ATTACHMENT 1 - HUD Exchange Platform - PWS - V2.pdf

Performance Work Statement (PWS)

IN SUPPORT OF

U.S. Department of Housing and Urban

Development (HUD)

Office of Policy Development and Research

Project Title: Hud Exchange Knowledge

Management Platform

05/21/2024

Version 2

Vision Statement …

1 General Information

1.1 Introduction

1.2 Background

1.3 Constraints

1.3.1 Project Planning and Management

1.4 Description of Services

1.5 Non-Personal Services

1.6 Period of Performance

1.7 Place of Performance

1.8 Hours of Operation

1.9 Special Qualifications

1.10 Post Award/Kickoff Conference

1.11 Status Meetings

1.12 Contractor Travel

1.13 Transition In

1.14 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials …

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Materials

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

4.7 Quality Control

4.7.1 Quality Control Plan

Specific Tasks

5.1 Project Management

5.2 Website Hosting & Administration

5.3 Website Operations

5.4 Website improvements

5.5 Marketing

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Performance Requirements Summary

8 Related Documents……………………………………………………………………………...82

Performance Work Statement (PWS)

HUD EXCHANGE KNOWLEDGE MANAGEMENT PLATFORM

Vision Statement

HUD is seeking contractor support in maintaining and administering their knowledge management platform, HUDExchange.

1 General Information

1.1 Introduction

The U.S. Department of Housing and Urban Development (HUD) is seeking a Contractor with extensive experience working in a regulated industry to perform knowledge management services. The Contractor will deliver a web-based technical assistance (TA) environment aimed at building the capacity of HUD’s TA customers, including program participants, grantees, and other recipients of HUD funding or participants in HUD initiatives, to design and deploy compliant, effective, and transformational affordable housing and community development programs.

The Contractor will assume responsibility for all aspects of the existing www.hudexchange.info website (HUD Exchange or HUDx), improve functionality of site features, and integrate new tools.

Through changes in the design, functionality, and marketing of HUD Exchange, the Contractor will contribute to increases in site usership and user engagement, which HUD expects will translate into measurable growth of TA customer capacity and improved delivery of HUD-funded programs and initiatives. In 2023, HUDx had 5.8 million user sessions, 19.3 million page views, and 741 thousand document downloads.

HUD Exchange is currently funded under a cooperative agreement awarded through the

Community Compass notice of funding availability.

HUD anticipates that the transition of HUD Exchange to a new contractor will occur in the second half of the 2024 federal fiscal year.

The Government intends to transition the current HUDx website to a .gov governmental website during the time period of this contract. The first year of the contract will have hosting and maintenance requirements. After the first year, the hosting requirements set forth within the contract shall be optional at the government’s discretion. After the transition to a .gov site, the contractor shall have continuous monitoring requirements solely.

1.2 Background

HUD facilitates technical assistance and capacity building (collectively referred to as TA) through cooperative agreements with a network of non-federal organizations. These organizations provide TA to HUD technical assistance customers (e.g., cities, states, public housing agencies, tribes, and fair housing organizations) with the aim of improving delivery of HUD-funded programs and initiatives.

HUD tasks a broad range of TA providers with generating TA deliverables that include static products, dynamic web-based content, live and recorded training events, large group http://www.hudexchange.info/ convenings, small cohorts of HUD TA customers, and one-to-one engagement with HUD TA customers.

The goal of HUD Exchange is to curate HUD’s wide range of TA deliverables into a user-centered experience that promotes translation of technical assistance into improved delivery of HUD programs. HUD believes users engage HUD Exchange to address four challenges: 1) to resolve a specific question or challenge with program delivery, 2) to learn about a topic or discipline related to HUD programs, 3) to research new and better ways of delivering HUD programs, and

4) to use a site tool to implement a HUD program more efficiently.

Through this contract, HUD is seeking to promote operational efficiencies and user engagement with the website. HUD Exchange presently spans 19,000 web pages, across 90+ programs or topics, and reaches 100,000+ registered users.

The HUD Exchange Knowledge Management Platform Contract is for comprehensive systems development and website operations for HUDx. The Contractor shall perform tasks and provide deliverables in the following areas:

1. Project management

2. Website hosting and administration

3. Website operations

4. Website improvements

5. Marketing

1.3 Constraints

The Contractor shall abide by all applicable regulations, publications, manuals, policies, and procedures in the performance of this contract. The deliverables and services identified in this

PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD and the Federal Government, including those listed.

Section 508 Compliance

a) The website and all components must comply with Section 508 of the Rehabilitation Act Amendment of 1998. Examples of Section 508 compliance include:

b) Logo Graphics – an assistive technology program will inform the user that a graphic is on a page, but the systems cannot read the graphic itself, thus a caption or alternative text, such as “Department of Housing and Urban Development logo,” needs to be provided.

c) Flow Charts and Graphs – an assistive technology program will read information in each of the “boxes” but it will not read arrows or lines, thus an unsighted person would not be able to determine relationships between the “boxes” and would not know a relationship even exists. To make these items compliant with Section 508 of the Rehabilitation Act

Amendment of 1998, a description of the graphic would have to be provided.

d) Color and Tables - Section 508 of the Rehabilitation Act Amendment of 1998 does not permit the use of either color or tables; thus, the Contractor shall ensure that all information conveyed with color is also available without color and that row and column headers are identified for tables.

Security

The website, inclusive of all components and associated services, must comply with applicable federal information security protocols. Due to U.S. national security interests and the need to protect personally identifiable information (PII) that may be gathered about U.S. citizens, U.S.

companies, government partners or others, the Contractor must attest to the design of the electronic security and organizational protocols which ensure that data cannot be stolen, hacked, removed, or released by unauthorized parties. These protocols include:

a) NIST 800-37 Rev. 2 Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy;

b) NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and

Organizations;

c) NIST SP 800-171 Rev 1 Protecting Controlled Unclassified Information in Nonfederal

Systems and Organizations;

d) FIPS Publication 200, Minimum Security Requirements for Federal Information and

Information Systems;

e) FIPS Publication 199, Standards for Security Categorization of Federal Information and

Information Systems; and

f) As specified in Federal Information Security Modernization Act (FISMA) of 2014 and others

Federal Risk and Authorization Management Program (FedRAMP) compliance

The Contractor shall utilize a FedRAMP-authorized cloud infrastructure for HUDx.

Authority to Operate

The Contractor shall comply with HUD Handbook 2400.25, including providing the government with the documentation required to achieve an Authority to Operate (ATO). The Contractor shall develop the required security documentation and supporting evidence requests as part of the security assessment conducted by HUD’s Office of Chief Information Security Officer (OCISO)

Once an ATO is achieved, the Contractor shall comply with HUD’s continuous monitoring requirements.

Records Retention and Information Access

The website and Contractor shall comply with Federal Records and Retention Acts and

Regulations, and Freedom of Information Act (FOIA) Laws and Regulations.

The website and Contractor shall comply with the National Archives and Record

Administration’s (NARA) Standards for Guidance on Maintenance and Storage of Electronic

Records.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the HUD COR.

Access to HUD Information Systems

Contractor and Sub-Contractor employees who will access HUD information systems or business service providers (e.g. NW or FHAC) must undergo a background investigation as referenced in Section 5.1.1. See HUDAR Clause 2452.239-70 Access to HUD Systems

(Deviation).

Data Location

The Contractor shall not host any portion of the cloud service environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Continuity of Operations

The Contractor shall comply with HUD’s Continuity of Operations’ policies, practices and testing.

Continuity of Operations is defined in Presidential Policy Directive (PPD 40) National Continuity

Policy and Federal Continuity Directive-1 (FCD-1), Federal Executive Branch National Continuity Program and Requirements, January 2017.

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME

PPM was designed based on the best practices from Capability Maturity Model Integration

(CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/

Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the

HUD Project Manager(s), the Contractor will tailor PPM to take advantage of contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer (DCIO) http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.4 Description of Services

The Contractor shall deliver the following knowledge management services under this contract:

(1) project management (2) website hosting and administration; (3) website operations; (4) website improvements; and (5) marketing. The Contractor shall provide all services and deliverables to HUD’s satisfaction, defined by specific performance requirements and objectives.

The HUD Exchange Knowledge Management Platform Contract shall not be used to perform work of a policy, decision-making, or management nature, which are inherently Governmental functions.

1.5 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.6 Period of Performance

The period of performance shall be for 12 months, with four successive 12-month extensions which can be exercised at HUD’s option.

1.7 Place of Performance

The services to be performed under this contract shall be performed at the Contractor's place of operation.

1.8 Hours of Operation

The Contractor shall provide services during the hours necessary to fulfill the performance requirements and standards.

1.9 Special Qualifications

N/A

1.10 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.11 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR) and other Government personnel, as appropriate may meet periodically with the Contractor to review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer may apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.12 Contractor Travel

1.13 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the 90-day transition-in period to ensure a smooth transition with the incumbent service provider.

During the transition-in period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract transition-in period.

1.14 Transition Out

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-out services as required. The Contractor shall have sufficient personnel on board during the 90-day transition out period to ensure a smooth transition with the successor Contractor. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all ongoing work.

During Transition-Out period, the Contractor shall maintain and transfer to the successive Contractor or HUD all files, code, and licenses owned, controlled, or secured by the Contractor during the term of this Contract and needed for the full performance of the contract.

2 Definitions and Acronyms

2.1 Definitions

Archived Content Technical assistance resources that can only be accessed by special request of a designated HUD POC. The resource is not accessible via a HUD Exchange webpage or a HUD Exchange search query.

Business/Workdays - Every official workday of the week which are days between and including

Monday to Friday. This does not include federal holidays and weekends.

Calendar Day - Any day of the week.

Capacity Building -Assistance which increases the ability of HUD's TA customers and their partners to organize and independently implement and manage affordable housing, community development, and economic development programs.

Content - Information that includes, but is not limited to, program pages, training and webinars, frequently asked questions, downloadable materials such as guidebooks, case studies, interactive tools, helpdesks, and information about HUD grantees.

Content management -The systematic organization, governance, and delivery of digital information.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the

Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification.

Government-furnished property also includes contractor-acquired property if the Contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

HUD TA Customers - Recipients and subrecipients of HUD funding, residents, and participants in HUD-funded programs or initiatives. Examples include, but are not limited to, state and local grantees, public housing agencies, owners and managers of HUD-assisted housing, Continuums of Care, non-profit organizations, HMIS Leads, HUD-approved housing counseling agencies and counselors, tribal organizations, Indian tribes, tribally-designated housing entities (TDHEs), FHA-approved multifamily lenders, EnVision Centers, residents and participants in HUD-funded programs, and stakeholders of inter-government agency partnerships.

Incumbent Service Provider - The current organization hosting and administering HUDx

Knowledge Management - Integrated learning or curriculum management systems; databases of resources, tools, and information; development, updates, and maintenance of interactive tools to assist with program design and management; organization, facilitation, and moderation of virtual peer cohorts, networks, forums, or exchanges; collection and dissemination of information about and to HUD TA customers; and facilitation of data collection for performance management.

Near Real-Time - refers to the time delay introduced by automated data processing or network transmissions. Real time is measured in seconds as in near real time speed can be measured in minutes or longer.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describes the required results in clear, specific, and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Service Level Agreement (SLA) - The expectations established by this PWS between the

Contractor and the Government regarding the products and services to be delivered.

Shareable Content Object Reference Model - A collection of standards and specifications for web-based electronic educational technology.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Technical Assistance (TA) - Guidance which enables HUD's TA customers to overcome a lack of specific skills or knowledge of the associated HUD programs and, by doing so, results in the successful performance of and compliance with those programs.

Warehoused Content - Technical assistance resources that are accessible through a HUD

Exchange search query but not published on a public-facing webpage.

Website Content - Any text, tools, images, or aural content published on a website.

Website Operations - The processes, maintenance and security of a website and its tools, applications and services.

Wireframe - is a visual guide that represents the skeletal framework of a website.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level ATO- Authority to Operate CFO or OCFO - Office of the Chief Financial Officer of HUD CFR - Code of Federal Regulations CIO or OCIO - Office of the Chief Information Officer of HUD CO - Contracting Officer COR - Contracting Officer's Representative CPO - Office of the Chief Procurement Officer of HUD EST - Eastern Standard Time (U.S.)

eICAM - enterprise Identity, Credential, and Access Management FedRAMP- Federal Risk and Authorization Management Program

HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation IG or OIG - Inspector General (Office of) IT - Information Technology LMS Learning Management System OCPO - Office of the Chief Procurement Officer OIG - Office of Inspector General OMB - Office of Management and Budget PL Public Law PM - Project Manager POC - Point of Contact PPM - Project Planning and Management QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan SF - Standard Form TA Technical Assistance TBD - To be determined U.S.C - United States Code

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government- Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

The Government may provide Government Furnished Information (GFI) to the Contractor in hard copy or soft copy. All GFI remains the property of the Government and will be returned to the COR upon request of the COR or at the end of the contract period, if not returned prior to the end of the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish all facilities, equipment and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all facilities necessary and sufficient to fulfill this contract.

4.2 Equipment

The Contractor shall furnish all equipment necessary and sufficient to fulfill this contract.

4.3 Materials

The Contractor shall furnish to the government on request of the Contractor Officer.

N/A

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period. Only the COR and designated POCs can approve Contractor actions under the PWS and only to the extent authorized in writing U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.4.1 Accessibility Standards

Unless otherwise specified, all deliverables under this contract shall comply with 36 CFR 1194.21 Software Applications and Operating Systems, 36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, 36 CFR 1194.23 Telecommunications Products, 36 CFR

1194.31 Functional Performance Criteria, and 36 CFR 1194.41 Information, Documentation and Support under the authority of Section 508 of the Rehabilitation Act Amendment of 1998, 29 USC 794d.

In order to comply with these standards, the Contractor shall submit all copies in a format readable by the assistive technology program, JAWS (HUD's standard screen reader). To view the entire text of 36 CFR Part I 194, go to Section 508 - Accessibility of Electronic and

Information Technology, and Federal Acquisition Regulation Subpart 39.2, https://www.acquisition.gov/content/part-39-acquisition-information-technology#i1077004.

4.4.2 Security Access

As a condition of obtaining access to HUD systems, Contractor employees requiring access to HUD systems shall follow the procedures as set forth in Section I, HUDAR 2452.239-70. HUD may grant, deny, or revoke an individual's access rights to a HUD system based upon the results of the security background check of the individual. The Contractor shall provide written notification to the COR not later than one (1) business day of termination or resignation of any employee granted HUD systems access or when there is no longer a need for access to HUD systems by any Contractor employee. The Contractor shall maintain an up-to-date list that identifies contract employees with access to each of the information system associated with execution of this contract and the justification for each employee's level of access.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel.” The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to receive assignment, guidance, and direction from the COR, PM and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance. These points of points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

The Contractor shall provide a Technical/Technology Lead who shall be responsible for the performance of all tasks outlined in the performance work statement relating to administration, security, design, development, and operation of the HUD Exchange system. An alternate shall also be designated, to act in the absence of the Technical/Technology Lead.

The Contractor shall provide an Engagement Lead who shall be responsible for the performance of all tasks outlined in the performance work statement relating to user outreach, resource promotion, and absorption of technical assistance among HUD customer organizations.

The Technical/Technology Lead and the Engagement Lead are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel.”

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their work space area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services.

The Contractor's quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP).

The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP).

The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system.

The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

Specific Tasks

5.1 Project Management

5.1.1 Reports

5.1.1.1 Project Management Plan

The Contractor shall document all support requirements in a Project Management Plan (PMP).

The PMP outlines the Contractors approach to program management, risk management, and communications for all tasks and deliverables included in the PWS. The PMP shall address all requirements contained in this PWS and define a detailed plan and schedule for the program throughout the periods of performance. The PMP shall show the processes by which the Contractor shall assist HUD in meeting its goals. The Contractor shall provide the government with a draft PMP at the Kick-off Meeting. The government will make comments on the draft within fifteen (15) business days. The Contractor shall incorporate these comments into the final PMP and return it to the government for approval within five (5) business days of receiving the governments comments. The PMP is an evolutionary document that shall be updated monthly by the contractor on the 5th business day of the month, with the revised version subject to government approval. The Contractor shall work from the latest Government-approved version of the PMP.

The PMP shall at a minimum include the following:

Daily tasks and activities that shall be performed Monthly tasks and activities that shall be performed Staffing Ad hoc meeting plan Describe the planned deliverables schedule/process after task assignment

Performance Standards

a) Standard: Document all support requirements in a Project Management Plan (PMP) outlining the Contractor’s approach to program management, risk management, and communications for all tasks and deliverables included in the PWS.

AQL: Zero Deviation

b) Standard: Provide the government with a draft PMP at the Kick-off Meeting.

c) Standard: Incorporate government comments into the final PMP and return it to the government for approval within five (5) business days of receiving the government’s comments.

d) Standard: PMP is updated monthly on the 5th business day of the month.

e) Standard: Only work from the latest Government-approved version of the PMP.

AQL: Deviation of no more than 3 business days

Deliverables

A001 Draft PMP A002 Final PMP A003 Updated PMP

5.1.1.2 Quarterly Progress Reports

The Contractor shall on a quarterly basis, following the transition in period, submit a report to the Government that includes the following:

a) A summary of the Section 5.4 data collection, including feedback from users and user testing

b) Recommended development plans and proposed timelines

c) Development progress from the prior quarters approved website improvement plan

d) A summary of content updates made during the quarter by content type, and HUD program area

e) A summary of the marketing analytics from the marketing dashboard

f) A summary of the key performance indicators from the KPI dashboard

The Contractor shall include tables, charts, or other graphics to illustrate trends.

a) Standard: The Contractor shall deliver a quarterly progress report on or before January

30th, April 30th, July 30th, and October 30th for each contract period.

AQL: One business day deviation unless otherwise approved by the Government.

A004 Quarterly Progress Reports

5.1.1.3 Ad hoc reports

The Contractor shall provide the government with ad hoc reports regarding site utilization or performance, as requested. The government does not anticipate these requests exceeding 2 per quarter.

Standard: The Contractor shall provide the government with an ad hoc report within 7 calendar days of request from the government.

AQL: Zero deviation unless otherwise approved by the Government.

A005 Ad Hoc Reports

5.1.1.4 Key Performance Indicator (KPI) Dashboard

The Contractor shall produce a business intelligence dashboard that draws data from across HUD

Exchange, the Learning Management System (LMS), and YouTube to help HUD analyze the effectiveness of its technical assistance. The dashboard should refresh with accurate data at least monthly and retain historic data for the duration of the contract. The Contractor shall work with the Government to determine the specific data to be collected. At a minimum, the KPI Dashboard shall include the following measures:

a) Active users (registered users who have logged into the site within 12 months)

b) Monthly active users (number of registered users who have logged into the site in a month).

c) Conversion rate for (percent of users who land on HUD Exchange and then take an action):

i. Account creation

ii. Resource download

iii. General video view

iv. LMS use

v. No action

d) Ten leading sources of site traffic

e) Consumption of TA content by:

i. Content type

ii. HUD program area associated with the content, and

iii. State or HUD field office associated with the user

f) Search click-thru-rate

g) Video views per day

h) Training events started and completed by:

i. Training type (e.g. webinar, self-paced training, live virtual training)

ii. HUD program area associated with the content, and

iii. State or HUD field office associated with the user i)Percentage of training registrations that are completed

a) Standard: The Contractor shall deliver a business intelligence dashboard within 120 calendar days of the contract start date.

AQL: An additional 60 calendar days.

b) Standard: The Contractor shall ensure the business intelligence dashboard refreshes data by the 10th calendar day of each month.

AQL: An additional 5 calendar days (15th of the month)

c) Standard: By the 10th calendar day of each month, the Contractor shall deliver a point-in-time report showing the monthly total or average, as appropriate, for each indicator over time.

AQL: An additional 5 calendar days (15th of the month)

A006 Key Performance Indicator (KPI) Dashboard A007 Monthly Point-in-Time report of Dashboard Indicators (a – i above)

5.2 Website Hosting & Administration

5.2.1 Website hosting requirements [OPTIONAL TASK after base year of the contract]

At HUD’s option, the Contractor shall host HUDx on a cloud-based server with the following minimum technical requirements:

a) 99% availability, or higher, in Service Level Agreement (SLA), consistent with PRS disincentive;

b) a secure platform that prevents loss of, or tampering with, HUD data, service degradation, and/or service disruption to all users;

c) 24 hours per day, seven days a week, 365 days per year proactive monitoring and support for resolution of any and all outages that affect the availability of the cloud services;

d) flexibility to rapidly scale up and down to meet the business needs;

e) provide troubleshooting services and support during core duty hours; and

f) compliance with federally mandated IPv6 requirements for public facing services

(see https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf)

a) Standard: The Contractor shall ensure HUD Exchange has 99% availability, or higher, in SLA with a financially backed penalty schedule;

AQL: Zero deviation, unless additional time is approved by the government in writing 7 calendar days in advance.

b) Standard: The Contractor shall ensure that HUD Exchange is a secure platform that prevents loss of, or tampering with, HUD data, service degradation, and/or service disruption to all users.

c) Standard: The Contractor shall provide proactive monitoring and support for resolution of any and all outages that affect the availability of the cloud services, 24 hours per day, seven days a week, 365 days per year.

AQL: Zero Deviation, unless additional time is approved by the government in writing 7 calendar days in advance.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf) https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf)

d) Standard: The Contractor shall have the flexibility to rapidly scale up and down to meet the business needs.

e) Standard: The Contractor shall provide troubleshooting services and support for hosting and technical administration of the site during core duty hours.

f) Standard: The Contractor shall ensure compliance with federally mandated IPv6 requirements for public facing services.

g) Standard: The Contractor shall provide hosting of cloud services within 14 calendar days of the contract start date.

AQL: An additional seven calendar days.

5.2.2 Cloud services

The Contractor shall utilize a FedRAMP-authorized cloud infrastructure for HUDx. The Contractor shall provide cloud services that meet the requirements below:

a) Allow for controlled, real-time, on-demand and automated provisioning of storage and bandwidth capacity to support content delivery;

b) Provide up to four concurrent HUD service level managers a web-based dashboard that enables 24x7x365 near real-time monitoring and visibility of:

i. Cloud services performance, service status, and key performance indicators of the system against the SLAs and operational parameters;

ii. Reporting analytics that provides HUD with up-to-date and comprehensive information regarding technical and management performance (summarizing projected vs. actual measures), and other related issues; and

iii. Security logs as required within the documentation identified in Section 5.1.5 Security.

a) Standard: The Contractor shall utilize a FedRAMP authorized cloud infrastructure.

b) Standard: The Contractor shall ensure the cloud services allow for controlled, real-time, on-demand and automated provisioning of storage and bandwidth capacity to support content delivery.

c) Standard: The Contractor shall provide a web-based dashboard near real time monitoring and visibility of Cloud services performance, service status, and key performance indicators of the system against the SLAs and operational parameters.

f) Standard: The Contractor shall provide reporting analytics to HUD with up-to-date and comprehensive information regarding technical and management performance (summarizing projected vs. actual measures), and other related issues; and

d) Standard: The Contractor shall provide security logs as required within the documentation identified in Section 5.1.5 Security.

e) Standard: The Contractor shall ensure Cloud Services are available within 14 days from the contract start date.

A008 FedRAMP authorized Cloud system A009 Web-based Dashboard

5.2.3 Test and Live environments for HUDx

The Contractor shall establish a nonpublic beta testing, or staged, environment and provide HUD POCs, including the CO, COR, and other persons designated by HUD with view/test access to the test environment. The test environment should be fully functional within 60 days of the contract start date.

The Contractor shall ensure the HUD Exchange site, including all files and applications, are functional before publishing the site to a live environment, via the public domain. The Contractor shall publish the site to live environment within 90 days of the contract start date.

a) Standard: Testing environment shall be functional within 60 days of the contract start date.

b) Standard: The HUD Exchange shall be published to live environment, accessible via the public domain from the Contractor’s servers, within 90 days of the contractor start date.

A0010 Test Environment

5.2.4 Authentication and access control

The Contractor shall integrate HUD Exchange system access control seamlessly with HUD’s enterprise Identity, Credential, and Access Management (eICAM) solution, which consists of:

a) HUD SiteMinder architecture,

b) HUD WASS,

c) HUD Active Directory (AD), and HUD HSPD-12 PIV Card based credentials and enable logical authentication.

a) Standard: The Contractor shall ensure system access control seamlessly integrates with HUD’s enterprise Identity, Credential, and Access Management

5.2.5 Security

5.2.5.1 Security requirements

The Contractor shall provide cloud services with the requisite security, confidentiality, integrity, availability, and privacy levels and controls that are compliant with regulations, to include the following:

a) Federal government regulatory compliance requirements (i.e. Privacy Act, FISMA, CIPSEA, Federal Records Act, Freedom of Information Act (FOIA), Trade Secrets Act, Health Insurance Portability and Accountability Act (HIPAA), Privacy Rules, etc.);

b) Security standards and security control requirements for a Moderate Impact system as described in NIST Special Publications (SP) for cloud computing (SP 800-144, SP 800-

145, and SP 800-146) as well as NIST SP 800-53 with an accepted Certification and

Accreditation (C&A) or Security Authorization;

c) Privacy Act, Title 5 of the United States Code (U.S.C.) 552a and applicable agency rules and regulations;

d) Supply Chain Risk Manage Standards (i.e., NIST SP 800-16 and OMB M-22-18

Enhancing the Security of the Software Supply Chain through Secure Software

Development Practices; and

e) OMB Memorandum M-21-32, Improving the Federal Government’s Investigative and

Remediation Capabilities Related to Cybersecurity Incidents

f) The hosting environment provisioned by the Contractor must demonstrate an appropriate level of security for FISMA impact level Moderate system by meeting the requirements of Section 5.3.1, comply with HUD Information Security and Privacy Requirements and be FedRAMP JAB authorized. The continuous monitoring provided must comply with the NIST Special Publication 800-137 framework and Department of Homeland Security (DHS) guidance.

a) Standard: The Contractor shall provide cloud services with the requisite security, confidentiality, integrity, availability, and privacy levels and controls that are compliant with A-F of this section.

5.2.5.2 Authority to Operate

Within the 36 weeks following the contract start date, the Contractor shall provide the documentation required for HUDx to achieve an Authority to Operate (ATO), in compliance with HUD Handbook 2400.25. The Contractor shall develop the required security and privacy documentation and support evidence requests as part of the security and privacy assessment conducted by HUD’s Office of the Chief Information Security Officer (OCISO). This includes coordinating with the HUD Information System Security Officer (ISSO), System Owner, and Privacy Laison Officer (PLO) to identify and draft documentation required for an ATO such as:

Contingency Plan and Contingency Plan Test Business Impact Analysis (BIA)

Security and Privacy Controls: Implementation Status, Implementation

Statement, Applicability (e.g., inheritance), and Evidence of Implementation Disaster Recovery Plan Vulnerability Scan Request

Memorandum of Understanding/Agreement (MOU/As)/ Interconnection Security

Agreement (ISA) / Service Level Agreements (SLA) / Interface Control Documents

(ICD) as applicable Risk Assessment documentation System Security Plan (SSP) Designation Letters as applicable

HUD Form 67 Records Series Inventory Worksheet after identifying unscheduled record series FIPS-199 Workbook in the case of data categorization changes Privacy Impact Assessment (PIA) System of Records Notice (SORN) as determined by HUD Privacy Office Configuration Management Plan (CMP)

Standard Operating Procedures (SOP) to address NIST 800-53 control families as applicable User and Administrative Manuals System Description and Technical Description Narratives User Accounts and Rules of Behavior Plan of Action and Milestones (POA&Ms) as applicable Information System Component Inventory per NIST SP 800-53 CM-8 requirements

Once an ATO is achieved, the Contractor shall comply with HUD continuous monitoring requirements, which includes monthly, quarterly, and ad-hoc reporting of compliance with ATO requirements.

a) Standard: The Contractor shall develop the required security documentation and supporting evidence requests as part of the security assessment conducted by HUD’s OCISO and Privacy Office and provide evidence of control implementation, within the 36 weeks of the contract start date.

AQL: Zero deviation unless additional time is approved by the government in writing in advance.

b) Standard: The Contractor shall comply with HUD continuous monitoring requirements on an ongoing basis, but not less often than annually.

A011 ATO Documentation

5.2.6 Incident response

The Contractor shall have, and deliver annually, an incident response plan to address security or privacy breaches, data loss, and unauthorized access to data. Such plan shall comply with FISMA, the Trusted Internet Connection (TIC) initiative, ISO 27001, and NIST standards. The Contractor shall adhere to the U.S.