COMMIT SOW.DOC

U.S. Department of Homeland Security/Federal Emergency Management Agency

Department of Homeland Security

Federal Emergency Management Agency (FEMA)

Centralized Operations, Maintenance and Management Information Technology (COMMIT)

Indefinite Delivery, Indefinite Quantity

Statement of Work

November 07, 2008

Indefinite Delivery, Indefinite Quantity Statement of Work FEMA Centralized O&M Information Technology (COMIT) Services

TABLE OF CONTENTS

1.0 PURPOSE

2.0 BACKGROUND

3.0 SCOPE

4.0 PERFORMANCE REQUIREMENTS

4.1 Performance Measures

4.2 Applications Sustainment

4.3 Network Operations and Sustainment

4.4 Hardware Maintenance and Support

4.5 Help Desk Support

4.6 IT Sustainment Outside the Enterprise

5.0 TASK ORDER MANAGEMENT

5.1 Monthly Progress Reports

5.1.1Task Order Reporting Requirements

5.2 Annual Plan of Action and Milestones (POA&M and Staffing Plan

5.2.1 Task Order Statement of Work

5.3 In Progress Reviews (IPR)

5.4 Task Prioritization Meetings

5.5 EVM Reporting

6.0 CONTRACT DATA REQUIREMENTS LIST (CDRL)

137.0 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

8.0 PLACE OF PERFORMANCE

9.0 PERIOD OF PERFORMANCE

10.0 SECURITY

10.1 General

10.2 Contractor Personnel

10.2.1 Employment Eligibility

10.2.2 Continued Eligibility

10.2.3 Termination

10.2.4 Security Management

10.2.5 Suitability Determination

10.2.6 Background Investigations

10.2.7 Information Technology Security Clearance

10.2.8 Information Technology Security Training and Oversight

10.2.9 Accessibility Requirement

11.0 TRAVEL

12.0 KEY PERSONNEL

13.0 TRAINING FOR CONTRACTOR STAFF

14.0 COMPLIANCE WITH APPROPRIATE POLICIES, LAWS AND STANDARDS

15.0 PLACEMENT OF FUTURE TASK ORDERS…………………………………….22

FEMA Centralized O&M Information Technology (COMIT) Services Indefinite Delivery Indefinite Quantity (IDIQ) Statement of Work (SOW)

1.0 PURPOSE

Currently, FEMA is obtaining IT operations and maintenance services through a variety of contractors. The objective of this acquisition is to consolidate these contracts into multiple centralized indefinite delivery indefinite quantity (IDIQ) contracts with multiple task orders through which O&M services will be obtained. The winning contractors will have the responsibility of providing a reliable, stable, and secure operating environment that is aligned with the DHS enterprise infrastructure. Task orders will be issued under the contract to provide services.

This solicitation also requests offerors to submit a proposal for the initial task order for O&M services associated with FEMA’s enterprise emergency management information systems. This task order will be awarded concurrent with the award of the IDIQ task order contract. The detailed requirements for O&M services supporting FEMA Enterprise Emergency Management Information Systems (FEEMIS) are provided in Attachment 1.

2.0 BACKGROUND

The Federal Emergency Management Agency’s (FEMA) mission is to reduce the loss of life and property and protect communities nationwide from all hazards, including natural disasters, acts of terrorism, and other man-made disasters. FEMA leads and supports the nation in a risk-based, comprehensive emergency management system of preparedness, protections, response, recovery and mitigation. FEMA has developed a suite of information systems to meet this mission and provides users a responsive array of information services for voice and data transfer capability. FEMA’s enterprise information technology (IT) systems must be operated and maintained at the highest level of performance and reliability twenty-four (24) hours a day, seven (7) days a week.

The work under this acquisition falls under the auspices of the Federal Emergency Management Agency (FEMA) Chief Information Officer (CIO) and the Information Technology Division (ITD). The CIO’s mission is “to enhance and maintain Information Technology infrastructure; develop and enhance key systems to support operating programs; increase efficiencies and cooperation across FEMA’s divisional and regional lines.” The CIO’s vision is to modernize the FEMA ITD to “deliver world-class secure Information Technology guidance, products, and services to meet the needs of FEMA’s emergency managers and stakeholders nationwide.” The CIO’s objective of the short, middle and long term modernization efforts is to transform the information technology services into a best-of-class, enterprise focused, efficient and well-managed environment. This environment must be implemented with the flexibility required to support the evolving mission of FEMA and to support the surge requirements necessary to support emergency situations as they occur.

The current FEMA information technology environment is an amalgam of new and old technologies, architectures, platforms and tools that includes a wide variety of PC-based, client server, web-based and service-oriented components. These systems have been implemented by FEMA using a variety of service providers under a vast array of oversight and governance conditions. These systems represent a broad spectrum of effectiveness to the DHS/FEMA ITD mission.

FEMA’s ITD modernization is defined as the evolution of all IT services and support. This will be achieved by utilizing a comprehensive approach and strategy; pushing the Agency forward; developing a common operating framework; supporting a secure implementation of enterprise applications and services that support the mission. The modernizations effort must encompass the ability to provide enterprise level solutions that will support particular business criteria that are necessary for the immediate requirements in support of emergency management and disaster operations within FEMA.

This modernization requires a major overhaul of the Information Technology Services as part of the new FEMA. Part of the overhaul includes a restructuring of the supporting contract services into five major areas: Enterprise Applications Development, Integration, and Sustainment (EADIS); Independent Technical Assistance and Program Enterprise Services (ITAPES); Operations and Maintenance (O&M); Policy Support, and Quality Assurance. The areas specific to this effort include:

1. Enterprise Applications Development, Integration, and Sustainment (EADIS) – to consolidate these services under a single contractor and ensure consistency and uniformity in applying the DHS Systems Development Life Cycle (SDLC).

2. Operations and Maintenance (O&M) – to provide a reliable, stable, and secure operating environment that is aligned with the DHS enterprise infrastructure and supported by Service Level Agreements (SLA) with supported customers. This effort includes the support of operating environments, and providing oversight and direction for managed support services.

FEMA’s Technical Reference Model (TRM) governs the range of compliant platforms. Conformance to this reference model is required in the performance of work described herein. The Technical Reference Model will be available to the winning Contractor after award. An abstract of the TRM is provided in Attachment 2.

3.0 SCOPE

The contractor will provide classified and unclassified Information Technology (IT) support services to FEMA primarily at the Mount Weather Emergency Operations Center (MWEOC) and FEMA Headquarters. Additionally, IT support will be required at the Agency’s Regional offices and call centers, the National Emergency Training Center (NETC), Long Term Recovery Centers (TROs), Logistics Centers, Mobile Disaster Recovery Centers (MDRC’s), Distribution Centers, and Joint Field Offices (JFO’s).

The scope of this contract also includes on-site contractor support to FEMA’s technical staff for operations, maintenance and monitoring of FEMA’s networks, systems and applications of the Agency’s As-Is environment. The contractor will maintain the FEMA As-Is systems and will adjust contract O&M support services to the To-Be environment for the Department of Homeland Security (DHS) OneNet and DHS Data Center. The categories of service are defined as:

1. Software Maintenance includes modification of a software system or component after delivery to correct faults, improve performance or other attributes; adapt to a changed environment or maintenance activities focused on anticipated problems, or preventive maintenance.

1.a. Software sustainment includes processes, procedures, people, material, and information required to support, maintain, and operate the software aspects of a system. It includes sustaining engineering, data management, configuration management, training, survivability, environment, and protection of critical program information, anti-tamper provisions, information technology security, supportability and interoperability functions, Commercial Off-the-Shelf (COTS) product management, and technology refresh.

2. Network operations support includes teleconferencing, engineering, configuration management, training, survivability, environmental, information and physical security, supportability and interoperability functions, and technology refresh for the FEMA network assets including, but not limited to: the National Network Operations Center, local area networks and wide area networks, Private Branch Exchange (PBX), Video Teleconferencing and (VTC) Satellite, the FEMA Intranet/Internet, the National Warning System (NAWAS) and Emergency Alert System (EAS), OneNet, and the Secure Operations Center.

3. Hardware maintenance and operations support is defined as support for non-data center systems including CPUs, memory, storage and other ancillary devices, and includes, but is not limited to, maintenance, upgrades, reconfiguration, troubleshooting, repair, correction of faults, performance improvements or other attributes, adaptation to a changing environment, anticipation of problems, and performance of preventive maintenance.

4. Help Desk support includes desktop support through the MWEOC Enterprise (I believe it is referred to as the Enterprise Service Desk) Helpdesk, Headquarters Helpdesk, MDRC and JFO IT Surge Support, for end-user personal computers, ancillary devices, printers, and office automation software to correct faults, improve performance or other attributes, adapt to a changing environment or maintenance activities focused on anticipated problems, and preventive maintenance.

4.a. FEMA interface support includes processes, procedures, people, material, and information required to support, maintain, and operate the FEMA As-Is O&M environment transition to the FEMA O&M To-Be environment and maintain alignment with the To-Be environment of the Department of Homeland Security (DHS) OneNet and DHS Data Center.

In addition to the services listed above, Task Orders issued against the resulting contract may include application systems developed under the EADIS systems development contract that reach sustainment status. Sustainment status is achieved when the application is completed, tested, accepted, packaged and delivered.

FEMA’s rapidly-evolving and unpredictable business and mission environment demands new and improved ways to provide properly secured public access to Federal emergency services through: shared critical business and mission-related information; response to the surging and receding emergency mission needs; unpredictable service and rapidly changing support staffing needs; an ability to leverage existing information assets to meet emerging mission challenges; and optimize the benefits of IT applications expenditures.

The fifth category of contracts to be potentially included under the “umbrella” IDIQ include Regional and Program Office systems that may be added either as part of the original competition or later through the placement of future Task Orders depending on decisions made by FEMA stakeholders.

4.0 PERFORMANCE REQUIREMENTS

4.1 Performance Measures

The contractor’s performance will be measured against the following performance measures and standards.

Customer Satisfaction

Contractor Staff

Quality and Timeliness of Work Products/Services Provided

There will be five major categories of services provided. They are:

4.2 Applications Sustainment

The contractor will provide application sustainment which includes: processes, procedures, people, material, and information required to support, maintain, and operate the software aspects of a system. It includes sustaining engineering, data management, configuration management, training, survivability, environment, protection of critical program information, anti-tamper provisions, information technology security, supportability and interoperability functions, COTS product management, and technology refresh. In addition, the contractor will develop and maintain baseline information about FEMA application software modeled after Industry and Government best practices (e.g., application software, subcomponents, feature set, version, software provider, FEMA users, etc.).

Task orders may include the following:

· Developing procedures, specifications, and standards to achieve a stable environment and maximize uptimes incorporating technologies such as SSL acceleration, SSL-VPN, load balancing, Oracle Application Server, Oracle Containers for Java (OC4J) and Oracle Real Application Clusters;

· Services associated with supporting Oracle Service Oriented Architecture (SOA) to provide connectivity to external Government agencies that link to FEMA enterprise systems;

· Conducting analysis, plans and prototypes and making recommendations to achieve consolidation of enterprise systems;

· Recommending and implementing database changes to adjust, reduce downtime, monitor or enhance recovery of FEMA systems.

· Supporting the Operational Data Store (ODS).

· Maintaining the Oracle Grid Control to monitor enterprise web based applications, hosts and databases.

· Providing software licenses and hardware associated with “turn-key” solutions.

For the purpose of this document the following information systems will be referred to as FEMA Enterprise Emergency Management Information Systems (FEEMIS):

· Enterprise Applications Development, Integration, and Sustainment (EADIS)

· Electronic Grants System (eGRANTS)

· Emergency Management Mission Integrated Environment (EMMIE)

· Information Financial Management Information System (IFMIS)

· Total Asset Visibility (TAV)

· Test and Development Lab (TDL)

· Liaison to DHS Data Centers

· FEMA.GOV Web Content Management

· Logistics Information Management System (LIMS)

· Fire Grants

· Enterprise Coordination and Approvals Processing System (eCAPS)

The systems list above is not considered all inclusive as FEEMIS. The contractor will provide technical support and database management to include, but not limited to the information systems listed as FEEMIS.

4.3 Network Operations and Sustainment

The contractor will provide centralized operations, monitoring, failure or intrusion detection, and restoration of FEMA’s nationwide telecommunications systems and networks on a 24x7 schedule, including video teleconferencing operations for FEMA senior-level management, federal, state, and local partners and other DHS components. The integrated network operations links all FEMA facilities with high-speed terrestrial circuits and routers to the Intranet and Internet, provides Private Branch Exchange (PBX) systems for voice communications via FEMA’s integrated network, public network and Federal Telephone Systems (FTS), and allows for Joint Field Offices (JFO’s) and/or mobile units to be added quickly to the architecture via landlines or satellite communications.

4.4 Hardware Maintenance and Support

The contractor will provide hardware maintenance and operations support as defined as support for non-data center systems including CPUs, memory, storage and other ancillary devices, and includes, but is not limited to, maintenance, upgrades, reconfiguration, troubleshooting, and repair, correction of faults, performance improvements or other attributes, adaptation to a changing environment, anticipation of problems, or performance of preventive maintenance.

4.5 Help Desk Support

The contractor will provide Help Desk support to include desktop support through the MWEOC Enterprise (Enterprise Service Desk) Helpdesk, Headquarters Helpdesk, MDRC and JFO IT Surge Support, for end-user personal computers, ancillary devices, printers, and office automation software to correct faults, improve performance or other attributes, adapt to a changing environment or maintenance activities focused on anticipated problems, or preventive maintenance.

4.6 IT Sustainment Outside the Enterprise

Defined as regional systems that may be added to this contract either as part of the original competition or later through the placement of future task orders depending on decisions made by FEMA stakeholders.

5.0 TASK ORDER MANAGEMENT

Task Orders issued against the IDIQ contract could result in any of the following deliverables. This list is not all-inclusive, but it is representative of the deliverables that could be produced under the resulting contract:

5.1 Monthly Progress Reports

The contractor will submit a Monthly Progress Report by the 21st of each month following the monthly reporting period. The suspense date of the report will be the same as those used for invoicing by the primary contractor. Any and all subcontractor/consultant data will be current through the “as of” date of the report.

The report will be unclassified. E-mail submission is encouraged. The specific format will be approved by the Task Order Manager (TOM) and the Contract Specialist. The following information will be provided as a minimum:

5.1.1 Task Order Reporting Requirements

(a) Technical data

1. Discuss efforts performed during the reporting period.

2. Discuss the status of any assigned deliverables. This will include the Contract Data Requirements List (CDRL) reference, deliverable title, date due and date delivered.

3. Identify any problems encountered (technical/schedule/cost) and resolutions.

4. Specifically note if there are any unresolved problems/issues at the end of the reporting period.

5. The final report for each contract period will include a cumulative list of all deliverable items provided. Detail will be the same as that provided in monthly reports.

(b) Expenditure data

1. Provide current and cumulative expenditures of both hours and dollars; illustrate expenditures separately by Task Order and the amount funded as well as compute a funding balance.

2. Provide line graphs illustrating expenditures of both hours and dollars. These graphs will demonstrate planned expenditures as well as funding levels.

3. Provide the names of all personnel charging to the Task Order. Organize the data by contract labor category and illustrate both current and cumulative hours charged for each person. Reveal separate uncompensated hours and total time to account for hours worked (if applicable).

4. Total expenditures will be compared to those invoiced for the same period and differences explained The above detail information will be provided for current contract period Task Orders only. Information required by paragraph 1 above will also be provided for each previous Task Order so as to provide a summary for the Task Order Distribution requirements: The report will be distributed as indicated on individual Task Orders.

5.2 Annual Plan of Action and Milestones (POA&M and Staffing Plan) The contractor will develop a POA&M for each work area within the Statement of Work (SOW) and/or as identified by the Task Order. The SOW area is defined as the level of task identified in the SOW/Task Order. The POA&M is due within twenty-one (21) calendar days after the Task Order award, Exercise of Option, Technical Instruction Issuance, and/or Modification to the Technical Instruction or the Task Order which affect the Level of Effort or dollar ceilings. While contractor format is acceptable, with the TOM’s and Contracting Officer’s, the following information, as a minimum, will appear in each POA&M.

5.2.1 Task Order Statement of Work

(a) Date POA&M prepared (and revision number if applicable)

(b) Work Area

(c) POA&M applicable period of performance

(d) Work summary to include a listing of planned deliverables

(e) Estimated Man-Years required for the period to include subcontractors

(f) Names of personnel to be assigned and estimated Level of Effort stated in terms of man-years.

5.3 In Progress Reviews (IPR)

The contractor will participate in both formal and informal IPRs of work being performed. Formal reviews will be scheduled by the Government and will be conducted in Governmental spaces. At the time the review is scheduled, the Government will communicate the specific purpose of the review and advise the contractor as to the desired content of the presentation. The contractor will provide copies of slides presented to all attendees. An initial IPR will be conducted within sixty (60) days of the Task Order award date and will follow an agenda agreed to by the TOM. Subsequent IPRs will be conducted approximately every ninety (90) days thereafter unless waived by the Government.

5.4 Task Prioritization Meetings

The contractor will participate in periodic Task Prioritization Meetings with individual Task Area Points of Contact (POC). The purpose of these meetings is to convey the Government’s technical program schedules and priorities and to identify corresponding task priorities for this order. The TOM and/or the Alternate TOM (A-TOM) may attend these meetings. Results of these meetings will be included in the Monthly Progress Report.

5.5 EVM Reporting

If applicable, the contractor will provide bi-weekly Earned Value Management (EVM) reports. The date for the first submission will be confirmed by the TOM upon Task Order award. The TOM will also identify the specific projects to be reported. Cumulative hours by subtask is a minimum requirement; cumulative hours by task and by employee is desired. The Government will provide the format for this report at the time of award and confirm the required submission date for the first report. The purpose of the report is to provide EVM variables that feed directly into the Project schedule. The Government, at its discretion, may hold validation sessions with the contractor to review actual hours submitted in the bi-weekly reports with the hours reported in the Monthly Progress Report. The EVM report will be provided to the TOM, Government Task Area Managers (for their respective project) and the Contract Specialist.

6.0 CONTRACT DATA REQUIREMENTS LIST (CDRL)

CDRL requirements will be specified in each Task Order issued.

7.0 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

FEMA will provide necessary equipment to accomplish the functions described within this SOW. This includes, but is not limited to; laptops, desk phones, printers, office supplies, etc. The individual will be responsible for any items issued to him/her from FEMA and will be issued a hand receipt for stated items. All items are subject to inventory based on the Government’s discretion, and can be requested to be returned at any time. Additionally, FEMA will provide the contractor will all necessary information to perform all services described in this SOW.

8.0 PLACE OF PERFORMANCE

Services will be performed at the following locations:

FEMA MWEOC

19844 Blue Ridge Mountain Road

Mt. Weather, Virginia 20135

FEMA NPSC

Winchester, VA

FEMA NPSC

FEMA NPSC

JFOs/DFOs/MDRCs

FEMA HQ

Hyattsville, MD Denton, Texas

US and territories Washington DC

9.0 PERIOD OF PERFORMANCE

The base period of performance for the contract is from the date of award through (Date TBD). The contract will contain an option clause providing FEMA the authority to extend the contract term for up to four (4) additional one (1) year periods.

The period of performance for each task will be indicated in each Task Order awarded under this contract.

10.0 SECURITY

10.1 General

The contractor shall comply with the Department of Homeland Security’s (DHS) technical, management, and operational security controls to ensure that the Government’s security requirements are met. DHS 4300A policy guide will be used for Sensitive Systems and DHS 4300B policy guide will be used for National Security Systems.

10.2 Contractor Personnel

10.2.1 Employment Eligibility

The Contractor will provide the appropriate levels of clearance to maintain the classified and unclassified systems. The Contractor will ensure that each employee and potential employee provide his/her name, and social security number (not card) for verification. If the number is not valid, then the employee will not be authorized to work on the contract until the resolved.

Subject to existing law, regulations and/or other provisions of this contract, illegal or undocumented aliens shall not be employed by the Contractor to perform on this contract. The Contractor shall ensure this provision is expressly incorporated into any and all subcontracts or subordinate agreements issued in support of this contract.

10.2.2 Continued Eligibility

The Department of Homeland Security (DHS) reserves the right to deny and/or restrict entrance to Government facilities, prohibit employees from assigned work under the contract, deny and/or restrict handling of sensitive documents/material to any Contractor employee who DHS determines to present a risk of compromising classified and/or sensitive Government information.

The Contractor shall report to the DHS Security Office any and all adverse information brought to their attention concerning employees performing under this contract. The report shall include the employee’s name and social security number, along with the adverse information being reported. Termination of employment of an employee does not obviate the requirement to submit this report. Reports based on rumor or innuendo shall not be submitted to the DHS Security Office.

10.2.3 Termination

The Contractor shall notify the DHS Security Office of all terminations/resignations of contractor personnel on this contract within five (5) days of occurrence. The Contractor shall return to the Contracting Officer’s Technical Representative (COTR) all DHS issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report shall be submitted to the COTR, referencing the pass or card number, name of individual to whom it was issued, and the last known location and disposition of the pass or card.

10.2.4 Security Management

The Contractor shall appoint a senior official to act as a Security Officer. The individual shall work collaboratively with the DHS Security Officer through the COTR on all security matters, to include physical, personnel, and protection of all sensitive documents/material handled by the Contractor.

The COTR and DHS Security Office will have the right to inspect procedures, methods and facilities utilized by the Contractor to comply with the security requirements under this contract. Should the COTR or DHS Security Office determine that the Contractor is not in compliance with the security requirements of the contract, the Contracting Officer shall notify the Contractor, in writing, of the appropriate action the Contractor must take to rectify any non-compliance with the contract security requirements.

10.2.5 Suitability Determination

DHS shall exercise full control over granting, denying, withholding or terminating unescorted Government facility and/or access to or handling of sensitive Government information to contractor employees based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and grant a favorable Entry on Duty (EOD) decision based on preliminary suitability checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of a full investigation. Granting of a favorable EOD decision shall not be considered as assurance that full employment suitability authorization will follow. A favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude or bar DHS from withdrawal of or terminating access to Government facilities or information, at any time during the term of the contract. Contractor employees shall not be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by the Security Office.

Contract employees waiting for an EOD decision may begin work on the contract provided they do not access sensitive Government information. Limited access to Government buildings is allowable prior to the EOD decision, if the Contractor is escorted by a Government employee. This limited access allows contractors to attend briefings, non-recurring meetings and begin transition work.

10.2.6 Background Investigations

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, in addition to possessing a DISCO granted personnel security clearance, shall undergo a position sensitivity analysis based on the duties each individual will perform under the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted for suitability screening purposes. All background investigations will be processed through the DHS Security Office. Prospective Contractor employees shall submit the following completed forms to the DHS Security Office. The Standard Form 85P will be completed electronically, through the Office of Personnel Management’s e-QIP System. The completed forms must be given to the DHS Security Office no less than thirty (30) days before the start of the contract or thirty (30) days prior to entry on duty of any employees, whether a replacement, addition, subcontractor employee or contractor:

a. Standard Form 85P, “Questionnaire for Public Trust Positions”

b. FD Form 258, “Fingerprint Card” (2 copies)

c. Conditional Access to Sensitive But Unclassified Information Non-Disclosure Agreement

d. Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act

Only complete packages will be accepted by the DHS Security Office. Specific instructions on submission of packages will be provided upon award of the contract.

Unless an applicant requiring access to sensitive information has resided in the United States for three (3) of the past five (5) years, the Government may not be able to complete a satisfactory background investigation. In such cases, DHS retains the right to deem an applicant as ineligible due to insufficient background information.

The use of Non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position that involves access to or development of any DHS Information Technology (IT) systems. DHS will consider only U.S. Citizens and LPRs for employment on this contract. DHS will not approve LPRs for employment on this contract in any position that requires the LPR to access or assist in the development, operation, management or maintenance of DHS IT systems. By signing this contract, the Contractor agrees to this restriction. In those instances where other non-IT requirements contained in the contract can be met by using LPRs, those requirements shall be clearly described.

10.2.7 Information Technology Security Clearance

When sensitive Government information is processed using Government telecommunications and automated information systems, the Contractor shall provide for the administrative control of sensitive data being processed and adhere to the procedures governing such data as outlined in the “DHS IT Security Program – Publication DHS MD 4300.Pub.” Contractor personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractors who fail to comply with the Government’s security policy are subject to having their access to Government IT systems and facilities terminated, regardless if the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g. Privacy Act).

10.2.8 Information Technology Security Training and Oversight

All Contractor employees using Government automated systems or processing Government sensitive data shall be required to receive Security Awareness Training. This training will be provided by the appropriate component Agency of DHS.

Contractors involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the department, shall receive periodic training at least annually in security awareness, and accepted security practices and systems rules of behavior. Department contractors, with significant security responsibilities, shall receive specialized training specific to their security responsibilities annually. The level of training shall commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Government information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behaviors by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

10.2.9 Accessibility Requirement

Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998, requires that when Federal agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to and use of information and services that is comparable to access and use available to non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following standards have been identified:

a. 36 CFR 1194.21 – Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement.

b. 36 CFR 1194.22 – Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as Flash or Asynchronous JavaScript and XML (AJAX) then “1194.21 Software” standards apply to fulfill functional performance criteria.

c. 36 CFR 1194.23 – Telecommunications Products. This applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured or developed when the item will be used by member(s) of the public or Federal employee(s).

d. 36 CFR 1194.31 – Functional Performance Criteria applies to all EIT deliverables regardless of delivery method. All EIT deliverables shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

e. 36 CFR 1194.41 – Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required “1194.31 Functional Performance Criteria”, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum.

f. Exceptions for this work statement have been determined by DHS. Only the exceptions described herein shall be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may be applied:

· 36 CFR 1194.3(b) – Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, and are not considered members of the public.

· 36 CFR 1194.3(f) – Back Office, applies to any EIT item that will be located in spaces frequented only by service personnel for maintenance, repair, or FEMA monitoring of equipment. This exception does not include remote user interfaces that are accessible outside the enclosed “space”.

11.0 TRAVEL

All contractor travel other than local must be approved in advance by the COTR. Contractor travel expenses will be reimbursed in accordance with the allowable travel costs specified in the Federal Travel Regulations.

12.0 KEY PERSONNEL

Key personnel will be specified in each Task Order issued under this contract. Prior to removing, replacing, or diverting any of the specified individuals, the Contractor shall notify the Contracting Officer and Contracting Officer’s Technical Representative reasonably in advance and shall submit justification (including proposed substitutions) in detail to allow for an evaluation of the impact relative to the Task Order. The Government also retains the right, at its discretion, to interview all proposed replacements of key personnel. No diversion shall be made by the Contractor without the written consent of the Contracting Officer; provided, that the Contracting Officer may ratify in writing the change and such ratification shall constitute the consent of the Contracting Officer required by this clause.

13.0 TRAINING FOR CONTRACTOR STAFF

The Task Orders issued against the underlying contract resulting from this competition will cover all types of IT O&M services. It is impossible to identify all requirements and/or anticipate how technology will evolve over the life of task orders issued against the contracts. Therefore, the Contractor shall be capable of providing the broad range of IT services and remain current with emerging technologies.

The Contractor must provide for and fund all training for its staff necessary to perform the services specified in the Task Order. The Contractor must also provide refresher training to keep its staff current. The Contractor must include in its proposal a plan to provide training to meet this requirement. FEMA will only fund training it specifies for FEMA-specific operating procedures.

14.0 COMPLIANCE WITH APPROPRIATE POLICIES, LAWS AND STANDARDS

Compliance with the policies, laws, and standards, described in Attachment 3, is required. FEMA will provide governing management, control, and oversight during the life of this effort.

In addition to Attachment 3, the following mandatory DHS Clauses apply:

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable standards have been identified:

36 CFR 1194.21 – Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including, but not limited to, GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some web-based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 – Web-based Intranet and Internet Information and Applications, applies to all web-based deliverables, including documentation and reports procured or developed under this work statement. When any web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then “1194.21 Software” standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 – Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.24 – Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a web or software application interface having user controls available.

36 CFR 1194.31 – Functional Performance Criteria applies to all EIT deliverables regardless of delivery method. All EIT deliverables shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 – Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required “1194.31 Functional Performance Criteria”, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply:

36 CFR 1194.2(b) – (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole if not commercially available because not all products in the marketplace meet every standard. If products are commercially available that meets some but not all of the standards, the agency must procure the product that best meets the standards.

When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the Agency business needs, and from that list of products or services, an analysis of the selected product illustrating it met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires approval from the DHS Office on Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

36 CFR 1194.3(b) – Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, and are not considered members of the public.

15.0 PLACEMENT OF FUTURE TASK ORDERS

All contractors will be given a fair opportunity to be considered for each future Task Order unless one of the following exceptions applies:

· The Government’s need for the services is so urgent that providing a fair opportunity to be considered would result in unacceptable delays;

· Only one awardee is capable of providing the services required at the level of quality required because the services are unique or highly specialized;

· The order must be issued on a sole source in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order; or

· It is necessary to place the order to satisfy a minimum guarantee.

For each Task Order, a Task Order Proposal Request will be issued to each contractor that contains:

· A clear statement of the Agency’s requirements;

· A reasonable response period;

· Disclosure of the significant factors and subfactors, including cost or price, that FEMA will consider in evaluating proposals, and their relative importance; and

· Where award is made on a best value basis, a written statement documenting the basis for award and the relative importance of quality and price or cost factors.

The contractor’s Task Order proposal will be evaluated and discussions may be conducted as needed. Based upon its evaluation, FEMA will award a Task Order.

� EMBED Word.Picture.8 ���

Procurement Sensitive – Do Not Disclose

PAGE

Procurement Sensitive Information – Do Not Disclose

_1239791706.doc