Attachment 1 - FCC_BDC_PWS_Mobile_App.pdf

Federal Communications Commission

Performance Work Statement

FCC Speed Test Mobile Application for

Broadband Data Collection

February 17, 2023

Prepared by:

Federal Communications Commission Office of Engineering and Technology

45 L Street NE

Washington, DC 20554

PWS – FCC Speed Test Mobile Application

Table of Contents

1. Background

2. Introduction

3. Objectives & Scope

4. Detailed Requirements

4.1 Task 1: Master Plan

4.2 Task 2: Application Development and Deployment

4.3 Task 3: Technical Management

4.4 Task 4: Operation, Maintenance, & Support Requirements

4.5 Task 5 (Optional): Special Projects

4.6 Task 6 (Optional): Additional App Features

4.7 Task 7 (Optional): Facilitation of Program Transition Activities

5. Optional Task Exercise Procedure

6. Deliverables

7. Effect of Termination

8. Security & Privacy

8.1 Cybersecurity Training

8.2 Incident Response

8.3 Breach Response

8.4 Usage of FCC Information

8.5 Processing of PII

8.6 Authority to Operate

8.7 Application-Specific Requirements

9. Section 508

9.1 Installation, Configuration & Integration Services

9.2 Maintenance Upgrades & Replacements

9.3 Service Personnel

9.4 Hosting Services

9.5 Validation for ICT Items

9.6 Documentation

10. Organizational Conflicts of Interest (OCI)

Performance Work Statement (PWS) for FCC Speed Test Application

1. Background

The Broadband Data Collection (BDC), is an agency-wide effort to implement the broadband mapping system required as a part of the Broadband Deployment Accuracy and Technological Availability Act

(“Broadband DATA Act” or “BDA”), 47 U.S.C. § 641 et seq.1 The Broadband DATA Act, enacted in

March 2020, requires the Federal Communications Commission (FCC) to improve the quality of the data it publishes on the availability of broadband service to locations across the country. To fulfill the requirements of the Broadband DATA Act, the FCC must collect data on the availability and quality of broadband Internet access service from both fixed and mobile providers and certain other entities. Mobile wireless broadband service providers must also submit network coverage maps based on standardized propagation model parameters, as well as supplemental data about how the maps were generated to support their broadband coverage claims.

The BDA also requires the FCC to establish processes whereby third parties can challenge and/or submit other crowdsource data to assist the FCC in verifying and correcting the availability data it collects from providers. Specifically, for mobile wireless broadband service, the BDA requires the FCC to establish: 1) a user-friendly challenge process through which consumers, State, local, and Tribal governmental entities, and other entities or individuals may submit data to the FCC to challenge the accuracy of the coverage maps and any information submitted by a provider regarding the availability of mobile wireless broadband and its technology type; and 2) a crowdsource process through which entities or individuals may submit specific information about mobile wireless broadband network availability on an ongoing basis to supplement the availability data collected from providers and provide the FCC with data that will inform its efforts to verify and audit that data. Moreover, mobile wireless broadband providers may submit on-the-ground speed test data or infrastructure data (or both), as well as potentially other data, as part of the FCC’s mobile challenge and verification processes. See Establishing the Digital Opportunity Data Collection, WC Docket No. 19-195, Order, DA 22-241 (WTB, OEA, OET, Mar. 9, 2022)

(https://www.fcc.gov/document/fcc-releases-bdc-mobile-technical-requirements-order) (Mobile Technical

Requirements Order).

For publication of its National Broadband Map, the FCC’s Broadband Data Task Force, along with other

FCC Bureaus and Offices, has designed and developed a multifaceted BDC System to collect, validate, and publish complete, granular, and reliable data on broadband availability and its quality of service. See

FCC, Broadband Data Collection System, https://bdc.fcc.gov/. The key outputs of the BDC System are the public-facing National Broadband Map (https://broadbandmap.fcc.gov), which provides location-specific information pinpointing where broadband service is and is not available. The FCC, other federal agencies, and other stakeholders will be able to use these broadband maps to make informed decisions about where service is needed and where funding to expand broadband services is appropriate.

1 The BDC was formerly known as the Digital Opportunity Data Collection. See Establishing the Digital

Opportunity Data Collection; Modernizing the FCC Form 477 Data Program, WC Docket Nos. 19-195, 11-10, Second Report and Order and Third Further Notice of Proposed Rulemaking, 35 FCC Rcd 7460 (2020) (Second

Order and Third Further Notice); Establishing the Digital Opportunity Data Collection; Modernizing the FCC

Form 477 Data Program, WC Docket Nos. 19-195, 11-10, Third Report and Order, 36 FCC Rcd 1126 (2021)

(Third Report and Order).

https://www.fcc.gov/document/fcc-releases-bdc-mobile-technical-requirements-order https://bdc.fcc.gov/ https://broadbandmap.fcc.gov/

2. Introduction

To support the ongoing implementation of the BDA, the FCC requires development, system infrastructure implementation, maintenance, and operation services of a publicly available mobile speed test application

(“FCC Speed Test app” or “App”) for Google’s Android and Apple’s iOS operated devices. The App must measure and collect data on mobile wireless broadband availability and connectivity performance throughout the United States. The FCC Speed Test app must be able to collect, with user consent, personally identifiable information (PII) from consumer mobile devices, including information about the app user’s geographic location, the user’s contact information, the parameters of the network connection and provider/carrier, and detailed network performance metrics as prescribed by the FCC (including download/upload throughput speeds, latency, packet loss, jitter, etc.). The Contractor must store, compile, and transmit the collected data to the FCC’s BDC System via a secure technical manner that the

FCC determines is appropriate to safeguard the information using an Application Programming Interface

(API), as well as other methods and formats directed by the FCC on an agreed-upon regular basis. To ensure the network performance metrics are unbiased, the Contractor must acquire and maintain a sufficiently dense network of carrier-neutral test servers, and the App must select the most optimal test-server located close to a major internet exchange point within the United States when conducting each network performance measurement initiated by a mobile device. For reference, the current version of the

FCC Speed Test app is available for download on Android and iOS devices, and it can provide a better understanding of the current state and functionalities of the App, which implements two processes required for the BDC: mobile challenge and mobile crowdsource, which are described in more detail below. As part of these processes, consumers, mobile wireless broadband providers, governmental entities, and other third parties may use the App to collect on-the-ground speed test data to challenge provider availability data and to submit crowdsource data. For more information, see Broadband Data

Collection Bulk Mobile Speed Test Submission Process, WC Docket No. 19-195, Public Notice, DA 22-

962 (WTB, OEA, OET, Sept. 15, 2022) (https://www.fcc.gov/document/broadband-data-collection-bulk-mobile-speed-test-submissions-process). In addition to use of the App for these processes, FCC staff may also use the App to conduct coverage data verifications and audits (Verification and Audit processes).

• Challenge Process. The BDA requires the FCC to establish a process to enable consumers, governmental entities, and other third parties to submit challenges to, or dispute the accuracy of, the mobile broadband coverage maps or other information submitted by a provider regarding the availability of its mobile broadband internet access service as shown on the FCC’s National

Broadband Map.

For mobile challenges, consumers, governmental entities, and other third-party entities must submit the results of speed tests, including certain metrics, conducted under specific conditions.

The FCC will aggregate and evaluate the test results by the testing environment (i.e., outdoor stationary or in-vehicle mobile) and technology type. The FCC will apply the methodology adopted in the Mobile Technical Requirement Order to analyze the speed test data and determine whether the three thresholds for a “cognizable” challenge—geographic, temporal, and testing— have been met and, if so, the geographic boundary of the area subject to the cognizable challenge.

Mobile wireless broadband providers must either dispute and rebut a cognizable challenge or concede it and have the challenged area identified on the mobile coverage map removed.

Providers may rebut a challenge with on-the-ground test data or, in certain circumstances, infrastructure data, so that the FCC can resolve the challenge.

• Crowdsource Process. The BDA requires the FCC to “develop a process through which entities or individuals … may submit specific information about the deployment and availability of https://play.google.com/store/apps/details?id=com.samknows.fcc&hl=en_US https://apps.apple.com/us/app/fcc-speed-test/id794322383 broadband internet access service … on an ongoing basis … to verify and supplement information provided by providers.” Consumers and third-party entities may submit crowdsource data to the FCC via the App. The mobile crowdsource data are reviewed and evaluated by the

FCC staff to determine whether there is a credible basis for a mobile verification inquiry, described below.

• Verification Process. The BDA requires the FCC to verify the accuracy and reliability of the broadband Internet access service data that service providers submit. For mobile verification inquiries, FCC staff may request and collect verification data from mobile wireless broadband providers on a case-by-case basis where staff have a credible basis for requiring verification of a provider’s coverage data. Staff will rely upon all available evidence to determine whether there is a credible basis for initiating a verification inquiry.

The FCC will supply mobile wireless broadband providers with a statistically valid sample of an area subject to a verification request (the target area). In response to the verification request, a mobile wireless broadband provider must submit either on-the-ground test data or infrastructure information for the specified area(s). The provider may choose to use the FCC Speed Test app to conduct on-the-ground test data collection. FCC staff will analyze the information submitted by a provider in response to a verification request to determine whether the provider has successfully demonstrated accurate coverage in the targeted area. FCC staff may ask the provider for additional information to help determine whether the provider has demonstrated coverage in the targeted area.

The FCC may also conduct general data quality checks separately from the formal verification process. These general data quality checks would focus on review of the availability data based on submitted supporting data.

• Audit Process. The BDA requires the FCC to conduct audits of information submitted by providers. FCC staff may randomly conduct audits of a provider’s coverage area to verify coverage, and request and collect data in conjunction with such audits. Audit tools could include field surveys, investigations, and on-the-ground speed tests, including tests taken by the FCC

Speed Test app. In addition, audits may be initiated based on an unusual number of crowdsource complaints.

3. Objectives & Scope

The FCC seeks a Contractor with the capability to develop, operate, and maintain an ad-free FCC Speed

Test app, at no cost to the end user that is available on both the Google Play and the Apple App Store for personal Android and iOS mobile devices, respectively. FCC Speed Test app users must be able to initiate mobile challenge and mobile crowdsource tests on the App, which will test the availability and performance of their mobile network connection by collecting and transmitting specific metrics about the connection. App users choosing the mobile challenge test option must be able to dispute the coverage claimed by their mobile broadband provider. The results of each test, as well as certain information about the challenger, including the location of the challenge and contact information (which qualify as PII) would be transmitted to the Contractor’s database. The Contractor would then compile and transmit the data to the FCC on an agreed-upon regular basis (at least monthly) per the data type and format requirements set forth under the relevant sections in BDC Data Specification for Mobile Speed Test Data

(https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec). Information about the current FCC Speed Test app’s test-system architecture and methodology is provided in 2022 FCC Speed Test App Technical

Description (https://www.fcc.gov/file/24078/download). To ensure the network performance metrics are https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec https://www.fcc.gov/file/24078/download unbiased, the Contractor must acquire and maintain a sufficiently dense network of carrier-neutral test servers, and the App must select the most optimal test-server located close to a major internet exchange point within the United States when conducting each network performance measurement initiated by a mobile device.

For reference, the BDC program’s current version of the FCC Speed Test app can be downloaded for

Android and iOS, and its wireframes are also attached herewith: FCC_Android_UI.pdf and

FCC_iOS_UI.pdf. However, the current App does not implement every functionality requirement described in this PWS. Additional details on the current app are available at https://www.fcc.gov/BroadbandData/consumers, and a consumer guide is available at https://www.fcc.gov/consumers/guides/fcc-speed-test-app-tip-sheet. The details of specific functional and technical requirements, deliverables, and schedules for this contract are further outlined below.

See also Mobile Speed Test API specification, available at https://us-fcc.box.com/v/bdc-mob-speed-test-api-swagger.

4. Detailed Requirements

4.1 Task 1: Master Plan

The Application Development (Task 2) requirement of the FCC Speed Test app shall be completed as soon as possible, no later than July 14, 2023. Accordingly, the Offeror shall develop and submit with its proposal a Master Plan that provides a comprehensive approach and timeline for meeting the objectives and requirements outlined in this PWS.2 The Offeror’s Master Plan for development shall include, but not be limited to, a project management plan, staffing and training plan, technical strategic plan, status and progress reporting, quality control, risk management, milestone schedule, and support for a range of stakeholder communications and briefings to ensure project completion within this timeframe. The FCC will work with the selected Offeror upon award of the contract to review, update, and finalize these draft plans within two weeks after award, unless there are delays in the onboarding process within the FCC’s control. The Offeror’s proposed Master Plan shall include milestones for app development and the FCC’s beta testing, review, and approval of the App and the overall infrastructure by July 14, 2023, prior to public deployment of the App in app stores.

The proposed and final Master Plan shall include, at a minimum, the following elements:

1. Project Management Plan including key activities, milestones, and government review/approval points throughout the period of performance.

2. Staffing and Training Plan documenting personnel to be utilized on the effort and their qualifications, including the overall approach to ensuring availability of, and necessary training for, qualified personnel on an ongoing basis. If sub-contracting any portion of the work, provide the name(s) and address(es) of all subcontractor(s) (if applicable) and a description of their planned subcontracting effort.

3. Technical Strategic Plan detailing how the Offeror will implement and satisfy the overall

FCC Speed Test app design, test-system architecture, and operation requirements, including maintenance support and end-user support of the App. The Offeror shall provide details on how it will meet the Contractor’s obligations to acquire and maintain a sufficiently dense

2 For purposes of this PWS, “Offeror” is a potential vendor submitting an offer or bid to fulfill the contract of this

PWS. “Contractor” is the Offeror who is awarded this contract and must then perform the terms of this contract.

https://play.google.com/store/apps/details?id=com.samknows.fcc&hl=en_US https://apps.apple.com/us/app/fcc-speed-test/id794322383 https://www.fcc.gov/BroadbandData/consumers https://www.fcc.gov/consumers/guides/fcc-speed-test-app-tip-sheet https://us-fcc.box.com/v/bdc-mob-speed-test-api-swagger https://us-fcc.box.com/v/bdc-mob-speed-test-api-swagger network of carrier-neutral test servers.3 The Offeror shall include any additional app features and costs proposal for Android and/or iOS devices for FCC’s consideration.

4. Quality Assurance Plan documenting the approach to be used to ensure high-quality and on-time delivery of the end-product, including proposed key performance indicators (KPIs).

5. Communications Plan including approach to engaging with FCC leadership, technical personnel, and other external stakeholders (as needed) to support the requirements of this

PWS, provide progress updates, and confirm any required customization of the design elements to meet FCC needs. Additionally, the communications plan shall document the communications channels, escalation path, and response timeline within the Offeror’s organization for resolution of any critical issues unable to be resolved through the

Contractor’s Project Manager.

6. Documentation Development Plan including any technical reference documents and other end-user support resources including, but not limited to, test-system architecture description/schematic, measurement technique, data dictionary, functionality description, user guide, FAQs, and app stores’ product page contents that the Offeror will develop for public release and FCC’s internal needs, and the timeline for the development of such documents.

7. Security/Privacy Compliance Plan including SOC-2 report and any additional required documents to satisfy requirements under the Federal Information Security Modernization Act

(FISMA)4 and applicable guidance; evidence of its Incident Response Plan and Breach

Response Plan; and evidence of compliance with Privacy Federal Acquisition Regulation

(FAR) clauses—all as discussed at greater length below in Task 3 and Section 8.

Sample timeframes are offered below; however, the Offeror should propose the timing and schedule that best fits the requirements of this PWS to work with the FCC post award to review, update, and finalize these draft plans prior to initiation of Task 1.

Sample Timeline

• Week 1 (between award and kickoff): Contractor ramp up and finalize the Master Plan submitted in the proposal.

• Week 2: Develop, document, and finalize test-system architecture schematic and test server plan (e.g., geographical distribution, performance, reliability, capacity, failover, redundancy, scalability).

• Week 3: Review and finalize implementation plan of the FCC’s mobile wireless broadband performance measurement methodology standard.

• Week 4: Develop FCC Speed Test app UI/UX wireframes.

• Week 5: Finalize wireframe design, implementation approach, and milestones.

• Week 6-7: Execute and develop approved wireframe design.

3 See Mobile Technical Requirements Order, DA-22-241, para. 26 (https://www.fcc.gov/document/fcc-releases-bdc-mobile-technical-requirements-order).

4 Pub. L. No. 113-283, 128 Stat. 3073 (2014).

• Week 8-9: Conduct alpha-app testing and measurement performance/result validation against the current FCC Speed Test app. Troubleshoot and finalize alpha-app, test-system/server testing.

• Week 10-11: Perform and complete testing of beta-app, validation and verification of test-system/server, backend system and database, data transmission to the BDC System, etc.

• Week 12: Finalize technical documents, data dictionary, Google Play and Apple App Store product page contents, FAQs, and user guide.

• Week 13: Perform final user testing, verification, and validation testing of the overall system and troubleshoot/modify as needed.

• Week 14: Final product launch.

4.2 Task 2: Application Development and Deployment

The Contractor shall complete the Application Development (Task 2) requirement of the FCC Speed

Test app no later than July 14, 2023. The Contractor shall adopt the FCC Speed Test app’s current speed test methodology used to measure and collect the required mobile wireless broadband performance metrics and shall disclose the location of all the servers used in these measurements.

See 2022 FCC Speed Test App Technical Description (https://www.fcc.gov/file/24078/download).

Consequently, the App’s overall measurement performance must be vetted through and comply with the OET’s speed test app performance review procedure described in Appendix A of OET Bulletin No. 75 (https://www.fcc.gov/sites/default/files/oet75.pdf).

No later than July 14, 2023, the Contractor shall complete the development requirements and, by July

31, 2023, make publicly available a new FCC Speed Test app to allow consumers and third parties

(e.g., state and local governments, service providers) to submit mobile speed tests and broadband performance measurements to the FCC in support of the BDC mobile challenge process and crowdsource data collection efforts. The App shall not include options to perform speed tests on Wi-

Fi networks or other types of network/speed tests, functionalities, or data collections other than the specified challenge and crowdsource processes set forth herein. The Contractor shall ensure that the new FCC Speed Test app is available throughout the United States and its territories for download on both Android and iOS devices via Google Play and Apple’s App Store, respectively, and on other devices/operating systems as directed by the FCC. The Contractor shall produce technical documents of the FCC Speed Test app’s test-system architecture description/schematic, measurement technique, data dictionary, functionality description, user guide, FAQs, and app stores’ product page contents available to the FCC for review and publication.

The new FCC Speed Test app shall be made available at no cost to the public, and without advertisements or elements not specified or directed by the FCC. This also includes the requirement to provide notice to existing users of the migration to the new App (see 4.6 Task 6: Facilitation of

Program Transition Activities). The App will allow users to run a speed test, with user consent for collection of certain PII, that collects the required information listed below. The data gathered in the process shall be regularly provided to the BDC System via an API at an interval specified by the

FCC. Upon FCC’s request, the Contractor shall provide the data in CSV or other file formats on a regular basis via a secure technical manner that the FCC determines is appropriate to safeguard the information using an API, file transfer protocol (FTP), or alternative methods directed by the FCC and for the convenience of the FCC.

https://www.fcc.gov/file/24078/download https://www.fcc.gov/sites/default/files/oet75.pdf

As an example of a streamlined process, the App would require the user’s contact information and user consent for collection of PII data prior to performing a speed test. If the user intends to perform a challenge test by including the device’s phone number, the App will initiate the challenge process.

If the phone number is not provided, the App will initiate the crowdsourcing process. The following further outlines the requirements of the challenge and crowdsource options:

• Crowdsource Option [see 47 CFR § 1.7006(b)]: The FCC Speed Test app will allow a consumer to submit crowdsource data. Under this option, the FCC Speed Test app will collect all available information listed in subsection number 1, and provide the capabilities listed in subsection number 2(a) below.

• Challenge Option [see 47 CFR § 1.7006(e)]: The FCC Speed Test app will allow a consumer to submit a challenge filing using the App. Under this option, the FCC Speed Test app will collect all available information listed in subsection number 1, and provide the capabilities listed in subsections 2(a) and 2(b) below.

Each option shall comply with a corresponding privacy policy and data implication notice provided by the FCC. See FCC Speed Test App Privacy Notice and Terms of Use

(https://www.fcc.gov/general/mobile-broadband-performance-application-privacy-notice-and-terms-use).

1. The FCC Speed Test app shall collect and be capable of submitting to the FCC via a secure technical manner that the FCC determines is appropriate to safeguard the information using an API format specified by the FCC, the information required for each option listed above, consistent with the latest BDC Mobile Speed Test Data Specification document (https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec).

2. The FCC Speed Test app shall provide the capabilities listed below. For unbiased test-sample collections, both processes below, once initiated and completed, shall automatically submit all test results without a user option to cancel or purge test results. These will be based on logic and process flows to be mutually agreed upon by the FCC and the Contractor.

(a) For both challenge and crowdsource data filings, the App shall:

(1) Prior to initiating a speed test, allow users to affirmatively consent to the submission of certain PII in order to participate in the mobile challenge and crowdsource processes.

(2) Store and transmit to the BDC System the name and email address entered by the user.

(3) Require users to certify: “To the best of my actual knowledge, information, and belief, all statements provided are true and correct.”

(4) Include (text and/or link) a privacy notice about how all the data collected by the app, including PII, will be stored, used, and protected.

(5) Have the App automatically submit all the information necessary for crowdsource process or required to support a challenge to the FCC directly from the mobile device, per the requirements detailed in the current BDC Mobile Speed Test Data Specification document.

(6) Have a “store-and-forward” capability that will (i) record when and where the App failed to establish a connection with a mobile network and hence to complete a test, and (ii) submit the required information for the test attempt once a network connection can be established.

https://www.fcc.gov/general/mobile-broadband-performance-application-privacy-notice-and-terms-use https://www.fcc.gov/general/mobile-broadband-performance-application-privacy-notice-and-terms-use

(b) For the challenge filing, the App shall additionally:

(1) Require users to certify that the user subscribes to the service being tested or is an authorized user of the mobile provider whose coverage is being tested.

(2) Require users to certify that the mobile data service option is “on,” and the airplane mode is “off.”

(3) Require users to certify that the speed test measurements were taken outdoors.

(4) Automatically determine, or require user to input, the 10-digit phone number associated with the device used to conduct challenge tests.

(5) Require users to take challenge speed test measurements on a mobile wireless broadband network; this should not include tests on Wi-Fi networks or speed tests using anonymized data.

(6) Require users to certify that the mobile device and the speed test application are in ordinary working order without any device or functional modifications/restrictions affecting its connection performance or technology type. “Ordinary working order” may be further defined and clarified by the FCC.

(7) Require users to certify that their provider may respond to a challenge by sharing with the FCC specific information about the service that it provides to the user.

(8) Require users to indicate whether each test was taken in an in-vehicle mobile or outdoor pedestrian/stationary environment.

3. In addition, the UI/UX and functional capabilities listed below must be implemented in the

App, unless restricted by Android and/or iOS operating systems. Additional features may be further defined by the FCC for UI/UX and usability improvements. For reference, the BDC program’s current version of the FCC Speed Test app can be downloaded for Android and iOS, and its wireframes are also attached herewith: FCC_Android_UI.pdf and

FCC_iOS_UI.pdf. However, the current App does not implement every functionality described below. Additional details on the current app are also available at https://www.fcc.gov/BroadbandData/consumers, and a consumer guide is available at https://www.fcc.gov/consumers/guides/fcc-speed-test-app-tip-sheet.

(a) Display to the user and record the network connection technology type (e.g., 3G, 4G, 5G).

(b) Measure download and upload speeds, round trip latency, packet loss, and jitter.

(c) Allow users to take automated background crowdsource tests and to customize the cadence, date, and time range for such tests.

(d) Require users to consent to the automated storage, transmittal to the FCC, and sharing with their provider the PII required by the App for fully automated continuous background crowdsource tests per part (c) specifications above.

(e) Display test history, charts of test statistics, and test location map.

(f) Allow users to save and export (via email or other transmission capabilities offered on the mobile device) a file containing test results.

(g) Enable users to specify a limit on the amount of data used by the App each month or period.

(h) Display to the user and record the name of the mobile network service provider.

https://play.google.com/store/apps/details?id=com.samknows.fcc&hl=en_US https://apps.apple.com/us/app/fcc-speed-test/id794322383 https://www.fcc.gov/BroadbandData/consumers https://www.fcc.gov/consumers/guides/fcc-speed-test-app-tip-sheet

4.3 Task 3: Technical Management

The Contractor will provide the technical administration of the App, including the collection and storage of test measurement data, as well as monitoring and maintaining the health of the measurement network on a continuous basis.

The Contractor shall report to the FCC on how it is implementing and complying with the following requirements:

1. The Contractor shall transmit challenge process and crowdsource data collected from devices to the Contractor’s hosting solution via a secure manner that satisfies FISMA, the FCC’s Risk

Management Framework (RMF), FCC policies, and/or other applicable Federal laws and requirements, and that the FCC determines to be appropriate to safeguard the information.

2. Any cloud solution to host challenge process and crowdsource data shall have at least one of the following certifications that is valid as of the date of proposal submission: FedRAMP

Moderate (preferred), ISO 27001 certification, or Cloud Security Alliance STAR Level 2 certification. For the preferred FedRAMP certification, ensuring that the host solution itself is FedRAMP certified (Software as a Service) is the most preferable, followed by certification of the platform (Platform as a Service) and lastly the infrastructure

(Infrastructure as a Service).

• Offeror shall provide documentation, including the relevant SOC 2 report, as part of their technical response confirming that the certification(s) held are valid as of the date of proposal submission.

3. Any on-premise solution to host challenge process and crowdsource data shall comply with

FISMA, the FCC’s RMF, FCC policies, and/or other applicable Federal laws and requirements.

4. Upon award, whether Contractor’s hosting solution is cloud-based or on-premise, Contractor shall work with FCC IT to ensure that its complete offering complies with FISMA, the FCC’s

RMF, FCC policies, and/or other applicable Federal laws and requirements.

5. Offeror shall submit as part of their technical response a complete Software Bill of Materials

(SBOM) as defined in Executive Order 14028. The SBOM shall follow the Minimum

Elements for Software Bill of Materials (SBOM) developed by the US Department of

Commerce.

6. The Contractor shall record and store, for a period to be determined by the FCC, the data collected from all mobile challenges and mobile crowdsource data filings. The Contractor shall also increase the data warehousing and storage necessary to accommodate the increased data volume resulting from the data collected through the App’s functionalities. The

Contractor shall maintain and process all FCC Information5 containing PII on servers located in the United States.

5 FCC Information refers to single or multiple instances of facts, data, ideas, knowledge, instructions, etc. that

Contractor receives, obtains, or accesses under the Contract in any medium or form that can be stored, transferred, communicated, or processed.

7. The Contractor shall maintain the privacy of consumer data, including PII. The Contractor shall at a minimum maintain appropriate administrative, technical, and physical safeguards to ensure the security of the PII collected by the FCC Speed Test app against any hazards to the confidentiality, integrity, or availability of those data and conform to the specific terms of the

FCC’s Privacy and Security Policy(ies), relevant sections of NIST SP 800-53 (“Security and

Privacy Controls for Information Systems and Organizations,” Rev. 5 or any subsequently applicable version), NIST SP 800-163 Rev. 1 (“Vetting the Security of Mobile

Applications”), and other terms and conditions developed for each testing effort.

8. The Contractor shall propose to the FCC and, upon agreement, deploy and operate a test-system infrastructure sufficient to meet the needs of testing and measurement as described herein, with carrier-neutral test servers distributed geographically close to major internet exchange points throughout the United States and its territories (including in Pacific territories, Puerto Rico, and U.S. Virgin Islands) practically sufficient and statistically viable to minimize any network biases and latency impacts on measurements conducted for each test filing.

9. The Contractor shall monitor, maintain, and ensure the health and quality of the test-system and measurement infrastructure and all data collected for reporting purposes.

10. The Contractor shall collect and audit data on the health and quality of the overall system on a continuous basis.

11. The Contractor shall develop and maintain all system and network administration staff and resources to ensure the quality of the collection process and address any issues that may arise.

12. The Contractor shall provide data collected, as applicable, to support this deliverable including, but not limited to, measurement server connectivity statistics including intra-server speed and performance measurements; measurement server virtual and physical host process and utilization statistics; and data supporting monitoring and auditing of health of the entire measurement server infrastructure as directed by the FCC.

13. The Contractor shall perform data processing and analysis on a continuous basis to check for any anomalies in the measurements. If the Contractor identifies a discrepancy, report this immediately to the FCC, support the FCC for data tracing of affected records if transmitted to the FCC, and take necessary action to mitigate impact on ongoing data collection.

14. At the direction of the FCC, the Contractor shall perform a manual review process of test data on a regular basis to ensure as a second check across automated systems.

15. The Contractor shall monitor the working and performance of test servers on a continuous basis to check for and identify any problems. If the Contractor identifies a problem with any test server, the Contractor shall inform the FCC of the problem immediately and develop a solution to resolve the problem within 24 hours. The Contractor shall continue to monitor the server and data until the problem is resolved and shall clearly identify the questionable measurement data collected from the faulty server or servers. The Contractor shall take all action necessary to resolve the problem as soon as possible, notify the FCC when the problem has been resolved, and provide a report on what caused the problem, how it was resolved, and any steps taken to prevent the problem from occurring again.

16. In the event of a test server failure, the Contractor shall work closely with the relevant server and/or system provider(s), if any, to repair the problem. The Contractor shall inform the FCC of the problem immediately and develop a solution to resolve the problem within 24 hours.

The Contractor shall continue to monitor until the problem is resolved and shall clearly identify the questionable measurement data collected from the test server. The Contractor shall monitor any new server or other network change(s) that may be introduced by the provider(s) as a potential solution to the problem.

17. At the direction of the FCC, the Contractor shall periodically, as mutually agreed, compare the results of all the servers connected with the FCC Speed Test app and perform analyses to identify discrepancies or anomalies observed in the measured performance results. Also, the

Contractor shall perform a root cause analysis on any App or test server issues upon FCC’s requests.

18. The Contractor shall transmit challenge and crowdsource data collected from the FCC Speed

Test app via a secure technical manner that the FCC determines is appropriate to safeguard the information to the FCC using an API, and other methods and formats specified by the

FCC, at mutually-agreed intervals (but no less frequently than monthly) and consistent with the requirements adopted by the FCC in the Mobile Technical Requirements Order. The FCC will provide BDC System registration instructions and assistance required for transferring data specified in BDC Data Specification for Mobile Speed Test Data (https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec) to its system. The Contractor shall transfer data in a secure manner using methods directed by the FCC and for the convenience of the

FCC. The Contractor shall make the full set of data collected available to the FCC. It shall also provide summary reports of the data at the direction of the FCC and in a format to be specified by the FCC.

19. At the direction of the FCC, the Contractor shall provide monthly reviews to the FCC regarding the health of the measurement infrastructure and the data collection process.

4.4 Task 4: Operation, Maintenance, & Support Requirements

To continue operation of the FCC Speed Test app under its brand name, the Contractor shall complete the tasks involved with transfer of the current “FCC Speed Test” app brand in Google Play and Apple

App Store to the Contractor’s account to retain the brand and existing userbase by no later than July

31, 2023. The Contractor shall provide maintenance support and end user support for the App. On the Technical Strategic Plan of the Master Plan, the Contractor shall document the full range of support included in its proposed solution to include, but not limited to:

• Approach to providing access to updated features and functionality through regular updates.

• Ensuring user-friendly interface, functional, system architecture, and backend system customizations, if any, are preserved and fully functional following any updates.

• Approach to providing any security updates required to maintain system security in accordance with FCC and broader Federal security policies and mandates.

• Approach to providing access to help desk support to respond to technical issues or end-user questions, including expected response time; and

• Approach to providing access to and availability of self-service support through a range of technical and end-user reference documentation (e.g., technical manuals, user guide, FAQs) on FCC’s and/or Contractor’s websites.

The Contractor shall fully support the FCC Speed Test app’s mobile challenge process and crowdsource process. Any system performance, data, UI/UX, and functional errors or inconsistences with the requirements and specifications set forth herein shall be corrected in a timely manner, based on a schedule to be coordinated with and approved by the FCC. The Contractor shall provide an overall system that accurately measures the specified parameters and meets a high level of scientific and engineering quality.

1. The Contractor shall, at the direction of the FCC and at no additional cost to the Government, resolve any FCC Speed Test app problems or bugs identified by the FCC or App users.

2. The Contractor shall provide customer support for the FCC Speed Test app users via email, phone, and/or other communication channels for technical issues including, but not limited to, troubleshooting errors, downloading/installing the app, submitting speed test data through the app, etc. The Contractor shall monitor (and resolve as necessary) comments on the Google

Play and Apple App Store for customer support-related questions from users.

3. The Contractor shall ensure that the FCC Speed Test app and its underlying support systems are properly connected and configured to submit mobile broadband challenge process and mobile crowdsource data to the FCC; and are up-to-date and compatible with all current and future Android and iOS operating systems and devices supported by Google and Apple for current and future mobile network technologies. The Contractor shall perform any necessary integration with the backend of the BDC System, and such integration shall be completed by

July 31, 2023, or a later date as directed by the FCC.

4. On or before July 14, 2023, or at a later date as directed by the FCC, the Contractor shall initiate a beta launch of the FCC Speed Test app to enable it to monitor the App’s performance and correct any deficiencies and other issues prior to the public launch. The beta launch would include activities such as preparation of data exports for FCC staff and error detection/correction, and quality testing of the App and its test-system architecture, backend system, data transmission to the BDC System, and similar functionalities. The beta launch will incorporate live data prior to launch to the extent possible, except that artificial

PII may be required as necessary to ensure compliance with applicable privacy requirements.

5. At the direction of the FCC, the Contractor will prepare weekly usage reports on progress of the development and roll-out of the application, take-up statistics, issues, and risk register.

The Contractor shall propose data analysis techniques and analytics report templates for the

FCC to agree upon report data and formats to be used in providing weekly status updates and executive briefings upon request.

6. At the direction of the FCC, the Contractor will prepare additional client support materials for launch of the FCC Speed Test app, including a user guide, a data dictionary for data format, FAQs, and technical specification documents.

7. The Contractor shall support the intake, review, assessment, and triage of the FCC Speed Test app inquiries from FCC staff and other sources identified by the FCC, which will assist FCC personnel in prioritizing, sequencing, and executing the required analyses, reporting, and troubleshooting within specified timeframes. The Contractor shall also provide higher-tier technical assistance with FCC Speed Test app inquiries from FCC stakeholders and the public, specifically the review, analysis, and recommended resolution of certain trouble tickets received through the BDC Help Center (https://help.bdc.fcc.gov/hc/en-us).

8. All the data collected by the App shall be regularly provided to the FCC at an interval specified by the FCC. The Contractor must store, compile, and transmit the challenge process and crowdsource collected data to the BDC System via a secure technical manner that the FCC determines is appropriate to safeguard the information using an API format consistent with the latest BDC Mobile Speed Test Data Specification document (https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec). Upon FCC’s request, the Contractor shall provide the data in CSV or other file formats via a secure technical manner using FTP or alternative methods directed by the FCC and for the convenience of the FCC.

4.5 Task 5 (Optional): Special Projects

At the FCC’s discretion during any performance period, but only upon the FCC’s review of the

Contractor’s proposal and written authorization to proceed, the Contractor shall provide services to support Special Projects to provide additional analytical, consulting, and advisory support related to the task areas above. This optional work may be directed on a labor-hour basis, within the ceiling established under the contract, or may be performed on a Firm Fixed Price basis agreed upon in a bilateral modification.

As technology changes or when special situations arise, this optional task provides the flexibility for the FCC to obtain from the Contractor additional support for the tasks of this contract, and other related requirements, as may be necessary.

4.6 Task 6 (Optional): Additional App Features

The Offeror shall document any additional proposed app features for Android and/or iOS devices in its Technical Strategic Plan of the Master Plan for FCC’s consideration. Additional features, if approved by the FCC for implementation, are not required to be completed by July 14, 2023, but until a mutually agreed upon date between the FCC and the Contractor. The optional proposal for additional app features may include, but is not limited to:

(a) Geo-targeted automated testing for a user-defined point-radius.

(b) Display heat maps showing provider-specific mobile availability data (https://us-fcc.app.box.com/v/bdc-data-downloads-output).

(c) Map displaying publicly available cellular tower locations and parameters.

(d) Map displaying H3 hexagonal grids (https://h3geo.org).

(e) Scheduling of multiple tests in sequence.

(f) Line charts showing changes over time.

This optional work may be performed on a Firm Fixed Price basis, within the ceiling established under the contract.

4.7 Task 7 (Optional): Facilitation of Program Transition Activities

In the event of exercise of this optional CLIN in anticipation of the termination of this contract and discontinuance of use by the FCC of the FCC Speed Test app (in whole or in part), the Contractor shall, for a term of not exceeding six months after such exercise:

https://help.bdc.fcc.gov/hc/en-us https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec https://us-fcc.app.box.com/v/bdc-data-downloads-output https://us-fcc.app.box.com/v/bdc-data-downloads-output https://h3geo.org/

1. Provide support for informing the installed userbase from the FCC Speed Test app and facilitating transition of users to a new application, as identified by and at the direction of the

FCC.

2. Should the FCC desire the transition of all installed users to a new application, the Contractor shall, for both the iOS and Android versions of the FCC Speed Test app:

a. Update the FCC Speed Test app to disable or remove all testing functionality from the

App.

b. Update the FCC Speed Test app to provide an alert informing the user to uninstall the existing App and redirecting the user to any new application, as identified and instructed by the FCC.

c. Transfer ownership of the now-disabled App in the Apple App Store and Google Play to the FCC (including, but not limited to, a developer account identified by the FCC).

3. Should the FCC continue use of the FCC Speed Test app delivered under this contract, the Contractor shall support any requested notification to and transition of users to the new Contractor's account and FCC Speed Test app for purposes of the BDC or other FCC programs.

4. The Contractor shall ensure that all data collected through the challenge process and crowdsource process have been transmitted to the BDC System via a secure technical manner that the FCC determines is appropriate to safeguard the information using an API format consistent with the latest BDC Mobile Speed Test Data Specification document (https://us-fcc.app.box.com/v/bdc-mobile-speedtest-spec). Upon FCC’s request, the Contractor shall provide the data in CSV or other file formats via a secure technical manner using FTP or alternative methods directed by the FCC and for the convenience of the FCC.

5. Nothing herein shall prevent, in the event of termination of use of the FCC Speed Test app by the FCC, the continued use by the Contractor of its proprietary application in the Apple App

Store or Google Play or other platform, provided, however, that the Contractor will cease use of the now-disabled App and installed userbase of the FCC Speed Test app and relaunch its own app without any reference to or affiliation with the FCC and FCC Speed Test app in its launch of a Contractor’s new application.

5. Optional Task Exercise Procedure

Work under Optional Task 4.5 and 4.6 may be exercised by the FCC, in its sole discretion, as often as it requires and as funding allows. When an optional task is exercised, the FCC shall send the Contractor a work plan, which shall detail requirements, deliverables, and timelines and provide a labor-hour estimate or firm fixed price and proposed ceiling amount to…