959P0019R0002_-_Electronic_Monitoring_Services.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE 17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ IFB RFP

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

DATED . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print)

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

8 (A)

NAICS:

SIZE STANDARD:

STANDARD FORM 1449 (REV. 3/2005) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

959P0019R0002

TABLE OF CONTENTS:

Listing of Incorporated Purchase Requisitions Section B - Supplies or Services and Prices/Costs Section C - Description/Specifications/Work Statement Section D - Packaging and Marking Section E - Inspection and Acceptance Terms Section F - Delivery or Performance Section G - Contract Administration Data Section H - Special Contract Requirements Section I - Contract Clauses Section J - List of Documents, Exhibits, and other Attachments Section K - Representations, Certifications, and Other Statements of Offerors Section L - Instructions, Conditions and Notices to Offerors Section M - Evaluation Factors for Award

Listing of Incorporated Purchase Requisitions

Incorporated Purchase Requisition Numbers:

Section B - Supplies or Services and Prices/Costs

Item Number Base Item Number

Supplies/Services Quantity Unit

0001 Electronic Monitoring Services 0 Contract Type:Firm Fixed Price

Unit Price Extended Price

Description:

BASE YEAR

Estimated number of defendants per month: 475

Daily Rate per Defendant: $______

The daily price/per defendant shall be fixed and shall be inclusive of all labor, supervision, materials, monitoring, management, and other costs as may be associated with providing the required equipment and services for electronic monitoring as further described in the Performance Work Statement and elsewhere in this document.

The variable shall be the actual number of active defendants under electronic monitoring supervision during any given day. Monthly invoices shall be based on the fixed Daily Rate per Defendant multiplied by the actual number of active defendants per day.

Purchase Requisitions

IDC Type: Not Applicable FSC Codes: D399 IT AND TELECOM- OTHER IT AND TELECOMMUNICATIONS

NAICS Code: 334220 Radio and Television Broadcasting and Wireless Comm...

Supplies/Services Quantity Unit

0002 0001 Electronic Monitoring Services 0 Contract Type:Firm Fixed Price

Unit Price Extended Price

Description:

OPTION YEAR ONE

Estimated number of defendants per month: 475

Daily Rate per Defendant: $______

The daily price/per defendant shall be fixed and shall be inclusive of all labor, supervision, materials, monitoring, management, and other costs as may be associated with providing the required equipment and services for electronic monitoring as further described in the Performance Work Statement and elsewhere in this document.

The variable shall be the actual number of active defendants under electronic monitoring supervision during any given day. Monthly invoices shall be based on the fixed Daily Rate per Defendant multiplied by the actual number of active defendants per day.

Purchase Requisitions

Option: 1 Option Time Date: 3/26/20 Option Time Duration: 364 Option Time Units: Days

Supplies/Services Quantity Unit

0003 0001 Electronic Monitoring Services 0 Contract Type:Firm Fixed Price

Unit Price Extended Price

Description:

OPTON YEAR TWO

Estimated number of defendants per month: 475

Daily Rate per Defendant: $______

The daily price/per defendant shall be fixed and shall be inclusive of all labor, supervision, materials, monitoring, management, and other costs as may be associated with providing the required equipment and services for electronic monitoring as further described in the Performance Work Statement and elsewhere in this document.

The variable shall be the actual number of active defendants under electronic monitoring supervision during any given day. Monthly invoices shall be based on the fixed Daily Rate per Defendant multiplied by the actual number of active defendants per day.

Purchase Requisitions

Option: 2 Option Time Date: 3/26/21 Option Time Duration: 364 Option Time Units: Days

Supplies/Services Quantity Unit

0004 0001 Electronic Monitoring Services 0 Contract Type:Firm Fixed Price

Unit Price Extended Price

Description:

OPTION YEAR THREE

Estimated number of defendants per month: 475

Daily Rate per Defendant: $______

The daily price/per defendant shall be fixed and shall be inclusive of all labor, supervision, materials, monitoring, management, and other costs as may be associated with providing the required equipment and services for electronic monitoring as further described in the Performance Work Statement and elsewhere in this document.

The variable shall be the actual number of active defendants under electronic monitoring supervision during any given day. Monthly invoices shall be based on the fixed Daily Rate per Defendant multiplied by the actual number of active defendants per day.

Purchase Requisitions

Option: 3 Option Time Date: 3/26/22 Option Time Duration: 364 Option Time Units: Days

Supplies/Services Quantity Unit

0005 0001 Electronic Monitoring Services 0 Contract Type:Firm Fixed Price

Unit Price Extended Price

Description:

OPTION YEAR FOUR

Estimated number of defendants per month: 475

Daily Rate per Defendant: $______

The daily price/per defendant shall be fixed and shall be inclusive of all labor, supervision, materials, monitoring, management, and other costs as may be associated with providing the required equipment and services for electronic monitoring as further described in the Performance Work Statement and elsewhere in this document.

The variable shall be the actual number of active defendants under electronic monitoring supervision during any given day. Monthly invoices shall be based on the fixed Daily Rate per Defendant multiplied by the actual number of active defendants per day.

Purchase Requisitions

Option: 4 Option Time Date: 3/26/23 Option Time Duration: 366 Option Time Units: Days

Clauses incorporated by reference

None

Clauses incorporated by full text

Section C - Description/Specifications/Work Statement

Performance Work Statement Performance Work Statement

Electronic Monitoring Services

1. Introduction

The Pretrial Services Agency for the District of Columbia (PSA or Agency) is an independent entity within the Court Services and Offender Supervision Agency (CSOSA) in the Executive Branch of the Federal government. PSA has served the District of Columbia for 50 years and is widely recognized as a leader in the pretrial field. PSA's mission is to promote pretrial justice and enhance community safety. Our vision is to thrive as a leader within the justice system through a diverse, inclusive and empowered workforce that embodies integrity, excellence, accountability, and innovation in the delivery of the highest quality services.

PSA promotes community safety and return to court while honoring the constitutional presumption of innocence. The agency plays a vital role in the District of Columbia's criminal justice system. PSA gathers and presents information about newly arrested defendants and available release options for use by judicial officers in deciding what, if any, conditions are to be set for released defendants. Additionally, PSA supervises defendants released from custody during the pretrial period by monitoring their compliance with conditions of release and by helping to ensure that they appear for scheduled court hearings.

PSA supervision gives the defendants the opportunity to participate in a variety of pro-social interventions that decrease the likelihood of future criminal behavior. PSA was established in its current form by the National Capital Revitalization and Self-Government Improvement Act of 1997 and was certified as a federal agency under the Executive Branch in August 2000.

2. Objective

PSA's strategic goals focus on effectiveness of mission accomplishment which includes solutions to enhance the supervision of defendants in the community. PSA's use of electronic monitoring to assist in the supervision of certain defendants released from custody supports the Agency's strategic goals for continued pretrial release, maximizing court appearance and minimizing rearrests.

3. Scope of Work

PSA requires electronic monitoring services that include installation, removal, maintenance, monitoring, retrieval, and courtroom testimony. The contractor is responsible for providing all equipment, equipment maintenance and user training for the system that electronically monitors a defendant's location, curfew or stay away order. The contractor must provide the most recent generation of electronic monitoring (EM) and global position surveillance (GPS) tracking equipment and remain up-to-date on the latest trends and technology in EM and GPS throughout the life of the contract.

The contractor must provide onsite staff representatives to perform the aforementioned tasks throughout the duration of the contract. The contractor is responsible for retrieval of monitoring devices at designated PSA offices, the defendants' homes and other designated locations (e.g. D.C. Superior Court, U.S. Marshall Service, Central Detention Facility, etc.).

The contractor will be responsible for replacing equipment due to failures and deficiencies that prevent the equipment from monitoring the defendants' movements and locations while away from the home which prohibits recording of the defendant's entrance into and exist from their home.

The estimated number of defendants actively monitored at any given time is approximately 475 per month, but may fluctuate on a daily basis. The contractor's database should have scalability to store and retrieve electronic and location monitoring data for 7200 defendants each year of the contract, whether active or inactive.

4. Background

PSA has relied upon electronic monitoring services, cellular and GPS, since 2008 when it was first introduced in its High Intensity Supervision Program (HISP). As part of the transition from program-based to risk-based supervision model PSA plans to expand the use of electronic surveillance. In a risk-based model supervision is tailored to the identified risk of each defendant.

5. Place of Performance

Pretrial Services Agency for the District of Columbia Offices:

1) 633 Indiana Avenue, N.W., , Washington, DC 20004

2) 601 Indiana Avenue, NW Washington, DC 20004

3) 500 Indiana Avenue, NW, , Washington, DC 20001

4) 333 Constitution Avenue, N.W., Washington, DC 20001

6. Applicable Documents

The following PSA policies apply to all contractors and can be found on PSA's intranet site "MyPSA" Contractors will be required to comply with the most current version available on MyPSA.:

PS 5802 Hostage Response Procedures (09/26/2005

PS 1008 Records Management (12/14/2012)

PS 3420 Prohibited Appliances and Personal Items (04/12/2016)

PS 4060 Personnel Security Program (12/17/2015)

PS 5500 Information Technology Security, (12/21/2016)

PS 5002 Safeguarding Personally Identifiable Information (7/1/2015)

7. Electronic Monitoring & Global Position Surveillance (GPS) Tracking Services

7.1. On-site and Remote Staffing Requirements

1) The Agency requires the contractor to provide fully qualified staff representatives on site to:

a. Install, remove, maintain, retrieve and account for electronic monitoring equipment Monday through

Friday from 8:00 am to 5:00 pm or until completion of daily tasks.

b. Contractor staff maybe required to work or during inclement weather when federal government offices are closed (according to OPM) and PSA is operating. The COR will notify contractor personnel when necessary.

2) Contractor staff representatives must be available to:

a. Provide court testimony as needed Monday through Friday from 8:00 am to 5:00 pm or until Court is done hearing the case on a given day.

b. The contractor is responsible for any associated costs (travel and witness fees).

3) Staff representatives working under this contract are required to complete relevant Agency training annually, as determined by PSA, and are subject to and must pass a Government background investigation.

4) PSA requires a 24 hour turn-around time for the installation and removal of equipment and service within 50 miles of the place of performance or delivery location. If maintenance or troubleshooting is necessary, the contractor will respond and provide resolution within 24 hours to ensure business continuity. The Agency also has a need for installation, removal, maintenance, service and retrieval of equipment during weekends, holidays, and non-business hours.

5) The staff representatives' on-site duties include, but are not limited to:

a. Troubleshooting key events/alerts with PSOs to ensure accuracy and certainty.

b. Providing confirmation of key events/alerts as valid or invalid as it pertains to GPS drift or other unavoidable location monitoring challenges.

c. Providing definitive answers to inquiries.

d. Entering exclusion zones into the contractor's automated system within fifteen (15) minutes of installation of monitoring equipment.

e. Resolving an extensive range of program support issues and problems.

f. Providing analysis and recommendations or alternatives to issues and problems to address any concerns and be more efficient.

6) The staff representatives' field duties include, but are not limited to:

a. Installation and de-installation

b. Maintenance and troubleshooting

c. Retrieval of equipment during weekends, holidays, and non-business hours

7.2. Equipment

1) The EM/GPS tracking devices must be made available for defendants on curfew and/or home confinement that reside, work, and travel throughout the Washington D.C., Maryland and Virginia metropolitan area, as directed by

PSA.

2) The EM/GPS device must be capable of tracking a defendant within the continental United States.

3) The contractor's equipment must allow for services even in the absence of a residential telephone line.

4) The contractor shall be responsible for ensuring adequate inventory is on site and readily available (operational) to ensure installation on defendants within fifteen (15) minutes of notification.

5) The EM/GPS tracking device must be able to monitor defendants' locations, curfew and capture inclusion/exclusion zones while showering and/or bathing 24 hours per day, 7 days per week.

6) The EM/GPS tracking device should be capable of one or more methods of instant communication with the defendant.

7) The EM/GPS tracking device must be capable of detecting physical tampers, interference, shielding, and GPS or cellular jamming.

8) The contractor must provide access to multiple cellular networks and provide local technology to include, Wi-Fi access points, broadcast towers and roaming capabilities.

9) The contractor must provide FCC certified equipment and a copy of the certification for each component prior to contract award.

7.3. System Requirements

1) The contractor's client management system (CMS) must provide accessible data containing a listing of the names of all defendants actively being monitored by the contractor's equipment, associated transmitter/receiver serial numbers, current real-time status of each defendant referencing the single most recent event that was reported for each defendant. This information shall be reported by location, date and time. There must also be access to inactive defendant information.

2) The CMS must be able to warn and instruct the defendant to leave a geographical area of exclusion as well as notify the Pretrial Services Officer (PSO) as the event occurs, notating within the CMS the actual time the defendant enters and/or exits a geographical area of exclusion.

3) The CMS must allow the PSO to create custom notification profiles, to include the capability to enter method of contact (phone, email, text, etc.). It must provide the flexibility of selecting the schedule of notification based on the type of event (e.g., equipment tamper or entering an exclusion zone) and the risk level of the defendant.

4) The CMS must be capable to provide daily violation reports of all violation notifications from the previous 24 hours.

5) The CMS must have standard reports that allow for the interpretation of technical information, and the ability to generate and print such reports. The system must also have the flexibility to allow customization of a report in non-technical terms based on the needs of the Agency.

6) The contractor must possess the ability to develop and generate new reports as requested by PSA, or suggested by the contractor and approved by PSA. The contractor must complete all requests for customization of standard reports within a negotiated timeframe.

7) The CMS must be user-friendly. The contractor is required to provide adequate training and instructional guidance explaining user functionality.

8) The CMS must be able to scale vertically and horizontally based on the agency needs. Scaling vertically would allow the agency to increase or decrease the number of defendants under supervision, while scaling horizontally allows the agency to increase its hardware capacity. The automated system scalability options should not affect the case manager's ability to perform supervision duties or impede the agency's daily operation.

9) The CMS must have the ability to register an unlimited number of defendants. For planning purposes, the estimated number of defendants actively monitored at any given time is 470. The contractor's database should have scalability to store and retrieve electronic and location monitoring data for minimally 7,200 defendants each year of the contract, whether currently installed on the system or not.

10) The CMS must be able to support a minimum of 30 concurrent PSA staff members. PSA reserves the right to increase this number as needed, with notice to the contractor.

11) The contractor shall provide PSA users with real-time remote web based access to its monitoring system to view, print, download, and enter/modify defendant monitoring information, and to access:

a. Defendant tracking information and location

b. Device events and alerts

c. Battery life

d. Schedules

e. Multiple PSA defendants

f. Enrollment

g. Data analytics

h. Reports

12) The CMS must provide management/supervisors with requested reports, including caseload by officer, total units, inventory control, and names and number of days removed for violation. The system must allow for storing agency pre-defined zones, which can be applied to any defendant.

7.4. Training

The contractor must provide initial training sessions for staff within the Office of Operations no later than 14 business days following award. The training must clarify and demonstrate the operation and installation of the monitoring equipment and systems. The contractor must also provide periodic training for PSA staff upon request and when there are changes made to the contractor's automated system and/or operating procedures.

7.5. PSA Client Management System Interface

The Pretrial Real-time Information System Manager -PRISM- is PSA's client management system (CMS). PRISM is the Agency's official defendant information repository and it includes an Electronic Monitoring module. The EM module contains events, alerts, and GPS points for defendants under electronic monitoring supervision. The Agency built PRISM using Microsoft .NET Framework® technologies and has a dedicated team to support it. PSA's Systems Development team will work with the service provider to integrate the systems.

1) The vendor shall provide, within 120-days of contract award, secure means for asynchronous data exchange between their CMS and PRISM via a secured Web Service.

2) PSA will consider utilizing REST (Representational State Transfer) or SOAP (Simple Object Access Protocol based web services for the data exchange.

3) The objective is to implement two-way communications so that PSA can make a request to vendor's web service for specific data or action, and the vendor in turn will feed the requested data into PSA's web service.

4) The Web Service shall include endpoints for the following services, respective acknowledgments, and error handling:

• Defendant enrollments and terminations

• Equipment installations, removals, and service calls

• Defendant events and alerts

• Defendant's GPS points, location addresses correspondent to the alerts

7.5.1. Defendant enrollment and termination

The web service shall make an endpoint available so PRISM can electronically request Defendants (defendants) enrollments and terminations. In order to do so, the service shall be able to accept and process new and updated defendant enrollment information, which will include name, alias, address, telephone number(s), case manager name, schedule curfew information and other information to activate the monitoring service. The system shall allow for, and differentiate between a defendant's temporary, one-time, and permanent daily schedules inclusion and exclusion zones. At a minimum the vendor's CMS shall accept and respond with the following information:

• PSA Unique Identifier (equivalent to Defendant ID – PSA will send one of two values PDID or BAID),

• First Name, Last Name, Middle Name, Name Prefix, and Alias,

• Defendant Type,

• Date of Birth, Gender, Race, Ethnicity,

• Location, Address, City, State, Zip, County, Phone # 1, Phone # 2, Time Zone,

• Defendant exclusion or inclusion zone(s),

• Case manager name and contact information – phone(s) and email,

• Alternate case manager name and contact information – phone(s) and email,

• Comments (text),

• Equipment Serial Number (equipment link),

• Message Type (enroll, remove),

• Action Type (add, update, delete),

• Message date-time stamp.

7.5.2. Equipment installations, removals, and service calls

The web service shall make an endpoint available so PRISM can electronically request equipment installation, removals, or service calls. At a minimum the vendor's CMS shall accept and respond with the following:

• Equipment Serial Number (unique identifier),

• Equipment Type (Cellular, Landline, GPS, Cellular + GPS, and Landline + GPS) ,

• Equipment Name,

• Equipment Status (active, inactive),

• Date-time install requested, date-time install completed,

• Date-time removal requested, date-time removal completed,

• Date-time service call requested, date-time service call completed,

• Location installed – address,

• Location served – address,

• Location removed – address,

• Service Call Type (repair, replacement, outage, other, etc.),

• Resolution (text describing solution or message),

• PSA Unique Identifier (Defendant ID link),

• Message Type (install, removal, service call),

• Action Type (add, update, delete),

• Message date-time stamp.

7.5.3. Defendant events and alerts

The web service shall make an endpoint available so PRISM can electronically request all events and alerts for a given unit or Defendant. The service shall allow PSA to retrieve near real-time monitoring events and alerts.

Near-real-time is defined as within five (5) to fifteen (15) minutes of an event or alert occurrence. At a minimum the vendor's CMS shall accept and respond with the following:

• Event unique identifier,

• Equipment Serial Number (equipment link),

• PSA Unique Identifier (Defendant ID link),

• Event Type,

• Event Description (text),

• Event Comments (text),

• Event Sub Type (subcategory if any),

• Event sub type Description (text),

• Event sub type Comments (text),

• Event Date-time stamp,

• Alert Type,

• Alert Description (text),

• Alert Comments (text),

• Alert Cleared By,

• Equipment parameters (if any),

• Action Taken (text),

• Action Type (add, update, delete),

• Message date-time stamp.

7.5.4. Defendant GPS points

The web service shall make an endpoint available so PRISM can electronically request all GPS location points for a given unit or Defendant. The service shall allow PSA to retrieve near real-time GPS points. Near-real-time is defined as within five (5) to fifteen (15) minutes of the point received at vendor's system. At a minimum the vendor's CMS shall accept and respond with the following:

• GPS point unique identifier,

• Equipment Serial Number (equipment link),

• PSA Unique Identifier (Defendant ID link),

• Latitude

• Longitude

• Accuracy

• Physical Address (location)

• GPS point Date-time stamp,

• Message date-time stamp.

8. Transition Plan

1) The contractor shall develop and submit a project plan that identifies the activities required to meet all aspects of the requirements. The contractor must clearly demonstrate its ability to prevent any break in service.

2) Transition In: The project plan shall clearly demonstrate the ability to manage the seamless transfer and transition of this contract. The proposed implementation plan must include, but not be limited to:

• Seamless plan for initial mass device installation

• Equipment transfer and return

• Records transfer and return

• Software implementation

• Staffing designations for on-site and field support

3) Transition Out: The transition out plan shall mitigate risks associated with a transition of services at the end of the contract period. The plan shall document the transition of powers, duties, activities, and functions of tasks and services for the EM contract. Upon conclusion of the contract, all records will be provided to the Government and are the exclusive property of the Government. The contractor shall propose a plan that shall include, but not be limited to:

• Specific contractor needs from the Government to successfully transition away from electronic monitoring services.

• Provide contact information of the project manager appointed to coordinate the transition.

• Process for the Government to request and receive monitoring data, interpretation and reports.

• Process for providing court testimony at the end of the contract life to include costs and information needed from the

Government.

9. Contractor Quality Assurance

The contractor must comply with PSA's Quality Assurance Surveillance Plan (QASP) set forth in the contract. This plan will detect errors in electronic monitoring, prevent future errors, and provide quality assurance for the services provided under this contract. The QASP will be used to measure realistic performance standards, reasonable deliverables and/or standards, realistic and measurable standards of performances, realistic acceptable quality levels, and realistic monitoring methods to collect and analyze data. The QASP is a living document and may be updated/changed by PSA as necessary.

10. Deliverables

The contractor must be available to meet with Government representatives in Washington, D.C., at the discretion of the Government, within one (1) week following contract award to discuss plans for implementation of monitoring services including training, equipment delivery, and installation. All equipment, training, and services necessary to monitor up to the current level of Defendants in each site shall be available from the contractor no later than twenty-four (24) hours following contract award, unless otherwise agreed, in writing, by the Contracting Officer.

No. Deliverable Frequency Format/# of Copies Submit To

1 Access to daily EM violations Daily by 7:00AM for the previous day

Email PSA Supervision staff

No. Deliverable Frequency Format/# of Copies Submit To

2 Develop and customize standard reports Within 2-4 weeks of request

Revise format and content as required by the COR and approved by the CO

CO &COR

3 Provide information to PSA's law enforcement partner agencies

Daily, as requested Email PSA Supervision staff

4 Provide a secure web service, a web information sharing interface between

PRISM and the Contractor's CMS

Within 120 days of contract award

Revise format and content as required by the COR and approved by the CO CO/COR

5 Provide staff representatives to install, remove, maintain, retrieve, troubleshooting, provide technical support and maintain electronic monitoring equipment

Daily, as required On-site

COR

6 Provide court testimony As necessary in accordance with contract

On-site

COR

7 Complete mandatory Agency training Annually or as required On-site/Automated system

COR

8 Provide analysis and recomm endations/alternative to issues or problems and confirm events/alerts as valid or invalid

Daily, as required Email

PSA

Supervision staff

9 Update monitoring software with defendant information for installations, curfews, inclusion/exclusion zones within 15 minutes of defendant installation

Automated system

COR

10 Provide field support services for installation, retrieval, troubleshooting and service of equipment within the defendant's home

Within 24 hours of COR request

Email

COR

11 Provide EM software and GPS equipment training sessions for Agency employees

Within 14 days following contract award and As necessary in accordance with contract

Revise format and content as required by the COR and approved by the CO COR

12 Provide automated, real-time remote web based monitoring system

24 hours per day/7 days per week, 365 days per year

Automated system PSA Supervision staff

13 Transmit stored data to the contractor's monitoring center, in the event of a power failure or disruption in

AC, when power is restored

Within 8 hours Automated system

COR

14 Provide in writing notification of monitoring center or backup center location change

As necessary in accordance with contract

Email

COR

15 Provide response to requests for Within 15 minutes of request

Email PSA Supervision

No. Deliverable Frequency Format/# of Copies Submit To location positioning staff

16 Provide notification when the system will be down for scheduled maintenance

Within 24 hours

Email

COR

17 Provide corrective action and written explanation to COR when contractor's system does not provide actual time of occurrence for key events

Within 24 hours

Email

COR

18 Notify the COR and provide contingency plan in the event monitoring access becomes inoperable

As necessary in accordance with contract

Email

COR

19 Terminate monitoring of defendant By close of business on day of COR request

Email

COR

20 Adhere to the Agency's performance measures in accordance to the QASP standards, surveillance methods, acceptable quality levels, and any pertinent incentive or disincentive calculations

Within 15 days of contract award

Revise format and content as required by the COR and approved by the CO

CO/COR

21 Provide written response to QASP areas requiring improvement and items for discussion

Within 5 working days

Monthly

COR

22 Develop and implement Transition Plan As necessary in accordance with contract

Revise format and content as required by the COR and approved by the CO

CO/COR

11. Meetings

The contracting staff will meet with the COR and CO weekly during the first month after contract award. Meetings will occur on an agreed upon schedule monthly thereafter or more often as deemed necessary in special circumstances. The contractor representative will prepare meeting minutes and will distribute them to the attendees after each meeting. Meetings will be held virtually via webinar/teleconference and/or in a PSA office located within:

633 Indiana Avenue, N.W.

601 Indiana Avenue, N.W.

500 Indiana Avenue, N.W.

1025 F Street, N.W.

Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5.

The Contracting Officer, Contracting Officer's Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

12. Special Instructions

12.1. Inclement Weather Provision

The PSA staff who oversee the use of the GPS monitoring services are considered Emergency/Essential Employees for the federal government and are essential to the continuation of operations at PSA. If the Federal Government grants delayed arrival or closure due to inclement weather or natural disaster, the contractor shall follow operating status for PSA's current operating status for Emergency/Essential Employees as well as any additional guidance from the COR or

CO.

12.2. Information Security Requirements

The vendor shall meet and comply with Federal laws, Executive Orders, directives, policies, regulations, standards, and guidance, as amended and extended, for the protection of the information system and information during processing, while in storage, and during transmission. The vendor shall be required to comply with, at a minimum:

1) Federal Information Security Modernization Act of 2014 (FISMA)

2) Office of Management and Budget (OMB) Circular and Memoranda (e.g. Circular A-130)

3) U.S. Department of Homeland Security Directives (e.g. US-CERT and HSPD-12)

4) National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and

Special Publication (SP) 800 Series (e.g. FIPS 200, FIPS 199, FIPS 140-2, SP 800-18, SP 800-37, SP

800-53A, SP 800-60)

5) PSA PS-4060 Personnel Security Program, (12/17/2015)

6) PSA PS-5500 Information Technology Security, (12/21/2016)

7) PSA PS-5002 Safeguarding Personally Identifiable Information, (7/1/2015)

The Federal Information Security Modernization Act of 2014 (FISMA), requires the head of each agency to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information. It requires those measures to be in place for information collected or maintained by or on behalf of the agency; and information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.

The law defines the term "information security" to mean protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide:

(A) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(B) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(C) Availability, which means ensuring timely and reliable access to and use of information.

The vendor shall provide and implement security controls, as selected by the Government, to meet the security requirements for a Moderate impact level system as defined in NIST SP 800-53 (as amended), Security and Privacy Controls for Federal Information Systems and Organizations. The contractor shall apply the appropriate set of baseline security controls as required by PSA's policy statement # 5500 Information Technology Security to ensure compliance with security standards.

Executive departments and agencies procuring commercial and non-commercial cloud services, or systems provided or managed by other departments or agencies, contractors, or other sources must comply with FISMA requirements.

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to FISMA compliance as it applies to cloud-based computing services. It oversees and standardizes how to do security assessments, authorizations, and continuous monitoring for cloud products and services. FedRAMP requirements apply to all cloud deployment models (e.g., Public Clouds, Community Clouds, Private Clouds, Hybrid Clouds); and all cloud service models (e.g., Infrastructure as a Service, Platform as a Service, Software as a Service) as defined by the National Institute of Standards and Technology (NIST).

12.2.1.Security Assessment and Authorization, and Continuous Monitoring

1) The contractor shall apply the appropriate set of baseline security controls as required in the PSA Service Provider Security Controls Baseline workbook to ensure compliance to security standards. The workbook is based on the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 (as amended), Security and Privacy Controls for Federal Information Systems and Organizations.

2) The contractor shall be responsible for the cost of preparing the Security Authorization Package using NIST

SP 800-37 (as amended) Guide for Applying the Risk Management Framework to Federal Information Systems (using FedRAMP templates, where available) and maintaining compliance.

3) The contractor shall be able to maintain a security management continuous monitoring environment that meets or exceeds the Continuous Monitoring requirements in SP 800-37, Appendix G.

12.2.2.Information Security Requirements Questionnaire

The contractor, at a minimum, shall address the following questions regarding its Information Security program in its proposal. The government must be able to assess whether or not the proposed system, end-to-end, could pass an information security assessment and be authorized within 120-days.

1) Does the company have a formal information security program in place?

2) Is the information security program FISMA compliant?

3) Is the information security program based on the NIST SP800-37 revision 2, and SP800-53 revision 4 framework?

4) If not based on the NIST framework, what framework does your program follow?

5) Has the company done an independent information security assessment on the CMS? If so, when was the last one?

6) Where is the CMS hosted (i.e., own data-center, commercial data center, or commercial cloud provider)?

7) If hosted on a commercial cloud provider (CSP) environment, is the cloud provider FedRAMP certified? And what is the CSP name?

8) Is the CMS FedRAMP certified? If so, what is the FedRAMP package number?

9) Does the CMS has a current Plan of Actions and Milestones (POA&M)?

10) Does the CMS has a current Systems Security Plan (SSP)?

12.2.3.Requirements for Externally Hosted Services and Applications

Since the contractor's client management system (CMS) is external to PSA the following requirements also apply:

1) The Government reserves the right to perform Penetration Testing. If the Government exercises this right, the contractor shall allow Government employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements. Review activities include but are not limited to scanning operating systems , web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

2) Identified gaps between required Security Controls and the contractor's implementation as documented in the System Security Plan (SSP) shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document.

3) The contractor is responsible for mitigating all security risks found during security assessment and accreditation and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified.

4) The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance. The Government reserves the right to conduct onsite inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

5) The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor's Information Technology (IT) environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, the contractor shall be responsible for the following security safeguards:

6) The contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the contractor under this contract or otherwise provided by the Government.

7) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the contractor shall afford the Government access to the contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours. The program of inspection shall include, but is not limited to:

a. Authenticated and unauthenticated operating system/network vulnerability scans;

b. Authenticated and unauthenticated web application vulnerability scans;

c. Authenticated and unauthenticated database application vulnerability scans; and

d. Automated scans can be performed by Government personnel, or agents acting on behalf of the

Government, using Government operated equipment, and Government specified tools.

8) If new or unanticipated threats or hazards are discovered by either the Government or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

9) If the contractor chooses to run its own automated scans or audits, results from these scans may, at the Government's discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of Contractor-conducted scans shall be provided, in full, to the Government.

10) The Government may choose to cancel for convenience the (Contract/Award) if the contractor has its authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

11) The contractor shall comply with the Government security and privacy requirements (subject to change by the PSA Information Security Office) and as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

12) The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract.

13) The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as Controlled Unclassified Information (CUI). It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets.

14) The Government shall retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on Contractor's infrastructure, as well as maintains the right to request full copies of these at any time.

15) The contractor shall ensure that the facilities that house the network infrastructure are physically secure. The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein.

16) The contractor shall provide requested data at no additional cost to the government. No data shall be released by the contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the Contracting Officer.

17) The contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of cyber incidents.

18) The contractor shall be responsible for all costs and related resource allocations required for all subsequent incident response activities determined to be required by the Government, whether incurred by Government, agents under contract or on assignment to the Government, or by third party firms.

12.2.4.Additional Requirements for CSP hosted Services and Applications If the proposed contractor's CMS is hosted in a commercial cloud service provider (CSP) environment like MS Azure, Amazon Web Services (AWS), IBM Cloud, Google Cloud, or similar the following requirements apply:

1) The contractor shall implement the controls contained within the FedRAMP Security Controls Baseline, and FedRAMP Continuous Monitoring Strategy Guide available at the FedRAMP website (https://www.fedramp.gov/documents/).

These documents define requirements for compliance to meet minimum Federal information security requirements.

2) The contractor shall follow FedRAMP guidelines and security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for information security.

3) The contractor shall be responsible for the cost of preparing the Security Authorization Package using the FedRAMP Security Assessment Framework (SAF) process (using FedRAMP templates, where available) and maintaining compliance.

4) The Contractor shall be responsible for preparing the Security Authorization Package using the FedRAMP SAF Process and FedRAMP Security Control Baseline Workbook.

5) The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

6) The contractor shall create, maintain and update the documentation using FedRAMP requirements and templates, which are available at https://www.fedramp.gov/templates/.

7) The contractor shall use an accredited Third-Party Assessment Organization (3PAO) whenever there is a significant change to the system's security posture in accordance with the FedRAMP Continuous Monitoring Strategy Guide.

8) To the extent required to carry out the FedRAMP Security Assessment and Authorization (SA&A) Process (also known as the Federal Risk and Authorization Management Program) and FedRAMP Continuous Monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the contractor, the contractor shall afford the Government access to the contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases.

9) If new or unanticipated threats or hazards are discovered by either the Government or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

12.3. Confidential Treatment of Sensitive Information

The vendor shall guarantee strict confidentiality of the information/data that it is provided by the Government during the…