NAMA-17-R-0001_ICN_-_HH_CSS_Attachments_1-12.docx

ATTACHMENT 1

SCHEDULE OF PRICES

1. SERVICES TO BE FURNISHED

(a) The purpose of this contract is to acquire initial configuration, migration, implementation, hosting, and operations and maintenance support of a Software-as-a-Service (SaaS) solution for the National Archives and Records Administration (NARA)’s Internal Collaboration Network (ICN) and History Hub (HH). All work must be performed in accordance with the terms and conditions of this contract.

(b) Firm-Fixed Price (FFP). The Contractor is required to furnish all the work that can be identified in advance, both in sufficient detail, and for which a fair and reasonable price can be obtained. The FFP must include the fully burdened cost for delivering the services required by this contract. All work in Attachment 2, Performance Work Statement (PWS) is considered firm-fixed price work, except for the: Base Year, SaaS -- License Term Subscriptions (ICN and HH); Base Year, SaaS -- Hosting and Operations and Maintenance (ICN and HH); Base Year, Ideation Module, ICN; Base Year, SaaS – License Term Subscription HH, Next Tier – 1,000,000 page views/users per month; and Additional Services.

(c) Base Year, SaaS -- License Term Subscriptions (ICN and HH). The Base Year, SaaS Term License Subscriptions shall only begin upon successful completion and Government acceptance of the work necessary to deploy these systems to production.

(d) Base Year, SaaS -- Hosting and Operations and Maintenance (ICN and HH), if separately priced. The Base Year SaaS -- Hosting and Operations and Maintenance shall only begin upon successful completion and Government acceptance of the work necessary to deploy these systems to production.

(e) Base Year, Ideation Module for ICN, shall only begin upon successful completion and Government acceptance of the work necessary to deploy these systems to production.

(f) Base Year, License Term Production Instance, History Hub Next Tier – 1,000,000 page views/users per month, shall only be applicable upon successful completion and Government acceptance of the work necessary to deploy History Hub to production.

(g) Additional Services with Fixed Hourly Rates. Throughout the term of this contract, Additional Services shall be provided on an as needed, firm-fixed price basis, as ordered in accordance with the PWS. The not-to-exceed (NTE) amount listed is the maximum amount the Government has reserved in the performance period, for Additional Services. The government does not guarantee that any Additional Services will be ordered throughout the term of this contract and the Contractor shall not provide services which would exceed the obligated NTE amount. If the Contractor provides services in excess of the obligated NTE amount, within the performance period, it does so, exclusively, at its own risk and cost.

2. PRICING OF BASE YEAR

(a) Fixed Price Services.

(i) The Contractor must identify the base year “Unit Price” and “Total Price” for the services described in paragraph 4, Schedule of Prices.

(A) The “Unit Price” for CLINs 0001, 0002, 0003, 0005, 0006, 0007, and, if applicable, 0017 must be the Contractor’s total fixed “Lot” price for the services identified.

(b) Total Base Year Price. The “Total Base Year Price” is the sum of the “Total Price” of each separately priced CLIN, the not-to-exceed amount for Additional Services, and, if applicable, the total of the contractor’s proposed Other Direct Costs (ODCs).

3. PRICING OF OPTION YEARS

(a) Option years will be priced using the procedure for pricing the contract base year for each separately priced CLIN. The “Total Price” must be the identified “Quantity” multiplied by the “Unit Price”.

(b) Total Option Year Price. The “Total Option Year Price” for each Option Year is the sum of the “Total Price” of each separately priced CLIN, the not-to-exceed amount for Additional Services, and, if applicable, the total of the contractor’s proposed ODCs.

4. SCHEDULE OF PRICES

(a) In accordance with this contract, the Contractor must provide all management, support, and services described herein (except as specified to be furnished by the Government in the PWS), and must plan, schedule, coordinate, and ensure effective performance.

(b) For CLINs 0001, 0002, 0003, 0005, 0006, 0007, 0025, 0026, 0027, 0041, 0042, 0043, 0057, 0058, 0059, 0073, 0074, and 0075 insert the fixed unit prices proposed per “Lot”. For evaluation purposes, the total price for each of these CLINs will be determined by multiplying the “Quantity” by the “Unit Price”. The Contractor must provide a detailed breakout of the price associated with these CLINs which includes the labor categories, mix, fully burdened hourly rates, level of effort, and materials as applicable. The Contractor must use table j(1) “Composite Hourly Rate Table” for any and all labor associated with these CLINs.

(c) For CLIN 0009, insert fixed unit prices proposed per “Each” participant for training. For evaluation purposes, the “Total Price” is the “Unit Price” multiplied by the “Quantity”.

(d) For CLINs 0004, 0008, 0010, 0011, 0021, 0022, 0024, 0031, 0037, 0038, 0040, 0047, 0053, 0054, 0056, 0063, 0069, 0070, 0072, and 0079 insert fixed unit prices per “Month” for these services. For evaluation purposes, the “Total Price” is the “Unit Price” multiplied by the “Quantity”. The “Unit Price” is the price per user, per month, multiplied by the number of users in the CLIN. The contractor must provide the price per user per month.

(e) For CLINs 0012, 0013, 0015, 0023, 0028, 0030, 0039, 0044, 0046, 0055, 0060, 0062, 0071, 0076, and 0078 insert fixed unit prices per “Month”: for these services. For evaluation purposes, the “Total Price” is the “Unit Price” multiplied by the “Quantity”. The Contractor must provide a detailed breakout of the price associated with these CLINs, if applicable, which includes the labor categories, mix, fully burdened hourly rates, level of effort, and materials, as needed. The Contractor must use table (j)1 “Composite Hourly Rate Table” for any and all labor associated with these CLINs, if they are priced based on direct labor.

(f) For CLINs 0014, 0029, 0045, 0061, and 0077 the contractor must complete pricing lines contained within each CLIN “Description”, the Contractor may, as applicable, include any “Overage Fees” whether priced as a percentage or dollar amount to the “Price Difference (from 250,000 page views/users per month)” which, is the “Full Price Per Month” (see table k(1)) subtracted by the “Unit Price” per “Month” for the following CLINs, within the respective period of performance, 0014, 0029, 0045, 0061, and 0077, this dollar amount is the “Unit Price” the Contractor shall use. If the Contractor includes an “Overage Fee” it must show its calculation. The “Total Price” is the “Unit Price” multiplied by the “Quantity”. Additionally, the Contractor must complete table k(1) which, will be the applicable “Unit Price” per “Month” which, will become applicable should NARA exercise its option to increase History Hub page views/user per month up to the next tier of 1,000,000. The Contractor SHALL NOT apply any “Overage Fees” whether priced as a percentage or dollar amount to the “Full Price Per Month” in the price quoted in table k(1). The pricing included in this table shall be incorporated into the contract and apply when and if NARA exercises its option to increase the page views to this tier.

(g) NARA has included not-to-exceed amounts in CLINs 0016, 0032, 0048, 0064, and 0080. For evaluation purposes, the “Total Price” for these CLINs is the total not-to-exceed amount. The Contractor must submit all available labor categories, descriptions, and fully burdened, fixed hourly rates, for the personnel available under these CLINs utilizing Table (j)1, Composite Hourly Rate Table.

(h) For CLINs 0017, 0034, 0050, 0066, and 0082 the total “Lot” price is the “Unit Price”. For evaluation purposes, the total price for each of these CLINs will be determined by multiplying the “Quantity” by the “Unit Price”. See Attachment 1, “NOTE” below concerning ODCs.

NOTE: The Contactor must separately identify and explain known ODCs (e.g. subcontract, applicable material, parts, etc.), if applicable, for all separately priced CLINs. The Government reserves the right to not pay for ODCs which, are not clearly identified and explained in the Contractor’s proposal. The Government does not guarantee that ODCs will be included in the resulting contract.

(i) The “Total Price” for each performance year will be determined by adding the individual CLIN prices for each year. The “Total Contract Price” will be determined by summing the yearly “Total Prices.”

(j) Composite Hourly Rate Pricing Table

The following table is for pricing all direct labor associated with the services required herein, including additional services [the Contractor may add as many rows to this table as necessary]:

TABLE (j)1

COMPOSITE HOURLY RATE

(Labor Category, Description)

(k) History Hub, Net Tier (1,000,000 page view per month). Full Price Per Month

TABLE (k)1

CLIN = Contract Line Item Number; IAW = In Accordance With; MAX = Maximum; Mo. = Month; NSP = Not Separately Priced; NTE = Not-to-Exceed; PWS = Performance Work Statement; and QTY = Quantity.

Base Year: Months 1-12

MAX

MAX

MAX

MAX

Price Difference (from 250,000 page views/users per month) Per Month: $______

(OPTIONAL ITEM)

MAX

MAX

NTE

Option Year I: Months 13-24

MAX

Price Difference (from 250,000 page views/users per month) Per Month: $______

(OPTIONAL ITEM)

MAX

MAX

NTE

Option Year II: Months 25 - 36

MAX

Price Difference (from 250,000 page views/users per month) Per Month: $______

(OPTIONAL ITEM)

MAX

MAX

MAX

NTE

Option Year III: Months 37 - 48

MAX

Price Difference (from 250,000 page views/users per month) Per Month: $______

(OPTIONAL ITEM)

MAX

MAX

MAX

NTE

Option Year IV: Months 49 - 60

MAX

Price Difference (from 250,000 page views/users per month) Per Month: $______

(OPTIONAL ITEM)

MAX

MAX

MAX

NTE

ATTACHMENT 2

PERFORMANCE WORK STATEMENT

INTERNAL COLLABORATION NETWORK AND HISTORY HUB

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) serves American democracy by safeguarding and preserving the records of our Government, ensuring that people can discover, use, and learn from this documentary heritage. NARA ensures ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience. The agency meets thousands of information needs daily, ensuring access to records on which the entitlements of citizens, the credibility of government, and the accuracy of history depend.

1.2 In order to further its mission, NARA is seeking a cost effective, flexible, and adaptable system to address the needs for NARA employees that are dispersed throughout the nation to exchange information and share knowledge through the use of a cloud hosted, Internal Collaboration Network (ICN) platform. The current iteration of the ICN was implemented using Jive Software, Inc. (Jive) SBS Internal Edition and is hosted, externally, through the Department of Commerce, National Technical Information Service (DOC-NTIS). Through its use, the ICN allows NARA to preserve and capture the expertise of its long-serving staff; create a centralized location where information is searchable and accessible; and, most importantly, it builds a network amongst staff who serve as subject matter experts throughout the agency. The ICN has enabled NARA employees to collaborate in a way that provides tangible benefits to the agency, while facilitating achievement of agency objectives since 2012.

1.3 Additionally, in 2015, NARA implemented an external collaboration network pilot entitled, History Hub (HH), to serve as a platform for NARA staff and public researchers who register accounts to create and share content. The content consists of user groups, profiles, discussion forums, tagging, blogs, collaborative documents, file-sharing, polls, and announcements. This content is publicly viewable via the web to non-account holding users. HH is currently hosted within Jive’s environment and it is based on Jive-x SBS version 8.0.2.0.

2.0 SCOPE

2.1 NARA has a requirement of its internal and external collaboration systems: ICN and HH to continue services to internal and external customers. Accordingly, NARA requires the Contractor to furnish a Commercial Off-the-Shelf (COTS), Software-as-a-Service (SaaS), for NARA’s internal and external collaboration networks. The internal collaboration network is to provide a government-sponsored platform for crowdsourcing information, in a restricted, internal network. The external collaboration network (HH) is to provide a government-sponsored platform for crowdsourcing information that would allow public researchers and interested individuals to engage with internal subject matter experts.

2.2 The goal of the ICN is to allow NARA staff to communicate with each other to share knowledge, in a private system. The goal of the HH is to allow NARA and other institutions to connect to the public and allow the public to communicate more effectively with subject matter experts. The ICN internal solution should be able to integrate with the external facing HH to allow the collaboration networks to work together. This feature is not currently needed, but may be required at a future date.

2.3 The Contractor shall migrate data from the existing instances of ICN and HH to the Cloud Service Provider (CSP)’s COTS SaaS environment. The Contractor shall provide, configure, and host the external and internal collaboration solution and provide all support for the SaaS hosted solutions for the duration of this contract. The Contractor shall implement a COTS solutions with little or no customization, except as described in this Performance Work Statement (PWS), which provides, the following, general, functional features:

2.3.1 Profiles - provide the capability for authorized users to add, change, and delete user profiles and related information including: the capability to upload and display profile images (e.g., head shots), collect contact information, relationship information including selecting organizations, working groups, and business functions, establish contacts (e.g., friends), and connections between users to establish a hierarchy (e.g., who reports to whom).

2.3.2 Groups - allow users to setup and have the capability to be either: a) open to all, b) open only by invitation, or c) completely private, with the capability of full functionality, open only by invitation, and not searchable. All groups shall have the following features: calendars, blogs, and document collaboration capability.

2.3.3 In addition to the stakeholder requirements, which are located in PWS Appendix 3, Stakeholder Requirements Specification (StRS) (ICN) and PWS Appendix 4, StRS (HH), the Contractor shall configure the internal collaboration network and History Hub to comply with the technical requirements.

2.4 Constraints. The following constraints pertain to the contents of this document in general and to the requirements specifically:

2.4.1 The ICN and HH must be implemented as a Commercial-Off-The-Shelf (COTS) Software-as-a-Service (SaaS) solution with no hardware required at NARA locations;

2.4.2 The current ICN uses Jive SBS Internal Edition and is hosted by NTIS, the database is Oracle database. The HH was built on Jive-x SBS version 8.0.2.0 and is hosted by Jive in its hosting environment;

2.4.3 Both HH and ICN must be internet accessible and shall not require additional networking or other infrastructure changes to provide access, except as necessary to comply with security requirements; and

2.4.4 Data from the existing ICN and HH must be migrated to the new ICN and HH system and each system must be live, in production, by no later than September 11, 2017.

2.5 HH is considered an “Optional Item”. If NARA exercises this “Optional Item” at time of award, then the deadline for system setup, configuration, integration, data migration, and deployment of HH shall be as stated in Attachment 2, Performance Work Statement (PWS) paragraph 2.4.4. Alternatively, if NARA exercises its option for HH in Option Years I, II, III, or IV:

2.5.1 The Contractor shall deploy the full HH within 210 calendar days from the date of option exercise to complete the tasks necessary to take HH to full deployment;

2.5.2 The specific deliverable dates, during Option Years I, II, III, or IV shall be based upon and reflect the timelines in PWS paragraph 10.1, Pre-System Deployment Deliverables List; and

2.5.3 The “date of award” must be the effective date of the modification exercising NARA’s option to require the deployment of HH.

2.6 Place of Performance. All services required herein shall be performed at the Contractor’s facilities. Meetings, briefings, and presentations shall, to the maximum extent practicable, be held via teleconference or webinar (via either contractor furnished or NARA furnished telecommunications services). Travel costs will not be reimbursed under this contract.

2.7 For the duration of this contract, normal hours of operation at NARA are between the hours of 7:00 AM ET and 5:00 PM ET Monday through Friday, 52 weeks a year excluding Federal holidays.

2.7.1 Federal holidays observed by NARA

2.7.2 In addition to the holidays listed above, any day specifically declared by the President of the United States as a holiday, will be considered a Federal holiday.

2.7.3 When a holiday falls on a Sunday, the following Monday shall be observed as the Federal holiday. When a holiday falls on a Saturday, the preceding Friday shall be observed as the Federal holiday.

3.0 REQUIREMENTS

3.1 NARA has identified and established baseline requirements. These requirements are defined in the PWS Appendix 3, StRS (ICN) and PWS Appendix 4, StRS (HH).

3.1.1 The solution shall provide, at a minimum, the capabilities in PWS Appendix 3, StRS (ICN) and PWS Appendix 4, StRS (HH) listed with requirement priority “MUST”.

3.1.2 The solution may provide capabilities listed in PWS Appendix 3, StRS (ICN) and PWS Appendix 4, StRS (HH) listed with requirement priority “SHOULD”.

3.1.3 Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked).

3.1.3.1 Technical Standards:

☒ 1194.21 – Software Applications and Operating Systems ☒ 1194.22 – Web Based Intranet and Internet Information and Applications ☐ 1194.23 – Telecommunications Products ☒ 1194.24 – Video and Multimedia Products ☐ 1194.25 – Self-Contained, Closed Products ☐ 1194.26 – Desktop and Portable Computers ☒ 1194.41 – Information, Documentation and Support

3.1.3.2 Functional Performance Criteria are the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

☒ 1194.31 – Functional Performance Criteria

3.1.3.3 The Contractor shall keep its GPATs or VPATs updated to reflect any modifications that have changed the 508 compliance status of the product – whether enhanced or diminished (if diminished, the GPAT(s) or VPAT(s) must include the Contractor’s mitigation plan).

3.1.3.4 All Electronic and Information Technology components are subject to Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998 and are subject to the associated Section 508 Standards as set forth by the U.S. Access Board. http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards.

4.0 PROJECT MANAGEMENT

4.1 Kickoff Meeting. The Contractor shall lead a Kickoff Meeting with the Government Program Manager, Project Manager, the Contracting Officer’s Representative (COR) and Contracting Officer (CO), within five (5) business days after the award date of the contract to prepare NARA and the Contractor for the work described in this PWS.

4.2 Requirements discussion. The Contractor shall meet with the COR and NARA stakeholders to review the requirements and to obtain clarification only, prior to system configuration. Changes to the requirements must be submitted to the COR. Any derivation of or changes to the requirements that result in updating or adding to the prescribed scope baseline will be a) controlled by the NARA Requirements Team; b) updated according to NARA’s change management process; and c) shall only be finalized through a bilateral contract modification, executed by a warranted NARA Contracting Officer.

4.3 Project Management Plan (PMP). The PMP shall include reference to all tasks listed in this PWS, as well as, draft and final deliverables enumerated in PWS paragraph 10.0, Deliverables. The PMP is required for the deployment phase for each system. The Contractor shall, after the kickoff meeting, provide a PMP that includes at a minimum:

4.3.1 Description of technical approach;

4.3.2 Organizational Resources;

4.3.3 Tasks and deliverables under this PWS, with due dates;

4.3.4 Contractor assignments (resource);

4.3.5 Milestone schedule that shows dependencies and critical path, as applicable; and

4.3.6 Management Controls to meet the cost, and schedule requirements throughout project execution

4.4 Monthly Status Report. The Contractor must provide a Monthly Status Report during deployment until all system functionality has been deployed and accepted by NARA. The Monthly Status Report must describe work accomplished for each calendar month, work planned, the status of work, and significant problems, risks or issues encountered or anticipated. Where applicable, the Contractor shall identify a solution for any unresolved problems or issues. The status report shall be provided to the COR the last business day of each month. An updated project schedule shall be provided with each Monthly Status Report.

4.5 Weekly Status Updates. During the implementation period, the Contractor shall meet weekly with the NARA Project Manager, the COR, and the Project Team to provide status on the progress of work and to discuss any significant problems, risks or issues encountered or anticipated.

4.6 Progress Briefings. Progress briefings shall be provided as requested by the COR.

4.7 Project Schedule. The Project Schedule shall provide all tasks and deliverables required to successfully complete each requirement under this PWS. The schedule shall also include planned start and end dates, task dependencies, and assigned resources. The project schedule shall be developed in Microsoft Project. An updated project schedule with completion status, milestones, critical path and actual start and finish dates shall be provided with each Monthly Status Report.

4.8 Release Roadmap. The release roadmap shall provide a schedule for requirements not met at initial release. The release roadmap dictates the schedule for customer acceptance testing for all requirements not met at initial deployment. Customer acceptance testing will begin at the date of release and will conclude within 10 business days of release.

4.9 Risk Management

4.9.1 Risk Management Plan. The Risk Management Plan documents the Contractor’s approach to managing risk for the project; to include, at a minimum risk management planning, identification, analysis, response planning, and controlling risks on a project. The plan must also define the roles and responsibilities for each team member for leading and supporting each type of activity as described in the plan.

4.9.2 Risk Register. The risk register must be delivered and updated as needed. The Risk Register documents and tracks all risks as identified for the project as a result of the risk identification, analysis, and response planning activities.

4.10 System Development Life Cycle (SDLC). All Project Management activities performed by the Contractor shall be in accordance with NARA’s System Development Life Cycle.

5.0 SYSTEM SETUP, CONFIGRUATION, INTEGRATION, AND DEPLOYMENT

5.1 Solution Deployment

5.1.1 The system shall be deployed for use no later than September 11, 2017. Initial deployment must include data migration, user account load with account role configuration, availability of the system to all users, Single Sign On (SSO) through NARA’s network (NARAnet) using SecureAuth which is a Secure Lightweight Directory Access Protocol (LDAPS) integration for all ICN users ONLY. For HH Application Administrators the system must have two (2) factor authentication enabled for those roles. The systems shall not go to production until granted Authorization to Operate (ATO) by NARA (see Attachment 2, PWS paragraph 6.0, Security).

5.1.2 The system shall meet all “MUST” requirements listed in Appendix 3, StRS (ICN) and Appendix 4, StRS (HH) within 120 calendar days of initial deployment. Acceptance testing for requirements releases will be conducted in accordance with the Release Roadmap provided in PWS paragraph 4.8, Release Roadmap.

5.1.3 Deployment Plan. The Contractor shall provide a Deployment Plan to document its approach for deploying the ICN and HH (when ordered). This plan shall provide details for data migration; system setup; configuration; and integration, as applicable. The Deployment Plan shall also identify all activities, resources, and timelines to execute deployment of the system.

5.2 Data Migration

5.2.1 The Contractor shall migrate all data from the legacy ICN (approximately 155 GB) and HH (approximately 15 GB) systems into the new system, without corruption or loss.

5.2.1.1 The Contractor shall notify the COR of areas where legacy data will need reconfiguration, such as combined field assignments, areas where inter-module links may not be retained, any data truncation, corruption, or loss is likely, and/or what follow-up manual data entry or clean-up will be needed.

5.2.1.2 The Contractor must work with the COR and other NARA personnel to resolve data migration issues to ensure data can be saved into an appropriate field that maintains the intent of the original record.

5.2.1.3 The Contractor shall be responsible for full documentation of conversion.

5.2.2 Data Migration Plan. The Contractor shall provide a Data Migration Plan to document its approach for preparing data, migrating, and verifying migrated data.

5.2.3 Data Mapping Document. The Contractor shall provide a Data Mapping Document that shows the mapping of data (elements, fields) from the legacy ICN and HH physical implementation (schema, tables) to the new system. NARA will work with the Contractor to validate a cross-map and to adjust the cross-map to each system’s specific data as needed prior to each conversion.

5.3 Configuration. The Configuration Management Database (CMDB) is a reference document that describes the solution’s hardware and software for the production systems. The information requested includes such items as Hardware: Name/Hostname, Platform, Storage Allocation (GB), IP Address (if any); and Software: Antivirus Software Installed, Windows Server Version, and Operating System. The Contractor shall provide a baseline configuration for each system within five (5) business days after each system is in production, using the Government furnished template. The Contractor must update the CMDB, as needed, when there are updates to the systems.

5.4 Training

5.4.1 Currently, 10 individuals within NARA’s staff have and must continue to have, Application Administrator role based access to maintain user accounts and to provide other general administration of the system and content. Prior to system deployment to production, the Contractor shall provide training for up to 10 Application Administrators, for both ICN and HH. The Contractor furnished training shall instruct Application Administrators how to perform administration tasks at all operational levels.

5.4.2 Application Administrator Training Manual. The Contractor shall furnish its online Application Administrator Training Manual and any related materials that document the ICN and HH’s full functionality to help Application Administrators understand the ICN and HH features and capabilities. The Contractor shall also furnish an electronic copy to the COR.

5.4.3 NARA will provide the Contractor with two (2) weeks advance notice for scheduling and performance of the training. The instructor-led training must take place via webinar.

6.0 SECURITY

6.1 The system shall process data that has the following FIPS 199 rating and protection requirements:

6.1.1 ICN. Confidentiality=Moderate; Integrity=Moderate; and Availability=Moderate; Overall rating=Moderate.

and

6.1.2 HH. Confidentiality=Low; Integrity=Low, and Availability=Moderate; Overall rating=Moderate.

6.2 The cloud service provider (CSP) for the SaaS shall comply with NARA Directive 804, Information Technology Systems Security as well as, the cloud hosting requirements as defined in Attachment 8, FedRAMP Terms and Conditions for Hosted Solutions and Cloud Computing Services. At a minimum, the systems shall be hosted on an Infrastructure-as-a-Service (IaaS) which is FedRAMP in process (see https://marketplace.fedramp.gov).

6.2.1 For those security controls not provided through CSP service offering, the system shall implement NARA’s minimum baseline security controls as delineated in Appendix 2, NARA IT Security Requirements, v6.5 for a system with the FIPS 199 ratings identified in PWS paragraph 6.1.

6.2.2 The system shall encrypt all data at rest for the ICN, in accordance with FIPS 140-2, Security requirements for Cryptographic Modules.

6.3 Multi-factor Authentication and Single Sign-on (SSO). The Contractor shall work with NARA staff and internal Contractors as directed by the COR to provide internal users seamless access to the ICN with their NARAnet credentials using SecureAuth, which is based on Security Assertion Markup Language (SAML) and Secure Lightweight Directory Access Protocol (LDAPS) to enable Single Sign On (SSO). For HH, Application Administrators must have two (2) factor authentication enabled for access to the system. The Contractor must work with NARA and its contractors as directed by the COR to make any necessary changes to the ICN, HH, and SecureAuth to perform two-factor and single sign-on authentication for users. The systems shall be Personal Identity Verification (PIV)-enabled by accepting Homeland Security Presidential Directive (HSPD)-12 PIV credentials as a method of identity verification and authentication.

6.4 All web servers associated with the system must enforce the use of Hypertext Transfer Protocol Secure (HTTPS) and HTTP Strict Transport Security (HSTS) for all websites. This is a Federal requirement as defined in OMB Memorandum M-15-12, Policy to Require Secure Connections across Federal Websites and Web Services.

6.5 System Security Plan. The Contractor shall develop a System Security Plan (SSP) that documents the security controls for which the Contractor has responsibility. Security Controls that are fully provided by a third-party CSP the Contractor is leveraging will be documented by that CSP in its own existing security plan. If a security control may not be applicable, or is not technically possible for the system, the rationale for choosing not to implement the control shall be documented within the SSP and any compensating security controls should be identified and documented for those controls.

6.5.1 The Contractor shall support NARA during the required Security Assessment and Authorization (SA&A) process of the system. NARA is required to have its independent third (3rd) party security assessor test and evaluate the system to ensure that security controls described in the SSP are implemented and functioning as intended. This assessment will be conducted against those security controls for which the contractor and NARA have responsibility. The assessor will review the FedRAMP documentation for those controls provided by the CSP, but will not directly perform a security assessment against them. The assessor will then prepare an assessment and authorization package for the system that includes a risk assessment of the system.

6.5.1.1 Any outstanding risks requiring further mitigation will be tracked by NARA within a Plan of Action and Milestones (POAM), which will be provided to the Contractor for its response.

‘High’ risk items noted shall be addressed and mitigated by the Contractor within 30 days of written notice;

‘Medium’ risk items shall be addressed and mitigated by the Contractor within 60 days of written notice; and

‘Low’ risk items shall be addressed and mitigated by the Contractor within 60 days of written notice.

6.5.1.2 If there are circumstances preventing completion of actions within these time frames, a written explanation must be provided to the COR for review and approval.

6.5.2 Many factors, such as enhancements, changes to Government IT security requirements, etc. may necessitate interim security control updates to the system where the need to add or update security controls arises. Subsequent to NARA’s completion of the A&A process, the Contractor shall work with NARA to update the SSP as requested by NARA, within thirty (30) days of receiving an official request from the COR.

6.6 The Contractor shall ensure that the ICN and HH is configured to protect sensitive information and that systems remain secure. The Contractor must implement a process of continuous review and improvement, which must be built into the development and maintenance of the services.

6.7 The Contractor shall immediately report all security incidents potentially involving NARA’s systems or data, whether suspected or confirmed, to the NARA COR and to NARA’s designated point of contact within the IT Security Management Division.

6.7.1 At the start of designing a new service or feature, the Contractor shall engage the COR as well as, the designated privacy, security, and legal officer(s) within NARA to discuss the type of information collected, how it should be secured, and how it may be used and shared.

6.7.2 The sustained engagement with appropriate NARA personnel (see PWS paragraph 6.7.1) to ensure that personal data is properly managed.

6.7.3 The Contractor shall comprehensively test and certify the components in each layer of the technology stack for security vulnerabilities, and then to re-use these same pre-certified components for multiple services, where possible.

6.7.4 Access to sensitive data shall be limited to individuals in designated roles and within a security scope defined by their role. For example, supervisors shall only have access to information for their direct reports.

6.8 Security Review. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced.

6.8.1 The Contractor shall afford NARA, including the organization of NARA Information Services, the Office of the Inspector General, the COR, and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract.

6.8.2 The Contractor must contact the NARA Chief Information Security Officer (CISO) to coordinate and participate in the review and inspection activity of government oversight organizations external to NARA.

6.8.3 Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of NARA data or the function of computer systems operated on behalf of NARA, and to preserve evidence of computer crime.

6.8.4 The Contractor must demonstrate through its internal policy document or internal operating procedure documents how it would respond to a request for access from a state, foreign government, or court, in a manner consistent with the Government’s interests; and how the presence of the Government's data in any particular jurisdiction would not reasonably result in access to the Government's information, should the data center(s) where the data is stored be physically breached. This requirement is in addition to the data being stored in a FISMA moderate environment.

6.9 The Contractor shall conduct monthly vulnerability scans on these systems and furnish all vulnerability scan information from the systems to the COR. Additionally, the Contractor shall perform and deliver the results of vulnerability scans, on an ad hoc basis, as requested by the COR.

7.0 TESTING AND CUSTOMER ACCEPTANCE TESTING

7.1 Testing. Before deployment, the Contractor shall perform system testing, and assist NARA with customer acceptance testing (CAT). The Contractor shall perform functional and system performance testing of the ICN and HH. In support of this, prior to NARA beginning its CAT, the Contractor shall submit the following:

7.1.1 Test Results/Report. Report results of Contractor’s system integration testing (including Regression Testing). It includes disclosure of testing performed that was not planned in the Test Plan as well as testing not performed that was planned in the Test Plan. The test results shall map directly to the Contractor test plans to show how each ICN and HH stakeholder requirement was met and shall address and provide mitigation strategies for system performance issues. A component of the Test Report is a Performance Test Report (if there are performance related requirements).

7.1.2 Test Plan / Test Procedures

7.1.2.1 The Test Plan identifies the approach, strategy, and coverage of the testing to be conducted. The Test Procedures are the test packages used by the testers to confirm the system conforms to the design and the requirements. A test procedure includes the test case, test data, expected results, actual results, pass/fail outcome, and approval of test case outcome.

7.1.2.2 The Contractor shall perform functional and system performance testing for the ICN and HH in accordance with its Test Plan approved by NARA, to verify that all functional requirements as stated in this contract are successfully satisfied. NARA CAT shall be incorporated into the Contractor’s test plan schedule.

7.1.3 Requirements Verification Traceability Matrix (RVTM). The Requirements Verification Traceability Matrix is a table that traces a requirement from its inception through test. It shows the relationships between the requirements, test cases, and test results. Each requirement should be mapped to specific test cases and their test results. Each test case tests one or more requirements.

7.1.4 Defects Report. The Defects Report shall list out all defects (open and closed) and at a…