Amendment 01 to HQC007-20-Q-0021 Hazardous Food and Drug Recall Notification System - Provide Answers and Revised SOW.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of the amendment is to post answ ers and provide the revised Statement of Work dated August 19, 2020.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 8

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 19-Aug-2020

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HQC00720Q0021

X 9B. DATED (SEE ITEM 11)

10-Aug-2020

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

19-Aug-2020

CODE

DEFENSE COMMISSARY AGENCY

INFORMATION TECHNOLOGY BRANCH

1300 E AVE

FORT LEE VA 23801-1800

HQC007 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HQC00720Q0021

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been added by full text:

QUESTIONS & ANSWERS

Hazardous Food & Drug Recall Notification System Questions & Answers – Revised 08/19/2020

1. Are there requirements that the software be single-tenant or multi-tenant?

Answer: No.

2. What are DeCA areas and DeCA zones and why do responders need to provide these data points as well as a site name as part of every response?

Answer: DeCA is divided up in to Areas and Zones with relation to where they are located in the US and Overseas. There are 5 Areas and 25 Zones within those areas. See below.

The program must be able to identify the store, zone and area when replying to a recall. We want this data for internal statistical use.

3. Are all recall notifications sent to all stores, central distributions centers (CDCs) and Central Meat Processing Plant (CMPP) (i.e. Do the projected 700 events per year go to all locations, or do recalls go to commissaries depending on distribution of the recalled products)?

Answer: Yes

4. How are recalled products uniquely identified within DeCA’s stock assortment? Can we be provided with an example of current Microsoft Outlook recall notification?

Answer: 4a. UPC. 4b. No.

5. Are costs input from responders shown in USD or are other currencies also used?

Answer: Only USD.

6. Are any languages other than English language required for users of the system?

Answer: No.

7. Is email the only form of communication to notify users of product recalls? If not, what other forms of communication are required?

Answer: Yes.

8. Is GDPR compliance required?

Answer: If required.

9. How is the DoD common access card to be used to authenticate the user?

Answer: Please see modification to section four (4) bullet one (1) Access, “…(via DoD issued common access card…” was changed to “…(for example, use of DoD issued common access card…” Offerors should propose their best solution in accordance with paragraph 13 Security in the SOW.

10. Is there a hard deadline when the system is to be deployed for use?

Answer: Yes. No later than four (4) weeks ADC (After Date of Contract).

The following have been modified:

STATEMENT OF WORK

STATEMENT OF WORK

AUGUST 19, 2020

1 Title. Hazardous Food and Drug Recall Notification Solution (HFDRNS) 2 Background Information.

The Defense Commissary Agency (DeCA) operates nearly 230 military grocery stores worldwide. As a premier military benefit, DeCA must not only provide groceries and services to comparable to commercial counterpart offerings, but it must also instill confidence that it resale food items are safe and uncontaminated from dangerous bacteria and other harmful pathogens. DeCA’s Hazardous Food and Drug Recall (HFDR) program is responsible for ensuring this confidence by resolving nearly 700 recalls annually.

HFDR receives recall notices from a number of disparate sources such as contractors, distributor, manufacturers, brokers, news media, and the Department of Defense (DoD) All Food and Drug Act (ALFOODACT). When a recall notification is determined, through coordination, to affect product within DeCA’s stock assortment, HFDR disseminates the recall notification and disposition instructions through Microsoft Outlook to a predefined email distribution group. This manually generated email requests field-level (e.g., store-level) respondents to use Outlook’s voting buttons or polling feature.

This manual process has a number of challenges and limitations. All responses require manual sorting and categorization. Common email settings such as digital signatures and message encryption make reading response problematic. All responses are stored in the native email format which is not tabular and requires significant manual intervention for reporting, responding to directed queries from regulatory agencies, and traceability of recalled product from notification to final processing.

3 Scope.

The objective of this requirement is to obtain a recall notification capability. This system, managed by the software provider external to DeCA’s systems, must include web-accessible automation that will disseminate HFDR generated instructions, deliver reference documentations (e.g., signs), collect data on actions taken by the site (i.e., store, Central Distribution Center (CDC), or Central Meat Processing Plant (CMPP)), and store this information for 12 months or according to DoD NARA regulations whichever is the longest period of time. The system will not use, generate, or maintain any DoD-Classified information, or interface with any existing DeCA IT system (e.g., sales, inventory, or logistics). The software will also provide reporting and dashboard capabilities to track a recall from notice to completions.

4 System Requirements.

The HFDRNS must allow DeCA to rapidly respond to recall notices 24/7, and to disseminate recall notifications to all DeCA stores, central distributions centers (CDCs) and Central Meat Processing Plant (CMPP) regarding product and disposition instructions. It must also collect all responses regarding actions taken by site. The solution must provide reports and dashboards tracking recall status from notification through conclusion. Information captured by this software must include: DeCA area, DeCA zone, site name, responder’s name, status of recalled products, product quantity, with date and time stamps. The software must provide DeCA the real-time ability to view the status of all DeCA facilities worldwide, display reporting statistics, generate reports on recall effectiveness, identify late responders, and send alerts or reminder notifications as necessary.

The vendor must provide necessary personnel expertise to configure, train, implement, host and maintain the Recall Notification System. All support for documentation, training, information assurance, hosting, and data management must be in accordance to DoD Guidelines. The system must include record retention software that adhere to DeCA and National Archives and Records Administration (NARA) guidelines. The HFDRNS offerer’s quote must provide an approach, to include the system requirements described herein:

Access: The system must provide support role-based security, workflows and approvals to authorized users (for example, use of DoD issued common access card (CAC) authentication). Notification generation, dissemination and responses based on roles and workflows, will include information pertaining to the recall and will direct the necessary actions by the addressees. The recipients must be capable of inputting status of recall items to include on-hand quantities and disposition.

Response Collection: The system must allow notification recipients the ability to provide input regarding 1) the quantity of product on hand related to the recall; 2) the cost of the respective product; 3) the status, action taken, or disposition of the respective product. The system must allow the respondent to modify or correct initial responses with audit capabilities. The system must allow alternative respondents and provide escalation alternatives should there be an absence or situation which prohibits a response from the primary respondent. All responses must include auditing capabilities to include time and date stamps.

Reporting: The system must provide industry standard reporting templates as well as allow for ad hoc reports and dashboard creation. The system must allow data exports into an MS Excel file to allow users to generate ad hoc reporting. The system must provide the capability to: 1) rapidly determine the status of all DeCA facilities worldwide; 2) identify late responders; 3) send reminder notifications to include notification escalation; 3) collect, maintain, and display data (to include cost and quantity) for reporting statistics; 4) generate reports; and 5) configure performance and status dashboards to track a recall from notice to completions.

Data Repository: The system must retain all data in a historical database that will allow DeCA users to track the recalled item through final disposition, and to conduct trend and other analytic analysis. The software must maintain a data repository to allow authorized users access to recalls, resident within the historical data repository for a period of one year. The repository must maintain historical records in compliance with DoD, DeCA, and NARA retention guidance.

5 Configure, Implement & Test.

The solution must clearly define the implementation and configuration of the HFDRNS, including:

o Setting up the application o Ensuring only authorized users can authenticate and use the solution o Establishing user profiles o Developing and implementing workflows, processes, and reporting o Providing secure sockets layer (SSL) certification

The HFDRNS must support role-based security, workflows and approvals. The contractor must test updates in a sandbox before they are deployed, and set up automated/canned and configurable reports, dashboards and queries.

The contractor must include licenses to allow for 24/7 site availability for 5 super users and 250 users

6 Training.

Training must be provided in a single live or interactive session for no more than 20 users. This training must be conducted on-site at DeCA Headquarters prior to the government’s acceptance of the system. The content of the training session must ensure a transfer knowledge for end to end software usage, to include generating recall messaging, disseminating, collecting responses, reporting (queries, reports, and dashboard customization), and trouble shooting. This training must be recorded and in addition to help screens, this recording must be accessible through the web-based application. The contractor must quote a methodology for defining a successful transfer of knowledge.

7 Hosting.

The Vendor must provide a fully implemented Food Recall Notification System that allows authorized users to disseminate recall information, respond recall notification, generate reports and query notification status. The vendor must host and maintain the software, this includes routine patches, fixes and Microsoft compatibility updates; and providing disaster recovery capability. The vendor’s support must be available to DeCA at a minimum Monday through Friday from 8 am – 5 pm EST with email or text support during off-hours.

8 Deliverables and Delivery Schedule.

The HFDRNS quote must include draft deliverables as summarized, in Table 1.

Table 1. HFDRNS Deliverables and Schedule

SOW

Parg-raph

Deliverable Title Description Format Due Date Quantity

1 0 Onsite Kickoff Meeting*

Review and finalization of planning materials submitted with vendor’s quote.

Face-to-face meeting Within 7 days post award

2 4 Enterprise/User License

250 concurrent internal users, to include 5 super-users.

Contractor-Determined Format

At least 5 business days prior to system implementation

Contracto r Determine d:

enterprise or 250 users

3 5 Configuration and Implementation Plan and Project Schedule

Plan and schedule detailing actions to be taken for configuration and implementation, which include, but may not be limited to, evaluating DeCA’s current systems and workflows and providing recommendations on the best approach, fully configuring and implementing all system applications and completing the transfer of data without an interruption in service to DeCA as it transfers between solutions.

- Draft Configuration and Implementation Plan and Project Schedule, in format compatible to MS Office Suites.

- Final Configuration and Implementation Plan and Project Schedule, in format compatible to MS Office Suites.

DRAFT -

Solicitation Due Date

FINAL – within 5 business days of kick-off meeting

4 6 User training

One interactive session for up to 10 trainees

Contractor-Determined Format

No more than 5 business days prior to system implementation

5 7 Annual License to include System Support / Maintenance

The contractor must define its service level agreement (SLA) for support response and resolution, with a maximum of 24 hours’ support response time for all maintenance issues.

Contractor-Determined Format

Annually, After Contract Award

Per Account

*Due to the COVID-19 pandemic, remote locations, if deemed applicable, will be considered to conduct meetings.

9 Place of Performance.

Initial configuration and implementation meetings must take place on-site, at DeCA Headquarters, but will be acceptable for meetings to take place via video teleconferencing. The DeCA Headquarters address is:

DeCA HQ/MPMP 1300 E Avenue Fort Lee, VA 23801-1800

*Due to the COVID-19 pandemic, remote locations, if deemed applicable, will be considered to conduct meetings.

10 Period of Performance.

The period of performance is one base year (anticipated 9/1/2020 – 9/31/2021) plus four (4) additional twelve-month option years.

11 Inspection and Acceptance.

DeCA will inspect and accept the HFDRNS to ensure that it is successfully developed, integrated and implemented and meets the minimum requirements defined in the SOW. If any element of the final solution prevents a full implementation in DeCA’s environment, the solution will not be accepted by DeCA.

12 Existing Environment.

DeCA currently uses the Secured Baseline Host version 10.5.0 with the following desktop business applications:

Microsoft Windows 10 Enterprise, Microsoft Outlook Professional Plus 2013, Microsoft Excel Professional Plus 2013, Microsoft PowerPoint Professional Plus 2013, Microsoft Word Professional Plus 2013, Internet Explorer 11, but regularly upgrades the environment. All deliverables will be in a format compatible with standards listed.

13 Security.

Requests for proposals must include sufficient information on which to evaluate each offeror’s proposed approach to satisfying the security control requirements prior to use of the software. This approach must also include a process to address the DeCA Program Manager’s requirement for continued assessment and maintenance of security control requirements throughout the life of the contract.

In addition to complying with installation access as delineated in clause 52.204-4500, contractors shall comply with country, municipality and any other applicable authority to include policy, regulations or laws regarding access to geographic areas and buildings with regards to performance of an award resulting from this solicitation.

In accordance with DoDI 8500.01 and DoDI 8510.01, DoD organizations that use external IT services provided by a commercial or other non-federal government entity must ensure the security protections of the information system delivering the service is appropriate to the confidentiality, integrity, and availability needs of the DoD organization's information and mission.

Unclassified, closed role based solution. The following controls must be addressed in the offeror’s approach, at a minimum, for any web-based service:

o Removal of default system accounts.

o Develop configuration standards for system. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards. Sources of industry-accepted system hardening standards may include, but are not limited to: (Center for Internet Security (CIS), International Organization for Standardization (ISO), SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST)) o Identify, address, and remediate new threats and common vulnerabilities affecting the system on a routine basis and in a timely manner.

o The site must perform user authentication with unique userids (individual unique IDs assigned to each individual user) and passwords that meet DoD password complexity requirements [as supported by the service].

o The following account management practices must be addressed in the offeror’s approach:

(a) Enforcement of change of characters when a password is changed

(b) Password minimum and maximum lifetime restrictions

(c) Prohibits password reuse restrictions

(d) Allows the use of a temporary password for system logons with an immediate change to a permanent password o Stores and transmits only cryptographically-protected passwords (encryption must use strong cryptography standards recommended by current industry best practices such as NIST – weak cryptography must not be used and must be replaced, as necessary, to maintain industry best practices through the life of the contract.

o Ensure that all security relevant and operational status changes are reported to the DeCA Program Manager.

14 Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI).

Government furnished equipment (GFE) will not be provided. Government-Furnished Information will be provided to the contractor, as required.

The awardee will be responsible for hardware and software required for use by its personnel.

15 Section 508 Accessibility Standards.

The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

(End of Summary of Changes)