Section C - Statement of Work_Amendment 0001.pdf

Section C – Statement of Work, Amendment 0001, Page 1 of 8

SECTION C – STATEMENT OF WORK

Incident Management System

1. BACKGROUND

The National Transportation Safety Board (NTSB) is a federal agency mandated by Congress to investigate all aviation accidents and selected accidents/incidents in other modes of transportation and report the results of those investigations. In support of this mission, the NTSB runs a 24-hour 7 day a week Response Operations Center (ROC). The NTSB’s ROC is seeking a cloud-based, web-enabled software capable of providing a centralized, secure, and integrated incident management system designed to manage incidents, accidents, and events.

The agency requires an efficient means of disseminating information with and among investigative participants.

The NTSB currently operates a centralized information dashboard for gathering real time investigative data. The NTSB has a continued need to further utilize a solution that will disseminate accurate and timely information to the intended audience as soon as the information is generated with auditing capabilities, real-time notification via short messaging services (SMS) texting, email and other forms of messaging for both the ROC mission.

NTSB staff regularly deploy to accident sites to conduct our accident investigations. Accidents can occur in a variety of locations across the country and world, and the hazards are often not known until we arrive on scene.

Assessing those hazards, the risks associated, and potential mitigation strategies and PPE requirements are all critical to ensuring the safety of our employees. As part of a process of continuous improvement, this risk assessment has been reviewed and revised to accurately reflect potential hazards while making it simple for investigators to complete while on scene.

2. SCOPE OF WORK

The NTSB’s ROC is seeking a cloud-based web-enabled software as a service (SaaS) solution capable of providing a centralized, secure, and integrated incident management system designed to manage information during the launch of incidents, accidents, and events. The software shall include the ability to process information for mission/tasking, situation reporting, significant events, and incident action planning. The NTSB ROC staff shall be able to use the software to track, view, and print reports with the above information. The contractor shall provide professional services which are specialized in nature and focused on configuration and technical support for the software technology. The software shall provide an emergency notification system to send SMS text, email messages, and voicemail messages to an individual or Outlook Active Directory group simultaneously through multiple types of devices (Android or Apple devices, email, and voicemail). The software shall be able to function for a minimum of 250 users simultaneously.

Section C – Statement of Work, Amendment 0001, Page 2 of 8

The implementation, installation and configuration of the software shall provide:

2.1.1 Ability to process information for mission/tasking, situation reporting, significant events, and incident action planning create and send SMS text, email messages, and voicemail messages to an individual, groups, and external entities.

2.1.2 Deleted.

2.1.3 Ability to get overall notification results and create reports.

2.1.4 Ability to provide status board access/ dashboard with limited read/write only functions to select users.

2.1.5 Ability to allow simultaneous data entry, deletion, and closeouts with the ability to identify who made the entry, deletion and/or closeout, time stamp the action and create a timeline of all actions.

2.1.6 Ability for a select group of users to update all users’ contact data.

2.1.7 Ability for select group of users to create and store prerecorded messages (i.e., accident/incident background information).

2.1.8 Ability to allow limited (read only) to others depending on the nature of the event.

2.1.9 Ability to allow employees to self-register their individual profiles and update contact information.

2.1.10 Ability to access system via any web-based connection (browser or internet connected device) with appropriate user authentication and security controls. The software shall have the capability to independently continue services in the event NTSB’s IT infrastructure is compromised.

2.1.11 Ability to allow the NTSB to provide portal access to outside originations who are not operating the same software/solution.

2.1.12 Ability to map locations and addresses in the system.

2.1.13 Chatroom instant messaging capability Between internal and external entities,

2.1.14 Ability to create and update forms and templates

2.1.15 Ability to create and print after-action reports.

2.1.16 Ability to archive full operational status.

2.1.17 Ability to be compatible with web-based emergency notification system using SMS, landline, cell phones and emails to contact individuals 24-hours 7-days per week.

Section C – Statement of Work, Amendment 0001, Page 3 of 8

2.1.18 Ability to create an internal flag/warning system that is user specific before data is shared or emailed.

2.1.19 Ability to modify time zones for sending /receiving messages.

2.1.20 Ability to send info with a button click from the Journal to the Daily Shift log.

2.1.21 Ability to send caller info from the intake form to a duty officer as an email.

2.1.22 Critical technical support available 365, 24 /7.

2.1.23 Ability to allow NTSB personnel to create and customize modules with ease within the incident management software for data collection and reporting needs for various offices with differing missions and/or contractor development of new modules. For example:

a. Message templates

b. Custom message distribution lists

2.2 Enterprise Risk Management Worksheet

Contractor shall discover, analyze, and recommend an end to end “to be” NTSBs business process for managing the on-scene hazard identification and risk mitigation.

Contractor shall Configure the platform and implement the “to be” business process for the staff to manage all on-scene hazard identification and risk mitigation.

Contractor shall configure and design the executable templates derived from risk assessments (RA) that allows investigators to initiate, retrieve, and manage on-scene risk data and complete the checklist of hazards and assign a level of risk .

Contractor shall configure the platform to integrate with SAFTI Line of Business application to pull the keys (Accident Identifier) in order to create a new RA

Contractor shall configure the platform to link the hazard and its assigned risk level with the appropriate mitigation measure and any associated personal protective equipment (PPE)

Contractor shall configure the platform to allow workflows for review and approval of the RA Assessment

Contractor shall configure the platform to provide RA information to launched staff.

Contractor shall provide the above capability via a mobile application and a web interface.

Contractor shall configure the platform to provide users with a dashboard for overall data review

Section C – Statement of Work, Amendment 0001, Page 4 of 8

Contractor shall discover, analyze, and recommend an end to end “to be” NTSBs business process for managing the on-scene hazard identification and risk mitigation for all Modal Offices.

Contractor shall Configure the platform and implement the “to be” business process for the staff to manage all on-scene hazard identification and risk mitigation for all Modal Offices.

Contractor shall configure and design the executable templates derived from risk assessments (RA) that allows investigators to initiate, retrieve, manage on-scene risk data, complete the checklist of hazards, and assign a level of risk for all Modal Offices.

Contractor shall configure the platform to link the hazard and its assigned risk level with the appropriate mitigation measure and any associated personal protective equipment (PPE) for all Modal Offices.

Contractor shall configure the platform to allow workflows for review and approval of the RA Assessment for all Modal Offices.

The contractor shall configure the platform to provide RA information to launched staff in all Modal Offices.

The contractor shall provide the above capabilities via a mobile application and a web interface for all Modal Offices.

The contractor shall configure the platform to provide users with a dashboard for overall data review of all Modal Offices.

The contractor shall provide all the discovery support, software, labor, and materials to implement its software to be fully functional and to meet the requirements of this SOW, including testing and demonstration, and provide training to up to 25 NTSB users. The contractor shall also provide software maintenance in the form of upgrades and 365-day, 24-hour critical technical support.

2.3 The above system functionality shall have an audit trail (except the instant messaging system).

The audit trail shall include tracking all people (using login and password) who accessed the system/file and the actions performed (print, view, etc.). All audit trail items shall be time stamped with time based on a hardware-based tamperproof trusted time clock provided as part of the system. System shall have variable user rights as assigned by the System Administrator (SA).

2.4 This software/solution shall include an automated system that will allow recipients to receive messages through multiple formats (such as voice messages, text messages, and email). The solution shall be able to notify the user via multiple formats and allow the recipient to send a response back to the initiator, the ROC staff. The solution should support infrastructure of multiple carriers, carrier networks and aggregators, and geo-redundant data centers, ensuring top emergency notification system performance and delivery.

Section C – Statement of Work, Amendment 0001, Page 5 of 8

The ROC and TDA staff should be able to use the software/solution to track, view, and print reports with the above information.

The contractor shall submit to the NTSB a Project Plan describing the specific incident management software solutions that will meet the requirements of the SOW.

3. TECHNICAL REQUIREMENTS

3.1 Software shall be available as true Multi-Tenant Software as a Service (SaaS). The SaaS will host the data and application in the cloud enabling users with internet connected mobile devices like iPad and iPhone to communicate and obtain real-time updates from the incident management solution. The SaaS ability is critical to the NTSB, as it allows for continued workflow and transmittal of vital real-time investigative information.

3.2 Ability to collaborate and share data with outside entities to include other emergency response agencies and/or public health departments in real-time. This feature is only possible if the solution is a true multi-Tenant SaaS in which a single instance of software and its supporting infrastructure serves multiple agencies. This ability will allow the NTSB to communicate and gather vital information from various entities and agencies during launches investigations in a more effective and efficient manner. The unique real time collaboration tool is essential to the future workflow of the NTSB’s ROC. This will allow the NTSB to effectively collaborate with mission essential entities and allow greater information sharing with increased accuracy and reduced redundancy and delays.

3.3 Ability to integrate with Identity Credentials and Access Management such as Okta, SailPoint.

3.4 Software shall have a mobile application that will work on Apple or Android OS.

3.5 Reporting Requirements:

The proposed solution shall have the capability to:

• Add emails and other documents (Word, Excel PDF) to a case file; auto injection is required as well.

• Ability to download all comments from a case in one file to comply with FOIA requests.

• Generate the following reports:

• Cases sorted by NTSB # (like dashboard view)

• Customizable reports using data fields selected by end-user.

4. DELIVERABLES

4.1 A full subscription of incident management software solution.

4.2 A complete Implementation, installation and configuration of all relevant modules of the software.

Section C – Statement of Work, Amendment 0001, Page 6 of 8

4.3 Targeted user training.

4.4 Administrator and customization training to the individuals designated as

Administrators.

4.5 A complete requirements document that shall outline the system configuration.

4.6 Provide Customer Support for software solutions.

4.7 Provide a System Security Plan, identifying a comprehensive list of all the FedRAMP

Customer Responsibility Matrix (if already FedRAMP authorized); and/or the vendor winner vendor acquires FedRAMP authorization.

5. SECURITY REQUIREMENTS

5.1 All cloud services must be FedRAMP authorized and shall meet all Federal FISMA guidelines and NTSB IT policies for the protection of privacy of unclassified data. If FedRAMP is not authorized at time of award, the Contractor shall obtain FedRAMP authorization within 12 months of contract award.

5.2 Relevant policies primarily include, but are not limited to, NIST Special Publications 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations.

6. SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

All electronic and information Technology (EIT) procured through this contract must meet the applicable accessibility standards specified in 36 CFR1194.2, unless an agency exception to this requirement exists. Any agency exception applicable to this order is listed below.

The standards define Electronic and Information Technology, in part, as “any equipment or interconnected system or subsystem of equipment that is used in the creation, conversion, or duplication of data or information.” The standards define the type of technology covered and set forth provisions that establish a minimum level of accessibility. The application section of the standards (1194.2) outlines the scope and coverage of the standards. The standards cover the full range of electronic and information technologies in the Federal sector, including those used for communication, duplication, computing, storage, presentation, control, transport and production. This includes computers, software, networks, peripherals and other types of electronic office equipment.

This requirement is subject to the Information and Communications Technology (ICT) Accessibility Requirements Statement attached and incorporated in the solicitation as Attachment A.

Section C – Statement of Work, Amendment 0001, Page 7 of 8

7. PERIOD OF PERFORMANCE

The anticipated period of performance, subject to change based on date of award, includes one

(1) base year and four (4) one-year option periods, as follows:

Base Year: September 28, 2025 – September 27, 2026 Option Year 1: September 28, 2026 – September 27, 2027 Option Year 2: September 28, 2027 – September 27, 2028 Option Year 3: September 28, 2028 – September 27, 2029 Option Year 4: September 28, 2029 – September 27, 2030

The software solution shall be fully implemented and operational no later than three (3) months after the date of award.

8. LINE OF BUSINESS APPLICATION DEFINITIONS

Investigative line of business application (SAFTI):

The NTSB maintains SAFTI to store, retrieve, and manage information associated with its accident/incident investigations, safety research, and reports. NTSB investigators create a new case record for each investigation or research report in the SAFTI, and then manage that case through various investigative milestones until the release of a final report with analytical findings, probable cause, and/or safety recommendations. NTSB staff relies on data from SAFTI to monitor workflow, conduct safety research, support accident investigations, produce annual statistical reviews, respond to congressional requests, and provide Board member support. These data are also used to fulfill US reporting requirements to the International Civil Aviation Organization (ICAO), Other government agencies, industry organizations, and individuals extensively use the data for safety research.

9. CONTRACT ADMINISTRATION

The Contracting Officer (CO) has the overall responsibility for this contract. The CO alone, without delegation, is authorized to take actions on behalf of the government to modify the agreement terms, conditions, requirements, specifications, and delivery schedules.

The Contracting Officer for this requirement is:

Peter M. Hazlinsky National Transportation Safety Board Acquisition and Lease Management Division, AD-20 490 L’Enfant Plaza East, SW Washington, DC 20594 Phone: (202) 314-6205 Email: matt.hazlinsky@ntsb.gov

The Contracting Officer will appoint a Contracting Officer’s Representative (COR) for the BPA to assist in monitoring the work. The COR is responsible for the technical administration of the

Section C – Statement of Work, Amendment 0001, Page 8 of 8

BPA and technical liaison with the Contractor. The primary duties of the COR are to monitor the Contractor’s performance to ensure that all technical requirements are met by the delivery date or within the period of performance, to inspect and accept services, as well as to review and approve invoices.

The COR is NOT authorized to issue technical instructions that:

• Institute additional work outside the scope of the BPA.

• Cause an increase or decrease in the estimated cost of the BPA.

• Alter the period of performance.

• Change any of the other express terms or conditions of the BPA.

The COR for this requirement is: To be provided after award

10.0 SECURE SOFTWARE DEVELOPMENT ATTESTATION FORM

This requirement incorporates Attachment C – Secure Software Development Attestation Form in the solicitation. In accordance with the Attachment, if any of the following conditions are met, then the Contractor shall complete the form and return it by the quotation due date:

Software requires self-attestation if any of the conditions is met:

1. The software was developed after September 14, 2022;

2. The software was developed prior to September 14, 2022, but was modified by major version changes (e.g., using a semantic versioning schema of Major.Minor.Patch, the software version number goes from 2.5 to 3.0) after September 14, 2022; or

3. The producer delivers continuous changes to the software code (as is the case for software-as-a-service products or other products using continuous delivery/continuous deployment).

11.0 NON-DISCLOSURE AGREEMENT (NDA)

All Contractor personnel performing technical work under this BPA shall execute a NTSB Non- Disclosure Agreement (Attachment D) within fourteen (14) calendar days of BPA award.

Provisions subject to non-disclosure to protect information shall remain in effect two (2) years from termination or expiration of the BPA. Only Contractor personnel from the Contractor company that is awarded the BPA are required to sign the NDA.

[END OF SECTION]