PWSOperations_and_Maintenance.pdf

FEMA Service Operations Division Indefinite Delivery, Indefinite Quantity Statement of Work

SOURCE SELECTON INFORMATION SEE FAR 3.104

PROCUREMENT SENSITIVE

FOR OFFICIAL USE ONLY

Department of Homeland Security (DHS) Federal Emergency Management Agency

(FEMA)

Service Operations Division Operations and Maintenance

Indefinite Delivery, Indefinite Quantity Statement of Work

July 21, 2015 Version 1.0

FOR OFFICIAL USE ONLY

Table of Contents 1 1 GENERAL .............................................................................................................................................. 4 2

1.1 Introduction ..................................................................................................................................... 4 3

1.2 Background ..................................................................................................................................... 5 4

1.3 Scope ............................................................................................................................................... 6 5

1.4 Objective ......................................................................................................................................... 7 6

1.5 Applicable Documents ................................................................................................................... 8 7

1.5.1 Compliance Documents .......................................................................................................... 8 8

1.5.2 Reference Documents ........................................................................................................... 10 9

1.5.3 DHS Enterprise Architecture Compliance............................................................................ 10 10

2 SPECIFIC TASKS AND REQUIREMENTS .......................................................................................... 11 11

2.1 Functional Area 1 – Program/Project Management ................................................................... 11 12

2.1.1 Transition Planning ................................................................................................................ 13 13

2.1.2 Program Management of Services ....................................................................................... 15 14

2.1.3 Reporting ................................................................................................................................ 16 15

2.2 Functional Area 2: Information Technology System Operations and Maintenance .............. 17 16

2.2.1 Hardware and Software Maintenance ................................................................................... 17 17

2.2.2 Agile Approaches ................................................................................................................... 18 18

2.2.3 Custom Design Solutions ..................................................................................................... 21 19

2.2.4 Database Administration ....................................................................................................... 21 20

2.2.5 Testing .................................................................................................................................... 21 21

2.2.6 Backup Support ..................................................................................................................... 21 22

2.2.7 Change and Release Management ....................................................................................... 22 23

2.2.8 Deployment ............................................................................................................................ 22 24

2.2.9 Technology Refresh ............................................................................................................... 22 25

2.3 Functional Area 3: Telecommunications Operations and Maintenance .................................. 23 26

2.3.1 Private Branch Exchange (PBX) ........................................................................................... 23 27

2.3.2 Mobile Device Management .................................................................................................. 23 28

2.3.3 Unified Communications – Request Fulfillment Service .................................................... 23 29

2.3.4 SATCOM – Request Fulfillment Service ............................................................................... 24 30

2.3.5 Cellular Communication – Request Fulfillment Service ..................................................... 26 31

2.3.6 Mobile Device Management Service ..................................................................................... 26 32

2.3.7 Miscellaneous Service ........................................................................................................... 27 33

2.4 Functional Area 4: Help Desk Services ...................................................................................... 27 34

2.4.1 Service Request ..................................................................................................................... 27 35

2.4.2 Access Management .............................................................................................................. 28 36

2.4.3 Incident Management ............................................................................................................ 29 37

2.4.4 Problem Management ............................................................................................................ 29 38

2.4.5 Knowledge Management ....................................................................................................... 29 39

2.4.6 Metrics .................................................................................................................................... 30 40

2.5 Functional Area 5: Network Operating Services ........................................................................ 30 41

2.5.1 Network Access Management............................................................................................... 31 42

2.5.2 Event Management ................................................................................................................ 32 43

2.5.3 Incident Management ............................................................................................................ 32 44

2.5.4 Problem Management ............................................................................................................ 32 45

2.5.5 Intrusion Detection Monitoring and Incident Management ................................................ 33 46

3 Optional Requirements ....................................................................................................................... 33 47

3.1 Optional Requirement—Surge .................................................................................................... 33 48

4 CONTRACTOR RESOURCES ............................................................................................................. 34 49

4.1 Qualified Personnel ...................................................................................................................... 34 50

4.2 Removal and Suspension ............................................................................................................ 34 51

4.3 Security Clearances ..................................................................................................................... 34 52

4.4 Continuity of Support ................................................................................................................... 34 53

4.5 Key Personnel ............................................................................................................................... 34 54

4.6 Project Manager ............................................................................................................................ 35 55

4.7 Employee Identification ............................................................................................................... 35 56

4.8 Employee Conduct ....................................................................................................................... 35 57

4.9 Removing Employees for Misconduct or Security Reasons .................................................... 35 58

4.10 Training ......................................................................................................................................... 36 59

5 OTHER APPLICABLE CONDITIONS .................................................................................................. 36 60

5.1 Period of Performance ................................................................................................................. 36 61

5.2 Place of Performance ................................................................................................................... 36 62

5.3 Hours of Operation ....................................................................................................................... 37 63

5.4 Travel ............................................................................................................................................. 37 64

5.5 Security ......................................................................................................................................... 37 65

5.5.1 Continued Eligibility .............................................................................................................. 37 66

FOR OFFICIAL USE ONLY

5.5.2 Termination ............................................................................................................................ 37 67

5.5.3 Suitability Determination ....................................................................................................... 38 68

5.5.4 Background Investigation ..................................................................................................... 38 69

5.5.5 Access to Classified and Confidential Unclassified Information ....................................... 39 70

5.6 Information Technology Security Clearance .............................................................................. 39 71

5.7 Security of Deliverables ............................................................................................................... 39 72

5.8 Information Technology Security Training and Oversight ........................................................ 40 73

5.9 Post-Award Conference ............................................................................................................... 40 74

5.10 Project Plan ................................................................................................................................... 40 75

5.11 Business Continuity Plan ............................................................................................................ 40 76

5.11.1 Individual BCPs ...................................................................................................................... 41 77

5.12 Progress Reports ......................................................................................................................... 41 78

5.13 Progress Meetings ....................................................................................................................... 41 79

5.14 General Report Requirements ..................................................................................................... 42 80

5.15 Protection of Information ............................................................................................................. 42 81

5.15.1 Required Security and Privacy Training for Contractors ................................................... 42 82

5.15.2 Requirement To Support Completion of Privacy Compliance Documents [Privacy 83 Compliance Documentation] ........................................................................................................... 43 84

5.16 Suspected Loss of Compromise of SPII [Breach] ..................................................................... 44 85

5.17 Section 508 Compliance .............................................................................................................. 46 86

5.17.1 Accessibility Requirements (Section 508) ........................................................................... 46 87 6 GOVERNMENT/CONTRACTOR-FURNISHED RESOURCES ............................................................ 47 88

6.1 GFE, Government-Furnished Property (GFP), and Contractor-Acquired Property (CAP) ...... 47 89 7 CONTRACTOR-FURNISHED PROPERTY .......................................................................................... 48 90 8 GOVERNMENT ACCEPTANCE PERIOD ............................................................................................ 48 91

8.1 COR Right to Reject or Require Correction ............................................................................... 49 92

8.2 Review and Comment Period Duration ....................................................................................... 49 93

8.3 Other Review Time Periods and Schedules ............................................................................... 49 94

9 DELIVERABLES .................................................................................................................................. 49 95 10 INVOICING PROCEDURES ................................................................................................................. 50 96 Appendix A FEMA’s Systems, Services, and Applications ................................................................ 51 97 List of Figures 98 Figure 1 FEMA IT Services Management Lifecycle ................................................................................... 6 99

GENERAL 102

1.1 Introduction 103

The mission of the Federal Emergency Management Agency (FEMA) is “to support our citizens 104 and first responders to ensure that as a nation we work together to build, sustain and improve our 105 capability to prepare for, protect against, respond to, recover from, and mitigate all hazards.” For 106 35 years, FEMA’s mission has consistently been to lead America to prepare for, prevent, respond 107 to, and recover from disasters with a vision of “A Nation Prepared.” 108 The mission of the FEMA Office of the Chief Information Officer (OCIO) is to enhance and 109 maintain information technology (IT) infrastructure, develop and enhance key systems to support 110 operating programs, and increase efficiencies and cooperation across FEMA’s divisional and 111 regional lines. To support the FEMA mission, the OCIO is providing the leadership to enable the 112 entire FEMA enterprise, including the OCIO organization, to better manage and execute its IT 113 portfolio, programs, and projects. 114 The OCIO is transforming the FEMA IT environment through a series of enterprise-wide 115 enhancements, including IT project management, requirements, best practice systems 116 development processes, IT security, operations and maintenance, and IT quality assurance. This 117 transformation is being accomplished to enhance and maintain the enterprise technology 118 infrastructure, develop and enhance key systems to support operating programs, and increase 119 efficiencies and cooperation across FEMA divisional and regional lines. 120 FEMA IT projects, infrastructure, and operations will be managed and executed with a 121 standardized approach that leverages all possible enterprise-wide acquisition efficiencies, utilizes 122 a common best-practice approach to project management, and provides for the more efficient 123 integration of systems and use of resources. 124 The FEMA transformation approach will focus on high performance execution with skilled 125 teams collaborating across functional areas to include requirements, development, operations and 126 maintenance, quality assurance, and security. High performing, cross functional, collaborating 127 teams will execute using rapid application development approaches such as Agile 128 methodologies. FEMA will adapt the Department of Homeland Security Systems Engineering 129 Life Cycle (DHS SELC) as it transforms and mature its policies and guidelines and expects 130 Contractors to rapidly evolve. Critical success factors will include: 131

• High productivity with resultant high quality work 132

• Collaboration and cooperation with across functional areas with a teaming approach 133

• Technical skills and expertise to be innovative and solve problems 134

• Efficient use of team resources that maximizes productivity. 135

To ensure successful deployment of mission capabilities, FEMA expects Contractors to provide 136 technical methods, techniques, and concepts that are innovative, practical, cost-effective and 137 meet the evolving needs and requirements that result from FEMA’s operational users. 138

FOR OFFICIAL USE ONLY

1.2 Background 139

FEMA leads and supports the nation in a risk-based, comprehensive emergency management 140 system of preparedness, protections, response, recovery and mitigation. FEMA has developed a 141 suite of information systems to meet this mission and provides users a responsive array of 142 information services. The suite of information systems, services, and applications are provided in 143 Appendix A. FEMA’s enterprise information technology (IT) systems shall be operated and 144 maintained at the highest level of performance and reliability twenty-four (24) hours a day, seven 145

(7) days a week. 146 The CIO’s vision is to modernize the FEMA OCIO to “deliver world-class secure Information 147 Technology guidance, products, and services to meet the needs of FEMA’s emergency managers 148 and stakeholders nationwide.” The OCIO’s objective of the short, middle and long term 149 modernization efforts are to transform IT services into a best-of-class, enterprise focused, 150 efficient and well-managed environment. This environment shall be implemented with the 151 flexibility required to support the evolving mission of FEMA and to support the surge 152 requirements necessary to support emergency situations as they occur. 153 The current FEMA IT operations and maintenance (O&M) environment, performed by the 154 FEMA OCIO Service Operations Division, is a combination of new and old technologies, 155 architectures, platforms and tools that includes a wide variety of PC-based, client server, web-156 based, and service-oriented components. These systems have been implemented by FEMA using 157 a variety of service providers under a vast array of oversight and governance conditions. These 158 systems represent a broad spectrum of effectiveness to the Department of Homeland Security 159 (DHS), FEMA, and OCIO mission. The services are supported by hundreds of physical and 160 virtual servers in several data centers. 161 FEMA infrastructure includes voice and video services, and regional data networks. The video 162 and voice connectivity is a mixture of Voice over Internet Protocol (VoIP) and Private Branch 163 Exchange (PBX) technologies. The regional network equipment is aging and requires 164 modernization. FEMA is also replacing the heterogeneous voice and video network with a 165 unified communications platform. 166 FEMA’s OCIO modernization is evolving. This will be achieved by utilizing a comprehensive 167 approach and strategy; supporting the FEMA strategic plan; developing a common operating 168 framework; supporting a secure implementation of enterprise applications and services that 169 support the mission. The modernization effort shall provide enterprise level solutions that will 170 support business needs necessary for the immediate requirements in support of the FEMA 171 mission. 172 FEMA O&M policies and procedures follows the Information Technology Infrastructure Library 173 (ITIL) Service Operation. From the website, https://www.axelos.com/best-practice-174 solutions/itil/what-is-itil. 175 “The ITIL Service Operation stage of the ITIL framework highlights best-practice for delivering 176 IT to meet agreed service levels for both business users and customers. ITIL Service Operation 177 also includes the day-to-day management of technology needed to deliver and support services. 178 The efficient delivery of agreed services is essential to maintain business satisfaction and 179 confidence in IT. It reduces the risk of service outages, and ensures that authorized levels of 180 access are consistently available.” 181 https://www.axelos.com/best-practice-solutions/itil/what-is-itil https://www.axelos.com/best-practice-solutions/itil/what-is-itil

Figure 1 FEMA IT Services Management Lifecycle 184

1.3 Scope 185

The Contractor shall assist the OCIO Service Operations Division in maintaining and maturing 186 the current operations to keep FEMA’s information systems infrastructure available and 187 operational. The Contractor must support traditional operations and maintenance activities and 188 be able to support these activities during periods of Continuity of Operations activities. The 189 scope of work will involve the execution of task orders. Specific categories of tasks that fall 190 within this scope of work and the necessary Contractor capabilities are outlined in the following 191 sections. Staff qualification minimum requirements are also addressed. 192 The Contractor shall ensure that it maintains a sufficient technical infrastructure, processing 193 power, data storage and retention abilities including Continuity of Operation Planning (COOP) 194 in all aspects of this SOW. Since workloads may fluctuate considerably due to crisis or disaster 195 periods, the Contractor’s staffing processes must be flexible and capable of adequately 196 responding to variations in service. 197

1. Currently, FEMA is obtaining IT O&M services through multiple contracted integrators. The 198 objectives of this acquisition are to consolidate six contracts into one contract, transition 199 existing services within 60 days of task order award, ensure accurate and timely invoicing, 200 and obtain O&M services that meet FEMA performance measures. The contractors shall 201 provide a reliable, stable, and secure operating environment that is aligned with the FEMA 202 enterprise infrastructure. 203

2. The Contractor shall support the primary operations locations in the Mount Weather 204 Emergency Operations Center (MWEOC) in Virginia, FEMA Headquarters, and other sites 205 located in the National Capital Region. Additional locations include FEMA Regional offices, 206 FEMA National Processing Service Centers (NPSCs), FEMA’s Brooke Road facility, the 207 National Emergency Training Center (NETC), Long Term Recovery Centers (LTROs), 208 Logistics Centers, Mobile Disaster Recovery Centers (MDRCs), Distribution Centers, and 209

FOR OFFICIAL USE ONLY

Joint Field Offices (JFOs), Center for Domestic Preparedness (CDP) and other permanent or 210 temporary facilities located in the United States and Territories. 211

3. The scope of this contract also includes contractor support to FEMA’s technical staff for 212 operations, maintenance, and proactive monitoring using FEMA’s tools of FEMA’s networks, 213 systems and applications. The contractor will support the FEMA systems and technical 214 environment. 215

4. There are five (5) functional areas that will make up the O&M Support Framework to be 216 addressed by the contractor are as follows: 217

1. Program Management is responsible for providing the program management oversight 218 across the contract and all contract task orders, up to and including contractual 219 deliverables and financial controls. Program Management is one of the primary points of 220 contact with OCIO Systems Management group. The Contractor’s Program Manager is 221 one of the Contractor’s Key Personnel required on the Contract. 222

i. Program Management is also responsible for supporting Mobility Service 223 Center (MSC) and Systems, Databases, and Application Management 224

(SDAM). 225

ii. Program Management should also be able to support project management 227 tasks where contracts and task orders can be quickly established to 228 complete special assignments including but not limited to hardware swap 229 outs, moving a physical environment to a virtual environment, etc. 230

2. Information Technology, Operations and Maintenance responsible for the 231 maintenance, system sustainment, and update of the FEMA infrastructure, to include 232 hardware and software, and for controlling and managing the lifecycle of all changes with 233 minimum disruption to FEMA's end users. Service Operations Division oversees and 234 manages all introductions into the production and test environments (as needed). This 235 includes the shared application and technical services as well as the system software, 236 middleware, information systems infrastructure, networks, and data centers. 237

3. Telecommunications Operations and Maintenance is responsible for providing 238 support to FEMAs telecommunications network. This includes unified communications, 239 mobile device management, and satellite communications. 240

4. Help Desk Services is responsible for providing 24x7x365 end user support across 241

FEMA. 242

5. Network Operating Services is responsible for 24x7x365 monitoring the voice, video, 243 data, and satellite feeds throughout FEMA. 244

1.4 Objective 245

The primary objective of this acquisition is to establish a single award Indefinite Delivery/ 246 Indefinite Quantity (IDIQ) contract for O&M Support Services that will enable the FEMA, 247 through the OCIO to accomplish its mission of “to enhance and maintain IT infrastructure; 248 develop and enhance key systems to support operating programs; increase efficiencies and 249 cooperation across FEMA’s divisional and regional lines.”. 250 The Task Orders issued under the IDIQ will be designed to acquire Operations and Maintenance 251 Support Services and will be written against five (5) functional areas: Program Management 252

(PM), Information Technology Systems Operations and Maintenance, Telecommunication 253 Operations and Maintenance, Help Desk Services, and Network Operating Services. 254 Requirements include updating and maintaining the current hardware infrastructure (including 255 lifecycle replacement) and software platforms, deploying code and upgrades to FEMA’s major 256 systems, management of the telecommunications infrastructure to include mobile and satellite. 257 Staffing of a Help Desk and a Network and Video Operation Center will also be within the scope 258 of the Task Orders. 259

1.5 Applicable Documents 260

The following documents provide specifications, standards, or guidelines that must be complied 261 with in order to meet the requirements of this acquisition: 262

• DHS Acquisition Directive D-102-01 263

• DHS Guidebook, 102-01-103-01, Systems Engineering Lifecycle Guidebook 264

• Instruction Manual 102-01-004-01, DHS Agile Development and Delivery for Information 265 technology Guidebook 266

• Government Accountability Office, Schedule Assessment Guide. 267

• FEMA Program Management Office Standard Operating Procedures 268

1.5.1 Compliance Documents 269

The contractor shall comply with and provide deliverables in accordance with technical and 270 functional performance criteria mentioned in these applicable documents/constraints: 271

• Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 272 1998 (P.L. 105-220); 273

• 36 CFR 1194.21 - Software Applications and Operating Systems, applies to all EIT 274 software applications and operating systems procured or developed under this work 275 statement including but not limited to GOTS and COTS software. In addition, this 276 standard is to be applied to Web-based applications when needed to fulfill the functional 277 performance criteria. This standard also applies to some Web based applications as 278 described within 36 CFR 1194.22. 279

• 36 CFR 1194.22 - Web-based Intranet and Internet Information and Applications, applies 280 to all Web-based deliverables, including documentation and reports procured or 281 developed under this work statement. When any Web application uses a dynamic (non-282 static) interface, embeds custom user control(s), embeds video or multimedia, uses 283 proprietary or technical approaches such as, but not limited to, Flash or Asynchronous 284 JavaScript and XML (AJAX) then -1194.21 Software- standards also apply to fulfill 285 functional performance criteria. 286

• 36 CFR 1194.23 - Telecommunications Products, applies to all telecommunications 287 products including end-user interfaces such as telephones and non-end-user interfaces 288 such as switches, circuits, etc. that are procured, developed or used by the Federal 289 Government. 290

FOR OFFICIAL USE ONLY

• 36 CFR 1194.24 - Video and Multimedia Products, applies to all video and multimedia 291 products that are procured or developed under this work statement. Any video or 292 multimedia presentation shall also comply with the software standards (1194.21) when 293 the presentation is through the use of a Web or Software application interface having user 294 controls available. 295

• 36 CFR 1194.25 - Self Contained, Closed Products, applies to all EIT products such as 296 printers, copiers, fax machines, kiosks, etc. that are procured or developed under this 297 work statement. 298

• 36 CFR 1194.31 - Functional Performance Criteria applies to all EIT deliverables 299 regardless of delivery method. All EIT deliverable shall use technical standards, 300 regardless of technology, to fulfill the functional performance criteria. 301

• 36 CFR 1194.41 - Information Documentation and Support, applies to all documents, 302 reports, as well as help and support services. To ensure that documents and reports fulfill 303 the required -1194.31 Functional Performance Criteria-, they shall comply with the 304 technical standard associated with Web-based Intranet and Internet Information and 305 Applications at a minimum. In addition, any help or support provided in this work 306 statement that offer telephone support, such as, but not limited to, a help desk shall have 307 the ability to transmit and receive messages using TTY. 308

Exceptions for this work statement have been determined by DHS and only the exceptions 309 described herein may be applied. Any request for additional exceptions shall be sent to the 310 Contracting Officer’ Representative (COR) and determination will be made in accordance with 311 DHS MD 4010.2. DHS has identified the following exceptions that may apply: 312

• 36 CFR 1194.2(b) - (COTS/GOTS products), When procuring a product, each agency 313 shall procure products which comply with the provisions in this part when such products 314 are available in the commercial marketplace or when such products are developed in 315 response to a Government solicitation. Agencies cannot claim a product as a whole is not 316 commercially available because no product in the marketplace meets all the standards. If 317 products are commercially available that meets some but not all of the standards, the 318 agency shall procure the product that best meets the standards. 319

• When applying this standard, all procurements of EIT shall have documentation of 320 market research that identify a list of products or services that first meet the agency 321 business needs, and from that list of products or services, an analysis that the selected 322 product met more of the accessibility requirements than the non-selected products as 323 required by FAR 39.2. Any selection of a product or service that meets less accessibility 324 standards due to a significant difficulty or expense shall only be permitted under an 325 undue burden claim and requires approval from the DHS Office on Accessible Systems 326 and Technology (OAST) in accordance with DHS MD 4010.2. 327

• 36 CFR 1194.3(b) - Incidental to Contract, all EIT that is exclusively owned and used by 328 the contractor to fulfill this work statement does not require compliance with Section 508. 329 This exception does not apply to any EIT deliverable, service or item that will be used by 330 any Federal employee(s) or member(s) of the public. This exception only applies to those 331 contractors assigned to fulfill the obligations of this work statement and for the purposes 332 of this requirement, are not considered members of the public. 333

1.5.2 Reference Documents 334

• Executive Order (EO) 12472: Assignment of National Security and Emergency 335

Preparedness Telecommunications Functions 336

• E O 13011 Federal Information Technology 337

• OMB Circular A-130, Management of Federal Information Resources 338

• P O D 63, Critical Infrastructure Protection 339

• PL 107-296, Homeland Security Act 340

• PL 104-106, Information Technology Management Reform Act 341

• PL 103-63, Government Performance and Results Act 342

• PL 107-347, Federal Information Security Management Act I. PL 100-235, Computer 343

Security Act of 1987 344

• PL 105-220, Rehabilitation Act 345

• DHS Management Directive (MD) 4300, DHS Information Security Program 346

• FEMA Risk Management Plan, TBD 347

• FEMA Configuration Management Plan, TBD 348

1.5.3 DHS Enterprise Architecture Compliance 349

Enterprise Architecture (EA) - The contractor shall certify that all solutions and services meet 350 DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor 351 shall comply with the following Homeland Security Enterprise Architecture (HLS EA) 352 requirements: 353

• All developed solutions and requirements shall be compliant with the HLS EA. 354

• All IT hardware and software shall be compliant with the HLS EA Technical Reference 355

Model (TRM) Standards and Products Profile. 356

• Description information for all data assets, information exchanges and data standards, 357 whether adopted or developed, shall be submitted to the Enterprise Data Management 358 Office (EDMO), a program office within the OCIO, for review, approval and insertion 359 into the DHS Data Reference Model and Enterprise Architecture Information Repository 360

• Development of data assets, information exchanges and data standards will comply with 361 the DHS Data Management Policy MD 103-01 and all data-related artifacts will be 362 developed and validated according to DHS data management of architectural guidelines 363

• Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components 364 (networks, infrastructure, and applications) specific to individual acquisitions shall be in 365 accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, 366

FOR OFFICIAL USE ONLY

August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or 367 replacement 368

• All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. 369 Government Version 6 (USGv6) Profile (National Institute of Standards and Technology 370 (NIST) Special Publication 500-267) and the corresponding declarations of conformance 371 defined in the USGv6 Test Program. 372

2 SPECIFIC TASKS AND REQUIREMENTS 373

2.1 Functional Area 1 – Program/Project Management 374

The Contractor will be expected to plan, execute, and manage the work described in this 375 statement of work employing industry best practices for project and program management 376 according to standards and methodologies published by the Project Management Institute or 377 equivalent industry practices. 378 The Contractor shall appoint a full-time, dedicated Contractor Project Manager (PM) who shall 379 be responsible for the accomplishment for all tasks to be performed under this SOW. The 380 Contractor Project Manager shall be the principal interface for all matters relating to the 381 execution of this SOW between the Contractor’s project team and the Contractor’s corporation; 382 between the Contractor’s project team and the Government Program Manager and the FEMA 383 Program Management Office (PMO); and between the Contractor’s project team and associated 384 contractors and subcontractors for all matters relating to the execution of this SOW. 385 The Contractor shall establish a project team responsible for executing the total effort required 386 by this SOW. This organization shall exhibit clear lines of authority, responsibility, and 387 accountability of project authority among all organizational elements including Government, 388 FEMA Contractor, and all subcontractors. 389 The Contractor shall establish a technical approach, organize resources, and establish and 390 execute management controls to ensure cost, technical, and schedule requirements of this SOW 391 are met. 392 The Contractor shall create a Project Management Plan (PMP) describing the scope, approach, 393 schedule, work breakdown structure (WBS), resources, quality assurance, and management 394 controls necessary to meet contract performance, schedule, and cost requirements. The PMP 395 shall describe the Contractor’s project organization including all lines of authority and reporting 396 relationships and further describe monitoring procedures, metrics, and corrective action 397 procedures to be used to manage the project. 398 The Contractor shall implement procedures to monitor technical, cost, quality and schedule 399 performance. The Contractor shall establish metrics to assess and report project status that will 400 enable the Contractor to detect and predict deviations from the planned or required performance 401 (cost, technical, quality, or schedule) in time to take corrective action. 402 The Contractor shall design and implement corrective action procedures to prevent, circumvent, 403 or mitigate the impact of deviations from planned or required performance. 404

The Contractor shall participate in weekly or bi-weekly status meetings with the Government 405 Program Manager and provide an agenda for those meetings. Meeting frequency shall be at the 406 discretion of the Government Program Manager. 407 The Contractor shall prepare and deliver a Monthly Status Report and prepare a monthly status 408 briefing. The Contractor shall attend a Monthly Status Review to be held on the second Tuesday 409 of each month or at the discretion of the Government Program Manager. 410 The Contractor shall follow a FEMA Risk Management Plan. 411 The Contractor shall conduct continuing risk identification and assessment activities to identify 412 any risks that may affect the contractor’s ability to meet its technical cost, and schedule 413 objectives. The Contractor shall inform the Government Program Manager immediately upon 414 identifying risks and shall address those risks and necessary mitigation strategies in the next 415 scheduled status meeting and in the Monthly Status Reports and Briefings. 416 The Contractor shall follow the FEMA Configuration Management Plan. 417 The Contractor shall create, deliver, and maintain a WBS (either within the Project Management 418 Plan or separately) at sufficient levels of detail to assess performance against schedule 419 milestones and budgets. The Contractor shall deliver an initial WBS and subsequent updates as 420 detail is added as work progresses. 421 The Contractor shall work with the Program Management Office team to help define and refine 422 an Integrated Master Schedule (IMS) for O&M functions. 423 The Contractor shall participate in an Integrated Baseline Review (IBR) conducted by the 424 Government Program Manager to be held usually within 90 days of contract award but not more 425 than 180 days following contract award. The IBR will be scheduled by the FEMA Project 426 Manager. 427 The Contractor shall perform Earned Value Management (EVM) tracking using a system 428 conforming to the American National Standards Institute/Electronic Industry Association 429 (ANSI/EIA) Standard 748-A, Earned Value Management Systems. For Agile work, the 430 Contractor shall use Agile EVM. 431 The Contractor shall submit four (4) monthly Earned Value reports: three Contract Performance 432 Report (CPR) Formats 1, 3, and 5, and the Contract Funds Status Report (CFSR). Alternatively, 433 if the Contractor’s EVMS data collection tool is capable of generating raw data in ANSI 434 Accredited Standards Committee (ASC) X12 format, the Contractor may substitute the 435 transmission of this data for the submission of the EVM reports. 436 The Contractor shall utilize an existing FEMA Online Project Repository or develop, deploy, and 437 maintain an Online Project Repository (e.g. SharePoint site) that allows the Contractor, Sub-438 contractor, Government Program Manager, government PMO, and other government contractor 439 personnel to track the project schedule, assess status and risks, schedule events, and review 440 documents and deliverables. The Contractor shall maintain this repository throughout the period 441 of performance. Details will be provided in Task Order. 442 The Contractor shall follow the DHS Systems Engineering Lifecycle (SELC) (DHS Instruction 443 Manual 102-01-001 Acquisition Management Instruction/Guidebook Appendix B System 444 Engineering Life Cycle) and participate in the gate reviews specified by FEMA. 445

FOR OFFICIAL USE ONLY

The Contractor shall participate in SELC phase gate reviews as specified by FEMA. The 446 Contractor shall create gate review presentations summarizing the Contractor’s accomplishments 447 in the previous SELC phase and deliver those presentations along with artifacts demonstrating 448 previous phase accomplishments. The Contractor shall participate in each gate review and shall 449 present the Contractor’s progress to the FEMA Lead Technical Authority conducting the review. 450 The gate reviews applicable to the FEMA projects may include: 451

• System Definition Review (SDR) 452

• Critical Design Review (CDR) 453

• Integration Readiness Review (IRR) 454

• Test Readiness Review (TRR) 455

• Production Readiness Review (PRR) 456

• Operational Test Readiness Review (OTRR) 457

• Operational Readiness Review (ORR). 458

The Contractor may be required to purchase equipment, licenses or managed services to meet on 459 unspecified requirements. FEMA CO approval will be required and a separate modification will 460 be issued for these purchases or the equipment may be authorized under an Other Direct Costs 461 (ODC) CLIN, if determined appropriate. All Contractor-acquired equipment subsequently 462 becomes GFE as defined by the terms of the contract. NOTE: This requirement includes the 463 procurement of any tagged items. 464

2.1.1 Transition Planning 465

2.1.1.1 Transition Support 466

The Contractor shall support DHS Government leads within the purview of this SOW with 467 transition planning and transition plan execution, associated with meeting the agreed upon 468 timeline for transition of SYSO&M support services from the incumbent Contractor to the 469 Contractor awarded the current contract, as directed by the Government COR. This includes: 470

• Coordinating with Government representatives 471

• Reviewing, evaluating, and transition of current Contractor support services 472

• Transition of historical data to any new systems 473

• Ensuring that Contractor personnel receive all Government‐required training and follow 474 all Government certification processes 475

• Receiving all necessary business and/or technical documentation 476

• Providing an orientation phase and program to introduce Government personnel and 477 other users of SYSO&M services to the Contractor's team, tools, methodologies, business 478 processes, equipment, etc. 479

• Receiving Government Furnished Equipment (GFE) and Government Furnished 480 Information (GFI), and providing GFE inventory management assistance. 481

2.1.1.2 Incoming Transition 482

The Contractor shall be responsible, under the direction of the Government, for active 483 participation in the transitioning of SYSO&M services from the incumbent contractor and shall 484 develop an Incoming Transition Plan that ensures that there is no degradation of services during 485 the transition. A final version of the Incoming Transition Plan is due ten (10) business days after 486 the first task order award date. 487 The Incoming Transition Plan shall address the following elements as a minimum: 488

• Mobilization of the Contractor’s transition team 489

• Specific transition tasks to be executed and how they will be managed 490

• Principal transition team members by name, position, and responsibilities 491

• Risks to the transition effort and mitigation and contingency plans in the event the 492 transition cannot be executed on schedule. 493

• The transition schedule in graphic format showing the timing, sequence and 494 interdependencies of tasks. The transition schedule shall be supplemented by sufficient 495 narrative. 496

2.1.1.3 Outgoing Transition 497

The Contractor shall develop and submit an outgoing ninety (90) day Transition Plan, 498 transitioning work from the Contractor to a successor Contractor or Government entity. This 499 transition may be to a Government entity, another Contractor, or to the incumbent Contractor 500 under a new contract. In accordance with the Government‐approved plan, the Contractor shall 501 assist the Government in planning and implementing a complete transition from this contract to a 502 successor Contractor. This shall include formal coordination with Government staff and 503 successor Contractor staff and management. The ninety (90) day Transition Plan shall also 504 include delivery of existing policies and procedures, and delivery of historical and current 505 metrics and statistics. The Transition Plan shall be tailored to the requirement and may include, 506 but not be limited to: 507

• Coordination with Government representatives 508

• Review, evaluation, and transition of current Contractor support services 509

• Transition of historical data to the successor Contractor’s system(s) 510

• Transition of Government‐approved Contractor training materials and certification 511 process documentation 512

• Transfer of all necessary business and/or technical documentation including the 513 operations, maintenance, and user manuals 514

• Transfer of compiled and un‐compiled source code, to include all versions, maintenance 515 updates, and patches 516

• Transfer of GFE and GFI to the successor Contractor 517

• Transfer of the GFE inventory management system, all user and maintenance 518 documentation, and current GFE information in the system to the successor Contractor 519

FOR OFFICIAL USE ONLY

• Facilitation of applicable Government debriefings and personnel out‐processing 520 procedures 521

• Turn‐in of all Government keys, identification and access cards, and security codes. 522

2.1.2 Program Management of Services 523

The Contractor shall provide program management functions to manage servers, applications, 524 devices, etc. from a business, technical, and contractual full lifecycle approach. Program 525 Management should also be able to support project management tasks where contracts and task 526 orders can be quickly established to complete special assignments including but not limited to 527 hardware swap outs, moving a physical environment to a virtual environment, etc. 528 FEMA’s Telecommunications Program requires: 529 FEMA seeks subject matter expertise in telecommunications, project and program management 530 support, lifecycle management, and evolving technologies. In addition, subject matter expertise 531 in acquisition planning, financial analysis, obligation reconciliation, service ordering and 532 provisioning, billing reconciliation and dispute, helpdesk and monitoring/tracking are the key 533 areas requiring support. FEMA requires contract services for the following two overarching 534 areas: 535

1. Technical – The Contractor shall assist FEMA with wireless, wire line, and satellite 536 technologies acquisitions which support voice and data communications to meet those 537 needs, and support to FEMA staff managing these technologies from contractual, and 538 operational and maintenance perspectives. This includes 24 X 7 X 365 call center support 539 for mobility Tier I and II help desk functionality, website maintenance, and NIOS 540 systems operations and maintenance, performance monitoring, integration services, and 541 support of major enterprise disaster and non-disaster assistance. This can also include 542 system engineering support for technology refresh efforts, managing tasks and activities 543 at the project level, and providing program management – centralized coordinated 544 management of all related projects. Managing related projects as a program consolidates 545 processes, resources, and deliverables to achieve requirements more effectively and 546 efficiently and reduce risks associated with managing each project separately. 547

2. Business – The Contractor shall assist FEMA with financial and contract management 548 including, but not limited to, telecommunications provisioning and procurement services, 549 funding management, invoice and reconciliation management, service contract/agreement 550 administration services, dispute management timely reports for accountability of assets, 551 status of funds of telecommunications contracts, and audit and optimization. Also 552 includes assisting in supporting FEMA disaster and non-disaster operations including 553 invoicing, billing, payment, device and service ordering, delivery processes, standardized 554 reporting, auditing, and asset management.