HUD Emergency Notification_ENS SOW 2025.doc

Statement of Work (SOW) HUD Emergency Notification System (ENS)

04/07/2025 4Vision Statement

1 General Information

1.1 Scope of Work/Description of Services

1.2 Background

1.3 Constraints

1.4 Non-Personal Services

1.5 Period of Performance

1.6 Place of Performance

1.7 Hours of Operation

1.8 Special Qualifications

1.9 Post Award/Kickoff Conference

1.10 Status Meetings

1.11 Contractor Travel

1.12 Transition In

1.13 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Material

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

5 Specific Tasks

5.1 General……………………………………………………………………………………...….12

5.2 Desktop Alert Integration……………………………..………………………………………13

5.3 System Intergration………………………………………………………………………….. 14

6 Deliverables

6.1 Acceptance Criteria

7 Related Documents

8 Performance Requirements Summary…………….………………………………………….21

Vision Statement To provide continued rapid emergency alert notifications to HUD staff via a Federal Risk and Authorization Management Program (FedRAMP) ready comprehensive enterprise-wide Emergency Notification Systems (ENS).

1 General Information

1.1 Scope of Work/Description of Services

The Department of Housing and Urban Development (HUD), Office of the Chief Administrative Officer (OCAO) is seeking Contractor support services to provide rapid emergency alert notifications to HUD staff via a Federal Risk and Authorization Management Program (FedRAMP) ready comprehensive enterprise-wide Emergency Notification Systems (ENS). These services are necessary to ensure that ENS is fully functional and operational. The ENS shall provide comprehensive methods to broadcast information to pre-defined distribution groups. The system shall support local (district) groups and system-wide administrator defined groups. Services shall include:

· Desktop Alert Notification Integration

· System Integration

· Security

· Contingency & Disaster Recovery Plans

· Reporting Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks and Deliverables.

1.2 Background

The ENS is a centralized database for maintaining contact information for all HUD Government employees. The ENS provides comprehensive methods to broadcast information to pre-defined distribution groups. The system supports local (district) groups and system-wide administrator defined groups. The system provides notifications via multiple mechanisms to HUD recipients. In addition, the system provides interactive response capability so notified staff members can respond to various inquiries, for example, health and welfare status.

1.3 Constraints

The services identified in this SOW will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

· FedRAMP

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform the work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for one base period of 12 months and four 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be performed at the Government’s facility located at the Robert C Weaver Federal Building, 451 Seventh Street, SW, Washington, DC 20410.

1.7 Hours of Operation

The Contractor is responsible for providing monitoring services 24 hours a day seven days a week. Customer Support hours shall not exceed a sixty (60) hour work week. The Government reserves the right to change the hours of operation or restrict contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

N/A

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after the contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.10 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will appraise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action should be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46. The Contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use the tourist class or economy class. Similar lodging accommodations to the extent they are available and commensurate with the mission requirements. HUD will not reimburse Contractor's local travel. Local travel is defined as travel within fifty (50) miles of Washington, DC. All other travel will be reimbursed on a cost reimbursable basis; no profit or fee will be paid.

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services, as required. As a successor, the Contractor shall have sufficient personnel on board during the 30-day Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 30 days Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business/Workdays - Every official workday of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirements and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts’ quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to ensure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnish any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have a contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2

AQL - Acceptable Quality Level

CO - Contracting Officer

COR - Contracting Officer's Representative

ENS – Emergency Notification System EST - Eastern Standard Time (U.S.)

FAR – Federal Acquisition Regulation FedRAMP - Federal Risk and Authorization Management Program HUD - U.S. Department of Housing and Urban Development OCAO – Office of the Chief Administrative Officer

OCPO - Office of the Chief Procurement Officer

PII – Personally Identifiable Information

POC - Point of Contact

QA - Quality Assurance

QASP - Quality Assurance Surveillance Plan

QCP - Quality Control Plan

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

The Government will not provide services.

3.2 Facilities

The Government will provide all facilities.

3.3 Equipment

The Government will provide (Computer equipment and server access)

3.4 Materials

The Government may provide materials. Copies of the required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

N/A

4.2 Equipment

N/A

4.3 Material

The contractor shall furnish all materials.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternative should also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, “Key Personnel”. The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to the daily operations of the contract. Accordingly, at a minimum, the points of contact shall have technical knowledge of the requirement and be in the position to receive assignment, guidance, and direction from the COR, Project Manager, and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance. These points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 General

The Contractor shall provide all necessary infrastructures and software to implement ENS services.

The ENS shall provide methods to broadcast information to pre-defined distribution groups supporting HUD-wide messaging, regional messaging, and specific targeting messaging.

The initiation process shall start with a website or wireless device by authorized broadcasters. The authorized broadcaster selects predefined groups/scenarios that contain data such as phone numbers and e-mail addresses. The broadcaster initiates emergency notifications via one or multiple methods to notify users. The application attempts to contact the selected groups.

The status of the broadcast can be seen in real-time on screen and via report detailed by user and contact method used. An exceptional report ensures those that are not notified can be traced via other methods if normal notification is impossible.

Notifications shall include alerts and incident management responses and expectations during affected periods.

The ENS must be capable of notifying HUD staff in locations throughout the United States and territories including the Virgin Islands, Puerto Rico, Guam, and the Northern Mariana Islands.

The system shall provide notifications via multiple methods to HUD recipients. In addition, the system should provide an interactive response capability so notified staff members can respond to various inquiries, for example, health and welfare status.

The system shall support alert initiation via the public telephone network and the Internet. Minimally, the system shall be able to transmit alert messages via conventional and mobile telephone, electronic mail, and Short Message Service (SMS) text.

The system shall be able to confirm notification delivery to recipients and continuously attempt delivery using available methods until notification is confirmed. There should be no expectation of data connectivity or storage on the HUD platform.

5.2 A Desktop Alert Integration

The system must provide desktop alert interoperability for HUD’s existing ENS. Using a Representational State Transfer Application Programming Interface (REST API), both systems must communicate bi-directionally between each other, thus enabling HUD’s ENS to activate desktop alert products, while also allowing HUD to use the desktop alert to activate ENS.

Desktop Alert to ENS System Activation Methods

This activation option allows you to send a standard alert by selecting the target group and delivery methods (e.g., SMS, email, or phone) or to launch an existing notification template in ENS. Using the system’s REST API, the Desktop Alert Notifications system should be able to send outbound notifications to the system.

ENS System to Desktop Alert Activation Methods

There should be two options to activate Desktop Alert Notifications in the system: (1) The Desktop Alert Notifications API or (2) the ENS System’s Webhook. Since each inbound integration method has its own pros/cons we recommend evaluating both approaches and consulting with Desktop Alert Notifications Support to select the best integration method for your organization.

5.3 System Integration

System integration must allow ENS Mass Notification to launch alerts in Desktop Alert Notifications, Desktop Alert Notifications to launch alerts in the ENS Mass Notification or implement a bi-directional integration utilizing both approaches. This integration allows users a unified, single-point activation to launch all Desktop Alert Notifications products through the Everbridge system.

ENS Mass Notification to Desktop Alert Notifications (API)

With ENS's Mass Notification platform, a broadcaster can launch Desktop Alert Notification activations directly from the ENS's user interface using the Desktop Alert Notifications API. This method will utilize the ENS Publishing Option.

ENS Mass Notification to Desktop Alert Notifications (Webhook)

ENS Webhook integration is required to initiate Desktop Alert Notification activations from an ENS Incident. At activation time, broadcasters will have access to Incident Variables to dynamically change the behavior, recipients, and settings of the Desktop Alert Notifications activation.

Specific tasks as described below:

1. General Requirements

a. Will meet FedRAMP requirements.

b. Contractor shall provide an ENS to HUD (herein the Government) that will provide telephone, e-mail, desktop pop-up, phone application, and SMS notifications.

c. The system shall support no less than 8,400 accounts.

d. The system should be available and function 24 hours per day, 7 days per week.

e. The Government configuration and administration interface shall be web-based, enforce 128-bit SSL, provide for authentication of authorized Government users, and support at least Internet Explorer 9 or higher.

2. Data Center – requirements for the data center that will house Government provided data.

a. Physical Security

i. The data center shall be staffed or guarded 24 hours per day, seven days per week. The facility shall be alarmed for intrusion; alarms shall be monitored on an around-the-clock basis. The intrusion alarm system shall automatically notify law enforcement or a commercial monitoring service of alarms. The facility should have access controls for personnel; all visitors shall be identified, logged, and escorted. The facility should have low-light video monitoring of all ingress/egress points and storage vault doors. The Contractor shall maintain video for no less than 48 hours prior to overwrite.

ii. The data center that hosts the Government’s data must protect Government Personally Identifiable Information (PII) data.

iii. The log of visitors shall be provided to the Government for inspection within 48 hours upon request.

iv. The Contractor shall maintain a data center access list. This list shall be provided to the Government within 48 hours upon request.

v. The data center facility shall have written incident response procedures. Data center personnel shall be trained on the procedures no less than annually. The Contractor shall test incident response procedures no less than annually. Training and contingency test records shall be provided to the Government for inspection within 48 hours upon request. The data center facility shall have conspicuously placed emergency contact data.

vi. The Contractor shall inform the Government of security incidents and suspected security incidents within four (4) hours of detection. For any incident involving unauthorized use or disclosure of PII, the Contractor shall notify the Government immediately.

b. Personnel Security

i. All data center personnel must, at a minimum, be vetted with name and fingerprint check prior to using the system.

ii. All data center personnel must know potential consequences of system misuse.

c. Identification / Authentication

i. All system users must use unique identifiers and authenticated IDs.

ii. Contractor shall have written procedures in place on how to report a security incident.

d. Media Security

i. Contractor shall provide written procedures on data center security practices that involve Government data within 48 hours upon request.

ii. Contractor data center must have at least one redundant backup facility.

e. Contingency & Disaster and Recovery Plans

i. Contractor shall test backup facility operations quarterly and provide results to the Government within 48 hours upon request.

ii. Contractor shall permit facility visits by Government security managers to all data center locations to assess practices and procedures within 48 hours upon request.

iii. Contractor must maintain and provide a contingency and disaster recovery plan to the Government within 48 hours upon request.

3. System Automation – The vendor must propose a solution that ensures the secure transfer of data and ensure current, accurate and complete data.

a. The Contractor system shall allow for a complete refresh of the notification database daily with no Government interaction.

b. Contractor system shall have ability to create groups based on a GUI interface for all imported fields.

c. Once groups are created in the system, the system shall have the ability to recreate those groups automatically after each daily refresh of the database with no Government interaction.

d. All groups created by local administrators shall be automatically refreshed daily with no interaction by the Government.

e. The system shall allow secure file transfer (SFTP) of contact file to data center.

f. The system must allow for mapping and remapping of data elements and minimum importation of five phone numbers, two email addresses, complete name, district, department, title, and all Government defined data fields.

4. Scenarios (the ability to outline the actions that shall take place for specific emergency situations) – the Government must be able to create “scenarios” at the district level and top administration level. (These scenarios must only be available to the local district administrator and primary system administrator. For example, the District of Washington must have the ability to create a “snow emergency” scenario that is only seen by the district. The Southern District of California must be able to create a “fire emergency” that is only available to the district. The District of Washington cannot see the other districts contacts or scenarios and vice versa.)

a. Scenarios shall be able to refresh automatically after nightly refresh of contact information.

b. The local administrator must be able to create and modify local scenarios.

5. Administration

a. The Government must be able to create unlimited local (district) administrators.

b. The Government must be able to organize and administer data by district in at least 125 groups which require separate administration.

c. All data shall be contained in one system for top level notification and administration.

d. Regional administrators shall be allowed to only view/administer his/her regional data, unless otherwise authorized.

6. Basic Functionality

a. Allow secure Uniform Resource Locator (URL) (https) web-based communication.

b. A person using a computer or wireless device shall be able to trigger notifications that include existing groups and scenarios.

c. Notifications shall be deliverable to desktop, phone, SMS, and e-Mail.

d. System shall be able to specify order of notification.

e. Notifications must have text to voice capability.

7. Video Training

The vendor shall provide HUD training as identified below.

a. Training shall consist of three distinct training sessions: 1) Overall system administration 2) District system administration 3) End user.

b. Each training session shall be taped at the Government’s studio in Washington, DC. The training will be recorded in a studio. Once the training is taped, it will be edited at the Government’s expense to be distributed to HUD users. The end-result shall consist of three separate videos as described below.

8. System Setup

a. Initial system setup completed within 14 days from the date of award. The Contractor shall provide initial setup of system including group creation, scenario creation, administer creation, Secure File Transfer Protocol, and system security setup.

b. Contractor shall work with the Government to setup complete automation of import process.

9. Reporting

a. System shall have reporting capabilities that include, at a minimum, exception reports, real time monitoring, system groups, system users, scenarios, and system notification history.

b. System shall provide real time emergency notification tracking that includes, at a minimum, attempts, successes, and exceptions. This should also include the ability to sort data by office or regional area.

c. System will give options to create Quick Reports that can be preconfigured and provide summary information quickly.

d. System will produce an automated summary report after each Test and Incident.

e. System will provide options to create Custom Reports will allow users to select the fields they want to show and set filters on the data. The contractor will assist the Government in creating Custom Reports. The data will be able to be arranged in the report and download into a file in the format desired. The system should accommodate up to 30 fields in the Custom Report. System users can generate a report on members of a specific group from Custom Reports or can use an advanced search feature from the Contacts tab to download a list of members of a specific group. All reports can be saved and used for future requirements.

6 Deliverables

The Contractor shall complete all work and submit all deliverables as specified herein. The Government reserves the right to make changes to delivery dates.

a. A web/phone-based system as defined in the Scope of Work above.

b. Written document outlining the data center security practices to ensure privacy of Government data.

c. Initial system setup within 14 days from date of award.

d. Admin / end user training completed within 30 days from the award of contract.

e. Contingency and disaster recovery plan within 7 days from the award of contract.

f. Contractor shall maintain a data center visitor access list. This list shall be provided to the Government within 48 hours upon request.

g. Contractor shall maintain a data center personnel access list. This list shall be provided to the Government within 48 hours upon request.

h. Contractor shall test incident response procedures no less than annually. Training and contingency test records shall be provided to the Government for inspection within 48 hours upon request.

i. Contractor shall have written procedures in place on how to report a security incident. Incident reports shall be provided to the Government within 48 hours upon request.

j. Contractor shall provide written procedures on data center security practices that involve Government data within 48 hours upon request.

k. Contractor shall provide Contingency & Disaster and Recovery Plans to Government within 48 hours upon request.

l. Contractor shall test backup facility operations quarterly and provide results to the Government within 48 hours upon request.

m. Contractor shall permit facility visits by Government security managers to all data center locations to assess practices and procedures within 48 hours upon request.

n. Training shall consist of three distinct training sessions: 1) Overall system administration 2) District system administration 3) End user.

I. Overall system administration will consist of comprehensive training for the ENS system. After training, the viewers shall be able to administer all basic and complex workings of the system. Viewers must also completely know of the notification and receipt process.

II. Regional system administration shall give viewers an overview of administration with a focus on group creation, local scenario building, notifications, and receipt of notifications, notification tracking, and reporting and general district upkeep of the system. These viewers will be the primary group sending out district alert notifications.

III. End user training will give viewers a general overview of the system, with a focus on alert notifications. These viewers will be the secondary group sending out alert notifications.

IV. A training manual shall be provided by the Contractor for each of the above-named classes.

6.1 Acceptance Criteria

Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that:

a. Uses the following contextual information: [%SA-11(02)_ODP[01] Assignment:

organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels%];

b. Employs the following tools and methods: [%SA-11(02)_ODP[02] Assignment:

organization-defined tools and methods%];

c. Conducts the modeling and analyses at the following level of rigor: [%sa-11.2_prm_3

Assignment: organization-defined breadth and depth of modeling and analyses%]; and

d. Produces evidence that meets the following acceptance criteria: [%sa-11.2_prm_4

6.2 Acceptance Criteria

Each contract deliverable shall meet the following inspection and acceptance criteria in addition to any "Inspection and Acceptance” contract terms and conditions:

Assignment: organization-defined acceptance criteria%].

Additional assessment-specific parameters

· Control parameter sa-11.2_prm_3 organization-defined breadth and depth of modeling and analyses breaks down into the following assessment parameters

· The breadth and depth of threat modeling to be conducted: [%SA-

11(02)_ODP[03] breadth and depth%]

· The breadth and depth of vulnerability analyses to be conducted: [%SA-

11(02)_ODP[04] breadth and depth%]

· Control parameter sa-11.2_prm_4 organization-defined acceptance criteria breaks down into the following assessment parameters

· Acceptance criteria to be met by produced evidence for threat modeling:

[%SA-11(02)_ODP[05] acceptance criteria%]

· Acceptance criteria to be met by produced evidence for vulnerability analyses:

· [%SA-11(02)_ODP[06] acceptance criteria%]).

7 Related Documents

The Contractor shall abide by all applicable regulations, publications, manuals, policies, and procedures in the performance of this contract.

8 Performance Requirements Summary

The summary chart below lists the contract's primary requirements, the associated performance standards, the expected target performance, and the methods of surveillance. While some contract requirements may not be listed in the chart below, requirements not appearing on the PRS chart do not negate the Contractor's obligation to perform all requirements as specified in the contract. Additionally, HUD reserves all rights and remedies under the provisions and clauses of the contract when performance of any contract requirement, whether or not listed below, is unacceptable.

HUD will develop a Quality Assurance Surveillance Plan to be used to provide contract oversight. In conjunction with the Contractor's Quality Control Plan and various other methods of assessing performance, the COR and PM may perform on-site reviews and/or other types of verification to determine that the specified target performance requirements have been met. Regular review of Contractor performance is critical to the overall success of the contract. On a monthly basis, the COR will evaluate the quality of the product or services

Performance Requirement Summary (PRS)