DHS-FEMA FOC SOW_OPENS_v.2.docx

Department of Homeland Security (DHS) DHS Statement of Work (SOW)

Federal Emergency Management Agency

STATEMENT OF WORK (SOW) FOR:

Federal Emergency Management Agency (FEMA) Operations Center (FOC) On-Premise Emergency Notification System (OPENS)

Tara Shirley, Contracting Officer

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

Statement of Work (SOW) For Federal Emergency Management Agency (FEMA) Operations Center (FOC) On-Premise Emergency Notification System (OPENS)

1.0 GENERAL

1.1 BACKGROUND

The mission of the FEMA Operations Center (FOC) and FEMA Alternate Operations Center (FAOC) is to receive, analyze, and disseminate a wide variety of all-hazards information in support of the Department of Homeland Security (DHS) National Operations Center, FEMA Senior Leadership, National Response Coordination Center (NRCC), and Executive Branch Departments and Agencies. FOC functions include maintaining 24/7 situational awareness, issuing alerts, warnings, and notifications, and coordinating operational support. The FOC and FAOC operate in Sensitive Compartmented Information Facilities (SCIF) and require an on-premise (on-prem) Emergency Notification System (OPENS) to fulfill mission critical requirements to notify mission partners of information readily and effectively.

On-prem means IT infrastructure hardware and installed software applications hosted locally at the FOC and FAOC.

1.2 SCOPE

The scope of this project is to acquire a commercial off-the-shelf (COTS) or customized on-prem Emergency Notification System (ENS) to meet FOC Functional and Operational Requirements listed below. The FOC will serve as the customer for this project.

1.3 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this contract:

Authorities:

· Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended (42 U.S.C 5121, et seq.)

· The National Security Act of 1947, as amended (50 U.S.C. 401).

· The Homeland Security Act of 2002 (PL 107-296).

· Post-Katrina Emergency Management Reform Act of 2006 (PL 109-295) References:

· Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Cybersecurity Framework Implementation Guidance, (May 2020)

· DHS National Security Systems Policy Directive 4300B, v.10.1, (November 2018)

· Executive Order (E.0.) 12148, as amended, Federal Emergency Management. E.O. 12656, Assignment of Emergency Preparedness Responsibilities.

· E.O. 13618, Assignment of National Security and Emergency Preparedness Communications Functions.

· Federal Executive Branch National Continuity Program and Requirements (October 2012).

· Federal Continuity Directive 1, Federal Executive Branch National Continuity Program and Requirements (January 2017).

· FEMA FP-104-008-4, FEMA Watch Guide (July 2019)

· National Institute of Standards and Technology (NIST), United States (U.S.) Department of Commerce, Cybersecurity Framework (CSF) 2.0, (February 2024)

· National Security Presidential Directive (NSPD) 51/Homeland Security Presidential Directive (HSPD) 20, National Continuity Policy.

· National Defense Authorization Act (NDAA) 2020/2021.

1.4 Constraints

The FOC faces certain constraints that come with being a government agency. The workings of the Federal budgetary process means the FOC regularly faces difficult choices between protecting funding for current projects and putting them at risk in support of FEMA Office of Response and Recovery programs. Moreover, the FOC, as with all agencies, is constrained by a myriad of acquisition laws, regulations, policies and procedures.

2.0 SPECIFIC REQUIREMENTS/TASKS

The FOC has identified the following Security, Functional and Operational requirements that OPENS must meet.

Security

Vendor must be a United States of America-based company.

System shall meet requirements of a National Security System in accordance with DHS National Security Systems Policy Directive 4300B.

System shall meet security requirements in accordance with FEMA established security standards (e.g., CISA Cybersecurity Implementation Guidance, National Institute of Standards and Technology Cybersecurity Framework 2.0)

System shall be on-prem, accessible only within the FEMA/DHS network. No internet-based access.

System shall support PIV access.

System shall support Username and Password.

System shall support solution for forgotten login.

System shall support solution for forgotten password.

System shall support Administrator rights.

System shall allow for multiple Administrators.

System shall allow Administrators ability to assign User permissions.

System shall support unlimited Users.

On-prem systems shall operate independently with ability to replicate data between sites.

System shall not include any Artificial Intelligence (AI).

Functional / Operational

System shall provide an Emergency Notification System.

System shall be accessible 24/7.

System shall provide a Graphical User Interface (GUI).

System shall provide quick access features to key functions (e.g., notification, templates, contacts, etc.).

System shall display active and sent notification(s).

System shall allow Administrator to assign User roles.

System shall provide Administrator ability to create custom user roles.

System shall support unlimited number of Contacts.

System shall allow for multiple communication methods (e.g., phone numbers, emails, and SMS numbers) per contact.

System shall support edits to saved contact entries.

System shall support single edit to Contact that populates throughout system (e.g., individual contacts and groups).

System shall allow Administrator to assign Contact rules.

System shall support search features for contacts (e.g. by Last Name, First Name, Login Name and email).

System shall support unlimited number of Groups.

System shall support search method for Groups by name, Contact Last or First Name.

System shall allow unlimited contact entries within group(s).

System shall support edits to saved Groups.

System shall allow Users to see all Contacts within Group(s).

System shall support search features for groups.

System shall support notification templates.

System shall support search method for notification templates.

System shall support notification templates that include multiple Groups.

System shall support variables within notification templates (e.g., date, time, sender, call back number, etc.).

System shall support customizable variables.

System shall provide separate fields for message content so User can send different information dependent on delivery method (e.g., email, phone, SMS, etc.).

System shall support ability for User to choose multiple groups/contacts to send a notification “on the fly.”

System shall support scheduled activation of notification(s).

System shall support text-to-speech.

System shall support recorded audio.

System shall support preview of audio.

System shall support removal of Contact(s) from a Group(s) without permanently deleting that Contact(s) from the Group(s).

System shall provide validation of notification receipt for each contact in a group.

System shall cease other methods of the notification when recipient validates receipt (i.e., recipient validates email receipt, system ceases follow-on methods of notification such as phone call).

System shall provide detailed Reports of system usage (e.g., contact, notification method, success/unsuccessful, reason, number of attempts, etc.).

System shall provide extraction of Reports via .csv and .pdf.

System shall support customization of Reports by the User.

System shall provide search feature for Reports.

System Reports shall be presented in a simple and understandable manner (e.g., simple explanation of unsuccessful attempts to notify contact(s)).

System shall provide audit logs in report format.

3.4 Project Manager

The Vendor shall provide a Project Manager who shall be responsible for all vendor work performed under this SOW. The Project Manager shall be a single point of contact for the Contracting Officer and the Contracting Officer Representative (COR). The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Vendor in the absence of the Project Manager, shall be provided to the Government as part of the Vendor’s proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Vendor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Vendor shall not replace the Project Manager without prior approval from the Contracting Officer.

The Project Manager shall be available to the COR via telephone between the hours of 8:30 am and 5:00 pm EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 4 hours of notification.

4.1 Security

Access to a National Security System and SCIF will require contractor personnel to hold an active Top-Secret clearance.

4.2 Period of Performance

The period of performance for this contract is 72 months from the date of award.

· Base Year

· Option Year 1

· Option Year 2

· Option Year 3

· Option Year 4

4.3 Place of Performance

Contractor performance will take place in SCIFs located at the FOC and FAOC.

4.5 Travel

Travel will be required to the FOC and FAOC for installation.

4.6 Post Award Conference

The Vendor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 21 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract. The Post Award Conference may be held virtually.

4.11 General Report Requirements

The Vendor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Window11 and Microsoft Office Applications).

4.14 Section 508 Compliance

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

The Government may furnish resources to the Vendor in support of this contract.

7.0 Contractor Furnished Property

The Vendor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract.

8.0 Government Acceptance Period

The COR will review deliverables prior to acceptance and provide the Vendor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Vendor notifying it that the deliverable has been accepted.

8.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Vendor’s accepted proposal.

In the event of a rejected deliverable, the Vendor will be notified in writing by the COR of the specific reasons for rejection. The Vendor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

The COR will have 10 business days to review deliverables and make comments. The vendor shall have 10 business days to make corrections and redeliver.

8.3 All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan.

The Vendor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Vendor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

9.0 Deliverables

The Vendor shall support the following meetings/requests and deliverables.

Vendor, COR, Government

image1.jpg