DRAFT Smart Buildings DRAFT SOW 2024 10 17.pdf

DRAFT

Section C, Description/Statement of Work

C.0 PROJECT SUMMARY

Built upon the Public Building Systems (PBS) building system network, GSA’s Smart Building Technology framework comprises multiple solutions and technologies.

Today, GSA has deployed fault detection and diagnostics, advanced metering, digital signage, Unified User Interface as well as an array of sensing technologies all leveraging field level data collected through the building automation systems. GSA Smart Buildings are built on the foundation of open, converged and normalized buildings systems. Open protocols allow for interactions of disparate systems.

Convergence of networks allows for advanced network security and cost savings in consolidation of network infrastructure. The final pillar of GSA Smart Buildings is the normalization of this now available building system data.

The General Services Administration (GSA) Public Building Services (PBS) Building Information or Control System Technology Policy mandates that all building technologies which require network or internet connectivity must utilize the GSA Building Systems Network (BSN). As software and hardware platforms reach an End of Life (EoL) for manufacturer support, these systems must be upgraded to remain connected to the GSA network.

C.1 PROJECT OBJECTIVES

Within the scope of this project, the goal is to upgrade and/or replace the building systems to the latest Public Building IT Services (PB-ITS) remediated version of software and hardware and/or Infrastructure per site requirements. This document is designed to outline the steps you will be required to complete in order to upgrade and/or replace existing systems

C.2 SCOPE OF WORK

Contractor will provide Integration Services via existing Tridium Niagara Framework® Supervisors Regional Operations Center (ROC) Server (including any underlying resource servers utilized by the ROC) and Building Monitoring & Control (BMC) Server(s) via GSA’s Building Systems Network (BSN).

All integrations will be a building specific process. The graphical user interface and technology will first be proven on the application before integrating the next systems.

The user interface will be evaluated along the development process for approval of graphics, navigation and functionality.

The Smart Buildings Technology (SBT) project will be constrained to buildings, systems, and devices located in the National Capital Region (NCR). The contractor will be responsible for upgrading and/or replacing existing monitoring & control systems, metering, integrating data points, creating the graphical interface, and training the user(s) on the system as applicable. The project scope will include any hardware, software, project management, coordination, and programming required to produce a functional and intuitive user interface.

Replace all existing hardware and applicable I/O, protocol port, and/or add-on modules that are End of Life (EOL) and/or incompatible with NCR’s standards with new JACE- 8000 and or JACE 9000 hardware and modules. Upgrade existing software, licenses, programming, graphics, drivers, etc. to the latest remediated version of N4.

Replace all existing applicable I/O, protocol port, or add-on modules that are End of Life (EOL) and/or incompatible with NCR’s standards with new approved hardware and modules. Upgrade existing software, licenses, programming, graphics, drivers, etc. to the latest remediated version of N4.

Replace all existing advanced metering infrastructure and applicable I/O, protocol port, or add-on modules that are End of Life (EOL) and/or incompatible with NCR’s standards with new approved hardware and modules. Upgrade existing software, licenses, programming, graphics, drivers, etc. to the latest remediated version of N4.

Upgrade and configure the existing software database files, backups, graphics, etc. to the latest remediated version of Niagara 4 and install on a new GSA-provided Windows 2019 or newer virtual server.

All Niagara 4 licenses shall include an additional 5 year SMA on top of the included 18 month SMA bringing the SMA total for licenses to 6.5 years.

C.2.3 PROJECT DELIVERABLES – Task Orders may include

1. Advanced Metering Management which can include but not limited to:

a. Advanced Meter Installation.

b. End of Life Advanced Meter Replacement.

2. BMC - BSN Migration of NCR Facilities Building Control System or Building Automation System which can include but not limited to:

a. Upgrade and or replacement of existing hardware and/or software to most recent GSA IT scanned and remediated versions.

3. SBS - Securing/Upgrade of existing Facility Building Control System or Building Automation System which can include but not limited to:

a. Upgrade and or replacement of existing hardware and/or software to most recent GSA IT scanned and remediated versions residing on the GSA Building Systems Network.

4. Commissioning - Ongoing Commissioning of NCR Owned and Operated Facility to include but not limited to:

a. Air balancing of facility equipment and systems

b. Water balancing of facility equipment and systems

c. Calibration of facility system sensors.

5. Programming/System Optimization

a. Including but not limited to sequence of operations.

C.4 Task Order Constraints

This section lists laws, rules, regulations, standards, technology limitations, and other constraints that the service and/or service provider must adhere to or work under.

C.4.1 Security Requirements The contractor shall comply with all GSA IT security requirements.

C.4.1.1 The contractor shall comply with GSA on-premise security for an on-premise solution hosted by GSA. Internal on-premise information systems reside in GSA facilities and may connect to the GSA network. Internal systems are operated on behalf of GSA.

Please reference IT Security Requirements for on-premise solutions in the Security Requirements-Mobile document attached.

C.4.1.2 The contractor shall comply with Mobile application requirements if a mobile application solution is being proposed. A mobile application, most commonly referred to as a mobile app, is a type of application software designed to run on a mobile device, such as a smartphone or tablet computer. GSA IT Security Requirements for Mobile Applications are attached.

C.4.1.3 Task orders shall ensure solutions meet moderate security requirements.

GSA Tailoring of NIST 800-53 Controls. The GSA Control Tailoring Workbook contains GSA defined values for NIST SP 800-53 Security and Privacy Controls. The workbook is not publicly available; contact the contracting officer who will coordinate with the GSA Office of the Chief Information Security Officer to determine if it can be made available. However, the NIST 800-53 control information can be referenced here:

https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final.

C.4.2 IT Requirements https://docs.google.com/document/d/15vro-zdtMyn-shcf7UL3oHQhupDVjEUbkYujQBPbZp4/edit#heading=h.32hioqz https://docs.google.com/document/d/15vro-zdtMyn-shcf7UL3oHQhupDVjEUbkYujQBPbZp4/edit#heading=h.2fk6b3p https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

The contractor shall propose task order responses that adhere to industry standard level of support services including proposing response rates to GSA requests.

C.4.2.1 The contractor shall ensure any and all software proposed in a task order is fully supported through the lifecycle of the proposed solution and is listed on the GSA Enterprise Architecture IT Standards List. This list is internal to the GSA network and vendors will not be able to access it until after award. The requirements are listed below:

a. The contractor shall identify and track all software components and associated end-of-life dates, including third-party software, used with the proposed solution as part of the system inventory.

b. As soon as the end-of-life upgrade is identified, the contractor shall notify the government of hotfixes or end-of-life dates to the operating system, middleware, database, third-party components or technical platforms (including patches) that impact the security posture or usability of the application.

c. The contractor shall replace or upgrade unsupported information system components prior to the end-of-life date or provide documented justification for the continued use of supported components.

d. The contractor shall ensure all software used is approved via the GSA Enterprise Architecture IT Standard.

The IT Standards program is governed by GSA’s policy. The GSA Office of the Chief Technology Officer (OCTO) manages the process and review of IT Standards and approves changes to the IT Standards Profile and approves any software used to process, store, or transmit GSA's data. Proposed technologies must go through the Software Approval Process, which begins with a security and accessibility assessments at a minimum, and is then reviewed by the OCTO for alignment with Federal Information Technology Reform Act (FITARA) and GSA's Digital Strategy. The Building Technologies Technical Reference Guide (BTTRG) references the approval process and other information applicable to this requirement. PBS’ Technology Policy is also applicable to this requirement.

C.4.2.2 For any resultant task orders that include software, the contractor shall follow the Public Building Information Technology Services (PB-ITS) Enterprise Quality Program (EQP) and all GSA IT Security Policies. This includes assessing vendor-developed code against requirements, validating code quality, and providing the necessary artifacts and deliverables when submitting application releases.

a. See (https://www.it-cisq.org/standards/code-quality-standards/) for guidance on how to measure, evaluate and improve software. Particular areas of importance are Performance Efficiency, Reliability, Maintainability, and Security.

b. PB-ITS reviews software code quality for security and resilience. PB-ITS references the Consortium for IT Software Quality (CISQ) (https://www.it-cisq.org/standards/code-https://www.gsa.gov/about-us/newsroom/congressional-testimony/the-federal-information-technology-reform-acts-fitara-role-in-reducing-it-acquisition-risk-part-ii-measuring-agencies-fitara-implementation https://www.gsa.gov/technology/government-it-initiatives/digital-strategy https://www.it-cisq.org/standards/code-quality-standards/ quality-standards/) for guidance on how to measure, evaluate and improve software.

Particular areas of importance are Performance Efficiency, Reliability, Maintainability and Security. PB-ITS currently uses CAST Application Intelligence Platform (AIP) and CAST Highlight to evaluate code quality for on premise non-COTS solutions.

C.4.2.3 For any resultant task orders that include software, the Contractor shall use GSA’s provided release management software, which is currently Jira.

C.4.2.4 For any resultant task orders that includes development, the Contractor shall manage all releases through the DevSecOps process and shall follow the GSA DevSecOps Guide and all other PB-ITS and GSA policies, procedures, and guidance for releases. The contractor shall adhere to industry best practice-defined by DevSecOps processes using PB- ITS tools.

a. The contractor shall be responsible for providing its own development environment.

b. PB-ITS Applications Operations provides two lower environments for on-premise solutions, Integration (INT) and Test (TST), and one Production (PRD) environment.

Contractor can upload and manage code to INT. GSA’s PB-ITS Applications Operations team manages the TST and PRD environments; no elevated contractor access is permitted.

c. Contractors shall submit code to a lower, non-production environment (INT) for scheduled testing and security scanning. The government PM reviews testing to determine acceptance. PB-ITS Application Operations pushes code to test environments, then production environments.

d. PB-ITS has implemented DevOps processes and tools for the automation of application installations. This solution is a collection of open source and standards-based tools currently using Jira as the front end for project managers and developers with Jenkins and Ansible for automation. The current tool set includes Jira, Jenkins, Ansible, Gitlab, Docker, Invicti, Artifactory, and Alfresco. The level of access of these tools will vary. PB-ITS is the admin of the tools and will be responsible for certain pieces/processes as a part of the deployment process. There is an access request process for these tools and vendors will be granted access with the appropriate level of access.

https://tech.gsa.gov/guides/dev_sec_ops_guide/ https://tech.gsa.gov/guides/dev_sec_ops_guide/

Note: Database = DB, Operating System = OS

e. The contractor shall provide artifacts to ensure a compliant build. Those currently include Source Code, Executables and Build and TestScripts. All build scripts must be supported by Ansible, Bash or Powershell.

f. The contractor shall provide installation instructions, documentation, and data dictionary updates.

C.4.2.5 For any task order, the contractor shall ensure all systems, software, equipment or their replacements are supported by Internet Protocol Version 6 (IPv6) by the year 2025 as mandated in the Office of Management and Budget (OMB) memorandum, M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” dated November 19, 2020.

C.4.2.6 For any resultant task orders that include software, the contractor shall propose dedicated support for Tier II and Tier III support and provide industry-standard SLAs.

C.4.2.7 The contractor shall use GSA’s single-sign on and multi-factor authentication (MFA) protocols for any task orders with support, installation, development, or related smart building services.

a. The contractor shall support configurable integrations with GSA operated, and government-wide operated, identity and authentication / single sign on services. The https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf contractor shall support Security Assertion Markup Language (SAML) 2.0 and/or OpenID Connect integrations. GSA will identify and provide the service(s) upon award.

b. The contractor shall support multi-factor authentication for GSA administrator users (privileged/administrative users) through integrations with a GSA managed identity and authentication service. The contractor shall support SAML 2.0 and/or OpenID Connect integrations. GSA will identify and provide the service(s) upon award.

c. The contractor shall support SCIM (System for Cross-domain Identity Management) or a vendor secured representational state transfer application programming interface RESTful (API) for GSA to create and manage GSA end user accounts. This includes creation, assignment of roles, and termination.

d. The contractor information system/IT solution shall support role-based access controls to distinguish between end users needing access to different levels of data (e.g., end users only needing access to non-sensitive data and end users needing access to sensitive data).

C.4.2.8 For any resultant task orders that include integration, development, transitioning, or other related smart building services and support, the contractor shall use human-centered design practices to create a product that is easy for the government to use.

This contract requires the delivery of functional products in a manner that enhances our end-users’ experience. The contractor shall:

a. Provide expert guidance and direction on user experience (UX) strategy, research, and design.

b. Articulate a user-centered vision for the future of the product, and establish mechanisms to measure progress.

c. Optimize products for mobile-first operation, with all solutions being equally usable on mobile and desktop.

d. Incorporate robust accessibility principles into design, and testing for all products to deliver high-quality digital experiences to users of assistive devices.

e. Follow plain language content guidelines (https://www.plainlanguage.gov/).

f. Ensure content has been optimized for Search Engine Optimization (SEO) to make information easier to find.

g. Use data and analytics along with user research to drive product decisions.

h. Create and maintain documentation for all activities, recommendations, and decisions that captures value to users as defined by them from user feedback.

i. At the start of work on a new or existing product/project, the contractor shall participate in and conduct a product kick-off meeting with GSA’s Public Building Service / Office of Facility Management / Facility Technology and Innovation / Smart Building personnel and other designated stakeholders.

j. Facilitate discovery activities, such as research with business stakeholders, an assessment of current related features, a content review, an information architecture https://www.plainlanguage.gov/ review, an accessibility review, a business process review; and collection of any available data and analytics.

k. Conduct periodic user research to understand customers’ and users’ goals, needs, journeys, and pain points with respect to the product.

l. Conduct frequent user research to validate and iterate on all aspects of the product.

This may include usability testing, content-focused testing, card sorting, tree testing, observations, etc.

m. For public-facing websites, leverage Digital Analytics Program (DAP) data in determining user goals, needs, and behaviors, or, if not available, include DAP code in the product.

n. Create a User Research Plan and Finding Summary for each study, which shall include a documentation of research questions, hypotheses, methodology, recruiting needs, synthesis, and next steps, and where applicable house findings with the code base.

o. Apply research insights to define product functionality and to continually improve content, information architecture, design, functionality, and accessibility.

p. Align with GSA’s style guide for content. This may include developing relationships with GSA subject matter experts, creating a governance and approvals process, maintaining content style guide, planning for iteratively testing content with customers and users.

q. Write and edit content using plain language best practices. Includes labeling, form questions, short guidance, long-form guidance, etc. Collaborate with GSA subject matter experts to translate complex language into user-friendly language.

r. Design interfaces such as page layout, content design, menus and navigation, information architecture, and user flows; mobile and desktop wireframes and high-fidelity interactive prototypes.

s. Create designs that use the U.S. Web Design System and, when applicable, align with GSA’s design system.

t. Conduct usability and user acceptance testing on new designs, features, content, navigational elements, etc. to ensure a quality end-user experience.

u. Employ inclusive design, accessibility, and user experience best practices with all research, content, and design activities to foster a quality experience for customers and users.

v. Create a plan for continuous user research and validation that can continue to guide product direction post-contract.

C.4.2.9 Inclusive Design/Accessibility/Section 508 Compliance: For all task orders, the contractor shall ensure that work is performed that serves a diverse user population. This includes, but is not limited to, users with physical and cognitive disabilities (who may use a variety of assistive technology), low English proficiency, low English literacy, different cultural backgrounds, a lack of access to fast internet connection, and/or whose primary access is with a mobile device. The contractor shall comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d). In accordance with Federal Register, 25 APR 01, FAC 97-27, Executive Order 12866, Part 2.101, FAR Part 7.103, FAR Part 10.001, FAR Part 11.002, FAR Part 12.202, FAR Part 39.000 & 39.2, access to electronic and information technology (EIT) by individuals with disabilities must be compliant with the accessibility standards at 36 CFR 1194, unless it falls under one of the exceptions noted in FAR 39.204. Additional information and requirements related to 508 Compliance can be located http://www.section508.gov.

The contractor shall conduct automated and manual accessibility tests using common screen readers and diagnostic tools; GSA may need access to these tests to ensure full 508 compliance. At a minimum, this should be done before each launch, major update, or new release. The contractor shall also create and maintain documentation for all related activities, recommendations, and decisions.

C.4.2.10 Integration/Data If a task order includes integration of data, the contractor shall ensure integration conforms to existing architecture to include but not limited to: BAS, GSALink (SkyFoundry’s SkySpark), NCMMS (IBM Maximo), Muse (IBM Envizi) and Kahua.

Current Capabilities of Existing Systems

BAS Kahua GSALink NCMMS MUSE

Connectors ✔ ✔ ✔ ✔ ✔

Flexible Connection

✔ N/A ✔ ✔ N/A

Bulk Data Transfer ✔ ✔ ✔ ✔ ✔

Bi-directional Data Feed

Synchronous Communication

✔ Unknown ✔ ✔ N/A

Asynchronous Communication

✔ Unknown ✔ ✔ N/A

Monitor Transactions

✔ ✔ ✔ ✔ N/A

Send Task N/A ✔ ✔ ✔ N/A

Receive Tasks TBD ✔ ✔ ✔ N/A

a. Building Automation System (BAS) is a diverse set of inventory.

- Currently integrates with GSALink (via SkySpark); sparks are event triggers to identify equipment operating outside of expected thresholds

- Connectors: flexible (open system)

b. Kahua is a construction management software solution

- Dashboards and reporting capability

- Workflow system capable of understanding tasks; Automation is built-in which enables workflows to be completed

- Transaction Monitoring: capable as automation is built-in

- System Limitation: push and pull data via API, no ETL integration capabilities at this time

c. GSALink is a fault detection and diagnostic platform

- It integrates building automation systems (BAS) data via Skyspark

- If something breaks a rule, it sets off a “spark” and a notification is sent to the building manager through NCMMS

- GSALink uses Skyspark for Analytics (data capture, trending rules) and NCMMS is used for reporting

- When faults are detected in GSALink they come through NCMMS

- Connectors: flexible; open system/BACnet

- GSALink leverages IBM Maximo to establish a connection with NCMMS via REST

API

- Capable of synchronous/asynchronous communication and monitoring transactions

d. NCMMS (IBM Maximo) is a computerized maintenance management system (CMMS),

- Hosted on vendor managed Amazon Web Services (AWS) but accessible through GSA Firewall

- Transaction Monitoring: system is capable of performing preventative actions+listener+auto generating tickets

- Connectors: manual when not API; automatic orchestration possible

- Flexibility of Connectors: capability exists to add connectors however not implemented

- Synchronous Communication: capable but may need additional assessment;

- Asynchronous Communication: extract, transform, and load (ETL) translator for 2-way communication capable; ability to initiate workflows, can integrate with MUSE

- Send Task or Work Orders w/ building information modeling (BIM) : future integration

- Bulk Data Transfer: data ingested via web services call, comma separated values (CSV) format, ETL, REST Interfaces

e. MUSE (IBM ENVZI) is SaaS reporting and analytics dashboard; it only ingests data and analyzes the data

- Connectors: application programming interface / secure file transfer protocol

(API/SFTP)

- Information is received every 15 min from utilities and daily for other systems outside

GSA

- Data push via API, data pull via SFTP, no other connectors supported

- Business intelligence (BI) connection is only to share information with users getting reports from BI

- Fully cloud service

- Internal GSA users only, no external users

f. Additional Platforms as GSA needs evolve

C.4.3 HSPD-12 Compliance The contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive 12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

For any contractor personnel performing work under this contract who will require access to GSA IT applications, systems or data, the contractor shall comply with the HSPD-12 security clearance process. This means first obtaining a fingerprint clearance, which typically takes 3- 4 weeks. At that point, the Authorizing Official (AO) can grant limited access on a case-by-case basis. Next, a preliminary favorable adjudication of their Tier 2S clearance level must be received. This process can take 1 to 2 months. Only when a full Tier 2S adjudication is received will full access be granted. This process usually takes 4 to 8 months, though it could take as many as 12 months. Higher levels of clearance may also be required depending on the level of trust required to perform specific duties or perform a specific task.

Contractors shall not be granted access to a GSA facility or to any GSA IT system prior to a favorable response to the fingerprint portion of this background investigation. An individual contractor’s failure to return satisfactory results from the background investigation shall result in immediate removal of that contractor.

The Contracting Officer, through the Contracting Officer’s Representative (COR) or GSA Program Manager (PM) will ensure that a completed Contractor Information Worksheet (CIW) for each Applicant is forwarded to the Federal Protective Service (FPS) in accordance with the GSA/FPS Contractor Suitability and Adjudication Program Implementation Plan dated 20 February 2007 and ADM 2181.1 Homeland Security Presidential Directive-12 Personal Identity Verification (PIV) and Credentialing Policy, and Background Investigations for Contractor Employees dated March 18, 2020. FPS will then contact each Applicant with instructions for completing required forms and releases for the particular type of personnel investigation requested.

Applicants will not be reinvestigated if a prior favorable adjudication is on file with FPS or

GSA, there has been less than a one-year break in service, and the position is identified at the same or lower risk level.

Once a favorable FBI Criminal History Check (Fingerprint Check) has been returned, Applicants may receive a GSA identity credential, a PIV card, (if required) and initial access to GSA information systems. The HSPD-12 Handbook contains procedures for obtaining identity credentials and access to GSA information systems as well as procedures to be followed in case of unfavorable adjudications.

The contractor shall be required to fund their employees’ security clearance and background investigation processes. The Government will not provide funding for these requirements.

HSPD-12 requirements do not apply to contractor IT applications, systems or data. HSPD-12 applies to all GSA IT systems owned or operated on behalf of GSA.

C.4.4 Government Furnished Equipment/Government Furnished Information Government Furnished Equipment (GFE) including PIV cards or Government Furnished Information (GFI) may be provided to the contractor during the period of performance of the contract, under the following conditions (see CIO 2160.4A Provisioning IT resources policy described below):

C.4.4.1 Use of the GFE and GFI is for the sole purpose of completing the requirements of this contract.

C.4.4.2 The contract employee has received a pre-favorable background investigation determination/adjudication; expected to result in a final favorable determination/adjudication, or the contract employee has already received a final favorable background investigation determination/adjudication.

C.4.4.3 GFE may include virtual desktop access provided by GSA and does not necessarily constitute the distribution of hardware to the Contractor. Access to the GSA network, whether direct or through other means, such as the GSA Virtual Private Network (VPN), is contingent upon each contract employee having successfully received a pre and final favorable background investigation.

C.4.4.4 The estimated GFE is to be determined (TBD) and can include virtual desktops or laptops as determined by the Government.

C.4.4.5 All Government unique information related to this requirement, which is necessary for contractor performance, will be made available to the contractor.

C.4.5 Non-Disclosure Agreements Standard non-disclosure statements shall be completed by all vendor system administration and other personnel who may have or potentially could have access to government data; this requirement includes subcontractor personnel. The vendor shall sign and return these agreements to the CO before but no later than 5 days after the post award orientation. The Security and Privacy Requirements for IT Acquisition Efforts listed in the SOO attachments shall be incorporated into any resultant contract.

A. Personnel working on any of the described tasks shall be required to sign formal non-disclosure and conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

B. Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract.

C. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees.

D. Disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

E. All information that is (1) obtained related to or derived from this contract, and (2) results from or derived from any actual tasks assigned to contractor employees while participating on this contract is considered proprietary.

F. The Contractor and all contractor/subcontractor employees will not use vendor proprietary information except as necessary to perform this contract and shall agree not to disclose such information to third parties, including any employee of the contractor/subcontractor who has not executed this NDA, or use such information in any manner inconsistent with the purpose for which it was obtained. Anyone failing to comply with the agreement may be subject to disciplinary action or termination of employment by the contractor/subcontractor, and possible administrative, civil, or criminal penalties.

G. Note: GSA’s Office of the General Counsel (OGC) is available to coordinate on defining NDA requirements. Upon request, GSA OGC can advise on NDA development.

C.4.6 Data and Deliverables All data (including but not limited to: asset information, tickets, contact information, project information, content metadata, etc.) associated with any task order awarded under this master contract is and shall remain the property of the Government.

C.4.6.1 The contractor shall ensure that the government retains access and download capability of all data for research, investigation, transfer, or migration to other systems. Data management and retention will be handled as directed by GSA and in conjunction with current Controlled Unclassified Information (CUI) guidelines.

C.4.6.2 The contractor shall deliver the deliverables outlined in any task order awarded under this master contract, (and any additional deliverables that the Contracting Officer may require in writing) on dates as the Contracting Officer may specify.

C.4.6.3 For all resultant task orders, all documentation, including, but not limited to, documented processes, procedures, software tools and applications, test materials, text, notes, electronic files, data, new capabilities or modification of existing applications, source code and records generated, modified, acquired or produced by the contractor under the resultant contract shall become the property of the Government. In accordance with the Federal Acquisitions Regulation (FAR) 52.227-14(b), the Government shall have unlimited rights to all produced materials, including the right to modify, distribute and publish. The contractor shall deliver electronic copies of all produced materials to the Government quarterly (or as requested) and upon expiration or termination of this contract. The contractor may mark the deliverables to indicate its authorship, provided, however, that it shall not include any markings inconsistent with the Government’s unlimited rights. The contractor agrees that the Government may release any deliverable in response to a Freedom of Information Act (FOIA) request, subject to any right to object or to request redactions that the contractor may otherwise have under the Act or under applicable agency regulations.

C.4.6.4 All deliverables, for any task order awarded under this master contract, in printed or other media forms containing personally identifiable information (PII) and/or SBU information shall follow applicable policies including GSAs PBS P 3490.3 or latest order. The contractor shall ensure and deliver the application is designed to function in accordance with applicable Federal Information Processing Standards Publication (FIPS PUB) 140-2 and all applicable annexes or subsequently approved federally recognized policy for the protection, operation and/or delivery of Federal information technology systems.

C.4.7 Confidentiality, Security, and Privacy The contractor shall be responsible for the privacy and security safeguards in accordance with the FAR clause 52.239-1 for all task orders associated with this master contract.

C.4.7.1 The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of any task order awarded under this master contract. In addition, the contractor shall protect all government data, equipment, or information by treating the material as CUI information, data, and/or equipment shall only be disclosed to authorized personnel. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, the CO/COR will give instructions whether this information, data, and/or equipment shall be returned to Government control, destroyed, or held until otherwise directed. Items returned to the Government will be hand carried or mailed to the COR using certified mail. Per instructions, the contractor shall destroy unneeded items by burning, shredding, or any other method that precludes the reconstruction of the material.

a. The contractor shall not publish or disclose in any manner, without the CO’s written consent, the details of any safeguards used by the contractor under the resulting contract or otherwise provided by or for the Government.

b. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public government data collected and stored by the contractor, the contractor shall afford the Government access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

c. If new or unanticipated threats or hazards are discovered by either the Government or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

d. The contractor’s solution shall meet the NIST Special Publication (SP) 800-53, Revision 4, control requirements for FIPS 199 Moderate Impact systems.

e. The contractor's solution shall comply with the GSA CIO IT Security Procedural Guide CIO- IT Security -09-48, Security Language for IT Acquisition Efforts. The critical requirements from this guide are covered in the SOO attachment titled "UUI Security Requirements-Mobile".

f. Work on this project may require or allow contractor personnel access to Privacy Information. Contractor personnel shall adhere to the Privacy Act, Title 5 of the U.S.

Code, Section 552a and applicable agency rules and regulations.

g. The contractor’s solution shall meet the requirements of the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541.

C.4.7.2 GSA has specified mandatory training for all contractors. If applicable to a task order, GSA will provide the internal training website containing the training modules after the contract award. The following required training courses, which are subject to change as needs arise among the GSA workforce and partners, is the current list of GSA-supplied mandated courses:

a. Security and Privacy Awareness Training

b. GSA Continuity of Operations (COOP) Awareness Training

c. Insider Threat and Awareness Training

d. Controlled Unclassified Information

C.4.8 Unauthorized Commitments The COR, PM, or any other government representative is not authorized to change any of the terms and conditions of this contract or any task orders awarded under this master contract.

Changes, if any, shall be made by the Contracting Officer (CO) only or task order Contracting Officers (TOCOs). Any task order changes including requirements, schedule, or other modifications performed by the contractor without a written, signed modification from the CO/TOCO shall result in (1) the contractor having to re-adjust schedule or work to the original requirements; (2) a denial of any resulting request for equitable adjustment or quantum meruit; (3) poor Contractor Performance Assessment Reporting System (CPARS) results; (4) a government requested change in the vendor’s lead contact; or (5) a combination or all of the items listed. Equitable adjustments and Quantum Meruits shall not be considered in response to a contractor failing to follow the requirement to wait for a CO/TOCO signed contract/task order modification before incurring additional expense.

C.4.9 Agile Program & Project Management Methodologies

C.4.9.1 For any task orders associated with development or performance based services, the contractor shall propose an Agile approach to development and use Agile methods to the extent feasible to deliver an operational solution. The contractor shall propose methods to monitor the delivery of work using Agile artifacts such as product backlog, iteration backlog, release backlog, iteration planning and review, iteration team meetings, velocity, error detection and management, and reports on earned value and burndown rates. The contractor shall provide a list of proposed artifacts and the frequency of their submission to GSA as part of their Agile Approach narrative in their PWS.

C.4.9.2 For any task orders associated with development or performance based services, the contractor shall use a Government-designated electronic repository to capture all artifacts and deliver the solution in the agreed-upon timeframe, and per the agreed-to criteria for acceptance. GSA currently uses JIRA.

C.4.9.3 For any task orders associated with development or performance based services, agile methodology shall include the contractor’s approach to collaborating with GSA stakeholders, validating the completeness of GSA user stories, updating the backlog with new user stories, demonstrating iterative functionality, and incorporating stakeholder feedback and stakeholder acceptance criteria.

C.4.9.4 For any task orders associated with development or performance based services, the contractor shall coordinate with a GSA-named, dedicated Product Owner and PM who will ensure that features are appropriately prioritized, tested and accepted.

C.4.9.5 The contractor shall include a Quality Control Plan (QCP) for all task order proposals unless otherwise stated in the task order solicitation instructions. The contractor may be asked to make appropriate modifications to the QCP (at no additional cost to the Government). The Government has the right to require revisions of the QCP (at no cost to the Government) should the QCP fail to deliver the quality of the services required at any time during performance. These contractor supplied documents shall be separate from the Government’s Quality Assurance Surveillance Plan (QASP) which will not be included in the task order award or documents.

C.4.9.6 As applicable to task orders with performance periods greater than one year, the contractor shall include a phase out plan that outlines the procedures and approach 60 calendar days prior to contract completion or termination. The focus of the plan is the retention of staffing and/or performance outcomes during the off-ramp transition.

a. Procedures for retaining the staffing levels necessary to maintain required services through the day of the contract’s expiration or termination.

b. Procedures and responsibilities for performing physical inventory and reconciling and certifying all GFE and GFI.

c. Procedures for reconciling and certifying material and equipment on-hand levels and accuracy.

d. Document and define the procedures and responsibilities for turning over all account access to the follow on contractor required to manage and maintain the on-premise solution.

e. Document and define the plan for providing on-the-job, application specific, training for the incoming contractor personnel.

f. Provide detailed documentation sufficient to allow the follow-on contractor to effectively transition into the contract. The following illustrates the types of documentation required. The Government will specify any other types of documentation that may be needed at the start of the phase-out period:

- System operating procedures

- Customized user guides and manuals

- Detailed data mapping

- All business logic and where it resides within the system (presentation layer, database, data architecture plan, etc.)

- All workflow and business process configurations

- All outstanding / in-progress issues

- All underdeveloped requirements

- Latest version of the System Security Plan, if applicable

- Any additional documents developed related to the system

g. Provide application and configuration walkthroughs with the incoming contractor.

h. Provide all code for any customizations or add-ons to the underlying solution.

i. Provide the hardware/software inventory.

j. Facilitate the transition of the on-premise environment to incoming contractor and/or

GSA, as determined by the Government.

k. Coordinate with the incoming contractor, if applicable.