Attachment J-1 Fleet Management System Solution SOW.pdf

Attachment J-1 – Fleet Management System Solution Statement of Work (Section C)

C.1 Overview. The Court Services and Offender Supervision Agency (CSOSA) staff occupies nine locations through the District of Columbia. In order to effectively supervise clients and support CSOSA’s involvement in the community, CSOSA maintains a fleet of approximately 69 vehicles. Currently, all vehicles are Government Owned Vehicles (GOVs) and leased from the General Services Administration (GSA).

C.2 Fleet Management System Performance Requirements. The Contractor shall provide a fully operational web-based, all-inclusive (off the shelf) fleet management software/hardware solution that consists of all the performance elements outlined in herein within 90 days after award.

C.2.1 Vehicle Reservation Requirements.

C.2.1.1 Vehicle Reservation Software Requirements. The fleet management system software shall include, at a minimum, the following capabilities:

C.2.1.1.1 On-line GOV reservations;

C.2.1.1.2 Displays real time GOV availability;

C.2.1.1.3 Allows the requester to check-out and check-in the GOV electronically.

C.2.1.1.4 Includes an online approval process to be configured by the System Administrator(s) before a GOV can be reserved.

C.2.1.1.5 Allows System Administrator(s) to configure pre-requisites for reserving GOVs, e.g., completion of driver portfolio information outlined in Section C.2.4 below.

C.2.1.1.6 An automated clearing of unused reservations within:

• 24 hours of the reservation start time for a full day reservation; and

• Two hours of reservation start time for a partial day reservation.

C.2.1.1.7 Includes an automated message to be generated and sent to the System Administrator(s) when drivers leave comments about a GOV so that each reservation does not have to be checked for any comments.

C.2.1.2 Vehicle Reservation Hardware Requirements.

C.2.1.2.1 The Contractor shall install an electronic, lockable key storage mechanism (e.g., kiosk/key box). The kiosk/key box shall be enabled via a touchscreen that will automatically unlock the key box to retrieve and return GOV keys during the check-out and check-in of GOVs.

In addition, the kiosk/key box shall allow for the fuel card to be stored with the GOV key.

9594CS21Q0004

Attachment J-1, Fleet Management System Solution Statement of Work

C.2.1.2.2 A kiosk/keybox shall be installed at each of the following CSOSA locations.

• 800 North Capitol Street, NW, 2nd Floor, Washington, D.C. 20002

• 800 North Capitol Street, NW, 6th Floor, Washington, D.C. 20002

• 300 Indiana Avenue, NW, Suite 2056Washington, D.C. 20001

• 633 Indiana Avenue, NW, 12th Floor, Washington, D.C. 20004

• 1230 Taylor Street, NW, 2nd Floor, Washington, D.C. 20011

• 910 Rhode Island Avenue, NE, 2nd Floor, Washington, D.C. 20018

• 3850 South Capitol Street, SE, 2nd Floor, Washington, D.C. 20032

• 2101 Martin Luther King, Jr. Avenue, SE, 1st Floor, Washington, D.C. 20020

• 1900 Mass. Avenue, SE, 3rd Floor, Washington, D.C. 20003

C.2.1.2.3 Once the kiosk/keybox hardware is installed, the Contractor is responsible for ensuring successful connection of the hardware to the fleet management software. Kiosk/keybox shall be functional and be able to communicate with the fleet management software.

C.2.2 Access Control Levels. The fleet management system software shall have the ability to provide layered access controls that can be configured by designated CSOSA personnel. Access control includes, but is not limited to the following:

C.2.2.1 System Administrator(s):

• Add/delete GOVs from inventory or change the CSOSA location where the GOV is retained;

• Disable GOV availability for maintenance/repair services or other issues;

• Assign GOVs when Site Coordinator/Dispatcher is unavailable;

• Generate/manage fleet reports;

• Create/cancel GOV requests;

• Allow for confidential driver information identified in Section C.2.4 below to be viewed by others, if determined appropriate; and

• Access a display screen to view the entire fleet at all CSOSA locations.

C.2.2.2 Site Coordinator/Dispatcher:

• Assign GOVs to users;

• Disable GOV availability for maintenance and repair issues at a specific CSOSA location;

• Create/cancel GOV reservations; and

• Access a display screen to view fleet at a specific CSOSA location.

C.2.2.3 Supervisor:

• Approve/disapprove user GOV reservation requests; and

• Access a display screen to view the Supervisor’s staff GOV reservations requests and activities. Such as, approval assignment activities, site/field visits information that the supervisor needs in order to approve the request.

C.2.2.4 User/Requestor/System Admin:

• Create/cancel GOV reservation requests; and

• Access to display screen to view the user/requester GOV reservation requests and activities. Such as, approval GOV assignment activities.

C.2.3 Vehicle Usage Information Management. The fleet management system software shall allow CSOSA to input new GOVs and track detailed GOV usage information, including:

• Mileage data o Per fleet, per CSOSA location, per GOV; and o For each of the above elements, per year, per quarter, per month, per week, or per day of the week);

• Frequency of GOV usage;

• Purpose of usage;

• Trip logs;

• Ability to attach trip planning documents; Documents vary per departments, and

• Ability to identify each GOV by “In-Service”, “Out-of-Service” and “Retired” status. “In-Service” means GOV is available to be used. “Out-of-Service” due to maintenance, vehicle inspection, etc. “Retired” means vehicle has been exchanged or returned. We need to keep track GOVs we used to have.

C.2.4 Driver Information Management. The fleet management system software shall:

C.2.4.1 Provide user created profiles with the ability to store and track all driver information, specifically:

• Driver’s name;

• Driver’s license number;

• State driver license issued;

• Driver license expiration date;

• Employee office location

• Employee office phone number;

• Employee mobile number; and

• Employee’s supervisor name.

C.2.4.2 Require all information in Section C.2.4.1 above as mandatory for completion before any GOV can be reserved.

C.2.4.3 Driver’s license number, state issued, and license expiration date are considered confidential information and shall only be available to the System Administrator(s) with the capability of being made available to others if the System Administrator(s) determine appropriate.

C.2.5 Vehicle Maintenance and Repair Management. The fleet management system software shall provide the ability to log all information related to all GOV maintenance and repairs, i.e.:

• Identification of the GOV receiving service;

• Type of work completed;

• Cost of work performed;

• Condition of GOV when it is repaired; and

• Provide a comment field to track additional information.

• Automated messages to administrators about the vehicle’s need for repairs.

C.2.6 Vehicle Traffic Violations Management.

C.2.6.1 The fleet management system software shall allow for the following information to be input for GOV traffic violation management:

• Driver name;

• Driver license number;

• Employee office location;

• Date, time, and location of the violation;

• Ticket/citation number;

• Type of violation;

• Amount of fee assessed;

• Paid status of assessed fee;

• GOV license plate number violation was cited; and

• Accident tracking number (if an accident was involved).

C.2.6.2 The system software shall have the ability to query the total number of cited traffic violations by driver.

C.2.7 Accident Management. The fleet management system software shall allow for the following information to be input for accident management:

• Driver and Passenger information; this is a form to upload.

• Police report number;

• Damage category to GOV, i.e.:

o None;

o Minor – no repair needed;

o Minor – repair needed;

o Major damage;

o GOV totaled;

• GOV tow status (yes/no);

• Tow cost;

• Cost of repair;

• Other GOV involved (yes/no)

• Other GOV driver name and contact number;

• Other GOV license number;

• Other GOV passenger information (name and contact information)

• Status section, i.e.:

o Referred to OGC (yes/no);

o Pending additional information;

o No further action required;

• Comment section; and

• Ability to upload any pertinent photos or documents.

C.2.8 Telematics.

C.2.8.1 Telematics allows the Agency to maximize efficiency and accuracy in managing the Government Leased Vehicles. The fleet management system must be able to integrate telematics data from GSA’s telematics provider (currently GeoTab) obtained from the GOV’s telematics module.

C.2.8.2 In addition, any devices supporting the current GSA system must be approved by GSA before installing in the GSA leased vehicles.

C.2.9 Reports. The system shall be able to generate the below identified reports:

• GOV Usage – capable of providing a report on any combination or all data fields identified in Section C.2.3 above;

• Driver Information – capable of providing a report on any combination or all data fields identified in Section C.2.4 above;

• Maintenance & Repair – capable of providing a report on any combination or all data fields identified in Section C.2.5 above;

• Traffic Violations – capable of providing a report on any combination of or all data fields identified in Section C.2.6 above;

• Accidents – capable of providing a report on any combination or all data fields identified in Section C.2.7 above;

• GOV Status – availability

• Ad hoc reports – any combination of information included in the system.

• The system shall also provide fuel management tracking features such as automatic odometer readings and gas levels.

C.2.10 Records Retention Capability. The fleet management system software shall have capability to upload Excel spreadsheets, pdf files, Word documents, and other attachments necessary to manage the fleet.

C.2.11 System Welcome/Home Page. The fleet management system software shall include a welcome/home page includes an access button/icon for each of the system features identified in Section C.2.1 through C.2.10 above as well as other areas to be accessed, e.g., settings, tools, messages from the System Administrator(s), etc.

C.3 Information Technology (IT) Requirements.

C.3.1 The fleet management system software must:

C.3.1.1 Support touch screen capability;

C.3.1.2 Include an on-line training module;

C.3.1.3 Include a “Help” icon for each module and/or screen;

C.3.1.4 Be HTML5 compliant; and C.3.1.5 Have override capability.

C.3.2 The application shall be compatible with Microsoft Edge and Google Chrome.

C.3.3 The system must support SQL Server 2016, Windows Server 2016 and Microsoft Development Environment.

C.4 Fleet Management System Testing Requirements. Final acceptance of a fleet management system that complies with all the requirements identified in this Statement of Work, implemented within 90 days after award, will be provided by the COR upon successful completion of the following:

C.4.1 An out of production pilot test. The Contractor shall conduct testing of the system in a realistic environment similar to the production environment. The Contractor shall develop a schedule for testing, test methodology, conduct internal and external testing, bug reporting, tracking, and a confirmation of fixes. The pilot test must be approved by the COR before the Contractor may proceed to the in production test identified below.

C.4.2 Once the pilot test is approved by the COR, an in production test to determine the operational fleet management system includes all the features and requirements identified in this Statement of Work.

C.5 Migrating CSOSA’s Current Fleet Management System Data. The Contractor shall migrate all data in CSOSA’s current fleet management system to the new fleet management system within 90 days from date of award. The current system data is on SQL platform.

C.6 Training.

C.6.1 All training outlined in this section shall be performed on-site at a CSOSA location designated by the COR unless otherwise agreed to by the COR. Training shall be provided upon final acceptance of a fully operational web-based, all-inclusive (off the shelf) fleet management software/hardware solution. Training dates shall be coordinated between the COR and the Contractor. Trainings shall be for OIT, COR, end users (including Facilities, Site Coordinators, and requesters), C.6.2 The Contractor shall provide one 1-day on-site comprehensive training on the software and hardware operations, including on-site demonstration of kiosk/key box system, for up to ten CSOSA personnel. This training is for CSOSA’s highest access control level.

C.6.3 The Contractor shall provide one 1-day on-site comprehensive training on the software and hardware operations, including on-site demonstration of kiosk/key box system, for the site coordinators/dispatchers and supervisors, up to 30 CSOSA personnel.

C.6.4 The Contractor shall provide one half day training on IT administration for up to five CSOSA personnel. The location of the training will be at one CSOSA site to be determined by the COR. The date of the class will be coordinated between the COR and the Contractor upon award.

C.7 Requirements for Professional Services for Vendor Proposed Fleet Management System.

C.7.1 CSOSA Hosted Fleet Management System. The fleet management system provided is to be hosted by CSOSA.

C.7.1.1 The Contractor shall provide installation, configuration, and technical support throughout implementation of the fleet management system; and

C.7.1.2 The Contractor shall provide all system software maintenance and support throughout the 12-month base period of performance as part of the acquisition cost of the system to include, but not limited to:

• Resolving any issues identified during installation of software upgrades or modifications; and

• Resolving any other software issues identified during performance of the fleet management system.

C.7.1.3 The Contractor shall provide professional services for installation, configuration, and technical support throughout implementation of the fleet management system.

C.7.1.4 The Contractor shall provide all system software maintenance and support throughout each option period of performance to include, but not limited to:

• Resolving any issues identified during installation of software upgrades or modifications;

• Resolving any other software issues identified during performance of the fleet management system; and

• Annual software licenses.

C.7.2 Security Management.

C.7.2.1 Within 90 days after installation, the Contractor shall work with CSOSA to identify, as security-critical, those core items (hardware, software, or business process) whose failure could lead to a breach of system security. For each risk identified, the Contractor shall assist CSOSA to develop a security assurance strategy to ensure that the requirements, design, implementation, and operating procedures for the identified product minimize or eliminate the potential for breaches of system security. The Contractor shall assist CSOSA to record the strategy in the Security Management Plan, implement the strategy, and produce evidence, as part of required IT products, that the security assurance strategy has been carried out.

C.7.2.2 All plans must identify through a brief description and drawing any and all external connections made by the application to vehicle on-board devices or other applications. Included in the description must be the method, if any utilized, of communication encryption.

C.7.2.3 Identify and describe the method of encryption, if any, in which driver information is stored on the server or collected and passed via the user interface.

C.7.3 FISMA Compliance. The Contractor shall supply a solution that is certifiable and accreditable under current NIST 800-53 guidelines for a confidentiality level of moderate. The Contractor shall support development and execution of a Certification and Accreditation Plan as part of the Security management Plan that assures the system meets current FISMA standards and has the ability to operate and to connect to the CSOSA infrastructure.

C.7.4 Privacy Act Compliance. The Contractor’s provided system shall comply with OMB Memorandum, M03-22 (OMB Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002) for conducting a Privacy Impact Assessment (PIA).

C.7.5 Cybersecurity Contract Requirements. The Contractor shall comply with the requirements identified in Appendix A.

C.8 Hardware and Software Help Desk Support.

C.8.1 The Contractor shall provide help desk support Monday through Friday, 7:00am through 5:00pm Eastern Time, excluding federal holidays.

C.8.2 The Contractor shall provide a call in number and email address for help desk support to the COR upon award.

C.8.3 All help desk communications will be initiated by only CSOSA’s COR and/or CSOSA fleet management system administrator(s). The Contractor is responsible for providing a call back or email communication recognizing the request for assistance no later than two business hours from receipt of the call or email. The solution for resolving the issue identified shall be implemented within two business days of the initiator’s call or email unless otherwise agreed to by the COR.

C.9 Hardware Support/Maintenance. The Contractor shall provide maintenance, repair, and/or replacement of all key boxes during each period of performance of the award, i.e., 12-month base period and each of the four 12-month option periods, at no cost to the Government. Any required repairs or replacement of the key boxes are shall be completed within two business days unless otherwise agreed to by the COR.

C.10 Post-Award Meeting. The Contractor shall attend (via teleconference) a Post Award meeting to be held within seven days from date of award. Upon award, the Contractor shall schedule the specific date of the meeting with the COR. One day prior to the scheduled meeting the Contractor shall provide the COR an agenda for the meeting. The Contractor’s key personnel responsible for implementing the fleet management system, installation of the hardware, and performing system maintenance shall attend this meeting.

C.11 Project Plan.

C.11.1 Within 15 days after award, the Contractor shall submit a draft Project Plan for review by the COR. The Project Plan shall identify all activities required to implement the fleet management system outlined in this Statement of Work within 90 days after award. The Project Plan shall include the start dates and end dates for each activity identified showing full, usable and complete implementation within 90 days after award including, but not limited to:

C.11.1.1 All testing activities;

C.11.1.2 All training activities; and

C.11.1.3 All activities required to migrate all information in the current CSOSA fleet management system to the new fleet management system within 90 days from award.

C.11.2 Within five days of receipt of the draft Project Plan, the COR will provide comments to the Contractor. If needed, the Contractor shall make all requested changes within three days upon receipt of the COR’s comments and resubmit the plan in final format for the COR’s approval.

C.11.3 An updated Project Plan shall be provided to the COR every two weeks until the fleet management system is fully operational.

Appendix A – Cybersecurity Contract Requirements

Compliance with Information Technology Security Policies, Procedures and Requirements

For all Covered Information Systems, the Contractor shall make a reasonable effort to support CSOSA’s request(s) for cybersecurity and privacy information related to CSOSA’s assessment and authorization requirements. CSOSA is required to obtain an Authority to Operate prior to utilizing the software provided by the Contractor to, store, or transmit CSOSA Information. The Contractor is required to support CSOSA in the development and maintenance of a security authorization package and continuous monitoring requirements to maintain the security, confidentiality, integrity, and availability of the CSOSA Information under this award.

These requirements include:

1. Providing CSOSA the ability to limit access in the application to CSOSA Information and Covered Information Systems to authorized CSOSA users and to transactions and functions that authorized CSOSA users are permitted to exercise.

2. Providing security awareness training to employees including, but not limited to, recognizing and reporting potential indicators of insider threats to users and managers of CSOSA Information and Covered Information Systems.

3. Creating, protecting, and retaining Covered Information System audit records, reports, and supporting documentation to enable reviewing, monitoring, analysis, investigation, reconstruction, and reporting of unlawful, unauthorized, or inappropriate activity related to such Covered Information Systems and/or CSOSA Information.

4. Maintaining authorizations to operate any Covered Information System.

5. Performing continuous monitoring on all Covered Information Systems.

6. Establishing and maintaining baseline configurations and inventories of Covered Information Systems, including hardware, software, firmware, and documentation, throughout the Information System Development Lifecycle, and establishing and enforcing security configuration settings for IT products employed in Information Systems.

7. Ensuring appropriate contingency planning has been performed, including CSOSA Information and Covered Information System backups.

8. Provide functionality in Covered Information System for CSOSA to integrate with Single Sign On and multifactor authentication according to published Covered Information System documentation.

Appendix A

9. Establishing an operational incident handling capability for Covered Information Systems that includes preparation, detection, analysis, containment, recovery, and user response activities, and tracking, documenting, and reporting incidents to officials and authorities within Contractor’s organization and CSOSA.

10. Performing periodic and timely maintenance on Covered Information Systems, and providing controls on tools, techniques, mechanisms, and personnel used to conduct such maintenance.

11. Protecting Covered Information System media containing CSOSA Information, including paper, digital and electronic media;; and sanitizing or destroying Covered Information System media containing CSOSA Information before disposal, release or reuse of such media.

12. Limiting physical access to Covered Information Systems, equipment, and physical facilities housing such Covered Information Systems.

13. Screening individuals prior to offering employment.

14. The Contractor will be required to protect the covered information system through the following:

(i) Segregation of Business Data from information of contractor’s or its other customers so that Business Data is not commingled;

(ii) Encryption, using industry standard encryption tools, of all records and files containing Business Data that the contractor

• Provides encryption in transit [https, TLS]

• Provides encryption with data at rest [AES 256]

• Ensures data entered by client in the Microsoft Azure production environment does not store client data on portable devices or removable media

(iii) Safeguarding of the security and confidentiality of all encryption keys associated with encrypted Business Data;

(iv) Implementation of processes and procedures intended to authenticate, monitor and report on access to and use of Business Data; and

(vii) Multi-factor authentication for all vendor employees with administrator privileges accessing the application production environment.

15. Assessing the security controls of Covered Information Systems periodically to determine if the controls are effective in their application, developing and implementing plans of action designed to correct deficiencies and eliminate or reduce vulnerabilities in such Information Systems, and monitoring security controls on an ongoing basis to ensure the continued effectiveness of the controls.

16. Monitoring, controlling, and protecting information transmitted or received by Covered Information Systems at the external boundaries and key internal boundaries of such Information Systems, and employing architectural designs, software development techniques, and systems engineering principles that promote security.

17. Identifying, reporting, and correcting Covered Information System security flaws in a timely manner, providing protection from malicious code, monitoring security alerts and advisories and taking action in response.

When requested by the CSOSA CO or COR, or other CSOSA official as described below, in connection with CSOSA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of CSOSA Information, Contractor shall provide CSOSA, including the Office of Inspector General (“OIG”) a SOC report.

When no longer needed, all media must be processed (sanitized, degaussed, or destroyed).

Contractor must keep an accurate inventory of digital or electronic media used in the performance of CSOSA contracts.

When requested in writing by CSOSA, the contractor must remove all CSOSA Information from Contractor media and return all such information to the CSOSA within 30 days of the expiration or termination of the contract, unless otherwise extended by the Contracting Officer, or waived (in part or whole) by the Contracting Officer, and all such information shall be returned to the CSOSA in a format and form acceptable to CSOSA and Contractor. The Contractor shall provide a written certification certifying the removal and return of all such information to the Contracting Officer within 15 days of the removal and return of all CSOSA Information.

Information System Security Breach or Incident

A. Definitions:

1. Confirmed Security Breach (hereinafter, “Confirmed Breach”) means any confirmed unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any CSOSA Information accessed by, retrievable from, processed by, stored on, or transmitted within, to or from any such system.

2. Security Incident means any Confirmed Covered Information System Security Breach.

B. Confirmed Breach. Contractor shall report any Confirmed Breach to the CSOSA the Chief Information Security Officer (CISO) within 24 hours. If the Confirmed Breach occurs outside of regular business hours and/or neither the CSOSA CO nor the COR can be reached, Contractor must email SOC@CSOSA.gov, and shall notify the CO and COR as soon as practicable.

C. Any report submitted in accordance with paragraph (B), above, shall identify (1) both the Information Systems and CSOSA Information involved or at risk, including making a reasonable effort to provide the detailed data and data fields, (2) steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident.

D. All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident will be the responsibility of CSOSA senior officials or the CSOSA Core Management Team at CSOSA’s discretion.

E. Processes, procedures and technology intended to maintain network security and to detect a breach or other failure of such security measures, such processes and procedures to include, among other things,

(A) Access controls,

(B) Controls designed to restrict and monitor network traffic;

(C) Audit logs and monitoring reports that are designed to identify unauthorized activities, detect intrusions, reconstruct events and promote accountability by any and all persons who access or use Business Data,

(D) Restricted access privileges, and

(E) A written incident response plan mailto:Soc@exim.gov