Attachment A - Statement of Work.pdf

Attachment A

STATEMENT OF WORK (SOW)

1. General Information

Project Title:

Fire & Emergency Medical Services Records Management System (FEMSRMS)

Agency/Organization:

Office of the Chief Information Officer (OCIO) on behalf of the Office of Protective Services

Requiring Activity:

Procure a Commercial off the Shelf (COTS) Software as a Service (SaaS) solution for Fire and Emergency Medical Services (EMS) Records Management

Program Office: Office of Protective Services

Date: July 2026

2. Background

The NASA Office of Protective Services (OPS) fire departments require a robust, integrated, and secure Records Management System (RMS) to replace outdated, manual, and fragmented systems. Increasing emergency service demands have amplified risks and inefficiencies associated with spreadsheet-based record keeping, creating operational gaps that jeopardize firefighter safety, mission assurance, and Center readiness.

Implementing a comprehensive RMS directly supports OPS’s strategic commitment to safeguarding NASA personnel, infrastructure, and mission-critical operations. To ensure capital project delivery, improve oversight and reporting capabilities, and to mitigate risk, NASA requires a Commercial Off the Shelf (COTS) and Software as a Service (Saas) enterprise-level Fire and EMS solution that aligns with industry standards and is robust, integrated and secure.

3. Objective

NASA seeks to acquire a Commercial Off the Shelf (COTS) solution for Fire and EMS Records management system along with Professional Services for tailoring and implementation of such a system. The configured COTS solution shall be known as Fire & Emergency Medical Services Records Management System (FEMSRMS)

NASA’s objective with the acquisition of FEMSRMS is to implement and configure a COTS solution that will:

• Replace manual and fragmented fire and EMS Records Management Systems with a modern cloud-based solution that meets NASA OPS and OCIO requirements.

• Enable site consolidation for data sharing.

• Achieve cost savings through efficiencies gained from reducing the number of solutions maintained/supported.

The contractor shall provide a cloud-based configured COTS offering, shall meet the technical and operational requirements herein, shall ensure integration with specified information technology (IT) systems and software, and shall operate and maintain FEMSRMS in accordance with industry best practices, Federal Regulations, and NASA guidelines and requirements. The contractor shall provide a solution that is Federal Risk and Authorization Management Program (FedRAMP) High Authorized at the time of contract award. The Government intends to achieve Agency Authority to Operate (ATO), in accordance with NPR 7120.7, prior to system to go live.

4. Scope

4.1 Functional Standards

4.1.1 The solution must be a COTS product and hosted in a cloud environment.

4.1.2 The FEMSRMS solution must provide the following capabilities:

• Incident reporting & fire documentation: create fire/incident reports and emergency response documentation with Fire Risk Management Service (FRMS) capture, National Emergency Response Information System (NERIS) v1 connectivity and an National Fire Incident Reporting System (NFIRS) legacy crosswalk for reporting.

• Electronic Patient Care Report (ePCR) & hospital data exchange: National Emergency Medical Services Information System (NEMSIS)-compliant electronic patient care reporting that is Health Insurance Portability and Accountability Act (HIPAA)-aware, includes a hospital handoff packet, and supports one-way digital transfer to receiving facilities.

• Integrated authentication & security: PIV-based integrated authentication for users.

• CAD ingestion & mobile responder/notifications: vendor-agnostic CAD interface (Central Square compatibility required), mobile responder capability (notifications, incident access on any device), and offline-capable mobile cache with sync-on-reconnect for intermittent-connectivity sites (e.g., White Sands, Stennis).

• Pre-Incident Planning: Build actionable pre-incident plans for response personnel.

• Connections to ESRI/ArcGIS for mapping, hydrant and water supply tracking

• Facility inspections, pre-plans, and Inspect-Test-Maintain (ITM): mobile inspection and pre-plan workflows with deficiency tracking, ITM management, trend/reporting on inspection compliance.

• Personnel scheduling & rostering: centralized personnel records, roster and leave management, qualifications tracking, auto shift-coverage proposals, and automated staffing notifications.

• Training, virtual training & compliance: course catalog, completion records, certification-expiry alerts, virtual end-user training, and training analytics for compliance with applicable standards (e.g., NFPA, FAA, NASA where required).

• Exposure tracking & health/wellness: per-responder, per-incident exposure history, cancer-presumption alignment, and health/wellness documentation and reporting.

• Incident command & on-scene (ICS) accountability: ICS form set, tactical worksheets, resource tracking, action-item tracking, and personnel accountability at incidents.

• Apparatus, equipment, fleet & asset management: asset register for apparatus and equipment, maintenance scheduling, Out of Service (OOS) tracking, recall management, inspections, and lifecycle/supply tracking.

• Narcotics & controlled-substance management: Drug Enforcement Agency (DEA)-compliant chain-of-custody, witnessed waste, reconciliation, and controlled-substance tracking integrated with asset/inventory controls.

• Investigations & evidence management: fire cause-and-origin documentation with customizable investigation forms and full evidence chain-of-custody tracking.

• Events, activities & non-incident records: capture and report daily departmental activities and non-incident events.

• Data, analytics & reporting: incident analytics, compliance and inspection-trend reports, and exportable data for downstream use.

• Data migration & test environment: limited/legacy data import capability plus a separate non-production test/sandbox environment for training and configuration testing.

o The migration scope is limited to the conversion and loading of information contained in legacy paper-based documents into the FESMRS. NASA will provide scanned electronic copies of the legacy paper documents to the Contractor via email. The documents must be complete and reasonably legible to support data capture and migration into the FESMRS. Any missing, illegible, or corrupted documents will be identified to NASA for resolution.

4.1.3 The solution will provide 2 stations at Kennedy Space Center, 2 stations at Wallops Flight Facility, 1 station at Stennis Space Center, 1 station at Ames Research Center, 1 station at White Sands Test Facility, and one independent non-production test environment. The procurement will be for a base year for the configuration, setup and training of the FESMRS. Along with four additional option years for annual maintenance and hosting infrastructure of the

FESMRS.

4.2 Security Requirements

4.2.1 The contractor COTS solution shall support a secure, multi-factor authentication (MFA) method for Government-consuming end users to access the service and for Government personnel who will perform administrative duties. The contractor shall support integration of the service with multi-factor NASA authentication services including Single Sign On (SSO) and Federal Government Personal Identity Verification (PIV) Card access. A user inside NASA’s firewall shall be able to access the solution without having to provide separate credentials. The contractor provided solution shall support an MFA solution that aligns with all applicable Federal IT security standards and policies. Access controls must comply with the applicable portions of all NASA and Federal IT Security standards and policies listed in Paragraph 5. These policies include session timeouts and inactive user lockouts. The information system/IT solution shall support role-based access controls to distinguish between end users needing access to different levels of data (e.g., end users only needing access to non-sensitive data and end users needing access to sensitive data).

4.2.2 The system shall have a FedRAMP High Authorization package. FEMSRMS shall have an active FedRAMP High Authorization package and shall maintain authorization through the performance period of the contract.

5. Contractor Responsibilities

The contractor shall provide all material, equipment, and labor necessary to perform all tasks associated with the licensing, hosting, configuration, testing, integration, data migration, implementation, training, and administration of the contractor provided solution. This shall include, but is not limited to, technical implementation of all system enhancements including beta testing, minor releases, major releases, software updates, and configuration changes.

The Contractor shall:

• Furnish all management, supervision, labor, equipment, and materials unless otherwise specified.

• Maintain project schedules.

• Comply with all applicable federal regulations.

• Protect Government information.

• Coordinate with Government personnel.

• Maintain required licenses and certifications.

6. Place of Performance

All work associated with the performance of this contract shall be performed off-site.

Access to NASA Center/Sites/Facilities will not be required.

7. Period of Performance

Base Period:

From: August 2026

To: August 2027

The base year shall include:

• Configuration, setup and training.

• Licenses and limited data import for 7 stations, 7 training sessions.

• 7 operational stations plus one non-production test system.

• Command and investigation licenses for each station including the test system

• One CAD connection license will be included for the KSC station.

• Program service licenses including HIPPA certification and authentication enablement licenses at all stations

Each option year shall only include the recurring subscriptions for all stations including the test instance. Setup, data import and web training shall not be included.

Option YEAR 1: August 2027 – August 2028

Option YEAR 2: August 2028 – August 2029

Option YEAR 3: August 2029 – August 2030

Option YEAR 4: August 2030 – August 2031