO: The SOW includes HSAR 3052.240-72 Safeguarding of Controlled Unclassified Information Alternate I, which states that the contractor shall not collect, process, store, or transmit CUI within a Federal information system until an Authority to Operate has been granted by the Component or Headquarters CIO, or designee. It also identifies the Security Authorization process and required Security Authorization package elements.

• Security Authorization documentation: The SOW identifies a Security Authorization package consisting of a Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and ATO Letter. Additional documents may include Plans of Action and Milestones and Interconnection Security Agreements. The package must be validated by an independent third party and submitted to the COR for review and approval at least 30 days prior to operation of the information system.

• Continuous monitoring: Contractors operating information systems on behalf of the Government must comply with federal reporting and continuous monitoring requirements.

Monthly continuous monitoring data must be stored at the contractor’s location for at least one year unless otherwise specified.

• Incident reporting: Known or suspected incidents involving PII or SPII must be reported within one hour of discovery. Other incidents must be reported within eight hours of discovery.

• Encryption: CUI transmitted via email must be protected by encryption or transmitted within secure communications systems. The SOW references FIPS 140-2/140-3 validated cryptographic modules.

• Section 508: All EIT deliverables must comply with applicable Section 508 technical and functional performance criteria. The SOW identifies applicable standards for software applications, web-based applications, telecommunications products, desktop and portable computers, functional performance criteria, and information documentation and support. Testing must include Section 508 compliance using DHS Office of Accessible Systems and Technology-approved testing methods and tools.

• Records management: The contractor must comply with Federal records management laws and NARA policies, including the Federal Records Act, NARA regulations, FOIA, and the Privacy Act. FEMA owns the rights to all data and records produced as part of the contract. Records may not be destroyed except in accordance with applicable agency records schedules and required written concurrence.

• Return or destruction of PII: If FEMA PII is no longer required, or upon termination of the contract, the contractor must notify FEMA and return or, at FEMA’s written request, destroy, uninstall, and/or remove all copies of such PII within 14 days and certify completion in writing.

• DHS Enterprise Architecture: All solutions and services must meet DHS Enterprise Architecture policies, standards, and procedures, including DHS/FEMA EA, TRM, data management requirements, and IPv6 compliance.

The SOW does not specify a FedRAMP authorization level, FISMA categorization, PIV integration, SSO integration, or data residency requirement. Offerors should identify any assumptions and describe how their proposed solution will meet the stated DHS/FEMA security, privacy, accessibility, ATO, and records management requirements.

5. Please identify all required interfaces and systems of record and provide the implementation acceptance criteria, including any required performance, deliverability, migration-reconciliation, security, and user-acceptance thresholds.

Response:

The SOW identifies the solution as a web-based, commercial off-the-shelf platform supporting contact management, inquiry tracking, distribution, stakeholder engagement metrics, training, administrative support, and transition of legacy data.

The SOW identifies or references the following interfaces, integrations, or related systems:

• FEMA’s current service provider or system, identified as Cision Public Relations/VOCUS, for transition of current contacts, distribution lists, recent activities, media inquiries, news releases, and distributions.

• Microsoft Outlook, Excel, and SharePoint integration is identified as desirable.

• Export/download capability to Microsoft Word, Excel, and PDF is required for analytics and reporting.

• Web access through Mozilla Firefox 78 or newer and/or Microsoft Edge 83 or newer is required.

• Compatibility with FEMA standard Windows-based systems and iOS mobile devices is required.

• Email distribution is required, and wire service distribution is included as an email and/or wire services requirement.

• The system must be accessible within the FEMA/DHS-secured network.

The SOW identifies the following implementation and performance-related requirements:

• The platform and technical support must be available 24 hours a day, 7 days a week.

• The solution must require no special software.

• The system must support at least 50 concurrent users and no more than 400 anticipated active accounts at any given point.

• The system must support distribution of emails to up to 10,000 contacts.

• The system must allow no maximum number of distribution lists or number of media contacts per distribution list.

• The system must support up to 10 attachments per group or individual email, including formats such as PDF, PNG, and JPEG.

• The system must support multiple attachments/documents and links/hyperlinks ranging from 1 to 50 pages.

• The contractor must update media contact information at least every two weeks.

• Confirmation emails with pertinent metrics must be sent directly to the user who initiated a distribution immediately after distribution.

• Reporting must identify successful and unsuccessful delivery directly to the user initiating the distribution.

• Help Desk support must be available 24/7, and issues should be resolved within 24 hours.

• The transition plan must be delivered by the end of the first month, with execution within the next 30 days.

• Training must include a minimum of six FEMA-specific interactive training sessions annually, with nine in the base period.

The SOW’s deliverables table provides the verification approach:

• Contact Management: Delivered every two weeks to the FEMA database. Verification occurs when FEMA users identify incorrect information and the COR notifies the vendor.

• Tracking/Inquiry Management: Delivered daily to the platform. FEMA users verify, and inquiry reports are pulled daily.

• Distribution System: Delivered immediately/daily to FEMA stakeholders. Verification includes stakeholders receiving the distributions/email and the confirmation email being sent to the initiating user.

• Stakeholder Engagement Metrics: Available after distribution or when a FEMA user wants to pull information. Verification is through reports generated by the platform.

• End User Support: Should be resolved within 24 hours.

• Training: Six times annually, nine times in the base period.

• Transition Plan: Delivered by the end of the first month, with execution within the next 30 days, verified based on transition of all legacy data to the new solution/platform.