RFP Attachment A - NFIP Direct PWS - Revised.pdf

ATTACHMENT A

NATIONAL FLOOD

INSURANCE PROGRAM

NFIP DIRECT

PERFORMANCE WORK STATEMENT (PWS)

FOR

NFIP DIRECT SERVICES

8/3/2020

2 | P a g e

1 PURPOSE

The purpose of this PWS is to obtain insurance industry leading and innovative contractor support for National Flood Insurance Program (NFIP) Direct services that meet the objectives described herein in a manner that aligns with Federal Emergency Management Agency’s (FEMA) Strategic Plan, Federal Insurance and Mitigation Administration’s (FIMA) guiding principles and values and the Federal Insurance Directorate’s (FID) Strategy.

2 BACKGROUND

FEMA’s mission is to help people before, during, and after disasters. FEMA accomplishes this mission through the development and execution of the FEMA Strategic Plan.1

FEMA’s Strategic Goals are:

• Build a Culture of Preparedness

• Ready the Nation for Catastrophic Disasters

• Reduce the Complexity of FEMA

FEMA focuses on building and developing a culture of preparedness across the country and unifying all levels of community and government into an integrated approach to emergency management. As part of FEMA, the FIMA concentrates on increasing the capabilities necessary to reduce loss of life and property by lessening the impact of disasters. FIMA has developed guiding principles that drive decision making.

FIMA’s guiding principles are:

• Emphasize integration and collaboration

• Strive for innovation where needed

• Improve the customer experience

• Improve organizational health

FIMA manages the NFIP. Congress created the NFIP through passage of the National Flood Insurance Act (NFIA) of 1968, and over the last 50 years, Congress has updated and added new requirements through various other legislation2. Through passage of these acts, Congress authorized FEMA to institute regulations that govern the NFIP and the delivery of flood insurance to policyholders in eligible communities using Title 44 Code of Federal Regulations (44 C.F.R.) parts 59 through 623. To emphasize the importance of the information, FEMA incorporated the entirety of the Standard Flood Insurance Policy4 (SFIP) into 44 C.F.R. FEMA also issues further guidance to external partners to aid in the issuance of policies and adjusting

1 Available at https://www.fema.gov/fema-strategic-plan 2 42 U.S.C. 4001 et seq. Available at https://www.gpo.gov/fdsys/pkg/USCODE-2016-title42/pdf/USCODE- 2016-title42-chap50.pdf 3 https://www.gpo.gov/fdsys/pkg/CFR-2017-title44-vol1/pdf/CFR-2017-title44-vol1-chapI-subchapB.pdf 4 A copy of the SFIP can be found within the FIM which is available at https://www.fema.gov/flood-insurance-manual https://www.fema.gov/fema-strategic-plan https://www.gpo.gov/fdsys/pkg/USCODE-2016-title42/pdf/USCODE-2016-title42-chap50.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2016-title42/pdf/USCODE-2016-title42-chap50.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2016-title42/pdf/USCODE-2016-title42-chap50.pdf https://www.gpo.gov/fdsys/pkg/CFR-2017-title44-vol1/pdf/CFR-2017-title44-vol1-chapI-subchapB.pdf https://www.fema.gov/flood-insurance-manual

3 | P a g e of claims, such as the Flood Insurance Manual5 (FIM), the National Flood Insurance Claims Manual6, and various FEMA Bulletins7.

Under FIMA, FID’s mission is to provide customer focused flood insurance to help survivors and their communities effectively recover from flood events.

As part of the NFIP, the NFIP Direct facilitates the issuance and administration of flood insurance policies on behalf of the Government. As such, positive public perception of the NFIP Direct and its handling of policy administration are important to FEMA. FEMA requires the NFIP Direct to fully comply with all statutes and demonstrate working knowledge and understanding of applicable regulations, policies, guidelines, and specifications that affect the NFIP, FIMA, FEMA, and DHS.

The NFIP Direct is in a position to set the standard for the entire NFIP by embodying FIMA’s guiding principles and FEMA’s strategic goals. FEMA envisions the NFIP Direct as the example and insurance industry leader for the entire NFIP and expects NFIP Direct employees to be familiar with all FEMA survivor programs to facilitate seamless service to survivors. FEMA also requires the NFIP Direct to function as a test laboratory for program innovation and initiatives that further FIMA’s guiding principles and the FEMA mission. To meet this vision, FIMA requires the contractor to continuously review, improve and innovate processes and tools as the environmental, technological, and political considerations impacting the NFIP evolve.

FEMA is procuring various contractor services to support the NFIP. NFIP contracts will support the direct sale and servicing of NFIP policies (addressed by this NFIP Direct PWS);

communications; operations, maintenance, and development for NFIP technology, standard business operations; and program management. Universal objectives, assumptions, and constraints applicable to all NFIP contracts are provided below.

FIMA is transforming the NFIP to update the products, processes, and procedures that support the program. The risk rating system is being redesigned to leverage industry best practices and current technology to deliver rates that are fairer, easier to understand, and better reflect a property’s unique flood risk. FEMA calls this effort Risk Rating 2.0 and will include updates to rates for all NFIP-insured properties over the next several years. Through these efforts, FEMA’s goal is to make flood insurance significantly easier for agents to price and sell policies, and in turn, help customers better understand their flood risk and the importance of flood insurance.

Universal Objective 1: The NFIP is growing. As the program works to close the nation’s insurance gap and double the number of structures covered by flood insurance by the year 2022, support services must scale to meet the workload expected to deliver world-class operations, inclusive of day-to-day, response, and recovery activities.

5 Available at https://www.fema.gov/flood-insurance-manual

6 Available at https://www.fema.gov/media-library/assets/documents/2675

7 Available at https://nfipservices.floodsmart.gov https://www.fema.gov/media-library/assets/documents/2675 https://nfipservices.floodsmart.gov/

4 | P a g e

Universal Objective 2: The NFIP must make it easier to sign up and maintain flood insurance.

From forms, to rating, to the claims process, the NFIP must continue to evolve how it delivers the program to help close the insurance gap and make it easier for citizens and communities to invest in hazard mitigation activities. All providers must directly contribute to improving the customer experience.

Universal Objective 3: FEMA must reduce the complexity of the NFIP and increase the program’s transparency. Leveraging process changes, improved communications, and new technology, FEMA must ensure that homeowners have insight, education, and confidence in the entire insurance lifecycle.

Universal Objective 4: To ready the nation for catastrophic disaster, FEMA must build and sustain long-lasting and mutually beneficial partnerships and coalitions with public and private organizations to leverage capabilities and influence, extending the reach of the NFIP’s mission.

Universal Objective 5: The NFIP must plan for and implement changes stemming from the reauthorization and other legislative and regulatory changes.

Universal Assumptions and Constraints

• All activities will align to DHS/FEMA/FIMA/FID strategies and intents.

• Pivot is the NFIP’s System of Record (SOR).

• FEMA is updating policy forms, and while some will be finalized, not all will be completely in place at the time of contract award.

• Updated rates will be implemented in a phased approach, with new rates going into effect over the next several years.

• The NFIP will continue to operate according to the current authorization and regulations but must ensure flexibility for changes.

• The NFIP will embrace data and fraud analytics to drive better operations through improved oversight, speed, quality, and customer service.

• The NFIP will leverage data analytics and behavioral science to better inform decisions and improve the program’s marketing approach.

• The NFIP will embrace industry-standard customer experience models (online sales, mobile claims through smartphone applications, agents at the contact center, etc.).

• The NFIP will strengthen and expand partnerships—including through incentives.

• Outreach activities are coordinated, integrated, and consistent with NFIP messaging.

• Data security and privacy issues are major focus of the federal Government’s information technology efforts. All program activities must be compliant with the Government Information Security Reform Act, OMB policies, DHS, and FEMA requirements.

• Solutions must include transition plans detailing how continuity of services will be maintained (e.g., operations of IT systems in various states of health and development, ongoing marketing and sales efforts, program management, etc.).

3 SCOPE

The contractor shall perform all actions necessary to, or incidental to, policy administration

5 | P a g e services for flood insurance policies in support of the NFIP Direct. The contractor shall have responsibility for management, operation, maintenance, and quality assurance for the services.

The actual number of policies administered by the NFIP Direct and percentage of NFIP Direct policies within the entire NFIP varies daily. Because of this, the Government does not guarantee the number of policies to be serviced by the NFIP Direct.8 The Government, through this contract, reserves the right to establish unique operations, standards and reporting requirements specific to the NFIP Direct and unique policies to be issued solely by the NFIP Direct. Should the situation arise, the contractor shall also assume the policies of Write Your Own (WYO) companies that withdraw or that FEMA terminates from the NFIP.

Furthermore, the contractor will act as a laboratory for testing Government initiatives that aim to enhance customer experience and better align the NFIP Direct with FEMA’s Strategic Plan, FIMA’s guiding principles, and FIMA’s values.

4 PERIOD OF PERFROMANCE

The period of performance shall consist of a twelve (12) months Base Period, with four (4) twelve (12) month Option Periods.

5 PLACE OF PERFORMANCE

Work shall be performed at the contractor’s site within the continental United States, with the primary or satellite9 office(s) within 50 miles of FEMA Headquarters.10 The contractor should provide designated space for NFIP Direct staff, in which all NFIP Direct business should be handled separate from other lines of business. Several key personnel must be located within the primary or satellite office(s) near FEMA Headquarters. Any IT solution must reside on a government-only cloud hosting environment which is, at a minimum, FedRamp moderate level authorized at the infrastructure (IaaS) level and platform (PaaS), should outsourcing of platform services occur.11

6 GOVERNMENT-FURNISHED EQUIPMENT

The contractor shall furnish all personnel, facilities, equipment, software, material, supplies, and services, except as may be expressly set forth in this PWS as furnished by the Government.

To ensure the highest level of protection, all Government Furnished Equipment (GFE) must be imaged by and maintained with a DHS/FEMA certified image. The contractor shall be responsible for operating and storing all GFE in a secure manner and in accordance with current rules and regulations. Additionally, the contractor shall designate a single point of contact (POC) for FEMA to work through when assigning or issuing GFE. This individual will be responsible for tracking the whereabouts of all issued GFE.

8 Currently, the NFIP Direct handles about 13% of the entire NFIP, or about 656,000 policies. FEMA will provide historical policy counts in the bidder’s library for reference.

9 A Satellite office should include capability to handle all subject areas of administering flood insurance policies.

10 FEMA Headquarters is located at 500 C Street, SW, Washington, DC 20024.

11 Authorized IaaS and PaaS Services Providers available at https://marketplace.fedramp.gov/#/products?status=Compliant&sort=productName https://marketplace.fedramp.gov/#/products?status=Compliant&sort=productName

6 | P a g e

A list of GFE furnished for this contract is provided below:

• www.nfipdirect.fema.gov domain name with a Government Controlled DNS and

External Validation certificates related to the www.nfipdirect.fema.gov domain.

• Sysco Routers related to the DHS OneNet tunnel

• Secure Cloud Interconnection (SCI) Tunnel related to the DHS OneNet connection

• NFIP Direct Phone numbers

• Laptops for System Administrators, privileged users, and Flood Insurance Claims

Office (FICO) kits12 o A list of names, titles, contact information need to be provided to FEMA of those individuals requiring GFE prior to the official transition of services

• Hard Drives for Transitioning In and Transitioning Out.

• FICO kits

7 PERFORMANCE OBJECTIVES AND REQUIREMENTS

The contractor shall provide solutions, which are able to be implemented in the public sector, that are innovative, flexible, reflect subject matter expertise, and increase efficiency and effectiveness, taking into consideration the Government’s continuing resource constraints.

The overall performance objective is to deliver customer-focused, secure, quality, scalable NFIP Direct service operations in a cost-effective and timely manner, while testing new initiatives of the NFIP.

7.1 Transition the operations of the NFIP Direct and effectively migrate data from the incumbent with minimal stakeholder disruption.

7.1.1 Develop and provide a project plan with a comprehensive timeline for transition and migration.

7.1.2 Anticipate and mitigate potential problems or impediments that may hinder transition or migration.

7.1.3 Collaborate with FEMA and incumbent to ensure a smooth and full transition of operations and knowledge.

7.1.4 Participate in knowledge transfer sessions with FEMA and the incumbent for various subject matters and business operations as defined by FEMA, including, but not limited to underwriting, claims, contact center, finance, correspondence, and data submission requirements and sign-off on resulting documents, within ten (10) business days of completion of discussions.

7.1.5 Obtain a DHS Authority to Operate (ATO13) for any proposed IT solution(s) prior to start of operations.

7.1.6 Provide proper documentation to FEMA demonstrating adherence to all IT system, privacy, and security requirements set forth in other sections of this PWS.

7.1.7 Successfully migrate all relevant data from the current NFIP Direct system, ensuring

12 Include items needed if a FICO is opened and the materials needed to support the FICO as determined by the Government 13 Information on ATOs can be found at https://www.dhs.gov/sites/default/files/publications/Security%20Authorization%20Process%20Guide_1.pdf http://www.nfipdirect.fema.gov/ https://www.dhs.gov/sites/default/files/publications/Security%20Authorization%20Process%20Guide_1.pdf https://www.dhs.gov/sites/default/files/publications/Security%20Authorization%20Process%20Guide_1.pdf

7 | P a g e data quality and completeness, into the secure IT solution proposed once ATO is granted. No policyholder data can be provided prior to ATO, though sanitized testing data can be provided.

7.1.8 Coordinate and perform parallel testing of systems with FEMA, the incumbent, and other relevant government contractors.

7.1.9 Coordinate with FEMA, and the incumbent when necessary, and perform pre- transition tests on FEMA-owned phone numbers and URLs.

7.1.10 Provide FEMA personnel training on all applicable IT solution(s) prior to the transition of operations from the incumbent to the contractor, including, but not limited to, policy administration system and contact center system.

7.1.11 Establish tailored system roles for FEMA Stakeholders, based on FEMA requirements, within applicable IT solution(s) prior to the transition of operations from the incumbent to the contractor.

7.1.11.1 Direct Service Branch Role Access

7.1.11.2 Other FEMA Role Access

7.1.12 Coordinate with FEMA to establish and implement reoccurring reports and business intelligence solution(s) prior to the transition of operations from the incumbent to the new contractor.

7.2 Issue and administer accurate and timely NFIP Products, including NFIP Direct-only products, to further FEMA’s mission and maximize stakeholder confidence in the NFIP.

7.2.1 Readily furnish, and make electronically available, when applicable, insurance policy forms and NFIP print materials to stakeholders.

7.2.2 Accept and process flood insurance applications within the timeframes referenced in applicable NFIP rules and regulations, as well as those set forth in the Quality Assurance Surveillance Plan (QASP). This should include the acceptance of both electronic and hardcopy submissions.

7.2.3 Underwrite and validate application information to accurately rate the policy and properly cover the policyholder’s property to mitigate policyholder risk.

7.2.4 Collect and process premiums (initial, renewals, and endorsements). Payments may be made by electronic credit card submission, paper check, wire transfer or money order.

Cash will not be accepted.

7.2.5 Generate and provide the policy declaration page and a copy of the policy to policyholders and any applicable stakeholders within the timeframes referenced in applicable NFIP rules and regulations, as well as those set forth in the QASP.

7.2.6 Proactively troubleshoot and resolve issues with policyholder agent and other stakeholders when additional information is needed to process applications, execute renewals, or administer policies.

7.2.7 Generate and furnish renewal notices to policyholders and any applicable stakeholders within the timeframes referenced in applicable NFIP rules and regulations, as well as those set forth in the QASP.

7.2.8 Process renewals/endorsements and furnish updated declaration pages to policyholders and any applicable stakeholders within the timeframes referenced in applicable NFIP rules and regulations, as well as those set forth in the QASP. This should include the acceptance of both electronic and hardcopy submissions.

8 | P a g e

7.2.9 Process policy cancellations, validating the reason for cancellation, and issuing refunds (if applicable) within the timeframes referenced in applicable NFIP rules and regulations, as well as those set forth in the QASP. This should include the acceptance of both electronic and hardcopy submissions and should impose minimal requirements on the policyholder.

7.2.10 At the direction of the Government, coordinate with Federal, State, Local, and Tribal governments and communities regarding policy and policyholder information, community standards, and mandatory purchase requirement instructions.

7.2.11 Provide FEMA access to all necessary information to conduct operation reviews, audits, and other surveillance of NFIP Direct Underwriting policy records.

7.2.12 Respond to findings and recommendations of any reviews, audits, and surveillance in a timely manner.

7.2.13 Carry out the policies, operations, standards and reporting for unique, requirements such as Group Flood Insurance Policies (GFIP), Severe Repetitive Loss (SRL) policies, loss history appeals, claims re-inspections, Flood Insurance Reform Act (FIRA) of 2004 Section 207, and financial reporting.

7.3 Coordinate with FEMA and its partners to identify eligible survivors and issue GFIP certificates to those that qualify.

7.3.1 At the direction of the Government, coordinate with FEMA’s Individuals and Households Program (IHP) and personnel from State Other Needs and Assistance (ONA)14 program, when necessary.

7.3.2 Review list of recipients provided by FEMA IHP or the State’s ONA program, confirming the recipient is eligible for policy and returning ineligible and duplicative recipients.

Notify FEMA of any discrepancies.

7.3.3 Coordinate and resolve any processing issues with FEMA‘s Individuals and Household Branch.

7.3.4 Process Premiums and return funds for ineligible or duplicative certificates.

7.3.5 Issue master policy and subsequent certificates after observing any required waiting periods in accordance with applicable NFIP rules and regulations, and those set forth in the QASP.

7.3.6 Furnish certificate, Summary of Coverage Letter, and a copy of the master policy to recipient within ten (10) days of receipt of accurate documentation from Individuals Household Branch or owner.

Maintain records at both the master policy and recipient certificate level within any proposed IT solution(s). The solution(s) should have the capability to track any policy or certificate to a specific disaster declaration and individual certificate coverage dates.

7.3.7 Process new owner/tenant notifications.

7.3.8 Reconcile the List of Recipients with Premiums Received, notifying FEMA when there are discrepancies.

7.3.9 Update GFIP Coverage limits in any proposed IT solution(s) and within any GFIP related materials annually, or at any time as requested by FEMA.

7.3.10 Maintain all necessary GFIP policy administration guidelines, form letters, and

14 Several states currently process their own GFIP listing under the ONA program and submission to the NFIP Direct contractor, which currently include TX, MD, PA and WA. (ref 7.3.1)

9 | P a g e procedures. These items shall be subject to FEMA approval.

7.3.11 Furnish anniversary and termination of coverage notice letters to recipients, within the timeframes referenced in applicable NFIP rules and regulations. The letters shall include the master policy expiration date and the Terms and Conditions of the GFIP Certificate of Flood Insurance. The contractor must be able to generate these letters in English and Spanish.

7.3.12 Assist FEMA in targeting GFIP certificate recipients for retention through the sale of a

SFIP.

7.3.13 Cancel the policy for any recipient that elects to purchase an SFIP during the term of the

GFIP.

7.4 Operate the Special Direct Facility (SDF), and seamlessly transition policy administration of Severe Repetitive Loss (SRL) policies with minimal policyholder disruption.

7.4.1 Generate and furnish notification letters to policyholders, agents, and lenders once a policy has been identified as an SRL property. Update the SRL database accordingly.

7.4.2 Provide information to the insured and their agent on how to appeal an SRL designation and in the event of an appeal, follow established NFIP appeal procedures.

7.4.3 Generate and furnish pre-renewal letters to the SRL policyholders informing them of the special renewal process.

7.4.4 Re-underwrite all new SRL policies underwritten by the NFIP Direct with respect to rates for correct premium charges, zone information, loss history and any policy- zone grandfathering information. Maintain the SRL file with any changes. Provide audit trail that the policy has been re-underwritten.

7.4.5 Provide status reporting that details re-underwritten SRL policies and review the SRL book of business per FEMA requirements.

7.4.6 Coordinate and collaborate with FEMA and other stakeholders to vigorously target SRL properties for FEMA-approved mitigation projects that will remove them from the SRL program and makes them eligible for standard policies.

7.4.7 Proactively campaign to communities to encourage FRED (Flood Proof, Relocate, Elevate, or Demolish) Mitigation of SRL properties.

7.4.8 Track and report to FEMA the status of SRL policies, including but not limited to:

removals from the SRL program, ongoing efforts to target SRL properties for mitigation, and campaign efforts to the community to encourage mitigation.

7.5 FIRA of 2004: The Parameters FOR FIRA 2004.

7.5.1 Manage communication and produce reporting of agency compliance with flood insurance training requirements.

7.5.2 Recommend ways to improve DSA agent and agency participation in training

“refreshers”, advanced training or other training as deemed appropriate by the DSA.

7.5.3 Find innovative ways to develop and implement strategies and technologies that significantly improve the FIRA Compliance percentages, with the goal of having all NFIP Direct agents with active policies be fully compliant.

7.6 Design and implement scalable, customer-focused customer service solutions

10 | P a g e to consistently and effectively serve NFIP stakeholders.

7.6.1 Positively and professionally represent FEMA to the public throughout all aspects of services provided on FEMA’s behalf.

7.6.2 Deliver robust and dynamic customer service processes, tools, and reporting that leverage industry best practices, support the needs of the NFIP, and align with FIMA’s guiding principles.

7.6.3 Develop and operate a contact center to interact with NFIP stakeholders and address inquiries through various channels (phone calls, social media, emails, etc.) with scalable staffing levels between normal and surge periods based on demand.

7.6.3.1 Maintain operating hours of 8:00am to 8:00pm Monday through Friday, Eastern

Standard Time/Eastern Daylight Savings Time, with additional hours of operation added during surge level demand, as needed per the direction of the Government. All federal holiday observances should follow the Government schedule. The Government does not expect for operations to take place during observed federal holidays.

However, during disasters the Contractor may be required to operate on observed federal holidays per direction of the Contracting Officer Representative (COR).

7.6.3.2 The proposed contact center solution shall include ways for stakeholders to submit inquiries both during (calls, emails, etc.) and outside (voicemail, emails, etc.) of operating hours.

7.6.3.3 Assume operation of the FEMA-owned NFIP Direct Servicing Agent Customer Support national toll-free telephone line (1-800-638-6620) as part of the contact center solution.

7.6.3.4 Ensure adequate staffing to address English and Spanish speaking inquiries in each of the contact center departments.

7.6.3.5 At a minimum, staff shall be able to:

7.6.3.5.1. Change or correct the insured’s name

7.6.3.5.2. Add an additional insured’s name

7.6.3.5.3. Remove an insured’s name with supporting documentation

7.6.3.5.4. Change or correct the insured’s mailing address

7.6.3.5.5. Add or remove a lender from the policy

7.6.3.5.6. Make minor corrections to submitted new business applications if money has not been applied

7.6.3.5.7. Approve primary residence for the Present Term

7.6.3.5.8. Approve endorsements to change residency status to non-primary

7.6.3.5.9. Approve Renewal Instruction applications to apply primary residence or non-primary residence

7.6.3.5.10. Acknowledge receipt of documentation

7.6.3.6 Staff and operate Section 508 Compliant Contact Center Phones and IT Systems.

7.6.3.7 Supply knowledgeable staff capable of addressing, at a minimum, Agency

Services, Underwriting, and Claims interactions and inquiries.

7.6.3.8 The proposed contact center solution shall include real-time visibility into relevant information, including, but not limited to call wait times, contact center personnel status, and number of pending inquiries by outreach channels.

7.6.3.9 IT components of the proposed contact center solution shall be remotely-accessible and subject to all IT related requirements, objectives, and constraints described herein.

7.6.3.10 Provide FEMA with an accurate representation of contact center workflow that

11 | P a g e reflects how contacts will be handled, and escalated if necessary, for each of the various channels. This workflow shall reflect operations as of the first day post-transition from the incumbent.

7.6.3.11 Maintain, and provide to FEMA, a contingency plan for when the Contact Center solution is unable to connect with stakeholders (i.e. unexpected office closure, full utilization of contact center staff, etc.)

7.6.3.12 Provide FEMA full access to recorded calls and transcripts of written interactions (i.e. emails and live chats) between the contractor & NFIP stakeholders for quality assurance purposes.

7.6.3.13 Respond to voicemails and written inquiries, not covered under correspondence guidelines, within the timeframes referenced in applicable NFIP rules and regulations and those set forth in the QASP.

7.6.3.14 Provide FEMA, and once approved, implement, a plan for receipt and handling of return mail.

7.6.3.15 Provide FEMA access to conduct surveillance of live customer calls, remotely and in- person, and visit Contact Center location(s) after advanced COR notification to the contractor for quality assurance purposes.

7.6.3.16 Identify and provide timely feedback to FEMA on common themes (both positive and negative) that arise through stakeholder interaction.

7.7 Support correspondence activities in accordance with the timelines and reporting requirements set forth in applicable NFIP rules and regulations, as well as those set forth in the QASP.

7.7.1 Establish and maintain detailed written procedures for handling correspondence.

Procedures shall be subject to FEMA approval and shall, at a minimum, demonstrate an ability to effectively control incoming and outgoing correspondence; perform a high level of quality assurance; and handle all correspondence tasks in a timely manner.

7.7.2 Develop, operate, and maintain a remotely accessible IT solution(s) for tracking and maintaining records of all correspondence.

7.7.2.1 IT components of the proposed correspondence solution shall include, at a minimum, automated controls and routing for approvals based on type of correspondence; the ability to search correspondence by various data points (i.e. topic, received date, sender, etc.); the ability to calculate correspondence related selected service performance area (SSPA) metrics; and a copy of the correspondence.

7.7.2.2 Provide FEMA full access to the proposed IT solution for visibility into current and past correspondence.

7.7.2.3 IT components of the proposed correspondence solution shall be subject to all IT related requirements, objectives, and constraints described herein.

7.7.3 Respond to all controlled correspondence in accordance with the timelines and reporting requirements set forth in applicable NFIP rules and regulations, as well as those set forth in the QASP.

7.7.3.1 Controlled correspondence is considered VIP (congressional), White House, and

DHS correspondence. Controlled correspondence is processed by FEMA’s Intranet Quorum (IQ) system. Only select FEMA personnel have access to the IQ system, and currently all controlled correspondence status reporting is conducted through the FEMA IQ system. FEMA’s Flood Insurance Directorate’s (FID) Correspondence Tracker application supports controlled correspondence processes provide templates and

12 | P a g e tracks status that is reconciled with FEMA’s IQ system on a regular basis.

7.7.4 Respond to all uncontrolled correspondence in accordance with the timelines and reporting requirements set forth in applicable NFIP rules and regulations, as well as those set forth in the QASP.

7.7.4.1 Uncontrolled correspondence (UCC) is defined as General correspondence.

General correspondence is received by postal mail, and hard copies are scanned into a web-based document library, such as SharePoint. Email correspondence is also classified as uncontrolled correspondence. Uncontrolled correspondence is not handled by the IQ system; however, FID’s SharePoint Correspondence Tracker supports UCC workflows and reporting to assess workloads and performance by federal and contracted support personnel.

7.8 Provide scalable and cost-effective solutions for the processing and adjudication of claims at normal and surge levels in accordance with NFIP rules and regulations.

7.8.1 Develop and maintain a Catastrophe (CAT) Plan that sets forth how the contractor shall (before, during, and after an event) successfully respond to events, including, but not limited to, those objectives set forth in this subsection. The plan shall reflect how the contractor responds to varying size events, from one small event to multiple location simultaneous events.

7.8.2 Negotiate and maintain throughout the contract, pre-positioned vendor agreements with Independent Adjusting (IA) Firms, outside examiner firms, and other temporary employment agencies, as appropriate, to allow for quick response when implementing the CAT Plan.

7.8.3 Routinely evaluate the FICO kits for operability and adequate supply levels.

7.8.4 Effectively evaluate flood situations and execute the CAT Plan as necessary.

7.8.5 Provide FEMA a timely pre-event assessment of potential NFIP Direct claims exposure and update, as necessary, to reflect actual exposure as the event progresses.

7.8.6 Maintain regular contract with FEMA during and after events, as well as coordinate with

State & Local stakeholders and other NFIP contractors, when instructed by the Government.

7.8.6.1 This may include, but is not limited to, other NFIP contractors, FEMA’s

Individuals and Households Assistance Program, SBA, and other Federal Loan or Assistance Programs.

7.8.7 Aid Policyholders and Agents in filing the First Notice of Loss, and open claims records within the proposed IT solution.

7.8.8 Ensure adequate adjuster presence within forty-eight (48) hours in any given disaster area, paying attention to multi-location and multi-event conditions.

7.8.9 Establish, manage and operate a FICO at disaster locations per FEMA requirements.

7.8.10 Deliver a reliable, timely, and cost-effective strategy for providing an appropriate number of FICO capable disaster teams and backup teams to flood areas as required by FEMA. In particular:

7.8.10.1 Establish emergency strategies for distributing NFIP information materials to adjusters and policyholders to expedite claims processing and assist policyholders in filing claims.

7.8.10.2 Be capable of deploying FICO back-up team(s) to at least four separate

13 | P a g e geographic areas simultaneously. Such teams must be operational within seven (7) calendar days of COR notification to deploy.

7.8.11 Collect data related to FICO, including but not limited to the number of visitors, questions asked, and the answers provided.

7.8.12 If the COR determines the NFIP policies in a flooded area do not warrant opening a FICO, operate and staff, to an appropriate level, an In-House FICO, which may be coordinated with an Adjuster Control Office (ACO).

7.8.13 Operate and maintain appropriate secure field-based technology to support effective adjuster assignments and prompt claims payments.

7.8.14 Coordinate with the FEMA Flood Response Offices, (FRO) as directed by the COR.

7.8.15 Swiftly and efficiently assign claims to adjusters by taking into consideration impacting factors including, but not limited to, geographical location of damaged property and adjuster workload and experience.

7.8.16 Adequately stock and furnish to adjusters, and other stakeholders, those forms and other printed supplies used in connection with claims processing. These shall be made available electronically and in paper format.

7.8.17 Report daily claims polling information per FEMA requirements, as needed.

7.8.18 Assign an adequate case-loss reserves as payments are made and as information becomes available; and report the reserve, and any updates to the reserve, to the System of Record.

7.8.19 Expedite claims advance payments, whenever possible, to assist the policyholder in recovery efforts.

7.8.20 Verify the repair of prior claims’ damage before determining eligible damages on current claim.

7.8.21 Promote and assist the efficient adjustment and settlement of wind-water losses.

7.8.22 Accurately and efficiently process claims, including, but not limited to, processing the

Preliminary Reports, Proofs of Loss, Interim Reports, and Final Reports.

7.8.23 Swiftly and accurately issue claims payments based on eligible losses, including, but not limited to, advanced payments, partial payments, final payments, and Allocated Loss Adjustment Expenses (ALAEs) including Special Allocated Loss Adjustment Expenses (SALAEs).

7.8.24 Reopen claims when necessary.

7.8.25 Provide FEMA unrestricted online access to all open and closed claims files including, but not limited to, all photographs, correspondences related to the claim, and all notes from contractor personnel and outside parties involved in the claim. Additionally, provide reports on claim status and payments made.

7.8.26 Deliver a reliable, timely, and cost-effective strategy for providing the quality control functions of claims processing under normal and surge conditions. Functions should measure both accuracy and efficiency of the claims process.

7.8.27 Establish an approach for re-inspecting and re-examining claims, and after FEMA approval, implement the approach.

7.8.28 Reset all case-loss reserves to $0 upon the closure of a claim.

7.8.29 Ensure any funds received by the contractor as a result of salvage or subrogation rights or collection are separately accounted for and deposited in the depository account within 24 hours of receipt.

7.8.30 Conduct post-event analyses on current CAT Plan and update the plan to reflect improvements based on lessons learned or to address areas that require improvement

14 | P a g e discovered during the event.

7.8.31 Maintain records of adjuster assignments in a manner that information can be retrieved by tax identification number, flood control number, adjuster name, and adjusting firm.

7.8.32 Provide access to all necessary information for FEMA to conduct operation reviews, audits, and other surveillance of NFIP Direct Claims records.

7.8.33 Respond to findings and recommendations of any reviews, and surveillance in a timely manner.

7.9 Policy Appeals

7.9.1 Support the collection and submission of data to substantiate policy appeals, including but not limited to designations of 1316, Coastal Barrier Resource Area, repetitive loss, severe repetitive loss, property address waivers, floodproofing, special rating, preferred risk policy eligibility, and prior term refunds.

7.9.2 At the direction of the Government, coordinate with other FEMA contractors to ensure that the policy appeals are fully adjudicated in a timely manner.

7.9.3 Implement any adjustments or corrective actions as a result of FEMA’s adjudication of the policy appeal.

7.10 Claims Appeals

7.10.1 Provide FEMA the following information upon notification of policyholder claim appeal from FEMA:

7.10.1.1 All records created or maintained by the NFIP Direct as requested by FEMA regarding the claim in question.

7.10.1.2 A comprehensive claim file synopsis that includes a summary of the appeal issues, the contractor ‘s position on each issue, and any additional relevant information.

7.10.2 Notify FEMA if, in the process of writing the synopsis, the contractor determines that it can address the issue raised by the policyholder on appeal without further direction.

7.10.3 Work directly with the policyholder to achieve resolution and update FEMA upon completion. The contractor may have a claims examiner review the file who is independent from the original decision and who possesses the authority to overturn the original decision if the facts support it.

7.10.4 The contractor must cooperate with and provide information through Standard Operations Contractor in completion of the appeals process.

7.10.5 Upon receiving access to Pivot Appeals application, the contractor shall provide the required information directly through Pivot.

7.10.6 Cooperate with FEMA throughout the appeal process until final resolution. This includes adhering to any written appeals guidance issued by FEMA.

7.10.7 Adhere to standard claim processing procedures for appeals that result in additional payment to a policyholder.

7.10.8 Update all records impacted by the results of the appeal in the proposed IT Solution, as well as outside reporting requirements including, but not limited to, the System of Record’s database.

7.11 Provide innovative, secure, Government-approved Information Technology

15 | P a g e solutions.

7.11.1 Host any IT solution(s) on a Government-only cloud-hosting environment which is, at a minimum, Federal Risk and Authorization Management Program (FedRAMP) moderate level authorized13 at the infrastructure (IaaS) level, and platform (PaaS) level should outsourcing of platform services occur.

7.11.1.1 Proof of current authorization and certification of compliance must be submitted at the time of proposal submission.

7.11.1.2 Data centers hosting the cloud environment must be located within CONUS and operated by employees who are US citizens.

7.11.2 Obtain and maintain a DHS Authority to Operate (ATO) through FEMA for all parts of the environment not covered by the FedRAMP authorization and keep current all related documentation for all IT solutions for annual reauthorization.

7.11.3 Comply with all current versions of applicable requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA Office of the Chief Information Officer (OCIO) throughout the lifecycle of the IT solution.

7.11.4 Develop, complete, update, and maintain accurate systems and security documentation for all systems, subsystems, and applications to the level prescribed by the Government.

The Government will use their own scanning tools provided that it has access to the contractor’s system environment. Documentation shall be suitably safeguarded, as well as, available for review and distribution upon reasonable notice. Documentation includes, but is not limited to:

a. Security Plan

b. Contingency Plan

c. Privacy Threshold Assessment

d. FIPS 199

e. E-Authorization

f. Privacy Impact Assessment

g. Contingency Plan Test Results

h. Configuration Management Plan

i. Security Assessment Plan

j. Network Diagrams

k. Architecture Diagrams

l. Build Plans

m. System & Software Inventory List(s)

n. Security Assessment Reports(s)

o. Plan(s) of Action and Milestones and

p. Interconnection Security Agreement(s)

7.11.5 Perform continuous monitoring on the entire environment post-ATO in accordance with DHS and FEMA requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution.

The Contractor shall provide their own scanning tools and provide a copy of scanning results to the Government. Scanning results will be provided to and owned by FEMA.

7.11.6 Utilize a FEMA approved Government (.gov) email system that complies with email security requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as

16 | P a g e requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution.

7.11.7 Route internet traffic through a DHS Approved Trusted Internet Connection (TIC) that complies with internet security requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution.

7.11.8 Ensure IT solutions complies with Single Sign On (SSO), Multi-factor authentication, and Personal Identity Verification (PIV) card credential authentication requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution.

7.11.9 Provide redundancy in IT solution(s) to ensure no single points of failure.

7.11.10 Notify FEMA of any system outages at the onset of each incident. Provide details on cause of outage, anticipated timeframe to resolve, and action taken to prevent form occurring again, if applicable. Ensure FEMA receives notifications via mobile device, email, and text.

7.11.11 Ensure sufficient financial internal controls with the IT solution(s).

7.11.12 Ensure IT security controls are maintained in compliance with requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution. FEMA currently uses the following security and monitoring tools: Splunk, McAfee, Nessus, WebInspect, Fortify, AppDetective, Xacta.

7.11.13 Demonstrate and maintain full compliance with each of the specific controls listed below, per DHS 4300A, NIST, and Federal Information Security Management Act (FISMA) baseline controls. Additionally, develop and implement a plan to mitigate any weaknesses related to these controls. Ensure all DHS4300A and NIST configuration/hardening guidelines are within compliance and remain within compliance.

7.11.13.1 Access Controls

7.11.13.2 Awareness and Training Controls

7.11.13.3 Audit and Accountability Controls

7.11.13.4 Security Assessment and Authorization Controls

7.11.13.5 Configuration Management Controls

7.11.13.6 Contingency Planning Controls

7.11.13.7 Identification and Authentication Controls

7.11.13.8 Incident Response Controls

7.11.13.9 Maintenance Controls

7.11.13.10 Media Protection Controls

7.11.13.11 Physical and Environmental Protection Controls

7.11.13.12 Planning Controls

7.11.13.13 Personnel Security Controls

7.11.13.14 Risk Assessment Controls

7.11.13.15 System and Services Acquisition Controls

7.11.13.16 System and Communication Protection Controls

7.11.13.17 System and Information Integrity Controls

7.11.14 Ensure IT solution capabilities meet the information and reporting requirements, 17 | P a g e including the Transaction Record Reporting and Processing (TRRP), statistical and other requirements of the System of Record, inclusive of GFIP data.

7.11.15 Identify and propose to meet business continuity objectives as described in the DHS 4300A Sensitive Systems Handbook15 inclusive of the long-term secure data storage of magnetic and optical media. The storage facility shall have the capability of delivering the backed-up system to a pre-selected backup or alternate processing site within 24-hours of notice. Restricted access to the back-up site shall be fully detailed in the Security Plan and be part of the Security Authorization Process.

7.11.16 Develop and maintain a Continuity of Operations (COOP) and Disaster Recovery (DR) plan for emergency circumstances that could jeopardize FEMA systems and operations requirements. Review and test the Disaster Recovery plan per FEMA requirements.

7.11.17 Maintain incident records and system overview documentation per requirements set forth in the Statutes, Regulations, Policies, Guidelines and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution.

7.11.18 Perform regular back-ups of all data and/or files created or changed as deemed appropriate for the level of risk posed by data loss.

7.11.19 Provide a detailed approach to ensure data provided under this contract is not improperly used for commercial purposes.

7.11.20 Securely contain Personally Identifiable Information (PII) and other sensitive information from unauthorized access and improper use in compliance with FEMA requirements.

7.11.21 Secure all necessary licenses or releases to permit use of third-party software as part of the proposed IT solution and, as required, assist in coordinating the transfer of such software to the Government or a successor system operation.

7.11.22 Maintain continuous compliance with security and privacy requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution. This includes providing prompt responses to all security questions posed by the FEMA Program Management Office (PMO), Information System Security Office (ISSO), or auditors, along with providing security artifacts and statements.

7.11.23 Implement any necessary IT system changes for all program changes and update system documentation accordingly, following processes detailing in ATO documents.

7.11.24 Comply with Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) requirements, including, but not limited to, those set forth in the Statutes, Regulations, Policies, Guidelines, and Specifications section of this PWS, as well as requirements identified by the FEMA OCIO throughout the lifecycle of the IT solution.

7.11.25 Develop and maintain a configuration management strategy to ensure optimal performance and consistency throughout the lifecycle of the IT Solution.

15 The DHS 4300A Sensitive Systems Handbook provides specific techniques and procedures for implementing the requirements of the DHS Information Security Program for DHS sensitive systems and systems that process sensitive information for DHS. The DHS 4300A Sensitive Systems Handbook is available at https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook

18 | P a g e

7.12 Design, implement, and provide metric reporting to continuously improve the customer experience (Data & Reporting)

7.12.1 Ensure FEMA data is not intermingled with other data unless approved by FEMA.

7.12.2 Ensure the protection of FEMA intellectual property (IP) and data ownership rights and those of any licensors.

7.12.3 Provide FEMA subject matter experts access to all raw data collected or stored in the proposed IT solution(s).

7.12.4 Deliver and provide FEMA access to all reoccurring reports required in a timely manner, including, but not limited to those listed in the Deliverables section of the PWS.

7.12.5 Provide data visualization to FEMA personnel in a timely…