Performance Work Statement VehicleTracking 07012011 MLF.pdf

ATTACHMENT 1

Statement of Work

Title: On-Board Equipment and Tracking Services for Trucks Participating in the U.S./Mexico Cross-Border Trucking Pilot Program

Requiring Activity Name: Federal Motor Carrier Safety Administration (FMCSA), MC-ESB (North

American Borders Division)

1.0 SCOPE

This performance work statement (PWS) specifies the requirements for providing integrated location tracking and hours-of-service recording for power units in the U.S./Mexico Cross- Border Trucking Pilot Program. For the purpose of this document, a power unit is defined as a single-unit truck or truck-tractor.

A key element of this work statement is the installation and technical support for integrated tracking devices to be installed in each power unit designated by FMCSA for inclusion in the Program. The devices must be capable of near-real time tracking of the geographic location1 of each power unit in which it is installed, as well as recording and providing records of duty status for hours-of-service (HOS) compliance monitoring.

This work statement is being advertised by FMCSA Office of Enforcement and Program Delivery, located at 1200 New Jersey Avenue, Washington, DC 20590. Unless specifically stated otherwise, the Contractor shall furnish all necessary materials, equipment, and personnel to perform services as required to complete the tasks described herein.

1.0.1 Background

The Program activities are being conducted to gather data and information relevant to potential phased-in access to the United States interior (i.e., beyond the U.S.-Mexico border commercial zones) to Mexico-domiciled motor carriers engaged in international transportation. After completing an application process, Mexico-domiciled are required to identify specific power units and specific drivers assigned to “long-haul” operations crossing into the United States and Mexico, respectively.

1 These location-tracking devices are commonly called “GPS devices” because many of them use the Global Positioning System (GPS) satellite array. However, some systems use a combination of GPS satellites and other methods to locate the vehicles or objects upon which the devices are installed.

1.0.2 Objectives

1. Provide near-real-time tracking of the location of all power units participating in the

Program. The near-real time tracking of the power unit location will be used to monitor cabotage (point-to-point transportation) of participating motor carriers and to measure distances of travel for each carrier and each power unit.

2. Provide duty status of each driver to include all on-duty driving, on-duty not driving, off-duty, and sleeper-berth time to enable monitoring of each driver’s compliance with the hours-of-service regulations,

3. Document the times and locations of all border crossings between Mexico and the U.S., and the U.S. and Canada, of participating motor carriers.

4. Collect detailed data (including total miles traveled for each power unit ) related to Mexican motor carrier operations within the United States and near borders for later analysis by FMCSA related to the safety of these operations.

5. Provide advance notice to Federal inspectors of when a participating power unit is approaching a predetermined border inspection location.

1.1 Non-Personal Services

This requirement has been reviewed and contains only non-personal services.

1.2 Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

2..2 REQUIREMENTS

2.1 Task Management

The Contractor shall provide sufficient management to ensure that this task is performed efficiently, reliably, on time and in compliance with the requirements of this document.

Specifically, the Contractor shall designate a single project manager to oversee this task, supervise staff assigned to this task, and to communicate with the FMCSA Contracting Officer’s Technical Representative (COTR) on all matters.

2.1.1 Monthly Progress Report (MPR)

The Contractor shall ensure that a MPR is submitted to the COTR outlining expenditures, billings, progress, status, any problems (or issues) encountered (or anticipated) in the performance of this statement of work. The MPR shall include number of tracking devices and other assets (such as servers) installed; description of trainings performed; summary of meetings attended; and recapitulation of travel taken. The Contractor shall require all subContractors to provide input to the MPR where there are critical or significant tasks related to the prime contract. The MPR is due no later than the 15th of the month following the month being reported.

2.1.2 SubContractor Expenditures Plan

The Contractor shall prepare and deliver a Subcontract Expenditures Report that discloses actual subcontract expenditures by company name, business size standard (e.g., Woman Owned Business and Veteran Owned Business.) and other socioeconomic programs (e.g., Indian Incentive Program, Historically Black Colleges and Universities, and Minority Institutions).

2.1.3 Work Breakdown Structure (WBS)

The Contractor shall provide a tailored WBS to this SOW.

2.1.4 Program Management Plan

The Contractor shall develop a Program Management Plan that shall be approved by the COTR approval before work proceeds. It will be used to manage, track, and evaluate the Contractor’s performance. The Program Management Plan shall consist of control policies and procedures in accordance with standard industry practices for project administration and tracking.

The Program Management Plan shall include the following:

• Identification of milestones where Government information/activity is required and timeline dependencies for subsequent Contractor activities,

• An Integrated Master Management Plan (IMMP) describing the Contractor’s overall management approaches, policies, and procedures including suggested performance metrics, and

• A detailed staffing plan.

The Contractor shall submit the Program Management Plan to the COTR no later than fifteen

(15) days after the contract award.

2.1.5 Quality Control Plan

The Contractor shall prepare and adhere to a Quality Control Plan (QCP). The Contractor must submit its initial QCP with the proposal. The QCP shall document how the Contractor will meet and comply with the acceptable quality levels. At a minimum, the QCP shall include a self-inspection plan, an internal staffing plan, and an outline of procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in the SOW.

2.2 Specific Tasks

2.2.1 Project Implementation Plan and Meetings

The Contractor shall provide a detailed project implementation plan. The project implementation plan must be designed to frame project goals and present the project schedule and timelines (including the schedule in Section 4.6) which outlines specific tasks necessary in delivering the services. The Project Implementation Plan may be changed or upgraded as required; the COTR must provide written approval before the Contractor implements any changes or upgrades to the Project Implementation Plan.

The Contractor shall discuss the project implementation plan at a kick-off meeting with the COTR, held in person at an FMCSA site to be specified. Because travel costs are variable, there will be separate cost reimbursement for Contractor’s travel to/from the kick-off meeting (and other meetings required with the COTR) in accordance with Federal Travel Regulations. The COTR will arrange for the FMCSA Information System Security Officer (ISSO) to attend the meeting to discuss the FMCSA Rules of Behavior (see Section 2.2.9)(the Contractor must understand and sign the FMCSA Rules of Behavior). The ISSO will also explain the information technology security requirements for privacy and data handling.

The Contractor shall also conduct bi-weekly status meetings via conference call during the equipment installation phase with the COTR and other Government personnel as designated by the COTR to discuss work progress. Additional meetings may be deemed necessary by the COTR, and may be suggested by the Contractor. The Contractor shall provide insight into potential cost changes, schedule impacts, and performance risks and detail such activities in the written monthly progress reports.

2.2.2 Provide Equipment

The Contractor shall provide equipment (integrated GPS-enabled location-tracking devices, which includes hardware, software, transmitter, and receiver) for installation in a minimum of 100 and a maximum of 500 power units for purchase or lease. The contractor shall submit pricing for the purchase and/or lease arrangement. The contract will be for 100 each with options to purchase the additional 400 in quantities of 5 each. The integrated tracking devices shall meet the following requirements:

• Each device must have a unique alphanumeric identifier, which may be the device serial number.

• The device shall comply with either (i) the electronic on-board recorder requirements of 49 CFR 395.16 or (ii) automatic on-board recording device requirements of 49 CFR

395.15 and 75 FR 32860.

• All components used in, and to support, the device must be resistant to moisture, temperature extremes, and shock and vibration consistent with industry standards for commercial-grade portable electronic devices. All on-vehicle components (e.g., antenna) installed external to the cab of a power unit must be weather resistant.

• The in-cab data entry and display unit of the device must be easily mountable within or in close proximity to the instrument panel on a standard power unit (straight truck or truck tractor). The mounted in-cab unit must not block access to vehicle controls and must not block the driver’s view through the windshield or the side windows of the cab.

• The Contractor must provide the frame, brackets, or other mounting devices necessary to install the in-cab data entry and display unit. Once a power unit has been approved for the program, the COTR will notify the vendor of the power unit information.

• The Contractor’s system shall be able to detect the functionality of the device by “pinging” or “prompting” the device to see if it responds or not.

• The Contractor shall provide a wired or wireless interface between the device and the engine control module so that the device and the engine control module are integrally synchronized (see 49 CFR 395.2).

• The Contractor shall provide a Return Policy Agreement to accept unused / unopened integrated tracking devices, antennas, applications software, terminals, frames and other equipment supplied as part of this procurement.

2.2.3 Installation of Tracking Devices

The Contractor will install the procured tracking devices in the power units participating in the pilot program. The COTR will provide a list of the power units and the locations of where the tracking devices are to be installed in the power units. The Contractor shall have a combination of mobile installation capability and fixed service center installation capability. Furthermore, the Contractor may use an authorized representative, franchise dealer to perform either mobile or fixed service center installations.

Capability for installation must be at or near the U.S.-Mexican border, areas having limited federal logistics and/or support, upon contract award. In particular, locations of installations are anticipated to be at in and around the seven (7) major points of entry (Laredo, El Paso, Nogales, Calexico, Brownsville, Eagle Pass, and San Diego), or other locations approved by FMCSA, including motor carrier locations within the bordering United Mexican States (e.g., Sonora, Chihuahua, Coahuila, Nuevo Leon, Tamaulipas, and the Baja California Norte).

All requests for installation of equipment associated with the performance of this contract shall be coordinated between FMCSA, the Contractor, and the motor carriers in the Program. The Government must approve all installation facilities/centers prior to any installations. Installation shall occur within 5 days of Contractor’s receipt of notice from FMCSA that power units planning to participate in the Program will be within proximity of designated border locations. The Contractor shall provide an estimate of installation date for all installation locations. FMCSA reserves the right to assign personnel to be present in order to observe, inspect, and accept or reject an installation.

The Contractor shall ensure that the engine control module is integrally synchronized (wired or wirelessly – see 49 CFR 395.2) with the tracking device.

The Contractor shall price each installation on a fixed cost per-vehicle basis, including mounting the in-cab device, wiring, affixing the antenna, connecting the engine control module with the in-cab module, providing individual training to the driver (see Section 2.2.12), and getting the driver (or the owner/operator) to sign an acknowledgement (see “Installation of Tracking Device” in the table in Section 6.6.2). Because travel costs are variable, there will be separate cost reimbursement for travel to/from an installation location in accordance with Federal Travel Regulations.

2.2.4 Data Services

With the tracking devices installed in power units described above, the Contractor shall provide hosting facilities, equipment (including hardware, software, communications and security), and proposed information technology services and methods used to collect and process the data and generate displays, reports, and maps in the format specified in the table below.

The Contractor shall provide real-time on-line resource displaying required information via graphical user interface, accessible to exclusive members of FMCSA project team or supporting staff. The Contractor shall grant access (via userid and password) to the on-line resource to persons identified on a list authorized by the COTR. Changes to the access list must be authorized by COTR prior to granting access to information or on-line resources.

The Contractor shall utilize the applicable mandates and standards from The Office of Management and Budget (http://www.whitehouse.gov/omb/memoranda), and the 800-Series of Special Publications from the National Institute of Standards and Technology (NIST) (http://crsc.nist.gov/index.html) in the development, maintenance, modernization and operations of information technology assets and programs. For more detailed security requirements, see the section 2.2.9 on “Information Technology Security.”

The Contractor may consult with the FMCSA Information System Security Officer (ISSO) for guidance on the applicability of information system security requirements and that are not herein identified.

Within 30 days of contract award, the Contractor shall develop and provide to COTR, a Technical Project Architectural Design Plan showing how the capabilities to be provided in the table below fit into Contractor’s overall system architecture.

Contractor must provide the services and data elements required in table 1.

Table 1: Services and Data Requirements Table

Data

Data Requirements

Capability to provide an inventory of tracking devices

Purpose: to maintain a record of each tracking device and vehicle on which it is installed and to account for all devices at time of de-installation upon Program termination

Table containing the following:

• Unique identifier for each device

• Vehicle Identification Number of power unit on which device is installed

• License number of power unit

• Make and model of power unit

• Motor carrier identifier

Data format must be compatible with MS Excel, comma-delimited files, and fixed field flat files and must be posted on a hosting site accessible on the web.

Capability to provide data on near-real time location of all vehicles in the program within:

• 48 contiguous states and Alaska,

• Canada (while en-route between

Alaska and the 48 contiguous states) and

• United Mexican States

Purpose: to enable cabotage monitoring

Record data at least every 3 minutes in the on-board device.

Transmit data at least every 30 minutes when vehicle is outside a commercial zone.

Transmit data at least every 5 minutes when vehicle is inside a commercial zone plus a buffer zone.

“Commercial zone” as is defined in 49 CFR 372.237

There must be a graphical user interface display (map) with a zoom in/out capability showing travel path (“electronic breadcrumbs”) with origin (time or location) selectable by user and with duration selectable by user and on a base map meeting requirements below (see “Base Map” in this table below)

Data format must be compatible with MS Excel, comma-delimited files, and fixed field flat files and must be posted on a hosting site accessible on the web.

User must be able to download data in form of map as described above or in form of multiple tables with user-selected fields

Capability to provide data on duty status of every driver of a vehicle in the Program

Data format must be compatible with MS Excel, comma-delimited files, and fixed field including status of driving (driving or non-driving as determined by engine control module) and status of non-driving (on-duty, off-duty, or sleeper berth) as entered by the driver.

Purpose: to enable inspectors to verify and download driver’s compliance with hours of service regulations, print out a record at time and place of inspection

User must be able to download current day and previous seven days record of duty status for all drivers in the pilot program with the data in table format or in a grid format.

Times/locations of all U.S.-Mexico border crossings of all vehicles in the program

Purpose: to enable inspectors to create and print reports recording time and location of all border crossings of all vehicles in the program

Data format must be compatible with MS Excel, comma-delimited files, and fixed field

Capability to provide data on aggregated mileage data

Purpose: to enable calculation of crash rates and hours of driving to allow inspector to support inferences about safety.

Multiple tables for aggregated mileage for all power units in pilot program and all motor carriers in pilot program sorted by:

Miles driven in U.S.

Miles driven within individual U.S. States Miles driven in Canada Miles driven in Mexico Total miles and for whatever time period selected by user but no earlier since the installation of tracking device.

Data format must be compatible with MS Excel, comma-delimited files, and fixed field

Capability to provide advance notice of when a vehicle in the Program is approaching from

Alert (see Section on “Alerts” separately) and transmit by e-mail or text message to the

(either North or South) within at least one mile of pre-determined border inspection location with the following information:

Purpose: to prepare personnel with appropriate background information to conduct a safety inspection of a vehicle in the pilot program appropriate border inspection location data on the following:

Motor carrier Vehicle ID Driver ID

Capability to provide data on number of times a motor carrier or a power unit in the Program traveled beyond the border of a commercial zone since device installed

Record for all motor carriers and all power units in the Program.

Data may be in multiple tabular formats but must be compatible with MS Excel, comma-delimited files, and fixed-field flat files.

Capability to provide geofencing data

Purpose: to enable alerts of the approach of a power unit to designated inspection station and entry and exit from commercial zones based on standard features available to and defined by the user

Recording and transmitting of data is the same as the data for “Near-real time location of all vehicles in the Program” (see above in this table).

In addition, record time and location whenever vehicle crosses a geofence boundary (proximity to inspection station at or near U.S.

Mexico border).

See the Section on Alerts

Capability to provide a base map

Roads, limited access highways, and topography (including rivers, lakes, mountains, political boundaries and commercial boundaries).

Must be viewable in contrasting colors or actual depiction (satellite imagery)

Capability to generate reports

Purpose: to enable FMCSA to develop and utilize standard and ad hoc management reports for the Program.

The Contractor will provide support to FMCSA on the development of standard and ad hoc reports.

Data for reports must summarize the activities of motor carriers, drivers, and power units both on an individual and aggregate basis. Reports to be MS Excel format

2.2.5 Data Storage

The Contractor shall provide the facilities, equipment, hardware, software, and services necessary to store and provide to FMCSA all vehicle data (100 to 500 power units) collected during the period of performance of the contract. All vehicle data shall be available on-line during the period of performance of the contract.

The vehicle tracking data collected and stored shall be transferred to FMCSA or its designee in an encrypted electronic format capable of being easily imported into a relational database for further analysis by FMCSA at monthly intervals during the period of performance of the contract. If data delivery more frequent than monthly intervals is required, the COTR shall notify the Contractor 5 business days prior to the delivery due date.

FMCSA will be the owner of all data collected by the devices and stored on an information storage and retrieval system. The Contractor shall ensure that all collected data is backed up on separate and secure information storage and retrieval system that is off-site.

Contractor shall develop a comprehensive information system contingency plan in accordance with NIST SP 800-34, Contingency Planning Guide for Information Technology Systems, documenting interim measures to recover information technology (IT) services including data following an emergency or system disruption. Interim measures may include the relocation of IT systems and operations to an alternate site, the recovery of IT functions using alternate equipment, or the performance of IT functions using manual methods.

No later than 30 days before contract termination, the Contractor shall archive all data collected but not previously delivered to FMCSA and deliver the archived data to FMCSA.

2.2.6 Alerts

The Contractor shall provide an automated system for sending alerts via e-mail and telephony to U.S. Government, and others authorized by the COTR. The individuals receiving the alerts will include border inspectors, field supervisors, and headquarters staff of both the U.S. Government and Mexican Government. Alerts shall be transmitted under the following conditions:

• Alert ( to individuals as designated by the COTR when a power unit approaches within one mile or otherwise specified distance of a pre-determined inspection station and provide data (see data table above) [COTR shall provide a list of pre-determined inspection stations and their telephone and to the Contractor]

The Contractor shall provide the capability to send optional alerts at the discretion of an authorized user. Optional alerts shall be sent via e-mail or telephony to the authorized user and other officials designated by the COTR or the authorized user. Optional alerts shall be transmitted under the following conditions when any of the following optional alert features is selected by the user:

• Alert (to user only and any individuals designated by the user) when a power unit crosses a geofence boundary.

• Alert when a power unit crosses a commercial boundary.

2.2.7 Reports

The Contractor shall provide support to FMCSA on the development of standard and ad hoc management reports. Reports must summarize the data on motor carrier, power units and drivers both individual and in aggregate. The COTR shall provide a list of desired standard management reports, which shall include, but is not limited to:

• Vehicle miles traveled;

• Hours-of-service violation;

• Border and Commercial Zone Crossing summaries;

• Suspected cabotage

The Contractor shall provide support to the COTR or any user authorized by the COTR on the development of ad hoc reports. Additionally, the Contractor shall provide a data dictionary that describes the value and meaning of all query-able data elements.

2.2.8 Cabotage

Cabotage is the domestic point-to-point transportation of goods by a foreign motor carrier.

Foreign motor carriers are prohibited from engaging in cabotage. The Contractor shall assist FMCSA in developing a methodology for discovering patterns of activity which could indicate a Mexico-domiciled motor carrier is engaged in cabotage. The COTR will provide a list of FMCSA personnel that the Contractor may contact to develop this methodology. The Contractor shall aid in the development of detection tool reports but not in the actual detection of cabotage.

2.2.9 Information Technology Security

After award of contract, there will be a kick-off meeting where the requirements for IT Security, Privacy and data handling will be further discussed. Security requirements of Contractor’s network and application will be based on implementation plans for meeting the statement of work requirements.

The Contractor shall include these requirements in any subcontract awarded involving access to DOT/FMCSA facilities, sensitive information and/or resources.

Definition of Information Technology (IT): IT means any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information and as further defined in Office of Management and Budget (OMB) Circular A-130 and the Federal Acquisition Regulation Part 2.

Contractor Responsibility: The Contractor shall be responsible for complying with the Federal Information Security Standards for all systems operated by the Contractor or subContractor to support the U.S.-Mexico Cross Border Trucking Program, regardless of location of the system.

This includes any IT resources or services where the Contractor has physical or electronic access to DOT’s sensitive information which directly supports DOT’s mission.

Federal Information Security Standards:

The minimum security requirements cover seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of Federal information systems and the information processed, stored, and transmitted by those systems. The security-related areas include:

(i) access control;

(ii) awareness and training;

(iii) audit and accountability;

(iv) certification, accreditation, and security assessments;

(v) configuration management;

(vi) contingency planning;

(vii) identification and authentication;

(viii) incident response;

(ix) maintenance;

(x) media protection;

(xi) physical and environmental protection;

(xii) planning;

(xiii) personnel security;

(xiv) risk assessment;

(xv) systems and services acquisition;

(xvi) system and communications protection; and

(xvii) system and information integrity.

The seventeen areas represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting federal information and information systems.

The Contractor shall ensure that information systems and facility is operated in accordance with the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. §3541, et seq.

Federal information security requirements are documented in Federal Information Processing Standards (FIPS) 200 Minimum Security Requirements for Federal Information and Information Systems.

The Contractor shall utilize the applicable mandates and standards from The Office of Management and Budget (http://www.whitehouse.gov/omb/memoranda), the Privacy Act of 1974, the E-Government Act of 2002, the 800-Series of Special Publications and the Federal Information Processing Standards (FIPS) from the National Institute of Standards and Technology (NIST) (http://crsc.nist.gov/index.html) in the development, maintenance, modernization and operations of information technology assets and programs. Publications used for guidance include, but are not limited to, OMB Memoranda

M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information M-06-16, Protection of Sensitive Agency Information M-06-15, Safeguarding Personally Identifiable Information M-06-19, Reporting Incidents Involving Personally Identifiable Information Incorporating the Cost for Security in Agency Information Technology Investments

Federal Information Processing Standards (FIPS)

FIPS 200 Minimum Security Requirements for Federal Information and Information Systems FIPS 199 Standards for Security Categorization of Federal Information and Information Systems FIPS 140-2; Security Requirements for Cryptographic Modules

National Institute of Standards and Technology

SP 800-18 Guide for Developing Security Plans for Federal Information Systems SP 800-34, Contingency Planning Guide for Information Technology Systems;

SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems http://www.whitehouse.gov/omb/memoranda� http://crsc.nist.gov/index.html�

SP 800-53, Recommended Security Controls for Federal Information Systems;

SP 800-53A Guide for Assessing the Security Controls in Federal Information Systems SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories SP 800-61 Computer Security Incident Handling Guide SP 800-64, Security Considerations for the Information System Development Life Cycle SP NIST 800-122 Guide to Protecting the Confidentiality of Personal Identifiable Information

The Contractor(s) may consult with the FMCSA Information System Security Officer (ISSO) for guidance on the applicability of these and other publications in these series not herein identified.

IT Security Plan:

The Contractor shall develop, provide, implement, and maintain an IT Security Plan. Within 30 days of contract award, the Contractor shall develop and provide to COTR, an IT Security Plan which describes the processes and procedures the Contractor will utilize to ensure the appropriate security of IT resources developed, processed, or used under this contract. This Plan shall be written and implemented in accordance with NIST SP 800-18, Guide for Developing Security Plans for Information Technology System. Each applicable security control must be identified as either in place, planned or not applicable.

Security Site Assessment:

The Contractor shall work with the COTR and FMCSA ISSO to perform a physical site assessment of the Contractor’s facility in accordance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Recommended Security Controls for Federal Information System.

Independent Security Controls Assessment (Certification and Accreditation)

Within 6 months after contract award, the Contractor shall submit independent IT Security Control assessment report and supporting artifacts (Certification Package) in accordance with NIST SP 800-37 Guide for the Security Certification and Accreditation of Federal Information Systems, to the FMCSA for acceptance by the FMCSA Contracting Officer. This certification package will include a final security plan, risk assessment, security test and evaluation, disaster recovery plan/continuity of operations plan and a Plan of Action and Milestones (POA&M). This information, when accepted by the Contracting Officer, shall be incorporated into the contract as compliance documentation, and shall include a final security plan, a risk assessment, security test and evaluation, and disaster recovery/continuity of operations plan. The Contractor shall comply with the accepted plans and schedules documented within.

Annual Self-assessment of the system:

The Contractor must conduct a review of security controls in accordance with NIST SP 800-53 annually. A complete copy of the security controls review will be provided to FMCSA Information System Security Officer (ISSO) for review, comment, and recommendation.

Continuity of Operations Planning (COOP)/Disaster Recovery (DR)

The Contractor shall ensure the availability of FMCSA’s operations as described in this performance work statement. The Contractor shall ensure the COOP and DR materials are maintained in compliance with applicable regulations.

Incident Response Program

Contractor shall implement an incident response program to work in concert with FMCSA, DOT and Department of Homeland Security, i.e., United States Computer Emergency Readiness Team (US CERT) requirements. The Contractor shall report all incidents (confirmed or suspected) involving FMCSA data electronic and physical form to the FMCSA COTR, FMCSA ISSO or DOT Cyber Security Management Center within one hour of discovering the incident.

Security Awareness

DOT Contractors are required to take the annual Security Awareness Training course. The Security Awareness training is given online with the address supplied by the Contract Technical Representative (COTR).

Contractor Employee Report

FMCSA requires the Contractor to provide a current listing of all employees with access to FMCSA resources. This report shall be provided to the COTR as requested.

FMCSA Rules of Behavior

All Contractors are required to read, understand, and sign/acknowledge FMCSA Rules of Behavior (RoB) prior to being allowed access to FMCSA data. The RoB will be supplied to the Contractor by the Contract Technical Representative (COTR).

2.2.10 Interface and System Requirements

The Contractor shall provide a system interface in English that is web-based. Access to the system interface shall use 128 Secure Socket Layer (SSL) encryption. The system interface must be multi-browser compatible and specifically functional using Internet Explorer.

The system interface and back office infrastructure will not require integration into other FMCSA information systems.

The Contractor shall provide a cost estimate for an optional system interface in Spanish.

2.2.11 Training

The Contractor shall produce a video in DVD format and post a video recording accessible on the web to provide each type of training described below, namely, to drivers, motor carrier staff, FMCSA inspectors, FMCSA investigators, and Mexican Government staff. The video in DVD format and video recording accessible on the web shall allow the user to choose either Spanish or English for the language. The Contractor may be requested by the COTR to provide either in-person or classroom training for any of the targeted audiences in addition to any that are specified below in this section; for in-person or classroom trainings, the COTR will furnish the number of students, location, date and time, and language that the training is to be offered.

Because travel costs are variable, there will be separate cost reimbursement in accordance with Federal Travel Regulations for travel to/from a classroom location requested by and pre-approved by the COTR

Drivers:

The Contractor shall provide training targeted to the drivers on the proper usage of the tracking device. This training shall be on video format in DVD posted on the web and will also be provided in-person to the driver of each power unit after installing the tracking device on the power unit. This training shall cover how to input a change in duty status and how to report a malfunctioning device. The Contractor shall summarize all key points of the training and provide a toll-free number (see Section 2.2.12, Call Center below) to report malfunctions and other inquiries in written materials to be left with the drivers (or motor carrier staff for distribution to the drivers) after each installation. The written materials must be in the same language as the training. The language for the in-person training shall be in Spanish for Mexico-domiciled carriers. FMCSA personnel shall be allowed to observe any in-person training of drivers after a tracking device is installed on the driver’s power unit.

Motor carrier staff:

The Contractor shall provide training via DVD or web based targeted to the motor carrier staff on the proper usage of the tracking device (same as above for the driver) and on the user interface (i.e., how to track their power units). The Contractor shall summarize all key points and provide a toll-free number for technical assistance or other inquiries in written materials. The written materials must be in the same language as the training. Copies of the written materials shall be transmitted to the motor carrier staff. The language for the training shall be in Spanish for Mexico-domiciled carriers.

FMCSA inspection staff:

The Contractor shall provide two classroom training sessions (for bidding purposes assume: one in San Diego, CA and one in Austin, TX) targeted for inspector-supervisors (oversight and program staff may attend). The Contractor will provide training on the devices and on the user interface. The Contractor will explain how the driver uses the tracking device. The Contractor will explain the user interface, specifically on how to receive alerts, generate reports, download data tables (see Section on “Data” above), what the record of duty status and hours-of-service reports look like, and how to detect signs of tampering. These trainings will be in English. The Contractor shall provide all student training materials, including manuals and examples of reports, data output, tables, and maps in English.

FMCSA investigative staff:

The Contractor shall provide two classroom trainings (for bidding purposes assume: one in San Diego, CA and one in Austin, TX) targeted for investigator-supervisors (oversight and program staff may attend). The Contractor will explain how the tracking devices operate. The Contractor will explain the user interface, specifically on how to track vehicles and generate reports (standard and ad hoc) and maps, download data tables (e.g., mileage, border crossings, stops en route), and use of the geofencing feature and optional alert features. These trainings will be in English. The Contractor shall provide all student training materials, including manuals and examples of reports, data output, tables, and maps in English.

Mexican Government officials:

The Contractor shall provide training on the devices and on the user interface targeted for Mexican officials. The Contractor will explain how the tracking devices operate. The Contractor will explain the user interface, specifically on how to track vehicles and generate reports (standard and ad hoc) and maps, download data tables (e.g., mileage, border crossings, stops en route), and use of the geofencing feature and optional alert features. The training will be in Spanish recorded in video in DVD format and posted on the web. The Contractor shall also price one classroom training in case classroom training is requested.

The training price estimate must include travel as a separate item. Because travel costs are variable, there will be separate cost reimbursement for travel to/from a training location in accordance with Federal Travel Regulations.

2.2.12 Repair and Servicing

Call Center: The Contractor shall provide a toll-free number and staff a call center, 24 hours per day, 7 days per week from the date of first installation of a tracking device to the termination of this contract for answering inquiries, receiving reports of malfunctioning devices, and providing technical assistance. The staff shall be bilingual in English and Spanish. The staff shall include at least one person available on-call 24 hours per day, 7 days per week capable of interpreting/translating technical engineering material regarding the tracking device technology between English and Spanish. The toll-free number shall be accessible from both the U.S. and Mexico; if a single toll free number is not feasible, then separate toll-free numbers shall be made available for calls from the U.S. and Mexico. The toll-free number(s) shall be included and must be readily visible in the written materials provided to drivers and motor carrier staff. The users of the call center will be FMCSA officials, Mexican Government officials, and motor carrier staff and drivers participating in the pilot program.

Warranty Maintenance Support for Tracking Devices

The Contractor shall provide technical and maintenance support of all integrated tracking devices and associated software for the power units participating in the program during the warranty period. The Contractor shall maintain a stock of spare tracking devices and accessories on-hand available to replace any tracking device reported to have a malfunction during the warranty period. The Contractor shall perform any repairs covered by the warranty in accordance with the terms and conditions of the warranty. If the power unit with the malfunctioning tracking device is not brought to an authorized representative or franchised reseller trained and authorized by the Contractor for service, repair, or replacement, the Contractor may invoice FMCSA for travel required by the COTR to a vehicle to service, repair, or replace a malfunctioning tracking device.

Because travel costs are variable, there will be separate cost reimbursement for travel to/from a servicing location in accordance with Federal Travel Regulations.

Non-Warranty Maintenance Support for Tracking Devices

The Contractor shall provide technical and maintenance support of all integrated tracking devices and associated software for the power units participating in the program outside of the warranty period during the period of performance of this contract. The Contractor shall maintain a stock of spare tracking devices and accessories on-hand available to replace any tracking device reported to have a malfunction.

The Contractor shall have a combination of mobile servicing capability and fixed service center capability. Furthermore, the Contractor may use an authorized representative, franchise reseller trained and authorized by the Contractor to perform either mobile or fixed service center servicing. The Contractor may use the same personnel (specified in the Section, “Installation of Tracking Devices”) who install the devices to provide servicing. If the power unit with a malfunctioning tracking device is unable (or it is impractical for the power unit to come to) at a fixed service center, the Contractor shall have a mobile servicing representative available for response. If the power unit is from a Mexico-domiciled motor carrier, then the responding mobile servicing representative must speak Spanish.

Travel for the mobile servicing representative to replace or repair a malfunctioning tracking device must be approved in advance by the COTR. Because travel costs are variable, there will be separate cost reimbursement for travel to/from a servicing location in accordance with Federal Travel Regulations.

Maintenance for User Interface: The Contractor shall also provide technical and maintenance support 24 hours per day, 7 days per week, for all facilities, equipment, hardware and software required for operation of the hosting site to which authorized users may access and download the data, tables, reports, and maps generated by the collected data.

2.2.13 De-Installation

The Contractor shall provide an inventory of, plan for and schedule for de-installing and transferring (to FMCSA) all Government-paid for assets, including equipment, hardware, software, and data generated or collected for the Government during the period of performance of this SOW. The plan may allow for abandonment of an asset in the event that the asset is obsolete or its value is equal to or less than the cost of de-installation (including travel expenses).

If the asset is not abandoned, the Contractor shall price the de-installation of tracking devices on vehicles based on a fixed cost per-vehicle (one for U.S. locations and another for Mexico locations), including dismounting the device, removing wiring, detaching the antenna, and disconnecting the engine control module from the tracking system. The Contractor shall plug any openings in sheet metal surfaces.

Because travel costs are variable, there will be separate cost reimbursement for travel to/from a de-installation location in accordance with Federal Travel Regulations. The de-installation cost per vehicle shall include the costs for physical cleaning, packaging, and shipping to a location in the United States (presumably at or near Washington, DC).

In particular, locations of de-installations are anticipated to be at, in, or around the seven (7) major points of entry (Laredo, El Paso, Nogales, Calexico, Brownsville, Eagle Pass, and San Diego), or other locations approved by FMCSA, including motor carriers locations within the bordering United Mexican States (e.g., Sonora, Chihuahua, Coahuila, Nuevo Leon, Tamaulipas, and Baja California Norte).

3.0 INSPECTION AND ACCEPTANCE

The COTR is a Government official who has been delegated specific technical, functional, and oversight responsibilities for this contract. The COTR is designated in the COTR appointment letter, issued by the Contracting Officer, and is responsible for inspection and acceptance of all services, incoming shipments, and documents. Installation of equipment is subject to observation and inspection by FMCSA personnel.

3.1 Acceptance Criteria

3.2 Contractor Payment Processing – Invoice Instructions

3.3 Invoice Review

Invoice review and approval process to be in accordance with instructions

4 DELIVERABLES

4.0 DELIVERABLES – See Delivery Schedule

4.1 Delivery Address

Locations of installations are anticipated to be at in and around the seven (7) major points of entry (Laredo, El Paso, Nogales, Calexico, Brownsville, Eagle Pass, and San Diego), or other locations approved by FMCSA, including motor carrier locations within the bordering United Mexican States (e.g., Sonora, Chihuahua, Coahuila, Nuevo Leon, Tamaulipas, and the Baja California Norte).

4.2 Method of Delivery

The Contractor shall make use of commercial best practices in the packing and shipment of packages, unless otherwise stated in this order.

4.3 Shipping

FOB: Destination

Items under this contract are to be shipped to point of installation in only quantities needed for planned installations. Contractor shall be required to hold tracking device units until COTR provide schedule of installations.

4.4 Government Acceptance Period

In accordance with GSA contract terms and conditions

4.5 Delivery Schedule Abbreviations

Abbreviation Definition CO Contracting Officer COTR Contracting Officer’s Technical Representative DA Days (calendar) After DACA Days (calendar) After Contract Award E Electronic Copy H Hard Copy ISSO Information System Security Officer (FMCSA) NLT No Later Than PWS Performance Work Statement

4.6 Deliverable/Delivery Schedule

Delive-rable

PWS

Refer-

Title Distri-bution

E H Initial Subsequent ence

1 2.1.1 Monthly Progress Report COTR 1 0 NLT 45

DACA

NLT 15th of each month

2 2.1.2

Subcontract Expenditures Report

CO

COTR

NLT 90

DACA

Quarterly thereafter. A final submission for all such expenditures due one week after contract termination

3 2.1.3 Work Breakdown Structure

COTR 1 0 NLT 15

DACA

4 2.1.5 Program Management Plan

COTR 1 1 NLT 15

5 2.1.6

Quality Control Plan COTR 1 1 NLT 15

DACA

Submit revised plan as necessary after review by COTR; due date mutually agreed upon

6 2.2.1

Project Implementation Plan

COTR 1 1 NLT 15

DACA

Submit revised plan as necessary or requested; due date mutually agreed upon

7 2.2.1 Kick-off meeting at an FMCSA Office

CO

COTR

0 0 NLT 5

8 2.2.1 Bi-weekly status meetings via conference call

COTR 0 0 Date/time to be mutually agreed upon

Date/time to be mutually agreed upon

9 2.2.2

Procurement of equipment

Power unit

0 0 Twenty (20) initial units available

NLT 20

DACA

Coordinated with installation scheduling

10 2.2.3

Installation of Tracking Devices

Power Unit

0 0 Installation must occur within 5 days of receipt of notice from COTR that a power unit will be within proximity of a border location; Contractor must estimate date for installation for all other locations.

11 2.2.4 Technical Project Architectural Design Plan

COTR 1 1 NLT 30

12 2.2.4

Hosting site for data collected and generating tables, reports, and maps accessible by web

All author-ized users

0 0 In accord with Project Implementati on Plan

13 2.2.5

Archive all data collected and not previously delivered to FMCSA and deliver archived data to

FMCSA

COTR 1 0 NLT 30 days before contract termination

14 2.2.5

Ensure that all collected data is backed up on a separate and secure information storage and retrieval system

All authori -zed users

0 0 In accord with Project

15 2.2.6

Alerts All author-ized users

0 0 In accord with Project

16 2.2.7 Data Dictionary COTR 1 1 NLT 30

17 2.2.8 Development of a Cabotage Detection Methodology

COTR 1 1 Date/time to be mutually agreed upon

18 2.2.9

IT Security Plan COTR and

ISSO

1 1 NLT 60

DACA

Submit revised plan as necessary or requested; due date mutually agreed upon

19 2.2.9 Site Security Assessment COTR and

ISSO

1 1 Date/time to

20 2.2.9

Annual Self-Assessment and Security Controls Review document

COTR

and

ISSO

1 1 In accord with Project

21 2.2.9

Completion of annual, on-line DOT Security Awareness Training course

All Contra ctor emplo yees

0 0 Date/time to be determined by ISSO and communicate d by COTR

22 2.2.9 Contractor employee COTR 1 1 Date to be report (list of all employees with access to FMCSA resources) determined by COTR

23 2.2.9 Signed Rules of Behavior COTR and

ISSO

1 1 Kick-off meeting

24 2.2.11

Training Plan COTR 1 1 NLT 30

DACA

Submit revised plan as necessary or requested; due date mutually

25 2.2.11

Written materials for drivers and motor carrier fleets

COTR 1 1 NLT 25

DACA

Submit revised plan as necessary or requested; due date mutually agreed upon

26 2.2.11

Trainings for drivers Driver s

0 0 Coordinated with installation scheduling

Coordinated with installation scheduling

27 2.2.11 Two training sessions for FMCSA inspectors

Inspec-tion staff

0 0 NLT 25

28 2.2.11

Two training sessions for FMCSA investigators

Inves-tigativ e Staff

0 0 NLT 25

2-98 2.2.11

Trainings…