Attachment_1_SOW.pdf

Statement of Work (SOW)

Bureau of Indian Affairs (BIA)

Office of Justice Services (OJS)

Electronic Cell Check

Table of Contents

1.0 General

2.0 Background

3.0 Requirements

3.1 Place of Performance

4.0 Scope

5.0 Regulatory Compliance

6.0 Components

6.1 Location Tags

6.2 Inmate Identification

6.3 Mobile Device

6.4 Management Platform

7.0 Functions

7.1 FedRAMP cloud-based system

7.2 Mobile Device Functions

7.2.1 Logging

7.2.2 Inmate Movement Tracking

7.2.3 Alerting

7.3 Reporting

7.4 Access and Authentication

7.5 Audit Trail

7.6 Data Currency

7.7 Recoverability

7.8 System Availability

7.9 Fault Tolerance

7.10 Performance

7.11 Data Retention

7.12 User Capacity

7.13 Security Roles

8.0 Processes

8.1 Current

8.2 Future

9.0 Tasks

9.1 Help Desk and Support Services

9.2 End-User Account Administration and Services

9.3 Technical Engineering Support, Software Development, and Maintenance

9.4 Training

10.0 Deliverables

10.1 Requirements

10.1.1 Routine Deliverables

10.1.2 Quality Measures

Appendix A OJS Regulations

Table of Figures

Figure 1: Current State OJS Cell Check Process Figure 2: Future State Electronic Cell Check Process

List of Tables

Table 1: Security Roles

This Document Contains Controlled Unclassified Information (CUI)

Office of Information Management Technology 1

1.0 General

The Department of the Interior, Bureau of Indian Affairs (BIA), Office of Justice Services (OJS) has a requirement for a FedRAMP authorized vendor to provide a turn-key cloud-based electronic cell check system with integrated mobile devices to perform electronic cell checks at twenty (20) BIA OJS detention facilities listed below. The system must be capable of providing real-time reporting and include daily weekly, and monthly logs.

Contractor shall provide delivery and training schedule by facility.

2.0 Background

The BIA OJS goal is to provide a safe and secure setting for Native American Inmates incarcerated in the BIA detention facilities.

Currently, inmate cell checks are completed manually and later hand-written into various logs. This is a challenge for the staff doing this manually because the documented cell checks on all inmates are not completed in real-time and poses many risks to the information not documented immediately or accurately. This would include inmates at risk leading to in-custody deaths, overdoses or serious injuries in the detention facilities.

BIA Detention Programs Physical Location Bed Capcity

District 1

1 Fort Totten Adult Correctional Facility 105 2nd Avenue North, Fort Totten, ND 58335 30

2 Lower Brule Adult Correctional Facility 100 Akicita O'Tipi Drive, Lower Brule, SD 57548 64

3 Standing Rock Adult Correctional Facility Proposal Avenue, Bldg #51, Fort Yates, ND 58538 48

4 Standing Rock Juvenile Correctinal Facility 9323 Hwy 24, Fort Yates, ND 58538 16

5 Turtle Mountain Adult Correctional Facility 1310 Francis Sinclair Street, Belcourt, ND 58316 30

6 Yankton Adult Correctional Facility 29797 South Main Avenue, Wagner, SD 57380 38

District 3

7 Eastern Nevada Adult Correctional Facility 1407 OPD Road, Owyhee, NV 89832 39

8 Hopi Adult Correctional Facility Hwy 264 Mile Post 397.5, Keams Canyon, AZ 86034 60

9 Supai Adult Holding Facility 1010 East Main Trail, Supai, AZ 86435 6

10 Uintah and Ouray Adult Holding Faciilty 7139 East 1000 South, Ft. Duchesne, UT 84026 10

District 4

11 Ute Mountain Ute Adult Correctional Facility107 Spruce Street, Towaoc, CO 81334 54

12 Ute Mountain Ute Juvenile Correctional Facility107 Spruce Street, Towaoc, CO 81334 22

20 Mescalero Adult Correctional Facility Mescalaro, NM - addresss To be announced. 30

District 5

13 Blackfeet Adult Correctional Facility 126 Agency Square, Browning, MT 59417 44

14 Fort Belknap Adult Correctional Facility 200 Sullivan Ave, Fort Belknap Agency, Harlem, MT 59526 16

15 Northern Cheyenne Juvenile Correctional Facility100 Mennonite Road, Busby, MT 59016 36

16 Northern Cheyenne Adult and Juvenile Holding Facility120 Sun Bear Road, Lame Deer, MT 59043 10

17 Rocky Mtn Regional Detention Facility 1015 North Lessard Avenue, Hardin, MT 59034 100

18 Wind River Adult Correctional Facility 109 Norkok, Fort Washakie, WY 82514 26

District 8

19 Spokane Adult Holding Facility 249 Agency Square, Wellpinit, WA 99040 10

Office of Information Management Technology 2

3.0 Requirements

OJS requires a system to be aligned with Federal Cloud Smart Computing Strategy, FedRAMP authorized and other related federal and Department of the Interior security and privacy requirements with multi-factor authentication.

The environment shall include essential cloud characteristics including flexibility, scalability, on-demand self-service, broad network access, resource pooling, rapid elasticity, and measure services.

This effort includes daily operations of the OJS Electronic Cell Check system, and the restoration of service in the event of scheduled or unscheduled outages. The following tasks and services are required:

1. Help Desk Support & Services

2. End-User Account Administration and Services

3. Technical Engineering Support, Software Development and Maintenance

3.1 Place of Performance

Contractor personnel are authorized to work remotely to provide support. Occasional travel to provide onsite support at OJS detention facilities will be required and travel costs will be subject Federal Travel Regulations and the terms of the contract.

https://cloud.cio.gov/strategy/ https://cloud.cio.gov/strategy/

Office of Information Management Technology 3

4.0 Scope

The Contractor shall provide a cloud-and-mobile based electronic cell check system and devices in individual inmate cells and common areas. The integrated system shall allow OJS officers to observe inmates within established timeframe and document their observations. The system shall meet the specifications below:

• Electronic cell checks using a mobile handheld device

• Automatic recording on an electronic log accessible by management/staff

• Fully Customizable

• Alert systems concerning compliance

• Automated/Real time reporting

• Compliance failure notice of electronic cell checks

• Add notes and observation to cell checks, as needed

• Interfacing with current BIA jail management systems

• Optional medication recording

• Optional wristbands for inmates, cards or tags

• Cloud storage with required security FEDRAMP

• Virtual training either in facilities or regional sessions and onsite training if needed

• Either hard copy or electronic operation manuals that can be printed if needed.

• Maintenance and replacement plan for sensors, inmate bracelets and hand-held devices

5.0 Regulatory Compliance

The OJS Electronic Cell Check Cloud System shall be designed to abide by and enforce the applicable rules and regulations that guide the operation of the Office of Justice Services (Appendix A).

Office of Information Management Technology 4

6.0 Components

6.1 Location Tags

Location Tags shall be installed at each correction facility identified and will not be connected to any power or wiring.

6.2 Inmate Identification

The Contractor shall provide identification tags to work with the system. These tags shall be either in the form of a wristband or ID card.

6.3 Mobile Device

• Mobile devices shall be dust and waterproof, meet Military Standard 810G protections in regard to drops, shock, vibrations, high altitude, humidity, icing, freezing rain, and temperature.

• Devices are preprogrammed and shipped ready to use.

• The vendor shall provide device management through their own system too allow for updates.

• The devices provided shall come with rubber protective shells for the devices, screen protectors, heavy duty nylon holsters, as well as multi-port charging stations for the devices.

6.4 Management Platform

The vendor shall provide secure access to a web and cloud enabled management platform for BIA.

Office of Information Management Technology 5

7.0 Functions

The system will provide the following features and functionality:

7.1 FedRAMP cloud-based system

FedRAMP is a unique Government program that is at the epicenter of cloud technology, cybersecurity, and risk management. FedRAMP provides a standardized framework to security assessment, authorization, and continuous monitoring for cloud products and services. This framework uses a “do once, use many times” approach that saves an estimated 30-40% of government authorization costs, by reducing both time and staff required to conduct Agency security assessments. BIA uses Microsoft Azure Government cloud services.

Contractor shall provide milestones for FedRAMP authorization.

All cryptographic modules used to protect DOI information (all data in transit and data at rest) shall comply with the current NIST FIPS 140 version and be validated by the Cryptographic Module Validation Program.

7.2 Mobile Device Functions

7.2.1 Logging

The provided mobile device shall be able to log the following:

• Standard Checks

• Special Watches

• Security Inspections

• Inmate Activities

7.2.2 Inmate Movement Tracking

• The mobile device should be able to track location of inmates wearing wristbands or IDs

• Provide a live count of inmates who have scanned in/out of locations

• Provide records depository of inmates at the facility

7.2.3 Alerting

The mobile device shall be able to receive alerts from the management platform

7.3 Reporting

• The provided system shall allow officers to create different types of reports on both the mobile device and management platform. Mobile reports shall also be able to be completed on management platform. The reports shall be fully customizable to allow for different levels of customization on each type of report stated below:

Office of Information Management Technology 6

• Standard Rounds Reports

• Special Watch Reports

• Security Inspection Reports

• Officer Reports

• Site Reports

• Automated reports

• Officers shall be able to complete reports on the mobile device that include;

• Narratives

• Location scans

• Photos and videos

• BIA shall be able to create their own reports using the Management Platform provided by vendor.

7.4 Access and Authentication

Authenticate and authorize, or restrict, internal access to the OJS Electronic Cell Check system utilizing replay-resistant multi-factor authentication mechanisms (PIV card) for access to both privileged and non-privileged accounts.

Managing and controlling user access to data –DOI/BIA’s Active Directory Federated Services (ADFS) and Azure Active Directories (AD).

User Administration – User access is controlled by DOI’s Identity Information System (IIS) and the OJS Electronic Cell Check Cloud System Administrator. User requests for access to the system must be approved by the requestor’s supervisor and the OJS Electronic Cell Check Business Owner (BO) before access is granted.

Phishing resistant MFA Microsoft Authenticator (for tribal access) for tribes to enter data in reporting to meet zero trust principles

7.5 Audit Trail

The system will have the ability to log events and transactions. Logging parameters will be customizable. If the OJS Electronic Cell Check system is delivered by ASP, then BIA will have online access to audit facilities, or be provided audit log reports on a daily basis. The system shall record logon failures and successes.

OJS Electronic Cell Check data sets will be available on-demand for auditing purposes.

In the event the OJS Electronic Cell Check system is operated outside of BIA facilities, BIA shall have the ability to monitor the status of the system via reports or dashboards.

Data required by BIA includes:

• Operational status

• Number of active users

Office of Information Management Technology 7

• Number of sessions/users per day

• Number of open trouble tickets (cumulative and by category)

• General trouble ticket statistics

7.6 Data Currency

Once data is entered, the data shall be available immediately.

7.7 Recoverability

In the event the system is unavailable to users because of a major system failure, the maximum recovery point objective (RPO) for restoring function and data is two (2) hours. The system must be capable of being restored to the condition that existed just prior to system failure.

In the event of destruction of the processing site, the backup site must be available within a maximum recovery time objective (RTO) of six (6) hours from failure.

The Contractor shall develop a Disaster Recovery Plan to be approved by BIA. It must be updated and tested annually by the anniversary date the plan was approved by BIA.

7.8 System Availability

The system must be available to users 24 hours a day, 365 days a year. Additionally, a separate Service Level Agreement (SLA) must be established that will clarify the System Availability, Recoverability, and Performance. The Contractor shall develop this document in coordination with BIA to be approved by the Government.

Routine system maintenance and upgrades shall be scheduled and communicated in writing at least 7 calendar days in advance. before a scheduled system outage.

To ensure system available the ‘warm site’ servers will be in a clustered configuration.

7.9 Fault Tolerance

The OJS Electronic Cell Check system has been identified as mission critical for the Bureau of Indian Affairs. Fault Tolerance requirements include;

• Total failover capabilities with 100% replacement and restoration of data and functionality.

• The operation procedures, training, and continuous improvement will be a part of the operational environment.

7.10 Performance

Assuming negligible network delays, screens, when selected, will display with minimal delay and will not be an encumbrance to performing functions. Reports will be able to be printed without requiring a network connection from the portable devices.

Office of Information Management Technology 8

7.11 Data Retention

All data for the 20 OJS detention facilities utilizing the OJS Electronic Cell Check system must be retained in accordance with NARA approved disposition schedule.

Therefore, copies of the data must be furnished to BIA at monthly intervals for data storage purposes if the OJS Electronic Cell Check system is delivered via an ASP.

All data furnished and turned over to BIA will be in a mutually agreed format which is, at minimum encrypted and SIF and ODBC compliant such that BIA will be able to store and access the data at a later time.

7.12 User Capacity

The current OJS Electronic Cell Check user population is approximately 175 users, consisting of the following role-based populations.

• 25-50 Administrative role-based users, including but not limited to the following personnel.

o Shift leads.

o Corrections officers o Administrative and compliance-monitoring personnel.

• 125 User role-based users.

The quantity of users is not expected to change.

7.13 Security Roles

Table 1: Security Roles

Role Description

Systems Administrator

• Monitoring & alerting.

• Administering user permissions & administration.

• Managing Single Sign On (SSO) and Multifactor Authentication (MFA) functions.

• Managing files.

• Planning for redundancies, rollovers & recoveries.

• Security.

IA-OJS

Administrator

• Define system usage policies & procedures.

• Moves, adds, change, deletes, and sets permissions on end user

• Perform password maintenance activities (resets, locks, etc.)

• Perform transaction audits within system for areas of responsibility

• Create and generate reports within system for areas of responsibility

• Receive alerts for system compliance issues

• Retrieve system data ‘snapshots’ for specific timeframes

IA-OJS

Supervisor / Shift Lead

• Create / update records within system for areas of responsibility

• Perform transaction audits within system for areas of responsibility

• Create and generate reports within system for areas of responsibility

Office of Information Management Technology 9

Role Description

• Receive alerts for OJS Cell Check procedural compliance issues

IA-OJS

Compliance Personnel

• Perform transaction audits within system for areas of responsibility

• Create and generate reports within system for areas of responsibility

• Receive alerts for OJS Cell Check procedural compliance issues

• Retrieve system data ‘snapshots’ for specific timeframes

IA-OJS

Corrections Officers

• Create / update records within system, from mobile devices and workstations, for areas of responsibility.

• Generate and queue reports within system, from mobile devices and workstations, for areas of responsibility.

Office of Information Management Technology 10

8.0 Processes

8.1 Current

1. Facility staff is required to open doors to cell areas every 30 minutes.

2. Facility staff performs manual count of inmates.

3. Facility staff manually records inmate count utilizing paper or notepad.

4. Facility staff manually records inmate activity (sleeping, angry, crying, sick, meals, medication) for each inmate.

5. Manually type all captured information from each 30-minute cell check into official facility log when time allows.

6. Manually document special inmate requests into separate log.

7. Manually fill out special management/cell check log if performing 15-minute cell checks.

8. Manually transfer information into Shift logs/paper reports.

9. Manually transfer logs into Final reports/paper reports for day.

10. Manually file all paper into logs organized by shift, day, week, month, and annual paper files.

Figure 1: Current State OJS Cell Check Process

Office of Information Management Technology 11

8.2 Future

1. Facility staff is required to open doors to cell areas every 30 minutes.

2. Electronically scan wall / door RFID sensor or tag.

3. Determine if additional note or photo documentation is required.

• If additional note or photo documentation is required, capture / record information while standing in cell area.

4. Submit electronic cell check records to system (real-time capture)

5. Retrieve / print reports on-demand.

Figure 2: Future State Electronic Cell Check Process

Office of Information Management Technology 12

9.0 Tasks

9.1 Help Desk and Support Services

The Contractor’s general role and responsibilities associated with providing Helpdesk Support and Services includes:

• Providing Tier 2 and Tier 3 support services for all trouble tickets regarding OJS Electronic Cell Check system cloud function and use.

• Serve as a liaison on Tier 4 tickets to internal and external partners. For example, with Microsoft Cloud-Services and the Department of the Interior, Office of the Chief Information Officer, Enterprise Services Division to help coordinate OJS Electronic Cell Check Cloud system resolution issues, on an as needed-basis.

• Receiving, coordinating, documenting, tracking, troubleshooting, and managing all Cloud end-user service requests, inquiries and problem notification. This includes logging and documenting all service requests and problem identification using the BIA’s Service Manager (Helpdesk Ticket Management system).

• Providing end-to-end problem identification, categorize/prioritization, escalation, and resolution for all OJS Electronic Cell Check Cloud service requests. This includes providing a written response via email to the Cloud end-user before closing a ticket.

• Managing the Root Cause Analysis process on recurring Service Incidents

• Providing additional support to communicate planned and unplanned events including issuing broadcasts or other notices to Cloud end-users in coordination with the OJS, DHS.

• Providing a report bi-annually to the OJS related to Cloud Helpdesk metrics and recommendations to improve service delivery and reduce ticket volume (i.e.

additional end-user training, self-help opportunities for end-users, Root Cause Analysis, etc.).

• Maintaining normal office hours and staffing as required by the government and in accordance with Table 2 – which outlines the hours of operational support needed. If a Helpdesk Support request is initiated during regular support hours, no lead-time may be provided.

• After hours support outside of Table 2 must be approved first by the designated government representative and will be on a case-by-case basis.

• Performing helpdesk center capacity monitoring and planning which is defined as monitoring and maintaining appropriate staffing levels for anticipated and planned call volumes.

• Provide user support for configuration and administration of specialized technologies as identified by the government.

Office of Information Management Technology 13

• All calls, faxes, and emails shall be documented in the BIA’s Service Center Ticketing System. Problems shall be resolved to the Customers’ satisfaction as indicated on Closing of Tickets procedures. The Contractor shall keep the user informed during the troubleshooting and resolution period until the ticket is closed.

• For Monitor Problem Notifications, the Contractor shall review and monitor all network status messaging systems and software in place to determine current System and network statuses. The Contractor shall maintain awareness of all reported issues that can potentially affect the OJS Electronic Cell Check system.

Notification concerning Systems and software will include Service Manager, voicemail, email status reports, intranet, and other means of Customer notification.

• The Contractor shall determine and document the scope, impact, and urgency of the problem based on documentation. The Contractor shall comply with Service Manager Severity levels and response times. The Contractor shall apply temporary fixes where appropriate while permanent solutions are developed. For Service Manager Incident tickets closed on initial call, the Contractor shall review the original problem description and resolution to ensure they appropriately match. If the Customer reported the original problem incorrectly, the problem description shall be changed to match the resolution. The Contractor shall communicate to the Customer the direction the resolution efforts are going, and give the Customer the Service Manager ticket number to allow them to follow up on any progress made.

• For the Remote Configuration and Administration, the Contractor shall use Government furnished software to provide remote assistance, troubleshooting, and problem resolution for desktop computers, network attached storage, network printers, and other devices where remote assistance through the IA network is possible.

• The Contractor shall work toward resolution of all Service Manager Incident tickets opened in their queue, and, within their scope, to achieve Customer satisfaction. When required, the Contractor shall coordinate efforts with other IA Government offices to resolve the problem promptly. If it is determined to be another IA Government office’s responsibility, the Contractor shall notify that office of the problem and assign the ticket to that specific entity. The Contractor shall determine that entity’s information requirements and shall ensure that all necessary information is documented in the Service Manager ticket.

Office of Information Management Technology 14

• The Contractor shall follow up with Customers, vendors, or IA components, as required, to resolve problems. The Contractor shall update Service Manager Incident tickets any time with the following: (a) resolution efforts that have been taken; (b) a change in the status or impact of the problem has occurred; (c) any contact with a Customer, vendor, or IA component has been made; or (d) as regulated by the priority of the ticket or service target date and accompanying text description. Customer contacts and follow-up shall be provided as negotiated with the Customer. The frequency of updates and follow-ups, based on the priority of the ticket, are listed. The Contractor shall document and maintain an audit trail of the complete problem resolution.

• The Contractor shall update and close appropriate Service Manager Incident tickets. All steps taken to resolve the issue must be completely documented in the ticket. The Contractor shall review the original problem description and resolution to ensure they match. If the Customer reported the original problem incorrectly, the problem description shall be changed to match the resolution.

• The Contractor shall open a Master Problem ticket and associate all related problems to this ticket when multiple problem reports related to the same failure are received. The Contractor shall document the call and log all necessary information into Service Manager. The Contractor shall open a Master Problem ticket at the request of another IA component who is informing the OIMT of a distributed client/server or telecommunication problem trend. The Contractor shall associate all new related tickets to this Master Problem ticket based on criteria identified by the IA component.

• The Contractor shall continue to follow up on the progress of Service Manager incident tickets opened by the Contractor but assigned to another component for resolution. The Contractor shall monitor their progress and escalate any lack of service, repeatedly missed required ticket updates, or other service delivery issues, to the Government Service Center Task Leader to ensure Customer satisfaction.

• The Contractor shall coordinate, when directed, formal, and informal meetings and consultations among IA components, third party vendors, and management to address unresolved complex problems, overlapping component ownership, and trends involving service delivery issues.

• The Contractor shall follow current and newly developed specialized procedures based on problem types, urgency, and priority. Such procedures will often require special notifications, reports, and paging on escalation or transfer. For each problem report, the Contractor shall determine whether a specialized procedure is indicated or not. If so, the Contractor shall follow IA’s established specialized procedures.

Office of Information Management Technology 15

• For high impact-high urgency issues, the Contractor shall prepare a report detailing all open high impact-high urgency issues encountered up to the time of the report creation and submit it to government task lead within 24 hours of its identification. The Contractor will make reasonable efforts to ensure the government task lead is made aware of the high impact-high urgency issues by telephone or email within 2 hours of the incident identification.

• The Contractor shall provide Tier 2 and Tier 3 application-specific Service Center support to assist users in the functionality and use of the applications. Application support shall include (but not be limited to) commercial software and IA-specific hardware and software.

• Customer Satisfaction Surveys should be made available to end-users on all open tickets, through the use of automated means.

• The Contractor shall compile the Customer satisfaction survey results and submit them to the Government Task Leader for review, comments, and approval, bi-annually.

• The Contractor shall document any Customer complaints received by phone or email regarding undelivered services from the Contractor, vendors, and IA Components within 24 hours of the complaint. The Contractor shall include a list of customer complaints to the Government Service Center Manager during the bi-annual report.

• The Contractor shall provide problem analysis and statistical reports as required by IA to include statistics on new Systems deployed, aging equipment, and general call/problem statistics and trending. The Contractor shall identify and deliver new reports required to analyze trends affecting call intake volume or problem resolution performance.

• The Contractor will open tickets daily 100% of the time using the IA Service Center ticketing system. All tickets will be opened and managed according to the Service Center SOP and IA service delivery standards.

• Support will be available from 7:00 a.m. Eastern Standard Time (EDT) to 8:00 p.m. EDT (13 Hours), Monday through Friday, excluding Federal holidays. The Contractor will be responsible for accessing the IA Service Center to respond to all Service Center tickets that require Tier 2 and Tier 3 support during aforementioned Service Center hours.

• The System application will be available to users 24 hours and day, 7 days per week, excluding scheduled maintenance and the time required to accomplish weekly System backups.

9.2 End-User Account Administration and Services

The Contractor will support user account maintenance of the OJS Electronic Cell Check Cloud. The Contractor’s role and responsibilities associated with providing Cloud End- User Account Administration and Services includes:

Office of Information Management Technology 16

• Performing and coordinating employee end-user account administration such as creating, changing, de-activating and deleting OJS Electronic Cell Check Cloud user accounts in accordance with the BIA’s Security Policies.

• Receiving and tracking Service Requests for End-User account activation, changes and terminations/ de-activations and deletion. Tickets will be assigned for creating new, modifying, and suspending accounts within OJS Electronic Cell Check Cloud.

• Working with and assisting OJS with annual audit review of Electronic Cell Check Cloud user accounts reconciliation to ensure 100% compliance of end-user accounts between OJS Electronic Cell Check Cloud and the BIA’s Identity Information System (IIS), bi-annually or as requested by the BIA Security Office.

• At a minimum, once a year the contractor; working with the COR to review and document requirements, policy changes, and guidelines regarding End-User Administration in OJS Electronic Cell Check Cloud.

• Coordinate as necessary with other BIA offices to manage end-user accounts.

9.3 Technical Engineering Support, Software Development, and

Maintenance

The contractor shall provide support services from qualified and experienced personnel to support the planning, analysis, design, engineering, development, programming and maintenance of web and system software applications and database projects. The contractor shall provide software maintenance, technical support, minor upgrades for the ongoing operations of the OJS Electronic Cell Check Cloud.

Specific tasks include, but are not limited to:

• General Analysis and Requirement Gathering

• Product Design

• Coding

• Testing

• Deployment of Product

• Product Maintenance and Operation

• Tracking all system enhancement requests by OJS Electronic Cell Check Cloud end-users in the BIA Service Center Ticketing System. The BIA Service Center Ticketing System will be replaced by DOI’s Remedy Ticketing System in the future.

• Developing and releasing minor system enhancements to improve usability, correct minor defects, or address specific problems identified within the OJS Electronic Cell Check Cloud.

Office of Information Management Technology 17

• Providing technical expertise to help address open security concerns on the OJS Electronic Cell Check Cloud Plans of Action & Milestone Report (POA&Ms), annually.

• Any identified defects or POA&Ms requiring major code development would be addressed in a new Task Order.

• Development of Use cases based on current workflows.

• The Use Cases will utilize sanitized data to ensure the workflow is being followed.

• The program and the contractors will be coordinating with the OJS Electronic Cell Check Cloud end-users and quality testers during acceptance testing.

• The Contractor will be providing the systems administration of the underlying databases used by the system.

• The Contractor will be maintaining a mirror system that is used for demos, user training, production, and other presentations.

• Identifying, diagnosing, and rectifying any issues in the OJS Electronic Cell Check Cloud hardware, software, services, and applications. This includes coordinating with BIA, OIMT, DOI Federated Services, and Microsoft Azure, i.e., deprecation of software/hardware, and the migration to new versions.

• Providing technical support on key OJS Electronic Cell Check Cloud deliverables and documents to comply with Departmental requests and security requirements.

This includes supporting in the preparation and submission of key documents.

This includes participating on Ad-Hoc data calls and participating in working sessions to meet internal deadlines as requested and specified by OJS and the IA, Office of Information Management Technology. An ATU (Authority to Use) will be performed to be a part of the ATO of the OJS Electronic Cell Check (Cloud) system. This includes but is not limited to the following documents/tasks:

• FIPS 199

• Incident Response Plan

• Continuous Monitoring Plan

• Security Control Assessment

• Plan of Action & Milestones (POA&M)

• Privacy Impact Assessment

• Privacy Plan

• System of Records Notice

• Information Collections

• SSN Use Reduction Planning

Office of Information Management Technology 18

• Check Reduction Initiative to comply with Department of Treasury and DOI mandates

• Financial Investment Portfolio

• IIS Account Reconciliation

• IT Portfolio Reviews

• Joint Planning Document Issued

• Departmental Budget Submission (POB), with Exhibit 6F for IT

• IMT Acquisition Strategic Plan

• High Level Planning Objectives Memo (HLPO) Issued

• ACIO/BBO Joint Certification Statements

• Cyber Security Budget Data Request (BDR)

• Assisting OJS as needed on updating process guides as needed, to reflect changes or updates in the business processes.

• If major enhancements are needed to the system regarding the OJS Electronic Cell Check Cloud system, the Government will then work with the CO and Contractor to explore options to address this.

9.4 Training

• The Contractor shall provide all necessary training to BIA to install the devices and set-up the system. The Contractor shall provide the necessary personnel to provide training to OJS employees upon installation of the system. Additionally, The Contractor shall host two (2) BIA employees for private initial training on the system so those employees are familiar prior to installation and employee/user training at the detention facilities

The Contractor shall:

• Utilize a dedicated training server with sanitized training data.

• Provide OJS Electronic Cell Check Cloud-specific, role and scenario-based end-user training through an online format of the Contractor’s choice and in agreement with the government, i.e., Government Zoom, Microsoft Teams (preferred), Google Meet, or Web-ex.

• Each Training session shall be recorded.

• The contractor will update process guides and training material provided for the government.

Office of Information Management Technology 19

10.0 Deliverables

10.1 Requirements

10.1.1 Routine Deliverables

Reports to be delivered to the COR on a weekly basis. Routine deliverables are for items such as:

• Reports:

o Weekly Status Report o FedRAMP Authorization Milestone Status

• Reference Materials: OJS will provide reference materials to the incumbent contractor within 30 days of award.

o Workflows for all operational processes.

o Operational Procedures for all operational processes.

o Operational Process Improvement Plan will have a feedback loop to ensure OJS Electronic Cell Check processes are met.

o Record of all meetings and conferences.

o Reference Materials used in the creation of all documentation.

o All System Documentation as defined in the DOI System Life Cycle v3.1.

10.1.2 Quality Measures

General quality measures, as set forth below, will be applied to each deliverable received from the Contractor under this Contract, and all resultant task orders.

• Accuracy – Deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity – Deliverables shall be clear and concise. All diagrams shall be easy to understand and be relevant to the supporting narrative.

• Consistency to Requirements – All work products must satisfy the requirements within this document.

• File Editing – All electronic files shall be editable by the Government using the standard IA software applications.

• Format – Deliverables shall be submitted in hard copy (where applicable), and in media mutually agreed upon prior to submission. Hard copy formats shall follow IA specified directives or manuals.

Office of Information Management Technology 20

• Timeliness – Deliverables shall be submitted on or before the due date specified in this document or submitted in accordance with a later scheduled date determined by the Government and negotiated with the incumbent contractor.

APPENDIX A