CWMS 3.0 - Attachment 1 - Draft Statement of Work.pdf

CWMS Statement of Work (SOW)

2025-2035

1 General

1.1 Background

1.2 Scope

1.3 Objective

1.4 Requirements

2 CORE SERVICES

2.1 Program Management

2.1.1 Program Management Plan (PMP)

2.2 Performance Management

2.2.1 Performance Management Accountability Plan (PMAP)

2.3 Telecommunications Expense Management Services (TEMS)

2.3.1 Device Lifecycle Management

2.3.2 Contractual and Financial Services

2.4 Management Portal

2.4.1 Security Requirements

2.4.2 Interface Requirements

2.4.3 User Roles

2.4.4 Workflow

2.4.5 Data Fields

2.4.6 Device Management

2.4.7 Organizational Cost Center Hierarchy

2.4.8 Training Program

2.5 Service Desk Support

2.6 Transition Services

2.6.1 Transition-In

2.6.2 Transition-Out

2.6.3 Transition Management Plan (TMP)

3 OPTIONAL SERVICES

3.1 Cellular and Satellite Wireless Devices, Accessories, Licenses, and Services

3.1.1 Carrier Terms and Conditions

3.2 Mobile Device Management (MDM) Services

3.3 Labor Support

3.3.1 Tier 2 Service Desk Support

3.3.2 Tier 2 Analysis Support

3.3.3 Tier 2 Development Support

3.3.4 Tier 2 Surge Support

3.3.5 Tier 2 Executive Travel Support

3.3.6 Specialized Support

3.4 In-Building Cellular Enhancement Services

4 Wireless Security

5 Deliverables

5.1 Plans

5.1.1 Program Management Plan:

5.1.2 Performance Management Plan (PMAP):

5.1.3 Transition Management Plan (TMP)

5.1.4 Device Reuse and Recycling Plan (DRRP)

5.1.5 Training Plan (TP)

5.1.6 Business Continuity Report (BCP)

5.2 Meetings

5.2.1 Post Award Conference

5.2.2 Operational Meetings

5.2.3 Program Management Review

5.3 Reports

5.3.1 Performance Status Report (PSR)

5.3.2 Contract Management Status Report (CMSR)

5.3.3 Strategic Sourcing Report (SSR)

5.3.4 Auditing Reports

5.3.5 Invoicing Reports

5.3.6 Optimization Reports

5.3.7 Service Desk Reports

5.3.8 Servicing, Refurbishing, and Recycling Report

5.4 Process Demonstrations

5.4.1 Management Portal Ordering Capability

5.4.2 Electronic Data Transfer Capabilities

5.4.3 Section 508 Compliance

5.5 Table of Deliverables

6 Government Furnished Resources

6.1 Labor Support

6.2 Applicable Government Furnished Equipment (GFE)

6.3 Contractor Furnished Property

7 Applicable Documents

8 IDIQ Contract Conditions and Other Requirements

8.1 Service Levels

8.1.1 Logistics Order Processing Turnaround Time

8.1.2 Logistics Shipping Turnaround Time

8.1.3 Service Desk Call Response Time

8.1.4 Service Desk Call Abandonment Rate

8.1.5 management Portal Availability

8.2 Ordering Period

8.3 Place of Performance

8.3.1 As-Needed and travel only staff support

8.3.2 Logistical Support

8.4 Hours of Operation

8.5 Type of Contract

8.6 Inspection and Acceptance

8.7 Travel

8.8 Contractor Personnel

8.8.1 Security

8.8.2 Observance of Legal Holidays and Excused Absence

8.9 Continuity of Support

8.10 Qualified Personnel

8.10.1 Key Personnel

8.10.2 Program Manager .................................................................................................................. Error! Bookmark not defined.

8.10.3 Employee Identification

8.10.4 Employee Conduct

8.10.5 Removing Employees for Misconduct or Security Reasons

8.10.6 Disclosure of “Official Use Only” Information Safeguards

8.10.7 Training

8.11 Interoperability and Functionality Services

8.12 Data Security and Safeguards

8.13 Compliance with DHS Security Policy

8.14 Encryption Compliance

8.15 Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information Requirement

8.16 Security Review ........................................................................................................................ Error! Bookmark not defined.

8.17 Interconnection Security Agreements

8.18 Required Protections for DHS Systems Hosted in Non-DHS Data Centers

8.18.1 Security Authorization

8.19 Enterprise Security Architecture

8.20 Continuous Monitoring

8.21 Specific Protections

8.21.1 Security Operations

8.21.2 Computer Incident Response Services

8.21.3 Intrusion Detection Systems and Monitoring

8.21.4 Physical and Information Security and Monitoring

8.21.5 Vulnerability Assessments

8.21.6 Anti-malware (e.g., virus, spam)

8.21.7 Patch Management

8.21.8 Log Retention

8.22 Personal Identification Verification (PIV) Credential Compliance

8.23 DHS Governance

8.24 Intellectual Property Records and Data Rights

8.24.1 Protection of Information

8.25 Section 508 Requirements

8.25.1 Section 508 Requirements for Technology Products (include in the SOW, PWS, or SOO)

8.25.2 Section 508 Requirements for Technology Services (include in the SOW, PWS, or SOO)

8.25.3 Section 508 Deliverables (include in the SOW, PWS, or SOO)

1 GENERAL

1.1 BACKGROUND

The Department of Homeland Security (DHS) is tasked with safeguarding the American people, our homeland, and our values. To accomplish our mission, we need to have the latest mobile technologies, tools, and capabilities to quickly adapt to any situation. We also need to work closely together as a unified Department comprised of the following components in additional to DHS

Headquarters (HQ). The primary purpose of this Statement of Work (SOW) is to establish a single-award Indefinite Delivery

Indefinite Quantity (IDIQ) contract for Cellular Wireless Management Services (CWMS) for the Department of Homeland Security

(DHS) and its Components.

▪ CBP: Customs and Border Patrol

▪ CISA: Cybersecurity and Infrastructure Security Agency

▪ CWMD: Countering Weapons of Mass Destruction

▪ FAMS: Federal Air Marshal Service

▪ FLETC: Federal Law Enforcement Training Center

▪ FPS: Federal Protective Services

▪ FEMA: Federal Emergency Management Agency

▪ OBIM: Office of Biometric Identity Management

▪ ICE: Immigration and Customs Enforcement

▪ S&T: Science and Technology Directorate

▪ TSA: Transportation Security Administration

▪ USCIS: United States Citizenship and Immigration Services

▪ USCG: United States Coast Guard

▪ USSS: United States Secret Service

1.2 SCOPE

The contractor shall provide the following mandatory and optional services. The contract will provide a comprehensive commercial cellular wireless managed services solution that includes access to multiple carriers and services; a web portal customized to each component to manage and report on the complete lifecycle of a device from order placement to recycling, program management services to oversee all aspects of the program, and a robust service desk to support all employees. The goal of these services is to reduce wireless costs, find program efficiencies across the Department, and provide timely access to the latest cellular wireless tools and services to complete the DHS Mission.

▪ Mandatory:

o Core Services

▪ Program Management

▪ Performance Management

▪ Telecommunication Expense Management Services (TEMS)

▪ Management Portal

▪ Service Desk Support

▪ Transition Services

▪ Optional:

o Cellular and Satellite Wireless Devices, Accessories, Licenses and Services o Mobile Device Management (MDM) Services o Labor Support o In-Building Cellular Enhancement Services

The area of support and coverage shall include the contiguous United States (CONUS), and locations outside the contiguous United

States (OCONUS) as needed.

DHS and all components have approximately 80,000 lines of service under the current CWMS contract vehicle.

1.3 OBJECTIVE

DHS seeks to establish an IDIQ contract as a DHS-wide contract vehicle for Cellular Managed Wireless Services (CWMS) to include the services described in Section 1.2 Scope above. The Contractor shall provide DHS with streamlined invoicing, billing and payment services, device ordering and delivery processes, standardized reporting, and a robust means of providing wireless devices and services to its employees. In addition, these services will enable DHS to reduce wireless costs and find program efficiencies.

Within DHS cellular wireless services has been procured incrementally, resulting in decentralized management and operational costs. While DHS and its Components’ wireless services have continued to improve, there are still requirements at the department level for oversight and monitoring of DHS assets, inventory control, and device disposition.

DHS’s current wireless services consist of devices and services from the following wireless service providers: Verizon, T-Mobile, AT&T, FirstNet, and several local/regional wireless vendors. The goals of this SOW are to:

(a) Allow for improved cost, schedule, performance, risk management, and warranties required to deliver effective and affordable cellular wireless services.

(b) Maintain clear government visibility into program cost, schedule, technical performance, and risk.

(c) Ensure services are provided within scope, committed service levels, and designated procedures.

This SOW is comprehensive and represents requirements from DHS and its Components. Ordering will be decentralized, and

Components will be able to manage their programs independently to meet dynamic operational needs.

1.4 REQUIREMENTS

The requirements are grouped into two categories: Core Services and Optional Services. Core services are required for each task order and shall be provided and priced out as a single suite of services. The Optional Services shall be available to all components.

Listed below are the services that shall be provided for both Core and Optional services.

Core Services:

▪ Program Management

▪ Performance Management

▪ Telecommunications Expense Management (TEMS)

▪ Management Portal

▪ Service Desk Support

▪ Transition Services

Optional Services:

▪ Cellular and Satellite Wireless Devices, Accessories, Licenses and Services

▪ Mobile Device Management (MDM) Services

▪ Labor Support

▪ In-Building Cellular Enhancement Services

2 CORE SERVICES

2.1 PROGRAM MANAGEMENT

The contractor shall provide both program and project management support services to include assigning a Program Manager (PM) responsible for managing the day-to-day functions of the contract and who will be the primary point of contact to each component.

Program management services are an integral part of and essential to the performance of all task orders under this IDIQ contract.

Component specific program management requirements will be specified at the task order level. At a minimum program management shall encompass the following:

▪ Project management support

▪ Operational support

▪ Contract management support

▪ Manage service provider relationships

▪ Generate reports

▪ Program analysis support

▪ Inventory control and monitoring

▪ Resource coordination

▪ Performance monitoring

▪ Risk management

▪ Identifying ways to improve organizational performance

▪ Facilitate communication among all contract staff and government

▪ Collaboration among all the contractor PMs supporting DHS and all its components.

2.1.1 PROGRAM MANAGEMENT PLAN (PMP)

The PMP shall outline and provide details on how the contractor will provide an inclusive plan at both the IDIQ and component task order level(s) to ensure the success of the program including but not limited to all program management requirements above. The

PMP shall be updated after the issuance of each component task order to include component specific plans and details.

2.2 PERFORMANCE MANAGEMENT

Performance management and accountability through service level management and metrics analysis is an integral part of this IDIQ contract. Performance and service level management shall serve as the primary tool for inspection and acceptance of services.

Evaluation of the contractor’s overall performance will be in accordance with the performance standards set forth in the Service

Level section.

2.2.1 PERFORMANCE MANAGEMENT ACCOUNTABILITY PLAN (PMAP)

The PMAP is the plan for managing performance, service level compliance, and the timely and accurate reporting of all services. At a minimum the plan shall include:

▪ Contractor’s overall approach for quality assurance

▪ Procedures and methods that will be used for the tracking of proposed service levels, the handling of corrective actions, improvement implementation, and how communication will occur with the Government.

▪ All proposed service levels, performance standards, and Acceptable Quality Levels (AQLs)

▪ Quality Assurance Surveillance Plan (QASP)

▪ Proposed credits for missed SLAs

All Service Levels shall include:

▪ Collection methodology

▪ SLA Measurement formulas

▪ Qualifying factors for SLA exceptions

▪ Proposed disincentive credits:

▪ Process to credit the Government:

▪ Process for increasing credit amounts based on consecutive missed SLAs.

Upon award the proposed service levels with government approval will become Service Level Agreements (SLAs). These SLAs will become the baseline for Component task orders. Components may negotiate additional SLAs if required and all SLAs resulting from award of the IDIQ contract or a task order shall be subject to a semi-annual suitability review. The Government at its discretion may request changes to the SLAs that include:

• Increases or decreases to the performance levels of existing SLAs

• The addition of new or deletion of existing SLAs

The Government will provide all proposed changes to the contractor for review and comment prior to execution. The contractor shall have ten (10) days to review and provide comments and request changes. Once received the Government will have ten (10) days to review the contractor’s response and make the determination to enact the changes within the IDIQ contract. The

Government will modify the SLAs at its own discretion based on the best interest of the Government.

2.3 TELECOMMUNICATIONS EXPENSE MANAGEMENT SERVICES (TEMS)

The contractor shall provide Telecommunication and Expense Management Services (TEMS). TEMS services shall be provided through the contractor’s management portal and include but not be limited to the following:

▪ Device lifecycle management

▪ Contractual and financial services

2.3.1 DEVICE LIFECYCLE MANAGEMENT

The contractor shall support the full device lifecycle for all mobility devices ordered under this IDIQ from procurement to recycling and maintained in the management portal.

2.3.1.1 PROCUREMENT

The contractor shall provide all ordering and procurement services through its management portal. Ordering and procurement services shall provide the ability to track all orders from initiation to closure and ensure adequate controls are in place to prevent fraud, waste, and abuse. Services and devices will be provisioned in a timely manner and maximize real time or just in time delivery associated with service activation.

2.3.1.2 INVENTORY MANAGEMENT

The contractor shall receive all devices, accessories, and equipment at their warehouse to be inventoried, add to the management portal, and asset tag if applicable using DHS Component asset tags. Devices and equipment may be received from service providers, vendors, and Government sources.

2.3.1.3 SHIPPING

The contractor shall ship all devices and accessories per the approved order in the management portal. All shipments shall be bundled together to minimize shipping costs and the Government will provide a shipping vehicle to be used if available. A minimum of two (2) shipping validation checks will be performed against the order to prevent issues. Shipping documentation will be included in each order and validation that equipment has been received by DHS and its components is required prior to invoicing.

2.3.1.4 SERVICING, REFURBISHING, AND RECYCLING DEVICES

The contractor shall assess malfunctioning devices to resolve customer reported issues. All devices to be replaced under warranty or unrepairable shall be wiped per DHS policy and disposed of through a DHS approved recycling program. All credits received from recycling shall be included in the consolidated invoice closing out the lifecycle of that device. The contractor shall submit a Device

Reuse and Recycling Plan (DRRP) that outlines how this service will be provided and report monthly on the results.

2.3.1.5 REFRESH

The contractor shall support a technology refresh program based on each Components specific needs at no additional cost. The refresh program may be done organically as devices become upgrade eligible or in large batches. Refresh intervals shall be negotiated at the lowest timeframe possible, and all efforts will be made to ensure a zero-cost device is available on the contract for new service and refresh orders.

2.3.1.6 SUPPLEMENTAL WARRANTY SERVICES

The contractor shall propose additional warranty support services to supplement existing manufacturer and service provider warranty programs. It shall cover devices, parts, and accessories.

2.3.1.7 VIP SERVICES

The contractor shall establish a VIP program for all VIPs identified at the order level to provide emergency device repair, replacement, or issue resolution. Specifics of the program shall be identified at the order level.

2.3.2 CONTRACTUAL AND FINANCIAL SERVICES

The contractor shall provide all contractual and financial services to support all Core and Optional Services to include but not be limited to the following:

▪ Wireless service agreement management

▪ Bill payment

▪ Invoice consolidation

▪ Invoicing

▪ Auditing services

▪ Administrative services

▪ Contract and dispute resolution

▪ Optimization services

2.3.2.1 AGREEMENTS

The contractor shall obtain the below types of agreements with other contractors, vendors, and service providers to facilitate the ordering and management of all Core and Optional Services. When supplies and services are not available on their own contract the contractor may propose a prime/sub arrangement. The contractor shall manage existing agreements awarded by the Government on behalf of the Components with specific requirements outlined at the task order level. The contractor shall process Purchase

Orders (PO) on the Governments behalf and pass all charges thru to the Government. The contractor shall research and recommend local wireless carriers to support international locations. The contractor shall advise DHS and its Components how wireless agreements may be impacted by changes in the wireless telecommunications industry and device/service offering. All agreements will be reviewed on an annual basis to include but not be limited to the following:

• Organizational Level Agreement

• Partnership Agreement

• Memorandums of Agreement

• Memorandums of Understanding

2.3.2.2 ADMINISTRATIVE SERVICES

The contractor shall maintain and make available all wireless service agreements, contracts, and other records with wireless service providers that specify pricing and their terms and conditions. The contractor shall monitor and notify the COR of key events associated with service contracts and agreements and measurable indicators, including but not limited to:

▪ Expiration dates

▪ Discount thresholds

▪ Review dates

▪ Contract and agreement option deadlines

▪ Spending levels

▪ Service line counts

2.3.2.3 CONTRACT DISPUTE RESOLUTION

The contractor shall work in collaboration with all wireless service providers with government oversight to prevent, mitigate, and resolve contract and invoicing disputes. All information shall be maintained in the management portal and services shall include but not be limited to the following:

▪ Resolving contractual issues

▪ Negotiate leveraging economies of scale to achieve optimal terms and pricing

▪ Collecting and preparing information required to resolve billing and account errors

▪ Track all claims from initiation to final resolution and follow up monthly until credits are received via the carrier’s invoice

▪ Research, review, dispute, and track all potential billing and accounting errors

2.3.2.4 AUDITING

The contractor shall provide monthly and ad hoc auditing services and reporting to ensure the integrity of DHS data and provide recommendations for where cost savings may be achieved. Auditing services and the monthly report will include but not be limited to the following:

• Identify billing and accounting errors prior to payment

• Examine usage patterns and adjust service and feature rate plans appropriately to mitigate costs and validate the proper provisioning of devices with the carriers

• Validate account ownership, service existence.

• Verify rates, charges, discounts, and phone numbers are assigned to the correct account numbers

• Alert DHS or Component designated staff if there is unauthorized usage, suspected fraudulent usage, excessive usage and if device usage exceeds established thresholds.

2.3.2.5 INVOICING

The contractor shall collect and process paper and electronic invoices received from multiple wireless service providers and vendors in multiple billing formats and consolidate into a single invoice per Component. All charges should pass through from the service providers and not be rebilled. Invoice and billing support shall be available between 8am and 5pm EST from Monday-Friday. As part of invoicing services, the contractor shall perform and report on the following services at a minimum:

• Validate invoice against ordering records, wireless contract or service terms and conditions

• Provide a single monthly invoice with minimal rework

• Conduct a service plan and feature review to ensure the plans within inventory match carrier records. All discrepancies will be disputed, and details provided to the Government as part of the invoice

• Breakout all carrier services, equipment, accessories, licensing, shipping costs, and recycling credits

• Include carrier inventory counts and voice and data usage

• Identify zero and minimally used devices for immediate action based on criteria identified at the task order level

• Identify phone numbers and charges on carrier invoices for equipment not within the management portals inventory

• Highlight high usage costs such as international and recommend cost saving measure for future usage

• Provide a copy of the original service provider invoice to the Government

• Separate out the invoice into the appropriate DHS organizational units, cost centers, or financial accounts

• Provide chargeback for carrier provided credits

• Identify opportunities and facilitate account and invoice consolidation efforts with individual service providers and DHS supported Components to streamline the payment process

2.3.2.6 OPTIMIZATION

The contractor shall perform an initial rate plan analysis within thirty (30) calendar days after the transition-in completion date to identify immediate savings and report monthly thereafter as part of the invoice review. All recommendations will be reviewed by the Component’s COR and implemented based on their approval. Optimizations services will include but not be limited to the following:

• Identify opportunities that lower costs while maintaining or improving the quality of wireless service to DHS users.

• Calculate costs based on actual monthly usage patterns over a 3-month, 6-month, and annual usage period.

• Analyzing available contract vehicles and carriers for the best pricing opportunities.

• Identify best practices and benchmarks from other federal and commercial customers for possible implementation.

• Track and report on all savings derived from contract optimization efforts.

• Ensure all carrier promotions are identified, communicated to DHS and its components, and implemented, if approved.

• Ensure any published discounts applicable to the federal government is applied to all DHS components. Components may negotiate special pricing due to a tailored SOW that will apply to said component.

2.4 MANAGEMENT PORTAL

The contractor shall provide a management portal no later than sixty (60) days after IDIQ contract award that will be available to all components to centrally manage all Core services and be the system of record for mobility services, devices, and licenses accessible by each respective component. The portal shall provide a single web-based carrier agnostic interface for DHS to control and manage its cellular wireless program across the department to include a distinct customizable instance for each component based on requirements specified at the task order level. All costs associated with establishing a properly certified web portal is the responsibility of the contractor. At a minimum the portal shall include the below functionality:

2.4.1 SECURITY REQUIREMENTS

The portal shall meet the below security requirements:

▪ Federal Risk and Authorization Management Program (FedRAMP) approved or in process

▪ Federal Information Processing Standards (FIPS) 140-2 certified at the Secure Socket Layer (SSL)

▪ Section 508 compliant

▪ Support Single sign-on

▪ Available 24x7x365 with backup and redundancy capability. Maintenance downtimes shall be negotiated and approved by the Government prior to implementation

▪ Include redundancy for continuity of operations.

2.4.2 INTERFACE REQUIREMENTS

The portal shall be capable of interfacing with the asset management, human resources, service desk ticketing, and mobile device management applications and systems used across DHS and identified at the task order level to ingest or export data. The interface may come in the form of a data dump, batch data transfer, API, or through e-Bonding.

2.4.3 USER ROLES

The portal shall categorize employees into distinct user roles identified at the task order level. User roles will identify what type of access and abilities will be given to an employee to include but not limited to the below.

▪ Ability to order specific types of equipment, accessories, and services

▪ Ability to see or have costs hidden

▪ Ability to run certain types of reports

▪ Ability to provide approvals in the system as part of an order workflow

▪ Ability to update device details and user profiles

▪ Ability to view usage and invoice details for specific users or offices

▪ Administrative rights for the portal

2.4.4 WORKFLOW

The portal shall have customizable role-based permission order workflows to allow for the following actions at a minimum to be taken in the portal.

▪ Ability for a user to order services, devices, licensing, and accessories that they have permission to access

▪ Ability for a user to provide multiple levels of order approvals

▪ Ability for a user to process orders

All orders within the portal shall follow a workflow from initiation through completion. At each status change in the order workflow a customized email notification shall be sent out if requirements are provided at the task order level. The contractor shall recommend automated notifications as part of their proposed solution to include workflow approvals, exceeding service plan thresholds, and any modification to the system such as outages, availability, and down times.

2.4.5 DATA FIELDS

The following data fields at a minimum are required for all components. The contractor is encouraged to include additional fields to meet the Government’s requirements not outlined below and additional options may be identified at the task order level.

▪ User Fields: Full name, Email, Title, Contact Number, Manager Name, Manager Email, Employee Type, Job Series, Work

Location, Shipping Address, Designation (VIP, ERG, etc.), Contract Name/Company/Number, Organizational Hierarchy, User

Comment.

▪ Device Fields: Phone Number, Carrier, Device Type, Make, Model, Service Start/Stop Date, Line Status, ESN, International

Mobile Equipment Identity (IMEI) Numbers, Physical SIM Number, eSIM Numbers, Device EID, Asset Tag Number, Cost

Center, Manufacturer’s Serial Number (MSN), Service Rate Plan/Features, Cost Center Hierarchy, Upgrade Eligibility Date, Warranty Date, Device Assignment Groups, Account Information, Line Comment, and Service Management Option (Device

Label).

2.4.6 DEVICE MANAGEMENT

The portal shall be able to track the full lifecycle of a license, service, or device from the initial order placed to the termination of service and recycling of the device. It will allow the government to track all Moves, Adds, Changes, and Disconnects (MACD) for managed services, licensing, and devices.

2.4.7 ORGANIZATIONAL COST CENTER HIERARCHY

The portal shall allow all users, devices, and service to be assigned to an organizational cost center hierarchy. The hierarchy will allow individual offices under each component to manage their own users, inventory, and expense management in either a centralized or decentralized way.

2.4.8 TRAINING PROGRAM

The contractor shall provide a Training Plan (TP) on how they will provide training to all DHS employees authorized to use the portal when requested by the government or when a major modification is made to the portal. Training shall be provided in multiple formats such as instructor lead, train the trainer, instructional videos, and web-based training. The training may be held at a government site, offsite, or web based. Training may be required initially and throughout the contract based on Component needs identified at the task order level.

2.5 SERVICE DESK SUPPORT

The contractor shall provide service desk support and reporting for all services offered within the scope of the IDIQ contract. Service requests may be initiated via email, instant message, or phone and may come directly to the contractor’s service desk or through a component’s service desk. The core hours for the service desk are between 7am and 6pm EST from Monday-Friday. Additional hours outside the core hours shall be provided as an optional service and be identified at the Order level. All issues shall be resolved at a minimum within 24 hours and no more than 5 calendar days for equipment replacement and shipping unless specified at the order level. The Contractor may be requested to travel within the CONUS to support DHS mission requirements. At a minimum the

Service Desk shall:

• Serve as the first point of contact for customers seeking technical assistance via phone, email, or ticketing system.

• Be knowledgeable on all mobility and carrier service offerings, and the specific differences in how each component handles Mobility that will be identified at the order level and through a component specific provided SOP.

• Provide an escalation tier for difficult or recurring issues.

• Seek to perform first contact resolution for a minimum of 80% of calls.

• Maintain communications with the customer until the issue is resolved.

• Perform remote troubleshooting.

• Provide reporting on all orders, call logs, and survey responses.

2.6 TRANSITION SERVICES

All task orders awarded under this IDIQ contract shall include both a Transition-In and Transition-Out service period. The contractor shall submit a Transition Management Plan (TMP) that captures all transition requirements and includes all required steps within a master schedule.

• Transition-In o IDIQ: 90 Calendar days from IDIQ contract award date o Task Order: Determined at Task Order level with a maximum of 90 calendar days from order award date

• Transition-Out o IDIQ: 90 calendar days from IDIQ contract expiration.

o Task Order: Determined at Task Order level with a maximum of 90 calendar days from order expiration

2.6.1 TRANSITION-IN

The transition shall be deemed complete as of the first business day immediately following the service transition complete date specified in the TMP. The Government will confirm acceptance with a written notice accepting transition-in completion. The

Transition In period shall be considered complete when all service management resources and support services are in place and in full compliance with the IDIQ contract requirements. Once completed the measurement and reporting of the contractor’s performance will begin according to the PMP criteria. The designated program manager shall maintain daily contact with the

Contracting Officer Representatives (COR) at both the IDIQ and Task Order levels during the transition period to ensure any issues are addressed timely. At a minimum transition-in services shall include the following:

• Data Transfer o The contractor shall successfully test and demonstrate any electronic data transfer capabilities between the contractor’s portal and all of DHS financial, inventory, or contracting data sources.

o The contractor shall gather all DHS asset data to perform an initial load into the web portal to perform an initial optimization analysis.

• Billing and Services o Transition billing and services while ensuring no interruption in service or adverse impacts upon DHS business capabilities and employees.

• Service Provider Impacts and Relationships o Minimize all carrier-initiated service impacts through coordination, continuous monitoring, and communication with all stakeholders.

o Maintain all cellular wireless service provider relationships to ensure no loss of service for DHS during the transition and over the life of the order.

• Obtain Operational and Security Authorizations o The contractor shall be in process to obtain FedRAMP Authority to Operate (ATO) for the web portal. The portal shall be given an interim ATO upon IDIQ contract award and DHS will sponsor FedRAMP approval for the

Contractor if not currently in process or previously approved.

• Web Portal o The contractor shall successfully demonstrate, test, and place into production the portal.

o The web portal shall support Single Sign-On at the Task Order level.

o The web portal shall include all Component requirements and modifications specified at the Task Order level.

• Service Interruptions o The contractor shall ensure no service interruptions or adverse impacts upon DHS activities and employees occur due to changes made without government review and approval at the IDIQ level or contractor negligence. All changes will be reviewed at the IDIQ and Component order level prior to release.

2.6.2 TRANSITION-OUT

The contractor shall plan and provide a transition-out period. Transition-out shall be available at the end of the base period of performance and each option period of performance for each task order at the Government’s discretion. At a minimum transition-out services shall include the following:

• Service Transition o The methodology that will be used to transfer service responsibility to another provider or back to DHS and its

Components. It shall identify what actions both the contractor and government will need to take to ensure a smooth transition of information, government furnished property, and all management responsibilities. Address any known risks, foreseeable problems, and shall identify additional resources and costs if any to mitigate these risks and ensure a successful transition.

• Agency Wireless Data o Delivery of all agencies wireless account(s), service provider and vendor contact information, inventory, invoice, and other data resident in the contractor’s data system necessary to enable another provider, or DHS and its

Components to assume full responsibility.

o All data shall be delivered, available, and accessible to DHS and its Components in electronic format to facilitate the transfer of data into another data system. The specific format(s) for this data will be specified at the task order level.

• Contract Resolution o Upon expiration of the IDIQ contract and task orders as part of close-out responsibilities the contractor shall continue to support DHS and its Components in handling and tracking all disputes filed with wireless service providers through final resolution or for 6 months after contractor expiration, whichever is less.

2.6.3 TRANSITION MANAGEMENT PLAN (TMP)

The TMP shall cover all Transition-In and Transition-Out requirements and shall be submitted at the kickoff meeting and updated 30 calendar days prior to the Transition-Out period starting. At a minimum the TMP shall also include the following:

• Description of how knowledge will be communicated to facilitate the transition i.e., briefings, training sessions, Standard

Operating Procedures (SOP), reference guides, etc.

• Development of an Integrate Master Schedule (IMS) that identifies all transition activities to be performed. The schedule shall identify critical processes, transition tasks and descriptions, risks and recommended workarounds, task prioritizations, and due dates.

3 OPTIONAL SERVICES

DHS and its Components may require additional services to support its mission requirements. These services will be acquired separately from the Core services at the discretion of the Component and will be incorporated at the Task Order level. All optional services are listed below.

3.1 CELLULAR AND SATELLITE WIRELESS DEVICES, ACCESSORIES, LICENSES, AND SERVICES

The contractor shall be able to provide commercially a wide range of wireless devices, accessories, services, and licenses that reflect the current commercial marketplace. All commercially available mobility devices capable of connecting to a wireless carrier telecommunication proprietary network shall be considered within scope of this IDIQ. Those devices shall be available if requested to be ordered and include but are not limited to the following device types:

• Pagers

• Cell Phones

• Smartphones

• Tablet/Laptops (Cellular and Wireless Enabled)

• Hotspots (MIFI)

• Air Cards

• Wireless modems

• Internet of Things (IOT) devices

• Satellite phones and BGANS

The contractor shall at a minimum be capable of providing the following:

• Documentation of an established working relationship with carriers

• A minimum of 3 domestic wireless carriers and local international service providers for countries identified in each component’s task order

• A continuously updated list of wireless devices and accessories that reflect current market offerings

• A DHS Service Catalog with all DHS approved devices, accessories, service plans and rates

• Ability to purchase all devices, licenses, and accessories on behalf of DHS and its components using authorized government contracts

• The most cost-effective plans and services for all devices considering unlimited usage, pooling options, add a line plans, free nights and weekends, friends, and family discounts, and mobile to mobile minutes, etc.

• Research and provide recommendations on voice and data service plans that provide cost savings for Government approval

• The option to purchase or lease wireless devices and ability to install additional software and upgrades

• Licensing for all devices that require a license for the device itself of software used to manage and secure the device

• Optional warranty services in addition to the manufacturer issued warranties.

3.1.1 CARRIER TERMS AND CONDITIONS

The contractor shall negotiate for the following contract terms and conditions:

• Price reduction for suspended service

• No early termination fees

• 10 to 18-month upgrade eligibility refresh cycle

• Zero cost smartphone device option no older than 1 iteration behind the manufacturer’s device offerings

• Warranty and device exchanges will not be returned to the carrier

3.2 MOBILE DEVICE MANAGEMENT (MDM) SERVICES

The contractor shall provide the following tiered MDM support options and invoiced per device as a single encompassing support fee. A higher-level tier includes all requirements of previous tiers in addition to its own specific requirements that will be provided at the Order level in Component statements of work.

• Tier 1: Basic Service Desk Support (Offsite) o Core hours: Monday through Friday between 7:00 am and 6:00 pm ET.

o Support multiple client device platforms i.e., Android OS, iOS, and Microsoft.

o Device installation support after a user has been provided a PIN/token for enrollment or work with Tier 2 directly for the PIN/token.

o Troubleshooting requirements for a component’s On-Prem or Cloud based MDM solution.

• Tier 2: Advanced Service Desk Support (Offsite unless specified in a component’s task order) o Provisioning of Devices (may include adding to Active Directory and/or sending a PIN/token for enrollment).

o Core hours: Monday through Friday between 7:00 am and 6:00 pm ET.

o Enable policy-based device management and configurations.

o Enforce security policies and encrypt data over the air and at rest.

o Push/pull (install, remove) applications.

o Control devices i.e., turn off WIFI, camera, GPS, Bluetooth, etc.

o Remote wiping.

o Deliver software, patches, and files to the devices.

o Enable FIPS 140-2 certification security.

o Support the NIST SP 800-126 Security Content Automation Protocol (SCAP).

• Tier 3: Engineering and Deployment Support (Quoted at task order level utilizing labor cost) o Core Hours: Monday through Friday between 7:00 am and 6:00 pm ET.

o Assist with engineering and deployment of new MDM solutions.

o Provide ongoing configuration and adjustment support.

o Analyze various MDM solutions and recommend the solution that best meets a component’s needs.

3.3 LABOR SUPPORT

The contractor shall provide an established process and procedures to onboard staff to support both on-site and off-site mobility efforts to supplement DHS staff under the scope of this IDIQ. Below are categories of labor support required and detailed labor support requirements that will be defined at the Component order level and will include specifics such as quantity of staff, skill level, education/experience, and specific duties.

3.3.1 TIER 2 SERVICE DESK SUPPORT

The contractor shall provide tier 2 service desk support staff to support all mobility operations and services. Specific duties will be identified at the order level, but general duties shall include but not be limited to the following:

• Limited after-hours support beyond core hours

• Collect and distribute cellular wireless devices

• Provide one on one training on the use of a device

• Troubleshoot broken or malfunctioning devices

• Support emergencies and Continuity of Operations (COOP) activities

• Provision and manage devices through an MDM

• Maintain an inventory of on-hand devices to support quick provisioning

3.3.2 TIER 2 ANALYSIS SUPPORT

The contractor shall provide analyst support staff to review all CWMS data to include usage, charges, trends, and report back on findings for DHS and its components to act on. Specific duties will be identified at the order level, but general duties shall include but not be limited to the following:

• Highlight trends

• Review and report on the health of the contract

• Supplement the contractor’s support staff provided under Core services

• Identify missed opportunities for cost savings

• Analysis of data sets, identify discrepancies, and adjust where necessary

• Draft reports, and brief senior management

3.3.3 TIER 2 DEVELOPMENT SUPPORT

The contractor shall provide development support for unique customizations to the management portal . Detailed requirements will be specified by the Component at the Order level.

3.3.4 TIER 2 SURGE SUPPORT

The contractor shall provide surge support staff in response to significant designated DHS events. Specific surge requirements will be specified at the Component order level. Examples of incidents include but are not limited to the following:

• Natural disasters

• Acts of terrorism

• Congressional mandates

• Policy changes

3.3.5 TIER 2 EXECUTIVE TRAVEL SUPPORT

The contractor shall provide dedicated travel support to DHS and Component designated Executive Level staff. The support and services shall ensure executive staff have continuous, secure, and complete cellular wireless service support. Specific requirements to include the definition of executive level will be provided at the Component order level.

3.3.6 SPECIALIZED SUPPORT

The contractor shall provide specialized support for those activities or events that require support services that are within the scope of the IDIQ contract but not explicitly stated in this SOW. A special requirement may be need for a subject matter expert in a new technology or service offering.

3.4 IN-BUILDING CELLULAR ENHANCEMENT SERVICES

The contractor shall provide acceptable and reliable cellular service within all parts of a building or campus to include the basement and garage levels if applicable. They will coordinate with the carriers, provide all labor, supervision, materials, and equipment necessary to install a cellular In-Building wireless solution to enable seamless outdoor to indoor coverage of mobile voice and data services. The solution will be capable of providing enhanced coverage for all AT&T, T-Mobile, Verizon, and FirstNet cellular bands and frequencies. Solutions may also include service for two-way and land mobile radios (LMR). Only carrier approved solutions will be accepted.

In-Building Cellular Wireless services shall include:

• Assessments to determine technical requirements

• Specification development

• Coordination with vendors for establishment of cost for implementation

• Asset Management

• Project Management

• Warranty and License Management

4 WIRELESS SECURITY

The contractor shall ensure that wireless communications services comply with DHS 4300A requirements. In the absence of DHS

4300A requirements, the contractor shall utilize NIST SP 800-53 or equivalent industry practices and standards.

The Contractor shall make available security features and procedures to prevent electronic serial number cloning and fraudulent use of cloned equipment and services. As new security enhancements for cellular services are developed, the contractor shall present written recommendations for those enhancements to the Government to which the Government will provide written acceptance / rejection.

The Contractor shall ensure that, due to the unique nature of the DHS mission, certain commonly available features on wireless devices shall be disabled prior to deployment in accordance with DHS policy and COR direction. New technologies and handset features must be pre-approved by DHS prior to deployment. DHS will review configuration of individual devices and provide guidance on which features the contractor shall disable prior to distribution. The contractor shall test a statistically significant sampling of devices to ensure that proper procedures are being followed.

The contractor’s solution shall be in accordance with OMB Memoranda M-09-32, M-08-27, M-08-05 and M-08-16 that require agencies to reduce and consolidate the number of external access points, including Internet connections into the DHS’s network.

The Trusted Internet Connections (TIC) initiative requires that all external connections are routed through an OMB-approved TIC.

This high-level security requirement drives the following lower-level requirements for GFE mobile devices:

• Cellular wireless data traffic shall not transmit from the trusted mobile device to the agency’s data connection across the open Internet unencrypted but use a Virtual Private Network tunnel.

• Cellular wireless data traffic shall pass through the agency’s TIC for inbound and outbound connections to the Internet.

• Management of the mobile devices shall not be performed across the open Internet unencrypted but use a Virtual Private

Network tunnel.

• The physical location of the Mobile Device Management (MDM) system which enforces the mobile device’s security policy shall comply with NIST SP 800-53 physical security controls for medium impact systems based on FIPS 199.

• Under Public Law 107-347, the Federal Information Security Management Act (FISMA), the Confidentiality, Integrity, and

Availability Impact Levels are Moderate for the MDM system which enforces the mobile device’s security policy.

5 DELIVERABLES

The COR is designated to inspect and accept all deliverables. Upon receipt of a deliverable the COR will have ten (10) business days to review, comment, and either accept or reject. All rejections will be in writing, state the basis for rejection, identify the SOW section that the deliverable fails to meet, and identify the corrective action required. The contractor shall rework any rejected deliverable within five (5) business days. Upon receipt of the reworked deliverable the COR will have five (5) business days to review. A deliverable will only be marked as “Final” if accepted by the COR.

5.1 PLANS

The contractor shall provide detailed plans that include all requirements of the IDIQ to ensure successful performance of this IDIQ

5.1.1 PROGRAM MANAGEMENT PLAN:

• SOW Section: 2.1.1

• Delivery Date:

o Draft: At Post award conference o Final: 30 Calendar days after award

5.1.2 PERFORMANCE MANAGEMENT PLAN (PMAP):

• SOW Section: 2.2.1

• Delivery Date:

o Draft: At Post award conference o Final: 30 Calendar days after award

5.1.3 TRANSITION MANAGEMENT PLAN (TMP)

• SOW Section: 2.6.3

• Delivery Date:

o Draft: At Post award conference o Final: 7 Calendar days after Government review

5.1.4 DEVICE REUSE AND RECYCLING PLAN (DRRP)

• Sow Section: 2.3.1.4

• Delivery Date: 30 Calendar days after award

5.1.5 TRAINING PLAN (TP)

• Sow Section: 2.4.8

• Delivery Date: 30 Calendar days after award

5.1.6 BUSINESS CONTINUITY REPORT (BCP)

The contractor shall prepare and submit a Business Continuity Plan (BCP) that documents the contractor’s plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism 45 calendar days after award. The BCP shall include but not be limited to the following requirements:

• A description of the contractor’s emergency management procedures and policy

• A disaster recovery plan for the management portal

• Designation of a key personnel who will be a member of the Emergency Response Group (ERG) who will participate in any training or exercise conducted by DHS

• A description of how the contractor will account for employees during an emergency and establish a calling tree for all personnel working within the scope of this IDIQ

• How communication will flow between the contractor and government

• A list of primary and alternate contractor points of contact each with a primary and alternate phone and email address

The BCP shall be activated immediately after an emergency or incident has occurred and shall be operational within 4 hours of activation and be sustained until the emergency is resolved and normal conditions are restored.

5.2 MEETINGS

The contractor shall attend government sponsored meetings to ensure effective and efficient distribution of information. The contractor is expected to coordinate as necessary with other contractors to resolve problems and issues identified in all meetings.

5.2.1 POST AWARD CONFERENCE

A Post Award conference will be required no later than 5 calendar days after award of the IDIQ contract. The contractor shall provide the meeting agenda and prepare, deliver, and speak to the drafts of Plan deliverables that are due.

5.2.2 OPERATIONAL MEETINGS

The contractor shall meet weekly, monthly, or as needed with government staff,…