Draft DOVE 4.0 - PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

Volunteer Delivery System

FOR

Office of Chief Information Officer

1.0 GENERAL

1.1 BACKGROUND

On March 1, 1961, President John F. Kennedy established the United States Peace Corps to promote world peace and friendship. Peace Corps' mission has three goals:

● Helping people of interested countries in meeting their needs for trained men and women.

● Helping promote a better understanding of Americans on the part of the peoples served.

● Helping promote a better understanding of other peoples on the part of Americans.

1.1.1 Volunteer Participation

Prior to the COVID pandemic, Peace Corps had nearly 7,000 Volunteers in 60 host countries.

Currently, Peace Corps has over 2,400 Volunteers working with local communities in over 50 host countries (Posts) in six sectors: agriculture, community economic development, education, environment, health and youth in development. The vast majority of Volunteers serve for a term of two years in the Peace Corps Volunteer (PCV) program. A smaller number of Volunteers serve in shorter 3–12-month assignments which require more advanced skills in the Peace Corps Response (PCR) program. In 2020, Peace Corps introduced a virtual service pilot for Americans to virtually support host country partners with community-level projects.

Each year thousands of Americans apply to become Peace Corps Volunteers. The chart below (Figure 1) shows the total applications received over the past six fiscal years. The second chart (Figure 2) represents the number of candidates who apply as volunteers compared to the number who actually serve. Numerous factors, including final medical and legal clearances, impact a candidate’s ability to depart for service once invited.

Figure 1 - Number of applications received for Peace Corps service for fiscal years 2014 to 2019 (pre-pandemic).

Figure 2 - Approximate number of candidates in the Peace Corps system using 2019 data.

Approximately half of the Volunteers cycle in or out of service each year.

For more information on the Peace Corps mandate and mission, see Peace Corps’ website:

https://www.peacecorps.gov/about/.

1.1.2 The Volunteer Delivery System (VDS)

The Volunteer Delivery System (VDS) consists of the agency’s core business processes and supporting technology that enable the Peace Corps to fill requests of host countries with suitable Volunteers from the number who apply. The VDS supports both the PCV and PCR programs.

For both programs, the VDS begins with the formulation of project frameworks specific to each host country that define the skills and number of Volunteers that need to be successfully recruited and placed by the Peace Corps for varying lengths of service. The VDS ends when the Volunteer departs for their country of service. The VDS is a true production environment with production quotas (a specific number of Volunteers for specific volunteer jobs is requested and

10000

15000

20000

25000

30000

Number of Applications

2014 2015 2016 2017 2018 2019 https://www.peacecorps.gov/about/ delivered by established deadlines for varying lengths of service). It is a human resource processing system through which involved offices must work interactively.

The VDS needs technology to support those business processes that process candidates from the time they apply until they begin their service overseas. The current VDS process is outlined in Table 1 below.

Table 1- Current VDS Process Components

VDS Component Staff Interfaces

GENERATE DEMAND: Overseas staff create jobs that are posted on the Peace Corps website. Leads are generated and managed.

● Office Based Recruiters

● Field Based Recruiters

● Public Affairs Specialists

● Peace Corps Response (PCR) Recruiters

● PCrm Recruitment (Dynamics CRM)

● Peace Corps website

APPLY: Candidates for Volunteer service apply through a web-based form. After they complete the application, candidates are directed to complete a Health History Form (HHF) (hosted by Peace Corps in MAXx) to capture their current medical history.

● MAXx (Peace Corps’ pre-service medical system)

EVALUATE and INVITE:

Applications are evaluated and suitable candidates are interviewed and invited to be Volunteers in a specific country and program.

● Placement Officers

● PCR Recruiters

● HireVue Coordinate

CLEARANCE: After a candidate has accepted their invitation, they are reviewed for a final legal and medical clearance.

● Medical Staff

● Legal Eligibility Staff

● MAXx

ONBOARD: After a candidate has accepted their invitation, they are directed to complete their onboarding paperwork, review training materials, and report to a pre-departure orientation event known as a ‘staging’ before boarding a plane to their country of service.

● Staging

● Country Desk

Officers

● PCR Recruiters

● LearningSpace (Peace Corps’ Learning Management System)

Some Posts are in resource-challenged environments where electricity and connectivity are unreliable. Post main offices are normally located in major cities with Volunteers placed in both urban and more isolated rural environments. Communication among HQ, remote staff, Post staff, Volunteers, and Peace Corps alumni (RPCVs) must function within this context. In addition, Peace Corps staff must work in an increasingly mobile environment, where potential candidates, Volunteers, RPCVs, and staff have the need (and high expectations) for accessing systems on a variety of devices, particularly smartphones, tablets, and laptops.

1.2 OBJECTIVE

The desired goal is the licensing and support of the Peace Corps VDS. Peace Corps requires the use of Infinite BrassRing and Infinite Onboard which are part of the Infinite Talent Acquisition Suite products from Infinite Computer Solutions.

This system supports candidates from the time when they search for Volunteer jobs/positions through filling out an application, the assessment and placement process, and finally through an onboarding process. Therefore, the Agency requires:

a. A configurable, Software as a Service (SaaS) solution.

i. Must integrate with Peace Corps existing infrastructure and several downstream financial and information systems;

ii. Must provide evidence of current compliance with Federal Risk and Authorization Management Program (FedRAMP) moderate impact information systems and the security requirements IAW section 5.2.

iii. Must provide software hosting and support services via a Service Level Agreement

(SLA).

b. Seamless transition. The solution shall enable Peace Corps to conduct a seamless and expedited transition from the current contract with ICS to the proposed contract with minimal disruption to business operations while ensuring data integrity.

c. Compliance and Best Practices. Compliance with the following federal policies, laws, and guidance is required:

i. Authentication: Single-sign on using federally-approved ID credential providers.

ii. Authorization to Operate: In accordance with FedRAMP authorization for a moderate impact system.

iii. Access for people with disabilities: Meet Section 508 standards.

1.3 SCOPE

1.3.1 Solution

The Contractor shall implement a cloud-based technology solution to support the following components:

a. Job opportunities presentation layer: Mobile and web-enabled module that allows Peace Corps staff to create jobs, vet them through an approval process, and use an Application Programming Interface (API) to post them to the Peace Corps website.

b. Online application portal: Mobile and web-enabled platform that allows individuals to complete an application, attach supporting documentation, and track their progress using a single log in for the entire candidate experience. This portal should integrate with www.peacecorps.gov (which is maintained internally by Peace Corps staff) and be consistent with the design for peacecorps.gov.

c. Candidate Workflow and Assessment: Back-end admin module with lifecycle workflow processing to track candidates’ personal data and qualifications, search for qualified candidates based on certain criteria, score candidates based on various assessment tools used throughout the process, and communicate with candidates and other external users (references). Support multiple workflows based on volunteer type.

d. Analytics and Reporting: Dashboards that track progress toward goals by predetermined criteria (sector/skill category, country, availability date, qualification summary, time in application process, number of applicants from various schools, etc.); data import/export capabilities.

e. Candidate Onboarding: Ability for candidates to use a candidate portal to complete required documentation (insurance forms, releases, financial etc.) and receive content specific to their volunteer position.

f. Integrations and APIs: Ability to transfer data in format(s) determined by Peace Corps staff between the vendor-provided system and systems inside and outside of Peace Corps (e.g., send an update regarding a candidate’s medical clearance status from MAXx to the candidate’s record in vendor-provided system). Support inbound and outbound integrations.

1.3.2 Transition Management

The Contractor will support transition activities including establishing connections and data flows with related systems, transitioning data from the current VDS system, and training staff to use the new solution.

1.3.3 Period of Performance

The period of performance for this contract is a base period of one year and four additional optional periods of one year each. The total period of performance if all optional periods are exercised will be five years.

2.0 PERFORMANCE REQUIREMENTS

2.1 VDS SOLUTION

The Contractor shall design, host, license and support the Volunteer Delivery System (VDS) solution according to the Peace Corps requirements, specifications, and business guidelines herein.

2.1.1 The Contractor shall host and support the proposed VDS solution that supports the application, processing, and onboarding processes associated to selecting volunteers.

The Contractor shall manage, support, and provide technical project management and oversight testing through deployment of any updates or changes to the product.

2.1.2 The VDS solution implementation shall include the design and implementation of interfaces with 1) Biztalk 2) employee data from the Peace Corps HR directory/system (e.g., Active Directory/Azure); and the 3) agency’s website. Any hosted SaaS or portal solution shall integrate with Peace Corps’ existing Active Directory/Azure, multifactor authentication, single sign-on and identity management infrastructure for staff. The VDS solution will utilize GSA login.gov services for authentication for volunteer candidates.

2.1.3 The contractor shall comply with Peace Corps “Information Security Program Requirements” Policy (see attachment Appendix A) and section 5.2 “Cloud Information Systems – IT Security and Privacy Requirements.”

2.1.3.1 The Contractor shall comply with the Federal Information Processing Standards (FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of the Federal Information Security Modernization Act (FISMA)

2.1.4 The Contractor shall provide a VDS solution capable of supporting the migration of existing Peace Corps’ candidate data into the new volunteer delivery software.

2.1.5 The Contractor shall provide recommendations for: 1) re-engineering existing Agency business processes to take advantage of the software’s features and capabilities and 2) best-practice workflows to support volunteer delivery management.

2.1.6 The Contractor shall provide support resources to assist with support and maintenance of all functions within the VDS solution.

2.1.7 The Contractor shall provide software license(s) and provide annual software and hardware support for the VDS solution. Contractor must provide a detailed Service Level Agreement (SLA) (i.e., Maintenance and Support Agreement) as part of its technical quote. Issue resolution shall be in accordance with the stated SLA timeframes during Contract performance.

2.1.7.1 The Contractor shall provide technical support and maintenance services that include monitoring of reported issues, classification of issues, triaging of issues with request/problem tracking through to resolution, and general helpdesk assistance for the life of the contract.

2.1.7.2 The software license shall include all fixes, patches, and updates. The contractor shall provide Peace Corps implementation team the ability to implement fixes, patches, and product updates to the system.

2.2 QUALITY MANAGEMENT

2.2.1 The Contractor shall provide support resources during the migration and go-live to track and resolve any implementation issues and problems. Support resources will be available to assist with support and maintenance of all functions within VDS solution.

2.2.2 The Contractor shall participate in biweekly meetings throughout this project to review the project schedule and discuss any issues requiring resolution.

2.2.3 The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this SOW.

2.2.4 The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

2.2.5 The Contractor shall meet physical and information security safeguard standards.

2.2.6 The Contractor shall make available upon request of the CO or COR, a record of inspections. The records must be kept and made available to Peace Corps, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

2.2.7 Any problems or concerns regarding quality assurance should be outlined in writing to the COR. The COR will discuss any issues with the Contractor. Records of all inspections conducted by the Contractor and corrective action taken shall be made available to Peace Corps upon request.

2.3 DESIGN AND IMPLEMENTATION SERVICES

2.3.1 The Contractor shall ensure that the VDS solution meets the functional and non-functional requirements listed in Attachment 2.

2.3.2 The Contractor shall conduct a GAP Analysis to identify deficient or missing functionality.

2.3.3 The Contractor shall complete system service layer allowing inbound and outbound integrations for 1) Biztalk 2) employee data from the Peace Corps HR directory/system (e.g. Active Directory/Azure), 3) Peace Corps’ website (jobs), and 4) other hosted solutions (e.g. lead generation, event management software, and HireVue’s Coordinate product). The integrations between the VDS solution and the Peace Corps’ existing systems must be bi-directional. The Peace Corps currently manages all inbound and outbound integrations using Microsoft BizTalk 2020 with the Enterprise Service Bus (ESB) toolkit installed. The number of integrations will depend on the design of the new solution.

2.3.4 The contractor shall coordinate tasks for implementation, including scheduling logistics, as outlined in the Contractor Project Management Plan (CPMP).

2.4 ACCEPTANCE

2.4.1 The Contractor shall ensure that the VDS solution works as designed in the test and production environments.

2.4.2 The contractor shall lead planning meetings with the Peace Corps development teams.

2.4.3 The contractor shall coordinate and perform full VDS solution test in Test and Production Environments.

2.4.4 The Contractor shall coordinate and manage tasks for User Acceptance Testing (UAT), including scheduling logistics via the CPMP. This includes coordinating with Peace Corps Subject Matter Experts to develop scenarios for test acceptance criteria.

2.4.5 The Volunteer Delivery System must successfully pass user acceptance testing with no more than 10% flaws and 0% critical flaws. Contractor shall resolve any flaws/issues discovered during UAT within 30 calendar days. The following definitions apply:

• Flaw: An error in the software that with a workaround allows the user to function normally.

• Critical Flaw: An error in the software (with or without a workaround) that does not allow the user to function normally or the software does not function as designed.

2.4.6 The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS.

2.1.7.1 The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

2.1.7.2 The Contractor shall meet physical and information security safeguard standards.

2.1.7.3 The Contractor shall make available upon request of the CO or COR, a record of inspections. The records must be kept and made available to the Peace Corps, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

2.1.7.4 Any problems or concerns regarding quality assurance should be outlined in writing to the COR. The COR will discuss any issues with the Contractor.

Records of all inspections conducted by the Contractor and corrective action taken shall be made available to the Peace Corps upon request.

2.1.8 The Contractor shall be responsible for all travel costs associated with travel to Peace Corps headquarters in Washington, DC.

2.5 ENGINEERING SERVICES/TECHNICAL INSTRUCTIONS

The Contractor shall provide new features and functionality within the scope of maintaining the VDS solution as requested by the Peace Corps through written technical instructions (TIs) approved and signed by the COR specified in this contract. The Contractor will execute tasks specified by TIs that may include, but is not limited to, analysis and implementation of additional and/or new VDS related features and functions. The COR will ensure that TIs they fall within the scope and funding of the contract.

2.5.1 As used herein, TIs are defined to include the following:

(1) Directions to the Contractor which suggest pursuit of certain lines of inquiry, shift work emphasis, fill in details or otherwise serve to accomplish the contractual requirements for Engineering Services.

(2) Guidelines to the Contractor which assist in the interpretation of specifications or technical portions of work description.

2.5.2 TIs must be within the general scope of work stated in the contract. TIs may not be used to:

(1) assign additional work under the contract;

(2) direct a change as defined in the "CHANGES" subsection of clause FAR 52.212-4;

(3) increase or decrease the contract price or estimated contract amount (including fee), as applicable, the level of effort, or the time required for contract performance ; or

(4) change any of the terms, conditions or specifications of the contract.

2.5.3 If, in the opinion of the Contractor, any TI calls for effort outside the scope of the contract or is inconsistent with this requirement, the Contractor shall notify the CO in writing within ten (10) working days after the receipt of any such instruction. The Contractor shall not proceed with the work affected by the TI unless and until the Contractor is notified by the CO that the TI is within the scope of this contract.

2.5.4 Nothing in the foregoing paragraph shall be construed to excuse the Contractor from performing that portion of the contractual work statement which is not affected by the disputed TI.

2.5.5 The Contractor shall inform the COR, in writing, when 75% of the hours allotted to a particular TI have been expended. Expenditures for a TI shall not exceed the allotted amount. The approval for TIs is contingent upon the availability of funds.

2.5.6 The Contractor must propose its best approach for supporting engineering efforts in response to TIs in response to this PWS.

2.5.7 The engineering services shall be performed within the limits, if any, as to place(s) and period(s) specified as authorized by the COR via the TI.

2.5.8 The maximum liability of the Government for each engineering services line item shall not exceed the amount set forth in the Schedule, or the amount obligated, whichever is less. If, at any time, the Contractor has reason to believe that the amounts it expects to incur in the performance of each engineering services line item in the next succeeding sixty (60) days, when added to all amounts previously incurred, will exceed seventy-five percent (75%) of the amount set forth in the Schedule; or if, at any time, the Contractor has reason to believe that the full performance of each engineering services requirement will be greater than or less than that set forth in the Schedule, the Contractor shall notify the Contracting Officer (CO) in writing, giving its revised estimate of the performance of said item. The Contractor shall not exceed the obligated amount for each engineering services line item, unless and until such amount has been increased in writing by the CO.

2.5.9 In the event the Government does not designate time(s) and place(s) sufficient for performance of the total quantity of engineering services line items set forth in the Schedule within the period(s) provided therefor, those services/deliveries not furnished shall be deemed to be terminated for the convenience of the Government at no cost to the Government. Such termination shall be evidenced by a written document signed by the Contracting Officer and mailed or otherwise furnished to the contractor.

2.5.10 Engineering support services may be required for the following areas:

2.5.10.1 Contractor may be asked to create a presentation layer that is above and beyond existing functionality to include a single portal for all components of the candidate experience from application through onboarding.

2.5.10.2 Contractor might be asked to develop unique reports that are not met by standard reporting.

2.5.10.3 Contractor might be asked to create integrations with systems outside of the mandatory requirements, which may include the creation of APIs or other methods.

2.5.10.4 Contractor may be requested to extract all Peace Corps related data in agreed upon specified formats to migrate at any time during the period of performance.

2.5.11 Engineering services line items shall not exceed the Not to Exceed (NTE) amount identified in each Technical Instruction (TI). Any revision or increase to the NTE within the TI must be issued with a formal modification to the contract by the Contracting Officer.

2.6 TRAINING

The Contractor shall provide end-user and administrator training to support the rollout of the VDS solution and training documentation that will enable Peace Corps to train future end-users and administrators of the VDS solution. The Contractor shall provide all the training materials in a format acceptable to the Peace Corps that can be referred to after implementation (e.g., PDF manuals, online reference materials, PowerPoint presentations). The Contractor shall provide a Training Plan outlining details of training (e.g., training type, audience, length, number of participants, cost, etc.).

The training shall include the following:

2.6.1 Contractor shall conduct instructor-led System Administrator classroom training at Peace Corps HQ facility for up to 10 participants per the delivery dates identified within the

CPMP.

2.6.2 Contractor shall conduct two (2) instructor-led End-User classroom trainings for Peace Corps’ staff at the agency’s HQ facility providing instruction in using the software for up to 30 participants per the delivery dates identified within the CPMP. Staff include people involved in the selection and placement of volunteers.

2.6.3 Contractor shall develop and provide training in a format that can be accessed by Agency’s end-users, (e.g., web-based software tutorials, online reference materials, computer-based end-user training) per the delivery dates identified within the CPMP.

2.6.3.1 Training shall reflect customizations provided to Peace Corps.

2.6.3.2 Training shall reflect various training delivery methods (e.g. web-based, electronic based, print materials).

2.6.3.3 Training shall be of such format, duration, and size to be viewed by all agency locations, including Peace Corps host country offices with poor bandwidth and high latency (e.g., the ability to download any electronic training for viewing off-line).

3.0 DELIVERABLES

Table 2 - Deliverables

Item No. Deliverable Description Frequency PWS Reference Deliver to Format Due

1 VDS Software license

License for use and support of software supporting current VDS solution through the base or option period

Once per contract period

2.1 VDS Solution COR Software

license

Start of base or option period

2 Quality Control Plan

Description of vendor’s method for managing the solution

Once 2.4.6 COR Document Within 21 days of award

3 Status Report Report documenting status of TIs and past and anticipated service issues or outages

Monthly 2.1 VDS Solution and 2.2 Quality Management and

2.5 Engineering Services/

Technical Instructions

COR Work document

First Tuesday of the month

4 Training Plan Plan and schedule for implementing end-user and administrator training.

Once

5 Data Extraction Extraction of all Peace Corps related data and documents

Once 2.2.5.4 COR Various as specified in technical instructions

TBD

6 Initial Authorization

Package Checklist

Collection of security documentation required to obtain FedRAMP

Authorization

Once 5.2.1 Assessment of the System

PMO Word or PDF Document

Within 90 days of security modification award

7 FedRAMP Readiness

Assessment Review

Demonstrates the CSPs overall readiness for FedRAMP authorization

Once 5.2.2 Authorization of the System

COR Word or PDF Document

Within 120 days of security modification award

8 FedRAMP In-Process

Demonstrates the CSP is actively working toward a FedRAMP

Authorization with Peace Corps

Once 5.2.2 Authorization of the System

COR Word or PDF Document

Within 165 days of security modification award 9 FedRAMP

Authorized designation

Designation by FedRAMP Program Management Office that the

Contractor’s solution is documented for security assessment.

Once 5.2.2 Authorization of the System, COR FedRAMP Package ID

Within one year of security modification award

10 Review of continuous monitoring documentation

Documentation of security monitoring.

Includes vulnerability scans, vulnerability mitigation status, plans of action and milestones (POA&M) status, change requests and incidents.

Monthly 5.2.3 Reporting and Continuous Monitoring

COR/ISSO Collection of documents

Beginning upon security modification award.

Item No. Deliverable Description Frequency PWS Reference Deliver to Format Due

11 Personnel Security Package

Collection of documents needed for personnel background checks

As needed for personnel

5.2.4 Personnel Security

Requirements

COR Collection of documents

14 days prior to expected work

12 Privacy Threshold

Assessment

(PTA)

Document if PII is in scope or not in scope of vendor’s cloud solution.

Once 5.2.6.2 Personally Identifiable Information

COR/ISSO Word or PDF Document

Within 30 days of security modification award.

13 Privacy Impact Assessment

For PII collected, maintained or disseminated in scope of the vendor’s cloud solution.

Once 5.2.6.2 Personally Identifiable Information

COR/ISSO Agency provided template

Within 30 days of security modification award..

4.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Table 3- Performance requirements summary

Service Output Performance Objective Acceptable Quality Level (AQL) Method of Surveillance

VDS Solution VDS solution is functional at all times, except during scheduled maintenance.

VDS services are operational 98% of the time, excluding scheduled maintenance.

Monthly vendor reports of availability, observations and customer complaints

Engineering Services

All required service performed within the specified time requirements.

Contractor meets the specified time requirement 95% of the time.

Periodic surveillance by the COR or government designee and status reports

Quality control program is administered in accordance with documentation

Quality is maintained Contractor is in compliance with QCP

97% of the time

Report reviews, observations and customer complaints

Monthly Reporting

Reports are accurate Contractor provides 100% accurate reports.

Report reviews by the COR, observations and customer complaints

Reports are provided in a timely manner

Contractor provides monthly reports on time 90% of the time.

Report reviews by the COR

FedRAMP documentation (Deliverables 5, 6, 7 and 8)

Demonstrate continued progress to FedRAMP designation

Contractor provides deliverables within two weeks of the due date

Review by COR/ISSO

Service Output Performance Objective Acceptable Quality Level (AQL) Method of Surveillance

Continuous monitoring response

All discovered vulnerabilities are addressed

100% of vulnerabilities are either corrected or addressed with managed Plans of

Action and Milestones

(POA&M)

Review by the ISSO

5.0 ADDITIONAL CONTRACTOR REQUIREMENTS

5.1 KEY PERSONNEL

The Contractor shall identify staff for positions designated as “Key Personnel.” The Government deems these positions as critical to the performance of work under this contract. Any proposed substitutes for individuals occupying these positions shall possess qualifications equal to or superior to those of the key personnel being replaced. The inability of the Contractor to provide personnel with equal to or superior qualifications of the key personnel may result in termination of the contract. At a minimum, the individuals occupying the positions listed below are considered key personnel for the duration of this contract. The CO may at his/her discretion add to or subtract from this list.

Title Name:

Client Manager Insert at award

All key personnel are subject to the following requirements:

a. Replacement is subject to the prior written approval of the COR.

b. Requests for replacement shall include a detailed resume containing a description of position duties and qualifications, as well as information about the qualifications of the individual(s) proposed and any security clearance(s) held.

c. Contractor proposals to move any key personnel off the contract shall use commercially reasonable efforts to submit such proposals in writing at least thirty (30) days in advance of proposed move, and are subject to the approval of the COR, including approval of proposed replacement.

5.1.1 Client Manager Minimum Roles and Qualifications

The Client Manager shall be responsible for the overall management and coordination of this contract and shall act as the central point of contact with the Peace Corps. The Client Manager shall have full authority to act for the Contractor in the performance of the required services. The Client Manager shall be a single point of contact for the CO and the COR. During any absence of the Client Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under the Contract. The Client Manager, or a designated representative, shall meet with the COR to discuss problem areas as they occur. The Client Manager or designated representative shall respond consistent with the SLA after notification by the Peace Corps of the existence of a problem. The Client Manager must read, write, and speak English fluently and at a minimum be required to participate in periodic Project Management Reviews.

Minimum qualifications for the Client Manager position include at least five years of experience in project leadership roles involved in successfully supporting large-scale talent management systems with a user base of at least 100 persons. The individual must have extensive knowledge of talent management information applications, relevant industry standards, database management systems, and system management principles.

5.2 CLOUD INFORMATION SYSTEMS – IT SECURITY AND PRIVACY

REQUIREMENTS

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for Moderate impact systems (as defined in FIPS PUB 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for Moderate impact systems. The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 5, “Security and Privacy Controls for Federal Information Systems and Organizations”, and also includes a set of additional controls for use within systems providing cloud services to the federal government.

Peace Corps may choose to cancel the contract and terminate any outstanding orders if the contractor has its FedRAMP authorization (Joint Authorization Board [JAB] Provisional or Agency) revoked and the deficiencies are greater than agency risk tolerance thresholds.

5.2.1 Assessment of the System

The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the Assessment and Authorization (A&A) is based on the System’s FIPS PUB 199 categorization. The contractor shall create, maintain and update the following documentation in accordance with the Initial Authorization Package Checklist using FedRAMP requirements and templates, which are available at FedRAMP.gov. (See Appendix B for FedRAMP Initial Authorization Checklist.)

Information systems must be assessed by an accredited FedRAMP Third Party Assessment Organization (3PAO) initially and whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

The Government reserves the right to perform Security Assessment and Penetration Testing (of its instance). If the Government exercises this right, the contractor shall allow Government employees (or designated third parties) to conduct Security Assessment and Penetration Testing activities to include control reviews in accordance with FedRAMP requirements. Penetration https://www.fedramp.gov/ https://www.fedramp.gov/

Testing shall be supported by mutually agreed upon Rules of Engagement (RoE). Review activities include but are not limited to manual penetration testing; automated scanning of operating systems, web applications; wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

Physical Access Considerations – If the Cloud Service Provider (CSP) is operated within an Infrastructure as a Service (IaaS) that is FedRAMP authorized (e.g., AWS); physical access to the physical datacenter environment will be governed by the terms of access allowed by the underlying infrastructure provider as defined in the FedRAMP A&A authorization package.

Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor's implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require them to be remediated before a Peace Corps authorization is issued.

The contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. All critical vulnerabilities must be remediated with 7 days, high-risk vulnerabilities must be mitigated within 14 days and all moderate risk vulnerabilities must be mitigated within 45 days from the date vulnerabilities are formally identified in accordance with Peace Corps policy. The Government will determine the risk rating of vulnerabilities.

5.2.2 Authorization of the System

Peace Corps will leverage the CSP’s FedRAMP Assessment and Authorization package to document and assess the customer controls for which Peace Corps has responsibility and issue a Peace Corps ATO for the agency’s instance of the CSP’s SaaS or PaaS offering. The CSP shall work with the Peace Corps to facilitate documentation and assessment of required customer controls, as necessary.

The CSP SaaS offering shall follow the below process to achieve a FedRAMP Authorization:

a. Shall deliver within 120 days of contract award a FedRAMP Readiness Assessment Review completed by a FedRAMP 3PAO following the FedRAMP Readiness Assessment Guidelines.

a. The FedRAMP Readiness Assessment Review demonstrates the CSPs overall readiness for FedRAMP authorization and whether it has a viable path to achieve a FedRAMP authorization within one (1) year of the contract modification award.

If the CSP does not provide a FedRAMP Readiness Assessment as prescribed or the assessment demonstrates a significant gap in capabilities that will preclude achievement of a FedRAMP authorization within 1 year of the contract award, then, Peace Corps will terminate the contract.

b. Be listed as FedRAMP Ready on the FedRAMP Marketplace website within 120 days of contract award.

https://marketplace.fedramp.gov/products

c. Be listed as FedRAMP In-Process on the FedRAMP Marketplace website within 165 days of contract award.

https://marketplace.fedramp.gov/products

If requirements a-c, as defined above are met (within 5.5 months of contract award), the CSP will have one (1) year from the date of contract modification award to achieve FedRAMP authorization. During this transitional period, Peace Corps may issue an agency specific authorization (i.e., not FedRAMP) not to exceed one (1) year (to allow the CSP to achieve FedRAMP compliance).

Note: CSPs must comply with all FedRAMP Baseline Controls. Additionally, the CSP shall implement Peace Corps provided specific parameter settings as set forth in the Peace Corps Control Tailoring Workbook.

The CSP shall ensure these essential security controls are implemented and operating as intended.

Further, the CSP shall make the proposed system and security architecture of the information system available to the OCIO security team of assigned Information Security Officers (ISSOs) and Subject Matter Experts (SME) for review and approval before commencement of system build (architecture, infrastructure, and code (as applicable)) and/or the start of A&A in support of the Initial Authorization Package and Continuous Monitoring activities.

5.2.3 Reporting and Continuous Monitoring

Maintenance of the FedRAMP Authorization will be through continuous monitoring and periodic audit of the operational controls within the Contractor’s system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated in agreement with FedRAMP guidelines and submitted to the repository designated by the FedRAMP program.

The submitted deliverables provide a current understanding of the security state and risk posture of the information systems. The deliverables will allow the Peace Corps to leverage the services providers’ cloud offering to make credible risk- based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring Plan.

In compliance with the Peace Corps agency specific authorization, on a monthly basis, the Contractors shall in collaboration with the ISSO team, provide access to the required deliverables to ensure the CSP maintains an appropriate risk posture.

The Contractor shall furnish access to the following deliverables:

• Monthly OS, database, and web application, vulnerability scans as specified in the NIST SP 800-53 Control RA-5 parameter in Peace Corps’ Control Tailoring Workbook (deliverable shall include raw results and findings shall be included in the POA&M document);

• Monthly Plan of Action and Milestones (POA&M);

• Change requests (as they occur)

• Incidents (as they occur) Upon achievement of FedRAMP authorization, Peace Corps will accept the FedRAMP A&A and continuous monitoring documentation made available on the repository designated by the FedRAMP program in agreement with FedRAMP guidelines to satisfy the continuous monitoring requirement.

5.2.4 Personnel Security Requirements

Contractor shall furnish documentation reflecting favorable adjudication of background investigations for all personnel (including subcontractors) supporting the system. Peace Corps separates the risk levels for personnel working on Federal computer systems as follows:

• A favorable initial fitness/suitability determination must be granted and a Tier 1 or higher background investigation initiated before access to the Peace Corps network or any Peace Corps IT system. There shall be no waivers to this requirement for Peace Corps network and IT system access for Peace Corps employees or contractors.

• A favorable initial fitness/suitability determination must be granted and a Tier 2 or higher background investigation initiated before access to PII/CUI is granted. The authority and access shall be determined by the appropriate Peace Corps Supervisor (for Peace Corps employees) or CO (for contract personnel), Data Owner, and the System's AO. Each System's AO, with the request of the Peace Corps Supervisor, Data Owner or CO, shall evaluate the risks associated with each such request.

• A favorable suitability determination must be completed at a Tier 2 or higher background investigation before privileged access to the Peace Corps network or IT systems is granted. A waiver may be requested in order to maintain Peace Corps business operations; however such requests should be used judiciously and not incur unnecessary risks to Peace Corps.

If final adjudication of a background investigation is unfavorable, Peace Corps network and IT system access must be revoked, and any GFE, including the Peace Corps PIV card, must be retrieved and returned to OS&S.

Peace Corps shall sponsor the investigation when deemed necessary. No access shall be given to government computer information systems and government sensitive information without a background investigation being verified or in process. If results of background investigation are not acceptable, then access shall be terminated.

The Contractor shall provide a report of separated staff on a monthly basis, beginning 60 days after execution of the option period.

5.2.5 Sensitive Information Storage

Controlled Unclassified Information (CUI) information, data, and/or equipment will only be disclosed to authorized personnel on a need-to-know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, “Guidelines for Media Sanitization.” The destruction, purging or clearing of media specific to the CSP will be recorded and supplied upon request of the Government.

5.2.6 Protection of Information

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information in accordance with its FISMA system categorization.

All information about the systems gathered or created under this contract should be considered as CUI information. If contractor personnel must remove any information from the primary work area that is included in the ATO boundary, they should protect it to the same FedRAMP requirements. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

5.2.6.1 Unrestricted Rights to Data

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

5.2.6.2 Personally Identifiable Information

Personally Identifiable Information (PII) is in the scope of acquisition and PII is expected to be stored in the vendor's cloud solution. The vendor shall prepare a Privacy Threshold Assessment (PTA) to either document PII is not in scope, or determine which categories of information will be stored, processed, or transmitted by the system. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

PII will require the following guidelines be adhered to.

• The vendor’s information system must be authorized at least at the FIPS PUB 199 Moderate level.

• For any system that collects, maintains or disseminates PII, a PIA must be completed by the contractor and provided to the Peace Corps Privacy Office for review along with the other authorization to operate (ATO) documents.

• If the system retrieves information using PII, the Privacy Act applies and it must have a system of records notice (SORN) published in the Federal Register.

• If PII is collected from individuals by the system, a Privacy Act Statement (i.e., Privacy Notice) must be provided to users prior to their use of the application on what data is being collected and why, as well as the authority for the collection and the impact of not providing some or all of it. The Privacy Act Statement must be available to the individual directly on the form used to collect the information. Providing a link back to the Statement from the form is acceptable.

5.2.6.3 Data Availability

The data must be available to the Government upon request within one business day or within the timeframe negotiated with the Contractor, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

5.2.6.4 Data Release

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

Contractor will not disclose Customer Data to any government or third party or access or use Customer Data; except in each case as necessary to maintain the Cloud Services or to provide the Cloud Services to Customer in accordance with this contract, or as necessary to comply with the law or a valid and binding order of a governmental or regulatory body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, Contractor will give Government reasonable notice of any such legal requirement or order, to allow Government to seek a protective order or other appropriate remedy.

5.2.7 Data Ownership

All Government data collected in the system is the property of the Federal Government. All data collected by the system shall be provided by the Contractor (system provider) as requested during the contract period and at the completion of the contract period.

5.2.8 Confidentiality and Nondisclosure

Personnel working on any of the described tasks, may at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

Additionally, any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.