RFP__M00264-13-R-0047_--_EMERGENCY_MANAGEMENT_INCIDENT_MANAGEMENT_SYSTEM_(EMIMS).pdf

COMMANDING GENERAL - REG CON OFFICE NCR

2010 HENDERSON RD

BOZADJIAN, GEORGE

QUANTICO VA 22134-5001

(703) 432-1084

(703) 784-3592

UNDER DPAS (15 CFR 700)

11. DELIVERY FOR FOB

RFQ

SEE SCHEDULE

14. METHOD OF SOLICITATION

IFB RFP

CODE

SEE ADDENDUM

BLOCK IS MARKED

DESTINATION UNLESS

12. DISCOUNT TERMS

(No Collect Calls)

$35.5 M

13b. RATING

13a. THIS CONTRACT IS A RATED ORDER

X

CODE

M00264-13-R-0047 10-Jul-2013

b. TELEPHONE NUMBER

(703) 432-1084

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 12 Aug 2013

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV 3/2005)

Prescribed by GSA

FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER) 31c. DATE SIGNED

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

22. UNIT 23. UNIT PRICE 24. AMOUNT21. QUANTITY

CODE 10. THIS ACQUISITION IS

UNRESTRICTED

FAX: NAICS:

TEL:

CODE 18a. PAYMENT WILL BE MADE BYOFFEROR

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TEL.

M00264

SIZE STD:

9. ISSUED BY

FACILITY

CODE

17a.CONTRACTOR/

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

BOZADJIAN, GEORGE D.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES

SEE SCHEDULE

511210

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS

SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

SB

HUBZONE SB

SET ASIDE: 100 % FOR

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

M9549413RCCU202

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

TEL: EMAIL:

COPIES

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

.OFFER DATED YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

8(A)

SVC-DISABLED VET-OWNED SB

EMERGING SB

X X

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

SEE SCHEDULE

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES 21. QUANTITY 22. UNIT 24. AMOUNT

PAGE 2 OF

23. UNIT PRICE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV 3/2005) BACK

Prescribed by GSA

FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

M00264-13-R-0047

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 6 Each EMIMS Configuration Support

FFP

Technical Services requested at the six (6) specified locations per the requirements listed in the Performance Work Statement (PWS).

Price per installation per location is requested.

FOB: Destination

MILSTRIP: M9549413RCCU202

PURCHASE REQUEST NUMBER: M9549413RCCU202

NET AMT

0002 6 Each EMIMS Software License Fees

FFP

Enterprise licenses for six (6) locations to accommodate multiple installations as well as multiple users per location.

FOB: Destination

0003 6 Each EMIMS Training

FFP

System maintenance training per installation for each location specified in the PWS. Training will be held for about 25 students / Federal employees at each location. Training sessions are estimated to be a minimum of about 35 hours long at each location.

0004 Dollars, U.S.

Travel/ODC

COST

The following six (6) sites in various regions:

• Marine Corps Base Quantico (Quantico, Virginia)

• Marine Corps Installations Command – Henderson Hall (Arlington, Virginia)

• Marine Corps Installations East – Camp Lejeune (Jacksonville, North Carolina)

• Marine Corps Installations West – Camp Pendleton (Oceanside, California)

• Marine Corps Installations Pacific – Camp Smedley D. Butler (Naha, Japan)

• Marine Corps Base Hawaii – Camp H. M. Smith (Aiea, Hawaii)

Occasional travel may be required. CONUS and OCONUS travel must be reimbursed in accordance with the JTR. Per Diem shall be in accordance with http://www.defensetravel.dod.mil/site/perdiemCalc.cfm.

Offerors shall propose the amount of $12,000.00 for this CLIN.

ESTIMATED COST

0005 140 Hours Information Assurance Labor

FFP

Conduct Information assurance procedures per paragraph 4.0 "Information Assurance" of the PWS. Contractor shall abide by the surveillance procedures of Task 1 of the Performance Requirements Summary (PRS) listed in the PWS.

1001 6 Each OPTION Maintenance Support

FFP

Maintenance support for system(s) in accordance with PWS Paragraph 8.11 "Maintenance and Training", and all subparagrpahs beneath it.

1002 6 Each OPTION EMIMS Training

FFP

System maintenance training per installation for each location specified in the PWS. Training will be held for about 25 students / Federal employees at each location. Training sessions are estimated to be a minimum of about 35 hours long

1003 Dollars, OPTION Travel/ODC

The following six (6) sites in various regions:

• Marine Corps Base Quantico (Quantico, Virginia)

• Marine Corps Installations Command – Henderson Hall (Arlington, Virginia)

• Marine Corps Installations East – Camp Lejeune (Jacksonville, North Carolina)

• Marine Corps Installations West – Camp Pendleton (Oceanside, California)

• Marine Corps Installations Pacific – Camp Smedley D. Butler (Naha, Japan)

• Marine Corps Base Hawaii – Camp H. M. Smith (Aiea, Hawaii)

Occasional travel may be required. CONUS and OCONUS travel must be reimbursed in accordance with the JTR. Per Diem shall be in accordance with http://www.defensetravel.dod.mil/site/perdiemCalc.cfm.

1004 140 Hours OPTION Information Assurance Labor

FFP

Conduct Information assurance procedures per paragraph 4.0 "Information Assurance" of the PWS. Contractor shall abide by the surveillance procedures of

2001 6 Each OPTION Maintenance Support

FFP

Maintenance support for system(s) in accordance with PWS Paragraph 8.11

2002 6 Each OPTION EMIMS Training

FFP

System maintenance training per installation for each location specified in the PWS. Training will be held for about 25 students / Federal employees at each location. Training sessions are estimated to be a minimum of about 35 hours long

2003 Dollars, The following six (6) sites in various regions:

• Marine Corps Base Quantico (Quantico, Virginia)

• Marine Corps Installations Command – Henderson Hall (Arlington, Virginia)

• Marine Corps Installations East – Camp Lejeune (Jacksonville, North Carolina)

• Marine Corps Installations West – Camp Pendleton (Oceanside, California)

• Marine Corps Installations Pacific – Camp Smedley D. Butler (Naha, Japan)

• Marine Corps Base Hawaii – Camp H. M. Smith (Aiea, Hawaii)

Occasional travel may be required. CONUS and OCONUS travel must be reimbursed in accordance with the JTR. Per Diem shall be in accordance with http://www.defensetravel.dod.mil/site/perdiemCalc.cfm.

2004 140 Hours OPTION Information Assurance Labor

FFP

Conduct Information assurance procedures per paragraph 4.0 "Information Assurance" of the PWS. Contractor shall abide by the surveillance procedures of

3001 6 Each OPTION Maintenance Support

FFP

Maintenance support for system(s) in accordance with PWS Paragraph 8.11

3002 6 Each OPTION EMIMS Training

FFP

System maintenance training per installation for each location specified in the PWS. Training will be held for about 25 students / Federal employees at each location. Training sessions are estimated to be a minimum of about 35 hours long

3003 Dollars, The following six (6) sites in various regions:

• Marine Corps Base Quantico (Quantico, Virginia)

• Marine Corps Installations Command – Henderson Hall (Arlington, Virginia)

• Marine Corps Installations East – Camp Lejeune (Jacksonville, North Carolina)

• Marine Corps Installations West – Camp Pendleton (Oceanside, California)

• Marine Corps Installations Pacific – Camp Smedley D. Butler (Naha, Japan)

• Marine Corps Base Hawaii – Camp H. M. Smith (Aiea, Hawaii)

Occasional travel may be required. CONUS and OCONUS travel must be reimbursed in accordance with the JTR. Per Diem shall be in accordance with http://www.defensetravel.dod.mil/site/perdiemCalc.cfm.

3004 140 Hours OPTION Information Assurance Labor

FFP

Conduct Information assurance procedures per paragraph 4.0 "Information Assurance" of the PWS. Contractor shall abide by the surveillance procedures of

4001 6 Each OPTION Maintenance Support

FFP

Maintenance support for system(s) in accordance with PWS Paragraph 8.11

4002 6 Each OPTION EMIMS Training

FFP

System maintenance training per installation for each location specified in the PWS. Training will be held for about 25 students / Federal employees at each location. Training sessions are estimated to be a minimum of about 35 hours long

4003 Dollars, The following six (6) sites in various regions:

• Marine Corps Base Quantico (Quantico, Virginia)

• Marine Corps Installations Command – Henderson Hall (Arlington, Virginia)

• Marine Corps Installations East – Camp Lejeune (Jacksonville, North Carolina)

• Marine Corps Installations West – Camp Pendleton (Oceanside, California)

• Marine Corps Installations Pacific – Camp Smedley D. Butler (Naha, Japan)

• Marine Corps Base Hawaii – Camp H. M. Smith (Aiea, Hawaii)

Occasional travel may be required. CONUS and OCONUS travel must be reimbursed in accordance with the JTR. Per Diem shall be in accordance with http://www.defensetravel.dod.mil/site/perdiemCalc.cfm.

4004 140 Hours OPTION Information Assurance Labor

FFP

Conduct Information assurance procedures per paragraph 4.0 "Information Assurance" of the PWS. Contractor shall abide by the surveillance procedures of

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

FOR THE

EMERGENCY MANAGEMENT INCIDENT MANAGEMENT SYSTEM (EMIMS)

1.0 INTRODUCTION

The US Marine Corps (USMC) has a requirement for an internet accessible emergency management incident management system that provides coordination with civilian response and recovery partners. This application shall provide MCICOM with the ability to standardize emergency management incident coordination and to ensure compliance with Department of Defense (DoD) and USMC policies and satisfy reporting and documentation requirements. Additionally, EMIMS shall support access to important emergency management decision-making information including near real-time access to local, regional, and national weather trends, satellite images, mapping information, details of operations and resource status within the USMC and partner civilian jurisdictions, and near real-time information sharing. MCICOM will deploy the application to each of the following six (6) sites in various regions:

• Marine Corps Base Quantico (Quantico, Virginia)

• Marine Corps Installations Command – Henderson Hall (Arlington, Virginia)

• Marine Corps Installations East – Camp Lejeune (Jacksonville, North Carolina)

• Marine Corps Installations West – Camp Pendleton (Oceanside, California)

• Marine Corps Installations Pacific – Camp Smedley D. Butler (Naha, Japan)

• Marine Corps Base Hawaii – Camp H. M. Smith (Aiea, Hawaii)

1.1 Scope

This Performance Work Statement (PWS) sets forth the work efforts required for support and enhancements to the Emergency Management Incident Management System (EMIMS). The scope of this effort shall encompass the following:

• Information Assurance

• Web-based System Access

• Information Sharing

• Disaster Recovery

• Mapping Capability

• Maintenance and Training

• Program Management

1.2 Expected Outcome

The Deputy Commandant for Installations and Logistics (DC I&L) and Commander, Marine Corps Installations Command (MCICOM) expect to gain efficient, high quality, customer-oriented contractor technical support for all EMIMS users located worldwide. Contracting for these services will allow I&L and MCICOM staff to focus on providing improved emergency management services to the Commander, MCICOM, Regional Installations Commanders, Commanders at Marine Corps Installations, and Marines and their families, while at the same time, reducing cost through innovative applications by the contractor. Although these organizations have different mission structures, for purposes of this PWS the term MCICOM will be used to refer to the senior stakeholders and policy authority for the emergency management incident management system used throughout Marine Corps installations including both regional commanders and supported Training and Education Command (TECOM) installations.

1.3 Assumptions

The assumptions listed below apply to this requirement:

• MCICOM staff has determined that requests for assistance and problem resolution support for all installation emergency management operations customers will be sustained at current or higher levels.

• The current and future emergency management operations are increasing in complexity in the area of information collection and data sharing and require advanced technical skills to meet the expected high levels of customer service.

1.4 General Information

• A U.S. Government employee, Program Manager, shall be assigned to the contractor team to provide oversight and analysis of the effort, and the team shall include expert personnel with experience and knowledge of performing information assurance, analysis, COTS adaptation, integration, training, and testing.

• EMIMS is considered to be Mission Assurance Category (MAC) III system with a Confidentiality Level as described in Department of Defense Instruction (DoDI) 8500.2 of Sensitive but Unclassified (SBU).

• In accordance with FAR 37.114(c): “All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public or Congress that they are Government officials ... (Contractor personnel) must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.”

1.5 Applicable Documents

Applicable documents will be listed throughout the PWS to the extent specified herein. The most recent revision of the referenced document at the time of contract shall be used unless otherwise specified or directed by the Contracting Officer. Subject to Contracting Officer direction, in the event of conflict between the applicable documents and this PWS, the PWS shall take precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

2.0 GENERAL REQUIREMENTS

Current USMC emergency management incident management efforts consist of disparate systems supported and funded at the Installation level that are increasingly unable to meet expanding needs and requirements. Existing methods include commercial off the shelf (COTS) web-based applications. A uniform approach is needed to address these issues, and allow MCICOM to implement a standardized emergency management incident coordination application that provides a common incident management capability and supports interoperability with all internal and external emergency management response partners.

3.0 DELIVERABLES

Deliverables are described through-out the PWS. Where deliverable documents are required the contractor shall provide one original in hardcopy form. The contractor shall maintain an electronic copy; of each deliverable on a shared drive of the MCICOM LAN that is accessible to the MCICOM staff. This drive will contain a separate directory established as a repository for all deliverables.

Deliverables must incorporate Government review comments for acceptance. The Government will have ten (10) working days to review deliverables and provide comments. The Contractor shall have five (5) working days to respond to or incorporate Government comments. For the EMIMS to be accepted, it must have successfully completed the test scenarios outlined in the Test Plan, all tasks must have been completed, all deliverables have been provided in the format and media required by the Government, all deliverables will be provided in accordance with DFARS 252.227-7020, and the system must have met the general requirements as stated herein.

4.0 INFORMATION ASSURANCE (IA)

4.1.1 Scope. The scope of this effort is to provide independent Information Assurance support for MCICOM. The scope of this activity includes the planning, review, reporting, tracking and management of Information Assurance (IA) documentation and the technical analysis of the MCICOM information system IA Certification and Accreditation (C&A) posture against DoD, US Department of Navy and Marine Corps security standards. Key support requirements require an understanding and application of the following: DoDI 8510.01 DoD Information Assurance Certification and Accreditation Process (DIACAP), DoD 8500.2 IA control compliance requirements, Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs), NIST IA control compliance requirements, and management of IA testing related activities consistent with program ACAT levels, milestone schedules, and overarching policy requirements.

4.1.2 Background. The Defense Information Systems Agency (DISA), in coordination with the National Security Agency (NSA) and other Department of Defense (DoD) activities has developed a standard process to minimize the risks associated with non-standard security implementation across shared infrastructures and end systems.

Information Assurance is the means used to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation in accordance with DoD Directive

8500.1 Information Assurance; DoD Instruction 8500.2 Information Assurance Implementation; DoDI 8510.01 DoD Information Assurance Certification and Accreditation Process (DIACAP); the Director of Central Intelligence Directive (DCID) 6/3 and Joint DoD Intelligence Information System (DoDIIS)/Cryptologic Sensitive Compartmented Information Systems Security Standards (JDCSISSS); and National Security Agency (NSA)/Central Security Service Information System Certification and Accreditation Process (NISCAP). The goal of IA is to integrate security directly into the system lifecycle and to apply it uniformly across DoD. The IA documentation package is a living document that captures and maintains security information related to the C&A of a system/application ensuring compliance in accordance with previously stated directives/processes/guides lines.

The IA package captures the topology, configuration, risk assessment, vulnerability assessment, and other pertinent security related information necessary to provide the Designated Approval Authority (DAA) assurance that system security and operational risks have been mitigated. The IA package is reviewed for completeness, accuracy, and compliance. This review comprises a thorough analysis of all IA controls both technical and non-technical associated with the system/application as it relates to Federal, National, DoD, DON and Marine Corps policy and standards.

4.1.3 General Requirements. Within the scope of this effort, the Contractor provides IA documentation planning, preparation and review support, technical expertise support; and general IA process management support to MCICOM to obtain and maintain Authorization to Operate (ATO) for the MCICOM emergency management incident management system application that is proposed.

4.1.4 Information Assurance Controls. The Contractor will provide documentation of compliance with appropriate DoD 8500.2 IA controls associated with the system and information in the tasks under this Requirement. This is necessary to ensure the integrity and independence of the work performed under this contract.

4.1.5 Organizational Conflicts of Interest (OCI). Currently there are no known organizational conflicts of interest associated with this requirement. Non-Disclosure Agreements (NDA) and Confidential Financial Disclosure Reports (OGE Form 450) will be required from all participants involved in the Source Selection process to identify any possible OCI’s. Additionally, all interested parties shall be required to identify any/all OCI’s and provide a mitigation plan as part of their proposal submission. The requiring activity shall be instructed that the Contracting Officer should be informed of any real or potential OCI once it is discovered. In accordance with FAR 9.505-4: “A contractor that gains access to proprietary information of other companies in performing advisory and assistance services for the Government must agree with the other companies to protect their information from unauthorized use of disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished.” The contractor shall furnish copies of these agreements to the contracting officer, who shall confirm that they are properly executed.

4.1.6 Maintain Staff Certifications. The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M Change 1, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including:

• DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

• Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M. Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information and systems for the purpose of performing information assurance functions.

In addition to the DoD 8570.01-M Change 1 requirements, the Contractor will ensure that Contractor personnel assigned to review or support tasks associated with a particular system have sufficient technical knowledge and experience to properly evaluate system compliance or perform required support on the technologies present in the system.

4.1.7 Maintain MCCAST Account. The Contractor is required to obtain and maintain an MCCAST account to support the IA process for the proposed application.

4.1.8 Specific Requirements. Specific requirements and duties for the period of performance are heavily based on DoD IA requirements, Department of Navy (DON) guidelines, and Marine Corps directives. The main effort under this contract is based primarily on the specific tasks and duties identified in the DON DIACAP handbook, version 1, dated 15 July 2008 as well as the specific IA status of the proposed application. The capability to perform all IA specific tasks identified in the DON DIACAP handbook for these systems/applications is critical. However, the scope of this effort will also include general process management support of the overall process.

Process steps listed in Chapter 6 of the DON DIACAP handbook should be used as the basis for the Contractor proposal for the specific requirements. Process management and items described below should be based heavily on the process identified in Chapter 6 of the DON DIACAP handbook.

4.1.9 Certification and Accreditation (C&A). C&A support will be the primary focus of this support contract. The Contractor is expected to have the knowledge and expertise to function as key support throughout the DIACAP process, as described in the DON DIACAP handbook.

The primary area of responsibility under this task is initial DIACAP planning, plan development, and approval of the DIACAP Implementation Plan (DIP). In collaboration with the Contracting Officer’s Representative (COR) , the Contractor will be responsible for the non-inherently governmental tasks identified in section 6.2 of the DON DIACAP Handbook. The contractor shall have the necessary C&A expertise to coordinate and carry out effective DIACAP planning and development and obtain necessary approvals.

4.1.10 Independent Verification and Validation. Independent Verification and Validation will be the secondary focus of the IA process. The Contractor will be responsible for the non-inherently governmental tasks identified in section 6.3 of the DON DIACAP Handbook and the Contractor is expected to develop and maintain the capability to perform requisite test planning activities required to support explicit independent DIACAP verification and validation tasks. Primarily test planning activities will consist of the development of test scenarios, verification of qualifications for assigned evaluators, and scheduling of test events.

The Contractor will review the IA Control (IAC) implementation plan, validation plan, and procedures for MCICOM IS’s, as assigned by the Government. The Contractor will verify the validation plan and procedures are appropriate for the system under review and are comprehensive and complete to ensure that all assigned IACs identified in the system’s DIACAP Implementation Plan (DIP) can be validated as compliant or non-compliant. The Contractor will provide verified procedures and tasks and carry out validation testing. Individual tasks and process steps for these activities are contained in 6.3.1.2 through 6.3.1.2.2 of the DoN DIACAP Handbook.

To complete these tasks the contractor will receive a DIACAP package with required IA controls identified and artifacts containing detailed system information, a DIACAP Implementation Plan (DIP), and a draft validation plan with draft validation procedures prepared by the Program Manager/MCICOM Government Lead. Once validation of the validation plan and procedures are completed, the Contractor will provide a validated test plan and artifacts and proceed with IA testing. The Contractor will carry out test events and ensure proper and complete execution of test activities.

The Contractor shall execute the Test report and recommendation tasks identified in section 6.3.2 of the DON DIACAP handbook. Inputs to this task will be the test results from a test event conducted by an independent evaluator based upon a validated set of test procedures provided by the Contractor as part of the IAC procedure validation task. Outputs of this task will be a residual risk analysis for each IA control assigned to the system that is in a non-compliant status based on the severity of the control impacts and the effectiveness of any mitigations applied. The Contractor will provide the validated DIACAP scorecard as input into the final C&A package as part of this task.

5.0 PREPARATORY PHASE

During this phase the validator shall work with the responsible Project Office(s) IA staff to ensure that an accurate Detailed Test Plan (DTP) is uploaded into the Marine Corps’ MCCAST system for approval. Once the DTP is approved by the DAA, and the associated tasks with this phase are complete, the validation may proceed to the next phase.

• Review C&A package o Create/Modify/Approve DTP

• Assemble IV&V team(s)

• Provide List of Technical Evaluation Tools to the Project Office o Eye Retina (Include software version and signature files) o Security Technical Implementation Guides (STIGS) (include STIG Names and version) o Host Info Scan o Other network discovery tools (as required)

6.0 EXECUTION PHASE

During the execution phase the validation team shall ensure each IA control is verified and validated via one or more of the following methods:

• Interviews with Contract technical staff

• Observation

• Test

7.0 RISK ANALAYSIS PHASE

During the Risk Analysis phase the validation team shall assess the findings and assign an overall risk assessment of Low, Medium, or high. All findings shall be evaluated from a stand-alone risk element and from the overall system view. The following actions at minimum shall be performed:

• Compile findings – o Generate a Compact Disc (CD) or Digital Video Disc (DVD) containing all raw data outputs from the technical reviews conducted and all notes and results from the non-technical reviews contractor. The CD/DVD shall be provided in both a read-only and Microsoft Word format that will allow modifiable excerpts to be pulled of all deliverables; and o Generate a vulnerability assessment report that clearly identifies the known vulnerabilities for each system.

• Assess findings;

• Generate a Residual Risk report that clearly identifies the residual risk associated with the vulnerabilities identified in the vulnerability assessment;

• The residual risk assessments shall define the methodology used to determine the residual risk associated with vulnerabilities discovered;

• Submit findings to the IAM for inclusion in the Plan of Action & Milestone (POA&M);

• This submission shall be in the USMC POA&M format for simplified inclusion into the Project Office’s

POA&M; and

• An overall risk assessment is provided to the Certification Authority Representative (CAR) and Designated

Approving Authority (DAA).

The Contractor shall upload the required documentation into the Marine Corps DIACAP workflow support system, MCCAST, and provide support to answer any questions and correct any issues that the CA or DAA have with the IV&V data produced in support of this PWS.

8.0 PERFORM VERIFICATION AND VALIDATION SUPPORT

The Contractor shall perform each IV&V effort in a phased approach that shall provide simplification, ensure completeness and assure accuracy in the assessment and recommendation process. Each phase of the IV&V shall be performed under the direction of a Certified Marine Corps Validator, as required by MARADMIN 251/10. These phases include:

8.1 Security Engineering Support. The Security Engineering sub-task includes three primary areas of effort.

The first area of effort is to provide technical Subject Matter Expertise (SME). The Security Engineering SME support will be in the nature of specific technical questions or problems being presented to the Contractor with a specific type of response requested. Questions and responses in this area will generally be over specific situations involving the proposed application, yet may also be specific technical questions applicable to the proposed application.

The second area of effort is to provide a technical analysis of impacts or risks associated with specific technologies and IA strategies currently employed with WebEOC. This may include issues related to particular vulnerabilities identified during the C&A process or issues related to proposed technologies or solutions.

The third area of effort is general research and security requirements generation. The Contractor is expected to provide answers to specific technical questions and IA strategies on various IA related topics. The Government will provide research topics and questions relating to particular areas of interest or technology, in various forums. The Contractor will conduct the necessary actions or research to develop the products and answers requested by the Government. Typically, the Government will request the generation of specific output products (i.e., technical memorandum) for a question or topic. Activities in this area will periodically include the development of generic technical requirements, configuration guides, or input into policy documents on specific IA related technology issues.

8.2 Operations Support. The Contractor will provide IA Operations Support, to include general administration support and process management support. The scope of this sub-task will include all tasks and activities required to enable efficient operations of the overall IA process, as identified in the DON DIACAP handbook. Specific responsibilities include tracking of the IA program, DIACAP process status, check-in/out of work products between process steps, process improvement activities, process documentation updates, and generation of process metric reports for the MCICOM IA system. Operations support will include the prioritization of Contractor efforts to meet identified Government needs, and to ensure the Government retains visibility of overall efforts and commitments.

The Contractor will identify a single point of contact within the Contractor organization for process management and tracking responsibilities.

The Contractor will ensure status updates on tasks related to process steps contained in the DON DIACAP handbook are entered into the online information system identified by the Government as the current repository for program status and process tracking. Status updates, appropriate reviewer/analyst comments, summaries of communications, or notes should be entered into the identified system in a timely manner. Significant events or process step changes for the application must be updated at least on a regular basis.

8.3 Subject Matter Expert Representation. During the period of performance, the Government may request the Contractor to provide Subject Matter Expert (SME) representation at various program and project meetings, training events, or other forums. The scope of the SME representation will be within the overall scope of technical expertise expected of the Contractor to perform the functions listed in this document. The Contractor will provide a meeting report detailing all pertinent information resulting from participation in any event while representing MCICOM.

While not a primary function of overall effort, SME support provides an important and valuable resource. Upon request for SME support, the contractor should be able to provide an impact assessment to other tasks in order to allow appropriate prioritization of effort and determination of value to the Government for Contractor effort applied to the overall requirements in existence at the time of the SME request. Effort for SME representation will typically be drawn from effort assigned to other task items, but the Contractor should identify to the Government the impact on other activities for providing requested SME representation.

8.4 Management & Administration. The Contractor is responsible for management of IA program priorities, scheduling, coordination of SME participation, and overall quality of products. The Contractor is responsible for providing necessary IA expertise to support identified priorities, executing a suitable performance schedule, identifying and coordinating deliverables, and ensuring the quality of draft and final products. This includes coordinating with other support contractors to execute IA program goals and establishing necessary interface processes to ensure performance consistent with the provisions of the Performance Requirements Summary (PRS).

The Contractor is responsible for establishing a suitable performance schedule based on Government customer requirement, identifying and coordinating deliverables associated with their analytical approach, ensuring the quality of draft and final products and maintaining a viable resource pool (e.g., qualified staff). Additionally, the Contractor shall develop a formal process for reporting performance (e.g., memoranda, reports, supporting documentation, invoicing procedures, etc.), ensuring progress and execution of task actions from Government customers in accordance with quality assurance provisions. Specific responsibilities between the Government and Contractor, as well as a final schedule of activities and deliverables shall be coordinated within ten (10) days of task order award, reviewed quarterly, and modified only through bilateral agreement.

Monthly status reports will be provided to the COR. Status reports shall include the status of projects currently in work and pending actions. Status reports shall include metrics to allow the Government to determine relative effort applied to each program. The intent of the reported metrics is to allow the Government to detect and address any prioritization of effort issues and available resources. Proposals should include methods for developing and reporting useful activity metrics in support of these goals.

8.5 Facility, Travel and ODC Requirements. This task order will require the Contractor to provide MCICOM a suitable infrastructure to manage, test, and validate program requirements (unclassified document library, database, etc.) throughout the course of performance to support the scope of activities. The Contractor shall ensure that any sensitive information stored at Contractor facility is protected in compliance with DoD policy and security best practices. The Contractor shall conduct internal vulnerability testing to ensure sensitive information housed, or stored at the Contractor facility is in compliance to DoD policy and standard security best practices. The Government expects items not meeting security policy and best practices will be mitigated in an expeditious manner.

The Government expects computers, cellular phones, and other elements of work equipment to be included in GSA rates. All Government printing requirements MUST be done by or through the local Document Automation and Production Service (DAPS, now called DLA Document Services) http://www.daps.dla.mil/dapsonline.html. Travel will be reimbursed in accordance with Joint Travel Regulations (JTR).

8.6 Security Requirements. The Contractor shall ensure appropriate physical and electronic security measures are in place to ensure individuals not specifically assigned duties under this contract do not have access to test reports, data, recommendations, or any other products, information, or working papers produced under this task.

The Contractor is required to provide personnel with adjudicated security clearances commensurate with the level of access for any systems under review or test. All personnel performing IA tasks under this contract must be US citizens. Foreign Nationals shall not be allowed or provided access to any documents, test reports or materials, regardless of the security classification of the material. All personnel performing tasks under this contract must be eligible for, and obtain and maintain, a DoD Common Access Card and associated DoD PKI certificates for identity verification and encryption of transmitted correspondence. Systems reviewed under the scope of this contract are classified below SECRET.

8.7 Web-based System Access.

The Contractor shall provide a web-based capability that provides emergency management incident coordination and allows users immediate access to important incident details and resource information that can be used and shared among key decision makers, DoD and civilian, for every day events and in times of crisis.

http://www.daps.dla.mil/dapsonline.html

8.8 Information Sharing.

The Contractor’s application shall provide near real-time send and receive exchange of emergency incident information among Marine Corps emergency management command sites and local, state and federal emergency management partners, including the following views:

• Map View of Incident

• Operational activity view

Additionally the application shall provide access to key decision making information including but not limited to;

weather, internal GIS data layers, and satellite imagery. The application shall enable interoperability with all existing emergency management partners.

The Contractor shall install, configure, and provision a minimum of six interoperability links per Marine Corps node with external links to Government identified incident management application(s). The Government shall identify the specific sites to be linked at the Post Award Conference. Training, for about 25 Federal employees, shall be provided by the contractor to enable end users to establish direct system interoperability between intra and interagency partners including local, state and federal emergency management organizations. Training sessions are estimated to be a minimum of about 35 hours long at each location.

8.9 Disaster Recovery.

The Contractor shall provide an application with the capability of providing maximum information redundancy to allow emergency management functions to relocate and reconstitute when necessary.

8.10 Mapping Capability.

The Contractor shall provide an application with an interactive mapping capability to provide situational awareness and incident information in a visual display. The application shall have the ability to display both imagery (raster) data and feature (vector) data in industry standard GIS formats. The mapping capability must be able to leverage and display existing Marine Corps authoritative installation geospatial data, which is stored and managed on an ESRI platform using ESRI standard data formats. The application shall include, but not be limited to, the following capabilities among its features: standard navigational and annotation tools; drawing and measuring tools; the ability to add or remove geospatial data to and from the display as needed; and the ability to save and print maps from the display. The application shall also have the ability to consume external GIS data layers and mapping data including web map services from a variety of local, state, and federal, and commercial sources.

8.11 Maintenance and Training.

The Contractor shall provide an application with extremely high reliability. Normal maintenance and technical issues shall support turn-around time and restoration of service within two hours of a reported maintenance occurrence. Details of technical support availability and any times when technical support may not be available shall be provided along with warranty information with the proposed application and shall be reported in the Monthly Status Reports (MSR).

8.11.1 Maintenance Plan.

The software maintenance concept developed by the Contractor shall be documented in a Maintenance Plan, and shall include plans for upgrades or technology insertion over a nominal 5-year life cycle. The Maintenance Plan should also include provisions for maintaining the receipt of geospatial data and other data links as required including provisions for meeting Marine Corps/USG needs associated with licensing and/or use of required software. Continuity of Operations Planning (COOP) is the responsibility of the Government.

However, the Contractor shall support and advise the Government regarding configuration management and COOP efforts for EMIMS including the software and data in Government’s test and production environment.

8.11.2 Help Desk Support.

The Contractor shall provide help desk support. This includes gathering the user’s information and determining the issue by analyzing the symptoms of the problem and providing technical guidance and issue resolution.

8.11.2.1 Essential Contractor Services: Help Desk Support under this PWS is considered essential services in accordance with DFARS provision 252.237-7024 and as defined in DFARS Subsection 237.7601 and DFARS clause 252.237-7023. The contractor shall provide a written Mission-Essential Contractor Services Plan that will be incorporated into this contract. This plan must include the following:

(a) At a minimum provide all information required, as detailed in DFARS provision 252.237-7024; and

(b) Provide for continuous service during the contingency period of performance, with a break in services when migrating over to, and during the contingency period.

This will be included as an attachment to Volume I – Technical Volume.

8.11.3 Provide User Training.

The Contractor shall provide user training to the system end users, about 25 Federal employees, at the fielding sites. Training sessions are estimated to be a minimum of about 35 hours long at each location. Training shall include updating current material and providing instruction for the use of the system. The Contractor is expected to recommend, maintain, and update the on-line training. On-line training may include Frequently Asked Questions (FAQ), User Manuals, Web Based Training, Handouts, Power Point Presentations, etc. The Contractor shall update and maintain as necessary the training documents, incorporating USMC-unique training materials, update/maintain web based training products and vendor provided training into a cohesive program.

The training program shall be identified as a Deliverable and shall be provided by the Contractor in a Microsoft Word format (CD or DVD).

8.11.4 Security Technical Implementation Guidelines (STIG) Compliance and Testing.

The Contractor shall ensure that EMIMS is in compliance with current Navy and Marine Corps policy. The Contractor shall assist the Project Officer in the completion of the testing for EMIMS for STIG requirements.

8.12 Program Management.

The Contractor shall establish and maintain program management practices throughout the period of performance.

The Contractor shall establish strict program control processes to ensure mitigation of risks, minimal schedule variances, and adherence to budget. Program management practices shall provide visibility into the Contractors’ organization and techniques used in managing the program, specifically data management and Personally Identifiable Information (PII) security. Documentation shall be readily available to the COR during planned visits.

8.12.1 Project Management Communication.

The Government anticipates emergent issues to arise during the course of system operations. Emergent issues encompass immediate impact(s) to system supportability, maintainability, and/or usability. These issues shall be brought to the immediate attention of the COR. The Contractor Project Manager (PM) and/or designated team member shall be responsible for communicating emergent system issues via telephone and email within twenty-four (24) hours of issue(s) discovery. Communication shall include issue(s) scope, impact, and recommended resolution. The PM and/or designated team member shall keep the COR apprised of all action(s) taken to resolve each emergent issue and provide notification once an issue has been resolved. Emergent issue(s) shall be reported in the Monthly Status Reports (MSR).

8.12.2 Meetings, Formal Reviews, Conferences, and Audits

8.12.2.1 Contractor Responsibilities

The Contractor shall plan, host, attend, coordinate, support and conduct the meetings, formal reviews, conferences, and audits (hereinafter called "reviews"). The reviews shall be conducted at Government and Contractor facilities. Reviews requiring demonstration and/or examination of equipment shall be conducted at the Contractor's facility. All such reviews shall be included in the program schedule and may be held concurrently with the Government’s approval. The Government reserves the right to cancel any review or to require any review to be scheduled at critical points during the period of performance. Action item documentation, assignment of responsibility for completion and due dates shall be determined prior to adjournment of all reviews. A summary of all action items, responsible parties, and estimated completion dates shall be included with the minutes.

8.12.2.2 Post award Conference

The Contractor shall attend a Post award Conference within thirty (30) calendar days after contract award.

The Contractor should present management, key personnel, and a program implementation process update.

8.12.2.3 In-Process Review

In Process Reviews (IPRs) will be held on a monthly or as needed basis, at a date and location mutually agreed upon. The Government reserves the right to cancel any review or to require any review to be scheduled during the period of performance. The Contractor’s progress, management, technical support services (if any), integrated logistics support, administrative, assurance of compliance with contract requirements, program status, funding, problem identification and resolutions shall be agenda items.

Actual performance versus expected performance of each area shall be addressed. The Contractor shall be responsible for recording the actions taken during IPRs in the form of minutes, which shall be delivered within five (5) working days of each IPR.

8.13 Informal Communication

The Contractor shall provide informal communication capability such as chat and twitter.

8.14 Updates and Alerting

The Contractor shall provide update and alert subscription capability for identified emergency management personnel.

8.15 Contact Tracking

The Contractor shall provide personnel contact information tracking and updating capability.

8.16 File Sharing

The Contractor shall provide document and file sharing capability.

8.17 System Fielding Plan of Action and Milestones

The contractor shall provide in response to the request for proposal (RFP) a detailed fielding plan of action identifying milestones that will allow the deliverables identified above in 3.1 – 3.12 to be fielded within 6 months of contract award.