Draft SOW_Conf Room Scheduling.pdf

STATEMENT OF WORK

Space Scheduling System for the Federal Aviation Administration (FAA)

1 Background In order to continue adapting to the agency’s growing technical needs, the FAA requires a digital and electronic workspace management system that is a cloud-based Software as a Service (SaaS) platform featuring an easy-to-use and consumer-grade interface that is responsive to any sized device for use across the agency at various FAA Enterprise locations across the US. The SaaS solution must include comprehensive implementation, data migration, systems integration, user training and support and maintenance. This SaaS software solution will allow users to reserve conference rooms, workplace spaces (desks, meeting rooms), and more in one centralized location using any device. This cloud-based solution must provide reservations of 1200 conference rooms and 700 workspaces with options for more licenses as more locations or other asset types (i.e., fleet, equipment) are included. The current FAA reservation system supports at least 100 locations and at least 100,000 users.

2 SYSTEM REQUIREMENTS

The software must be a SaaS product and have the following features and functions:

Architectural and Hosting

2.1 Must be on a Federal Risk and Authorization Management Program (FEDRAMP) authorized cloud provider.

2.2 Ability to be easily accessed through application programming interfaces (API) connections for data exchanges, as required.

2.3 Provide high availability with at least 99.5% availability uptime.

2.4 Must have a clear disaster Recovery Time Objective (RTO) and Recovery Point Objective

(RPO) per impact level targets.

2.5 Must be scalable to over 100,000 users in different time zones and locations.

Security

2.6 Must be compliant with FEDRAMP, FISMA and NIST SP 800-53 latest version. Refer to http://www.cloudcomputing.ieee.org/standard and www.fedramp.gov.

2.7 Integrate the contractor’s application with the following technologies used with the FAA for identification and multi-factor authentication:

- FAA/DOT MyAccess Single Sign On (SSO) system which is FAA’s Active Directory

- FAA Windows Active Directory user authentication process

- HSDP-12 Personal Identification Verification (PIV) http://www.cloudcomputing.ieee.org/standard http://www.fedramp.gov./

2.8 Comprehensive auditing of all reservations, access, changes and administrative actions (SIEM integration)

2.9 Comply with Section 508 Web Content Accessibility Guidance (WCAG) 2.1 AA for accessibility to include email, exported or generated reports.

2.10 Provide Role-based access control (RBAC) with least privilege.

2.11 Documented incident response procedures with 1-hour detection/notification for incidents.

2.12 Supports continuous monitoring with mature standardized patch management procedures in place.

2.13 Availability of annual cloud service provider reassessments per FedRAMP standards.

2.14 Must be Zero-trust ready.

2.15 All data must be encrypted in transit using Transport Layer Security (TLS) 1.3 (or latest

Federal standard) and at rest utilizing Federal Information Processing Standards (FIPS) 140- 3 validated cryptographic modules with Advanced Encryption Standard (AES)-256 or better.

Core Reservation Functionality

2.16 Request and Reserve shared spaces such as conference rooms, offices, workstations, equipment and transportation.

2.17 Fully support Microsoft 365 and/or Google Workplace integration to enable users to reserve rooms within the mail service offerings to include calendar optimization. For example, user should have the ability to connect to the service via their email exchange provided by Microsoft Outlook and/or Google service calendar to make and manage space reservations within the system. (Preferred solution can integrate with both Microsoft 365 and Google Workplace.)

2.18 Ability to autogenerate email confirmations and notifications of changes to reservations.

2.19 Ability to customize rules and requirements for spaces by role, organization and location.

2.20 Ability to configure custom forms for onboarding spaces, locations, policies, users and group management. (For example, users have the ability to indicate configuration and equipment requests such as hollow square and perimeter seating requirements (based on max capacity per configuration), panel head table, microphones, flags, and quantity).

2.21 Ability to support enterprise-level configuration options to accommodate local policies and business unit rules by space across FAA buildings throughout the agency. This means the application must provide the ability to set specific business rules by space, as needed, to tailor the application to meet business unit’s unique needs.

2.22 Ability to establish multiple POCs for at least 100 locations.

2.23 Ability to upload floor plans and multiple photos for all spaces and locations.

2.24 Ability to modify approval workflow for spaces requiring approval.

2.25 Ability to conduct universal searches.

2.26 Ability to modify existing reservations for Space Manager and System Administrators.

2.27 Ability to auto-bump reservations where the user has not checked in by a specified time or after a grace period allowing others to reserve the space.

2.28 System should be intuitive and user friendly with minimal clicks to reserve a room and offer intuitive search functionality with additional filtering such as, floor plans, capacity and configuration type, equipment.

2.29 Allow delegation so others can make, approve, modify reservations or spaces on behalf of another user.

2.30 Allow multiple user types with varying roles and responsibilities with access. At a minimum, 10 System Administrators, 100 Space Managers, 200 Approvers, and 100,000 Regular Users are required.

2.31 Ability to make reoccurring reservations.

2.32 To have a landing page that is manageable to add downloadable resources.

2.33 Ability to conduct mass updates to the database such as managing user profiles and permissions as a bulk or per group basis.

2.34 Ability to support all users and reservations in different time zones based on location.

2.35 Ability to accept floor plans in JPEG or PDF and update as needed without having any effect on the existing resources or reservations.

2.36 Ability to perform the FAA Use Cases

2.37 Ability to print or export pages from the application, ex. Listing of the reservations for all user types.

Analytics and Reporting

2.38 Access to user activity and reservation activity logs in a reporting functionality.

2.39 Ability to track space onboarding and offboarding activities, archived locations, user management and engagement.

2.40 Offer dashboard and reporting templates to manage portfolios and programs by location, building, regions, or communities and share with other users.

2.41 Ability to identify or locate which point of access to the application.

2.42 Ability to create customized reports based on all data points, export data to standard reporting formats (ex: xls, xlsm, html, txt, xml, csv, pdf).

2.43 Ability to automatically generate reports on set frequency levels and email to designated recipients.

3 TASKS

3.1 Program Management

3.1.1 Program Administration

The contractor must provide ancillary project management services to support the planning and execution of this project. The Contractor must implement and document a Management Program. The contractor must submit a Management Plan (MP), documenting its management program, for Government approval. The Contractor must revise this plan as necessary. The Contractor must implement this plan upon approval. The MP must identify the Contractor's management, organization, authority, responsibility, controls, and the extent to which these apply to the space scheduling system. The MP must detail the

Contractor's methodology to ensure that the program management requirements set forth in this SOW are met. The MP should detail the specific plans, schedule, and logistical approach to support the implementation of the system for each of the FAA facilities covered under this requirement and training of FAA administrators and users. The contractor must:

At a minimum, the Contractor must perform the following tasks in managing this contract:

• Produce the schedules of work that reflect and track the delivery of products as specified by this SOW.

• Use methods and metrics for assessing the schedule, technical performance of the work, and risks of this program.

• Use procedures for relating risks and costs to schedule and technical performance to assess the impact of risks and costs on successful completion of the scheduling system work efforts

• Designate a Program Manager (PM) who is responsible for integrating and maintaining the total Contractor effort as described in this SOW. The PM must be prepared at all times, given reasonable notice, to present and discuss with the FAA the status of contract activities.

An integral factor in the success of the space scheduling system is the Contractor's plans for interaction with the Government and their support contractors. The MP must include the Contractor's plan for ensuring that all interaction is managed and conducted to provide maximum benefit toward successful design, implementation and operations and maintenance of the space scheduling system. The Contractor must also conduct ongoing risk management activities during the period of the contract. The risk management activities must be an integral part of the Contractor's management process, as described in the MP.

CDRL 001 Management Plan

3.1.2 Project Schedule

The Contractor must develop and maintain a project schedule of events planned for accomplishing the work effort identified in the SOW. The Contractor must monitor and report project performance using an automated scheduling tool. The schedule must provide time phasing for all activities described in this SOW, relationships between the various activities, and milestone review points. A revised project schedule must be delivered quarterly thereafter, or as required based on the volume of changes.

CDRL 002 Project Schedule

3.1.3 Financial Reporting

The Contractor must establish and maintain a financial control system that plans and controls cost and schedule. The system must also assess and report project cost and schedule status to the FAA.

The Contractor must prepare and submit cost performance reports on a monthly basis with each invoice that provide:

- Summary information by contract line item number (CLIN), task order, sub-total, and total

- Supporting detailed information that identifies quantities, CLIN, task order, unit prices, which separately identify the monthly lease price and the monthly maintenance price for each piece of equipment, and total amounts

- A financial status report that identifies by task order and CLIN, funding or hours remaining, as of the reporting date.

CDRL 003 Financial Technical Report

3.1.4 Project Status Monitoring

The Contractor must continuously monitor schedule, and technical performance on this contract.

The Contractor must provide a timely assessment of project progress at monthly project reviews. The monthly project reviews will be held at FAA Headquarters unless otherwise directed by the FAA. The key contractor and sub-contractor personnel must attend the monthly project reviews.

The project reviews must:

- Include a review of the technical and schedule, aspects of contractor's performance, and program accomplishments (e.g., milestones met), problems, forecasts, and subcontractor activities

- Provide a summary of procurement activity, including what is on order, pending, and projected lead times and/or arrival times

- Address project status as related to projected and actual milestones and accomplishments

- Present price summaries (total price for period and total price to date) by CLIN for all invoices submitted since the last review

- Address schedule delays, problems, or other discrepancies in planned, actual and forecasted project progress and address the cause, effect and proposed correction

- Provide status of action items

The Contractor must provide Project Status Reports on a monthly basis. The Project Status Reports must include the corrective actions being pursued if there is a deviation from the planned schedule, budgeted cost, or performance requirements.

The Contractor must conduct technical interchange meetings with the FAA or its designated representatives to resolve specific technical issues. Technical interchange meetings must be conducted at the Contractor's facility or a site designated by the FAA. The Contractor must provide administrative support for the project reviews and TIMs, including preparation of agendas and minutes for each project review and technical interchange meetings in accordance with Section 3.1.6.

CDRL 004 Project Status Report

3.1.5 Quality Assurance

The Contractor must provide and maintain a documented quality system as a means of assuring compliance with the hardware and software requirements of the contract. The quality system should be established and maintained in accordance with ANSI/ASQC Q9002-1994 and must be documented in the Quality System Plan.

CDRL 005 Quality Assurance Plan

3.1.6 Meetings, Conferences, and Reviews

The Contractor must conduct meetings, conferences, and reviews (hereinafter referred to as reviews) with the FAA to discuss program progress, identify potential problems, and resolve identified problems.

The Contractor must prepare and submit a meeting agenda for all reviews to the Government for approval. The Contractor must formerly notify the Government of its readiness to conduct a review if the review is a mandatory requirement of this contract (i.e., design review). Delivery of all CDRL Items required prior to the mandatory review is a prerequisite to notification of readiness. If prerequisites to holding the review have not been fulfilled, the FAA will have the option of postponement without prejudice to other task requirements.

Upon receiving approval of the review agenda, the Contractor must promulgate the agenda, date, and location of the review to all attendees. The Contractor must make key Contractor personnel available to respond to FAA questions. For each event at which a presentation will be given, the Contractor must prepare and submit the presentation materials. The Contractor must record, prepare, and submit the review minutes and action items for each review. The Contractor must track action items identified at each event. For each action item, the Contractor must assign an agreed upon suspense date and provide status at agreed upon intervals until the action item is closed. The Contractor must respond to all action items in writing with a written closure statement or plan for closure.

CDRL 006 Meeting Agenda CDRL 007 Presentation Materials CDRL 008 Meeting Minutes & Action Items

3.2 Technical Support

The contractor must provide ancillary technical and implementation services to support the set-up/configuration, testing, and migration of the current operational COTS-based system to the cloud-based platform so that it continues to meet the minimum requirements specified in Section 2. The scope of this support includes gathering the site-specific requirements, in coordination with the FAA program office, and providing Implementation Services.

3.2.1 Implementation

Phase 1: Discovery

- Conduct architecture and configuration workshops with agency stakeholders.

- Discovery of FAA’s current architectural and configuration reservation scheduling system.

- Conducting data analysis on FAA’s current architectural and configuration reservation scheduling system.

- Collaborate with FAA to define allowable configuration (toggling existing settings, mapping APIs) vs. custom code extensions.

- Incorporate discovery outcomes into system integration and implementation plan.

- Support and coordinate with the FAA Information Security Team to obtain an Authority to Operate (ATO) for the Conference Room, Workspace and Transportation Scheduling System.

- Support the establishment of a FISMA Reportable system and support the completion of FAA system requirements.

- Establish an Integrated Business Plan.

Phase 2: Design

- Establish and define user access levels, reservation policies, data structures, and workflows based on Use Cases provided by FAA.

- Establish and design the reporting functionality.

- Develop design of all conference rooms, huddle spaces, collaborative areas, per location and building.

- Establish a development environment to provide the ability to conduct testing.

Phase 3: Configuration

- Configure the SaaS environment (workflows, custom fields, user roles, access control policies, and dashboard reporting) to map to Agency workflows without altering the core SaaS source code.

- Develop and implement a Data Migration Plan detailing extraction, transformation, and loading (ETL) validation strategies.

- Migrate historical data from the current FAA reservation scheduling system to the Conference Room, Workspace and Transportation Scheduling System

- Integrate the system with Microsoft 365 / Google Workspace / Okta Single Sign-On/ FAA’s Active Directory.

- Configure custom branding (company logo, color schemes) and content management on the web portal and mobile application.

- The Contractor shall configure and test secure application programming interfaces (APIs) to integrate the SaaS solution with existing FAA systems.

Phase 4: Testing & Deployment

- Conduct end-to-end testing of ad-hoc bookings, remote reservations, check-in/no-show cancellations, and calendar syncing.

- Develop User Acceptance Testing (UAT) Plan and use cases

- Conduct integration testing.

- Support the Government during UAT, addressing and mitigating any identified bugs, defects, or performance bottlenecks prior to production deployment.

- Execute a soft launch with a pilot group of users and administrators.

- Develop a roll out schedule and plan across the FAA enterprise and all locations.

- Conduct production set up

- Deploy the system across all of the FAA locations.

- Provide post-implementation support to troubleshoot and resolve issues that may arise following the go-live production implementation and rollout.

- Provide information security documentation in compliance with NIST 800.53’s latest version and as required to obtain FAA’s Authority to Operate (ATO) and FAA’s Annual Assessments.

CDRL 010 Requirements Sign-off CDRL 011 System Architecture Design CDRL 012 Software Environment and System Integration CDRL 013 User Acceptance Testing (UAT) Sign-Off CDRL 014 Operational SaaS Solution Implemented across FAA locations

3.2.2 Maintenance and Support

- The vendor must provide the following Maintenance & Support for the duration of the agreement:

- Troubleshoot application/infrastructure issues and assist with resolution.

- Notify FAA of scheduled security and application updates/outages immediately.

3.3 Training Support

3.3.1 Training Program

The Contractor must provide familiarization training and associated materials in accordance with the requirements specified herein. The Contractor must conduct familiarization training of FAA personnel in system administration Familiarization training may be conducted manually. Contractor must develop training materials specific to FAA to include How to Guides, quick reference guides one pagers, and videos for general end users. Contractor must provide user training for the general FAA user base that can be recorded for use though out the agency and enable the FAA to successfully adopt the system for widespread use at the locations specified in the table below.

The Contractor must develop and modify and perform familiarization training in accordance with best commercial practices. Course materials for each type of familiarization training must be documented in a Familiarization Training Plan and submitted for approval.

o System Administrators: [~10 users]. Deep technical training covering identity management, configuration adjustments, security auditing, and API monitoring.

o Space Managers/Train-the-Trainer: [~100 users] Comprehensive functional training to enable selected internal personnel to act as Tier-1 support.

o Regular Users: [~100,000 users] Standard operational workflows, navigation, and core feature utilization.

CDRL 015 Familiarization Training Plan CDRL 016 Training Materials CDRL 017 Training Delivery

3.3.2 Systems Administrator Familiarization Training & Other Trainings for User Tupes The Contractor must familiarize selected FAA personnel in administering using the system. The familiarization training will be provided on-site, and must be coordinated with workstation delivery and installation at each site.

4 Data Ownership, Privacy and Governance All data processed, stored, or transmitted on this system must reside exclusively within the continental United States (CONUS) in dedicated federal cloud data centers.

The contractor must assist the agency in extracting data to comply with Freedom of Information Act (FOIA) requests and National Archives and Records Administration (NARA) federal records schedules.

Upon contract expiration or termination, the contractor must deliver a complete, unencrypted copy of all government data in a machine-readable format (e.g., JSON, SQL, or CSV) within 30 days of contract expiration or termination

All references to days indicate Government workdays, unless otherwise noted. Documents submitted by the Contractor must be editable by the Government and be produced using versions of software the FAA currently uses (e.g. MS Office), unless otherwise approved by the FAA COR.

3 Deliverables The required deliverables are listed in the schedule below. Abbreviations used in this schedule:

• NLT = Not Later Than

• IAW = In accordance with

All references to days indicate Government workdays, unless otherwise noted. Documents submitted by the Contractor must be editable by the Government and be produced using versions of software the FAA currently uses (e.g. MS Office), unless otherwise approved by the FAA COR.

CDRL Deliverable Title Section Completion Date 001 Management Plan (MP) 3.1 • Initial MP NLT 10 business days following the kickoff meeting

• MP updates, as required

002 Project Schedule 3.1 • Initial Project SChedule NLT 30 business days

• Schedule updates, as changes to the b li

003 Financial Technical Report 3.1 5th of each month 004 Project Status Reports 3.1 5th of each month 005 Quality Assurance Plan 3.1 15 days post award

006 Meeting Agenda 3.1 3 business days prior to meeting

007 Meeting Presentation Materials 3.1 3 business days prior to meeting 008 Meeting Minutes and Action

Items

3.1 4 business days post meeting

009 Technical & Information Security Documentation in support of the system FAA’s Authority to Operate (ATO) and Annual Assessments

2, 3.1 IAW the approved PMP, Annually after initial ATO is obtained

010 Requirements Sign-Off 3.2 30 days post award 011 System Architecture Design 3.2 IAW the approved PMP 012 Software Environment and

System Integration

3.2 IAW the approved PMP

013 User Acceptance Testing (UAT) Sign Off

3.2 IAW the approved PMP

014 Operational SaaS solution 3.2 IAW the approved PMP 015 Familiarization Training Plan 3.3 60 days prior to initial soft launch 016 Training Materials 3.3 IAW the approved PMP 017 Training Delivery 3.3 IAW the approved PMP