Amd 0001 Revised Attachment J-1 SOW.pdf

Solicitation 9594CS26Q0025 – Amendment 0001 Personal Property Management System

Revised Attachment J-1: Statement of Work

C.1 Background.

C.1.1 The Court Services and Offender Supervision Agency for the District of Columbia (CSOSA) is an independent agency in the executive branch of the federal government with approximately 1,000 employees. CSOSA is responsible for supervising adult offenders who are on probation, parole, or supervised release in the District of Columbia. The Agency’s mission is to promote public safety, reduce recidivism, support crime prevention, and ensure fair administration of justice.

C.1.2 This Statement of Work is for the purchase of a commercially available Personal Property Management System delivered as a Web-based Software as a Service (SaaS) solution that is deployed in a FedRAMP Moderate Authorized cloud environment.

C.1.3 There are two separate organizations (CSOSA and Pre-Trial Services Agency (PSA)) which manage property in this system with a total of 6 administrators and 27 property custodians (end-users).

C.2 System Requirements. The Personal Property Management System shall:

C.2.1 Be a commercially available Web-based SaaS platform solution compatible with the current versions of Microsoft Edge and Google Chrome.

C.2.2 Be deployed in a FedRAMP Moderate Authorized cloud environment and compliant with applicable federal security and privacy regulations. All cloud infrastructure, data storage, data processing, and system management/support must physically reside and be performed within the United States legal jurisdiction, and all administrative access must be restricted to U.S. persons.

C.2.3 Support management of approximately 8,000–8,500 active assets, with the ability to collect, store, update, reconcile, and report on asset and location data.

C.2.3 System Capacity, Data Volume, and Scalability.

C.2.3.1 Support the operational management of an estimated 8,000 to 8,500 active assets, with the capability to accommodate fluid growth up to 10,000 active assets as new items are purchased, providing full functionality to collect, store, update, reconcile, and report on active asset and location data.

C.2.3.2 Accommodate a total database volume of approximately 70,000 records, encompassing both active assets and historical/inactive asset records. The solution must ensure that historical records are retained, searchable, and accessible for auditing and reporting purposes without degrading system performance.

C.2.4 Has the capability to:

C.2.4.1 Scan asset tag barcodes with either an RFID and traditional barcode scanning technologies using either barcode-based technology, Radio Frequency Identification (RFID) technology, or a combination of both;

C.2.4.2 Scan and directly upload from CSOSA supported mobile Apple iOS devices (e.g., tablets, smartphones) as well as CSOSA’s 6 dedicated handheld Motorola, MC 3000 scanners (e.g., Zebra MC3000 or equivalent mobile operating systems);

C.2.4.3 Retire, transfer, or reassign assets without permanent deletion, preserving complete historical audit trails;

C.2.4.4 Perform persistence offline scanning capability with subsequent synchronization controls and automated conflict/audit logs; and

9594CS26Q0025

Personal Property Asset Management System

C.2.4.5 Perform persistence offline scanning capability with subsequent synchronization controls and automated conflict/audit log.

C.2.5 Has configurable workflows supporting the end-to-end asset lifecycle management, including approvals and custody changes.

C.2.6 Provide support for templated, standardized, and customizable reporting aligned with Government Accountability Office (GAO) internal control and audit requirements.

C.2.7 Has multi-factor authentication.

C.2.8 Automated Data Exchange. The system shall provide the technical capability to execute automatic, periodic batch updates of financial data (including asset capitalization, depreciation, and reporting) to Oracle Financials via REST API without requiring manual intervention.

C.3 Reporting Requirements. The Personal Property Management System shall include the following reporting capabilities:

C.3.1 Asset Inventory Reports (categorized by types, ownership, locations, and custodianship);

C.3.2 Asset Lifecycle, Status, and Risk Reports (including warranty, repair, missing, retired, disposed, and risk indicators);

C.3.3 Inventory Reconciliation and Audit Reports (identifying variances between physical counts and system records, discrepancies, and adjustments);

C.3.4 Location and Space Reports (down to the building, datacenter, room, and workstation level);

C.3.5 Barcode/Scanner Upload and Transaction Logs (with strict user and timestamp traceability);

C.3.6 End-of-Life (EOL) and Replacement Planning Reports;

C.3.7 Periodic Inventory and Certification Reports;

C.3.8 Chain-of-Custody and Accountability Reports;

C.3.9 Audit Trail and Change History Reports; and

C.3.10 Custom/Ad Hoc Reporting Features.

C.4 Required Input Fields. The Personal Property Management System shall support, store, and track the following data fields:

C.4.1 Acquisition date;

C.4.2 Asset Name;

C.4.3 Asset Type (e.g., laptop, phone, equipment; specialized asset tracking);

C.4.4 Asset Tag/ID (e.g., unique barcode or RFID number); Unique asset identification and tracking using either barcode-based technology, Radio Frequency Identification (RFID) technology, or a combination of both.

C.4.5 Model Number;

C.4.6 Manufacturer;

C.4.7 Serial number;

C.4.8 Description;

C.4.9 Hardware specifications (e.g., CPU, storage, etc., when applicable);

C.4.10 Operating System and Version (when applicable);

C.4.11 Date Received / Date Placed in Service;

C.4.12 Supported business function / program alignment;

C.4.13 Physical location (building, floor, room, and workspace type (e.g., office, shared space, storage, field use);

C.4.14 Asset Owner / Custodian;

C.4.15 Asset Status (e.g., active, in-use, in storage, decommissioned, retired, disposed);

C.4.16 End-of-Life (EOL) / End-of-Support (EOS);

C.4.17 Disposal Date and Method;

C.4.18 Replacement Schedule; and C.4.19 Funding Source / Cost Center (for financial and audit traceability).

C.5 System Configuration and Setup. The Contractor shall:

C.5.1 Configure the SaaS environment and user access in accordance with CSOSA requirements.

C.5.2 Ensure seamless compatibility with CSOSA IT infrastructure, including specified browsers and mobile devices.

C.5.3 Configure role-based access controls for up to a total of 33 users, strict segregation of duties, Multifactor Authentication (MFA) (PIV card via SAML), comprehensive logging, and audit mechanisms aligned with GAO internal control principles.

C.6 Software Licensing, Hosting, and Maintenance.

C.6.1 The Contractor shall provide, maintain, and support all necessary software licenses, cloud hosting, user credentials, and technical maintenance for the fully operational Personal Property Management SaaS solution.

C.6.2 The Contractor's licensing framework shall support up to 33 total system users (with a minimum baseline of 6 concurrent users) and accommodate an active asset portfolio ranging from 8,000 to 8,500 active items (with scalability up to 10,000 active assets). Furthermore, the licensing and storage architecture must fully support the total database volume of approximately 70,000 historical and active records without additional per-record penalties or licensing fees.

C.7 Training.

C.7.1 The Contractor shall conduct the following live, virtual training sessions via Microsoft Teams.

conduct live training sessions for system users and administrators. Administrator training shall be conducted on-site (at CSOSA’s facility located at 800 North Capitol Street, NW, Washington, DC, 20002- 4260), while Property Custodian training may be conducted virtually via Microsoft Teams. All training sessions, material reviews, and final delivery must occur entirely within the base period of performance.

Class Type Delivery Method Sessions Maximum per Session

Total Users

Administrator Training On-site 3 6 6 Property Custodians Virtual (MS Teams) 5 15 27

Note: The above table identifies the total users by role and the maximum capacity allowed per individual session. Attendance at any single session shall not exceed the stated "Maximum per Session" limit. The Contractor is required to provide all scheduled training sessions, even if all total users have been trained prior to all sessions being completed.

C.7.2 The Contractor shall digitally record all each training sessions and provide the video files to the Contracting Officer’s Representative (COR) as part of the training materials specified in C.7.3.3 below.as required by section C.7.3.4 below.

C.7.3 At a minimum, training shall consist of the following:

C.7.3.1 Role-based training tailored for end-users (property custodians) and system administrators covering everyday operational workflows;

C.7.3.2 Advanced training on system administration, user provisioning, role configuration, custom workflow creation, and reporting functions including GAO compliance reporting; and

C.7.3.3 Training materials/deliverables to include comprehensive Section 508-compliant training materials shall be provided to the COR five business days prior to the first training session. Training materials include electronic user guides and quick reference sheets (provided in an accessible format (e.g., PDF).

C.7.3.4 Within three business days following the final live each training session, the Contractor shall deliver the finalized digital video recordings of all hosted each sessions to the COR for future agency onboarding use.

C.7.4 On-site Training Logistics. To ensure the successful execution of on-site Administrator training at CSOSA’s facility located at 800 North Capitol Street, NW, Washington, DC, 20002-4260), the Contractor shall coordinate and adhere to the following logistical requirements:

C.7.4.1 If requested by the COR, the Contractor shall submit any required personnel information (full legal names, dates of birth, and social security numbers) at least 10 business days prior to the scheduled on-site date to facilitate facility access, visitor badges, and required security clearances. Contractor personnel shall comply with all local security, badging, and escort protocols enforced at the government facility.

C.7.4.2 CSOSA will provide a suitable training room equipped with standard presentation infrastructure (e.g., projector, projection screen, and power sources, and Wi-Fi access). CSOSA will also provide all necessary training laptops, mobile devices, or media hardware for the attendees/

C.7.4.3 On-site training sessions shall be conducted during normal CSOSA working hours (Monday through Friday, 08:00 to 16:30 local time, excluding federal holidays). The Contractor shall be permitted access to the designated training room at least one (1) hour prior to the start of each session for equipment setup, technology testing, and material distribution.

C.7.4.4 Parking is available for Contractor personnel at private or city-operated parking facilities located near training site. All parking fees, tolls, or related expenses incurred by Contractor personnel shall be at the sole expense of the Contractor and will not be reimbursed by the Government.

C.7.4 Payment under CLINs 0002, 0004 and 0005 "delivery of training" shall be deemed complete only is authorized when:

• All eight (8) live virtual sessions specified in C.7.1 have been fully executed;

• A single training session (either Administrator training or user training) is completed;

• The COR has provided written technical acceptance of the 508-compliant materials specified in C.7.3.3 for the completed training session; and

• The COR has received and verified the digital video recordings specified in C.7.2 and

C.7.3.4 for the completed training session.

C.8 System Maintenance and Updates. The Contractor shall perform ongoing system maintenance and updates, including:

C.8.1 Application patches, upgrades, and enhancements;

C.8.2 Bug fixes and issue resolution;

C.8.3 Security updates;

C.8.4 Maintenance scheduling aligned with Agency-approved windows; and C.8.5 Notification to the Agency at least 5 business days before any planned maintenance.

C.9 Customer Support and Troubleshooting. The Contractor shall provide customer support services, including:

C.9.1 Technical Helpdesk Support via a website, ticketing system, and phone:

• Minimum availability: Monday–Friday, 8:00 AM–6:00 PM Eastern Time

• Emergency support for critical outages: 24/7

C.9.2 Adherence to the Contractor’s established Service Level Agreement (SLA) for response and resolution times.

C.10 Data Migration Requirements.

C.10.1 CSOSA’s existing system has 8,000–8,500 active assets, a total database volume of approximately 70,000 records, encompassing both active assets and historical/inactive asset records, currently stored in CSOSA’s legacy system, BarScan. Prior to the start of the migration effort, CSOSA will provide the Contractor BarScan database schema, data dictionary, and sample export files.

C.10.2 The Contractor shall:

C.10.2.1 Provide full data migration services from the legacy system to the new platform solution.

C.10.2.1.1 The current CSOSA system includes approximately 70,000 records (active and historical). A complete historical audit trail of all previous changes made in BarScan must be imported/migrated to the new system.

C.10.2.1.2 CSOSA will be responsible for data cleansing. The Contractor shall be responsible for data mapping, validation, and loading. CSOSA will provide the following migration data prior to the start of the migration effort:

• Historical asset data will be provided to the Contractor in CSV format;

• BarScan database schema;

• Data dictionary; and

• Sample export files.

C.10.2.2 Develop a migration risk and mitigation plan.

C.10.2.3 Prepare and execute migration scripts.

C.10.2.4 Conduct data validation and reconciliation; and

C.10.2.5 Provide knowledge transfer on migration processes and audit considerations.

C.10.3 Post-Migration Support. The Contractor shall provide post-migration support to resolve discrepancies and errors for 30 days from date migration is complete and approved by the COR.

C.10.4 Within five business days following the completion of the final production migration, and prior to COR acceptance, the Contractor shall deliver a comprehensive Migration Report to the COR. At a minimum, this report shall include:

C.10.4.1 The exact count of asset records extracted from the legacy system versus the total successfully loaded into the production environment;

C.10.4.2 A detailed breakdown of any records excluded from the migration, including the specific asset IDs and the technical or structural justification for their exclusion (e.g., formatting errors, missing mandatory fields);

C.10.4.3 A statistical summary of the migration execution, detailing overall success percentages and categorized error types; and

C.10.4.4 Proof of data integrity confirming that financial markers, baseline asset specifications, and historical audit trails map accurately from the legacy format to the new tenant environment without unintended alteration. Acceptable proofs include source-to-target row count matrices, aggregate financial sum reconciliations, cryptographic checksum validation logs, and a documented random-sample spot-check audit.

C.10.5 Once appropriate clearances are obtained, CSOSA will provide data field mapping documents and legacy system technical specifications.

C.11 Integration Support. Upon completion of the migration effort identified in section C.10 above, the Contractor shall support interface development, configuration, and testing with CSOSA’s financial system (Oracle Financials) for asset capitalization, depreciation, and reporting. Integration to be performed exclusively via a REST API and must support automatic periodic batch updates from the solution to Oracle Financials to ensure seamless data synchronization and financial accuracy. Information necessary for the Contractor to perform this interface (e.g., version of Oracle Financials, etc.) will be provided at the completion of the migration effort identified in section C.10 above.

C.12 Federal Security, Privacy, and Cloud Compliance.

C.12.1 The Contractor shall ensure compliance with all applicable federal requirements to include FISMA and Privacy as outlined in NIST SP 80-53.

C.12.2 CSOSA will be responsible for obtaining Authority to Operate (ATO). The Contractor shall provide support for any documentation required to gain approval of Authority to Operate (ATO) i.e. ATO, e.g., supporting the for preparation of Privacy Impact Assessments (PIA) and System of Records Notices (SORN), if required.

C.12.3 The Contractor shall support log management, audit logging, remediation, and compliance scanning and provide any required security, performance, and audit reports.

C.12.4 Computer Security Incident and Privacy Breach Notification. In the event of any actual or suspected computer security incident or breach of PII, PHI, or Sensitive Information Marked as CUI as defined by Executive Order 13556 (or similar markings – FOUO, SSI, SBU, or any other forms of Non- Public Information), the Contractor will notify within one hour, the CSOSA CIO, Chief Privacy Officer, CISO, and the COR or Contracting Officer.

C.13 Section 508 Accessibility Compliance

C.13.1 All Information and Communication Technology (ICT) delivered, developed, maintained, or supported under this purchase order must meet the electronic and information technology accessibility standards set forth in 36 CFR Part 1194, pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d). The SaaS platform solution, mobile interfaces, and digital outputs shall conform to the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA (or the current federally adopted version, WCAG 2.1 Level AA) Success Criteria.

C.13.2 The Contractor shall: ensure the web-based platform solution, mobile device interfaces, and all associated applications are fully operable and accessible to users with disabilities, including those using assistive technologies (e.g., screen readers, keyboard-only navigation, and voice recognition software).

C.13.3 The Contractor shall provide a current and complete Accessibility Conformance Report (ACR), based on the Voluntary Product Accessibility Template (VPAT), documenting compliance with Section 508 requirements. The ACR shall be provided:

C.13.3.1 Within ten business days following final system configuration/setup and prior to formal Agency data migration, reflecting the specific tenant environment provided to the Agency;

C.13.3.2 Within 15 business days of any major platform solution upgrade, enhancement, or architectural change that impacts the user interface or system functionality; and

C.13.3.3 Re-submitted annually within 10 business days of exercise of any option period.

C.13.4 The Contractor shall ensure all user-facing content, forms, workflows, and reports meet accessibility standards for readability, contrast, navigation, and interaction.

C.13.5 The Contractor shall provide all electronic deliverables, including documentation and training materials in accessible formats (e.g., tagged, Section 508-compliant PDFs or captioned media).

C.13.6 The Contractor shall remediate any identified accessibility deficiencies within agreed-upon timeframes at no additional cost to the Agency.

C.13.7 The solution must maintain accessibility compliance throughout the lifecycle of the contract, including all updates, patches, enhancements, and newly introduced features.

C.14 Project Plan Requirement.

C14.1 The Contractor shall develop and maintain a comprehensive a Project Management Plan (PMP) that serves as the master guide for the system implementation.

C.14.2 At a minimum, the PMP shall include:

C.14.2.1 A detailed timeline (e.g., Gantt chart) mapping out tasks, dependencies, and key milestones from completion of Post-Award Meeting through final system acceptance.

C.14.2.2 Clear delineation of tasks assigned to Contractor personnel and required actions/inputs from

CSOSA.

C.14.2.3 A list of potential technical, schedule, or data security risks, along with corresponding mitigation strategies.

C.14.2.4 Specific actions addressing the execution of:

• Configuration, including environment setup, user role definitions, and MFA integration.

• Data migration, including data mapping, validation testing, and legacy data migration execution.

• Security and compliance, including privacy controls and required security documentation.

• Training, including schedule and coordination for the live virtual sessions outlined in

Section C.10.

• Deployment, including the transition strategy from the legacy tracker to the fully live

SaaS platform solution.

C.14.3 The Contractor shall deliver a draft PMP to the COR within 15 days of the post-award meeting.

The Government will provide comments within five business days of receipt of the draft PMP. The Contractor shall deliver the final PMP within five business days of receiving Government comments.

C.14.4 The Contractor shall provide updates against the approved PMP schedule via the biweekly status report. Any deviations from the approved PMP must be communicated immediately to the COR with a remediation plan.

C.15 Post-Award Meeting.

C.15.1 Within 10 days of purchase order award, the Contractor shall schedule and facilitate a virtual Post-Award Meeting. The meeting shall be conducted via Microsoft Teams.

C. 15.2 At a minimum, the meeting shall be attended by the Contractor’s Program Manager, key technical/migration leads, and the COR.

C. 15.3 The Contractor shall provide a draft agenda to the COR at least two business days prior to the meeting. The meeting objectives shall include, but are not limited to:

• Introducing key personnel, roles, and communication protocols;

• Reviewing the Statement of Work requirements, period of performance, and initial implementation timeline;

• Discussing the transition from the legacy data system and technical prerequisites for the SaaS environment; and

• Establishing the schedule for weekly status updates and future deliverables.

C. 15.4 The Contractor shall document the meeting and deliver comprehensive meeting minutes, including an attendance list and a tracked action-item matrix, to the COR via email within three business days following the conclusion of the meeting.

C.16 Bi-weekly Status Reports. The Contractor shall provide bi-weekly status reports describing the accomplishments, next steps, and any issues, including any changes/updates to the approved PMP.

Biweekly status reports shall begin 15 days after purchase order award and every two weeks thereafter until all work/deliverables have been accepted by the COR.

C.17 Deliverables.

C.17.1 Table 1 below summarizes the deliverables/events required by this Statement of Work.

C.17.2 Adjustments within the PMP. Minor shifts in individual task dependencies, data migration schedules, or training session dates may be adjusted and authorized via mutual agreement between the Contractor and the COR (at no cost to the Government) through the biweekly tracking of the approved Project Management Plan (PMP). These internal adjustments do not require a formal contract modification, provided the adjustments do not extend the base period of performance.

C.17.3 Any adjustment that changes the total purchase order price or alters the essential scope of work must be documented via a modification to the award.

Table 1: Deliverables Days listed in the table below are calendar days unless otherwise stated in the Statement of Work.

SOW

Section Deliverable Due Formats COR Review C.15 Post-Award Meeting & Agenda Within 10 days of award Virtual via Microsoft

Teams (PDF Agenda) N/A

C.15 Post-Award Meeting Minutes Within 3 business days of the post-award meeting

Word/PDF 3 business days

C.14 Draft PMP 15 days from post-award meeting

MS Project or Excel 5 business days

C.14 Final PMP Within 5 business days of receipt of COR Comments

MS Project or Excel 3 business days

C.2 thru C.5

Provisioned SaaS Environment & MFA Integration Validation

Within 60 days from award Digital Access/Written Confirmation

5 business days

C.13.3 Post-Configuration Accessibility Conformance Report (ACR/VPAT)

Within 10 business days following final system configuration/setup and prior to data migration

Email (PDF / Standard VPAT Form)

5 business days

C.5.3 User Role Configuration & User Acceptance Testing (UAT) Sign-off

Within 75 days from award System Demonstration / Sign-off Memo

5 business days

C.7 Completion of Live Virtual Training Sessions & Media Deliverables

Within 15 business days from final production migration/receipt of migration report Within the base period of performance as agreed to in the PMP.

On-site & Virtual Delivery / Link to Recorded Files & PDFs

3 business days

C.10 Integration w CSOSA Financial System

Within 85 days from award Demonstrated successful integration

3 business days

C.11 Final Production Migration & Comprehensive Migration Report

Within 90 days from award System Live / Email (Excel & PDF Report)

5 business days

All SOW Rqmts

Final System Acceptance & Go- Live Authorized

Within 10 business days final production migration/receipt of migration report

Written COR Acceptance Notice

5 business days

C.16 Bi-weekly Status Reports Every other Monday beginning the 3rd Monday after award

Word/PDF 3 business days

C.14 Updated PMP As required by SOW C.14 MS Project or Excel 3 business days

C.18 Review and Acceptance Criteria.

C.18.1 All written or digital deliverables shall be professional, free of formatting errors, and fully compliant with Section 508 standards as outlined in Section C.13.

C.18.2 If the COR disapproves a deliverable, the Government will provide written comments detailing the deficiencies. The Contractor shall remediate and resubmit the revised deliverable within five (5) business days of receiving the Government's notification at no additional cost to the Government.

C.18.3 For the purposes of fixed-price milestone billing, a deliverable is only considered "delivered" once the COR issues an explicit, written confirmation of acceptance.