ATTACHMENT 2 - PWS.pdf

Fire and Emergency Services (FES) Modernization Support

SECTION 2: PERFORMANCE WORK STATEMENT (PWS)

2.1 BACKGROUND

The Fire and Emergency Services (FES) mission is to protect the lives, environment, and property of all persons in the community and surrounding serviced areas. FES is responsible for the input of response data for emergency incidents; tracking and maintenance of inventory; training and fire prevention to include inspections, site fire safety education, hot work permits and fire hydrant locations.

Data collection is the cornerstone of the FES mission and must be accomplished in accordance with Department of Defense (DOD), DLA, and national consensus standards to maintain the Agency’s accreditation status with the Center for Public Safety Excellence (CPSE). Tracking of response data used to identify trends within the various response disciplines helps ensure that FES is providing the right service at the right time to the customers. FES requires a system that will track various data points regarding the care, maintenance, and disposition of tools, equipment, personnel training, and fire prevention. This information is used to maintain accountability, ensure serviceability of critical response equipment, and to support the establishment of equipment life cycles for budget purposes. Tracking of testing and maintenance records ensures regulatory and manufacturer compliance. The end user requires the creation of various reports to confirm maintenance and replacement are completed and properly documented.

The Government requires Program Management Office (PMO) support and IT application(s) support for E911 telecommunications, automated dispatching, investigations, records management, reporting including Electronic Patient Care Reporting (ePCR) incident management including response data, inventory records including tracking and maintenance, training records, inspection records, hot work permits, and key infrastructure such as fire hydrants.

The Government requires licensing, hosting support, privileged application administration support.

Specifically, the program requires a Software as a Service (SaaS) IT application that interfaces with law enforcement, 911, fire and Emergency Management System (EMS) defined capabilities while maintaining permission-based separation of data based on operational need. The fire and emergency service applications operate in accordance with DoD, DLA and National consensus standards maintaining the Agency’s accreditation status with the Center for Public Safety Excellence (CPSE). The application(s) securely document the Health Insurance Portability and Accountability Act (HIPAA) and other law enforcement and criminal investigative sensitive data such as the Criminal Justice Information System

(CJIS).

2.2 SCOPE

FES requires an emergency patient care report and fire records management system that meets Department of Defense and Department of State mandates. The scope of this effort is to provide a cloud-based, web-enabled emergency records management and reporting application with the ability to standardize records management and reporting capability; to ensure compliance with DOD and DLA policies and regulations;

and to support access to important decision-making information that promotes a consistent framework and format for capturing essential program data and trends for the Fire and Emergency Services Program.

This Task Order includes tasks for project management, operations and sustainment support, technical professional services and transition support for police, fire, and emergency operations applications. The

Contractor shall provide the full range of lifecycle and technical support services required to sustain and enhance the applications.

This Performance Work Statement (PWS) includes tasks for COTS application license procurement, license maintenance, project management, operations and sustainment support, technical professional services, and if required transition support for fire, and emergency services operations applications. Note:

The current applications have licensing in place until April 15, 2024. The Government’s plan is to have the new system in place and fully operational prior to April 25, 2024, to provide for a smooth transition.

The Operations, sustainment, and professional technical support includes upgrades, migrations, and enhancements including all application server administration, application database administration, application software and hardware technical support, project support, technical design support, development, implementation, compliance, RMF cybersecurity, configuration management support, systems engineering support, information system architectural support, testing and documentation support.

The following table (Table 2) outlines the tasks detailed in this PWS.

2.2.1 Locations for Support

This effort supports care, maintenance, and disposition of tools, equipment, personnel training, and fire prevention reporting; emergency patient care reports; and fire records management for five Defense Logistics Agency (DLA) locations identified below:

•DLA Headquarters Complex, Fort Belvoir, VA (HQC)

• Defense Distribution Depot, San Joaquin, CA (DDJC)

• Defense Distribution Depot, Susquehanna, PA (DDSP)

• Defense Supply Center, Richmond, VA (DSCR)

• Defense Supply Center, Columbus, OH (DSCC)

2.2.2 Minimal Technical Requirements

The system shall:

• Be available 24/7

• Be accessible for unclassified information

• Be fully web-based

• Support current versions of major browsers such as Edge, Google Chrome, and other GOV/DLA approved browsers

• Allow interoperability of DLA approved Computer Aided Dispatch (CAD) integration

• Allow for safety analytics and tracking

• Pass all security requirements to include Security Technical Implementation Guides

• Provide reports of response time

• Comply with all DLA Information Assurance, Privacy Act and System of Record policies

• Conform to DOD information assurance testing

• Send daily notifications with links to the appropriate records or modules

• Populate the daily roster and incident reports. Provide system access

• Must achieve and maintain IL5 FedRAMP+ and IL5 DISA DoD Cloud Authorization Services (DCAS) approved for use, and must be maintained at those levels while in use

2.2.3 Functional Requirements

The system shall:

• Create, control, and maintain the master data and settings that integrate the system into daily FES operations

• Use analytics to assess response times and staffing levels

• Utilize smart card/Common Access Card (CAC) for login

• The option to access the application from a government furnished mobile phone or tablet

• Digital signature capture for Patient Care Reports

• The ability to download vitals and 12 leads from the Lifepak 15 to the Patient Care Report

• The ability to transmit 12 leads, vitals, and Patient Care Reports to the hospital

• Import custom building locations

• Import current existing data from the legacy ESO Fire Emergency Service (FES) software

• Follow National Fire Protection Association (NFPA 1710) standards of cover

• Follow NFPA 1500 standards for safety analytics

• Display an overview of department activities

• Export fire and EMS data in real time or at the end of a response

• Use a CAD interface to transmit, configure, and upload data directly

• Assign and track personnel and apparatus during a shift

• Match employee preferences and unique job responsibilities

• Feed data to reports, incidents, and analytics about the coverage area

• Track agency’s contributions to the community outside of pure emergency services

• Track hydrant locations, manufacturer and replacement information, maintenance records and flow test data

• Allow for the storage and creation of patient care reports

• Create emergency patient care reports with 100% National Emergency Management System (EMS) Information System (NEMIS 3.X AND ABOVE) compliance

• Automatically submit records to local, state, and federal data collection agencies

• Create fire response reports with 100% National Fire Incident Reporting Systems (NFIRS) compliance

• Map incidents, hydrants, and occupancies by type

• Track item usage

• Send notices via email to responsible personnel, reminding them to reorder supplies

• Develop the minimal number of custom components or modules required to augment the capabilities provided by the Emergency Records Management and Reporting Software meet the requirements in this PWS Store files for personnel to view, such as PDF or video files

• Track status, location and service life of all agency apparatus including self-contained breathing apparatus (SCBA), bunker gear, hoses, emergency medical equipment and other fire related equipment

• Manage valuable data for buildings and other structures in the agency’s coverage area (e.g. pre-fire plans, fire extinguishers, fire protection and prevention systems)

• Run real-time (incident, station activity, personnel) reports

• Schedule personnel to populate the Daily Roster

• Automatically populate incident reports

• Create and store all records, documents and other information related to fire and EMS personnel training

• Calculate response times and plan resource deployment

• Record the location and potential impact of hazardous materials

• Determine the required fire flow needed to stop a fire at origin

• Evaluate potential medical emergencies involving mass casualties

• Develop the required documentation to support the Center for Public Safety Excellence (CPSE) accreditation process:

The Accreditation model includes a comprehensive research and information collection guide with checklists, exhibits, benchmarks, references, and activities broken down by category. Several appendices address additional topics including defining the elements of response time, creating standards of response coverage, and developing master or strategic plans. The Commission on Fire Accreditation International (CFAI) accreditation model includes these performance evaluation categories:

o Assessment and Planning o Essential Resources o External Systems Relations o Financial Resources o Goals and Objectives o Governance and Administration o Human Resources o Physical Resources o Programs o Training and Competency

• Provide maximum output from the data collection to produce multi-level data analysis and report building

• Collect and report comprehensive information related to fire and emergency service operations

• Incident response documentation and reporting for all hazards emergency incidents

• Emergency medical patient care recordkeeping and reporting

• Be National Fire Incident Reporting Systems (NFRIS) 5.1 compliant

• Have the capability to collect and report the NFRIS data elements

• Be listed as an NFIRS 5.X and above Active Vendor by time of award

• Be Health Insurance Portability and Accountability Act (HIPAA)/Personally Identifiable Information (PII) compliant

• Be National Emergency Management System (EMS) Information System (NEMIS 3.X AND ABOVE) Gold compliant o An EMS data system is defined as any software associated with Emergency Medical Services that provides a mechanism to collect, document, analyze, or otherwise store and use data associated with an EMS event.

This includes but is not limited to:

• EMS dispatch data systems

• EMS medical device data systems

• EMS patient care documentation systems

• EMS billing systems

• EMS quality management or reporting systems o Any EMS data system is Gold compliant with the National Highway Traffic Safety Administration (NHTSA) Version 2.2.1 Dataset when the following conditions have been met:

• EMS Dataset and Demographic Dataset

• Every data element contained in the NHTSA Version 2.2.1 EMS Dataset must be available for use in the EMS data system. Not every NHTSA Version 2.2.1 EMS and Demographic data element has to be used by an EMS system but if the data element is selected for use, it must be available as defined for use.

• No translation of the NHTSA Version 1 EMS Dataset into the NHTSA Version

2.2.1 EMS Dataset is permitted since definitions, variables, and codes are often inconsistent between the two versions.

• Additional data elements outside of the NHTSA Version 2.2.1 EMS Dataset may be collected either by using the E23_09 Research Survey Fields (along with E23_11 Research Survey Field Title) or by creating unique data elements outside the NHTSA Version 2.2.1 Dataset2.

• An EMS data system may extend the variables associated with any NHTSA Version 2.2.1 EMS Data Element by using the existing definitions, variables, and codes in such a way so that any change in a data element variable and code can be collapsed back to a defined, acceptable code for data storage and transmission within the XML standard. XML Standard

• An EMS data system must have the capability to export data using the NHTSA Version 2.2.1 XML Standard. This standard is defined by the ability to export any EMS event and/or demographic record from the EMS data system using XML with validation using the NHTSA Version 2.2.1 XSDs.

• All State EMS Data Systems must have the capability of importing data using the NHTSA Version 2.2.1 XML Standard.

• It is recommended, but not required, that local EMS data systems have the capability of importing data into the system using the NHTSA Version 2.2.1 XML standard.

o Provide the capability for heat mapping incident response locations

Contract Tasks

TASK 1 – SaaS FedRamp+ Approved Solution

TASK 2 – Project Management Support

TASK 3 – Operations and Sustainment Support & Technical Services

TASK 4 – Optional Transition Support

This task order will be evaluated in accordance with Tradeoff source selection procedures. Award of this task order will be made on a competitive best value basis, using “tradeoff” procedures between nonprice and price. In evaluating task order proposals, the non-price factor(s) is/are considered significantly more important than price. The Government may consider award to other than the lowest priced Contractors or other than the highest technically rated Contractors.

The criteria used to select the contractor for award of this task order will be based on an evaluation of the contractor’s proposed labor mix and allocation along with its proposed price as compared to the government’s estimate of the work to be performed.

Non-Price Factor – Labor Mix: The contractor’s quality of proposed personnel will be evaluated based on an assessment of the level of experience and skill necessary to minimize Government risk and successfully complete the technical requirements outlined in the task order PWS. Proposed labor mix and allocation will be evaluated on experience, skills, and qualifications as they relate to the requirements of the task order PWS. Contractors are required to submit copies of resumes for all key personnel (and key personnel substitutions) proposed in response to this task order PWS.

Non-Price Factor – Technical Approach: Describe in detail your approach to develop the specified deliverables and perform each tasking in the PWS. The Contractor must provide evidence demonstrating a clear understanding of the scope and complexity of the requirements set forth in the PWS. The proposed approach must be well-defined and logical and include the methodologies and processes that can successfully meet DLA objectives and mitigate risk.

Non-Price Factor – Past Performance: The Government will consider the contractor’s past performance/experience under U.S. Government contracts or other contracts/projects within 3 years of the initial closing date of this RFQ. Any contracts/projects submitted in reference to past performance that are outside of the 3-year recency period will not be considered for evaluation. Contractors shall submit at least one past performance example, but not more than two examples.

Note: In the case of a contractor without a record of relevant past performance or for whom information on past performance is not available, the contractor will not be evaluated favorably or unfavorably on past performance and will receive a Neutral rating.

In evaluation of this factor, the following aspects will be considered:

Aspect One: Relevancy of Prior Contracts - The relevancy of contractor’s prior projects to the current PWS requirements will be evaluated based on the similarity to the service/support, the complexity, and dollar value. The Government will evaluate the contractor’s demonstrated evidence of experience in performing contracts with a similar size, scope, and complexity to this task order requirement.

Aspect Two: Quality of Past Performance (i.e., how well the contractor performed) - The contractor’s history of success in completion of projects, history of producing high-quality reports and deliverables, and commitment to customer satisfaction and history of staying on schedule and within budget will be evaluated via CPARS/PPIRS; information provided in the contractor’s offer; and/or with the Government’s independent contact with the contractor’s prior customers. Degree of conformance to contractual requirements, responsiveness, and effectiveness in addressing issues, quality of customer service, and/or conformance to cost/price requirements or goals, will be evaluated in the qualitative past performance ratings.

Price: The proposed task order pricing will be evaluated to determine it is in accordance with the IDIQ. Pricing will be evaluated to ensure completeness and reasonableness.

Current Incumbent Information:

Not applicable. This is a new requirement.

2.3 TASK REQUIREMENTS

The Contractor will be required to perform tasks such as the following:

2.3.1 TASK 1 – SaaS Application Procurement IUS#0007 Annual Licenses and Maintenance The Contractor shall procure, for the DLA COTS application, licensing to meet the defined functional requirements of the law enforcement, fire, and EMS users. The COTS application licensing will include a browser-based CAD, LERMS and LE mobile solution. The FES solution will be maintained in the IL5 FedRAMP+ and IL5 DISA DoD Cloud Authorization Services (DCAS).

It is the intent of the DLA to sustain the existing FES applications until the migration of the COTS applications to the Gove Azure or other approved hosting environment. During this contract it is expected that the Contractor will support one or more major migrations, upgrades, and enhancements.

The Contractor shall be responsible for all software, licenses and 100% of all DLA ServiceNow Incidents (critical, high, medium, low) to include those generated after core hours. License requirements exist for 200 Users at (9) sites.

2.3.2 TASK 2 – Project Management Support IUS#0004 Program Management

The Contractor shall provide project management support that includes support of all tasks in this TO including administrative support, operations and sustainment and technical tasks. Technical tasks include managing the architecture, systems engineering, information assurance, cybersecurity and configuration management support required. Management of these tasks shall include integrating a common system landscape with internal controls and processes that optimize and streamline services.

The Contractor shall provide project management services necessary to establish project governance, develop and implement project plans, establish communication and escalation procedures; support change control processes; monitor, control and report project status, schedule, and report performance; conduct regular project reviews; and ensure quality of deliverables.

The Contractor shall provide a full-time Project Manager. The Contractor’s Project Manager is a key person on this project and shall have demonstrated leadership experience in a law enforcement, fire, and emergency service work environment. Additionally, the Project Manager must have IT and program management experience of similar size and complexity as that outlined in this TO. Contractor’s Project Manager shall serve as a senior official and as such is responsible for all contract staff and their deliverables employed in concert with this TO. The Contractor’s Project Manager shall coordinate with the Contracting Officer’s Representative (COR) and Contracting Officer on all contractual and business issues.

Project management functions shall include developing, maintaining, and meeting schedule milestones, managing risks, identifying, and resolving problems, keeping the PMO informed of statuses and issues.

The Contractor’s Project Manager shall provide the planning, direction, coordination, and control necessary for effective and efficient accomplishment of all requirements. The Contractor’s Project Manager shall verify and validate the level of effort and deliverables for each task on the monthly status report and project plans.

The Contractor’s Project Manager shall ensure productivity and provide oversight of management methods such as Quality Assurance, progress/status reporting and project reviews. The Contractor’s Project Manager shall provide the centralized administrative, clerical, documentation, and related functions support.

The Contractor’s Project Manager shall provide specific guidance to application(s) staff and other technical staff that describes the development environment, identifies constraints such as styles and conventions, and provides details to assist technical resources in accessing, configuring, coding, troubleshooting, testing, and operating application modules.

The Contractor’s Project Manager shall support the strategic technical direction and implementation of the Enterprise Capabilities strategic roadmap and the DLA vison and strategy.

The COR/COTR has the responsibility to monitor the progress of the work of the Contractor personnel assigned to the task. Additionally, in the absence of other agreements negotiated with respect to time provided for Government review, standards and actions shall be inspected and the Contractor notified of the COR’s findings within five (5) workdays of normally scheduled review.

The Contractor shall provide a compliance tracking report quarterly that identifies that contract employees are certified in accordance with DoD Directive 8140.01 Cyberspace Workforce Management.

All documentation will be in the latest version of the Government-supplied Microsoft Office format unless another format is required and agreed to by the COR, the Contractor, and Contracting Officer.

The Contractor will provide the following:

1. Kick-off meeting

2. Project plan(s)/schedule(s)

3. Risk register

4. Integrated Master Schedule (IMS)

5. In Process Reviews (IPR)

6. Monthly Status Report (MSR)

7. Briefings, meetings, attend conference calls, and provide reporting

8. Configuration control governance meetings

2.3.2.1 Kick-Off Meeting

The Contractor shall schedule and complete a kick-off meeting with the Government within five business days of TO award or as agreed upon between the Government and Contractor. The Contractor shall prepare and present an executive overview at the kickoff. The executive overview will demonstrate the Contractor’s plans to manage scope, schedule, and resources for the contract. Contractor shall introduce key personnel and describe plans for sustaining and if required replacing existing FES application.

The Contractor shall present and deliver the kick-off meeting briefing presentation material and be prepared to discuss the content, to include the staffing plan, schedule, and proposed metrics. The Contractor shall produce and distribute kick-off meeting minutes identifying all the discussion points, agreements, and action items within two (2) business days following the meeting.

2.3.2.2 Project Plan(s) / Schedule(s)

The Contractor shall develop project plans/schedules to accomplish the requirements of this PWS to include set-up and configuration of environments, upgrades, migrations, and enhancements. Project plans for upgrades, migrations and specific tasks assigned by the Government within the scope of this PWS shall be created within 10 business days of notification of the project. Project plans/updated project plans shall be submitted as part of the Monthly Status Report.

The Contractor shall prepare project plans that describe the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements for the proposed effort. The Contractor shall provide the planning, supervision, coordination, and controls necessary to accomplish all work contained in this PWS. The Contractor shall document the approach and plan that defines the activities, tools, and techniques to ensure high-quality products that are defect free, that meet PWS requirements by sub-task and that are delivered in accordance with the approved schedule.

The plan shall include a description of the task, duration, status, baseline dates, actual dates and include resources that will deliver and implement this PWS. The organization structure must include the identification of key personnel. The Contractor shall provide an organization chart and describe other corporate organizations that will support the team.

The Contractor shall provide an explanation of how, within the scope of the Task Order, technical management will be performed; personnel and physical resources will be managed; and the mechanisms to be used to control cost, schedule, and quality.

The plan shall include a Work Breakdown Structure (WBS) that shows tasks required to complete the work and the dependencies of each task. The WBS shall be detailed to the level of effort necessary to support the accomplishment of work to be performed under the PWS. Normally, the WBS will be provided as a Microsoft Project artifact which includes a timeline view with clear deliverables and milestones.

2.3.2.3 Risk Management Plan

The Contractor shall apply the risk management approach and plan in the Task Order to develop and maintain a risk register that documents and tracks Contractor and Government identified risks. For each risk, the register shall include a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur and a mitigation strategy. The initial register should be provided during the Kick-off meeting and then as part of the Monthly Status Report each month. The Contractor shall provide the Risk Register in a Contractor-proposed, Government-approved format.

2.3.2.4 Integrated Master Schedule (IMS)

The IMS is a time-based schedule containing the networked, detailed tasks necessary to ensure successful project/task order execution. The IMS consolidates high-level information from each future planned or in process project plan. The IMS is used to verify attainability of task order objectives, to evaluate progress toward meeting project objectives, and to integrate the project schedule activities with all related components.

The Contractor shall produce and maintain an IMS using Microsoft Project that shows the activities required for the completion of tasks and deliverables for this Task Order. The Contractor shall deliver to the COR/COTR a draft and baselined IMS within 30 of award and every 75 calendar days thereafter. The Contractor shall deliver the IMS in a Contractor proposed, Government approved format.

2.3.2.5 In Process Reviews (IPRs)

The Contractor shall conduct IPRs as requested (quarterly) and provide information regarding project and contract status. IPRs shall provide for an interchange between the Government and Contractor during the execution of the task order (e.g., update of project status, review of the system design, reviewing the results of troubleshooting, testing, etc.). Quarterly IPR report shall discuss:

1. Planned/in process project status

2. ServiceNow incident status

3. DISA tickets

4. Risks

5. Issues

6. Concerns

2.3.2.6 Monthly Performance/Progress/Status Report

The Contractor shall monitor activities and deliverables under this Task Order and provide a Monthly Status Report (MSR) that describes project(s) progress, costs, issues, problems, and status. The MSR shall be the Contractor’s method of reporting progress. The period covered by the MSR shall include the previous calendar month’s activities; any issues, actions or other MSR reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings, or other commitments. If applicable, travel costs shall be broken down by destination, duration, purpose, and costs for both monthly and cumulative to date. The Contractor shall provide a monthly status report monitoring the quality assurance.

The Contractor shall provide a Monthly Status Report by the 5th business day of the month. The Monthly Status Report shall include, but not be limited to:

1. Contract number

2. Brief task description; summary of activities by task

3. A summary of work accomplished during the reporting period and/or significant events.

4. Updated copies of each project plan should be included with the Monthly Status Report.

5. Deliverables progress; activities and progress (Integrated Master Schedule)

6. Summary of problem areas and updated Risk Register

7. Risks to Contractor based on Government pending actions

8. Risks to police, fire, or emergency service applications performance

9. Significant meetings

10. Software engineering metrics and technical measures such as CPU, memory, license(s) availability

11. Description of any travel or unique services provided and presentation of trip reports if travel occurred

12. Renewal summary including any application certificates, username password expirations, staff

Common Access Cards (CAC), mandatory trainings, Authority to Connect (ATC)/Authority to Operate (ATO) and other items with expiration dates

13. Number of tickets submitted, received, and completed

14. Anticipated activity for the next reporting period

2.3.2.7 Briefings, Meetings, Conference Calls Attendance and Reporting

The Contractor shall prepare briefing materials and represent the EC Portfolio at briefings, meetings, and conference calls with organizations of interest, stakeholders, external and internal systems. This representation shall be at a level that functionally and technically represents the EC Portfolio mission and capabilities.

All Contractor led briefings and meetings shall be conducted in a professional manner. The COR/COTR or an authorized Government representative will be present at all briefings, meetings, and conference calls.

Read ahead and presentation materials shall be delivered to the COR/COTR two business days prior to any meetings, briefings or conference calls as required.

The Contractor shall document meeting notes including any action items, status of action items and summary of discussions. The Contractor shall deliver these meeting minutes to the COR/COTR no later than two business days after the meeting. Approved meeting notes / after action reports will be disseminated by the COR/COTR as required.

2.3.2.8 Call/Meeting Participation

Contractor personnel shall be prepared to actively lead support calls by having status updates ready and be available for any questions from the Government. As requested by the COR/COTR, the Contractor shall participate in calls daily/weekly/bi-weekly, etc. as needed.

2.3.2.9 Configuration Control Governance Meetings

The Contractor shall assist the PMO in preparing for routine and special topic Government Configuration Control governance meetings. These may be the Configuration Control Working Group (CCWG), meetings dependent on the governance structure in place. The Contractor may be required to attend governance meetings, In Process Review’s (IPRs), meetings with integration/interface representatives of external and internal systems, and special working group sessions, as requested by the COR/COTR.

Task 2 Deliverables:

Deliverable 1: Kick-off Meeting Estimated Time: Within five (5) calendar days of TO award

Deliverable 2: Risk Register Estimated Time: At Kick-off and then updated monthly with Monthly Status Report

Deliverable 3: Integrated Master Schedules and Project Plans Estimated Time: Initial IMS within 30 calendar days after TO Award and updated as required, but not longer than every seventy-five (75 days)

Deliverable 4: In-Process Reviews (IPRs) Estimated Time: Quarterly

Deliverable 5: Monthly Status Report Estimated Time: 5th business day of the month

Deliverable 6: Meeting, Briefing, Conference Call Presentation Materials Estimated Time: Briefings provided two business days prior to any meetings, briefings or conference calls as required

Deliverable 7: Calls/Meetings Estimated Time: As Required

Deliverable 8: Configuration Control Governance Meeting support Estimated Time: Two days prior to any meetings

Deliverable 9: Monthly 8570 Report Estimated Time: By the 5th calendar day of each Month

Deliverable 10: Plan of Actions and Milestones (POA&M) – Cybersecurity Vulnerabilities Estimated Time: Due within 5 business days from request date

2.3.3 TASK 3 – Operations and Sustainment Support IUS#0003 Operational Phase

The Contractor shall provide monitoring, troubleshooting, problem resolution and operations support for sustainment functions for Stage and Production application environments.

The Contractor shall provide support for day-to-day operations and maintenance including reporting to the ITOC (InfoSpots and scheduled maintenance notifications). The Contractor shall analyze, review, and monitor the police, fire, and emergency service applications performance to identify operational issues and potential problems including support for Business Systems Monitoring (BSM) with the DLA Enterprise Dashboard.

The Contractor shall coordinate solutions to problems and recommend changes to enhance EC Portfolio applications performance with the Installation Support Program Manager/Deputy PM/COR/COTR. The Contractor implements changes and updates to processes, procedures, permissions, and code configurations.

2.3.3.1 The Contractor shall provide test artifacts.

The Contractor shall support testing and evaluation. The Contractor shall develop test plans, execute tests (unit, system, functional, interface, regression, performance, integration and/or interoperability, negative, security and section 508 testing), generate necessary test data and transactions in the test (stage) environment to exercise all applicable data values which enables execution of required tests, and coordinate testing with selected end users in test environment as applicable.

Testing expected for each environment shall include validation of data source connection, hardware setup validation, software application testing, internal and external interface/dataset testing. The Contractor shall successfully complete unit, system performance and quality assurance testing and deliver a complaint product. The Contractor will fix issues identified during Contractor and Government testing to ensure a quality product. The Contractor shall provide a Testing and Evaluation Master Plan (TEMP), test plans, test results, Plan of Action, and Milestones (POA&Ms) for all defects identified, and resolution of defects.

2.3.3.2 Maintenance and technical issue resolution shall support turn-around time and restoration of service within 24-hours of a reported maintenance occurrence.

The Contractor provides direct support in the availability ensuring that environments, applications, and or services are correctly sized and tuned in accordance with the mission needs of the Program Management Offices (PMO) and the customers. The Contractor ensures personnel are available during core support hours of 0600 hours through 1800 hours Eastern Time, Monday through Friday.

The Contractor shall ensure that system to-system interfaces are operating and that the scheduled interfaces run at scheduled times, 7 days/week, 365 days a year. The Contractor ensures all detected problems are promptly reported and acknowledged within one (1) hour to the COR/ACOR/PMO.

The COR shall capture contacts times attempted by phone, text or email and report for metrics.

The Contractor shall provide the processes, procedures, people, documentation, operations support, deployment, security, configuration management and training required to sustain the application software. The Contractor shall correct faults, improve performance, and adapt the applications to changing organizational and technical environments. The Contractor shall support the resolution of problems discovered through the testing or operations. Defects identified in a new project will be corrected prior to production deployment unless otherwise agreed to by the Installation Support Program Manager. In the event a defect is not corrected prior to production deployment, it will be worked as a service ticket.

2.3.3.3 The Contractor shall support all migrations, upgrades, and modernization of the Applications.

The Contractor shall provide support for any and all major or minor upgrades, modernizations, migrations, or other required technical efforts required in support of continuous process improvement, innovation efforts, datacenter hosting moves, changes in policy or law or other EC Portfolio initiatives to the operational environment(s).

The Contractor shall provide support and coordinate with the COTS vendor to implement the NIBRS certification assistance package, which includes the following:

• Prepare, assist, and advise agencies with preparing for NIBRS participation and going through certification process.

• Technical configuration assistance to validate Online RMS Offense codes and State NIBRS code tables.

• NIBRS Clerk technical assistance for validating incidents and how to generate a NIBRS compliant submission file from the Online RMS.

• NIBRS Clerk assistance to generate, review, and submit up to 4 monthly NIBRS submission files (NIBRS certification requires 3 consecutive submissions with less than 4% error rate).

Certification assistance to review and troubleshoot NIBRS submission errors to obtain a less than 4% error rate.

• Error Rate testing, troubleshooting, software configuration updates.

• Guidance to demonstrate the capability to be responsive for handling rejected records and resubmissions.

• Assistance for Statistical Reasonableness review.

2.3.3.4 The Contractor shall maintain all system documentation.

The Contractor shall maintain documentation in accordance Risk Management Framework (RMF) and DoD Architecture Framework (DoDAF) artifacts such as System Views (SVs) Visio diagrams.

The Contractor shall update all documentation as changes occur or complete new documentation as required. Documentation also includes user guides, training materials, landscape documents, test plans, POA&Ms, technical support artifacts (Enterprise Change Requests (ECRs), firewall requests, access requests), Configuration Management Plan, support agreements, policy memos, data flow diagrams, DODAF Articles, disaster recovery plan, formal agreements (MOU, MOA, etc.), appointment letters, hardware/software listing, network diagrams, ports, protocols and services, risk analysis reports, residual risk statements, system security plan, Security Technical Implementation

Guides (STIG) reports, access control policy, audit logs, rules of behavior, incident responses, vulnerability management documentation (Authorizing Official Acceptance of Risk (AORA)) and business impact analysis. Additionally, the Contractor shall assist the Government in developing, updating, and maintaining lifecycle support documentation.

2.3.3.5 The Contractor shall provide change /configuration management support.

The Contractor shall support change/configuration management. The Contractor shall maintain a Configuration Management (CM) plan that addresses product management and version control of hardware and software for the project following DLA guidance and policies. The process should allow re-creation of all baseline deliveries from any point in time; it shall address configuration management administration, configuration identification, configuration control, configuration status accounting, and configuration audit procedures for EC Portfolio application software and documentation. The Configuration Management process will achieve the following objectives:

Identify, define, and control all relevant configuration items of the product Control modifications of all configuration items Record and report the status of configuration item and modification requests Ensure the completeness of the configuration items Control storage, handling, release, and delivery of the configuration items

2.3.3.6 The Contractor shall provide ticket support.

As instructed by the COR/ACOR, the contractor may be required to participate in meetings and conference calls with users, the functional community and the PMO to discuss requirements and trouble tickets; review and analyze production trouble tickets; and recommend and implement fixes as directed by the Government. Problems or potential problems discovered in basic maintenance are resolved by various service ticket types including General Work Orders (GWO), Project Work Orders (PWO), Break/Fix CRQs and normal project CRQs. Service tickets are used for all work including break/fix production issues, project support and development, research, planning, onboarding, and technical efforts such as upgrades, migrations, or technical refreshes. Service tickets will be created by the Government and/or may be initiated as requested by the Contractor’s Project Manager and are assigned a ticket priority (listed below) using inputs from the customer, the COR/ACOR and other technical staff. Criteria for High, Medium, and Low are based on business days and exclude weekends or holidays, which may fall into the range of ticket creation.

Severity Code. Indicates the Certification Authority (CA) assessment of the likelihood of system-wide IA consequences, given single or multiple findings. The Severity Code is assigned to a system IA security weakness by a CA as part of a certification analysis to indicate (1) the risk level associated with the IA security weakness and (2) the urgency with which the corrective action must be completed. Severity codes are expressed as “CAT I, CAT II, CAT III,” where CAT I is the indicator of greatest risk and urgency.

CAT I Severity Code. Assigned to findings that allow primary security protections to be bypassed, allowing immediate access by unauthorized personnel or unauthorized assumption of super-user privileges, and usually cannot be mitigated.

CAT II Severity Code. Assigned to findings that have a potential to lead to unauthorized system access or activity. CAT II findings can usually be mitigated and will not prevent an ATO from being granted.

CAT III Severity Code. Assigned to recommendations that will improve IA posture but are not required for an authorization to operate.

Web Inspect vulnerability definitions are listed below. Critical, high, and medium findings must be resolved before final approval is granted:

The definitions for the priorities below are defined in the DLA Enterprise CM Guidance available upon request.

Expected performance times by activity for each priority provided below for a GWO and break/fix

CRQ:

Critical: Within two (2) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide triage support/diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through troubleshooting, analysis, development, administration work that will be supported to resolution.

The objective for resolving a Critical ticket is as soon as possible for all tasks. A Critical remains the work focus until validated fixes are operational in a Production environment including after-hours work.

Historically, the applications have only experienced limited instances of Critical work. Possibly, 1 or 2 total a year is expected.

High: Within four (4) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide triage support/diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through troubleshooting, analysis, development, administration work which will be supported to resolution.

Contractor typically receives a range of 25-30 High priority tickets per year.

Medium: Within eight (8) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through troubleshooting, analysis, development, administration work that will be supported to resolution.

Contractor typically receives 50-55 medium tickets per year.

Low: Within sixteen (16) hours of notification (email, ticket in the queue, phone call, systemic monitoring alert or other communication), the Contractor shall provide diagnostic which includes the anticipated remediation plan and the remediation timeline. Remediation plan includes support through troubleshooting, analysis, development, administration work that will be supported to resolution.

Contractor typically receives 90-100 low tickets per year.

The Contractor shall create, control, and maintain the master data and settings that integrate the daily operations including:

• Use analytics to assess response times and staffing levels

• Follow National Fire Protection Association (NFPA 1710) standards of cover

• Follow NFPA 1500 standards for safety analytics

• Display an overview of department activities

• Export fire and EMS data in real time or at the end of a response

• Use a dispatching interface to transmit, configure, and upload data directly

• Assign and track personnel and apparatuses during a shift

• Match employee preferences and unique job responsibilities

• Feed data to reports, incidents, and analytics about the coverage area

• Track agency’s contributions to the community outside of pure emergency services

• Track hydrant locations, manufacturer and replacement information, maintenance records and flow test data

• Allow for the storage and creation of patient care reports

• Create emergency patient care reports with 100% National Emergency Management System (EMS) Information System (NEMIS 3.X AND ABOVE) compliance

• Automatically submit records to local, state, and federal data collection agencies

• Create fire response reports with 100% National Fire Incident Reporting Systems (NFIRS) compliance

• Automatically submit records to local, state, and federal data collection agencies

• Map incidents, hydrants, and occupancies by type

• Track equipment item usage

• Send notices via email to responsible personnel, reminding them to reorder supplies

• Develop the minimal number of custom components or modules required to augment the capabilities provided by the Emergency Records Management and Reporting Software meet the requirements in this PWS Store files for personnel to view, such as PDF or video files

• Track status, location and service life of all agency apparatus including self-contained breathing apparatus (SCBA), bunker gear, hoses, emergency medical equipment and other fire related equipment

• Manage valuable data for buildings and other structures in the agency’s coverage area (e.g., prefire plans, fire extinguishers, fire protection and prevention systems)

• Run real-time (incident, station activity, personnel) reports

• Schedule personnel to populate the Daily Roster

• Automatically populate incident reports

• Create and store all records, documents and other information related to fire and EMS personnel training

• Calculate response times and plan resource deployment

• Record the location and potential impact of hazardous materials

• Determine the required fire flow needed to stop a fire at origin

• Evaluate potential medical emergencies involving mass casualties

• Develop the required documentation to support the Center for Public Safety Excellence (CPSE) accreditation process. The Accreditation model includes a comprehensive research and information collection guide with checklists, exhibits, benchmarks, references, and activities broken down by category. Several appendices address additional topics including defining the elements of response time, creating standards of response coverage, and developing master or strategic plans.

The Commission on Fire Accreditation International (CFAI) accreditation model includes these performance evaluation categories:

a. Assessment and Planning

b. Essential Resources

c. External Systems Relations

d. Financial Resources

e. Goals and Objectives

f. Governance and Administration

g. Human Resources

h. Physical Resources

i. Programs

j. Training and Competency

Provide maximum output from the data collection to produce multi-level data analysis and report building

Collect and report comprehensive information related to fire and emergency service operations support including:

a. Incident response documentation and reporting for all hazard’s emergency incidents

b. Emergency medical patient care recordkeeping and reporting

Comply with National Fire Incident Reporting Systems (NFRIS) 5.1 including:

a. Collect and report the NFRIS data elements

b. Vendors must comply with NFIRS 5.X and above, Active Vendor by time of award

Comply with Health Insurance Portability and Accountability Act (HIPAA)/Personally Identifiable Information (PII)

Comply with National Emergency Management System (EMS) Information System (NEMIS 3.X AND ABOVE) Gold.

a. An EMS data system is defined as any software associated with Emergency Medical Services that provides a mechanism to collect, document, analyze, or otherwise store and use data associated with an EMS event. This includes but is not limited to:

i. EMS dispatch data systems

ii. EMS medical device data systems

iii. EMS patient care documentation systems

iv. EMS billing systems

v. EMS quality management or reporting systems

a. An EMS data system is Gold compliant with the National Highway Traffic Safety Administration (NHTSA) Version 2.2.1 Dataset…