REQUIREMENTS _ESTIMATES _AND_SCOPE_(RES).pdf

REQUIREMENTS, ESTIMATES, AND SCOPE (RES)

STATEMENT OF WORK

OFFICE OF THE CHIEF INFORMATION OFFICER

September 11, 2014

1 Cover Page

PROCUREMENT SENSITIVE TO NOT DISTRIBUTE

Contents 1 Cover Page ............................................................................................................................................... i

This Page Intentionally Left Blank ................................................................................................................ iv

2 Introduction ........................................................................................................................................ - 5 -

3 Scope and Purpose ............................................................................................................................. - 5 -

3.1 Scope ........................................................................................................................................... - 5 -

3.1.1 Requirements Analysis ......................................................................................................... - 5 -

3.1.2 Requirements Management ................................................................................................ - 6 -

3.1.3 Technical Writing and Editor Support Services .................................................................... - 6 -

3.2 Purpose ........................................................................................................................................ - 7 -

4 Requirements ..................................................................................................................................... - 7 -

4.1.1 Platforms and Technical Environments ................................................................................ - 9 -

4.2 Compliance with Appropriate Policies, Laws, and, Standards .................................................... - 9 -

4.3 Development Approaches ......................................................................................................... - 12 -

4.4 Architectural Control and Compliance ...................................................................................... - 13 -

4.4.1 Enterprise Architecture ...................................................................................................... - 13 -

4.5 Innovation and Best Practices ................................................................................................... - 14 -

4.6 Information Systems security .................................................................................................... - 15 -

4.6.1 Security Review and Reporting .......................................................................................... - 15 -

4.6.2 Information Security Policy Compliance ............................................................................ - 15 -

4.6.3 Security Requirements for Unclassified Information Technology Resources .................... - 15 -

4.6.4 Exigency Applications Development, Engineering, and Integration .................................. - 17 -

4.7 Government Furnished Equipment / Facilities / Workspace .................................................... - 18 -

4.8 Place of Performance ................................................................................................................ - 18 -

5 Deliveries and Performance ............................................................................................................. - 20 -

5.1 EAGLE II Task Order ................................................................................................................... - 20 -

5.1.1 Task Order Term ................................................................................................................. - 20 -

5.2 Fair Opportunity ........................................................................................................................ - 21 -

5.3 Order Process ............................................................................................................................ - 22 -

5.3.1 Issuing Work Orders ........................................................................................................... - 22 -

5.3.2 Acceptance of Deliverables ................................................................................................ - 22 -

5.4 Advertising of Award ................................................................................................................. - 22 -ii

5.5 Avoidance of Personal Services ................................................................................................. - 23 -

5.5.1 Prohibition on Personal Services ........................................................................................ - 23 -

5.5.2 Performance of Inherently Governmental Functions ........................................................ - 23 -

5.5.3 Government Rights ............................................................................................................. - 23 -

5.6 Release of Information .............................................................................................................. - 24 -

5.7 Key Personnel ............................................................................................................................ - 24 -

5.7.1 Substitution of Key Personnel ............................................................................................ - 24 -

5.8 Interrelationship of Associate Contractors ............................................................................... - 25 -

6 Invoicing (Based on Objective, CLIN) ................................................................................................ - 26 -

7 Additional Provisions/Terms and Conditions ................................................................................... - 26 -

7.1 Electronic And Information Technology (EIT) (Aug 2001) ......................................................... - 26 -

7.2 Security Clearance Requirements ............................................................................................. - 27 -

7.2.1 3052.204-71 Contractor Employee Access (Jun 2006) Alternate I (Jun 2006) ................... - 29 -

7.2.2 3052.209-72 Organizational Conflict Of Interest (Jun 2006) .............................................. - 32 -

7.3 3052.215-70 Key Personnel Or Facilities ................................................................................... - 33 -

7.3.1 Key Personnel Or Facilities (Dec 2003) 06-01-2006 HSAR 52-14 ....................................... - 33 -

7.3.2 3052.237-70 Qualifications Of Contractor Employees (Dec 2003) .................................... - 34 -

7.3.3 3052.237-72 Contractor Personnel Screening For Unclassified Information Technology Access (Dec 2003) ........................................................................................................................... - 35 -

7.3.4 3052.237-71 Information Technology Systems Access For Contractors (Dec 2003) ......... - 36 -

7.4 3052.242-72 Contracting Officer's Technical Representative (Dec 2003) ................................ - 37 -iii

This Page Intentionally Left Blank iv

2 Introduction

The Federal Emergency Management Agency (FEMA), Office of the Chief Information Officer

(OCIO) is undertaking a transformative mission to enhance and maintain enterprise information technology infrastructure; develop and enhance key systems to support operating programs;

and increase efficiencies and cooperation across FEMA divisional and regional lines. Prior to this requirement, the engineering and operations areas of the OCIO were limited by the priorities and demands placed upon them to implement and follow a full life-cycle approach in the creation, implementation and ongoing support of any given project within their priorities queue. A critical point of success in this transformative mission is to obtain clear, concise requirements analysis for all IT infrastructure projects and initiatives, which will be used as the foundation for full life-cycle requirements management and processes.

3 Scope and Purpose

3.1 Scope

There are two over-arching objectives to this requirement that the contractor shall be responsible for implementing as a process and ensuring delivery of applicable services and artifacts supporting each objective; they are Requirements Analysis and Requirements

Management.

3.1.1 Requirements Analysis

The contractor shall obtain a thorough and detailed understanding of the business need of each project or initiative that the government presents, and then decompose it into discrete requirements.

a) The discrete requirements will then be clearly defined, reviewed and agreed upon with the Customer and Stakeholders.

- 5 -

b) When this process and methodology has been organized and is being managed correctly, FEMA expects that a formalized Requirements Analysis will become the foundation for the desired products or services.

c) The identified requirements are the specifications that will be used during the full life-cycle of the project.

d) Requirement Analysis will be designed and implemented to meet the needs of end-users by identifying and specifying project or program requirements, and it is expected to focus on achievable outcomes, i.e., what will be required to deliver each outcome, and what should identified resources be able to accomplish and deliver.

3.1.2 Requirements Management

The contractor shall establish and implement a process that enables system users, developers, program managers, and test analysts to employ a common understanding of the system that is under development and ensures that business requirements for the product are communicated in a clear, concise and traceable manner. The purpose of Requirements Management is to manage the requirements of any given project or initiative, its products and product components, and to identify inconsistencies between those requirements and the project plans and work products.

3.1.3 Technical Writing and Editor Support Services

The Contractor shall provide required technical writing and editing support to produce, review, and edit highly complex written, graphical and technical materials germane to the development of project requirement documentation, cost estimation, and project scope.

The Contractor shall ensure that it is compliant with applicable DHS and FEMA standards, styles and formats, proper usage of English syntax, and overall structure and organization of material.

Contractor must be proficient with Microsoft Office suite of applications and Microsoft Project software.

- 6 -

3.2 Purpose

The purpose of this acquisition is to procure expert technical and project management contractor support and services to assist FEMA in developing a formalized Requirements, Estimating and Scope (RES) process and methodology that will be used to produce RES documentation. The desired and necessary outcome is to identify a highly qualified and capable Contractor team that will:

• Understand a variety of application development approaches as described herein.

• Can apply those various approaches to different scenarios, as described by a unique set of work requirements, desired behaviors, required labor categories, and relevant skill sets.

• Demonstrates understanding, knowledge, willingness, and ability to accomplish the evolution of applications pursuant to the FEMA CIO vision and efforts to create an agile enterprise based upon a SOA framework that is responsive to the dynamic mission requirements facing FEMA.

• Demonstrates that they can embrace a series of diverse architectures within which work is currently accomplished, and help drive toward those strategic capabilities that FEMA must create.

4 Requirements

This Task Order shall adhere to any or all of the guidelines defined in the Department of

Homeland Security Systems Engineering Life-Cycle (SELC) as presented in Attachment X.

The contractor shall have a thorough and clear understanding of the FEMA enterprise IT infrastructure and its constituent elements and components. Based upon that understanding and FEMA specified product and service needs, the contractor shall use knowledgeable and skilled resources to implement contemporary and professionally recognized and established requirements definition and documentation practices, methods and processes to develop thoroughly researched, validated and documented requirement and project-related artifacts.

- 7 -

Developed artifacts will be used by FEMA as the foundation for the full life-cycle tracking of each project or initiative.

The contractor shall address the following types of requirement management artifacts for each approved effort that is undertaken (this is not an all-inclusive list):

• Preliminary Requirements Definition (builds on pre-SELC activities documented in the

Mission Needs Statement (MNS), Continuity of Operations (CONOPS)).

• Business Requirements Definition (BRD).

• Functional Requirements Analysis and Definition (FRD).

• Performance and Data Requirements.

• Detailed Work Breakdown Structure (WBS).

• Notional Project Schedule.

• Requirements Traceability Matrix (RTM).

• Test and Evaluation Master Plan.

• Security Requirements Traceability Matrix.

• Plan of Action and Milestones (POAM).

• Development of System Security Plan.

• Continuity of Operations Plan (COOP).

• Independent Cost Estimate.

The vendor shall, leveraging its expert technical resources accomplish the following specific work for each identified project or initiative. The work deliverables listed may, at FEMA discretion, be tailored to meet the specific needs of any given project or initiative. The work deliverables are not limited to those shown:

a) A defined scope planning and definition document for projects and related activities;

b) A document for verifying and documenting that the scope of projects and activities satisfies stakeholders;

c) A document for assessing and documenting the scope verification process;

d) A document for managing and documenting changes to project and activity scope;

- 8 -

e) A document(s) that identifies specific schedule activities, dependencies among scheduled activities, number of work periods to complete individual scheduled activities, resources requirements, and scheduled constraints for each project or initiative;

f) A document for controlling and documenting changes to project schedules;

g) A document for addressing, planning, executing and documenting risk management activities;

h) A document that addresses options and actions to enhance opportunities to reduce threats to project objectives, risks, and evaluates the effectiveness of the option and actions throughout the project life-cycle.

i) Create and deliver a weekly status report, as approved by FEMA, that shall at a minimum address all projects or initiatives being worked, applicable EV metrics, specific issues/concerns, items requiring escalation for resolution, and expected completion of project artifacts.

4.1.1 Platforms and Technical Environments

The contractor must become familiar with FEMA platforms and technical environments so that the contractor can effectively define relevant and applicable requirements to any proposed project or initiative. The FEMA Technical Reference Model (TRM) governs the range of compliant platforms. Conformance to this reference model is required in the performance of work described herein. The Technical Reference Model will be available to the winning

Contractor after award. An abstract of the TRM is provided as Attachment X.

4.2 Compliance with Appropriate Policies, Laws, and, Standards

Compliance with the policies, laws, and standards, described in the EAGLEII Task Order is required. The Federal Emergency Management Agency will provide governing management, control, and oversight during the life of this effort.

In addition to Attachment 3 the following mandatory DHS Clauses apply:

- 9 -

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998

(P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable standards have been identified:

36 CFR 1194.21 – Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 – Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then “1194.21

Software” standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 – Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non-end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.24 – Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia

- 10 -presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

36 CFR 1194.31 – Functional Performance Criteria applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 – Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required

“1194.31 Functional Performance Criteria”, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum.

In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the

COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply:

36 CFR 1194.2(b) – (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a

Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meets some but not all of the standards, the agency must procure the product that best meets the standards.

When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the

- 11 -accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires approval from the DHS Office on Accessible Systems and Technology (OAST) in accordance with

DHS MD 4010.2.

36 CFR 1194.3(b) – Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

4.3 Development Approaches

FEMA’s application development approaches are based upon a combination of life-cycles and methodologies for different types of development. FEMA expects that it will use these development approaches to achieve its application architecture goals.

Development approaches include:

• A software development life-cycle (SDLC) that governs “traditional” (i.e., waterfall, spiral, Universal Mark-up Language UML, incremental etc.) development; this is typically applied to larger applications enhancements and development efforts;

• Rapid Applications Development (RAD) efforts that follow an instance of the SDLC that is tailored for evolutionary development wherein technical requirements evolve based upon user feedback; this is typically applied to mid-sized applications and development efforts. This approach is used to (a) Incrementally apply modified SDLC re-development methods to bring non-compliant applications into compliance with legal and regulatory requirements or (b) quickly create urgent and compelling mission services using incremental development methods to quickly and incrementally bring critical mission

- 12 -products on-line using a Risk Assessment and Plan of Action and Milestones (POAM) to document and mitigate risk. All Agile products will comply with the requirements defined in the Agile Systems Compliance Guidelines. Applications required as a result of legal or congressional mandates often require short timeframes and few requirements would be developed in this manner.

4.4 Architectural Control and Compliance

Application development approaches will call for specific architectures; nevertheless, all development must conform to and exist in harmony with the DHS and FEMA evolving

Enterprise Architecture (EA).

4.4.1 Enterprise Architecture

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures as it relates to this Performance Work Statement and its associated Task Order and subsequent Work Orders. Specifically, the contractor shall comply with the following FEMA

Enterprise Architecture (FEMA EA) and Homeland Security Enterprise Architecture (HLS EA) requirements:

• All developed solutions and requirements shall be compliant with the FEMA EA and HLS

EA.

• All IT hardware, software, and related technology shall be compliant with the FEMA

Technology Standards and the FEMA EA and HLS EA Technical Reference Model (TRM)

Standards and Products Profile.

• All data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the FEMA Enterprise Data Management Office (EDMO) and DHS EDMO for review and insertion into the FEMA and DHS Data Reference Model.

• In compliance with OMB mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

- 13 -

4.5 Innovation and Best Practices

The contractor is expected to participate in FEMA’s goal is to create, through innovation and the application of industry best practices, an organization where all IT services are delivered through state-of-the-art, service-enabled applications, processes, methods, and practices to:

• Stabilize and integrate Information Technology assets across the Agency

• Provide “cradle to grave” emergency management support including but not limited to preparedness, training, mitigation, response, and recovery.

• Protect the emergency management infrastructure and information assets against loss or compromise

• Enhance the Homeland Security information infrastructure through sharing mission-critical information where and when it is needed, regardless of organizational boundary

• Effectively leverage existing information assets to address emerging mission requirements quickly

• Propel FEMA Software Application development, implementation, and operations forward to Capability Maturity Model Level 3 and/or Capability Maturity Model

Integrated Level 3 as defined by the Software Engineering Institute.

• Support the effective analysis, assessment and selection of appropriate solutions, products and technologies to support the enterprise

• Optimize return on all IT applications expenditures

• Implement proper project management practices and reporting procedures in adherence to established best practices (e.g., PMBOK).

Clearly, this new organization cannot be created without innovative ideas and solutions.

Therefore, the Government’s desired outcome is to transform the FEMA organization so that resources are optimized and the mission is more efficiently accomplished. Thought leadership is an integral component of this effort.

- 14 -

4.6 Information Systems security

4.6.1 Security Review and Reporting

a) The Contractor shall include security as an integral element in the management of this contract. The Contractor shall conduct reviews and report the status of the implementation and enforcement of the security requirements contained in this contract and identified references.

b) The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The

Contractor shall afford DHS including the Office of Inspector General, FEMA ISSM, and other government oversight organizations, access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/FEMA data or the function of computer systems operated on behalf of DHS/FEMA and to preserve evidence of computer crime.

4.6.2 Information Security Policy Compliance

All services, hardware and software provided under this task order must be compliant with DHS

Information Security Policy, DHS 4300.1 as implemented by DHS MD 4300A Sensitive Systems

Handbook or National Security Systems Policy Directive 4300B.

4.6.3 Security Requirements for Unclassified Information Technology Resources

a) The Contractor shall be responsible for Information Technology (IT) security compliance for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have

- 15 -physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency's mission.

b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within 30 days after contract award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the

Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor's IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the

Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-

130.

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor's site (including any information stored, processed, or transmitted using the Contractor's computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

c) Examples of tasks that require security provisions include--

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor's copy be corrupted; and

- 16 -

(2) Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract, and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

e) Within 6 months after contract award, the contractor shall submit written proof of IT

Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Handbook Publication, 4300A (Version 7.2.1, August 9, 2010) or any replacement publication, which the

Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the

Contracting Officer, shall be incorporated into the contract as a compliance document.

The contractor shall comply with the approved accreditation documentation.

4.6.4 Exigency Applications Development, Engineering, and Integration

During the response, recovery, and mitigation of declared disasters and emergencies many new urgent and compelling requirements often arise that require automation of emergency tracking, coordinating, reporting, information management, human capital services, and management of evolving emergency management actions and tasks. Additionally, congressionally mandated requirements with challenging and strict deadlines may imposed scope and schedules that require urgent and agile development efforts. FEMA must be able to effectively and responsively provide automation of these services using an agile solution that defines, contains, and mitigates risk. The government recognizes that agile solutions requires temporary acceptance of risks and shortfalls. The government expects the contractor to clearly define an agile process by which urgent and compelling automation requirements can be met in a timely manner while risk and compliance issues are addressed. These tasks frequently

- 17 -require immediate applications and systems development, which must be accomplished in a fraction of the time normally, allocated to accomplish the task of building operationally compliant applications. Consequently, Service Oriented Architecture (SOA) tool and services, Rapid Application Development (RAD), Joint Application Design (JAD), Beta Releases, and incremental applications rollout methodologies are employed to meet the exigent requirements.

These applications shall be design in so that they may be brought into compliance with the requirements identified in the SELC and be documented in Work Packages. However, these systems most often require an initial incremental implementation strategy.

Further, as FEMA matures its information technology services to be CMMI level 3, non-compliant field developed applications are likely to be discovered requiring urgent and compelling re-alignment and compliance actions.

4.7 Government Furnished Equipment / Facilities / Workspace

The contractor shall provide sufficient workspace, equipment, services, and facilities to support its staffing. However, it may be government furnished. If deemed necessary by the government, sufficient workspace and facilities will be provided by FEMA for the contractor’s team and will include office furniture, telephones, networking, analog lines, computers, laptops, printers, and facsimile and copier machines. The Contractor shall use the Government

Furnished Workspace and equipment only in connection with this Task Order.

In all cases where government data resides at a contractor provided computer facility the contractor shall submit and gain Government approval of that plan prior to storing the data.

The details of that plan shall be consistent with the requirements in the EAGLEII Contract.

4.8 Place of Performance

The majority of work is anticipated to be performed at FEMA offices at Patriots Plaza in Washington DC;

however, some work may need to be accomplished at other FEMA locations within the National Capitol

Region (NCR), other FEMA facilities, or at FEMAs discretion from the contractor’s office.

- 18 -

It is anticipated that the primary places of performance for the activities under this contract will occur at:

FEMA Headquarters Federal Emergency Management Agency 500 C Street SW Washington, DC 20472

FEMA OCIO

Software Development, Engineering & Integration Division (SDEI) Patriots Plaza 245 E Street SW, 2nd Floor Washington, DC 20472

FEMA Mt. Weather Emergency Operations Center 19844 Blue Ridge Mountain Road Mt. Weather, Virginia 20135

FEMA Disaster Operations Center 340 Market Street Winchester, Virginia 22603

FEMA currently has a number of other locations within the Washington metropolitan areas.

When specific needs arise, activities under this contract may need to be performed in those locations.

The activities under the scope of this contract may also be required to occur at other FEMA locations. This may include:

FEMA Regional Offices:

Region I – Boston Region II – New York Region III – Philadelphia Region IV – Atlanta Region V – Chicago Region VI – Denton, TX Region VII – Kansas City, MO Region VIII – Denver, CO Region IX – Oakland, CA Region X – Bothell, WA

FEMA National Processing Service Center (NPSC)

- 19 -

Denton, TX Hyattsville, MD Winchester, VA

5 Deliveries and Performance

5.1 EAGLE II Task Order

In addition to EAGLE Section F, Deliveries and Performance, the following terms and conditions are in full force and effect.

5.1.1 Task Order Term

The term of this Task Order is 12 months after date of Task Order award for the base period with five annual renewable options in accordance with the period of performance of the

EAGLEII contract.

5.1.1.1 Work Order-Specific Reports

Specific reports will be identified as required in individual Work Orders.

FEMA applies Earned Value Management to all development efforts when applicable and to use

EVM criteria to the degree that is appropriate relative to size and complexity of the development effort. FEMA will specify in each work order whether all 32 criteria of ANSI/EIA

Standard 748A will be applied or whether on a specified number of the 32 criteria will be applied. Basic Guidance on EVM is defined in the Department of Homeland Security Earned

Value Management Guidance, Version 1.1, February 2007.

5.1.1.2 Small Business Reporting Requirement

This Task Order contains Small and Disadvantaged Business (SDB) participation targets. The contractor shall report on the participation of SDB concerns at quarterly, or as otherwise provided in this Task Order. Reporting shall be on Optional Form 312, Small Disadvantaged

Business Participation Report. This report is required for each contract containing SDB participation targets. If this contract contains an individual Small, Small Disadvantaged,

- 20 -

Veteran-Owned, Service-Disabled Veteran-Owned, and Women-Owned Small Business

Subcontracting Plan, reports may be submitted with the final Subcontracting Report for

Individual Contracts (Standard Form 294) at the completion of the contract.

Large businesses responding to the task order proposal request must submit a subcontracting plan during Phase II as prescribed in FAR 52.219-9, which meets the following DHS subcontracting goals:

Type of Business Goal % of Total TO $ (Less ODCs)

Small Businesses 40%

Small Disadvantaged Businesses 5%

Woman-Owned Small Businesses 5%

Service-Disabled Veteran-Owned Small Businesses and Veteran- Owned Small Businesses

3%

HUBZone 3%

5.1.1.3 Subcontracting Plan Compliance

The contractor shall comply with Section F.8.3 – Subcontracting Plan Reports, of the EAGLEII contract.

5.2 Fair Opportunity

Upon award of the Task Order for applications development services, and subject to the

Availability of Funds and negotiation of a fair and reasonable price, the Government reserves the right to award the Contractor future Work Orders for related applications development and integration services and related applications development infrastructure support services subject to the Fair Opportunity exceptions allowed under FAR 16-505, ordering within the scope of the Task Order.

- 21 -

5.3 Order Process

The Government will order any supplies and services to be furnished under this Task Order by issuing Work Orders containing one or more Work Packages on an agency prescribed form.

Some Work Orders may be generated without the use of a representative Work Package(s). All orders are subject to the terms and conditions of the selected contract. In the event of a conflict between an order and the EAGLEII contract, the EAGLE contract shall control. In no event will an order change the requirement of the EAGLEII contract.

5.3.1 Issuing Work Orders

Only the Contracting Officer is authorized to issue Work Orders. The Contractor is hereby notified that future Work Orders may be subject to negotiations and mutual agreement of the parties.

5.3.2 Acceptance of Deliverables

The acceptance of deliverables produced by the vendor shall be accomplished by FEMA and will be based upon a critical review of each artifact within 10 workdays from date received. Artifacts that are determined to be non-conforming to agreed to and established

The Software Development, Engineering and Integration (SDEI) division is responsible for leadership and managing the activities, work products, and oversight of the requirements of this effort. The vendor will provide material and support to achieve successful outcomes that support the mission and goals of this initiative.

5.4 Advertising of Award

The contractor shall not refer to awards in commercial advertising in such a manner as to state or imply that the product or service provided is endorsed or preferred by the Federal

Government or is considered by the Government to be superior to other products or services.

- 22 -

5.5 Avoidance of Personal Services

The Government shall not supervise contractor employees. The contractor shall determine work schedules and work methodology for its employees.

5.5.1 Prohibition on Personal Services

No personal services shall be performed under this Task Order. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any

Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the COTR and/or the Contracting Officer of this communication or action.

5.5.2 Performance of Inherently Governmental Functions

The Contractor shall not perform any inherently governmental functions under this Task Order.

No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government Contractors in connection with this contract, the Contractor employee shall state that they have no authority to, in any way, change the contract and that if the other

Contractor believes this communication to be a direction to change their Task Order, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

5.5.3 Government Rights

Nothing in this clause shall limit the Government's rights in any way under any other provision of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract.

- 23 -

5.6 Release of Information

The contractor and subcontractors may NOT release to the public or other Government agencies any information developed under or pertaining to this contract or subcontracts without the approval of the Contracting Officer. This information includes press releases, promotional literature, price lists, and deliverables.

5.7 Key Personnel

The contractor shall use the key personnel set forth in its offer, upon which award of this order shall be based, for performance of the effort set forth under the contract. Key personnel named in the contractor’s offer shall not be replaced without 30-day prior written request and approval. In the event that one or more of the personnel are not available, or become unavailable, the contractor shall furnish substitute personnel of equal skills and certifications, of which substitutions shall be subject to approval of the contracting officer, COTR, and applicable FEMA Program Manager.

If applicable, Key personnel will also be identified at the Work Order level with the same substitution requirements as outlined herein.

5.7.1 Substitution of Key Personnel

The contractor shall assign to the contract those persons whose resumes were submitted with its Phase 2 offer who are necessary to fill the requirements of the contract and orders there under. No substitutions shall be made except in accordance with this clause.

5.7.1.1 Request for Substitutions

The contractor shall not allow personnel substitutions during the contract performance period unless the contractor promptly notifies the contracting officer, with a copy to the COTR and

FEMA Work Order Project Manager and provides the information required by this section. All proposed substitutions must be submitted, in writing, at least thirty (30) calendar days in advance of the proposed substitutions to the contracting officer, and provide the information required in this section.

- 24 -

All requests for substitutions must include a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute, and any other information requested by the contracting officer needed to approve or disapprove the proposed substitution. No subcontractor travel or ODC costs incurred by the subcontractor prior to FEMA approval in writing may be billed to this Task Order. All proposed substitutions must have qualifications that are equal to or higher than the qualifications of the person(s) to be replaced. The contracting officer or an authorized representative will evaluate such requests and promptly notify the contractor of approval or disapproval within 10 business days of receipt of the substitution request.

5.8 Interrelationship of Associate Contractors

FEMA may enter into contractual agreements with other Contractors (i.e., “Associate

Contractors”) in order to provide information technology requirements separate from the work to be performed under this contract, yet having links and interfaces to this contract. The

Contractor may be required to coordinate with other such Contractor(s) through the cognizant

Contracting Officer and/or designated representative in providing suitable technical and/or management interfaces and in avoidance of duplication of effort. Information on deliverables provided under separate contracts may, at the discretion of FEMA and/or other Government agencies, be provided to such other Contractor(s) for the purpose of such work.

Where the Contractor and an Associate Contractor (Associate) fail to agree upon action to be taken in connection with their respective responsibilities, each Contractor shall promptly bring the matters to the attention of the cognizant Contracting Officer and furnish the Contractor’s recommendations for a solution. The Contractor shall not be relieved of its obligations to make timely deliveries or be entitled to any other adjustment because of failure of the Contractor and the Associate to promptly refer matters to the Contracting Officer or because of failure to implement Contracting Officer directions.

Where the Contractor and Associate are required to collaborate to deliver a service; the

Government will designate, in writing and prior to the definition of the task, to both

Contractors, a “lead Contractor” for the project. In these cases the Associate shall also be

- 25 -contractually required to coordinate and collaborate with the Contractor. FEMA will facilitate the mutual execution of Non-Disclosure Agreements.

6 Invoicing (Based on Objective, CLIN)

7 Additional Provisions/Terms and Conditions

The following clauses are hereby incorporated by reference (by Citation Number, Title, and Date) in accordance with the clause at FAR "52.252-2 CLAUSES INCORPORATED BY REFERENCE" contained in this document. FAR 52.252-2 contains the Internet address for electronic access to the full text of a clause.

52.227-17 Rights in Data – Special Works (JUN 1987)

52.246-17 Warranty of Supplies of a Noncomplex Nature (JUN 2003)

52.246-18 Warranty of Supplies of a Complex Nature (MAY 2001)

52.246-19 Warranty of Systems and Equipment Under Performance Specifications or Design Criteria (MAY 2001)

52.246-20 Warranty of Services

3052.219-70 Small Business subcontracting plan reporting (JUN 2006)

3052.223-70 Removal or disposal of hazardous substances – applicable licenses and

Permits (JUN 2006)

3052.228-70 Insurance (DEC 2003)

3052.242-71 Dissemination of contract information (DEC 2003)

3052.242-72 Contracting officer's technical representative (DEC 2003)

3052.245-70 Government property reports (JUN 2006)

7.1 Electronic And Information Technology (EIT) (Aug 2001)

The Federal Emergency Management Agency (FEMA) considers universal accessibility to information a priority for all its employees and external customers, including individuals with disabilities. Pursuant to the Workforce Investment Act of 1998, 29 U.S.C. A794d, FEMA must

- 26 -ensure the accessibility of its applications and activities to all current and potential users, specifically its obligation to acquire and use accessible Electronic and Information Technology

(EIT) including web pages, software, telecommunications, kiosks and other information transaction machines, and fax machines, copiers, printers, and other information technology office equipment. To comply with the provisions of this clause, the contractor shall provide EIT that meets the intent of the Workforce Investment Act of 1998 which requires, regardless of medium, - -

(i) Individuals with disabilities who are Federal employees to have access to and use of information and data that is comparable to access to and use of the information and data by

Federal employees who are not individuals with disabilities; and

(ii) Individuals with disabilities who are members of the public seeking information or services from FEMA to have access to and use of information and data that is comparable to the access to and use of the information and data by such members of the public who are not individuals with disabilities.

Furthermore, the contractor shall comply with the applicable accessibilities standards issued by the Architectural and Transportation Barriers Compliance Board at 36 CFR 1194 and http://www.section508.gov.

7.2 Security Clearance Requirements

(a) Contractor employees working on this contract must complete such forms and supply such information, as may be determined by the agency, to be necessary for security or other reasons, including the conduct of background investigations to determine suitability or eligibility. High and Moderate Risk positions require that an applicant fingerprint card (FD-258), United States of American Authorization to Obtain Consumer (Credit) Report, a Questionnaire for Public Trust Positions (SF 85P), shall be and a Non-Disclosure Agreement Statement completed, submitted, and processed as directed by the Contracting Officer for each contractor

- 27 -employee working on this Task Order. Low Risk positions require only the FD-258 and the SF

85P.

(b) The scope of the suitability (as determined by the COTR) will depend on the risk level of the contractor position as delineated in DHS Management Directive 11055, Suitability

Screening Requirements Form Contractors. The DHS FEMA Safety & Security Branch, Personnel

& Information Security Section shall adjudicate information received as a result of the fingerprint check and OPM background investigation; unless the same has been previously adjudicated by the DHS Office of Security or other authorized security office.

(c) Access to DHS FEMA facilities, personnel, assets, resources, clients, emergency partners, and sensitive information including proprietary data or resources, requires…