RFP__DTPH5617R00001.pdf

DTPH5617R00001

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

ORDER UNDER DPAS (15 CFR 700)

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP)

SEALED BID (IFB)

5. DATE ISSUED

1. THIS CONTRACT IS A RATED RATING PAGE OF PAGES

1 3

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRS., CONDS., AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECS./WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXT.NUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

12. In compliance with the above, the undersigned agrees, if this offer is accepted within ______________ calendar days (60 calendar days unless a different period is inserted

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 253 (c) ( 10 U.S.C. 2304 (c) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

07/14/2017 X

PHMSA PHA-30

Acquisition Services Division

US DOT/PHMSA/PHA-30

1200 New Jersey Avenue, SE E22-317 Washington DC 20590-0001

1200 EDT 08/14/2017

Ben Patterson Ben.Patterson@dot.gov

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

WARREN OSTERBERG

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (Rev. 9-97)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

1-2 B.1

C.1-19 D&E.1 D&E.1 F.1-2 G.1-4 H.1-4

I.1-9

J.1

K.1-16

L.1-6

M.1-4

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 3

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

DTPH5617R00001

(A) (B) (C) (D) (E) (F)

PLEASE DO NOT INCLUDE PRICE/COST INFORMAITON IN

THE SF33 WHEN RESPONDING TO THIS RFP.

***All questions regarding this RFP MUST BE

EMAILED to Ben Patterson (Ben.Patterson@dot.gov) with a copy to Mr. Warren Osterberg

(Warren.Osterberg@dot.gov). All questions must be received on or before Monday July 24, 2017 at

12:00 PM, Eastern Daylight Time (EDT).

***All proposals in response to this RFP MUST BE

EMAILED to Ben Patterson (Ben.Patterson@dot.gov) with a copy to Mr. Warren Osterberg

(Warren.Osterberg@dot.gov). All proposals must be received on or before August 14, 2017, at 12:00

PM Eastern Daylight Time (EDT).

FOB: Destination

00001 Firm Fixed Price (FFP) Item

*The Contractor shall perform Integrity

Management Support Services in accordance with

Section C, all applicable attachments, and the fully loaded labor rates in Section B. Specific requirements will be identified at individual task order level.

00002 Labor Hour (LH) Item

*The Contractor shall perform Integrity

Management Support Services in accordance with

Section C, all applicable attachments, and the fully loaded labor rates in Section B. Specific requirements will be identified at individual task order level.

Ceiling Value:

[To be filled in at the time of award]

00003 Travel Cost

Travel must be authorized by the Government and be in conformance with the contract requirements

***Travel will be performed and bill in accordance with FAR 31.205-46 Travel Costs.

Contractor may only bill for actual travel expenses incurred.

00004 Other Direct Costs (ODCs)

Continued ...

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 3

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

DTPH5617R00001

(A) (B) (C) (D) (E) (F)

The contractor shall execute all requirements for authorized ODCs in accordance with Section H and all applicable attachments. Specific requirements will be identified at individual task order level.

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

U.S. Department of Transportation Pipeline and Hazardous Materials Safety Administration

RFP: DTPH5617R00001 B-1

PART I – THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SERVICES

The Contractor must furnish all labor necessary to provide the services as set forth in Section C, Statement of Work.

B.2 REIMBURSEMENT OF COSTS

B.2.1 Allowable Costs For the performance of this contract, the Contractor will be reimbursed for direct and indirect costs incurred that are determined allowable per their indirect rate agreement.

B.2.2 Limitations Reimbursement of the direct and indirect costs will not exceed the contract amount, which is presently allowable and obligated under this contract, subject to FAR clause entitled LIMITATION OF COST (FAR 52.232-20) of Section I of this contract.

[END OF SECTION B]

RFP: DTPH5617R00001 Page C-1

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

INTRODUCTION

The Pipeline and Hazardous Materials Safety Administration (PHMSA) within the Department of Transportation (DOT), has responsibility for the regulation of hazardous materials transportation by highway, rail, air, water and pipeline. PHMSA is the primary federal regulatory agency responsible for ensuring that the Nation's 2.6 million miles of gas and hazardous liquid pipelines are safe, reliable, and environmentally sound. From the federal level, we oversee the development, implementation and enforcement of regulations concerning pipeline construction, maintenance and operation, and we share these responsibilities with our state regulatory partners.

The Nation's pipelines are a transportation system that enables the safe movement of extraordinary quantities of energy products to industry and consumers, literally fueling our economy and way of life.

Our oil and gas pipelines are the arteries of the Nation's energy infrastructure, as well as the safest and least costly way to transport energy products., They also deliver the resources needed for national defense, that heat and cool our homes, generate power for business, and fuel an unparalleled transportation system.

Since 2001, the hazardous liquid and gas transmission/distribution integrity management programs (IMP) have enabled the testing and assessment of far more lines than ever before. Tens of thousands of pipeline defects were detected and repaired. Many operators developed and applied risk models for the first time, and many others made significant improvements to their existing risk management tools and practices.

PHMSA is now transitioning into a second edition of IMP, utilizing lessons learned from a multitude of inspections, audits, and collaborations with state regulators, utility commissioners, and the regulated industry. Much of the successes from these integrity endeavors and several other safety programs have come from ongoing contractor support. This support enables PHMSA to accelerate the development and implementation of numerous pipeline safety programs.

Please visit http://www.phmsa.dot.gov/pipeline and http://primis.phmsa.dot.gov/comm/ for a full description of PHMSA’s various pipeline safety programs.

REQUIREMENT

PHMSA requires contractor support for many ongoing and new challenges related to its integrity management and safety mission. Contractor support provided through services in the form of subject matter experts, technical reports, briefs, white papers, training curriculums, inspection protocols, database & website management, PowerPoint slideshows, and physical travel to attend and execute requested support.

The support structure is divided into three tasks. The tasks and sub-tasks are in support of the PHMSA pipeline safety mission. Please view the individual task statements of work for detailed scope descriptions.

Task 1 – Integrity Management Support

1A – Development of IA 1B – Operations & Maintenance of IA 1C – Security and Privacy http://www.phmsa.dot.gov/pipeline http://primis.phmsa.dot.gov/comm/

RFP: DTPH5617R00001 Page C-2

1D – Training and Support

Task 2 – Program Development, Technical Consultation and Strategic Planning Services

2A – Technical Requirements Adequacy 2B – Technology Assessment and Adequacy 2C – Risk-Ranking Index Model Technical Support 2D – Underground Natural Gas Storage 2E – Enforcement Guidance and Program Development 2F – Safety Management Systems 2G – Regulatory/Rulemaking Development/Administration 2H – Program Development/Mandates 2I – Program Development/Damage Prevention, Public Awareness, and Outreach

Task 3 – Research Program, Assistance Programs and Website Administration 3A – Research Program Management Information System 3B – Webpage/Webmaster Services 3C – Public Meeting Website Administration 3D – State Damage Prevention and Technical Assistance Grant Information

Conflicts of Interest

The Contracting Officer has determined that this acquisition may give rise to a organizational conflict of interest (OCI). Accordingly, the attention of prospective Offerors is invited to FAR Subpart 9.5 -- Organizational Conflicts of Interest.

Each offeror must be clear of active business or financial arrangements with the pipeline industry that conflict with the work required under this contract by the date of contract award (anticipated September 2017). An active business or financial arrangement includes contracts, subcontracts, partnering agreements, and consulting arrangements. Arrangements include those held by the contractor organization or contractor key personnel. Award is contingent on the offeror having no active business or financial interest with the oil and gas pipeline industry, specifically with those entities that PHMSA regulates under the Federal Pipeline Safety Law at 49 U.S.C. 60101 et seq., and implementing regulations in 49 C.F.R.

Parts 191-199, which would conflict with the work to be performed under this contract. After award, the contractor must, for the duration of the contract, not enter into any arrangement that would conflict with the work requirements set forth in the contract.

Personnel Security:

Contractor personnel are subject to DOT security and safety regulations. The contractor must ensure that all security requirements are met. DOT Order 1630.2c titled “Personnel Security Management,” dated April 27, 2015, available at http://one10.dot.gov/office/ost/security/Public_Documents/DOT_Orders/1630.2C%20- %20PERSONNEL%20SECURITY%20MANAGEMENT.pdf “DOT Policies and Guidance,” applies to this requirement. The contractor must provide a list of staff security clearances in each monthly progress report.

At a minimum, all proposed Key Personnel and those personnel with direct access to PHMSA’s LAN/WAN must have current Secret clearances. All other personnel must meet the standards in DOT Order 1630.2c, as referenced above.

http://one10.dot.gov/office/ost/security/Public_Documents/DOT_Orders/1630.2C%20-%20PERSONNEL%20SECURITY%20MANAGEMENT.pdf http://one10.dot.gov/office/ost/security/Public_Documents/DOT_Orders/1630.2C%20-%20PERSONNEL%20SECURITY%20MANAGEMENT.pdf

RFP: DTPH5617R00001 Page C-3

PHMSA will provide the contractor security regulations after award. Access to work areas will be restricted to hours of operation unless otherwise directed or approved by the designated government representative.

The contractor must comply with all applicable Federal, state, and local safety regulations at all times during the performance of the work under this contract. The contractor must employ protective devices (e.g., software, systems) provided by the government for the prevention of espionage, sabotage, and any other potential malicious or accidental destruction or damage to government equipment and information.

The contractor must ensure that safe operating practices and safeguards are in effect at all times to ensure the safety of personnel, information and equipment. The contracting officer and authorized PHMSA security and safety personnel must have access to the portions of the building staffed and operated by the contractor at all times during the performance of the work under this contract to inspect, inventory, install or remove any of the protective devices or equipment. These personnel will also inspect the premises to determine compliance with all regulations and requirements concerning equipment protection, safety and security.

The Contracting Officer’s Representatives (COR) will convey access and security procedures for PHMSA’s computer resources. The contractor must implement these procedures as part of its facilities and systems management responsibilities. PHMSA will not provide on-site space for the execution of this contract. PHMSA intends for the contractor staff of this contract to be off-site.

C.1 STATEMENT OF WORK

The Contractor is to provide the following support services under the following three work areas:

Work Area 1: Integrity Management Program (IMP) Support

Introduction of Service: The contractor will support the further implementation of PHMSA’s IMP initiative for hazardous liquid, gas transmission, gas distribution pipelines and development of similar program for gas gathering pipelines. This initiative is intended to increase public confidence in the pipeline infrastructure by requiring operators to develop and implement comprehensive integrity management programs. The field work associated with this task area was historically very large in workload but over the past ten years, has reduced in scope to a significantly lower level of effort. One exception is for Information Technology (IT) services for the development and ongoing operations and maintenance of field testing and implementation of the Pipeline Risk Management Information System (PRIMIS), where the level of effort is significant.

PRIMIS is a custom-built set of applications. PRIMIS is a combination of web servers and application servers that includes several PHMSA Pipeline (PHP) websites and applications with a diverse user base (http://primis.phmsa.dot.gov/). Included within PRIMIS are:

1. Integrity Management Database - Hazardous Liquid

2. Integrity Management Database - Gas Transmission

3. Operator Qualification Database

4. Research & Development Website and Management Information System

5. Public Meeting Registration Application

6. Inspection Assistant (IA) Workflow Server Application

7. IA Content (web-application used to manage IA content)

8. IA Export Service

9. IA Training Server http://primis.phmsa.dot.gov/

RFP: DTPH5617R00001 Page C-4

10. Stakeholder Communications Website

11. Pipeline Technical Resources Website

PRIMIS comprises a significant user base that utilizes these applications and services on a daily basis for mission critical activities. The user base is large and diverse and includes:

• general public

• local officials

• state regulators

• federal agencies

• emergency officials

• pipeline safety advocates

• industry

• excavators

• pre-award and post-award users of R&D programs

• PHMSA/PHP Award Officers (AOs)

• PHMSA/PHP Award Officer Technical Representatives (AOTRs)

• PHMSA R&D Program and Grant Management Team

• Federal PHP Inspectors

• State Pipeline Inspectors

• Pipeline operators

• PHP Management

• PHP Program Management Team

• State Pipeline Inspectors

• Pipeline operators

• PHP OQ Program Team

PRIMIS IA Application Suite: The full suite of PRIMIS Inspection Assistant (IA) applications among the above include IA-Desktop, IA-Mobile (iPad), IA-Export (PHMSA database), IA-Content (to manage inspection content), and the IA-Server (to keep everything, including individual team member notes, in real-time sync). PRIMIS IA is under the full production and operational oversight of PHMSA IT.

The IA is a suite of software applications that assist in the implementation of the Integrated Inspection (II) process (also referred to as a “data driven risk informed (DDRI)” inspection process). Integrated Inspection (II)/DDRI is a relatively new PHMSA pipeline inspection process (as compared to those originally developed in the early 200s), to eliminate previous discrete inspection “types” with pre-established inspection forms such as standard, integrity management, team O&M, and Operator Qualifications (OQ) inspections. The reengineered process prioritizes specific areas to be inspected based on system-specific and operator-specific risk information. [Use of pre-determined sets of inspection questions on paper inspection forms would not be possible when using an II/DDRI approach.]

The IA suite of software applications is one facet of the overall reengineered inspection process and is the primary tool used by pipeline inspectors to a) develop an II plan (i.e., questions to be asked during an inspection), b) set up how the inspection is to be implemented (where subsets of questions will be asked, and by whom), and c) capture inspection results on an asset-specific (e.g., Unit) basis. IA also includes a set of required workflow requirements designed to enhance and document inspection consistency, and allow for the exporting of all inspection related data to a central PHMSA database.

Server Network: The host servers are not located at any vendor data centers but it is required that operations and maintenance activities performed on IA applications be closely integrated and scalable with the current servers and any future additional severs. The number of physical host servers may

RFP: DTPH5617R00001 Page C-5 change due to the retirement of legacy applications or the addition of new requirements. This requires the contractor to coordinate directly with DOT OCIO and/or OST ITSS on system software modifications, OS updates, and vendor patches for PRIMIS applications hosted on internal servers. Below is the framework of the current PRIMIS servers supporting both Production and Test/Development environments.

Figure 1: PRIMIS Servers

All ten servers are hosted in the DMZ thru OST VMware in DOT HQ running vCenter v5.5 update 3e.

Server Hostname Operating System RAM CPU Count CNAME Function

Prod Servers

PHMHQNWAS070VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 primis.phmsa.dot.gov

PRIMIS

PROD

PHMHQNWAS071VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 ia-sync.phmsa.dot.gov

PRIMIS

PROD -

IA-SYNC

PHMHQNWAS072VG Microsoft Windows 4GB 2 ia- PRIMIS

RFP: DTPH5617R00001 Page C-6

Server 2012 R2, Standard x64 Edition content.phmsa.dot.gov PROD -

IA-

CONTENT

PHMHQNWAS073VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2

PRIMIS

PROD -

IA-

EXPORT

PHMHQNWAS080VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 PRIMIS

PROD IA

Training -

TQ

Test and Dev

Servers

PHMHQNWAS074VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 primis-stage.phmsa.dot.gov

PRIMIS

test & dev

PRIMIS

PHMHQNWAS075VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 ia-sync-stage.phmsa.dot.gov

PRIMIS

test & dev

IA-SYNC

PHMHQNWAS076VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 ia-content-stage.phmsa.dot.gov

PRIMIS

test & dev

IA-

CONTENT

PHMHQNWAS077VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 PRIMIS

test & dev

IA-

EXPORT

PHMHQNWAS081VG

Microsoft Windows Server 2012 R2, Standard x64 Edition

4GB 2 PRIMIS

test & dev IA Stage -

TQ

Figure 2: PRIMIS Production, Test and Development Servers

Outline of Work Areas:

Services are sought to provide ongoing, case by case and short turn around work area support to PHMSA for developing programs as well as for responding to information requests from Congress, Government Accountability Office (GAO), National Transportation Safety Board (NTSB), Inspector General (IG), and other stakeholders on issues related to the Statement of Work of this contract.

1A. Development of IM The purpose of the Inspection Assistant Management System is to allow PHMSA and its state partners to organize, plan, execute and document inspection efforts. IA provides a standard, flexible inspection platform for use in both team-based and single-user inspection activities. As a secondary purpose, it produces granular inspection result data of high analytical value useful for inspection resource allocation and targeted planning of subsequent inspections.

The system is comprised several components:

• A syncing server (IA-Sync) that acts as a data exchange hub between all participating clients.

RFP: DTPH5617R00001 Page C-7

• A Microsoft Windows® desktop application (IA-Desktop) that facilitates all phases of an inspection from setup to final documentation. IAD supports off-line use.

• An Apple iOS® Mobile application (IA-Mobile) containing core functions that allow inspectors to both view and collect inspection documentation during fieldwork. IAM supports off-line use.

• A web-based content management system (IA-Content) used to manage the regulatory question content utilized in various inspection types.

• An export service (IA-Export) that acts as a bridge between IA’s data store and outside consumers of bulk IA data.

IA employs a distributed service-oriented architecture (SOA) that employs adapters to act as service-agents between disparate systems. Connections between services are stateless (typically over https transport) and assumed to be sporadic without and always-on requirement imposed on any of the related services.

Figure 3: IA utilizes a distributed service based architecture that does not explicitly dictate the deployment locations of services.

Multiple instances of the software are deployed and used simultaneously while the workflow server caches the data and ensures that all clients are in sync with the others. Due to the nature of inspection work, there disconnections from the server may be experienced for periods of time while collecting data.

While disconnected, the software continues to function and can be used to support inspection activities and collect inspection data. Upon reconnecting, the client software syncs with the server and conflicts (if any) are resolved. At any time during the inspection, all connected instances of the IA client-software have a current snapshot of all inspection results across all activities. This information sharing is critical to all team-based inspection types and to the team leader’s ability to be aware of real-time issues and to direct the inspection as it progresses.

The contractor will be responsible for providing limited software development activities to be

RFP: DTPH5617R00001 Page C-8 performed in support of enhancing existing IA applications. In the event that a release is necessary to enhance the performance of the IA applications, limited software development may be needed.

Software releases based on existing and new Change Requests (CR) as approved by the PHMSA IT Systems Change Management Board (CMB). The PHMSA CMB will prioritize Change Requests and determine best course of action based on significance, level of effort, risk and existing schedule. In the event an urgent software release is required to mitigate a significant business impact, the CMB will review the issue and determine best course of action. The contractor shall maintain a product backlog inventory for each product owner to assist the CMB in outlining those items that should be prioritized.

The number of features/story points will be agreed upon by the CMB with appropriate acceptance criteria to include the definition of a complete release.

The Contractor Will Support Critical Defect Remediation

• Rectify those critical defects or bugs that are approved by the PHMSA IT System Program Manager.

• Create and test changes, including but not limited to fixes to application bugs and after PHMSA approval deploy them to the PHMSA IT Systems production environment in a timely fashion. This must be coordinated with the PHMSA IT System Program Manager.

• Coordinate all releases with the PHMSA IT System Program Manager and other applicable technical teams.

Change Requests (CRs)

• All CRs must have PHMSA change management board (CMB) approved Requirements, Design, Build/Develop, and Testing.

• All CRs must be deployed to the PHMSA IT Systems Production Environment, after PHMSA CMB approval, and in coordination with the PHMSA IT System Program Manager and other applicable technical teams.

• The contractor must identify any dependencies between new and existing CRs and dependencies to existing capabilities.

• Coordinate all releases with the PHMSA IT System Program Manager.

1B. Operations & Maintenance of IA In support of Operations & Maintenance, the Contractor is responsible for ensuring the PRIMIS IA platform and all components remain operational and are performing at optimal levels. This will include O&M support for the suite of IA applications to include IA-Desktop, IA-Mobile (iPad), IA-Export (PHMSA database), IA-Content (to manage inspection content), and the IA-Server (to keep everything, including individual team member notes, in real-time sync). This task will require the standard operations and maintenance activities to include user account administration, patches, upgrades of the aforementioned components. These PRIMIS System Applications run on a number of various technologies (please see the PRIMIS O&M Business Documentation in in Attachment A for more detail). The IA platform and all associated components are considered mission critical and are supported by a mixed software stack which requires varied level of maintenance and support. Support performed requires contractor staff with expertise in all aspects of the technologies, including the current architecture while assisting in the advancement of the strategic direction of PHMSA.

All work performed under this service area must result in consistent and reliable operations of the IT IA platform and associated applications. It includes all infrastructure and system application level support services covered under this SOW.

RFP: DTPH5617R00001 Page C-9

Standard System Operation and Maintenance support includes but is not limited to:

• Security and Change Management o Ensure the full suite of PRIMIS IA applications, web platform and associated components remain in compliance with all DOT and PHMSA Security policies; and o Ensure PRIMIS IA System, Application and website and its components remain with applicable Federal laws including: The Computer Security Act of 1987 (40 U.S.C. 1441 et seq.), the Clinger-Cohen Act of 1996, and the Federal Information Security Management Act (FISMA) of 2002 and meet Government IT security requirements including: OMB Circular A-130, Management of Federal Information Resources, Appendix 111, Security of Federal Automated Information Resources; National Institute of Standards and Technology (NIST) Guidelines; Departmental Information Resource Management Manual (DIRMM) and associated guidelines; Department of Homeland Security (DHS) directives; Executive Orders (EO); and Office of Management and Budget (OMB) memorandums and circulars.

o Ensure all activities associated with modifications to PRIMIS system and applications adhere to PHMSA Change Management Processes; and o In coordination with PHMSA ISSM, as prescribed in the Assessment and Authorization’s Plan of Action & Milestones (POA&M) or as a result of regularly scheduled security scans, ensure all POA&Ms and vulnerabilities are addressed and remediated by the required timeframes.

o Use the PHMSA JIRA system as the tracking and reporting tool to submit all change management requests.

• Updates & Patches o At a minimum on a quarterly basis, or as prescribed in the Security Authorization &

Accreditation (SA&A) Plan of Action & Milestones, any updates (patches) supplied by other vendors must be incorporated (such as the middle tier products). Any updates must be installed in coordination with the PHMSA IT System Program Manager.

o Updates and patches will be conducted for all PHMSA production systems to minimize user disruption.

• Data Base Services o Patching and upgrading databases;

o Maintaining, planning, developing, managing, administering and enhancing of the

Middleware, Developer Tools and Applications through the use of Microsoft Internet Information Services (IIS). Microsoft IIS fulfills the role of the Web server, responding to requests for files from Web clients such as IE, and logging activity and is the current web server option utilized for IA applications;

o Research, troubleshooting and testing database, middleware and Applications software bugs and errors;

o Daily monitoring of the software environments (Microsoft Visual Foxpro).

• Application Support o Respond to IA application support/trouble calls from the users;

o Resolve application trouble/support calls;

RFP: DTPH5617R00001 Page C-10 o Track trouble/support calls;

o Configure web platform applications using administrative interfaces;

o Recommend and implement code changes, system redesign and/or system improvements to improve the salability of the application to handle the Peak Volume periods.

o Administer application and related application and database settings such as preferences, user permissions, and reports;

o Refreshing and/or updating reference/meta-data data;

o Software Management - tracking requests for bug fixes, enhancements, or modifications to existing applications; assess and document the level of effort to address requests;

organize and group requests into releases and/or patches;

o Perform Root Cause Analysis (RCA) of the problem and identify the failing component of any applications; and o Constant monitoring of the IA web platform will be performed to identify problems and causes.

• System Recovery o Support the system recovery of the full suite of PRIMIS applications and components and settings which must be restored in accordance with the Service Level Agreements (SLAs).

o Support the development of contingency plans, including disaster recovery (DR) and Continuity of Operations (COOP) testing, and failover testing consisting of documented contingency plans.

o Support the execution of emergency backups in coordination with other infrastructure operational components and/or DOT Data Center specific requirements.

• PRIMIS Website Support Services o Maintaining the PRIMIS website;

o Administering web page resources;

o Planning and enhancing the PRIMIS Website;

o Integrating web technology with application software and databases;

o Maintaining and enhancing existing web pages;

o Developing, testing, and deploying new web pages/sites;

o Conducting analysis and generating reports on website usage;

o Supporting PHMSA Network operations; and o Improving the navigational design structure within the Content Management System.

These services may include but are not limited to:

Develop templates and graphics according to the existing, new and future design frameworks Test and deploy new templates Assist with content migration.

• PRIMIS Content Management o Layout and design of web pages;

o Plan, edit, write, and design web content using CMS/website tools;

RFP: DTPH5617R00001 Page C-11 o Provide user training and create CMS and website user training materials;

o Coordinate content management meetings; and o Make recommendations and assist in development of new content o Migrate content into new and future templates.

• Miscellaneous Support o Provide support where necessary to include but is not limited to modifying user accounts, modifying user roles and privileges, creating new passwords, resetting passwords, bug and ECR tracking, supporting calls from the users, etc.;

o All calls, emails, and contact, to include time spent must be provided to the PHMSA IT System Program Manager on a monthly basis;

o Create a monthly report with the information content and format to be approved by PHMSA Program Manager.

• Documentation o Develop and/or update, as necessary, procedures for all O&M tasks. This task must include, at minimum, procedures for the above bulleted items under this task.

Procedures must include all necessary information for starting and stopping servers, environments, applications, etc. Listed below are examples of documentation that needs to be maintained as system changes are implemented.

Configuration Management;

Backup Restore procedures;

Starting and Stopping scripts;

Configuration files;

Source code control configuration and usage;

Compile process;

Build application scripts;

Data Dictionary;

Deploy procedures and scripts;

Network Diagram(s);

Port Inventory;

Startup / Shutdown Sequence;

Post Maintenance Checklists;

Inventory of Service Accounts; and New and Existing Detailed Capabilities Requirements.

Service Level Agreement The following table lists the Service Level Agreements (SLA) identifying the maximum allowable outage times and expected response time once contractor staff have been notified of an issue to fix and resolve issues related to the server, components or database.

1.1 Service Level Agreements

Server / Component / Database Component Criticality

(1=less critical - 5=most critical)

Allowable Outage Times

Integrity Management Database - Hazardous Liquid Database 2 8PM ET to 5AM

ET Daily Integrity Management Database - Gas Database 2 8PM ET to 5AM

RFP: DTPH5617R00001 Page C-12

Transmission ET Daily

Operator Qualification Database Database 2 8PM ET to 5AM ET Daily

Research & Development Website and Management Information System System 4 8PM ET to 5AM

ET Daily

Public Meeting Registration Application Application 2 8PM ET to 5AM ET Daily

Inspection Assistant (IA) Workflow Server Application Application 5 8PM ET to 5AM

ET Weekends IA Content (web-application used to manage

IA content) Application 5 8PM ET to 5AM ET Weekends

IA Export Service Application 5 8PM ET to 5AM ET Weekends

IA Training Server Server 5 8PM ET to 5AM ET Weekends

Stakeholder Communications Website Website 2 8PM ET to 5AM ET Daily

Pipeline Technical Resources Website Website 2 8PM ET to 5AM ET Daily

1C. Security and Privacy

• Per the Federal Information Security Modernization Act (FISMA) of 2014, the IT systems supporting/enabling the activities identified in this SOW must be Assessed and Authorized prior to moving the system into a production environment. The Security Assessment and Authorization (SA&A) activities must be conducted in accordance with NIST and DOT standards and guidelines. As directed by PHMSA ISSM, the contractor must maintain security documentation and coordinate with DOT on updates and system information required in support of the development of PRIMIS security documentation. The security documentation must remain up to date and at a minimum, the SA&A package must include:

o System Security Plan (SSP)

i. To include: hardware inventory, software inventory, system description, vendor contacts, protocols, system users, system interconnections/information sharing, and security control implementation statements in accordance with NIST 800-53 (current revision).

o Risk Assessment and Risk Factor o Security Test and Evaluation (STE) o Plan of Action and Milestone (POA&M) o Contingency Plan o Configuration Management Plan o Privacy Threshold Analysis

Note: The current IT system received an Authority to Operate in October 2014. Recertification of the system is scheduled for 2017. However, the POA&Ms must be mitigated within the timeframes specified in the SA&A package.

RFP: DTPH5617R00001 Page C-13

• The contractor must ensure PRIMIS complies with Federal and DOT IT security policies, standards, and guidelines which include baseline configuration standards, patch management, vulnerability remediation and annual IT security assessments.

• The contractor must provide evidence of IT security awareness training for each staff member supporting the IT system. The scope of the training must be in alignment with the scope of duties. For example, system administrators should have IT security training tailored for system administrators.

• The contractor shall ensure PRIMIS and its components remain in compliance with applicable Federal laws including: The Computer Security Act of 1987 (40 U.S.C. 1441 et seq.), the Clinger- Cohen Act of 1996, and the Federal Information Security Management Act (FISMA) of 2014 and meet Government IT security requirements including: OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources; National Institute of Standards and Technology (NIST) Guidelines; Departmental Information Resource Management Manual (DIRMM) and associated guidelines; and

• The contractor must adhere to Federal Government law and policies, as well as Department of Transportation and PHMSA Internet development standards and guidelines. These laws and policies include but are not limited to the Privacy Act of 1974, Section 208 of the E-Government Act, Paperwork Reduction Act, OMB M-03-22, OMB M-04-05, OMB Guidance for Federal Public Websites and Section 508 of the Rehabilitation Act of 1973, as amended. Test results of scans conducted must be provided as evidence. The DOT Compliance Checklist for Websites will be used to ensure all DOT mandated policies are followed.

• All Internet enabled systems must use SSL technology to encrypt sensitive data.

• The contractor shall ensure Personally Identifiable Information (PII) is protected and:

o Comply with DOT Privacy policies; and o Ensure that all PII is encrypted and appropriate security controls are applied to protect the data from unauthorized disclosure; and o Coordinate with the COTR, PHMSA Privacy officer and ISSM for any privacy related requirements; and o Ensure all applicable privacy-related documentation delivered will be considered acceptable only upon approval of the DOT Privacy Office.

1D. Training and Support Provide support to PHMSA for inspection, audits and training actions with the following tasks:

• Assist PHMSA in resolving and communicating technical and regulatory interpretation issues;

• Assist in closing NTSB recommendations against PHMSA;

• Maintain the web site to communicate information on hazardous liquid or gas IM requirements to the public and industry;

• Develop and deliver training for inspectors on hazardous liquid or gas IM requirements and related subjects (e.g., Direct Assessment);

• Maintain an information system to support hazardous liquid or gas IM inspections;

• Review and comment on reports related to hazardous liquid or gas IM;

• Assist PHMSA’s outreach efforts to trade and industry groups regarding hazardous liquid or gas

IM issues;

• Assist PHMSA in conducting IM inspections and documenting related inspection and enforcement activity;

• Track and consolidate data PHMSA can use to report inspection and enforcement progress to stakeholders (such as Congress, GAO or the IG);

RFP: DTPH5617R00001 Page C-14

• May interface with the PHMSA IA Team (IAT) on any further IA software development and functional specifications. PHMSA’s IAT oversees the maintenance and updates of the IA inspection content (i.e., individual questions, associated topical “directives”, question organization, etc.);

• Work with additional contractors via PHMSA’s Training and Qualification Center to develop new or review existing guidance materials, training curriculum and conduct training tailored to the various subjects under this task area;

• Maintain the Integrity Management Database (IMDB) as part of the broader Pipeline Risk Management Information System (PRIMIS) website located at http://primis.phmsa.dot.gov/ that supports inspectors’ data storage and analysis needs; and

• Support the IMDB and PRIMIS website in accordance with any relative Office of Management and Budget (OMB) requirements.

• Ensure any software changes or enhancements associated with training are closely coordinated with the production training server (reference subtask 1.B Operations and Maintenance)

Work Area 2: Program Development, Technical Consultation and Strategic Planning Services

Introduction of Service: The contractor must provide necessary technical consultation, management, and administrative services to support PHMSA in assessing technical requirements of various regulatory requirements in association with codes of federal regulations, special permits and corrective action orders.

The drafting of some technical requirements for new rulemakings will also be needed. Services to qualitatively assess current or new technology deployed in the pipeline industry will be requested.

PHMSA continually improves its Risk-Ranking Index Model (RRIM) which is a risk based tool to set priorities for annual region inspection planning. RRIM uses risk, performance, and inspection data to derive a risk based numerical index and inspection priority for each pipeline system inspected by PHMSA’s regions and interstate agents.

PHMSA intends to issue safety regulations under 49 CFR Parts 191 and 192 to the downhole of underground natural gas storage reservoirs where significant technical services will be required for the first half of this contract but may lessen toward the second half.

Technical services are required in support of PHMSA’s Enforcement Program to ensure it is risked-based, maintains and enhances data quality so that it can identify record and track enforcement parameters.

PHMSA has a robust program in damage prevention and seeks review and guidance in identifying, developing and implementing the necessary tools and processes for ensuring that local government officials’ land use decisions appropriately consider pipeline safety.

Contractor support is sought so that PHMSA can promote the American Petroleum Institute (API) new Recommended Practice (RP) 1173 on Pipeline Safety Management Systems (SMS) and expand upon its merits to the regulated community. PHMSA believes this initiative will enhance pipeline safety, increase process efficiencies, increase system reliability and reduced costs. Various logistic and administrative support in pipeline safety rulemaking remains a need whether it be in documentation at various stages of the rulemaking process, a review of the Regulatory Impact Analysis (RIA) and administrative services in organizing/grouping stakeholder comments in support of PHMSA’s response to submitted comments.

PHMSA’s Training and Qualifications (T&Q) Division provides inspectors with the nation’s only specialized training for understanding and applying federal pipeline safety regulations and standards incorporated by reference. Contractor services are needed in working with T&Q on the adequacy and

RFP: DTPH5617R00001 Page C-15 review of current training programs and the development of future ones. This area may require interaction with other Tasks and Sub-Tasks under this statement of work.

Outline of Sub-Tasks:

Services are sought to provide ongoing, case by case and short turn around subtask support to PHMSA for developing programs as well as for responding to information requests from Congress, GAO, NTSB, IG, and other stakeholders on issues related to the tasks performed through the Statement of Work of this contract.

2A. Technical Requirements Adequacy

• Review and adequacy guidance on any technical subject from PHMSA’s regulatory requirements, special permits and corrective action orders; and

• Technical adequacy reviews of draft regulatory requirements for new rulemaking.

2B. Technology Assessment and Adequacy

• Capability review of existing or new technology used to comply with any PHMSA regulatory requirement will be requested in the form of white paper summaries or presentational matter.

2C. Risk-Ranking Index Model Technical Support

• Risk analysis and risk management support for PHMSA’s RRIM development team;

• Further tool development and continued assistance during all phases of model development and implementation; and

• Work with additional contractors via PHMSA’s Training and Qualification Center to develop new or review existing guidance materials, training curriculum and conduct training tailored to the various subjects under this task area.

2D. Underground Natural Gas Storage

• Recommendations and guidance sought after review of facility incident data and failure reporting;

• Technical adequacy review of current and future editions of various national standards such as API RP 1171 Functional Integrity of Natural Gas Storage in Depleted Hydrocarbon Reservoirs and Aquifer Reservoirs and RP 1170, Design and Operation of Solution-mined Salt Caverns Used for Natural Gas Storage;

• Development of requirements guidance on design, cementing, operational inspections, maximum operating pressures (MOP), use of pressure tests and well log inspections, integrity management principles to maintain MOPs, training, emergency response, and record keeping; and

• Draft FAQ’s, and work with additional contractors via PHMSA’s Training and Qualification Center to develop new or review existing guidance materials, training curriculum and conduct training tailored to the various subjects under this task area for PHMSA and State inspectors.

2E. Enforcement Guidance and Program Development

• Review current enforcement metrics and performance measures to ensure program goals can be met and make recommendations to adjust policies and priorities accordingly;

• Maintain public posting of enforcement guidance to better clarify performance-based requirements and enforcement case documents under the Pipeline Risk Management Information System (PRIMIS) located at http://primis.phmsa.dot.gov/;

• Provide recommendations for efficient enforcement processes within the bounds of generating effective enforcement products and providing strong but fair enforcement, respectful of due process rights;

• Work with additional contractors via PHMSA’s Training and Qualification Center to

RFP: DTPH5617R00001 Page C-16 develop new or review existing guidance materials, training curriculum and conduct training tailored to the various subjects under this task area; and

• Review PHMSA enforcement practices and other best practices and make recommendations so that they foster a proactive and effective safety culture in the regulated community.

2F. Safety Management Systems

• Assist in the further development of PHMSA’s strategy to Introduce, Educate, Engage, Innovate and Evaluate and Review current SMS approaches within the framework of Plan, Do and Check;

• Assist in developing protocols to review and evaluate SMS programs within the area of Management Commitment and Leadership which embodies several strategies for Stakeholder Engagement, Risk Management, Operational Controls, Incident Investigation, Evaluation and Lessons Learned, Safety Assurance, Management Review and Continuous Improvement, Emergency Preparedness and Response, Competence, Training, Qualification and Development and Documentation and Record Keeping;

• Consultation services on how to establish a framework for implementation of SMS in PHMSA and within our regulated communities is sought; and

• Work with additional contractors via PHMSA’s Training and Qualification Center to develop new or review existing guidance materials, training curriculum and conduct training tailored to the various subjects under this task area.

2G. Regulatory/Rulemaking Development/Administration

• Review and commentary of our methodology and conduct RIAs and other analyses for rulemaking;

• Economic and other supporting analyses in support of rulemakings; and

• Regulatory analysis support during our rulemaking process (e.g., development of regular evaluations) and Regulatory Flexibility Analysis 2H Program Development/Response to Mandates

• With case by case direction and on an as-needed basis only, provide short turn-around support to PHMSA in responding to information requests from Congress, GAO, NTSB, IG, and other stakeholders;

• Assist in developing new programs on subjects as directed by the Congress, GAO, NTSB and IG;

• Work with additional contractors via PHMSA’s Training and Qualification Center to develop new or review existing guidance materials, training curriculum and conduct training tailored to the various subjects under this task area; and

• Contractor staff level of effort supporting this subtask will fluctuate to handle wide ranging subject matter as needed.

2I Program Development Damage Prevention, Public Awareness, and Outreach

• Assist with damage prevention, 811, public awareness, pipelines and informed planning alliance, excavator enforcement implementation, emergency response outreach, community…