DRAFT_Attachment_J.2_Operations_and_Maintenance_PWS_V.5_2-24-17.pdf

FEMA Service Operations Division Indefinite Delivery, Indefinite Quantity Performance Work Statement

Department of Homeland Security (DHS) Federal Emergency Management Agency

(FEMA)

Service Operations Division Operations and Maintenance

Indefinite Delivery, Indefinite Quantity Performance Work Statement (PWS)

February 24, 2017 Version 5

Contents 1

1.1 Introduction ..................................................................................................................................... 4 2

1.2 Background ..................................................................................................................................... 5 3

1.3 Scope ............................................................................................................................................... 6 4

1.4 Objective ......................................................................................................................................... 7 5

1.5 Applicable Documents ................................................................................................................... 8 6

1.5.1 Compliance Documents .......................................................................................................... 8 7

1.5.2 Reference Documents ........................................................................................................... 10 8

1.5.3 DHS Enterprise Architecture Compliance............................................................................ 10 9

2 SPECIFIC TASKS AND REQUIREMENTS ........................................................................ 11 10

2.1 Functional Area 1 – Program/Project Management ................................................................... 11 11

2.1.1 Transition Planning ................................................................................................................ 13 12

2.1.2 Program Management of Services ....................................................................................... 15 13

2.1.3 Reporting ................................................................................................................................ 16 14

2.2 Functional Area 2: Information Technology System Operations and Maintenance .............. 17 15

2.2.1 Hardware and Software Maintenance ................................................................................... 17 16

2.2.2 Agile Approaches ................................................................................................................... 18 17

2.2.3 Custom Design Solutions ..................................................................................................... 21 18

2.2.4 Database Administration ....................................................................................................... 22 19

2.2.5 Testing .................................................................................................................................... 22 20

2.2.6 Backup Support ..................................................................................................................... 22 21

2.2.7 Change and Release Management ....................................................................................... 22 22

2.2.8 Deployment ............................................................................................................................ 23 23

2.2.9 Technology Refresh ............................................................................................................... 23 24

2.2.10 SharePoint Support Services………………………………………………………………...……23 25

2.2.11 Service Orientedd Architecture (SOA) Support Services…………………………………….24 26

2.2.11 Office 365/Exchange/Email as a Service (EaaS) Support…………………………………….24 27

2.2.12 Virtual Machine Support……………………………………………………………………………24 28

2.2.13 Production Environment Monitoring, Statistics and Reporting…………………………….24 29

2.3 Functional Area 3: Telecommunications Operations and Maintenance .................................. 24 30

2.3.1 Private Branch Exchange (PBX) ........................................................................................... 25 31

2.3.2 Centralized Telecommunications Ordering and Billing Support ....................................... 25 32

2.3.3 Unified Communications – Request Fulfillment Service .................................................... 26 33

2.3.4 SATCOM – Request Fulfillment Service ............................................................................... 27 34

FEMA Operations and Maintenance PWS

2.3.5 Cellular Communication – Request Fulfillment Service ..................................................... 28 35

2.3.6 Mobile Device Management Service ..................................................................................... 29 36

2.3.7 Miscellaneous Service ........................................................................................................... 29 37

2.4 Functional Area 4: Help Desk Services ...................................................................................... 29 38

2.4.1 Service Request ..................................................................................................................... 30 39

2.4.2 Access Management .............................................................................................................. 31 40

2.4.3 Incident Management ............................................................................................................ 31 41

2.4.4 Problem Management ............................................................................................................ 31 42

2.4.5 Knowledge Management ....................................................................................................... 32 43

2.4.6 Metrics .................................................................................................................................... 32 44

2.5 Functional Area 5: Network Operating Services ........................................................................ 32 45

2.5.1 Network Access Management............................................................................................... 33 46

2.5.2 Event Management ................................................................................................................ 34 47

2.5.3 Incident Management ............................................................................................................ 35 48

2.5.4 Problem Management ............................................................................................................ 35 49

2.5.5 Intrusion Detection Monitoring and Incident Management ................................................ 35 50

3 Optional Requirements ..................................................................................................... 36 51

3.1 Optional Requirement—Surge .................................................................................................... 36 52

4 CONTRACTOR RESOURCES ........................................................................................... 36 53

4.1 Qualified Personnel ...................................................................................................................... 36 54

4.2 Removal and Suspension ............................................................................................................ 36 55

4.3 Security Clearances ..................................................................................................................... 36 56

4.4 Continuity of Support ................................................................................................................... 37 57

4.5 Key Personnel ............................................................................................................................... 37 58

4.6 Program Manager ......................................................................................................................... 37 59

4.7 Employee Identification ............................................................................................................... 37 60

4.8 Employee Conduct ....................................................................................................................... 38 61

4.9 Removing Employees for Misconduct or Security Reasons .................................................... 38 62

4.10 Training ......................................................................................................................................... 38 63

5 OTHER APPLICABLE CONDITIONS ................................................................................ 38 64

5.1 Place of Performance ................................................................................................................... 38 65

5.2 Hours of Operation ....................................................................................................................... 39 66

5.3 Travel ............................................................................................................................................. 39 67

5.4 Security ......................................................................................................................................... 39 68

5.4.1 Continued Eligibility .............................................................................................................. 40 69

5.4.2 Termination ............................................................................................................................ 40 70

5.4.3 Suitability Determination ....................................................................................................... 40 71

5.4.4 Background Investigation ..................................................................................................... 40 72

5.4.5 Access to Classified and Confidential Unclassified Information ....................................... 41 73

5.5 Information Technology Security Clearance .............................................................................. 41 74

5.6 Security of Deliverables ............................................................................................................... 42 75

5.7 Information Technology Security Training and Oversight ........................................................ 42 76

5.8 Post-Award Conference ............................................................................................................... 42 77

5.9 Project Plan ................................................................................................................................... 43 78

5.10 Business Continuity Plan ............................................................................................................ 43 79

5.10.1 Individual BCPs ...................................................................................................................... 43 80

5.11 Progress Reports ......................................................................................................................... 44 81

5.12 Progress Meetings ....................................................................................................................... 44 82

5.13 General Report Requirements ..................................................................................................... 44 83

5.14 Protection of Information ............................................................................................................. 44 84

5.14.1 Required Security and Privacy Training for Contractors ................................................... 45 85

5.14.2 Requirement To Support Completion of Privacy Compliance Documents [Privacy 86 Compliance Documentation] ........................................................................................................... 45 87

5.15 Suspected Loss of Compromise of SPII [Breach] ..................................................................... 47 88

5.16 Section 508 Compliance ........................................................................................................... 49 89

5.16.1 Accessibility Requirements (Section 508) ................................................................. 49 90 6 GOVERNMENT/CONTRACTOR-FURNISHED RESOURCES........................................... 51 91

6.1 GFE, Government-Furnished Property (GFP), and Contractor-Acquired Property (CAP) ...... 51 92 7 CONTRACTOR-FURNISHED PROPERTY ........................................................................ 52 93 8 GOVERNMENT ACCEPTANCE PERIOD .......................................................................... 52 94

8.1 COR Right to Reject or Require Correction ............................................................................... 52 95

8.2 Review and Comment Period Duration ....................................................................................... 52 96

8.3 Other Review Time Periods and Schedules ............................................................................... 52 97

9 DELIVERABLES ................................................................................................................ 52 98 Appendix A FEMA’s Systems, Services, and Applications………………………………………………...54 99 Appendix B Professional Certifications………………………………………………………………………..59 100

GENERAL 102

1.1 Introduction 103

The mission of the Federal Emergency Management Agency (FEMA) is “to support our citizens 104 and first responders to ensure that as a nation we work together to build, sustain and improve our 105 capability to prepare for, protect against, respond to, recover from, and mitigate all hazards.” For 106 35 years, FEMA’s mission has consistently been to lead America to prepare for, prevent, respond 107 to, and recover from disasters with a vision of “A Nation Prepared.” 108 The mission of FEMA Office of the Chief Information Officer (OCIO) is to enhance and 109 maintain information technology (IT) infrastructure, develop and enhance key systems to support 110 operating programs, and increase efficiencies and cooperation across FEMA’s divisional and 111 regional lines. To support FEMA’s mission, the OCIO is providing the leadership to enable the 112 entire FEMA enterprise, including the OCIO organization, to better manage and execute its IT 113 portfolio, programs, and projects. 114 The OCIO is transforming FEMA IT environment through a series of enterprise-wide 115 enhancements, including IT project management, requirements, best practice systems 116 development processes, IT security, operations and maintenance, and IT quality assurance. This 117 transformation is being accomplished to enhance and maintain the enterprise technology 118 infrastructure, develop and enhance key systems to support operating programs, and increase 119 efficiencies and cooperation across FEMA divisional and regional lines. 120 FEMA IT projects, infrastructure, and operations will be managed and executed with a 121 standardized approach that leverages all possible enterprise-wide acquisition efficiencies, utilizes 122 a common best-practice approach to project management, and provides for the more efficient 123 integration of systems and use of resources. 124 The FEMA transformation approach will focus on high performance execution with skilled 125 teams collaborating across functional areas to include requirements, development, operations and 126 maintenance, quality assurance, and security. High performing, cross functional, collaborating 127 teams will execute using rapid application development approaches such as Agile 128 methodologies. FEMA will adapt the Department of Homeland Security Systems Engineering 129 Life Cycle (DHS SELC) as it transforms and mature its policies and guidelines and expects 130 Contractors to rapidly evolve. Critical success factors will include: 131

• High productivity with resultant high quality work 132

• Collaboration and cooperation with across functional areas with a teaming approach 133

• Technical skills and expertise to be innovative and solve problems 134

• Efficient use of team resources that maximizes productivity. 135

To ensure successful deployment of mission capabilities, FEMA expects Contractors to provide 136 technical methods, techniques, and concepts that are innovative, practical, cost-effective and 137 meet the evolving needs and requirements that result from FEMA’s operational users. 138

1.2 Background 139

FEMA leads and supports the nation in a risk-based, comprehensive emergency management 140 system of preparedness, protections, response, recovery and mitigation. FEMA has developed a 141 suite of information systems to meet this mission and provides users a responsive array of 142 information services. The suite of information systems, services, and applications are provided in 143 Appendix A. FEMA’s enterprise information technology (IT) systems shall be operated and 144 maintained at the highest level of performance and reliability twenty-four (24) hours a day, seven 145

(7) days a week. 146 The CIO’s vision is to modernize FEMA OCIO to “deliver world-class secure Information 147 Technology guidance, products, and services to meet the needs of FEMA’s emergency managers 148 and stakeholders nationwide.” The OCIO’s objective of the short, middle and long term 149 modernization efforts are to transform IT services into a best-of-class, enterprise focused, 150 efficient and well-managed environment. This environment shall be implemented with the 151 flexibility required to support the evolving mission of FEMA and to support the surge 152 requirements necessary to support emergency situations as they occur. 153 The current FEMA IT operations and maintenance (O&M) environment, performed by FEMA 154 OCIO Service Operations Division, is a combination of new and old technologies, architectures, 155 platforms and tools that includes a wide variety of PC-based, client server, web-based, and 156 service-oriented components. These systems have been implemented by FEMA using a variety 157 of service providers under a vast array of oversight and governance conditions. These systems 158 represent a broad spectrum of effectiveness to the Department of Homeland Security (DHS), 159 FEMA, and OCIO mission. The services are supported by hundreds of physical and virtual 160 servers in several data centers. 161 FEMA infrastructure includes voice and video services, and regional data networks. The video 162 and voice connectivity is a mixture of Voice over Internet Protocol (VoIP) and Private Branch 163 Exchange (PBX) technologies. The regional network equipment is aging and requires 164 modernization. FEMA is also replacing the heterogeneous voice and video network with a 165 unified communications platform. 166 FEMA’s OCIO modernization is evolving. This will be achieved by utilizing a comprehensive 167 approach and strategy; supporting FEMA strategic plan; developing a common operating 168 framework; supporting a secure implementation of enterprise applications and services that 169 support the mission. The modernization effort shall provide enterprise level solutions that will 170 support business needs necessary for the immediate requirements in support of FEMA mission. 171 FEMA O&M policies and procedures follows the Information Technology Infrastructure Library 172 (ITIL) Service Operation. From the website, https://www.axelos.com/best-practice-173 solutions/itil/what-is-itil. 174 “The ITIL Service Operation stage of the ITIL framework highlights best-practice for delivering 175 IT to meet agreed service levels for both business users and customers. ITIL Service Operation 176 also includes the day-to-day management of technology needed to deliver and support services. 177 The efficient delivery of agreed services is essential to maintain business satisfaction and 178 confidence in IT. It reduces the risk of service outages, and ensures that authorized levels of 179 access are consistently available.” 180 https://www.axelos.com/best-practice-solutions/itil/what-is-itil https://www.axelos.com/best-practice-solutions/itil/what-is-itil

Figure 1 FEMA IT Services Management Lifecycle 183

1.3 Scope 184

The Contractor shall assist the OCIO Service Operations Division in maintaining and maturing 185 the current operations to keep FEMA’s information systems infrastructure available and 186 operational. The Contractor must support traditional operations and maintenance activities and 187 be able to support these activities during periods of Continuity of Operations activities. The 188 scope of work will involve the execution of task orders. Specific categories of tasks that fall 189 within this scope of work and the necessary Contractor capabilities are outlined in the following 190 sections. Staff qualification minimum requirements are also addressed. 191 The Contractor shall ensure that it maintains a sufficient technical infrastructure, processing 192 power, data storage and retention abilities including Continuity of Operation Planning (COOP) 193 in all aspects of this SOW. Since workloads may fluctuate considerably due to crisis or disaster 194 periods, the Contractor’s staffing processes must be flexible and capable of adequately 195 responding to variations in service. 196

1. Currently, FEMA is obtaining IT O&M services through multiple contracted integrators. The 197 objectives of this acquisition are to consolidate six contracts into one contract, transition 198 existing services within 60 days of task order award, ensure accurate and timely invoicing, 199 and obtain O&M services that meet FEMA performance measures. The contractors shall 200 provide a reliable, stable, and secure operating environment that is aligned with FEMA 201 enterprise infrastructure. 202

2. The Contractor shall support the primary operations locations in the Mount Weather 203 Emergency Operations Center (MWEOC) in Virginia, FEMA Headquarters, and other sites 204 located in the National Capital Region. Additional locations include FEMA Regional offices, 205 FEMA National Processing Service Centers (NPSCs), FEMA’s Brooke Road facility, the 206 National Emergency Training Center (NETC), Long Term Recovery Centers (LTROs), 207 Logistics Centers, Mobile Disaster Recovery Centers (MDRCs), Distribution Centers, and 208

Joint Field Offices (JFOs), Center for Domestic Preparedness (CDP) and other permanent or 209 temporary facilities located in the United States and Territories. 210

3. The scope of this contract also includes contractor support to FEMA’s technical staff for 211 operations, maintenance, and proactive monitoring using FEMA’s tools of FEMA’s networks, 212 systems and applications. The contractor will support FEMA systems and technical 213 environment. 214

4. There are five (5) functional areas that will make up the O&M Support Framework to be 215 addressed by the contractor are as follows: 216

1. Program Management is responsible for providing the program management oversight 217 across the contract and all contract task orders, up to and including contractual 218 deliverables and financial controls. Program Management is one of the primary points of 219 contact with OCIO Systems Management group. The Contractor’s Program Manager is 220 one of the Contractor’s Key Personnel required on the Contract. 221

i. Program Management is also responsible for supporting Mobility Service 222 Center (MSC) and Systems, Databases, and Application Management 223

(SDAM). 224

ii. Program Management should also be able to support project management 226 tasks where contracts and task orders can be quickly established to 227 complete special assignments including but not limited to hardware swap 228 outs, moving a physical environment to a virtual environment, etc. 229

2. Information Technology, Operations and Maintenance responsible for the 230 maintenance, system sustainment, and update of FEMA infrastructure, to include 231 hardware and software, and for controlling and managing the lifecycle of all changes with 232 minimum disruption to FEMA's end users. Service Operations Division oversees and 233 manages all introductions into the production and test environments (as needed). This 234 includes the shared application and technical services as well as the system software, 235 middleware, information systems infrastructure, networks, and data centers. 236

3. Telecommunications Operations and Maintenance is responsible for providing 237 support to FEMAs telecommunications network. This includes unified communications, 238 mobile device management, and satellite communications. 239

4. Help Desk Services is responsible for providing 24x7x365 end user support across 240

FEMA. 241

5. Network Operating Services is responsible for 24x7x365 monitoring the voice, video, 242 data, and satellite feeds throughout FEMA. 243

1.4 Objective 244

The primary objective of this acquisition is to establish a single award Indefinite Delivery/ 245 Indefinite Quantity (IDIQ) contract for O&M Support Services that will enable FEMA, through 246 the OCIO to accomplish its mission “to enhance and maintain IT infrastructure; develop and 247 enhance key systems to support operating programs; increase efficiencies and cooperation across 248 FEMA’s divisional and regional lines.”. 249 The Task Orders issued under the IDIQ will be designed to acquire Operations and Maintenance 250 Support Services and will be written against five (5) functional areas: Program Management 251

(PM), Information Technology Systems Operations and Maintenance, Telecommunication 252 Operations and Maintenance, Help Desk Services, and Network Operating Services. 253 Requirements include updating and maintaining the current hardware infrastructure (including 254 lifecycle replacement) and software platforms, deploying code and upgrades to FEMA’s major 255 systems, management of the telecommunications infrastructure to include mobile and satellite. 256 Staffing of a Help Desk and a Network and Video Operation Center will also be within the scope 257 of the Task Orders. 258

1.5 Applicable Documents 259

The following documents provide specifications, standards, or guidelines that must be complied 260 with in order to meet the requirements of this acquisition: 261

• DHS Acquisition Directive D-102-01 262

• DHS Guidebook, 102-01-103-01, Systems Engineering Lifecycle Guidebook 263

• Instruction Manual 102-01-004-01, DHS Agile Development and Delivery for Information 264 technology Guidebook 265

• Government Accountability Office, Schedule Assessment Guide. 266

• FEMA Program Management Office Standard Operating Procedures 267

1.5.1 Compliance Documents 268

The contractor shall comply with and provide deliverables in accordance with technical and 269 functional performance criteria mentioned in these applicable documents/constraints: 270

• Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 271 1998 (P.L. 105-220); 272

• 36 CFR 1194.21 - Software Applications and Operating Systems, applies to all EIT 273 software applications and operating systems procured or developed under this work 274 statement including but not limited to GOTS and COTS software. In addition, this 275 standard is to be applied to Web-based applications when needed to fulfill the functional 276 performance criteria. This standard also applies to some Web based applications as 277 described within 36 CFR 1194.22. 278

• 36 CFR 1194.22 - Web-based Intranet and Internet Information and Applications, applies 279 to all Web-based deliverables, including documentation and reports procured or 280 developed under this work statement. When any Web application uses a dynamic (non-281 static) interface, embeds custom user control(s), embeds video or multimedia, uses 282 proprietary or technical approaches such as, but not limited to, Flash or Asynchronous 283 JavaScript and XML (AJAX) then -1194.21 Software- standards also apply to fulfill 284 functional performance criteria. 285

• 36 CFR 1194.23 - Telecommunications Products, applies to all telecommunications 286 products including end-user interfaces such as telephones and non-end-user interfaces 287 such as switches, circuits, etc. that are procured, developed or used by the Federal 288 Government. 289

• 36 CFR 1194.24 - Video and Multimedia Products, applies to all video and multimedia 290 products that are procured or developed under this work statement. Any video or 291 multimedia presentation shall also comply with the software standards (1194.21) when 292 the presentation is through the use of a Web or Software application interface having user 293 controls available. 294

• 36 CFR 1194.25 - Self Contained, Closed Products, applies to all EIT products such as 295 printers, copiers, fax machines, kiosks, etc. that are procured or developed under this 296 work statement. 297

• 36 CFR 1194.31 - Functional Performance Criteria applies to all EIT deliverables 298 regardless of delivery method. All EIT deliverable shall use technical standards, 299 regardless of technology, to fulfill the functional performance criteria. 300

• 36 CFR 1194.41 - Information Documentation and Support, applies to all documents, 301 reports, as well as help and support services. To ensure that documents and reports fulfill 302 the required -1194.31 Functional Performance Criteria-, they shall comply with the 303 technical standard associated with Web-based Intranet and Internet Information and 304 Applications at a minimum. In addition, any help or support provided in this work 305 statement that offer telephone support, such as, but not limited to, a help desk shall have 306 the ability to transmit and receive messages using TTY. 307

Exceptions for this work statement have been determined by DHS and only the exceptions 308 described herein may be applied. Any request for additional exceptions shall be sent to the 309 Contracting Officer’ Representative (COR) and determination will be made in accordance with 310 DHS MD 4010.2. DHS has identified the following exceptions that may apply: 311

• 36 CFR 1194.2(b) - (COTS/GOTS products), When procuring a product, each agency 312 shall procure products which comply with the provisions in this part when such products 313 are available in the commercial marketplace or when such products are developed in 314 response to a Government solicitation. Agencies cannot claim a product as a whole is not 315 commercially available because no product in the marketplace meets all the standards. If 316 products are commercially available that meets some but not all of the standards, the 317 agency shall procure the product that best meets the standards. 318

• When applying this standard, all procurements of EIT shall have documentation of 319 market research that identify a list of products or services that first meet the agency 320 business needs, and from that list of products or services, an analysis that the selected 321 product met more of the accessibility requirements than the non-selected products as 322 required by FAR 39.2. Any selection of a product or service that meets less accessibility 323 standards due to a significant difficulty or expense shall only be permitted under an 324 undue burden claim and requires approval from the DHS Office on Accessible Systems 325 and Technology (OAST) in accordance with DHS MD 4010.2. 326

• 36 CFR 1194.3(b) - Incidental to Contract, all EIT that is exclusively owned and used by 327 the contractor to fulfill this work statement does not require compliance with Section 508. 328 This exception does not apply to any EIT deliverable, service or item that will be used by 329 any Federal employee(s) or member(s) of the public. This exception only applies to those 330 contractors assigned to fulfill the obligations of this work statement and for the purposes 331 of this requirement, are not considered members of the public. 332

1.5.2 Reference Documents 333

• Executive Order (EO) 12472: Assignment of National Security and Emergency 334

Preparedness Telecommunications Functions 335

• E O 13011 Federal Information Technology 336

• OMB Circular A-130, Management of Federal Information Resources 337

• P O D 63, Critical Infrastructure Protection 338

• PL 107-296, Homeland Security Act 339

• PL 104-106, Information Technology Management Reform Act 340

• PL 103-63, Government Performance and Results Act 341

• PL 107-347, Federal Information Security Management Act I. PL 100-235, Computer 342

Security Act of 1987 343

• PL 105-220, Rehabilitation Act 344

• DHS Management Directive (MD) 4300, DHS Information Security Program 345

• FEMA Risk Management Plan, TBD 346

• FEMA Configuration Management Plan, TBD 347

• DHS System Engineering Life Cycle (SELC) 348

1.5.3 DHS Enterprise Architecture Compliance 349

Enterprise Architecture (EA) - The contractor shall certify that all solutions and services meet 350 DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor 351 shall comply with the following Homeland Security Enterprise Architecture (HLS EA) 352 requirements: 353

• All developed solutions and requirements shall be compliant with the HLS EA. 354

• All IT hardware and software shall be compliant with the HLS EA Technical Reference 355

Model (TRM) Standards and Products Profile. 356

• Description information for all data assets, information exchanges and data standards, 357 whether adopted or developed, shall be submitted to the Enterprise Data Management 358 Office (EDMO), a program office within the OCIO, for review, approval and insertion 359 into the DHS Data Reference Model and Enterprise Architecture Information Repository 360

• Development of data assets, information exchanges and data standards will comply with 361 the DHS Data Management Policy MD 103-01 and all data-related artifacts will be 362 developed and validated according to DHS data management of architectural guidelines 363

• Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components 364 (networks, infrastructure, and applications) specific to individual acquisitions shall be in 365 accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, 366 August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or 367 replacement 368

• All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. 369 Government Version 6 (USGv6) Profile (National Institute of Standards and Technology 370 (NIST) Special Publication 500-267) and the corresponding declarations of conformance 371 defined in the USGv6 Test Program. 372

2 SPECIFIC TASKS AND REQUIREMENTS 373

2.1 Functional Area 1 – Program/Project Management 374

The Contractor will be expected to plan, execute, and manage the work described in this 375 statement of work employing industry best practices for project and program management 376 according to standards and methodologies published by the Project Management Institute or 377 equivalent industry practices. 378 The Contractor shall appoint a full-time, dedicated Contractor Program Manager (PM) who shall 379 be responsible for the accomplishment for all tasks to be performed under this SOW. The 380 Contractor Program Manager shall be the principal interface for all matters relating to the 381 execution of this SOW between the Contractor’s project team and the Contractor’s corporation; 382 between the Contractor’s project team and the Government Program Manager and FEMA 383 Program Management Office (PMO); and between the Contractor’s project team and associated 384 contractors and subcontractors for all matters relating to the execution of this SOW. 385 The Contractor shall establish a project team responsible for executing the total effort required 386 by this SOW. This organization shall exhibit clear lines of authority, responsibility, and 387 accountability of project authority among all organizational elements including Government, 388 FEMA Contractor, and all subcontractors. 389 The Contractor shall establish a technical approach, organize resources, and establish and 390 execute management controls to ensure cost, technical, and schedule requirements of this SOW 391 are met. 392 The Contractor shall create a Project Management Plan (PMP) describing the scope, approach, 393 schedule, work breakdown structure (WBS), resources, quality assurance, and management 394 controls necessary to meet contract performance, schedule, and cost requirements. The PMP 395 shall describe the Contractor’s project organization including all lines of authority and reporting 396 relationships and further describe monitoring procedures, metrics, and corrective action 397 procedures to be used to manage the project. 398 The Contractor shall implement procedures to monitor technical, cost, quality and schedule 399 performance. The Contractor shall establish metrics to assess and report project status that will 400 enable the Contractor to detect and predict deviations from the planned or required performance 401 (cost, technical, quality, or schedule) in time to take corrective action. 402 The Contractor shall design and implement corrective action procedures to prevent, circumvent, 403 or mitigate the impact of deviations from planned or required performance. 404 The Contractor shall participate in weekly or bi-weekly status meetings with the Government 405 Program Manager and provide an agenda for those meetings. Meeting frequency shall be at the 406 discretion of the Government Program Manager. 407

The Contractor shall prepare and deliver a Monthly Status Report and prepare a monthly status 408 briefing. The Contractor shall attend a Monthly Status Review to be held on the second Tuesday 409 of each month or at the discretion of the Government Program Manager. 410 The Contractor shall follow a FEMA Risk Management Plan. 411 The Contractor shall conduct continuing risk identification and assessment activities to identify 412 any risks that may affect the contractor’s ability to meet its technical cost, and schedule 413 objectives. The Contractor shall inform the Government Program Manager immediately upon 414 identifying risks and shall address those risks and necessary mitigation strategies in the next 415 scheduled status meeting and in the Monthly Status Reports and Briefings. 416 The Contractor shall follow FEMA’s Configuration Management Plan. 417 The Contractor shall create, deliver, and maintain a WBS (either within the Project Management 418 Plan or separately) at sufficient levels of detail to assess performance against schedule 419 milestones and budgets. The Contractor shall deliver an initial WBS and subsequent updates as 420 detail is added as work progresses. 421 The Contractor shall work with the Program Management Office team to help define and refine 422 an Integrated Master Schedule (IMS) for O&M functions. 423 The Contractor shall participate in an Integrated Baseline Review (IBR) conducted by the 424 Government Program Manager to be held usually within 90 days of contract award but not more 425 than 180 days following contract award. The IBR will be scheduled by FEMA’s Program 426 Manager. 427 The Contractor shall perform Earned Value Management (EVM) tracking using a system 428 conforming to the American National Standards Institute/Electronic Industry Association 429 (ANSI/EIA) Standard 748-A, Earned Value Management Systems. For Agile work, the 430 Contractor shall use Agile EVM. 431 The Contractor shall submit four (4) monthly Earned Value reports: three Contract Performance 432 Report (CPR) Formats 1, 3, and 5, and the Contract Funds Status Report (CFSR). Alternatively, 433 if the Contractor’s EVMS data collection tool is capable of generating raw data in ANSI 434 Accredited Standards Committee (ASC) X12 format, the Contractor may substitute the 435 transmission of this data for the submission of the EVM reports. 436 The Contractor shall utilize an existing FEMA Online Project Repository or develop, deploy, and 437 maintain an Online Project Repository (e.g. SharePoint site) that allows the Contractor, Sub-438 contractor, Government Program Manager, government PMO, and other government contractor 439 personnel to track the project schedule, assess status and risks, schedule events, and review 440 documents and deliverables. The Contractor shall maintain this repository throughout the period 441 of performance. Details will be provided in Task Order. 442 The Contractor shall follow the DHS Systems Engineering Lifecycle (SELC) (DHS Instruction 443 Manual 102-01-001 Acquisition Management Instruction/Guidebook Appendix B System 444 Engineering Life Cycle) and participate in the gate reviews specified by FEMA. 445 The Contractor shall participate in SELC phase gate reviews as specified by FEMA. The 446 Contractor shall create gate review presentations summarizing the Contractor’s accomplishments 447 in the previous SELC phase and deliver those presentations along with artifacts demonstrating 448 previous phase accomplishments. The Contractor shall participate in each gate review and shall 449 present the Contractor’s progress to FEMA’s Lead Technical Authority conducting the review. 450 The gate reviews applicable to FEMA projects may include: 451

• System Definition Review (SDR) 452

• Critical Design Review (CDR) 453

• Integration Readiness Review (IRR) 454

• Test Readiness Review (TRR) 455

• Production Readiness Review (PRR) 456

• Operational Test Readiness Review (OTRR) 457

• Operational Readiness Review (ORR). 458

The Contractor may be required to purchase equipment, licenses or managed services to meet on 459 unspecified requirements. FEMA CO approval will be required and a separate modification will 460 be issued for these purchases or the equipment may be authorized under an Other Direct Costs 461 (ODC) CLIN, if determined appropriate. All Contractor-acquired equipment subsequently 462 becomes GFE as defined by the terms of the contract. NOTE: This requirement includes the 463 procurement of any tagged items. 464

2.1.1 Transition Planning 465

2.1.1.1 Transition Support 466

Transition activities will be addressed at the task order level. The Contractor shall support DHS 467 Government leads within the purview of this SOW with transition planning and transition plan 468 execution, associated with meeting the agreed upon timeline for transition of SYSO&M support 469 services from the incumbent Contractor to the Contractor awarded the current contract, as 470 directed by the Government COR. This includes: 471

• Coordinating with Government representatives 472

• Reviewing, evaluating, and transition of current Contractor support services 473

• Transition of historical data to any new systems 474

• Ensuring that Contractor personnel receive all Government‐required training and follow 475 all Government certification processes 476

• Receiving all necessary business and/or technical documentation 477

• Providing an orientation phase and program to introduce Government personnel and 478 other users of SYSO&M services to the Contractor's team, tools, methodologies, business 479 processes, equipment, etc. 480

• Receiving Government Furnished Equipment (GFE) and Government Furnished 481 Information (GFI), and providing GFE inventory management assistance. 482

2.1.1.2 Incoming Transition 483

The Contractor shall be responsible, under the direction of the Government, for active 484 participation in the transitioning of SYSO&M services from the incumbent contractor and shall 485 develop an Incoming Transition Plan that ensures that there is no degradation of services during 486 the transition. A updated task order version of the Incoming Transition Plan is due ten (10) 487 business days after the first task order award date. 488 The Incoming Transition Plan shall address the following elements as a minimum: 489

• Mobilization of the Contractor’s transition team 490

• Specific transition tasks to be executed and how they will be managed 491

• Principal transition team members by name, position, and responsibilities 492

• Risks to the transition effort and mitigation and contingency plans in the event the 493 transition cannot be executed on schedule. 494

• The transition schedule in graphic format showing the timing, sequence and 495 interdependencies of tasks. The transition schedule shall be supplemented by sufficient 496 narrative. 497

2.1.1.3 Outgoing Transition 498

The Contractor shall develop and submit an outgoing ninety (90) day Transition Plan, 499 transitioning work from the Contractor to a successor Contractor or Government entity. This 500 transition may be to a Government entity, another Contractor, or to the incumbent Contractor 501 under a new contract. In accordance with the Government‐approved plan, the Contractor shall 502 assist the Government in planning and implementing a complete transition from this contract to a 503 successor Contractor. This shall include formal coordination with Government staff and 504 successor Contractor staff and management. The ninety (90) day Transition Plan shall also 505 include delivery of existing policies and procedures, and delivery of historical and current 506 metrics and statistics. The Transition Plan shall be tailored to the requirement and may include, 507 but not be limited to: 508

• Coordination with Government representatives 509

• Review, evaluation, and transition of current Contractor support services 510

• Transition of historical data to the successor Contractor’s system(s) 511

• Transition of Government‐approved Contractor training materials and certification 512 process documentation 513

• Transfer of all necessary business and/or technical documentation including the 514 operations, maintenance, and user manuals 515

• Transfer of compiled and un‐compiled source code, to include all versions, maintenance 516 updates, and patches 517

• Transfer of GFE and GFI to the successor Contractor 518

• Transfer of the GFE inventory management system, all user and maintenance 519 documentation, and current GFE information in the system to the successor Contractor 520

• Facilitation of applicable Government debriefings and personnel out‐processing 521 procedures 522

• Turn‐in of all Government keys, identification and access cards, and security codes. 523

2.1.2 Program Management of Services 524

The Contractor shall provide program management functions to manage servers, applications, 525 devices, etc. from a business, technical, and contractual full lifecycle approach. Program 526 Management should also be able to support project management tasks where contracts and task 527 orders can be quickly established to complete special assignments including but not limited to 528 hardware swap outs, moving a physical environment to a virtual environment, etc. 529 FEMA’s Telecommunications Program requires: 530 FEMA seeks subject matter expertise in telecommunications, project and program management 531 support, lifecycle management, and evolving technologies. In addition, subject matter expertise 532 in acquisition planning, financial analysis, obligation reconciliation, service ordering and 533 provisioning, billing reconciliation and dispute, helpdesk and monitoring/tracking are the key 534 areas requiring support. FEMA requires contract services for the following two overarching 535 areas: 536

1. Technical – The Contractor shall assist FEMA with wireless, wire line (including long 537 haul), and satellite technologies acquisitions which support voice and data 538 communications to meet those needs, and support to FEMA staff managing these 539 technologies from contractual, and operational and maintenance perspectives. This 540 includes 24 X 7 X 365 call center support for mobility Tier I and II help desk 541 functionality, website maintenance, and NIOS systems operations and maintenance, 542 performance monitoring, integration services, and support of major enterprise disaster 543 and non-disaster assistance. This can also include system engineering support for 544 technology refresh efforts, managing tasks and activities at the project level, and 545 providing program management – centralized coordinated management of all related 546 projects. Managing related projects as a program consolidates processes, resources, and 547 deliverables to achieve requirements more effectively and efficiently and reduce risks 548 associated with managing each project separately. 549

2. Business – The Contractor shall assist FEMA with financial and contract management 550 including, but not limited to, telecommunications provisioning and procurement services, 551 funding management, invoice and reconciliation management, service contract/agreement 552 administration services, dispute management timely reports for accountability of assets, 553 status of funds of telecommunications contracts, and audit and optimization. Also 554 includes assisting in supporting FEMA disaster and non-disaster operations including 555 invoicing, billing, payment, device and service ordering, delivery processes, standardized 556 reporting, auditing, and asset management. Additional tasks include compilation of data 557 and system entry for input into, but not limited to, the DHS & FEMA applications such as 558 Information Management System (IMS), Acquisition Planning Forecast System (APFS), 559 Enterprise Coordination Approvals and Processing System (eCAPs), Integrated Financial 560 Management Information System (IFMIS) and New Periodic Reporting System (nPRS) 561 for the OMB-300 IT dashboard. 562

The Contractor shall be proficient in other functional areas including market research for 563 acquisitions, business and enterprise planning, budgeting, space and facility management, DHS 564 and FEMA IT security requirements, supply chain management, and training.