Attachment_A_-_Catastrophic_Data_Modeling_Statement_Of_Objectives.pdf

PROCUREMENT SENSITIVE

FOR OFFICIAL USE ONLY

FAR 3.104 & 2.101

Federal Emergency Management Agency Risk Management Directorate

Statement of Objectives Catastrophic Data Modeling Licenses

June 28, 2017

Table of Contents

I DESCRIPTION AND PURPOSE

II FEMA STRATEGIC GOALS

III FIMA MISSION

IV ACQUISITION STRATEGY

V CATASTROPHIC DATA MODELING SOFTWARE LICENSES OBJECTIVES

VI DELIVERABLES AND MILESTONE SCHEDULE

VII GOVERNMENT FURNISHED EQUIPMENT

VIII PERIOD OF PERFORMANCE

IX PLACE OF PERFORMANCE

X ASSUMPTIONS AND CONSTRAINTS

XI SECURITY REQUIREMENTS

FAR 3.104 & 2.101

I DESCRIPTION AND PURPOSE

The Federal Insurance and Mitigation Administration (FIMA) is a component of the Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), which operates the Risk Management Directorate and the National Flood Insurance Program (NFIP).

FEMA’s NFIP has been offering flood insurance coverage to homeowners, renters and businesses as protection against flood losses for over 40 years. In return, local governments provide commitment to sound floodplain management and related flood disaster mitigation efforts. In addition to offering flood insurance, the duties of the NFIP include identifying communities’ flood risks, mapping and publishing Flood Insurance Rate Maps of those risks, helping communities meet floodplain management requirements, and communicating the benefits of flood insurance protection so that more Americans are reimbursed for flood damage through the insurance mechanism, rather than through Federal disaster assistance funds.

The purpose of the acquisition is to procure catastrophic data modeling licenses for the purposes of running models for reinsurance and risk rating, reviewing and validating model output, and, if available, conducting live event tracking.

II FEMA STRATEGIC GOALS

The 2014-2018 FEMA Strategic Plan reflects objectives the Agency will accomplish to provide the best possible support to the American people before, during, and after disasters. It sets forth the strategies FEMA will employ to accomplish the objectives and also establishes measurable outcomes to achieve. This Strategic Plan was developed through the involvement of hundreds of FEMA employees and many external stakeholders who contributed to generating our objectives, strategies, and outcomes, and who are now working to execute this Plan.

The Strategic Plan provides a strategic lens to focus FEMA's efforts and guide the allocation of resources over the next four years. The FEMA Strategic Plan also supports the Department of Homeland Security's Strategic Plan for Fiscal Years (FY) 2014-2018 Mission 5 of Strengthen national preparedness and resilience.

FEMA’s Five Strategic Priorities:

• Priority 1: Be survivor-centric in mission and program delivery

• Priority 2: Become an expeditionary organization

• Priority 3: Posture and build capability for catastrophic disasters

• Priority 4: Enable disaster risk reduction nationally

• Priority 5: Strengthen FEMA’s organizational foundation

FEMA's Two Strategic Imperatives:

• A whole community approach to emergency management

• Foster innovation and learning https://www.fema.gov/media-library/assets/documents/96981 http://www.dhs.gov/sites/default/files/publications/FY14-18%20Strategic%20Plan.PDF http://www.dhs.gov/sites/default/files/publications/FY14-18%20Strategic%20Plan.PDF

FAR 3.104 & 2.101

III FIMA MISSION

The mission of FIMA is to create safer communities by reducing loss of life and property; enable individuals to recover more rapidly from floods and other disasters; and lessen the financial impact of disasters on the Nation. This is accomplished through three primary objectives:

• Analyze Risk – Determining the impact of natural hazards that lead to effective strategies for reducing risk.

• Reduce Risk – Reducing or eliminating long-term risk from hazards on the existing built environment and future construction.

• Insure for Flood Risk – Reducing the impact of floods on the Nation by providing flood insurance.

IV ACQUISITION STRATEGY

FIMA intends to award one or more firm-fixed price contracts for this requirement. The number of contracts to be awarded is constrained by budget.

V CATASTROPHIC DATA MODELING SOFTWARE LICENSES

OBJECTIVES

The primary reason for the purchase of catastrophic data modeling is to be able to run the models using NFIP data to understand the program’s risk and exposure to flood loss. The secondary reason is to be able to compare against rates proposed by reinsurers using the same models they are using to justify their rates. The third reason is to use models to help the NFIP set rates for their policies. The fourth reason is to understand and validate the accuracy and precision of available catastrophic flood models. The final reason is to understand the ability of the catastrophic models to provide real-time event tracking information for major flooding events.

Objective 1: Obtain United States catastrophic flood modeling software

The purpose of this objective is to obtain latest versions of catastrophic data modeling software for the following capabilities:

• United States inland flood modeling

• United States storm surge modeling

• United States live event tracking (not required, but desired)

Contractor’s installation requirements:

• Installation of modeling licenses

• An initial installation of the modeling license may be required on a third party owned cloud environment. The Government expects the models to then be reinstalled on the permanent third-party IT environment in late 2017

• Installation of version upgrades

FAR 3.104 & 2.101

Usability considerations:

Usability is defined as the ability for models to produce results in an easy and effective manner in a licensable software application used by trained external users. Usability is also defined by the ability for models to operate within all Government IT constraints. The following capabilities demonstrate usability:

Import and Exposure o Minimum required risk characteristics o Recommended secondary risk characteristics o Format of import file/database o Limitations in rows and number of risk characteristics when importing (file size considerations) o Clarity and detail of import errors (provide a list of errors, no longer than one page) o Ease of re-coding risk characteristics once imported

Run o Ability to change hazard and model characteristics after importing

Results o Model settings and output levels available o Ranking of primary risks characteristics impact to loss o Ranking of secondary risks characteristics impact to loss o Abilities to split results (i.e. by state, zip code, etc) o Results interface - What results can been viewed from the interface versus extracting from the back end or exporting result reports?

o Ability to extract event footprint files or event description details o Approximate analysis run times when running 4 million locations o Clarity and detail of analysis error logs (provide a list of errors, no longer than one page)

Objective 2: Obtain training and technical support for the catastrophic flood models

The purpose of this objective is to obtain training for up to five (5) FIMA personnel to gain proficiency in running models for reinsurance and risk rating, reviewing and validating model output, and, if available, conducting live event tracking.

In addition, the vendor will provide standard technical and troubleshooting support for assistance required arising from technical difficulty in usability or understanding. The vendor’s delivery method for technical and troubleshooting support is subject to the following constraints:

• Where support is done remotely, the vendor will be unable to access any NFIP data.

FAR 3.104 & 2.101

• Where support is completed onsite or remotely with access to data, the vendor is required to be badged (and complete a public trust background investigation).

VI DELIVERABLES AND MILESTONE SCHEDULE

DESCRIPTION FREQUENCY DUE DATES

Catastrophic Flood Models

Installation

Training Plan

Once

Once or twice

Five days from contract award

Five days from contract award Late 2017

Five days from contract award

Data Rights List

Thirty days from contract award

Note: Deliverables will be delivered to the COR by the due date listed. The COR then has 20 business days to review the deliverable and request corrections from the Contractor before the document is accepted by the Government. Some of these deliverables could be shared with other FEMA stakeholders. Deliverables may be delivered in electronic format using Microsoft products.

VII GOVERNMENT FURNISHED EQUIPMENT

None

VIII PERIOD OF PERFORMANCE

The performance period of the contract will be up to two (2) years consisting of a one (1) year base and a one (1) year option.

IX PLACE OF PERFORMANCE

The Government anticipates that the place of performance shall primarily be remote and at FEMA Headquarters located in Washington, DC.

X ASSUMPTIONS AND CONSTRAINTS

• All software must be approved on FEMA’s Technical Reference Model (TRM)

• Due to IT security and privacy concerns, NFIP data is required to stay behind the FEMA firewall. All modeling must be performed within a FEMA-secure environment.

FAR 3.104 & 2.101

• The software shall be hosted by a third-party until transition to the final FEMA IT environment.

XI SECURITY REQUIREMENTS

The Contractor shall be required to complete the Operations Security (OPSEC) and Insider Threat Awareness trainings in addition to the training requirements per Information Technology Security and Privacy Training (MAR 2015).

In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities. The contractor will:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall:

Execute a DHS Form 11000-6, Sensitive but Unclassified Information Non Disclosure Agreement (NDA), as a condition of access to such information. Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an N DA as determined by the applicable program manager. Execution of the NDA shall be effective upon publication of this directive and not applied retroactively.

BACKGROUND INVESTIGATIONS

All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access Contractor personnel occupying positions or performing functions with a Low Risk designation and who do not require access to DHS or FEMA information systems may undergo a Tier 1

FAR 3.104 & 2.101

investigation with a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract. (also reference Facility Access).

Low Risk with Information System Access Contractor personnel occupying positions or performing functions with a Low Risk designation and who require access to DHS or FEMA information systems shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Moderate Risk Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

High Risk Contractor personnel occupying positions or performing functions with a High Risk designation shall undergo a Tier 4 Suitability Background Investigation (T4) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Background Investigation Process To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

• the investigation was completed within the last five years,

• it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract,

• the contractor personnel have not had a break in employment since the prior favorable adjudication, and,

• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email directly to the contractor applicant/personnel that contains the following documents, which are

FAR 3.104 & 2.101

incorporated into this contract by reference, along with a link to the Office of Personnel Management’s (OPM) Electronic Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• SF 87, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports

Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation Eligibility determinations based on a Low Risk T1, Moderate Risk T2S or High Risk T4 are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

FACILITY ACCESS

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.