OLES_PSP_FSA_Software_Statement_of_Work_1JUL25_Draft_1.docx

Facility Security Assessments Software – Statement of Work

Facility Security Assessment (ISRMS) software Statement of Work Purchase and Operation & Maintenance

1. Scope and Requirements The following Statement of Work (SOW) is for all aspects of the purchase and Operation & Maintenance (O&M) of the Department of the Interior’s (DOI) Office of Law Enforcement Services (OLES) Enterprise Integrated Security and Risk Management System (ISRMS).

The ISRMS software will support the needs of the DOI to meet compliance, analysis and reporting requirements for the physical security program (PSP) based on DOI needs and Interagency Security Committee (ISC) policies and standards. The ISRMS software shall be capable of seamlessly integrating with DOI IT requirements for handling, storing, and protecting controlled unclassified information (CUI).

This statement of work (SOW) describes the services required from the Contractor to provide support to the PSP.

The PSP requires the implementation, installation, transition of old database records to the new system, hosting with application and data management services, helpdesk support services, training, and other as needed support services such as added functionality and customizations for a new ISRMS system.

This Commercially Available Off-The-Shelf (COTS) system will need to automate the functions performed by security employees and address the following high-profile concerns which are not currently being met by the Government’s current systems for DOI:

· Individual bureaus are developing and managing their own records systems and inconsistent and independent collection of data and reporting guidelines make data inconsistent, increase subjectivity and gaps of non-compliance, and make any statistical analysis of DOI security programs extremely difficult.

· The ISC mandates that all federal facilities comply with their policies and standards but the PSP has no comprehensive tool to provide DOI for ensuring inventory, assessments, plans training, signage, and reporting are being done properly.

· DOI Strategic Plan calls for a more integrated and coordinated approach to collecting data, support by common programs and modernization blueprints. The current systems are unable to share information making it difficult to do joint bureau investigations and the duplicative systems resulted in both systems receiving a combined investment rating of RED from the Office of Chief Information Officer.

· Incorporate modern Cybersecurity Requirements under Executive Order (E.O.) 14028 such as multi-factor authentication.

· Store digital evidence (images, video, etc.) per E.O. 14074.

· The current systems are not accessible in rural areas that do not have cellular or internet services.

The solution will be an automated system that will allow personnel within DOI to identify, collect, store, retrieve, analyze, manage, and report information related to the PSP. As a result, the system will allow DOI and bureau personnel to create reports in various formats, sort data, conduct data analysis, and interface with other systems, both within DOI and outside of it. The system will give DOI an enhanced ability to:

· Protect people

· Protect critical activities and infrastructure

· Prepare, Detect, deter, deny, respond, and recover from incidents at facilities

· Capture, integrate, and share information from multiple sources

· Identify needs (training, resources, etc.)

· Measure performance of security programs and management of incidents

· Meet reporting requirements

· Analyze and prioritize protection efforts

· Manage visitor use and protection programs

As the Government anticipates a COTS system, it is anticipated that the entire solution will require twelve months or less for installation, implementation, transition of and cleanup of old database records to the new system, testing of the new system, and training for personnel. It must support industry standard Application Programing Interfaces (API), such that additional application features can be phased-in, as required. The solution can be integrated with other COTS products to meet the specific ISRMS requirements.

DOI is the nation’s largest landowner responsible for the day-to-day law enforcement and security of lands that it manages. The various bureaus that make up DOI have a responsibility to prevent, detect, and investigate criminal activity that occurs on DOI-managed lands. Bureaus must manage safety and protection for tribal communities, the millions of visitors each year that use these lands, as well as for the thousands of DOI employees that manage the resources. They must monitor visitor use, manage crowds, and traffic, and protect the natural and cultural resources. These wide-ranging responsibilities require the collection, analysis, management, and reporting of information related to security incidents. Because DOI has many security roles at sites across the country, it is continually collecting information, in compliance with legislation, policy, and directives, on people and events. Both actions and observations, criminal and non-criminal, may have security implications, and these need to be recorded. These nation-wide responsibilities mean that security information, are continually captured and used within DOI as part of their on-going business. Through the analysis of the information, valuable management lessons can be learned, patterns identified, and procedures and policies improved. The new ISRMS software will address these data storage, processing, and analytical needs. Finally, information collected by DOI needs to be shared among the bureaus, and with other federal agencies such as the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS).

1.1 ISRMS system requirements

The Department of the Interior (DOI) seeks to acquire, deploy, and maintain a next-generation Enterprise Integrated Security and Risk Management System (ISRMS). This ISRMS shall exceed the capabilities of both the U.S. Army Military Police Security Management System – Countermeasures (SMS/CM) and the Department of Homeland Security’s (DHS) Modified Infrastructure Survey Tool (MIST), by incorporating fully integrated physical security, vulnerability analysis, asset management, risk modeling, and compliance functionality within a unified, cloud-architected platform.

1.1 Purpose and Objectives The ISRMS will serve as the authoritative platform for DOI’s security management, supporting:

1.1.1 Comprehensive facility and asset risk assessments in compliance with the latest DHS Interagency Security Committee (ISC) Risk Management Process (RMP).

1.1.2 Automated cost estimation and budgeting for mitigation measures

1.1.3 Scheduling and tracking of assessments, inspections, mitigation activities, and preventive maintenance

1.1.4 Secure, CUI-, NDAA- and FISMA-compliant system and data storage

1.1.5 Simple system integration with existing access control (PACS), CCTV, intrusion detection systems (IDS), mass notification, and GIS-based visualization tools

1.1.6 User roles and audit functionality consistent with NIST SP 800-53 and FedRAMP Moderate security controls. Only available to specific users within DOI.

1.1.7 User-customizable reporting with dashboards and GIS visualization.

1.2 Scope of Work The contractor shall design, engineer, furnish, install, integrate, test, document, and support a turn-key ISRMS that includes the following components:

1.3 Core System Functionality

1.3.1 Vulnerability tracking engine with tiered severity levels and remediation status

1.3.2 Asset catalog with linkage to facilities, systems, risk profiles, and ownership, as well as to GIS-based graphic user interface

1.3.3 Cost estimating module to generate and track lifecycle estimates for planned mitigation measures and existing security equipment in place (repair/replacement)

1.3.4 Assessment/Inspection module with scheduling, notifications, documentation, corrective action tracking, and certification workflows

1.3.5 Geospatial dashboard visualizing current threat levels, status of countermeasures, and site-specific indicators

1.3.6 Assessment and countermeasure assignment system in compliance with the ISC-RMP, 444 DM 1, SMS/CM guidance, and GSA-approved product lists

1.3.7 Facility/bureau/DOI-level User-customizable Analysis and Report generation for ISC compliance (ISC-RMP, Risk Registers, countermeasure tracking, Compliance System (ISC-CS) exports, program mgmt. analysis within and between bureaus or facilities, annual accomplishments, internal controls/performance management, outyear budget and resource planning, DOI directives, NIST RMF, FISMA, and congressional briefings. System has the functionality to seamlessly gather and report the information into performance measurement dashboards and reports that can be dynamically updated and manipulated to show specific facilities, bureaus, offices, or all, as well as provide ISC-compliant DOI-customized FSA reports and compliant ISC Compliance System (ISC-CS) excel outputs.

1.3.8 Data is owned by DOI and made available as requested and after contract end in a format compatible with DOI systems and as requested by DOI.

1.3.9 Easy import and export process between Microsoft 365 products (e.g., Excel, Word, PowerPoint, Power BI, PowerApps/Flow) and Adobe PDF. Must be able to pull and read data from imports for integration into existing database(s).

1.4 System Architecture

1.4.1 Modular, scalable architecture (cloud-native or hybrid)

1.4.2 API-ready with support for REST, XML, and JSON for integration with PACS, VSS, enterprise asset databases, and personnel tracking tools

1.4.3 Role-based access with multifactor authentication and PKI/PIV compliance

1.4.4 High availability (99.99%), failover clustering, and full data redundancy

1.5 Technical Requirements

1.5.1 Encryption: FIPS 140-3 compliance (data at rest and in transit)

1.5.2 Compliance: NIST SP 800-53 Rev. 5, SP 800-171, FISMA, FedRAMP Moderate, NDAA

1.5.3 Data Integrity: Immutable audit logs; log retention ≥ 5 years

1.5.4 Interfaces: Compatible with AMAG, LenelS2, Avigilon, Brivo, Axis, Genetec, and GSA PACS ordering frameworks, and easily interfaced via laptop, mobile, iPad, etc.

1.6 System Components

1.6.1 Asset Registry: Categorizes physical security equipment, IT systems, structural components

1.6.2 Vulnerability Assessment Tool: DOI-compliant, ISC-compliant, DA Form 7278-equivalent logic, risk matrix, and cross-facility consequence modeling

1.6.3 Countermeasure Planning Suite: Matches vulnerabilities to prescriptive fixes with prioritization capabilities and implementation schedules

1.6.4 Financial Planning Interface: Tracks cost estimates and budget codes per facility/region/project

1.6.5 Assessment/Inspection Manager: Workflow for pre-inspections, SMO progress checks, final QA walkthroughs

1.7 Accessibility and Section 508 Compliance

1.7.1 Visually compliant to departmental visual identification requirements

1.7.2 Full adherence to 36 CFR Part 1194 (as applicable), including:

1.7.2.1 Software Applications and Operating Systems (§1194.21)

1.7.2.2 Functional Performance (§1194.31)

1.7.2.3 Information, Documentation, and Support (§1194.41)

1.8 Cybersecurity and Data Protection

1.8.1 Audit-ready log management, incident reporting interface, vulnerability patching protocol

1.8.2 Data Sovereignty: All data must be U.S. Government–originated and hosted in a secure federal-compliant environment for controlled unclassified information (CUI) including markings, handling, storage, decontrol, and disposition.

1.8.3 Access Controls: Enforce role separation, least privilege, and traceability

1.9 Maintenance and Sustainment Services

1.9.1 Emergency support response: 2-hour phone triage; on-site within 4 hours

1.9.2 Preventive maintenance inspections: Biannual at minimum, with firmware and patch updates included

1.9.3 AMAG certification required for PACS components; minimum 4 years’ experience with enterprise installations

1.9.4 Biannual updates of software incorporating ISC changes within 2 weeks of issuance

1.10 System Integration and Interoperability

1.10.1 Support for integration with existing DOI/BOR/NPS/USGS PACS, CCTV, IDS

1.10.2 GIS overlay and asset map capability (ArcGIS preferred)

1.10.3 Common alerting interface (EDXL-DE/TEP/RM compliant)

1.11 Deliverables

1.11.1 ISRMS

1.11.2 System Design Document (SDD)

1.11.3 Cybersecurity Plan aligned with NIST RMF

1.11.4 Implementation Plan with WBS and Gantt Chart

1.11.5 Final Acceptance Test Plan and Validation Protocol

1.11.6 As-built Documentation in PDF and native CAD

1.11.7 Warranty Certificates (minimum 1 year parts/labor)

1.11.8 Training Plan with job aids, manuals, and support materials 1.11.9

1.11.10 Section 508 Compliance Checklist (signed)

1.12 Period of Performance

1.12.1 Base Year: 12 months from Notice to Proceed

1.12.2 Options: Four (4) 12-month option periods for licensing, hosting, support, and sustainment

1.13 Inspection and Acceptance Criteria

1.13.1 Progress inspections per COR scheduling

1.13.2 Final Acceptance: 100% functionality confirmed by technical lead and COR;

1.13.3 includes security system tests, training verification, and document submission

1.13.4 QASP: Performance-based surveillance with penalties for missed delivery timelines, defective installs, or unverified configurations

1.14 Contractor Qualifications

1.14.1 Must possess at least 4 years of experience supporting federal agency security systems

1.14.2 Licensed under applicable state security laws (e.g., VA DCJS)

1.14.3 Employ personnel with AMAG or equivalent certifications for access control integration

1.14.4 Demonstrated record of compliance with Section 508, NIST 800-53, and ISC RMP

1.15 Security and Clearance Requirements

1.15.1 Background checks under HSPD-12

1.15.2 All on-site personnel must hold valid PIV credentials

1.15.3 Classified access not required; system must comply with CUI/NIST 800-171 for moderate impact level

1.16 References and Compliance Standards

1.16.1 FAR Parts 1–53, Titles 40 & 41

1.16.2 FIPS 140-3, FIPS 199/200, NIST SP 800-53 Rev. 5, SP 800-116 Rev. 1

1.16.3 ISC Policies and Standards

1.16.4 USGS Acquisition Operating Procedures (2025)

1.16.5

1.16.6 Section 508 Accessibility Checklist (2023)

1.16.7 MIST: DHS/FPS PIA-023; GAO-22-104649

1.16.8 SMS/CM: AR 190-13, FM 3-39.30, ATTP 3-39.32

1.16.9 NDAA, FISMA & FedRAMP Guidelines

2. Quantities Base Requirement

Optional Requirement for increased customization Minimum Quantity Purchase

1. Provide a Cost breakdown/fee structure – baseline costs and fees such as the below.

a. Initial purchase costs, annual costs for customized reports, troubleshooting/customer support, updates, maintenance, etc.?

b. Are these per user, assessment, and/or site?

c. Will you please delineate the frequency of each fee (one time initially, once each occurrence, annually, monthly, etc.) ?

d. Any discounts? Group/bulk, number of users, duration of usage, etc.

e. Do you require lease/contract for a set minimum time?

2. Here is an example table to help with this request

One time

training is 6 hours per ISRMS User, 3 hours for signatories, 16 hours for Administrative Users

Customer Support

Annually

Updates and Maintenance

Discount 1

Discount 2 etc

2.1 ISRMS Program-Level License Maintenance

The Contractor shall provide cost information for the period of performance, as stated in this solicitation, of ISRMS Program-Level License Maintenance. This CLIN shall provide license maintenance for the ISRMS product in accordance with the work described in this SOW and the license maintenance shall directly relate to the level of licensing provided for each of the phases.

Contractor licensing will include the price for licensing or maintenance of the ISRMS software, Operating System licenses, and any other annual fees.

General CONTRACT REQUIREMENTS

Program Manager

3.1.1 The Contractor will provide a program manager who will be responsible for the performance of all work. The name of this person, and an alternate or alternates, who will act for the Contractor when the manager is absent, will be designated in writing to the contracting officer (CO).

3.1.2 The program manager or alternate will have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

3.1.3 The program manager or alternate will be available during normal duty hours within thirty (30) minutes to meet by phone or at the facility with government personnel (designated by the CO) to discuss problem areas. After normal duty hours, the manager or alternate will be available within two (2) hours.

3.1.4 The program manager will provide an emergency phone/cell phone to the COR and CO.

3.1.5 The program manager and alternate or alternates will be able to read, write, speak, and understand English.

3.1.6 The program manager will be responsible for ensuring that all quality control objectives for the project are met; as well as being responsible for project management methodology; facilitating meetings and providing meeting minutes; developing of deployment schedule; coordination of resources (federal and contractor); development of risk mitigation plans.

Contractor Personnel Identification

3.2.1 The Contractor will, when communicating with outside parties, DOI personnel, and other DOI contractors, advise that they are Agency Contractors to ensure they are not mistaken as Government employees.

3.2.2 Contractor employees will identify themselves as an Agency Contractor in all documents (e.g., reports, correspondence, etc.) which the employees are listed as the Point of Contact.

Email messages from contractor employees will contain a signature block identifying the individual as a contractor employee with the firm’s name with a reference to being a DOI Agency Contractor.

3.2.3 The Contractor will display on their person an identification badge that clearly indicates that he/she is a DOI Contractor when on-site and when off-site if their “attendance” is related to providing services under this contract.

Contractor Work Force Responsibility

It will be the full responsibility of the Contractor to organize, furnish, maintain, supervise, and direct a workforce, which, within the limitations of the provisions of this contract, is thoroughly capable of effectively performing the work set forth in this contract.

Transfer and Exchange of Contractor Personnel

Replacement of any of the proposed workforce will be with individuals with comparable experience and skills. Resumes of replacement personnel will be provided to the COR and CO for review in sufficient time to satisfactorily submit to and clear the pre-employment high risk background investigation process, which typically requires at least six (6) weeks from when the required information is supplied by the Contractor to the DOI Office of Security. Shorter periods of time may be permitted for positions that are not deemed “High Risk” or for which the CO sends approval in writing to the Contractor. From date of initial background check through receipt of a PIV Card, it typically takes an average of sixty (60) calendar days for the onboarding process.

Quality Control Plan

3.5.1 The contractor will develop and maintain an effective quality control program (QCP) to ensure all services are performed in accordance with this SOW and its orders along with an approved Program Management Plan (PMP). The contractor will develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s quality control program is how compliance with the requirement of the contract will be managed.

3.5.2 A quality control plan and PMP will be submitted to the CO and the COR for review and approval within thirty calendar (30) days of notice of award of the contract. The CO will notify the Contractor of acceptance or required modifications to the plan within fourteen (14) days. The Contractor will make appropriate modifications and obtain acceptance of the plan within ten (10) days of receipt of comments. The QCP plan will include:

3.5.1.1 A description of the inspection system to cover all proposed services. The description will include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of the inspectors.

3.5.1.2 A description of the methods to be used for identifying and preventing defects in the quality of service performed.

3.5.1.3 A description of the records to be kept to document inspections and corrective or preventive actions taken.

3.5.1.4 The records of inspections will be kept by the Contractor and made available to the CO, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims under this contract.

Quality Assurance

According to the FAR 52.212-4(a), the Government will evaluate the Contractor’s performance under this contract. A Performance Requirements Summary (PRS) and Quality Assurance Surveillance Plan (QASP) will be provided. Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR will require the contract manager or representative at the site to initial the observation. The initialing of the observation does not necessarily constitute concurrence with the observation, only acknowledgement that he or she has been made aware of the defective performance. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the CO as a result of surveillance will be in accordance with the terms of this contract.

Performance Evaluation Meetings.

The CO may require the program manager to meet with the CO, COR, and other government personnel as deemed necessary. The contractor may request a meeting with the CO when he or she believes such a meeting is necessary. Written minutes of any such meeting will be prepared by the Contractor within two (2) calendar days of the meeting. The meeting minutes will provide a summarized transcripts from the meeting, participate list, discussion points, decisions, and any pertinent action items as a result of the meeting. The program manager, COR, and CO will sign those minutes. If either party does not concur with any portion of the minutes, such non-concurrence will be provided to the CO within seven (7) calendar days following receipt of the minutes.

Other Meetings

For all other meetings, the contractor will be responsible for providing, as needed, meeting materials and other administrative support. If meetings are necessary, they will be conducted primarily virtually or through teleconference or as agreed to by both the parties. If needed, some examples of potential meetings that could be required on a Task Order are as follows:

· Kickoff Meeting When requested, the order will specify when this will occur. Typically, this is needed within thirty (30) days of award of the order. Details regarding preparation of the meeting will be provided on, as needed basis.

· Monthly Project Status Reviews Meetings will discuss their monthly progress report and will occur approximately every thirty (30) days after award of the order, or as agreed to by the parties. The Contractor is responsible for reporting the previous month’s activities (including any risks, issues, or concerns, and actual or recommended actions for their mitigation), and projected activities for the following month. The Government will provide feedback regarding this progress and performance.

Monthly Progress Reports

Until six months after the software is fully implemented, monthly progress reports will capture items such as, but not limited to, description of the issues, performance issues, usage metrics, system updates, system downtimes and associated causes, status of potential replacements of key personnel (if any), outstanding government issues/concerns/data requests, helpdesk reports with metrics, and document any outstanding issues from the Contractor.

The first report will include a detailed work outline of the project by reporting period to include updates on all outstanding tasks. This report will be submitted electronically in MS Word compatible to the COR via email. A separate Monthly Progress Report will be provided for each Task Order.

Invoices

3.10.3 Invoices will be submitted monthly, as agreed to with the COR, or as stated in a task order.

Government Point of Contact for Quality Assurance.

The COR is the Government’s Point of Contact. If a separate COR is designated on a Task Order, a separate letter will be provided to the Contractor indicating that individual’s authority.

Hours of Operation, Holidays, and Closures

3.12.1 The Government’s hours of operation are typically from 8:00 AM to 4:30 PM Eastern, Monday through Friday, except for legal holidays in regards to meeting with the COR. The Contractor’s system and helpdesk support must be available 24 hours a day, 7 days a week, 365 days a year once the system is deployed.

3.12.2 Official Federal Holidays

A list of official Federal Holidays are listed below:

New Year’s Day Martin Luther King, Jr.’s Birthday Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

Visit the official website for specific dates of these holidays at: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/ Additional days may be designated by Federal law, Executive Order, or Presidential Proclamation.

3.12.3 If the Government is shut down, information will be provided to the Contractor with appropriate instructions related to their performance during this time period. If necessary, a change order modification may be issued related to potential decreases in the effort from the Contractor.

Weapons, Firearms, and Ammunition

Contractor employees are prohibited from possessing weapons, firearms or ammunition, on themselves or within their contractor-owned vehicle or privately owned vehicle while on Government property.

Government Furnished Equipment

Government furnished equipment is not anticipated for this requirement.

Security

3.15.1 Computers and Information Technology Systems.

3.15.1.1 For contractor employees which receive a PIV card, the investigative requirements are typically public trust or moderate in order to have access to DOI IT Systems and Network. The COR on the order will coordinate with the contractor regarding whether the work will necessitate public trust or moderate investigation.

3.15.1.2 Contractor personnel will have access to sensitive information and federal information technology systems. Contractor personnel must take due care in safeguarding information and the integrity of IT systems. Contractor personnel working on the DOI network must take and pass an online IT security awareness course. Access information to this website will be provided by the COR after award of the Task Order. Evidence of completion of the course will be provided to the COR within one (1) week after starting work.

3.15.2 Safeguarding the Network

3.15.2.1 The contractor and its subcontractors which are providing Information Technology (IT) services to the DOI agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the DOI network or operated by the Contractor and other external organizations for the DOI, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to DOI sensitive information that directly support the mission of the DOI. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by Office of Management and Budget (OMB) Circular A-130.

3.15.2.2 The contractor and its subcontractors will be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor will also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

3.15.2.3 The contractor and its subcontractors will not publish or disclose in any manner, without the DOI Contracting Officer’s written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the DOI and any contractors and other external organizations will be entered into before DOI data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The contractor and other external organizations will agree to establish and follow security precautions considered by the DOI to be necessary to ensure proper handling of data and information. As may be identified elsewhere in this contract, the Contractor agrees that:

· The draft and final deliverables and all associated working papers and other materials deemed relevant by the COR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COR at the conclusion of the tasks.

· All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor.

· To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor’s or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of DOI information. Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

3.15.2.4 If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organization, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party. The Contractor will Immediately report any suspected or confirmed loss of privacy data or other sensitive information, or any suspected computer security incidents to DOI Computer Incidents Response Center (CIRC) (doicirc@ios.doi.gov) and your Contract Office Representative (COR).

3.15.2.5 The Contractor will insert these clauses in all subcontracts when the subcontractor is required to have routine physical access to a Federally controlled facility and/or routine access to a Federally controlled information system. Failure to comply with said requirements will constitute cause for termination.

3.15.3 Acquiring External IT Services (Processing, Storing, or Transmitting DOI Data on Non-DOI Systems

3.15.3.1 The Contractor or other external organizations will develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by DOI with significant replacement cost will the Contractor’s and other external organization’s copy be corrupted. This plan will describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan will describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan will be compliant with applicable Federal laws that include, but are not limited to: (e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan will meet IT security requirements in accordance with Federal and FS policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

3.15.3.2 Security Banners.

The Contractor and other external organizations will ensure that the appropriate security banners are displayed on all DOI systems (both public and private) operated by the contractors and other external organizations prior to allowing anyone access to the system.

3.15.4 Non-US Citizens: Additionally, there are security concerns with access to the DOI network, DOI systems, and DOI facilities for any individual that does not possess a I-551 Permanent Resident Card (Green Card). Though an individual may have a right to work in the country, they may not meet this contract’s security requirements if they do not possess an I-551. In order to avoid potential concerns, the contractor will consult the government regarding any non-us citizen that does not possess an I-551 before working on this contract in any capacity.

3.15.5 Acquiring and/or implementing Software Applications, when applicable At least one week prior to delivery of any code due under this contract, Contractor will deliver to the COR the following reports covering all code that will be delivered:

3.15.5.1. Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of DOI. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

3.15.5.2 For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of DOI. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

3.15.5.3 . For all applications: Release notes and updated user documentation.

Privacy Act

3.16.1 The contractor is responsible for complying with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

3.16.1.1 The systems of records; and

3.16.1.2 The design, development, or operation work that the contractor is to perform.

3.16.2 The contractor will include the Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

3.16.3 Include this requirement, including this paragraph (3), in all subcontracts awarded under this contract that requires the design, development, or operation of such a system of records.

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

3.16.4 Definitions of the clause:

3.16.4.1 “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

3.16.4.2 “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

3.16.4.3 “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

3.16.5 Security Banner.

The contractors and other external organizations will ensure that the following banner is displayed on all DOI systems that contain Privacy Act information operated by the contractors and other external organizations prior to allowing anyone access to the system:

“This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

Government-Contractor Relations (Non-Personal Services)

3.18.1 The Government and Contractor understand and agree that the services to be delivered under this contract are non-personal services as defined in the Federal Acquisition Regulations Part 37.101. No employer-employee relationship exists or will exist under this contract between the Government and the Contractor’s personnel.

3.18.2 Contractor personnel under this contract must not be placed in a position where they are under relatively continuous supervision and control of a government employee.

3.18.3 Employee relationship. The rules, regulations, directives, and requirements that are issued by DOI under its responsibility for good order, administration, and security are applicable to all personal who enter the Government installation or who travel using Government transportation. This is not to be construed or interpreted to establish any degree or Government control that is inconsistent with a non-personal services contract.

3.18.4 Inapplicability of employee benefits. This contract does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

3.18.5 Notice. The Contractor must notify the CO in writing promptly, within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this requirement. The notice should include the date, nature and circumstance of the conduct; the name function and activity of each Government employee, or Contractor official or employee, involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the estimate in time by which the Government will respond to the notice to minimize cost, delay, or disruption of performance.

Inherently Governmental Functions

The contractor must not perform any functions that are considered Inherently Governmental Functions (see FAR 7.503). If at any time the services being provided appear to be inherently governmental in nature, the contractor will contact the CO and COR regarding the work so that appropriate decisions can be made in how to resolve the problem. Within 21 calendar days of award of the task order, the contractor will ensure the staff has been informed about inherently governmental functions. Some examples on inherently functions are the following:

3.19.1 The direct conduct of criminal investigations.

3.19.2 The determination of agency policy, such as determining the content and application of regulations, among other things.

3.19.2 The determination of Federal program priorities for budget requests

3.19.3 The direction and control of Federal employees

3.19.4 The selection or non-selection of individual Federal Government employment, including the interviewing of individual for employment.

3.19.5 The approval of position description and performance standards for Federal employees.

3.19.6 The determination of what Government property is to be disposed of and on what terms.

3.19.7 In Federal Procurement activities with respect to prime contractor (1) Determining what supplies or services are to be acquired by government; (2) Participating as a voting member on any source selection board; (3) Approving any contractual documents defining requirements, incentive plans, and evaluation criteria; awarding contracts; administrating contracts (including change ordering changes in contract performance or contract quantities; taking action based on the evaluation of contractor performance, and accepting or rejecting contractor productions or services); (4) Terminating contracts; (5) Determining whether contract cost are reasonable, allocable, and allowable; and (6) Participating as a voting member on performance evaluation boards.

3.19.8 The approval of agency responses to Freedom of Information Act (FOIA) requests and the approval of agency responses to administrative appeals of denials of FOIA request.

3.19.9 The determination of budget policy, guidance, strategy.

3.19.10 The drafting of Congressional testimony, responses to Congressional correspondence, or agency responses to audit reports from the Inspector General, the Government Accountability Office, or other Federal Audit entity.

Confidential Information

3.20.1 The term “information”, as defined herein, includes, but is not limited to, oral or written communication, planning documents, strategy, research documents, data, conclusions, field notes, computer files, designs, equipment, photographic or video media, or conversations related to any work performed for DOI. The term “information” also includes internal Government memoranda, draft and final documents, procurement sensitive information including information on other contractors, cost or pricing information, financial information, as well as information marked “Confidential Business Information” or information not specifically marked, but falling within the meaning of “Confidential Business Information,” and “Attorney-Client Work Products.”

3.20.2 Any information viewed, received, obtained, developed or generated pursuant to the work assigned or work performed with DOI is sensitive and may be used as a basis for identifying and evaluating policy options, planning future budget and work priorities, or ongoing or future litigation. Some information may carry additional sensitivities and restrictions relative to use or disclosure including “Confidential Business Information” and “Proprietary Information.”

3.20.3 The Contractor must keep any such information confidential and to otherwise use discretion and exercise reasonable care and caution to prevent the potential compromise of any restrictive markings or ongoing or future plans or litigation. The Contractor must not use, make reference to or reveal to any person or entity not working under the direction of DOI, any information, whether that information is provided to the Contractor by DOI, provided to the Contractor by another party at DOI direction, or developed or generated by the Contractor pursuant to a work assignment, without the prior written approval of the CO or COR.

3.20.4 After 90 calendar days of completion the Task Order, the Contractor must deliver to DOI any original or copied information furnished by DOI or from another party, (at DOI’s direction) and any information developed or generated under this Task Order.

Travel

Travel is not anticipated for this requirement.

4.0 Task Areas

As stated in Section 1.1, the contractor will be required to provide a new system as well as support services for that new system to ensure that DOI OLES can meet its mission requirements. The contractor, operating as an independent contractor and not as an agent of the Government, will be responsible to provide all labor, tools, materials, facilities, equipment, supervision, and other items necessary (unless specifically stated elsewhere in this document or in the specific order). The contractor may be required to perform work under multiple orders. Examples of the anticipated work to be completed are as follows:

4.1 Task Area 1: Implementation, Installation, Transition of Old Database Records The contractor will provide all licenses, resources, and support to stand-up\provision the solution in a FedRAMP approved moderate Cloud production, development, and training environment including, but not limited to:

· Assist in the transition of legacy system(s)

· Identify the data, format

· Determine technical, time, and financial requirements

· Devise and execute a data migration plan

· Test the system after each phase of migration

· Submit an ISRMS implementation plan within 60 days of award

· Explain the strategy for going live with production data and DOI users

· List the timeline and steps involved

· Resources required

The Government anticipates that the new system will take twelve months or less to deploy. The final deployment schedule will be agreed to by the Government and the Contractor. Upon confirmation that the system is ready to accept the DOI PIV for authentication and is ready for use, the Contractor will coordinate with the COR on the method of communication and the approach to begin the transition and migration of accounts with the DOI end users.

4.2 Task Area 2: Hosting with Application and Data Management Services In adherence to the Executive Order on Improving the Nation's Cybersecurity, the contractor is required to provide a cloud solution that is Federal Risk and Authorization Management Program (FedRAMP) approved. Our primary preference is for a Software-as-a-Service (SaaS) solution that meets the Federal Information Security Management Act (FISMA) moderate level requirements. A SaaS solution, to qualify under this contract, must have FedRAMP Moderate Hosting approval covering all critical layers including networking, storage, servers, virtualization, middleware, runtime, data, and applications. If a vendor offers a Platform-as-a-Service (PaaS) solution, it must be FedRAMP Moderate Hosting approved for networking, storage, servers, virtualization, middleware, and runtime layers. Additionally, if this PaaS solution is complemented with comprehensive data and application management support services, it will be considered on par with a SaaS solution for the purposes of this contract. This flexibility is extended due to the limited availability of FedRAMP approved SaaS solutions in the market.

All Cloud Service Providers (CSP) must adhere to Federal Risk and Authorization Management Program (FedRAMP) Moderate standards. For any CSPs that are hosted in a FedRAMP-certified environment that is certified up to “high,” the contractor must configure the system for compliance with FedRAMP Moderate hosting specifications.

The Contractor will provide an application and data management of FedRAMP Moderate approval level. The Government may agree to accept an in process or equivalent status, if they are not currently approved in FedRAMP. The contractor must provide a copy of the equivalent information required, which will allow the Department to authorize and continually monitor.

All Moderate FedRAMP equivalent activities and artifacts must be maintained in the DOI Governance, Risk and Compliance (GRC) tool including the signed waiver.

A Web-based browser access is preferred utilizing a multifactor authentication Personal Identification Verification (PIV) in order to meet the National Institute of Standards and Technology (NIST) as a result of the Cybersecurity Strategy and Implementation Plan (CSIP) published by the Office of Management of Budget titled “Best Practices for Privileged User PIV Authentication.” If the solution is not browser based, the solution must demonstrate an equivalent solution which allows for minimal manual installation and upgrades of client field devices for both desktop and mobile based clients (including connected and non-connected).

Per NIST 800-53 DOI Revision (see Appendix F), the solution must provide:

· Automated mechanisms to notify appropriate users of…