Solicitation 9594CS26Q0025 Personal Property Management System

Attachment J-1: Statement of Work

C.1 Background.

C.1.1 The Court Services and Offender Supervision Agency for the District of Columbia (CSOSA) is an independent agency in the executive branch of the federal government with approximately 1,000 employees. CSOSA is responsible for supervising adult offenders who are on probation, parole, or supervised release in the District of Columbia. The Agency’s mission is to promote public safety, reduce recidivism, support crime prevention, and ensure fair administration of justice.

C.1.2 This Statement of Work is for the purchase of a Personal Property Management System delivered as a Software as a Service (SaaS) solution that is FedRAMP Moderate Authorized.

C.1.3 There are two separate organizations (CSOSA and Pre-Trial Services Agency (PSA)) which manage property in this system with a total of 6 administrators and 27 property custodians (end-users).

C.2 System Requirements. The Personal Property Management System shall:

C.2.1 Be a Web-based SaaS platform compatible with the current versions of Microsoft Edge and Google Chrome.

C.2.2 Be FedRAMP Moderate Authorized and compliant with applicable federal security and privacy regulations.

C.2.3 Support management of approximately 8,000–8,500 active assets, with the ability to collect, store, update, reconcile, and report on asset and location data.

C.2.4 Has the capability to:

C.2.4.1 Scan asset tag barcodes with an RFID and traditional barcode scanning technologies;

C.2.4.2 Scan and directly upload from CSOSA supported mobile iOS devices (e.g., tablets, smartphones) as well as dedicated handheld scanners (e.g., Zebra MC3000 or equivalent mobile operating systems);

C.2.4.3 Retire, transfer, or reassign assets without permanent deletion, preserving complete historical audit trails;

C.2.4.4 Perform persistence offline scanning capability with subsequent synchronization controls and automated conflict/audit logs; and

C.2.4.5 Perform persistence offline scanning capability with subsequent synchronization controls and automated conflict/audit log.

C.2.5 Has configurable workflows supporting the end-to-end asset lifecycle management, including approvals and custody changes.

C.2.6 Provide support for templated, standardized, and customizable reporting aligned with Government Accountability Office (GAO) internal control and audit requirements.

C.2.7 Has multi-factor authentication.

C.3 Reporting Requirements. The Personal Property Management System shall include the following reporting capabilities:

C.3.1 Asset Inventory Reports (categorized by types, ownership, locations, and custodianship);

9594CS26Q0025

Personal Property Asset Management System

C.3.2 Asset Lifecycle, Status, and Risk Reports (including warranty, repair, missing, retired, disposed, and risk indicators);

C.3.3 Inventory Reconciliation and Audit Reports (identifying variances between physical counts and system records, discrepancies, and adjustments);

C.3.4 Location and Space Reports (down to the building, datacenter, room, and workstation level);

C.3.5 Barcode/Scanner Upload and Transaction Logs (with strict user and timestamp traceability);

C.3.6 End-of-Life (EOL) and Replacement Planning Reports;

C.3.7 Periodic Inventory and Certification Reports;

C.3.8 Chain-of-Custody and Accountability Reports;

C.3.9 Audit Trail and Change History Reports; and

C.3.10 Custom/Ad Hoc Reporting Features.

C.4 Required Input Fields. The Personal Property Management System shall support, store, and track the following data fields:

C.4.1 Acquisition date;

C.4.2 Asset Name;

C.4.3 Asset Type (e.g., laptop, phone, equipment);

C.4.4 Asset Tag/ID (e.g., unique barcode or RFID number);

C.4.5 Model Number;

C.4.6 Manufacturer;

C.4.7 Serial number;

C.4.8 Description;

C.4.9 Hardware specifications (e.g., CPU, storage, etc., when applicable);

C.4.10 Operating System and Version (when applicable);

C.4.11 Date Received / Date Placed in Service;

C.4.12 Supported business function / program alignment;

C.4.13 Physical location (building, floor, room, and workspace type (e.g., office, shared space, storage, field use);

C.4.14 Asset Owner / Custodian;

C.4.15 Asset Status (e.g., active, in-use, in storage, decommissioned, retired, disposed);

C.4.16 End-of-Life (EOL) / End-of-Support (EOS);

C.4.17 Disposal Date and Method;

C.4.18 Replacement Schedule; and C.4.19 Funding Source / Cost Center (for financial and audit traceability).

C.5 System Configuration and Setup. The Contractor shall:

C.5.1 Configure the SaaS environment and user access in accordance with CSOSA requirements.

C.5.2 Ensure seamless compatibility with CSOSA IT infrastructure, including specified browsers and mobile devices.

C.5.3 Configure role-based access controls for up to a total of 33 users, strict segregation of duties, Multifactor Authentication (MFA) (PIV card), comprehensive logging, and audit mechanisms aligned with GAO internal control principles.

C.6 Training.

C.6.1 The Contractor shall conduct the following live, virtual training sessions via Microsoft Teams. All training sessions, material reviews, and final delivery must occur entirely within the base period of performance.

Class Type Sessions Maximum per Session

Total Users

Administrator Training 3 6 6 Property Custodians 5 15 27

Note: The above table identifies the total users by role and the maximum capacity allowed per individual session. Attendance at any single session shall not exceed the stated "Maximum per Session" limit. The Contractor is required to provide all scheduled training sessions, even if all total users have been trained prior to all sessions being completed.

C.6.2 The Contractor shall digitally record all training sessions and provide the video files to the Contracting Officer’s Representative (COR) as part of the training materials specified in C.6.3.3 below.

C.6.3 At a minimum, training shall consist of the following:

C.6.3.1 Role-based training tailored for end-users (property custodians) and system administrators covering everyday operational workflows;

C.6.3.2 Advanced training on system administration, user provisioning, role configuration, custom workflow creation, and reporting functions including GAO compliance reporting; and

C.6.3.3 Training materials/deliverables to include comprehensive Section 508-compliant training materials shall be provided to the COR five business days prior to the first training session. Training materials include electronic user guides and quick reference sheets (provided in an accessible format (e.g., PDF).

C.6.3.4 Within three business days following the final live training session, the Contractor shall deliver the finalized digital video recordings of all hosted sessions to the COR for future agency onboarding use.

C.6.3.5 Payment under CLIN 0002, "delivery of training" shall be deemed complete only when:

• All eight (8) live virtual sessions specified in C.6.1 have been fully executed;

• The COR has provided written technical acceptance of the 508-compliant materials specified in C.6.3.3; and

• The COR has received and verified the digital video recordings specified in C.6.2 and

C.6.3.4.

C.7 System Maintenance and Updates. The Contractor shall perform ongoing system maintenance and updates, including:

C.7.1 Application patches, upgrades, and enhancements;

C.7.2 Bug fixes and issue resolution;

C.7.3 Security updates;

C.7.4 Maintenance scheduling aligned with Agency-approved windows; and C.7.5 Notification to the Agency at least 5 business days before any planned maintenance.

C.8 Customer Support and Troubleshooting. The Contractor shall provide customer support services, including:

C.8.1 Technical Helpdesk Support via a website, ticketing system, and phone:

• Minimum availability: Monday–Friday, 8:00 AM–6:00 PM Eastern Time

• Emergency support for critical outages: 24/7

C.8.2 Adherence to the Contractor’s established Service Level Agreement (SLA) for response and resolution times.

C.9 Data Migration Requirements.

C.9.1 CSOSA’s existing system has 8,000–8,500 active assets, currently stored in CSOSA’s legacy system, BarScan.

C.9.2 The Contractor shall:

C. 9.2.1 Provide full data migration services from the legacy system to the new platform. CSOSA will be responsible for data cleansing. The Contractor shall be responsible for data mapping, validation, and loading.

C.9.2.2 Develop a migration risk and mitigation plan.

C.9.2.3 Prepare and execute migration scripts.

C.9.2.4 Conduct data validation and reconciliation; and

C.9.2.5 Provide knowledge transfer on migration processes and audit considerations.

C.9.3 Post-Migration Support. The Contractor shall provide post-migration support to resolve discrepancies and errors for 30 days from date migration is complete and approved by the COR.

C.9.4 Within five business days following the completion of the final production migration, and prior to COR acceptance, the Contractor shall deliver a comprehensive Migration Report to the COR. At a minimum, this report shall include:

C.9.4.1 The exact count of asset records extracted from the legacy system versus the total successfully loaded into the production environment;

C.9.4.2 A detailed breakdown of any records excluded from the migration, including the specific asset IDs and the technical or structural justification for their exclusion (e.g., formatting errors, missing mandatory fields);

C.9.4.3 A statistical summary of the migration execution, detailing overall success percentages and categorized error types; and

C.9.4.4 Proof of data integrity confirming that financial markers, baseline asset specifications, and historical audit trails map accurately from the legacy format to the new tenant environment without unintended alteration. Acceptable proofs include source-to-target row count matrices, aggregate financial sum reconciliations, cryptographic checksum validation logs, and a documented random-sample spot-check audit.

C.9.5 Once appropriate clearances are obtained, CSOSA will provide data field mapping documents and legacy system technical specifications.

C.10 Integration Support. Upon completion of the migration effort identified in section C.9 above, the Contractor shall support interface development, configuration, and testing with CSOSA’s financial system (Oracle Financials) for asset capitalization, depreciation, and reporting. Integration to be performed via

API.

C.11 Federal Security, Privacy, and Cloud Compliance.

C.11.1 The Contractor shall ensure compliance with all applicable federal requirements to include FISMA and Privacy as outlined in NIST SP 80-53.

C.11.2 The Contractor shall provide support for any documentation required to gain approval of Authority to Operate (ATO) i.e., support for preparation of Privacy Impact Assessments (PIA) and System of Records Notices (SORN), if required.

C.11.3 The Contractor shall support log management, audit logging, remediation, and compliance scanning and provide any required security, performance, and audit reports.

C.11.4 Computer Security Incident and Privacy Breach Notification. In the event of any actual or suspected computer security incident or breach of PII, PHI, or Sensitive Information Marked as CUI as defined by Executive Order 13556 (or similar markings – FOUO, SSI, SBU, or any other forms of Non- Public Information), the Contractor will notify within one hour, the CSOSA CIO, Chief Privacy Officer, CISO, and the COR or Contracting Officer.

C.12 Section 508 Accessibility Compliance

C.12.1 All Information and Communication Technology (ICT) delivered, developed, maintained, or supported under this purchase order must meet the electronic and information technology accessibility standards set forth in 36 CFR Part 1194, pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d). The SaaS platform, mobile interfaces, and digital outputs shall conform to the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA (or the current federally adopted version, WCAG

2.1 Level AA) Success Criteria.

C.12.2 The Contractor shall: ensure the web-based platform, mobile device interfaces, and all associated applications are fully operable and accessible to users with disabilities, including those using assistive technologies (e.g., screen readers, keyboard-only navigation, and voice recognition software).

C.12.3 The Contractor shall provide a current and complete Accessibility Conformance Report (ACR), based on the Voluntary Product Accessibility Template (VPAT), documenting compliance with Section 508 requirements. The ACR shall be provided:

C.12.3.1 Within ten business days following final system configuration/setup and prior to formal Agency data migration, reflecting the specific tenant environment provided to the Agency;

C.12.3.2 Within 15 business days of any major platform upgrade, enhancement, or architectural change that impacts the user interface or system functionality; and

C.12.3.3 Re-submitted annually within 10 business days of exercise of any option period.

C.12.4 The Contractor shall ensure all user-facing content, forms, workflows, and reports meet accessibility standards for readability, contrast, navigation, and interaction.

C.12.5 The Contractor shall provide all electronic deliverables, including documentation and training materials in accessible formats (e.g., tagged, Section 508-compliant PDFs or captioned media).

C.12.6 The Contractor shall remediate any identified accessibility deficiencies within agreed-upon timeframes at no additional cost to the Agency.

C.12.7 The solution must maintain accessibility compliance throughout the lifecycle of the contract, including all updates, patches, enhancements, and newly introduced features.

C.13 Project Plan Requirement.

C.13.1 The Contractor shall develop and maintain a comprehensive a Project Management Plan (PMP) that serves as the master guide for the system implementation.

C.13.2 At a minimum, the PMP shall include:

C.13.2.1 A detailed timeline (e.g., Gantt chart) mapping out tasks, dependencies, and key milestones from completion of Post-Award Meeting through final system acceptance.

C.13.2.2 Clear delineation of tasks assigned to Contractor personnel and required actions/inputs from

CSOSA.

C.13.2.3 A list of potential technical, schedule, or data security risks, along with corresponding mitigation strategies.

C.13.2.4 Specific actions addressing the execution of:

• Configuration, including environment setup, user role definitions, and MFA integration.

• Data migration, including data mapping, validation testing, and legacy data migration execution.

• Security and compliance, including privacy controls and required security documentation.

• Training, including schedule and coordination for the live virtual sessions outlined in

Section C.9.

• Deployment, including the transition strategy from the legacy tracker to the fully live

SaaS platform.

C.13.3 The Contractor shall deliver a draft PMP to the COR within 15 days of the post-award meeting.

The Government will provide comments within five business days of receipt of the draft PMP. The Contractor shall deliver the final PMP within five business days of receiving Government comments.

C.13.4 The Contractor shall provide updates against the approved PMP schedule via the biweekly status report. Any deviations from the approved PMP must be communicated immediately to the COR with a remediation plan.

C.14 Post-Award Meeting.

C.14.1 Within 10 days of purchase order award, the Contractor shall schedule and facilitate a virtual Post-Award Meeting. The meeting shall be conducted via Microsoft Teams.

C.14.2 At a minimum, the meeting shall be attended by the Contractor’s Program Manager, key technical/migration leads, and the COR.

C.14.3 The Contractor shall provide a draft agenda to the COR at least two business days prior to the meeting. The meeting objectives shall include, but are not limited to:

• Introducing key personnel, roles, and communication protocols;

• Reviewing the Statement of Work requirements, period of performance, and initial implementation timeline;

• Discussing the transition from the legacy data system and technical prerequisites for the SaaS environment; and

• Establishing the schedule for weekly status updates and future deliverables.

C.14.4 The Contractor shall document the meeting and deliver comprehensive meeting minutes, including an attendance list and a tracked action-item matrix, to the COR via email within three business days following the conclusion of the meeting.

C.15 Bi-weekly Status Reports. The Contractor shall provide bi-weekly status reports describing the accomplishments, next steps, and any issues, including any changes/updates to the approved PMP.

Biweekly status reports shall begin 15 days after purchase order award and every two weeks thereafter until all work/deliverables have been accepted by the COR.

C.16 Deliverables.

C.16.1 Table 1 below summarizes the deliverables/events required by this Statement of Work.

C.16.2 Adjustments within the PMP. Minor shifts in individual task dependencies, data migration schedules, or training session dates may be adjusted and authorized via mutual agreement between the Contractor and the COR (at no cost to the Government) through the biweekly tracking of the approved Project Management Plan (PMP). These internal adjustments do not require a formal contract modification, provided the adjustments do not extend the base period of performance.

C.16.3 Any adjustment that changes the total purchase order price or alters the essential scope of work must be documented via a modification to the award.

Table 1: Deliverables Days listed in the table below are calendar days unless otherwise stated in the Statement of Work.

SOW

Section Deliverable Due Formats COR Review C.14 Post-Award Meeting & Agenda Within 10 days of award Virtual via Microsoft

Teams (PDF Agenda) N/A

C.14 Post-Award Meeting Minutes Within 3 business days of the post-award meeting

Word/PDF 3 business days

C.13 Draft PMP 15 days from post-award meeting

MS Project or Excel 5 business days

C.13 Final PMP Within 5 business days of receipt of COR Comments

MS Project or Excel 3 business days

C.2 thru C.5

Provisioned SaaS Environment & MFA Integration Validation

Within 60 days from award Digital Access/Written Confirmation

5 business days

C.12.3 Post-Configuration Accessibility Conformance Report (ACR/VPAT)

Within 10 business days following final system configuration/setup and prior to data migration

Email (PDF / Standard VPAT Form)

5 business days

C.5.3 User Role Configuration & User Acceptance Testing (UAT) Sign-off

Within 75 days from award System Demonstration / Sign-off Memo

5 business days

C.9 Integration w CSOSA Financial System

Within 85 days from award

C.10 Final Production Migration & Comprehensive Migration Report

Within 90 days from award System Live / Email (Excel & PDF Report)

5 business days

C.6 Completion of Live Virtual Training Sessions & Media Deliverables

Within 15 business days from final production migration/receipt of migration report

Virtual Delivery / Link to Recorded Files & PDFs

3 business days

All SOW Rqmts

Final System Acceptance & Go- Live Authorized

Within 10 business days final production migration/receipt of migration report

Written COR Acceptance Notice

5 business days

C.15 Bi-weekly Status Reports Every other Monday beginning the 3rd Monday after award

Word/PDF 3 business days

C.13 Updated PMP As required by SOW C.13 MS Project or Excel 3 business days

C.17 Review and Acceptance Criteria.

C.17.1 All written or digital deliverables shall be professional, free of formatting errors, and fully compliant with Section 508 standards as outlined in Section C.14.

C.17.2 If the COR disapproves a deliverable, the Government will provide written comments detailing the deficiencies. The Contractor shall remediate and resubmit the revised deliverable within five (5) business days of receiving the Government's notification at no additional cost to the Government.

C.17.3 For the purposes of fixed-price milestone billing, a deliverable is only considered "delivered" once the COR issues an explicit, written confirmation of acceptance.