Attachment 1 - Statement of Work.pdf

70Z02320QADW01100 Combined Synopsis Solicitation Attachment 1 – Statement of Work

CONTRACTOR SUPPORT SERVICES

FOR THE U.S. COAST GUARD (USCG) ACQUISITION DIRECTORATE

BUSINESS INTELLIGENCE APPLICATION

STATEMENT OF WORK

1.0 GENERAL.

The purpose of this Statement of Work (SOW) is to obtain Contractor services to further develop a Business Intelligence (BI) material solution utilizing Acquisition Directorate’s (CG-9) existing Business Intelligence System.

1.1 SCOPE.

The USCG has a requirement for Contractor services to develop and implement performance management data sets and measures in support of the Acquisition Directorate’s Strategic Plan and Action Plan goals and objectives utilizing CG-9’s existing APMS.

Specifically, the Acquisition Directorate requires an organic capability to provide a holistic view of the CG-9 performance management data in a single dashboard/portal. The performance management data should be capable of searching and displaying relevant, holistic, and predictive information that will support strategic decisions, which will enable CG-9 to address critical business decisions and align resources with organizational plans.

In addition to supporting the goals and objectives of the Acquisition Directorate’s Strategic Plan and Action Plan, CG-9 requires an organic BI capability to implement performance management functions by integrating data from various sources into one portal that displays all measures, metrics and reports.

1.2 BACKGROUND.

CG-9 is responsible for providing data-driven metrics to ensure that the USCG is promoting projects with the requisite technical, contracting, and program management skills to deliver best-value systems and assets to USCG operating forces. The USCG currently has an existing system in place that can be utilized to integrate this requirement. The Acquisition Directorate has deployed and is operating a comprehensive Acquisition Performance Management system using commercial off-the-shelf (COTS) BI software. The performance management system known as the Acquisition Performance Management System (APMS) is the SAS-based BI system consisting of enterprise business intelligence, data integration, and performance management components. APMS receives data from multiple sources both internal and external to the USCG and displays the information for executives and managers through a portal, web reports and metrics.

1.3 CONTRACTOR PERSONNEL.

1.3.1 Qualified Personnel. The Contractor shall provide qualified personnel to perform all requirements specified in this SOW. The Contractor personnel shall have at a minimum eight years of experience using SAS and a minimum of five years expertise in the following: SAS BI version 9.4, SAS Portal Version 4.4;

SAS Web Report Studio Version 4.4; Base SAS Version 9.4; Information Map Studio Version 4.4; SAS Financial Management Studio Version 5.5 and SAS Management Console Version 9.4. The Contractor shall have experience in extracting data from SAS Financial Management version 5.5 to include extraction of data from supplemental schedules and shall have experience in configuring data for use in automatic metric loading using SAS Strategy Management 5.6. The Contractor Personnel shall have experience in moving data between versions of SAS software.

1.3.2 Employee Identification. Contractor employees visiting Government facilities shall wear an identification badge that, at minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

1.3.2.1 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display the Government issued badge in plain view above the waist at all times.

1.3.2.2 For all Contractor employees working for the USCG, the Contractor shall utilize the Department of Defense (DoD) Trusted Associate Sponsorship System (TASS) to apply for a Common Access Card (CAC) for their employees that require access to a USCG or other federally controlled computer information system.

1.3.2.2.1 When an employee with a CAC is no longer performing work under this purchase order, the Contractor shall notify the COR on the same day the employee stops working and shall deliver the CAC to the COR within one (1) calendar day after such notification. Upon Termination, Cancellation or Completion of this purchase order, the contractor shall return all CACs.

1.3.2.2.2 The Contractor shall submit a list of employees to the Contracting Officer’s Representative (COR) for the TASS. Contractor employees required to access a USCG, DoD, or other federally controlled computer information system and facility, or need Public Key Infrastructure authentication to perform their duties shall use TASS to obtain a CAC. The Contractor shall provide such forms to or request such information from Contractor employees that may be necessary for obtaining a CAC via the CVS. Completed forms and information shall be submitted as directed by the COR. Contractors are responsible for the accuracy and completeness of the information submitted and for any liability resulting from the Government’s reliance on inaccurate or incomplete information.

1.3.3 Employee Conduct. Contractor employees shall present a professional appearance at all times and their conduct shall not reflect discredit upon the United States, the Department of Homeland Security and the USCG.

1.3.4 Removing Employees for Misconduct or Security Reasons. The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from USCG facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under this purchase order. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

1.4 KEY PERSONNEL.

All personnel supporting the requirements under this SOW are considered Key Personnel. Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced. The Contractor shall not replace Key Contractor personnel without written acknowledgement from the Contracting Officer. A meeting with the COR and the Contractor is required after any change in Key Personnel.

1.5 SECURITY.

Contractor access to classified information is not currently required under this purchase order. However, the Government may require all Contractor personnel to have Secret clearances during the period of performance of this purchase order. Accordingly, all Contractor employees provided for this requirement must be eligible for a Secret Clearance. The details will be provided in a future Department of Defense Form 254 if this policy goes into effect.

1.5.1 Contractor access to unclassified, but Security Sensitive Information may be required under this purchase order. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

1.5.2 Contractor employees that require access to classified information must have proper security clearances in place at the time of award.

1.5.3 All hardware, software, and services provided must be compliant in accordance with 140-01 Information Technology Systems Security and the DHS Sensitive Systems Handbooks 4300A or 4300B for Classified Systems.

1.5.4 Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information, describes how contractors must handle sensitive but unclassified information. DHS MD 140.01 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the contractor except as specified in the purchase order.

1.5.5 Security Review The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this purchase order are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Technical Representative (COTR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this purchase order. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

1.5.6 Interconnection Security Agreements Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements. COMDTINST 5500.13 requires an ISA for all interconnections. All hardware and software interfaces shall meet FIPS 140-2 and

FIPS 197 Advanced Encryption Standard (AES) 256 encryption compliance. All hardware and software shall be Federal Desktop Core Configuration (FDCC) compatible.

1.5.7 Security Certification/Accreditation: Information Assurance (IA) professionals in significant information security roles are required by COMDTINST 5200.3 to have a professional certification. USCG shall provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook. During all SDLC phases of USCG systems, USCG personnel shall develop documentation and provide any required information for all levels of classification in support of the certification / accreditation process. In addition, all security certification / accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

1.5.8 DHS Sensitive Systems Policy Directive 4300 A, Section 4.1.4 requires the "Separation of duties to prevent a single individual from being able to disrupt or corrupt a critical security process." The Policy requires the following: "Components shall divide and separate duties and responsibilities of critical IT system functions among different individuals to minimize the possibility that any one individual would have the necessary authority or system access to be able to engage in fraudulent or criminal activity." Security testing is but one critical systems function that needs to be performed by a provider (either government or contractor) other than the system designer / developer / operator.

This requirement is based, in part, on NIST 800-53 Rev 3, Security Control CA-2 Security Assessments -enhancement 1 which requires "The organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system." Consequently, the vendor that provides C&A services may not perform the security controls testing.

1.6 PERIOD OF PERFORMANCE.

The period of performance for this purchase order is one twelve (12) month base period, with two twelve

(12) month option periods.

1.7 PLACE OF PERFORMANCE.

The primary place of performance is the U.S. Coast Guard Headquarters Building at 2703 Martin Luther King Jr Ave, SE, Washington, DC 20593.

1.7.1 OFF-SITE CAPABILITY. Contractors may be allowed to complete all or part of select functions off-site. To request, the Contractor must submit a written request describing the function(s) to be completed off-site, validating that schedule, minimum on-site support fulfillment, and USCG off-site capability and security requirements are properly addressed. The COR will approve or deny all off-site capability requests..

The USCG licensed VMWare software must be used to prevent the potential of For Official Use Only correspondence being transmitted non-USCG email servers.

The Contractor is solely responsible for ancillary costs such as internet access, secure off-site locations, and any and all overhead that may be required for off-site work.

Ancillary costs shall be paid by the Contractor through a price reduction in their next invoice after the Contractor has successfully obtained and used the VMWare software. The cost for off-site access to the USCG's server is currently $363.00 per person, per purchase order year. This cost may change at any time unilaterally as required by the USCG. The Contractor shall pay the difference in any changes in these costs through invoice price reductions in their next immediate invoice after the price increase.

1.8 WORKING HOURS.

Contractor support is required between 0800 – 1600 daily.

1.9 TRAVEL.

No travel is anticipated under this SOW in support of the requirements.

1.10 KICK-OFF MEETING.

The Contractor shall attend a kick-off meeting with the Contracting Officer and the COR no later than five business days after the date of purchase order award. The purpose of the kick-off meeting, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this SOW. The kick-off meeting will be held at the Government’s facility.

1.11 GENERAL REPORT REQUIREMENTS.

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with Coast Guard Standard Workstation (Windows Vista and Microsoft Office Applications) within 48 hours of request by COR.

1.12 INTELLECTUAL PROPERTY.

All Contractor developed processes and procedures and other forms of intellectual property first developed under this purchase order, shall be considered Government property, unless specifically stated. The contractor shall provide—upon five business days’ notice—electronic copies of all materials developed in this purchase order in a format with read and write capability using applications that are compatible with USCG work stations. Additional intellectual property requirements may be specified under this purchase order.

1.13 PROTECTION OF INFORMATION.

Contractor access to proprietary information shall be required under this purchase order. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, Safeguarding Sensitive but Unclassified (SBU) Information. SBU includes information categorized by DHS or other government agencies as: For Official Use Only (FOUO); Official Use Only (OUO); Sensitive Homeland Security Information (SHSI); Limited Official Use (LOU); Law Enforcement Sensitive (LES); Safeguarding Information (SGI); Unclassified Controlled Nuclear Information (UCNI); and any other identifier used by other government agencies to categorize information as sensitive but unclassified. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement (DHS Form 11000-6).

1.13.1 The Contractor shall continue to ensure employees safeguard this information when the new Controlled Unclassified Information (CUI) framework replaces the sensitive but unclassified (SBU) categorization.

1.13.2 Contractor personnel will have access to CGOne/CG Portal, where For Official Use Only (FOUO) information may be accessible. Access to PersonalIy Identifiable Information (PII) is not required. In accordance with DHS MD 11042.1, Safeguarding Sensitive but Unclassified (FOUO) information, all Contractor personnel with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information.

Further, Contractor personnel shall be personally liable and responsible for adhering to DHS Class Deviation 15-01 for proper handling and safeguarding of the security of all such USCG information. The following clauses apply:

Safeguarding of Sensitive Information (MAR 2015)

HSAR Clause 3052.204-71, Contractor Employee Access (SEP 2012)

Information Technology Security and Privacy Training (MAR 2015)

1.14 SECTION 508 COMPLIANCE.

According to the DHS Accessibility Requirements Tool (DART 2.0) Section 508 does not apply to the deliverables.

1.15 DHS Enterprise Architecture Compliance

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures.

Specifically, the contractor shall comply with the following HLS EA requirements:

• All developed solutions and requirements shall be compliant with the HLS EA.

• All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

• Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

• Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01 and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

• Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

2.0 GOVERNMENT TERMS & DEFINITIONS.

2.1 APMS – Acquisition Performance Management System

2.2 BI – Business Intelligence

2.3 COTR – Contracting Officer’s Technical Representative

2.4 SOW – Statement of Work

2.5 USCG – United States Coast Guard

3.0 GOVERNMENT FURNISHED PROPERTY AND INFORMATION.

The Government will provide access to the SAS BI Version 9.4 system and all its components listed in

1.3.1. Additionally, the government will provide software and permissions to work remotely for this purchase order in accordance with section 1.7.1. The government will also provide a workspace with a computer and permissions for this purchase order.

4.0 CONTRACTOR FURNISHED PROPERTY.

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements under this purchase order, except for the Government Furnished Resources specified in this work statement.

5.0 REQUIREMENTS.

5.1 PERFORMANCE MEASURES SUPPORT.

The Contractor shall support the USCG during the review and ongoing implementation of existing and new automated performance measures that pertain to various projects and programs within the Acquisition Directorate in support of the Strategic Plan and Annual Action Plan.

1. The Contractor shall review and if necessary modify all existing automated performance measures developed from current data marts to ensure they are running correctly and include the most recent fiscal year data.

2. The Contractor shall ensure that these measures continue to run with minimal interruption during the migration of the current financial data mart from the Coast Guard Finance Center views and tables to a new financial data mart pulled from tables from the Coast Guard Enterprise Data Warehouse.

3. The Contractor shall also create new performance measures that support CG-9 projects and programs within the Acquisitions Directorate as required.

4. The Contractor shall integrate data from the financial management application into data sets useable in the BI system to include integration with actual accounting data from the data mart by object class and month/year.

5. The Contractor shall review any potential new data or data sources and recommend ways to integrate it with currently available data.

6. The Contractor shall review industry best practices and make recommendations for new measures based on currently available data.

7. The Contractor shall review the current APMS portal pages and make recommendations for additional pages and portlet types for use by APMS offices.

8. The Contractor shall provide support and update data, in APMS, in support of USCG Treasury reporting and audit compliance.

5.2 REPORTS/DOCUMENTATION.

1. The Contractor shall provide updated documentation for each process, process modified or developed in support of paragraph 5.1.

2. The contractor shall also update all information technology documentation to account for the systems latest Security Authorization and process changes that occur during the period of performance.

3. The contractor shall also update or assist in the creation of any new documentation requirements that pertain to the system.

5.3 AD-HOC TRAINING

The Contractor shall provide Ad-Hoc training, as needed, for any measures or reports developed in support of paragraph 5.1.

5.4 PROGRAM MANAGEMENT

The contractor shall monitor the performance of all work executed under this purchase order and ensure all work completed on the system is tested on the development servers and coordinated for deployment on the production system with the APMS project manager and system administrator. The contractor shall hold peer reviews of all processes developed to support data sets in APMS to ensure the code is efficient and sustainable and that it does not duplicate or override any other code or processes in existence within the system.

5.5 STATUS REPORTS.

The contractor shall provide a monthly status report to the COR and Contracting Officer via electronic mail.

This report shall include a summary of all Contractor work performed under this purchase order, an assessment of technical progress, schedule status, and any Contractor concerns or recommendations for the previous month.

5.6 STATUS MEETINGS.

The contractor shall be responsible for keeping the COR informed about Contractor progress under this purchase order, and ensure Contractor activities are aligned with USCG requirements. The contractor shall be available for a meeting within 24 hours of request by COR.

6.0 REFERENCES.

1. APMS Certification and Accreditation Documentation

7.0 DELIVERABLES.

SOW DELIVERABLE Due Date Qty

1.10 Kick-Off Meeting 5 business days after purchase order

award

5.2 Update Documentation As directed by the COR. For each

process, process modified or developed in support of paragraph 5.1

5.2 System Documentation 11 Months after Base Purchase Order

Award

5.2 System Documentation 11 Months after Option 1 Award 1

5.2 System Documentation 11 Months after Option 2 Award 1

5.3 Adhoc Training As directed by the COR When new

measures or reports are developed or updated.

5.5 Monthly Status Report Monthly 12 per purchase

order period