Comfort Zone Ergonomic Reporting Software Licenses and Services (Brand Name or Equal).pdf

Food and Drug Administration (FDA)

Request for Quotation (RFQ)

For

Operations, Maintenance Support and Licenses for the Comfort Zone (CZ) Ergonomic Reporting Software (Brand Name or Equal)

I. This solicitation is an official RFQ from the U.S. Food and Drug Administration (FDA).

II. The FDA intends to issue a commercial item Firm Fixed-Price delivery order that meets the requirements stated on the Performance Work Statement (PWS) below. This is a BRAND NAME OR EQUAL solicitation.

III. The associated North American Industrial Classification System (NAICS) code for this procurement is 541512- Computer Systems Design Services, with a small business size standard of $34,000,000.

This requirement is a total small business set aside for small business concerns.

IV. SOLICITATION NO.: 75F40124Q00415

QUOTE DUE DATE: September 5, 2024 by 2:00 PM ET

It is the quoter’s responsibility to monitor SAM.gov for the release of an amendment to the request for quote.

All quotes must be submitted via email to Min Jie Zeng (at Minjie.Zeng@fda.hhs.gov) and Lilibeth Deato (at Lilibeth.Deato@fda.hhs.gov).

Period for Acceptance of Offers: The quoter agrees to hold prices firm for 30 calendar days after the quote due date.

Point of Contacts: Min Jie Zeng at Minjie.Zeng@fda.hhs.gov

Quoters that fail to submit all required information in accordance with the instructions, or reject the terms and conditions of the solicitation, may be excluded from consideration.

All responsible sources may submit a quote, which if timely received, shall be considered. The quote and any questions shall reference solicitation number.

Quoters shall ensure that their initial submission represents their best pricing and that all information is provided to determine technical acceptability. The Government will not research items to determine compatibility; all information regarding compatibility must be contained within the quotation.

The Government reserves the right to include some or none of the quoters additional terms and conditions into any possible orders, especially when the quoter’s terms and conditions would conflict with the Federal Acquisition Regulation or any of the terms or conditions of the quoter’s award vehicles. Quoters are advised that additional terms and conditions submitted with their quotation that is in conflict of the terms and conditions of this solicitation may be deems as technically unacceptable and may not be considered for award.

Licensing Agreements: Quoters are notified that the Government will not sign any licensing agreement or similar user agreement provided by the Quoters. The Government may choose to incorporate an agreement into the contract resulting from this solicitation.

The quoter shall submit all electronic documents for Microsoft Office suite products without the use of “macros”.

When submitting proposals via email, DO NOT include .exe, .mso, or any other executable file types that could potentially trigger email security protections (i.e. email blocks, quarantine). If the offeror or applicant submits documents that contain macros, macro referenced files, and/or executable files, the Government will not be able to view or open such documents and the submission will be considered non-responsive to the solicitation. No additional time will be given to an quoter to correct the document submission and the Government will not inform the quoter that their submission is non-responsive prior to award. It is the quoter’s responsibility to ensure all electronic documents are submitted without the use of macros.

V. SUBMISSION INSTRUCTIONS

Compatibility: FDA is making this acquirement on a “Brand Name or Equal” basis and the salient characteristics (physical, functional, or performance characteristic specified in this solicitation) have been provided. For the purposes of this RFQ, FDA defines compatible as meaning that there will be no communication, performance, maintainability issues in the interconnection of solutions with different configurations. A compatible solution is one that will allow for seamless integration in FDA’s current environment. Each alternate component proposed shall demonstrate:

• That there will be *no* communication, performance or maintainability issues in the interconnection of solutions with differing brand names.

• Seamless (no application change) any solution must be able to be installed with no change in application code or redevelopment. The ability to maintain service support without any changes in FDA environment.

• Performance compatibility of the component vs. the brand name provided.

• Equal to quotes shall include all pricing (installation, integration, training, etc.) related to ensuring the FDA maintains the current state of functionality with no disruption or degradation of service or support.

The quoter shall be an authorized distributor/reseller or original equipment manufacturer (OEM)/provider for the quoted on the date of the quote submission. The quoter must submit a formal company letter with any applicable supporting document to prove their status of OEM or authorized reseller of the quoted items.

For quoting purposes, the anticipated base period of performance is from 09/30/2024 to 09/29/2025. Option Period 1 is from 09/30/2025 to 09/29/2026. And Option Period 2 is from 09/30/2026 to 09/29/2027.

Please submit all quotes with the following:

a. Quote – Schedule of items

The current software solution implemented is Comfort Zone

b. EQUAL TO quotes shall meet all the salient characteristics to be considered technically acceptable.

EQUAL TO quotes shall submit a separate technical volume that details point-by-point descriptions of how the EQUAL TO software solution meets all the salient characteristics as detailed in the PWS.

The quote shall provide product specifications for the specific items listed in the schedule, and all terms and conditions, as applicable.

Part numbers for EQUAL TO items must be mapped to the brand name part numbers with the explanation provided in quote.

VPAT

EQUAL TO quotes shall be required to operate seamlessly with all requirements of this solicitation. The EQUAL TO quotes shall be clear, concise, and include sufficient detail for effective evaluation and for substantiating of the validity of stated claims. The EQUAL TO quotes shall not simply re- phrase or re-state the Government’s requirements, but rather shall provide convincing rationale to address how the Quoters intends to meet these requirements. Statements that the Quoters will provide a particular feature or objective without explaining how the Quoters proposes to meet that feature or objective are generally inadequate and may adversely impact the Government’s evaluation of the Quoters. Simply returning the solicitation may deem your quote to be non- responsive. Quotes providing the brand name product are not required to submit separate Technical Quotes. Technical Quotes shall not contain pricing information.

EQUAL TO quotes shall include a breakdown of all costs associated with the integration of the proposed solution into FDA environment. These costs shall be incorporated in the overall cost to the Government.

EQUAL TO quotes must meet all the salient characteristics in order to be considered technically acceptable. Equal to quotes must submit a separate Technical Quote with a detailed point-by- point description of how the Equal To products meet all the salient characteristics of this SOW.

VI. BASIS FOR AWARD

The Government will award an order resulting from this solicitation to the responsible quoter whose quote meets the requirements stated herein the solicitation and is the lowest priced quote received in response to this solicitation. Therefore, award will be made to the quoter whose quote is determined to be Lowest Price Technically Acceptable.

A written notice of award or acceptance of an offer mailed or otherwise furnished to the successful quoter within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are communications after its receipt, unless a written notice of withdrawal is received before award.

VII. EVALUATION OF QUOTES

FDA will evaluate all quotes received in response to this Request for Quote (RFQ) by using the lowest-price-technically-acceptable (LPTA) methodology. Quotes must meet all the salient functional characteristics and requirements of this RFQ in order to be considered technically acceptable. Quotes providing an equivalent solution may not be considered further if the requisite functionality/compatibility explanation and VPAT is not provided.

Performance Work Statement (PWS)

1. General

1.1 Introduction

At the Food and Drug Administration (FDA), the Center for Employee Safety and Occupational Health

(ESOH) provides a comprehensive ergonomics program with focus on a proactive approach to increase worker productivity, through the prevention of musculoskeletal disorders (MSDs), while reducing the

Agency’s liability for worker’s compensation related costs.

In 2021, ESOH embarked on an enterprise-wide modernization of their ergonomics program processes and support methodologies by purchasing Comfort Zone™ software and installing the application in

FDA’s Amazon Web Services (AWS) Cloud Environment.

Currently, Comfort Zone™ software, as a commercial off-the-shelf (COTS) software, is installed behind

FDA’s firewall using FDA’s existing cloud environment. Comfort Zone™ software is used to assist

FDA’s ergonomic program by providing a user-friendly platform to conduct ergonomic assessments, provide end user accessible training and two separate ergonomic reports (an evaluation report & an equipment report).

The purpose of this Performance Work Statement (PWS) is to outline the requirements for the operation and maintenance of Comfort Zone™, brand or equal to, software within the Food and Drug

Administration's Amazon Web Services (AWS) environment. The Contractor shall provide all necessary personnel, materials, and services to ensure the successful operation and ongoing maintenance of the

Software as a Services (SaaS) product in accordance with the specifications outlined herein.

1.2 Scope of Work

The scope of work is to acquire Comfort Zone™, brand or equal to, software and the complete range of services necessary to provide FDA with verification of proper installation, creation, and maintenance of the Comfort Zone™, brand or equal, software and corresponding ancillary systems. The task areas include management, installation services, and maintenance services within FDA's IT infrastructure, including all environments; ultimately supporting the agency's mission to protect and promote the health and safety of its employees.

Reduction of manual activities such as ergonomic report production by ensuring the functionality of Comfort Zone™ software, brand or equal to, software.

Provide customization of Comfort Zone™ software, brand or equal to, software to be in accordance with FDA IT regulations and policies.

Provide Comfort Zone™ software, brand or equal to, software licenses.

2. Constraints

2.1 Owner or Authorized Reseller/IT Servicing Agent

To perform the requirements of this contract, the contractor shall be the software Original Equipment Manufacturer (OEM), or an authorized reseller/servicing agent of the software OEM.

The Contractor shall notify the Contract Specialist / Contracting Officer immediately if this requirement is registered by a reseller with the OEM.

2.2 General IT Life Cycle Support

All software O&M and DME activities will be, at a minimum, in accordance with FDA’s EPLC policies, processes, and templates found in HHS Policy for Information Technology (IT) Enterprise Performance.

The activities will follow either Waterfall or Agile or a hybrid of both methodologies based on the scope of work identified. The Government will provide updates to artifacts (standards, document templates, and processes) as they become available. As the EPLC artifacts are modified, the Contractor shall use the modified artifacts in all subsequent development activities. All software shall be developed in accordance with software engineering industry best practices. All software developed shall maintain existing database integrity, error handling, and graceful termination of execution for unexpected problems and not adversely impact other applications running in the production environment.

2.3 Stage Gate Review (SGR) Support – Updates and/or Modifications

SGRs are FDA’s release review and approval process, which focuses on the review and approval of the

EPLC documents created or modified per the Project Process Agreement (PPA) for the release. The

Contractor shall provide the Government with the technical support to create or modify documents per the

PPA. The Contractor shall be available to attend the SGR upon notification of the Contracting Officer’s

Representative (COR).

3. Performance Requirements

3.1 Kick Off Meeting

A kickoff meeting shall be conducted prior to the start of work to introduce the Contractor team, discuss roles and responsibilities, discuss the contract objectives, and address other relevant issues.

3.2 Compatibility

FDA defines “compatible” as meaning there will be no communication, performance, legacy data recovery, or maintainability issues of solutions with differing brand names.

The contractor shall provide a brand name or equal item that are compatible to the following infrastructure & performance requirements:

1. FedRAMP Certification:

The quoted software shall have an active Federal Risk and Authorization Management Program

(FedRAMP) certification at the Moderate or High impact level.

The software provider shall be listed on the FedRAMP Marketplace as a FedRAMP-authorized solution, ensuring compliance with federal security standards for cloud-based systems.

Exception: the quoted software obtains a special waiver from FDA ODT department, so that the quoted software does not need to comply with the above FedRAMP Certification requirement.

2. AWS Federal Government Cloud Compatibility:

The software shall be compatible with AWS GovCloud (US) regions to ensure compliance with government data residency and security requirements.

The software shall be able to operate within the FDA’s AWS environment and integrate with services available in AWS GovCloud, including but not limited to Amazon RDS, Amazon S3, and Amazon EC2.

The software shall be designed to utilize AWS native security features, including AWS Identity and Access Management (IAM), AWS Key Management Service (KMS), and AWS CloudTrail.

The software shall use FDA’s existing AWS GovCloud resources approved for FDA’s ergonomic program.

The software shall be compatible with FDA’s existing F5 Load Balancer infrastructure, ensuring efficient traffic distribution and high availability across the FDA ergonomics program environment.

The software shall utilize the existing FDA ergonomics program internal DEV/PROD sites, adhering to the specified URLs designated for the program’s environments. This includes proper configuration to operate seamlessly within these predefined domains.

The software shall be able to operate within the AWS environment to handle increased loads without performance degradation.

The software shall be optimized for performance on AWS, with the ability to utilize auto-scaling features and Elastic Load Balancing (ELB) to distribute traffic across multiple instances for improved availability and fault tolerance.

3. AWS Server Types and Configuration:

The software shall support deployment on the following AWS server types:

o Amazon EC2 Instances: Compatibility with various instance types, including general-purpose (e.g., t3, m5), compute-optimized (e.g., c5), and memory-optimized (e.g., r5) instances.

o Amazon RDS Instances: If the software requires database functionality, it shall be compatible with Amazon RDS for PostgreSQL, MySQL, or SQL Server, and support configurations for Multi-AZ deployment.

o Amazon S3 Storage: The software shall be able to integrate with Amazon S3 for secure and scalable object storage, including the ability to configure storage classes (e.g., S3 Standard, S3 Glacier) based on data access needs.

o The software shall be compatible with the relevant FDA/OC IT environment which is a Windows operation system, Windows Server 2012 R2, 64-bit or Newer Version, and Cisco VPN tunneling.

o The software shall provide a bi-directional interface with the FDA standard Enterprise Administrative Support Environment- Oracle system or MS SQL database systems and API’s to interface to other external data sources.

3.3 Software Requirements

The contractor shall provide software and the license(s) that meet the following salient characteristics:

Quoted Ergonomic Reporting Software:

Web-based, cloud-based solution that is customizable ergonomic software.

Shall provide a platform for the ergonomist to use the software while simultaneously conducting an ergonomic assessment.

Shall allow the ergonomist the ability to create, save, and modify an ergonomic report of the findings from the ergonomic assessment, customizable reports.

Shall allow an equipment report to be generated separately from the ergonomic assessment report and be downloadable in pdf format.

Include the ability to house an equipment database.

Include an administrator and user interface. With administrator controls that are role based and assignable by the administrator.

Compliance tracking: trackable ergonomic program risks, recommendations, training, and discomfort management.

Has internal training interface for employees to self-assess their ergonomic risk.

Provides data for analysis and download. Historical data tracking.

Has a dashboard with alerts and notifications, to include ability to assign work tasks to the ergonomist within the interface.

Ensure successfully operates in FDA’s AWS cloud environment. FDA defines confirmation of successful operation as meaning the software configuration within the Food and Drug Administration's (FDA) Amazon Web Services (AWS) environment, is fully operational, meets all specified requirements and compatibility standards.

3.4 License Keys

The contractor shall provide license keys for Comfort Zone™ software, brand name or equal, for FDA’s usage for a minimum of 12 consecutive months of access per license key.

The requirements shall include:

Delivery of the licenses in advance to ensure seamless transition from year-to-year service.

Delivery of the license keys in accordance with the software delivery requirements.

Provide documentation outlining the installation process, configurations, and any necessary troubleshooting procedures.

License keys – delivered to the COR after contract award, any deviations from delivery timeframe require approval from the government.

Perform user testing to ensure valid change in number of user licenses and Site License expiration date.

3.5 Cloud and IT Infrastructure Management

The FDA will provide the Amazon Cloud Platform (AWS Government, EC2) and infrastructure, including network admin access for the Comfort Zone™ software, brand or equal to, application.

The contractor shall meet the following requirements:

Submit an internal IT request for modifications to the existing installation or for any new versions of Comfort Zone™ software, or equivalent software, to the COR and FDA IT for approval prior to deployment in the EC2 environment.

Maintain the Comfort Zone™ software, or equivalent software, application, and the supporting infrastructure in accordance with FDA standard information and technology infrastructure.

Maintain and perform all received FDA IT directives regarding the Infrastructure and Cloud platform

(e.g., verification after software update).

Resolve infrastructure issues (servers, networks, databases).

Resolve app logic issues, including code and integration changes.

Provide cloud resource management in conjunction with FDA IT.

Maintain the resident software application and its assigned resources (e.g., servers), tools, utilities, databases, and storage in the EC2 environment.

3.6 Application Management

A. Configuration Support Services

The contractor shall meet the following requirements:

Participate and contribute to cybersecurity risk management framework and information system authorization processes including Authorization to Operate (ATO) package artifacts.

Support annual planning, which includes providing a consolidated view of current and future architectures.

Perform operational checks to ensure existing version of Comfort Zone™, brand or equal, application, including storage and presentation of user-entered data, is functional and data is accessible by end user.

Maintain Comfort Zone™ software, brand or equal to, ensuring it is in good working order, keeping it free from material defects and errors so that the software shall function in accordance with its specifications, and the accepted level of performance and level of use.

Be responsible for the integration of all systems and components that become part of the FDA IT production environment, whether purchased/developed internally through the IT organization or purchased/developed by another group within FDA to ensure accessibility, availability, security, and integrity.

The contractor shall at times be required to modify, update or patch, the software code to ensure it follows FDA IT Security requirements.

Ensure the PDF header text in the generated report from Comfort Zone™ software, brand or equal to, is content that the customer can define the text, including the ability for administrator to enter/modify presented text.

Ensure Comfort Zone™ software, brand or equal to, has an indicator to show the end user that the pdf report is being generated (e.g., progress timer, loading wheel, etc.).

Increase the speed of the pdf total download time of the pdf to ensure the ergonomic report is generated at or less than 1 minute from initiation requested.

Adhere to all FDA regulations and compliances.

Examples of FDA IT and Application Compliance include but not limited to:

o 508 Compliance o IT Security Compliance o User Device IT Security Compliance (e.g., desktop, browser, cookies) o Infrastructure Compliance o Single Sign-on (SSO) Compliance

Single Sign One (SSO) capabilities (software shall have SSO capabilities).

o SSO: FDA IPD SSO integration with CZ, or equal to, SSO offering this includes SSO definition (e.g., protocol, supported actions), SSO settings and integration testing, and adherence to FDA SSO Compliance.

o SSO may include email/ Outlook email compatibility/interaction

SAML protocol

SAML runs independently of OAuth 2.0, and instead of a JSON web token, it uses message exchange to authenticate in XML. As such, it is more common to help organization users to use a single login for multiple applications. It is known as an umbrella standard that addresses federation, single sign-on, and identity management.

o IDP or SP initiated SSO process o SAML Statements for Authorize Access and Attribute Updates

Monitor Cloud resources and Infrastructure for usage trends, risk mitigation, and growth planning.

Risk/Issue Management

The contractor shall prepare a risk/issue register that includes the identification and classification of the technical, programmatic, and process hurdles that may arise. The risk/issue register will consist of at minimum:

o Descriptions of the risk o Recognition date of the risk o Probability of occurrence o Severity, owner o Action o Status o Potential loss size o Risk exposure o Priority level

B. End User Support

Offer responsive technical troubleshooting support to FDA personnel, promptly addressing any issues or anomalies related to the Comfort Zone™, brand or equal to, software and providing guidance on best practices for utilization.

Provide a method & procedure for end users to contact for, IT support.

Support is provided virtually. On-site support is not required.

C. Cybersecurity Hygiene Support Services

The purpose of cybersecurity hygiene is to ensure the safe handling of critical data, ensure that all applications, systems, and networks are secure, and to proactively address risk. The contractor shall ensure the confidentiality, integrity, and availability of data generated by IT systems and support the assertion that systems operate as intended and that output is reliable. The contractor shall establish and implement a baseline of practices and controls for managing the most common and pervasive cybersecurity risks FDA may face.

The contractor shall meet the following requirements:

Adhere to logical access policies, standards, and processes to manage access based on business need and on least privilege when maintaining user accounts, limiting the number of users with administrative access.

Transition to role-based access and deny privileged access unless explicitly permitted.

Target and implement multi-factor authentication for privileged access for all environments.

Implement controls to protect and recover data.

Perform vulnerability, malware, and threat monitoring and remediation.

Adhere to source code/document version control procedures to protect the integrity of program code.

Ensure the complete and accurate processing of data, from input through output.

Ensure the privacy and security of data transmitted between applications.

Ensure knowledge of cybersecurity processes and targeted controls to avoid unnecessary delays in execution.

Follow all Industry Standard guidance compliance and Government regulations (NIST, Control

SI).

D. Data Calls and Mandate Responses

The Contractor shall take the appropriate actions to assist with response to Government Data Calls and

Federal Mandates. The Contractor shall be prepared to support IT-related data calls, spanning all requirements of the contract.

The Contractor shall assist in responding to data calls and mandates as directed by the Government.

Examples of data calls include the following:

Supporting the compilation and maintenance of information to develop responses to cybersecurity related data calls or investigations, and Authority to Operate (ATO)/Authority to Use (ATU) status data calls or investigations.

Conducting periodic audits to verify and validate 800-53 security controls, Federal Information

System Modernization Act (FISMA) compliance, information security, and Authority to Operate

(ATO)/Authority to Use (ATU) status.

Enterprise Performance Life Cycle The Contractor shall provide the required EPLC documentation as needed to the COR and Project Manager as needed and determined by the final EPLC Project Process Agreement (PPA). The Contractor shall also provide the PPA 30 days after the Order effective date.

3.7 Application Maintenance

The requirements shall include the following:

Identify and plan for infrastructure maintenance (e.g., end-of-life dates, version dependencies).

Provide timely and effective maintenance and support services for the Comfort Zone™, brand or equal to, software, including regular updates, patches, and bug fixes, to ensure optimal performance and minimize disruptions to FDA’s ergonomics program operations.

Identify software issues (e.g., bugs) to be addressed and corrected to resolve the issue, followed by user acceptance testing.

Update DevOps configuration and resources, maintain and update software code as necessary with written documentation of the reconfigurations provided to the government. (refer to Section

3.8 Documentation for details)

Perform deployment of Comfort Zone™, brand or equal to, version update with risk mitigation processes in place (e.g., backout deployment) (refer to Section 3.6.B. Application Software

Updates Requirements sections for details).

Perform operational testing followed by user acceptance testing to ensure the new version is working correctly (e.g., feature/function, stored data, and content).

Monitor Cloud resources and Infrastructure for usage trends, risk mitigation, and growth planning.

Any coding, or environment changes shall be communicated and approved by the FDA’s Change

Control Board (CCB) prior to implementing the changes.

All updates, any major code changes, and any major maintenance work shall be done during business hours only after approval is received from FDA’s Office of Digital Transformation

(ODT) CCB.

Triage troubleshooting and updates may be performed outside of the support for ergonomic staff timeframe with prior approval of the COR.

FDA Application/Data Integration with Comfort Zone™, brand or equal to, software; this includes ensuring implementation of data security (e.g., sensitive data), smooth interoperability with existing FDA applications and resources (e.g., databases, storage).

Coordinate with FDA's IT Cloud teams to identify appropriate AWS instances for Comfort Zone™ (CZ) software, brand or equal to, post-installation. If needed update or correct installation configurations of the CZ software in the designated AWS instances, ensuring compatibility and optimal performance.

A. Application Availability

Availability and Response Time is dependent on the capabilities and performance of the FDA-provided ES2 platform and defined resources.

Target availability:

98% of FDA business window (7:00am and 7:00pm Eastern Standard Time), Monday through Friday, excluding federal holidays in Maryland and/or the United States).

If the software, site is not available (e.g., site is down):

The contractor shall initiate issue identification/recovery and issue a progress statement within 1 hour of FDA-notification that system is down.

During the Issue Identification/Recovery process, a Progress Update should be provided to COR and the End User Support every hour or as directed by the COR.

Recovery may require work with ODT/OIMT, on an as needed base, to identify and eliminate the issue (e.g., application, network, EC2 resource).

Restoration of the software application shall occur within 3 hours.

o All Functions and Features in the implemented version should be fully operational.

Identified application bugs should be documented and reviewed with COR for priority, severity, and estimated time needed to correct bug.

The contractor and the COR will review priorities and define the order of bugs to be addressed as part of the Project Plan addressing all IT service tasks to ensure best use of resources and issue impact (e.g., severity).

o Target End User Performance Criteria Simple Actions – 10 second or less response time Aggregated Data actions, depends on amount of data to be aggregated.

Acceptable Response times o Up to 1 minute response time for large data sets o Average response time should be 30 seconds or less.

B. Application Software Updates Requirements

When software updates, and/or application modifications are available these shall be communicated to the COR. The COR will determine if the software update or modification is necessary for benefit to FDA’s Ergonomics Program. If the COR deems the update/modification to be of benefit to the government than the contractor shall provide the following in conjunction with FDA IT required approvals prior to deployment of the update/modification:

I. Development – Updates and/or Modifications

1. Data Readiness (if applicable to the update and/or modification)

a. The contractor shall develop a data readiness plan in conjunction with FDA ESOH staff/FDA IT, including data migration if necessary.

b. The contractor shall develop, update, and maintain a Functional Specification Document

(FSD) which will act as an umbrella document over the system interfaces of the project.

The FSD will describe the interfaces between systems and subsystems, the integration timeline, and target-source mapping. The end product will be a paper that explains in detail the Comfort Zone™, brand or equal to, update and/or modification the changes quoted.

2. Data Migration and Capture

3. The contractor shall review the existing Comfort Zone™, brand or equal to, software application to understand and identify data points for data.

4. The contractor shall create a detailed data mapping documentation identifying key data points.

a. The contractor shall create a Data Migration Strategy Plan to be shared and approved by FDA prior to beginning Data Migration.

b. The contractor will prepare the data migrations. The contractor shall review and monitor all records, metadata, indexing data, file attachments, data bases, and usage data. The contractor shall analyze the accuracy of the current and historic usage data to determine accuracy and integrity. Upon completion of the migration, the contractor shall test that the capture was complete and compliant with federal law as well as FDA requirements.

5. Data Integration

a. The contractor shall integrate with SAML to authenticate users and support single sign-on

6. System Security

a. The contractor shall aid FDA in the drafting of the System Security Plan (SSP) and other ATO artifacts for FDA, which define the security assessment process and authorization planning. The contractor will configure access permissions, monitor, and harden network infrastructure, as well as continuing to review all integrations for security issues.

b. The contractor shall work with FDA to ensure network access to the virtual private cloud.

II. Testing – Updates and/or Modifications

The contractor shall lead testing and track and document every stage of testing. The contractor will work with FDA to provide test data along with test milestones, allowing FDA to monitor the testing progress.

1. User Acceptance Testing (UAT)

a. The contractor shall create and maintain a UAT plan.

b. The contractor shall create test scenarios for users to complete an end-to-end ergonomic assessment and other requested workflows in the Comfort Zone™, brand or equal to, environment.

c. The contractor shall complete a final round of software configuration for any issues uncovered from end-user testing. The FDA will sign off on system readiness.

2. UAT Quality

a. The contractor shall collect user testing feedback and provide support as needed.

b. The contractor shall resolve software configuration issues uncovered from end-user testing.

III. Cutover and Go-Live – Updates and/or Modifications

1. Cutover The contractor shall create a detailed Cutover plan which includes the following items:

Prerequisites to Cutover (including the Go Live criteria) Planning for the availability of required resources Go live communications Issue Management protocol Defined Blackout Period Success criterion Risk assessment Cutover procedure Multiple Mock Conversions (including the Go/No Go Process) Stakeholder Sign-off Go live/Post Go live support o The contractor shall lead Cutover and Go-Live and support FDA end users using the

Comfort Zone™, brand or equal to.

2. System Support

1. The contractor will prepare their helpdesk to provide support for the first several weeks of the re-deployment.

IV. Operations & Maintenance (O&M) – Updates and/or Modifications

1. Following re-deployment of Comfort Zone™, brand or equal to, software application, the contractor will commence Operations & Maintenance (O&M) support.

2. Data Recovery

a. The contractor shall back up 100% of the system data, monitored through fallback tests and vendor reporting metrics.

b. The contractor will update the Disaster Recovery Plan document (DRP) to include any new system Recovery Point Objective, (RPO), Recovery Time Objective, (RTO), data backup/recovery requirements, and detailed procedures to resume system operations at all data locations.

c. The contractor will test backups annually to ensure that the backups are complete and available.

3. Quality Control and Assurance

a. The contractor and FDA will create and follow a Quality Assurance Plan (QAP).

4. Security Updates

a. The contractor shall install security patches per their regular schedule as needed and share notes on changes.

3.8 Training

Comprehensive Training that covers all aspects of the platform: Develop and deliver training materials/manuals and conduct training sessions for FDA staff to ensure they are proficient in operating and administering Comfort Zone™, brand or equal to, software, empowering them to utilize its features effectively.

Update training materials when version updates are implemented and as needed when code changes and resolved bug issues are deployed.

Provide training material electronically for the government’s reference use post-training.

The training will be provided remotely. The contractor shall have MS Teams or Zoom platforms to provide the training remotely to the FDA site Administrator.

Up to 24 training sessions per contract year, that are up to 1 hour in length of time per session.

Provide training sessions when new features/functions are released or changes in software user operation occur, to ensure FDA personnel are aware.

Training provided on as needed basis (e.g., onboarding new ergonomic staff or FDA staff).

A. Trainees

Up to 10 trainees per contract year, to ensure FDA personnel are proficient in operating the software effectively.

B. Applicable Contents

Use and administration of the software.

The training will encompass “how to” details and best practices for each training topic.

Administrator specific content: site setup, account setup, license setup/tracking/expiration date, personalization, user profiles, role entry, global permissions, equipment database/library, program access, data access, data reports, ergonomic reports, workflow, ergo team roles, etc.

User (ergonomist) specific content: site access, conducting ergonomic assessments, ergonomic report generation, ergonomic report downloads, selecting ergonomic equipment, creating accounts for FDA patrons.

3.9 Documentation

Provide clear and comprehensive documentation of Comfort Zone™, brand or equal to, software installation procedures, configurations, maintenance activities, and training sessions contents, facilitating transparency and accountability throughout the contract period.

The requirements shall include, but are not limited to:

Provide documentation outlining the installation process, configurations, and any necessary troubleshooting procedure, and update existing FDA documentation on the process.

Provide documentation of lessons learned from prototype evaluation, DEV/PROD environments.

Create and update all FDA required documentation as requested by FDA’s Office of Digital Transformation (ODT) for the CPIC, EPLC, ATO review process, System Lifecycle Management (SML) Documentation may be a part of the ODT review process; update existing records when applicable.

Create and maintain Project Plan, to include but not limited to planned updates, end-of-life dates

(e.g., server operating system version), and scheduled maintenance.

Create and maintain Road map: identification of FDA requested updates/features/functions;

planned features/functions.

Provide documentation of technical and user requirements for FDA-requested features, updates, functions, and modifications to the software application. Create and maintain technical manuals to aid FDA ODT in assisting with the software and to document the applications technical needs.

In conjunction with Employee Safety and Occupational Health (ESOH) develop, document, and implement a backup plan in the event the Comfort Zone™, brand or equal to, cloud solution goes down.

When application updates occur, the contractor shall validate key assumptions with FDA stakeholders in the project documentation. This will include draft versions of the Implementation Schedule, Test Plans, Software Development and Architecture plans, and other documents as needed.

Provide documentation of regular and irregular maintenance detailing updates/patches Provide documentation of issues/Risks/Mitigation Plans and/or Actions.

4. Transition In/Out

This task is optional. When a new contract is awarded to a different vendor, the incumbent Contractor shall perform the followings:

Transition In

The incumbent Contractor shall provide Transition-In support to provide an orderly transition from the incumbent Contractor to the successor Contractor. The incumbent Contractor shall ensure minimal disruption to the current system and operational activities. The purpose of the transition is to transfer expert knowledge, data, and artifacts that are used to support applications from the incumbent contractor to the successor Contractor efficiently and orderly. While individual order will provide the specific tasks, representative tasks may include the following:

Develop a Transition-In Plan

Participate in Transition-In meetings.

Participate in knowledge transfer activities such as “shadowing.”

Conduct and coordinate all knowledge transfer activities such obtain secure badging for team personnel.

Ensure complete understanding of the documented requirements.

Ensure complete understanding of the FDA ODT technical environment.

Ensure complete understanding of the current implementations and activities.

Ensure staff identified as key personnel are available to work with Subject Matter Experts (SME) from the Government and the incumbent Contractor immediately after Order award.

Transition Out

The incumbent Contractor shall provide a Transition-Out Plan for COR review and approval no later than prior to the end of the period of performance as determined by the project schedule. The incumbent contractor shall provide support services to the orderly transition of functions from this incumbent contract to the FDA and/or successor contractor. The incumbent contractor shall be the lead on the transition activities during the transition period, leading Technical Exchange Meetings (TEMs) with the successor to impart complete and full knowledge transfer of FDA ODT projects, systems, applications, and databases, as well as sustainment activities that are in progress to include the technology used for all projects initiated under this contract.

During this period, the incumbent contractor shall ensure no degradation in support to the Government. At the COR designated turnover date, the successor contractor shall assume full responsibility of the contract, while the outgoing contractor focuses on contract closeout activities and providing sustainment support to complete the transition.

The requirements shall include the following:

Providing the FDA with current versions of all system and user documentation, to include the native format for diagrams (e.g., Visio), even those embedded in documents.

Providing FDA all licensing and renewal information, asset management records, software documentation, and training materials

Providing FDA with a current inventory of all Government-owned assets used by the Contractor along with full support in the reconciliation of this inventory.

Providing FDA with current versions of all CONOPS, operational procedures, standard operating procedures, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor, i.e., any documentation developed under this contract. Within 30 days of contract award, the COR will identify the repository where all documentation is to be stored; however, it will be the incumbent contractor’s responsibility to update/maintain the repository for the duration of this contract.

Providing “shadowing” and other knowledge transfer plans, meetings, and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the successor contractor.

Providing full source code sets (not COTS source code) with configuration management information;

and, Providing up to date EPLC and program/project management documents Providing COR with a current inventory of all Government-owned assets used by the outgoing

Contractor along with full support in the reconciliation of this inventory.

5. Deliverables

PWS

Reference #

Deliverable or Event Quantity Delivery Date Delivery Method

Point of Contact for Delivery

3.1 Kick off Meeting 1 Post Award MS Teams COR

3.4

Comfort Zone™ Software Licenses, brand or equal to

Up to 13,000 Post Award

In accordance with software application license key acceptance

COR

3.8 Training 24

As Requested by the COR

MS Word COR

3.9 Training Documents

As needed by

FDA IT

Requirement

As Requested by the COR or

FDA ODT

MS Word

COR

3.9

3.6.

Clauses Section B.

Cloud Services

FDA IT software review Documentation (e.g., CPIC, SSP, ATO, EPLC)

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.7 Functional Specification

Document (FSD)

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.7 Data Migration Strategy

Plan

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.7 System Lifecycle

Management (SML)

Documents

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.7 User Acceptance Testing

(UAT) Plan

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.7 User Acceptance Testing

(UAT) Scenarios

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.9 Technical Manuals

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.6 Risk Management Plan &

Risk Register

As needed by

FDA IT

Requirement

As needed by

FDA IT

Requirement

Coordinate with COR to deliver it in a proper way

COR

3.7 Quality Assurance Surveillance Plan

1 TBD MS Word COR

Transition-In Plan (optional) 1

Within 10 days of the

Award MS Word COR

Transition-Out Plan

(optional)

Within 30 days before the POP ends MS Word COR

6. Government Furnished Equipment/Government Furnished Information (GFE/GFI)

The Government will provide, as GFE, personal computers sufficient for contract staff to access the FDA network, servers, and network resources.

All hardware and software on GFE computers and the government portion of the network shall be government owned. This in turn dictates that software be approved for installation according to the FDA Office of Information Management (OIM) guidelines. This process currently requires more than four weeks.

Technical services regarding the GFE PCs and network will be provided through the COR. Maintenance of GFE will be provided through the COR.

7. Contractor Staffing

The contractor shall ensure any staff working at this contract be technically capable, obtains all necessary knowledge, and be well trained in order to perform this contract.

The contractor shall ensure a seamless transaction between the out-going staff and the income the ones to limit any negative impact to the contract performance and service provided. The transaction shall not cause any deliverable delay nor reduce of performance quality.

8. Type of Contract Contemplated

Firm Fixed Price contract is appropriate for the services provided in this contract.

9. Period of Performance

The period of performance of this contract consists of base period and one optional period:

Base Period: 09/30/2024 – 09/29/2025

Option Period 1: 09/30/2025 – 09/29/2026

10. Place of Performance

The services provided in this contract, will be provided remotely; entirely at the contractor’s facility (off site).

The installation, operation, and maintenance services on Comfort Zone™ software, or equal to, software shall be performed in FDA's designated AWS environment and FDA on-premise server(s).

11. Inspection And Acceptance

In accordance with the inspection and acceptance clauses, all work under this contract is subject to inspection and final acceptance by the Contracting Officer or the duly authorized representative of the Government. The Government’s Contracting Officer’s Representative (COR) is a duly authorized representative of the Government and is responsible for inspection and acceptance of all items to be delivered under this contract. Unless otherwise specified by the COR, the general quality measures, as set forth below, will be applied to each work product received from the contractor under this task order.

-Accuracy: Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

-Clarity: Work products shall be clear and concise. Diagrams shall be easy to understand and be relevant to the supporting narrative.

-Consistency to Requirements: All work products shall satisfy the requirements of this statement of objective.

-Timeliness: Work products shall be submitted by the due date specified in this statement of work or submitted in accordance with a later scheduled date determined by the Government.

-File Editing: All text and diagrammatic files shall be editable by the Government.

-Format: Work products shall be submitted in hard copy (where applicable) and in media as approved by the COR prior to submission.

The Contracting Officer’s Representative will inspect and accept the services delivered. Inspection and acceptance will occur at the place of delivery. The Government will accept deliverables only if they conform to all terms and conditions of the contract, and satisfy the performance standards detailed within this SOW.

Government will accept goods and services only if they conform to all terms and conditions of this order. The Government will provide written notification of acceptance or rejection within ten (10) business days of receiving the delivery.

The Government will reject non-conforming products and services. The Contractor shall correct any deficiencies within thirty (30) days of when the Government issues the rejection notice. If the Contractor cannot correct the deficiencies within this time frame, the Contractor shall immediately notify the COR or technical POC of the reason for the delay and provide a proposed corrective action plan within ten (10) business days.

12. Contracting Officer Authority

The Contracting Officer (CO) is the sole person authorized to make or approve any changes in any of the requirements of this order and notwithstanding any provisions contained elsewhere in the order, the said authority…