DRAFT-_NFIP_Direct_-_SOO.pdf

NATIONAL FLOOD INSURANCE

PROGRAM

NFIP DIRECT

Statement of Objectives (SOO)

August 14, 2019

PROCUREMENT SENSITIVE

2 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

1 PURPOSE

The purpose of this SOO is to obtain insurance industry leading and innovative contract support for NFIP Direct services that meet the objectives described herein in a manner that aligns with FEMA’s Strategic Plan, FIMA’s guiding principles and values and the Federal Insurance Directorate (FID) Strategy.

2 BACKGROUND

FEMA’s mission is to help people before, during, and after disasters. FEMA accomplishes this mission through the development and execution of the FEMA Strategic Plan1.

FEMA’s Strategic Goals are:

Build a Culture of Preparedness Ready the Nation for Catastrophic Disasters Reduce the Complexity of FEMA

FEMA focuses on building and developing a culture of preparedness across the country and unifying all levels of community and government into an integrated approach to emergency management. As part of FEMA, the Federal Insurance and Mitigation Administration (FIMA) concentrates on increasing the capabilities necessary to reduce loss of life and property by lessening the impact of disasters. FIMA has developed guiding principles that drive decision making.

FIMA’s guiding principles are:

Emphasize integration and collaboration Strive for innovation where needed Improve the customer experience Improve organizational health

FIMA manages the National Flood Insurance Program (NFIP). Congress created the NFIP through passage of the National Flood Insurance Act (NFIA) of 1968, and over the last 50 years, Congress has updated and added new requirements through various other legislation2. Through passage of these acts, Congress authorized FEMA to institute regulations that govern the NFIP and the delivery of flood insurance to policyholders in eligible communities using Title 44 Code of Federal Regulations (44 C.F.R.) parts 59 through 623. To emphasize the importance of the information, FEMA incorporated the

2016-title42-chap50.pdf 3 https://www.gpo.gov/fdsys/pkg/CFR-2017-title44-vol1/pdf/CFR-2017-title44-vol1-chapI-subchapB.pdf

3 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

entirety of the Standard Flood Insurance Policy4 (SFIP) into 44 C.F.R. FEMA also issues further guidance to external partners to aid in the issuance of policies and adjusting of claims, such as the Flood Insurance Manual5 (FIM), the National Flood Insurance Claims Manual6, and various FEMA Bulletins7.

Under FIMA, the Federal Insurance Directorate’s (FID) mission is to provide customer focused flood insurance to help survivors and their communities effectively recover from flood events

As part of the NFIP, the NFIP Direct facilitates the issuance and administration of flood insurance policies on behalf of the government. As such, positive public perception of the NFIP Direct and its handling of policy administration are important to FEMA. FEMA requires the NFIP Direct to fully comply with all statutes and demonstrate working knowledge and understanding of applicable regulations, policies, guidelines, and specifications that affect the NFIP, FIMA, FEMA, and DHS.

The NFIP Direct is in a position to set the standard for the entire NFIP by embodying FIMA’s guiding principles and FEMA’s strategic goals. FEMA envisions the NFIP Direct as the example and insurance industry leader for the entire NFIP and expects NFIP Direct employees to be familiar with all FEMA survivor programs to facilitate seamless service to survivors. FEMA also requires the NFIP Direct to function as a test laboratory for program innovation and initiatives that further FIMA’s guiding principles and the FEMA mission. To meet this vision, FIMA requires the awardee to continuously review, improve and innovate processes and tools as the environmental, technological, and political considerations impacting the NFIP evolve.

3 SCOPE

The awardee shall perform all actions necessary to, or incidental to, policy administration services for flood insurance policies in support of the direct side of the NFIP. The awardee shall have responsibility for management, operation, maintenance, and quality assurance for the services. The actual number of policies administered by the NFIP Direct and percentage of NFIP Direct policies within the entire NFIP varies daily. Because of this, the Government does not guarantee the number of policies to be written by the NFIP Direct.8 The Government, through this contract, reserves the right to establish unique operations, standards and reporting requirements specific to the direct side of the NFIP and unique policies to be issued solely by the NFIP Direct. Should the situation arise, the awardee shall

4 A copy of the SFIP can be found within the FIM which is available at https://www.fema.gov/flood-insurance-manual

8 Currently, the NFIP Direct handles about 13% of the entire NFIP, or about 656,000 policies. Please see the attached historical policy counts for reference.

4 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

also assume the policies of WYO companies that withdraw or that FEMA terminates from the NFIP.

Furthermore, the awardee will act as a laboratory for testing government initiatives that aim to enhance customer experience and better align the NFIP Direct with FEMA’s Strategic Plan, FIMA’s guiding principles, and FIMA’s values.

4 PERIOD OF PERFROMANCE

The period of performance shall be twelve (12) months, with 4 twelve (12) month option periods.

5 PLACE OF PERFORMANCE

Contract objectives shall be performed at the awardee’s site within the continental United States, with the primary or satellite9 office, including at least the Project Manager and 50% of their Key Personnel, within 50 miles of FEMA Headquarters,10, and any IT solution(s) must reside on a government-only cloud-hosting environments which is, at a minimum, FedRAMP moderate level authorized at the infrastructure (IaaS) level, and platform (PaaS) level should outsourcing of platform services occur11.

6 GOVERNMENT-FURNISHED EQUIPMENT

The awardee shall furnish all personnel, facilities, equipment, software, material, supplies, and services, except as may be expressly set forth in this SOO as furnished by the Government. To ensure the highest level of protection, all GFE must be imaged by and maintained with a DHS/FEMA certified image. The awardee shall be responsible for operating and storing all government furnished equipment (GFE) in a secure manner and in accordance with current rules and regulations. Additionally, the awardee shall designate a single point of contact (POC) for FEMA to work through when assigning or issuing GFE.

This individual will be responsible for tracking the whereabouts of all issued GFE.

A list of GFE furnished for this contract is set forth below.

Nfipdirect.fema.gov domain name with a Government Controlled DNS and External Validation certificates related to the Nfipdirect.fema.gov domain.

Cisco Routers related to OneNet tunnel SCI Tunnel related to OneNet connection NFIP Direct Phone numbers

9 A Satellite office should include capability to handle all subject areas of administering flood insurance policies.

10 FEMA Headquarters is located at 500 C Street, SW, Washington, DC 20024.

11 Authorized IaaS and PaaS Services Providers available at https://marketplace.fedramp.gov/#/products?status=Compliant&sort=productName

5 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Laptops for System Administrators, Privileged users, and FICO Kits o A list of names, titles, contact information need to be provided to FEMA of those individuals requiring GFE prior to the official transition Hard Drives for Transitioning In and Transitioning Out.

FICO Kits

7 PERFORMANCE OBJECTIVES AND REQUIREMENTS

The awardee shall provide solutions, which are able to be implemented in the public sector, that are innovative, flexible, reflect subject matter expertise, and increase efficiency and effectiveness, taking into consideration the Government’s continuing resource constraints.

The overall performance objective is to deliver customer-focused, secure, quality, scalable direct service operations in a cost-effective and timely manner, while testing new initiatives of the NFIP.

Transition the operations of the NFIP Direct and effectively migrate data from the incumbent with minimal stakeholder disruption.

Develop and provide a project plan with a comprehensive timeline for transition and migration.

Anticipate and mitigate potential problems or impediments that may hinder transition or migration.

Collaborate with the government and incumbent to ensure a smooth and full transition of operations and knowledge.

Participate in, and sign-off, within 10 business days of completion of discussions, on documents resulting from, knowledge transfer sessions with FEMA and the incumbent for various subject matters and business operations as defined by FEMA, including, but not limited to underwriting, claims, call center, finance, correspondence, and System of Record compliance.

Obtain an Authority to Operate (ATO12) for the proposed IT solution(s) through FEMA’s Office of the Chief Information Officer (OCIO).

Provide proper documentation to FEMA demonstrating adherence to all IT system, privacy, and security requirements set forth in other sections of this SOO.

Successfully clean/cleanse/scrub and migrate all relevant data, ensuring data quality, into the secure IT solution proposed once ATO is granted. No data can be provided prior to ATO.

Coordinate and perform multiple rounds of parallel testing with FEMA, the incumbent, and other relevant government contractors.

Coordinate with FEMA, and the incumbent when necessary, and perform pre-transition tests on FEMA-owned phone numbers and URLs.

12 According to internal guidance put out by OCIO, the average timeframe for a FEMA ATO is one year from start to finish. Please allot for the appropriate amount of time.

6 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Provide FEMA personnel training on all applicable IT solution(s) prior to the transition of operations from the incumbent to the awardee, including, but not limited to, policy administration system and contact center system.

Establish tailored system roles for FEMA Stakeholder, based on FEMA requirements, within applicable IT solution(s) prior to the transition of operations from the incumbent to the awardee.

Direct Service Branch Role Other FEMA Role

Coordinate with FEMA to establish and implement reoccurring reports and business intelligence solution(s) prior to the transition of operations from the incumbent to the awardee.

Timely and accurately issue and administer all NFIP Products, including Direct-only products, to further FEMA’s mission and maximize stakeholder confidence in the NFIP.

Readily furnish, and make electronically available, when applicable, insurance policy forms and NFIP print materials to stakeholders.

Accept and process flood insurance applications within the timeframes referenced in applicable NFIP rules and regulation, as well as those set forth in the Quality Assurance Surveillance Plan (QASP). This should include the acceptance of both electronic and hardcopy submissions.

Underwrite and validate application information to accurately rate the policy and properly cover the policyholder’s property to mitigate policyholder risk.

Collect and process premiums (initial, renewals, and endorsements) (electronic credit card submission, paper check, wire transfer, money order – No cash accepted directly)

Generate and furnish the policy declaration page and a copy of the policy to policyholders and any applicable stakeholders within the timeframes referenced in applicable NFIP rules and regulation, as well as those set forth in the QASP.

Proactively troubleshoot issues with policyholder agent and other stakeholders when additional information is needed to process applications, execute renewals, or administer policies.

Generate and furnish renewal notices to policyholders and any applicable stakeholders within the timeframes referenced in applicable NFIP rules and regulation, as well as those set forth in the QASP.

Process renewals/endorsements and furnish updated declaration pages to policyholders and any applicable stakeholders within the timeframes referenced in applicable NFIP rules and regulation, as well as those set forth in the QASP. This should include the acceptance of both electronic and hardcopy submissions.

Process policy cancellations, ensuring validate reason for cancellation, and issue timely refunds (if applicable) within the timeframes referenced in applicable NFIP rules and regulation, as well as those set forth in the QASP. This should include the acceptance of both electronic and hardcopy submissions and should impose

7 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

minimal requirements on the policyholder.

At the direction of the Government, coordinate, as needed, with Federal, State, Local, and Tribal governments and communities regarding policy and policyholder information, community standards, and mandatory purchase requirement instructions.

Provide access to all necessary information for FEMA to conduct Operation Reviews, audits, and other surveillance of NFIP Direct Underwriting policy records.

Timely respond to findings and recommendations of the aforementioned reviews, audits, and surveillance.

Coordinate with FEMA and its partners to identify eligible survivors and issue GFIP certificates to those that qualify.

At the direction of the Government, coordinate with FEMA’s Individuals and Households Program (IHP) and personnel from State Other Needs and Assistance13 (ONA) program, when necessary.

Review list of recipients provided by FEMA IHP or the State’s ONA program, confirming the recipient is eligible for policy and returning ineligible and duplicative recipients. Notify the government of any discrepancies.

The Contractor shall coordinate and resolve any processing issues with FEMA‘s Individuals and Household Branch.

Process Premiums, returning funds for ineligible or duplicative certificates.

Issue master policy and subsequent certificates after observing any required waiting periods in accordance with applicable NFIP rules and regulations, and those set forth in the QASP.

Furnish certificate, Summary of Coverage Letter, and copy of the master policy to recipient in a timely manner within 10 days of receipt of accurate documentation from Individuals Household Branch or owner.

Maintain records at both the master policy and recipient certificate level within any proposed IT solution(s). The solution(s) should have the capability to track any policy or certificate to a specific disaster declaration and individual certificate coverage dates.

Process New owner/tenant notifications Reconcile List of Recipients with Premiums Received, notifying FEMA when there are discrepancies.

Update GFIP Coverage limits with any proposed IT solution(s) and within any GFIP related materials annually, or at any time as requested by FEMA.

Maintain all necessary GFIP policy administration guidelines, form letters, and procedures. These items shall be subject to FEMA approval.

Furnish anniversary and termination of coverage notice letters to recipients, within the timeframes referenced in applicable NFIP rules and regulation. The letters shall

13 It should be noted that there are states that handle their own GFIP listing under the ONA program and submission to the NFIP Direct contractor, which currently include TX, MD, PA and WA.

8 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

include the master policy expiration date and the Terms and Conditions of the GFIP Certificate of Flood Insurance. Additionally, the letters shall be made available in English and in Spanish.

Assist FEMA in targeting GFIP certificate recipients for retention through the sale of a SFIP.

Cancel policy for any recipient that elects to purchase an SFIP during the term of the

GFIP.

Operate the Special Direct Facility (SDF), and seamlessly transition policy administration of Severe Repetitive Loss (SRL) policies in and out with minimal policyholder disruption.

Generate and furnish notification letters to policyholders, agents, and lenders once the System or Record’s contractor has identified a policy as an SRL property.

Update the SRL database accordingly.

Provide information to the insured and their agent on how to appeal an SRL designation and in the event of an appeal, follow established NFIP appeal procedures.

Generate and furnish pre-renewal letters to the SRL policyholders informing them of the special renewal process.

Re-underwrite all new SRL polices underwritten by the NFIP Direct with respect to rates for correct premium charges, zone information, loss history and any policy-zone grandfathering information. Coordinate with the NFIP-IT Systems and Services contractor for SRL file updating. Provide audit trail that the policy has been re-underwritten.

Provide status reporting that details re-underwritten SRL policies and reviews the SRL book of business per FEMA requirements.

Coordinate and collaborate with the government and other stakeholders to vigorously target SRL properties for FEMA-approved mitigation projects that will remove them from the SRL program and makes them eligible for Standard policies.

Proactively campaign to communities to encourage FRED (Flood Proof, Relocate, Elevate, or Demolish) Mitigation of SRL properties.

Track and report to FEMA the status of SRL policies, including but not limited to:

removals from the SRL program, ongoing efforts to target SRL properties for mitigation, and campaigns efforts to the community to encourage mitigation.

Design and implement scalable, customer-focused customer service solutions to consistently and effectively serve NFIP stakeholders.

Positively and professionally represent the government to the public throughout all aspects of services provided on the government’s behalf.

Deliver robust and dynamic customer service processes, tools, and reporting that leverage industry best practices, support the needs of the NFIP, and align with FIMA’s guiding principles.

Develop and operate a contact center to interact with NFIP stakeholders and

9 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

address inquiries through various channels (phone calls, social media, emails, etc.)

with scalable staffing levels between normal and surge periods based on demand.

Maintain operating hours of 8:00am to 8:00pm Monday through Friday, Eastern Standard Time/Eastern Daylight Savings Time, with additional hours of operation added during surge level demand, as needed. All federal holiday observances should follow the government schedule. The Government does not expect for operations to take place during those days but may be allowed with permission from the Contracting Officer Representative (COR) to the Project Manager (PM). No exceptions will be made during disasters.

The proposed contact center solution shall include ways for stakeholders to submit inquiries both during (calls, emails, etc.) and outside (voicemail, emails, etc.) of operating hours.

Assume operation of the FEMA-owned NFIP Direct Servicing Agent Customer Support national toll-free telephone line (1-800-638-6620) as part of the contact center solution.

Ensure adequate staffing to address English and Spanish speaking inquiries in each of the contact center departments.

At a minimum, staff shall be able to:

7.5.3.5.1 Change or correct the insured’s name

7.5.3.5.2 Add an additional insured’s name

7.5.3.5.3 Remove an insured’s name with supporting documentation

7.5.3.5.4 Change or correct the insured’s mailing address

7.5.3.5.5 Add or remove a lender from the policy

7.5.3.5.6 Make minor corrections to submitted new business applications as long as money has not been applied.

7.5.3.5.7 Approve primary residence for the Present Term.

7.5.3.5.8 Approve endorsements to change residency status to non-primary.

7.5.3.5.9 Approve Renewal Instruction applications to apply primary residence or non-primary residence.

7.5.3.5.10 Acknowledge receipt of documentation.

Access, as required, to assist English and Spanish speaking callers.

Staff and operate 508 Compliant Contact Center Phones and IT Systems.

Supply knowledgeable staff capable of addressing, at a minimum, Agency

Services, Underwriting, and Claims interactions and inquiries.

The proposed contact center solution shall include real-time visibility into relevant information, including, but not limited to call wait times, contact center personnel status, and number of pending inquiries by outreach channels.

IT components of the proposed contact center solution shall be remotely-

10 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

accessible and subject to all IT related requirements, objectives, and constraints described herein.

Provide FEMA with an accurate representation of contact center workflow that reflects how contacts will be handled, and escalated if necessary, for each of the various channels. This workflow shall reflect operations as of the first day post-transition from the incumbent.

Maintain, and provide to FEMA, a contingency plan for when the Contact Center solution is unable to connect with stakeholders (i.e. unexpected office closure, full utilization of contact center staff, etc.)

Provide FEMA full access to recorded calls and transcripts of written interactions (i.e. emails and live chats) between the awardee & NFIP stakeholders for quality assurance purposes.

Timely respond to voicemails and written inquiries not covered under correspondence guidelines within the timeframes referenced in applicable NFIP rules and regulation and those set forth in the QASP.

Provide FEMA access to conduct surveillance of live customer calls, remotely and in-person, and visit Contact Center location(s) after advanced COR notification to the awardee for quality assurance purposes.

Identify and provide timely feedback to FEMA on common themes (both positive and negative) that arise through stakeholder interaction.

Support FEMA NFIP correspondence activities in accordance with the timelines and reporting requirements set forth in applicable NFIP rules and regulation, as well as those set forth in the QASP.

Establish and maintain detailed written procedures for handling correspondence.

Procedures shall be subject to FEMA approval and shall, at a minimum, demonstrate an ability to effectively control incoming and outgoing correspondence; perform a high level of quality assurance; and handle all correspondence tasks in a timely manner.

Develop, operate, and maintain a remotely-accessible IT solution(s) for tracking and maintaining records of all correspondence.

IT components of the proposed correspondence solution shall include, at a minimum, automated controls and routing for approvals based on type of correspondence; the ability to search correspondence by various data points (i.e. topic, received date, sender, etc.); the ability to calculate correspondence related selected service performance area (SSPA) metrics;

and a copy of the correspondence.

Provide FEMA full access to the proposed IT solution for visibility into current and past correspondence.

IT components of the proposed correspondence solution shall be subject to all IT related requirements, objectives, and constraints described herein.

11 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Field and respond to all Controlled correspondence in accordance with the timelines and reporting requirements set forth in applicable NFIP rules and regulation, as well as those set forth in the QASP.

Controlled correspondence is considered VIP (congressional), White House, and DHS correspondence. Controlled correspondence is processed by FEMA’s IQ system. Only select FEMA personnel have access to the IQ system, and currently all controlled correspondence status reporting is conducted through the FEMA IQ system. FEMA’s Risk Insurance Division’s (RID) SharePoint Correspondence Tracker application supports controlled correspondence processes, provides templates and also tracks status that is reconciled with FEMA’s IQ system on a regular basis.

Field and respond to all Uncontrolled correspondence in accordance with the timelines and reporting requirements set forth in applicable NFIP rules and regulation, as well as those set forth in the QASP.

Uncontrolled correspondence (UCC) is defined as General correspondence.

General correspondence is received by postal mail, and hard copies are scanned into a web-based document library, such as SharePoint. Email correspondence is also classified as uncontrolled correspondence.

Uncontrolled correspondence is not handled by the IQ system, however FID’s SharePoint Correspondence Tracker supports UCC workflows and reporting to assess workloads and performance by federal and contracted support personnel.

Provide scalable and cost-effective solutions for the processing and disposition of claims at normal and surge levels in accordance with NFIP rules and regulations.

Develop and maintain a Catastrophe (CAT) Plan that sets forth how the awardee shall (before, during, and after an event) successfully respond to events, including, but not limited to, those objectives set forth in this subsection. The plan shall reflect how the awardee responds to varying size events, from one small event to multiple location simultaneous events.

Negotiate, and maintain throughout the contract, pre-positioned vendor agreements with Independent Adjusting (IA) Firms, outside examiner firms, and other temporary employment agencies, as appropriate, to allow for quick response when implementing the CAT Plan.

12 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Regularly evaluate the Flood Insurance Claims Office (FICO) Kits for IT operability and adequate supply levels.

Effectively evaluate flood situations and execute the CAT Plan as necessary.

Provide FEMA a timely assessment of potential NFIP Direct claims exposure pre-event, when applicable, to FEMA and update, as necessary, to reflect actual exposure as the event progresses.

Maintain regular contact with FEMA during and after events, as well as, coordinate with State & Local stakeholders and other NFIP contractors, when instructed by the government.

This may include, but is not limited to, the System of Record’s contractor, FEMA’s Individuals and Households Assistance Program, SBA, and other Federal Loan or Assistance Programs.

Aid Policyholders and Agents in filing the First Notice of Loss, and open claims record within the proposed IT solution.

Ensure adequate adjuster presence within forty-eight hours in any any given disaster area, paying particular attention to multi-location and multi-event conditions.

Establish, manage, and operate a FICO at disaster locations per FEMA requirements.

Deliver a reliable, timely and cost effective strategy for providing an appropriate number of FICO capable disaster teams and backup teams to flood areas as required by FEMA. In particular:

Establish emergency strategies for distributing NFIP informational materials to adjusters and policyholders to expedite claims processing and assist policyholders in filing claims.

Be capable of deploying FICO back-up team(s) to at least four separate geographic areas simultaneously. Such teams must be operational within seven calendar days of Contracting Officer’s Representative (COR) notice.

Collect Data related to FICO (i.e. number of visitors, questions asked, were questions answered)

If the COR determines the NFIP policies in a flooded area do not warrant opening an FICO, operate and staff to an appropriate level an In-House FICO, which may be coordinated with an Adjuster Control Office (ACO).

Operate and maintain appropriate secure field-based technology to support effective adjuster assignments and prompt claims payments.

Coordinate with the System of Record’s contractor Flood Response Office (FRO) as directed by the COR.

Swiftly and efficiently assign claims to Adjusters by accounting for impacting factors including, but not limited to, geographical location of damaged property and adjuster current workload.

Adequately stock and furnish to adjusters, and other stakeholders, those forms and other printed supplies used in connection with claims processing. These shall be made available electronically and in paper format.

13 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Report daily claims polling information per FEMA requirements, as needed.

Assign an adequate case-loss reserve to each claim within the proposed IT solution;

update the case-loss reserves as payments are made and as information becomes available; and report the reserve, and any updates to the reserve, to the System of Record.

Expedite claims advance payments, whenever possible, to assist the policyholder in recovery efforts.

Verify the repair of prior claims’ damage before determining eligible damages on current claim.

Promote and assist the efficient adjustment and settlement of wind-water losses.

Accurately and efficiently process claims, including, but not limited to, processing the Preliminary Reports, Proofs of Loss, Interim Reports, and Final Reports.

Swiftly and accurately issue claims payments based on eligible losses, including, but not limited to, advanced payments, partial payments, final payments, and Allocated Loss Adjustment Expenses (ALAEs) including Special Allocated Loss Adjustment Expenses (SALAEs).

Reopen claims when necessary.

Provide FEMA unrestricted online access to all open and closed claims files including, but not limited to, all photographs, correspondences related to the claim, and all notes from awardee personnel and outside parties involved in the claim.

Additionally, provide reports on claim status and payments made.

Deliver a reliable, timely, and cost-effective strategy for providing the quality control functions of claims processing under normal and surge conditions.

Functions should measure both accuracy and efficiency of the claims process.

Provide a government approved approach for re-inspecting and re-examining claims.

Reduce all case-loss reserves to ZERO upon the closure of a claim.

Ensure any funds received by the awardee as a result of salvage or subrogation rights, or collection are separately accounted for and deposited in the depository account within 24 hours of receipt.

Conduct Post-Event analyses on current CAT Plan and update the plan to reflect improvements based on lessons learned or to address areas that require improvement discovered during the event.

Maintain records of adjuster assignments in a manner that information can be retrieved by tax identification number, flood control number, adjuster name, and adjusting firm.

Provide access to all necessary information for FEMA to conduct Operation Reviews, audits, and other surveillance of NFIP Direct Claims records.

Timely respond to findings and recommendations of the aforementioned reviews, audits, and surveillance.

Appeals

14 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Provide FEMA the following information upon notification of policyholder appeal from FEMA:

All records created or maintained by the NFIP Direct as requested by FEMA regarding the claim in question.

A comprehensive claim file synopsis that includes a summary of the appeal issues, the awardee’s position on each issue, and any additional relevant information.

7.8.1.2.1 Notify FEMA if, in the process of writing the synopsis, the awardee determines that it can address the issue raised by the policyholder on appeal without further direction.

7.8.1.2.1.1 Work directly with the policyholder to achieve

resolution and update FEMA upon completion. The awardee may have a claims examiner review the file who is independent from the original decision and who possesses the authority to overturn the original decision if the facts support it.

7.8.1.2.1.2 Prior to access to Pivot Appeals module, the awardee must cooperate with and provide information through Standard Operations Contractor in completion of the appeals process.

7.8.1.2.1.3 Upon receiving access to Pivot Appeals application, the awardee will provide the information directly through Pivot.

Cooperate with FEMA throughout the appeal process until final resolution. This includes adhering to any written appeals guidance issued by FEMA.

Adhere to standard claim processing procedures for appeals that result in additional payment to a policyholder.

Update all records impacted by the results of the appeal in the proposed IT Solution, as well as outside reporting requirements including, but not limited to, the System of Record’s database.

Ensure that the proposed IT Solution complements any policyholder-facing appeal submission web portal developed by FEMA.

Provide secure, government-approved innovative Information Technology solutions.

Host any IT solution(s) on a government-only cloud-hosting environment which is, at a minimum, Federal Risk and Authorization Management Program (FedRAMP) moderate level authorized14 at the infrastructure (IaaS) level, and platform (PaaS) level should outsourcing of platform services occur.

Proof of current authorization and certification of compliance must be submitted at the time of proposal submission.

14 Authorized IaaS and PaaS Services Providers available at https://marketplace.fedramp.gov/#/products?status=Compliant&sort=productName

15 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Data centers hosting the cloud environment must be located within CONUS and operated by employees who are US citizens.

Obtain and maintain an agency Authority to Operate (ATO) through FEMA for all parts of the environment not covered by the FedRAMP authorization and keep current all related documentation for all IT solutions for annual reauthorization.

Comply with all current versions of applicable requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Develop, complete, update, and maintain accurate systems and security documentation for all systems, subsystems, and applications to the level prescribed by the Government. Documentation shall be suitably safeguarded, as well as, available for review and distribution upon reasonable notice. Documentation includes, but is not limited to:

a. Security Plan

b. Contingency Plan

c. Privacy Threshold Assessment

d. FIPS 199

e. E-Authorization

f. Privacy Impact Assessment

g. Contingency Plan Test Results

h. Configuration Management Plan

i. Security Assessment Plan

j. Network Diagrams

k. Architecture Diagrams

l. Build Plans

m. System & Software Inventory List(s)

n. Security Assessment Report(s)

o. Plan(s) of Action and Milestones and

p. Interconnection Security Agreement(s)

Perform continuous monitoring on the entire environment post-ATO in accordance with DHS and FEMA requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Utilize a FEMA approved government (.gov) email system that complies with email security requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Route internet traffic through FEMA Approved Trusted Internet Connection (TIC) that complies with internet security requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the

16 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Ensure IT solutions complies with Single Sign On (SSO), Multi-factor authentication, and Personal Identity Verification (PIV) card credential authentication requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Provide redundancy in IT solution(s) to ensure no single points of failure.

Ensure sufficient financial internal controls with the IT solution(s).

Ensure IT security controls are maintained in compliance with requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Demonstrate and maintain full compliance with each of the specific controls listed below, per DHS 4300A, NIST, and Federal Information Security Management Act (FISMA) baseline controls. Additionally, develop and implement a plan to mitigate any weaknesses related to these controls. Ensure all DHS4300A and NIST configuration/hardening guidelines are within compliance and remain within compliance.

Access Controls Awareness and Training Controls Audit and Accountability Controls Security Assessment and Authorization Controls Configuration Management Controls Contingency Planning Controls Identification and Authentication Controls Incident Response Controls Maintenance Controls

Media Protection Controls Physical and Environmental Protection Controls Planning Controls Personnel Security Controls Risk Assessment Controls System and Services Acquisition Controls System and Communications Protection Controls System and Information Integrity Controls

Ensure IT solution capabilities meet the information and reporting requirements, including the statistical and other requirements of the System of Record, and modified to accept GFIP data.

Identify and propose to meet business continuity objectives as described in the DHS

17 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

4300A Sensitive Systems Handbook15 inclusive of the long-term secure data storage of magnetic and optical media. The storage facility shall have the capability of delivering the backed-up system to a pre-selected backup or alternate processing site within 24-hours of notice. Restricted access to the back-up site shall be fully detailed in the Security Plan and be part of the Security Authorization Process.

Develop and maintain a Continuity of Operations (COOP) and Disaster Recovery (DR) plan for emergency circumstances that could jeopardize FEMA systems and operations requirements. Review and test the Disaster Recovery plan per FEMA requirements.

Maintain incident records and system overview documentation per requirements set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Perform regular back-ups of all data and/or files created or changed as deemed appropriate for the level of risk posed by data loss.

Provide a detailed approach to ensure data provided under this contract is not improperly used for commercial purposes.

Securely contain Personally Identifiable Information (PII) and other sensitive information from unauthorized access and improper use in compliance with FEMA requirements.

Secure all necessary licenses or releases to permit use of third-party software as part of the proposed IT solution and, as required, assist in coordinating the transfer of such software to the Government or a successor system operation.

Maintain continuous compliance with security and privacy requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution. This includes providing prompt responses to all security questions posed by the PMO, ISSO, or auditors, along with providing security artifacts and statements.

Perform timely IT system changes for all program changes and update system documentation accordingly.

Comply with Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

Develop and maintain a configuration management strategy to ensure optimal performance and consistency throughout the lifecycle of the IT Solution.

Design, implement, and provide metric reporting to continuously improve the customer experience (Data & Reporting)

15 https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook

18 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Ensure FEMA data is not intermingled with other data unless approved by FEMA.

Ensure the protection of FEMA intellectual property (IP) and data ownership rights and those of any licensors.

Provide a means for FEMA subject matter experts to access ALL raw data collected or stored in the proposed IT solution(s).

Timely Delivery of and access to all reoccurring reports required by FEMA, including, but not limited to those listed in the Deliverables section of the SOO.

Provide an automated business intelligence solution (i.e. dashboards, infographics, reports, etc.) that provide FEMA personnel timely access to information related to topics of regular inquiry.

Swiftly field Ad Hoc data and reporting requests.

Deliver meaningful Customer Experience reporting metrics such that quality, effectiveness, and efficiency of the customer experience can be assessed. Customer Experience includes service, product features and brand image.

Manage communication and produce reporting of agency compliance with flood insurance training requirements.

Perform Quality Control checks on all data, reports, and visualizations prior to submission to FEMA.

Ensure all reports are professionally formatted for distribution and printing with the source of data cited and assumptions/parameters/criteria footnoted on the report.

Provide regular and ad hoc submissions of data as required by FEMA, including, but not limited to, PIVOT monthly submission and informal claims polling.

Comply with the information and reporting requirements, including the statistical and other requirements, of the WYO Pivot User Procedures, as modified to accept GFIP data.

Perform proactive data quality checks to maximize accuracy of information within the IT solution(s) and limited errors within PIVOT submissions.

Leverage subjective and objective data from the provider’s reports, and other FEMA sources, to deliver continuous improvement in customer experience.

Providing FEMA a list and templates of the types of information in which the IT solution(s) currently produce on a reoccurring basis.

Accurately handle/manage and report on all NFIP Direct financials in accordance with the timelines set forth in applicable rules and regulations of the GAAP, NFIP, and the QASP.

Be fully versed in the requirements of and in compliance with all audits, operation reviews, and contract surveillance activities.

Provide detailed deposit accounting per Generally Accepted Accounting Principles

(GAAP).

Accurately calculate and timely delivery of adjuster and agent commissions.

Process both new and renewal premium payments, as well as premium adjustments within the timeframes referenced in applicable rules and regulation, as well as those

19 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

set forth in the QASP.

Utilize Treasury General Account (TGA) Approved depository and disbursement Bank(s) for all financial transactions.

Safeguard, log, and timely deposit all received funds into a Treasury General Account (TGA) Approved Bank within the timeframes referenced in applicable rules and regulation, as well as those set forth in the QASP.

Establish and maintain at least one bank account in a minority owned bank within 90 calendar days of the award.

Establish and maintain a separate bank account for GFIP funds.

Separately account for and timely deposit all funds received as a result of money endorsements, salvage or subrogation rights, or collection.

Utilize TGA Approved Lockbox Service (Currently only US Bank). Exceptions to this will be considered and must be approved by FEMA, however if awardee choses to use a non-TGA approved lockbox service, the costs of lockbox services cannot be transferred to the government or included in the proposal/overhead.

Establish internal controls and submit document of internal controls to FEMA for approval within 90 calendar days of contract award.

Operate and maintain a secure and comprehensive financial control system for NFIP business that conforms to requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this SOO, as well as requirements identified by the FEMA Office of the Chief Financial Officer (OCFO).

Comply with The Payment Card Industry Data Security Standard (PCI DSS) regulation as mandated by the FEMA Office of Chief Information Officer.

Prepare financial reporting per FEMA requirements, including, but not limited to, monthly Financial Statements and all supporting reports associated with the Financial Statements, Schedule 9 Accounts Receivable Statements, FEMA fiscal year-end statements, and supporting schedules.

Aggressively collect and repay debts due the United States Government per applicable rules and regulations, including, but not limited to, the Debt Collection Act of 198216.

Timely reimburse the government directly for all claims over payments, all premium refunds returned to policy holder by mistake, all erroneous adjuster payments or agent commissions, and all other scenarios where government/program funds have been disbursed by the awardee and are required to be reimbursed to the government.

16 31 U.S.C. 3701 et seq. Available at

20 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

Reimburse the government within 30 days of notification of over payment by the COR.

Issue 1099 Earning Statements to Adjusters and Agents as a result of their work with the NFIP Direct.

Provide a test laboratory for the testing of program innovation and pilot initiatives that further FIMA’s guiding principles and the FEMA mission Design an organization and governance structure, to include an execution plan, time tables, and performance evaluation factors across FEMA and the NFIP Direct for capturing, testing, documenting and reporting on FEMA generated initiatives. New data elements not included within the current Pivot User Procedures Plan may be identified and required to be collected as part of any initiative and possibly become part of future PIVOT versions.

Implement and test NFIP initiatives. Collaborate with the government as an NFIP Subject Matter Expert (SME) to collect and provide timely feedback to FIMA’s NFIP Branch and assist in performing trend analyses on the information. One of FIMA’s guiding principles is to improve CX. As the goal is to improve, being fully aware of and understanding both the positive and negative aspects of the NFIP is paramount.

Feedback received through this objective shall be used in good faith to improve and is not meant to be used for past performance of the awardee.

Collaborate on government initiatives to enhance customer experience, produce process efficiencies, and improve quality of direct services.

Collaborate with the government to effectively measure satisfaction of the NFIP brand, products, and services.

As a NFIP SME, provide FEMA with timely feedback, from all levels of the NFIP Direct staff, aimed to improve the NFIP and its products and services. This includes, but is not limited to:

Identify and report common themes of inquiries or complaints from all stakeholders.

Suggest ways to simplify and improve ease of use of NFIP products and services.

Suggest process or tool improvements that positively affect the stakeholder perception of /trust in the NFIP and/or that are in the spirit of FIMA’s guiding principles.

Develop and execute marketing initiatives and communications products to support the increase of NFIP Direct policies.

Provide timely feedback on clarity of FEMA communications, making suggestions for improvement where applicable.

Provide timely feedback on how FEMA may improve to better work with the NFIP Direct, WYO Companies, and other stakeholders.

Develop and institute mechanism(s) for collecting both unsolicited and solicited stakeholder feedback while adhering to all applicable rules and regulations on data collection.

Provide FEMA access to data collected or calls recorded for purposes of better

21 | P a g e

NFIP DIRECT: PERFORMANCE WORK STATEMENT

understanding the current customer experience.

Recommend ways to improve NFIP Direct agent and agency participation in training “refreshers”, advanced training or other training as deemed appropriate by the NFIP Direct.

Develop and maintain a plan for the assumption of WYO company policies and execute the plan as necessary.

Provide strategies for efficiently and expeditiously assuming WYO policies under different policy assumption levels.

Exercise the plan to assuming WYO policies, should the need arise.

Respectfully, and without incident, cooperate with the government and…