Attachment A - SOW - Hazardous Food and Drug Recall Notification.pdf

STATEMENT OF WORK

(SOW)

1 Title. Hazardous Food and Drug Recall Notification Solution (HFDRNS)

2 Background Information.

The Defense Commissary Agency (DeCA) operates 235 military grocery stores worldwide. As a premier military benefit, DeCA must not only provide groceries and services to comparable to commercial counterpart offerings, but it must also instill confidence that its resale food items are safe and uncontaminated from dangerous bacteria and other harmful pathogens. DeCA’s Hazardous Food and Drug Recall (HFDR) program is responsible for ensuring this confidence by resolving nearly 700 recalls annually.

HFDR receives recall notices from a number of disparate sources such as contractors, distributor, manufacturers, brokers, news media, and the Department of Defense (DoD) All Food and Drug Act (ALFOODACT). When a recall notification is determined, through coordination, to affect product within DeCA’s stock assortment, HFDR disseminates the recall notification and disposition instructions through and automated food and drug recall system that is web based to over 2,115 single users located at our commissary stores and CDCs around the world.

3 Scope.

The objective of this requirement is to obtain a recall notification capability. This system, managed by the service provider external to DeCA’s systems, must include web-accessible automation that will disseminate HFDR generated instructions, deliver reference documentations (e.g., signs), collect data on actions taken by the site (i.e., store, Central Distribution Center (CDC), or Central Meat Processing Plant (CMPP)), and store this information for 12 months or according to DoD National Archives and Records Administration (NARA) regulations whichever is the longest period of time. The system will not use, generate, or maintain any DoD- Classified information, or interface with any existing DeCA IT system (e.g., sales, inventory, or logistics). The service will also provide reporting and dashboard capabilities to track a recall from notice to completions.

4 System Requirements.

The HFDRNS must allow DeCA to rapidly respond to recall notices 24/7, and to disseminate recall notifications to all DeCA stores, central distributions centers (CDCs) and Central Meat Processing Plant (CMPP) regarding product and disposition instructions. It must also collect all responses regarding actions taken by site. The solution must provide reports and dashboards tracking recall status from notification through conclusion. Information captured by this service must include: DeCA area, DeCA zone, site name, responder’s name, status of recalled products, product quantity, with date and time stamps. The service must provide DeCA the real-time ability to view the status of all DeCA facilities worldwide, display reporting statistics, generate reports on recall effectiveness, identify late responders, and send alerts or reminder notifications as necessary.

The vendor must provide necessary personnel expertise to configure, train, implement, host and maintain the Recall Notification Service. All support for documentation, training, information assurance, hosting, and data management must be in accordance to DoD Guidelines. The system must include record retention services that adhere to DeCA and National Archives and Records Administration (NARA) guidelines. The HFDRNS offeror’s quote must provide an approach, to include the system requirements described herein, through software as a service (SaaS).

• Access: The system must provide support role-based security, workflows and approvals to authorized users (via DoD issued common access card (CAC) authentication).

Notification generation, dissemination and responses based on roles and workflows, will include information pertaining to the recall and will direct the necessary actions by the addressees. The recipients must be capable of inputting status of recall items to include on-hand quantities and disposition.

• Response Collection: The system must allow notification recipients the ability to provide input regarding 1) the quantity of product on hand related to the recall; 2) the cost of the respective product; 3) the status, action taken, or disposition of the respective product.

The system must allow the respondent to modify or correct initial responses with audit capabilities. The system must allow alternative respondents and provide escalation alternatives should there be an absence or situation which prohibits a response from the primary respondent. All responses must include auditing capabilities to include time and date stamps.

• Reporting: The system must provide industry standard reporting templates as well as allow for ad hoc reports and dashboard creation. The system must allow data exports into an MS Excel file to allow users to generate ad hoc reporting. The system must provide the capability to: 1) rapidly determine the status of all DeCA facilities worldwide; 2) identify late responders; 3) send reminder notifications to include notification escalation;

3) collect, maintain, and display data (to include cost and quantity) for reporting statistics; 4) generate reports; and 5) configure performance and status dashboards to track a recall from notice to completions.

• Data Repository: The system must retain all data in a historical database that will allow DeCA users to track the recalled item through final disposition, and to conduct trend and other analytic analysis. The service must maintain a data repository to allow authorized users access to recalls, resident within the historical data repository for a period of one year. The repository must maintain historical records in compliance with DoD, DeCA, and NARA retention guidance.

5 Configure, Implement & Test.

The solution must clearly define the implementation and configuration of the HFDRNS, including:

o Setting up the application o Ensuring only authorized users can authenticate and use the solution o Establishing user profiles o Developing and implementing workflows, processes, and reporting o Providing secure sockets layer (SSL) certification

The HFDRNS must support role-based security, workflows and approvals. The contractor must test updates in a sandbox before they are deployed, and set up automated/canned and configurable reports, dashboards and queries. The contractor must include licenses to allow for 24/7 site availability for 7 super users and an unlimited number of users that have recall input responsibility at the store and CDC levels.

6 Training.

Training must be provided in a single live or interactive session for no more than 20 users. This training must be conducted on-site or via remote using MS Teams at DeCA Headquarters prior to the government’s acceptance of the system. The content of the training session must ensure a transfer knowledge for end to end service usage, to include generating recall messaging, disseminating, collecting responses, reporting (queries, reports, and dashboard customization), and trouble shooting. This training must be recorded and in addition to help screens, this recording must be accessible through the web-based application. The contractor must quote a methodology for defining a successful transfer of knowledge.

7 Hosting.

The Vendor must provide a fully implemented Food Recall Notification Service that allows authorized users to disseminate recall information, respond recall notification, generate reports and query notification status. The vendor must host and maintain the service, this includes routine patches, fixes and Microsoft compatibility updates; and providing disaster recovery capability. The vendor’s support must be available to DeCA at a minimum Monday through Friday from 8 am – 5 pm EST with email or text support during off-hours.

8 Deliverables and Delivery Schedule.

The HFDRNS quote must include draft deliverables as summarized, in Table 1.

Table 1. HFDRNS Deliverables and Schedule

SO

W

Par g-rap h

Deliverable Title Description Format Due Date Quant ity

1 0 Onsite Kickoff Meeting*

Review and finalization of planning materials submitted with vendor’s quote.

Face-to-face meeting

Within 7 days post award

2 4 SaaS License unlimited concurrent internal users, to include 7 super-users.

Contractor- Determined Format

At least 5 business days prior to system implementat ion

Contra ctor Deter mined:

enterpr ise or unlimi ted users

3 5

Configuration and Implementatio n Plan and Project Schedule

Plan and schedule detailing actions to be taken for configuration and implementation, which include, but may not be limited to, evaluating DeCA’s current systems and workflows and providing recommendations on the best approach, fully configuring and implementing all system applications and completing the transfer of data without an interruption in service to DeCA as it transfers between solutions.

- Draft Configuration and Implementation Plan and Project Schedule, in format compatible to MS Office Suites.

- Final Configuration and Implementation Plan and Project Schedule, in format compatible to MS Office Suites.

DRAFT -

Solicitation Due Date

FINAL –

within 5 business days of kick-off meeting

4 6 User training

One interactive session for up to 10 trainees

Contractor- Determined Format

No more than 5 business days prior to system implementat ion

5 7 Annual SaaS License to include System

The contractor must define its service level agreement (SLA) for support response and

Contractor- Determined Format

Annually, After Contract Award

Per Accou nt

Support / Maintenance resolution, with a maximum of 24 hours’ support response time for all maintenance issues.

9 Place of Performance.

The HFDRNS must use the SaaS methodology and allow the Government accessibility via the Cloud. Initial configuration and implementation meetings must take place on-site, at DeCA Headquarters, but will be acceptable for meetings to take place via video teleconferencing. The DeCA Headquarters address is:

DeCA HQ/MPMP 1300 Eisenhower Avenue Fort Gregg-Adams, VA 23801-1800

10 Period of Performance.

Base Year: December 13, 2023 – December 12, 2024 Option Year 1: December 13, 2024 – December 12, 2025 Option Year 2: December 13, 2025 – December 12, 2026 Option Year 3: December 13, 2026 – December 12, 2027 Option Year 4: December 13, 2027 – December 12, 2028

11 Inspection and Acceptance.

DeCA will inspect and accept the HFDRNS to ensure that it is successfully developed, integrated and implemented and meets the minimum requirements defined in the SOW. If any element of the final solution prevents a full implementation in DeCA’s environment, the solution will not be accepted by DeCA.

12 Existing Environment.

Program must be compatible with the most recent version of Microsoft Edge, Google Chrome or Mozilla Firefox.

13 Security.

Requests for proposals must include sufficient information on which to evaluate each offeror’s proposed approach to satisfying the security control requirements prior to use of the services.

This approach must also include a process to address the DeCA Program Manager’s requirement for continued assessment and maintenance of security control requirements throughout the life of the contract.

In addition to complying with installation access as delineated in clause 52.204-4500, contractors shall comply with country, municipality and any other applicable authority to include policy, regulations or laws regarding access to geographic areas and buildings with regards to performance of an award resulting from this solicitation.

In accordance with DoDI 8500.01 and DoDI 8510.01, DoD organizations that use external IT services provided by a commercial or other non-federal government entity must ensure the security protections of the information system delivering the service is appropriate to the confidentiality, integrity, and availability needs of the DoD organization's information and mission.

The contractor will report all cybersecurity issues directly to the Chief Technology Officer (CTO), Information System Security Manager (ISSM), Program Manager (PM) or Senior Information Security Officer (SISO).

Unclassified, closed role-based solution. The following controls must be addressed in the offeror’s approach, at a minimum, for any web-based service:

o Removal of default system accounts.

o Develop configuration standards for system. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards. Sources of industry-accepted system hardening standards may include, but are not limited to: (Center for Internet Security (CIS), International Organization for Standardization (ISO), SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST)) o Identify, address, and remediate new threats and common vulnerabilities affecting the system on a routine basis and in a timely manner.

o The site must perform user authentication with unique userids (individual unique IDs assigned to each individual user) and passwords that meet DoD password complexity requirements [as supported by the service].

o The following account management practices must be addressed in the offeror’s approach:

(a) Enforcement of change of characters when a password is changed

(b) Password minimum and maximum lifetime restrictions

(c) Prohibits password reuse restrictions

(d) Allows the use of a temporary password for system logons with an immediate change to a permanent password o Stores and transmits only cryptographically-protected passwords (encryption must use strong cryptography standards recommended by current industry best practices such as NIST – weak cryptography must not be used and must be replaced, as necessary, to maintain industry best practices through the life of the contract.

o Ensure that all security relevant and operational status changes are reported to the DeCA Program Manager.

14 Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI).

Government furnished equipment (GFE) will not be provided. Government-Furnished Information will be provided to the contractor, as required.

The awardee will be responsible for hardware and software required for use by its personnel.

15 Section 508 Accessibility Standards.

The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.