J-2 Revised Contractor Compliance with SOW.xlsx
XLSX spreadsheet 32 KB Posted
- Solicitation number
- 9594CS26Q0016
About this file
This is a Vendor Compliance Matrix for demonstrating contractor adherence to the Statement of Work (SOW) for GPS location tracking services for the Court Services and Offender Supervision Agency (CSOSA). The matrix requires offerors to indicate whether their proposed solutions are Compliant (C), Partially Compliant (PC), or Non-Compliant (NC) for each SOW requirement, along with detailed narrative explanations and supporting documentation.
The SOW requirements span multiple functional areas: one-piece tracking devices incorporating GPS, Wi-Fi sniffing, cellular, and RF technologies capable of monitoring up to 300 active offenders daily; equipment featuring tamper-resistant straps, multiple cellular networks across the United States, and 48-hour battery life with low-battery alerts; communication and data collection at least once per minute with transmission approximately every 10 minutes; a web-based Client Management System (CMS) accessible 24/7/365 with mapping, zone configuration (inclusion/exclusion), alert management, reporting, and crime scene correlation capabilities; mobile applications for both staff and offenders compatible with iOS and Android; a 24/7 monitored secure facility with backup disaster recovery, redundant systems, and 30-minute restoration capability; customer support with 30-minute response times and batch device configuration; inventory maintenance of minimum 100 devices with overnight replenishment; API integration with REST endpoints returning JSON responses within five minutes; expert witness availability; comprehensive training for up to 400 personnel; data ownership retention by CSOSA with 60-day return of records; and compliance with FISMA, NIST SP 800-53 Moderate baseline, and FedRAMP Moderate authorization (Class C) for cloud-based solutions. Offerors must provide product specifications, technical manuals, screenshots, certifications, FedRAMP documentation, and architecture diagrams as evidence of compliance.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 9594CS26Q0016 AMD 0002.pdf | ||
| Response to Questions 9594CS26Q0016.pdf | ||
| Attachment J-7 CSOSA Monitored Events Protocol and Notification Matrix.pdf | ||
| Revised(2) Attachment J-5 Past Performance Questionnaire.docx | DOCX document | |
| Attachment J-1 Revised SOW.pdf | ||
| 9594CS26Q0016 AMD 0001.pdf | ||
| Revised Attachment J-5 Past Performance Questionnaire.docx | DOCX document | |
| Attachment J-2 Contractor Compliance with SOW.docx | DOCX document | |
| Attachment J-4 Cover Letter.docx | DOCX document | |
| Attachment J-5 Past Performance Questionnaire.docx | DOCX document | |
| Attachment J-6 Solicitation Price Sheet.docx | DOCX document | |
| Attachment J-1 SOW.pdf | ||
| Solicitation 9594CS26Q0016.pdf | ||
| Attachment J-3 FAR 52.212-3 Offeror Reps & Certs.docx | DOCX document |
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Compliance Matrix SOW Reference Requirement Vendor Response (C/PC/NC) Notes / Narrative / Supporting Documentation (Explain how equipment or service complies, partially complies, or does not comply with requirement. Provide documentation (if applicable) as verification of explanation.)
| Scope of Services | ||
| C.3.1 | One-piece location tracking devices, which incorporate multiple technologies such as GPS, Wi-Fi sniffing, cellular, and radio frequency (RF) technology. | Quoter is required to submit product detail and specifications information for the one-piece tracking device(s) recommended. |
| C.3.2 | Provide all equipment, maintenance, upgrades, software maintenance/updates, and user training to ensure use of current generation technology throughout the purchase order. | |
| C.3.3 | Invoice only for active units; do not invoice for shelf units or deactivated units; CSOSA not responsible for damaged, lost, stolen, or unrecoverable units. | |
| C.3.4 | Replace units due to failures or deficiencies that prevent monitoring of offender movements and locations. | |
| C.3.5 | Support a maximum average of 300 tracking devices/offenders actively monitored per day, with daily fluctuations. | |
| Equipment Requirements | ||
| C.4.1 | Provide multiple location technologies including GPS, cellular/mobile telephone networks, Wi-Fi sniffing, or RF beacons. | |
| C.4.2 | Utilize multiple cellular networks, towers, and roaming partners to ensure communications throughout the United States. | |
| C.4.3 | Pair with accessory RF beacon as needed at the COR's discretion to confirm offender presence at a designated location. | |
| C.4.4 | Allow deactivated devices to be reactivated online via the CMS by CSOSA personnel if recharged. | |
| Reliability and Tamper Detection | ||
| C.5.1.1 | Provide tamper-resistant straps that vary in size, adjust to fit, and do not pose a safety hazard or unduly restrict offender activities. | |
| C.5.1.2 | Render clips, snaps, pins, and connectors unusable if the device/strap is removed. | |
| C.5.1.3 | Issue tamper alerts differentiated by type, including strap tampering, communication interference, shielding, and jamming. | |
| C.5.1.4 | Function reliably under normal atmospheric and environmental conditions. | |
| C.5.1.5 | Provide map representations of GPS latitude/longitude data within a tolerance of 16 feet (4.9 meters). | |
| Battery Requirements | ||
| C.6.1 | Provide battery charge life of at least 48 hours in optimal conditions. | |
| C.6.2 | Provide low battery warning, such as vibration or audible notification, repeated at fixed intervals until charged or battery expires. | |
| C.6.3 | Confirm when a device is no longer communicating location data because the offender failed to charge after low-battery alerts. | |
| Communication & Data | ||
| C.7.1 | Provide one or more methods of instant communication with offender, such as audible alerts, voice communication, or vibration. | |
| C.7.2 | Allow CSOSA staff to initiate instant communication with the unit and change alert settings. | |
| C.7.3 | Provide FCC-certified devices. | |
| C.7.4 | Record cell tower information or Wi-Fi location in absence of GPS signal. | |
| C.7.5 | Distinguish tracking type for each location point, such as GPS, Wi-Fi, or cellular, and make data available to end users. | |
| C.7.6 | Collect GPS track points at least once per minute and transmit GPS track points to CMS at least approximately every 10 minutes under normal conditions. | |
| C.7.7 | When device exits sleep/rest mode, make location coordinates available from the moment movement resumes. | |
| C.7.8 | Provide pursuit mode manually toggled by CSOSA staff to increase or decrease GPS track point collection/transmission interval. | |
| C.7.9 | Identify immediately breaches of exclusion and inclusion zones. | |
| C.7.9.1 | Define and support zones as geographically defined areas used to monitor offender movement and compliance with supervision conditions. | |
| C.7.9.1(a) | Support inclusion zones where an offender is required or authorized to be present during specified dates/times, such as residence, employment, education, treatment, religious, community service, or other CSOSA-approved locations. | |
| C.7.9.1(b) | Support exclusion zones where an offender is prohibited from entering during specified dates/times, such as victim locations, schools, parks, daycare facilities, residences, employment, treatment providers, restricted businesses, or other CSOSA-designated locations. | |
| C.7.9.1(c) | Support locations-of-interest identified by CSOSA for monitoring, investigative, analytical, crime-scene correlation, or operational purposes. | |
| C.7.9.1(d) | Allow zones to be configured by address, map location, geographic coordinates, radius, polygon, or other mapping functionality within the CMS. | |
| C.7.9.1(e) | Allow CSOSA to create, modify, activate, deactivate, and assign zones based on offender supervision requirements and operational needs. | |
| C.7.10 | Store data if unit loses network communication without loss of un-transmitted data if battery depleted or network unavailable. | |
| C.7.11 | Transmit all stored data upon reconnecting to the network. | |
| C.7.12 | Store a minimum of 90 inclusion/exclusion zones and schedules in onboard memory. | |
| C.7.13 | Encrypt all data transmitted to and from the device to prevent interference and duplication. | |
| Client Management System (CMS) | ||
| C.8.1.1 | Provide web-based CMS accessible 24/7/365. | |
| C.8.1.3 | Enable users to view location data on a map to identify GPS coordinates or other location tracking. | |
| C.8.1.4 | Provide mapping software with zoom, panning, and approximate street address identification. | |
| C.8.1.5 | Provide mapping with standard, satellite, and street view capabilities in Washington, DC Metropolitan Area. | |
| C.8.1.6 | Allow users to configure alerts for when an offender enters an exclusion zone. | |
| C.8.1.6.1 | Allow authorized users to configure exclusion zone parameters, including geographic boundaries, schedules, alert thresholds, notification methods, and notification recipients. | |
| C.8.1.7 | Allow supervision officer to toggle exclusion zone entry alert as audible or nonaudible for offender and supervision officer. | |
| C.8.1.8 | Notify CSO as event occurs and note actual time offender enters/exits a geographic exclusion area or triggers an alert. | |
| C.8.1.10 | Provide access by division, branch, or team and access to inactive/archived offender information. | |
| C.8.1.11 | Allow CSOSA to create custom notification profiles by CSO and by offender for violation events. | |
| C.8.1.12 | Allow authorized CSOSA users to configure and modify offender-specific monitoring parameters, including zones, schedules, alerts, notification profiles, and supervision conditions prior to enrollment or dynamically during active monitoring. | |
| C.8.1.13 | Include CSO contacts, simultaneous multiple-party notifications, and contact methods in notification profiles. | |
| C.8.1.14 | Provide real-time remote web access to view, print, download, and enter/modify offender monitoring information. | |
| C.8.1.14(a-h) | Provide access to offender tracking/location, device events/alerts, battery life, schedules, grouped offender views, enrollment, data analytics, and reports. | |
| C.8.1.15 | Allow users to run reports by officer caseload, organizational unit, and access level. | |
| C.8.1.16 | Store unlimited predefined zones that can be applied to all offenders and do not generate immediate alerts to CSOSA. | |
| C.8.1.17 | Allow users to activate zones in batch and individually. | |
| C.8.1.18(a) | Provide statistical tools to help CSOs identify and prioritize highest risk offenders. | |
| C.8.1.18(b) | Provide dashboards/reports with insights into travel patterns, alert numbers, proximity to risk locations, frequency/duration at known/unknown locations, last known locations, and normal pattern-of-life activity. | |
| C.8.1.14 Reports | Provide standard reports allowing interpretation of technical information and generation/export in PDF, Microsoft Excel, and other common data formats. | |
| C.8.1.15 Reports | Provide daily violation reports of all violation notifications from the previous 24 hours. | |
| C.8.1.16 Reports | Develop and generate new reports as requested by CSOSA in a COR-approved format. | |
| C.8.1.17 Reports | Complete requests for customized/new reports within seven calendar days of COR request unless otherwise agreed. | |
| C.8.1.18 Reports | Provide strap false tamper statistics. | |
| C.8.1.19 | Provide monthly lost equipment report to COR no later than the 10th day of the month for previous month. | |
| C.8.1.20 | Provide crime scene correlation capability for tracking locations for offenders in relation to a crime or location-of-interest within a specified timeframe. | |
| C.8.1.21 | Allow users to draw on map or identify by address a location-of-interest and specified timeframe to determine and trace offender presence/movement. | |
| C.8.1.22 | Allow live point tracking where users draw/identify a location-of-interest and see tracked offenders present and their movements. | |
| Mobile Applications | ||
| C.8.2.1 | Provide mobile software application for users with authorized login to access/manage CMS features and data. | |
| C.8.2.2 | Provide offender mobile application for remote check-in, identity verification, violation alerts, messaging, or other communication. | |
| C.8.2.3 | May provide non-location-based communication or supervision features for low-risk offenders. | |
| C.8.2.4 | Offender mobile application may be integrated with or issued independently of offender-worn tracking device. | |
| C.8.2.5 | Mobile software applications must function with iOS and Android operating systems. | |
| Monitoring Center | ||
| C.8.3.2 | Operate appropriately staffed monitoring center 24/7 including holidays, covering systems, hardware/software, communications, and building support services. | |
| C.8.3.3 | Provide in-house secure confidential monitoring center and help-desk facility with UPS, firewall protections, and backup disaster recovery plan. | |
| C.8.3.4 | Provide backup disaster recovery plan to COR at post-award meeting and when updated, at least annually within 30 days of each option period start. | |
| C.8.3.6 | Provide live agent monitoring services executing notification steps for specified events/violations in accordance with Monitored Events Protocol. | |
| C.8.3.7 | Support CSOSA's right to modify Monitored Events Protocol procedures after commencement with written COR notice. | |
| C.8.3.8 | Record all phone calls or messages transmitted by live monitoring center staff. | |
| C.8.3.9 | Provide audio files of recorded communication to COR upon request. | |
| C.8.3.10 | Generate event report documenting each step taken for each location tracking event. | |
| C.8.3.11 | Store monitoring center event reports in CMS and make retrievable to end users. | |
| C.8.3.12 | Secure monitoring center facility, equipment, data transmissions, and data storage. | |
| C.8.3.13 | Ensure Contractor facility is alarmed and monitored by local law enforcement or security company. | |
| C.8.3.14 | Use tamperproof dedicated alarm line not exposed to alteration or damage. | |
| C.8.3.15 | Equip monitoring center with automated fire detection and suppression equipment. | |
| C.8.3.16 | Provide backup power supply for continuous operations during utility power failures. | |
| C.8.3.17 | Provide duplicate computers enabling restoration of data collection and monitoring services within 30 minutes after computer failure. | |
| C.8.3.18 | Provide duplicate data storage devices and automatic re-establishment of duplicate databases upon replacement of failed storage device. | |
| C.8.3.19(a) | Provide computer hardware necessary for 24/7 continuous tracking and monitoring of offenders. | |
| C.8.3.19(b) | Provide secure transmission/storage of crime scene correlation data and local law enforcement crime/incident reports. | |
| C.8.3.19(c) | Ensure computer system is ventilated and equipped with hot redundancy system with at least dual controllers. | |
| C.8.3.19(d) | Ensure all data, transmissions, and storage are kept confidential. | |
| C.8.3.19(e) | Provide security policies/procedures for network, application, transmission, storage, and physical security within three days of award. | |
| C.8.3.20 | Provide multilingual services, at minimum Spanish, and other languages as requested by COR. | |
| Customer Support | ||
| C.8.4.1 | Provide staffed communication system with toll-free phone and email access 24/7. | |
| C.8.4.2 | Configure devices individually or in batch with supervision conditions, including modified/deleted conditions, within 30 minutes of COR/authorized request. | |
| C.8.4.3 | Immediately activate or deactivate a device on request from COR or authorized designee. | |
| C.8.4.4 | Provide immediate notification by telephone, text, and email during business/non-business hours to designee or COR when violation event occurs. | |
| C.8.4.5 | Receive verifiable confirmation via telephone call from monitoring center to designated contacts confirming immediate violation notifications were received. | |
| C.8.4.6 | Maintain call trees used to contact designated personnel to report alerts. | |
| C.8.4.7 | Respond to requests via email or telephone from COR/authorized designee within 30 minutes. | |
| C.8.4.8 | Notify COR within 30 minutes by telephone and email when any services have been or will be interrupted for any length of time/reason. | |
| Inventory Management | ||
| C.8.5.1 | Maintain minimum shelf inventory of 100 devices available for immediate activation; replenish as necessary to restore minimum inventory by overnight delivery at no additional cost. | |
| C.8.5.2 | Provide CSOSA with most recent version of GPS tracking devices available at fixed unit price. | |
| C.8.5.3 | Allow COR sole discretion to determine consumables and total units activated during task order. | |
| C.8.5.4 | Supply sufficient nondurable items, including spare straps, chargers, and parts for timely installation and servicing. | |
| C.8.5.5 | Handle return shipping of excess/non-operational equipment per Contractor-required method; Contractor responsible for shipping expenses. | |
| C.8.5.6 | Maintain equipment/spares in good operating condition and arrange prompt repair/replacement; bench test and certify as new; Contractor bears costs. | |
| C.8.5.7 | Provide installation kits with all necessary equipment/instructions to install, activate, deactivate, remove, and clean device. | |
| API Integration | ||
| C.8.6 | Provide REST API enabling CSOSA to fetch records from Contractor CMS on demand over secured HTTPS connection. | |
| C.8.6 | Make insert/update/delete changes performed against CMS accessible within five minutes. | |
| C.8.6 | Make API accessible to authorized CSOSA staff within 30 days of award. | |
| C.8.6 | Accept JSON blocks as requests. | |
| C.8.6 | Return JSON blocks as responses. | |
| C.8.6 | Provide API endpoints for system user, offender, device, device status, activation periods, alerts, user notes/status, tracking records, invoice data, and bi-directional data exchange. | |
| Expert Testimony | ||
| C.8.7.1 | Be competent to attest to methodology/performance in legal proceedings if called or subpoenaed on behalf of CSOSA. | |
| C.8.7.2 | Provide SME to support location monitoring tracking and related data if required for testimony. | |
| C.8.7.3 | Ensure SME has industry experience, related degree, and prior expert testimony experience; provide verification if requested. | |
| C.8.7.4 | Make SME available on 48 hours' notice and provide certified documentation requested/needed for testimony. | |
| C.8.7.6 | Notify COR immediately upon receipt of legal process requiring disclosure of offender records. | |
| Training | ||
| C.8.8.2 | Training must include verbal, written, and hands-on instructions/demonstrations for software and hardware/equipment. | |
| C.8.8.3(a) | Provide training to all CMS/remote application users up to 400 personnel, in-person or live web-based, allowing at least 100 participants at a time and Q&A/co-facilitation. | |
| C.8.8.3(b-c) | Make self-paced web-based training modules available on CMS and related remote applications. | |
| C.8.8.3(d) | Provide additional in-person or web-based training on software/hardware changes as necessary. | |
| C.8.8.3(e) | Coordinate all training with and obtain approval from COR. | |
| C.8.8.5 | Train CSOSA personnel to provide the information provided by the Contractor in Section C.8.8. | |
| Data Owernship & Transition | ||
| C.8.9.1 | Maintain all offender records for task order life and subject records to inspection/examination by authorized CSOSA personnel. | |
| C.8.9.2 | Return all offender records and backup copies to CSOSA in usable format within 60 days after expiration. | |
| CSOSA Contractor Information Security Requirements | ||
| C.13.1 | Complies with FISMA, OMB A-130, DHS directives, NIST FIPS/SPs | |
| C.13.2.b | Implements NIST SP 800-53 Moderate baseline (CSOSA-selected controls) | |
| C.13.3.a | Prepares Security Authorization Package per SP 800-37 (FedRAMP templates where available) | |
| C.13.3.b | Continuous Monitoring meets/exceeds SP 800-37 App G | |
| C.13.4.a | Supports CSOSA penetration testing & assessments | |
| C.13.4.b | Tracks gaps in POA&M | |
| C.13.4.c | Mitigation timelines: High (≤30 days); Moderate (≤90 days) | |
| C.13.4.d | Provides access; personnel available; documentation on request | |
| C.13.4.e(1) | No disclosure of safeguards without CO consent | |
| C.13.4.e(2) | Affords access within 72 hours for scans/audits | |
| C.13.4.e(2)(i–iv) | OS/network/web/db scans (auth/unauth); gov tools accepted | |
| C.13.4.f | If the contractor runs scans, provide full results; tools approved. | |
| C.13.4.g | Acknowledges cancellation for convenience if authorization is revoked beyond risk tolerance | |
| C.13.4.h | Complies with CSOSA security/privacy; provides access & docs | |
| C.13.4.i | Properly protects all information used/collected. | |
| C.13.4.j | Treats all information as CUI; off-site protection equivalent | |
| C.13.4.k | CSOSA retains data ownership; full copies on request | |
| C.13.4.l | Physical security of facilities; data available within 1 business day | |
| C.13.4.m | No data release without written CO consent | |
| C.13.4.n | Full access & cooperation for incident response; artifacts provided | |
| C.13.4.o | Contractor bears all incident response costs. | |
| C.13.5 | FedRAMP Moderate Authorized (Class C) as required by Attachment J-1, section 13.5 | |
| C.13.5 | Provide the exact Cloud Service Provider (CSP) name and Package ID associated with the authorized solution. | |
| C.13.5 | Provide a direct hyperlink to the proposed cloud service offering (CSO) active listing on the official FedRAMP Marketplace (marketplace.fedramp.gov). | |
| C.13.5 | Identify the Agency Authorization to Operate (ATO) utilizing the FedRAMP Moderate (Class C) proposed cloud service provider. | |
| C.13.5 | Identify the portion of the proposed solution operating within the authorized environment. If the proposed solution does not utilize cloud hosting services for the storage, processing, transmission, or access of CSOSA data, the Offeror shall explain why FedRAMP authorization is not applicable. |
&"Carlito,Bold"&10Attachment J-2: Contractor Compliance with SOW
Instructions
| CSOSA GPS Monitoring Services – Vendor Compliance Matrix Instructions | |
| Instructions to Offerors | Complete the Vendor Compliance Matrix for all applicable SOW requirements. For each requirement, indicate Compliant (C), Partially Compliant (PC), or Non-Compliant (NC). |
Provide a narrative explanation. Attach product specifications, technical manuals, screenshots, certifications, FedRAMP documentation, architecture diagrams, or other evidence demonstrating the proposed solution meets or exceeds the requirement. Unsupported assertions of compliance may be evaluated unfavorably.
| C | Compliant: The proposed solution fully meets the requirement. |
| PC | Partially Compliant: The proposed solution meets part of the requirement or requires clarification/explanation. |
| NC | Non-Compliant: The proposed solution does not meet the requirement. |
| Required Evidence | Where a simple response is not sufficient, include narrative and attach supporting documentation verifying compliance. |
File details come from the government source that posted it. Updated .