NB192020-25-01686 Scope of Work DRAFT 2025 06 17.docx

Scope of Work Inbound Tracking and Outbound Mailing Systems

1.0 Background Information

The National Institute of Standards and Technology’s (NIST) Facilities Services Division (ASD) is responsible for the shipping, receiving, and mail room functions.

ASD receives approximately 100,000 packages a year. These packages include chemicals, equipment, hazardous and non-hazardous material, test specimens, supplies and special handling packages (e.g., refrigerated or frozen). These packages are received on the NIST receiving loading dock, then redelivered to the recipients throughout the NIST campus.

Receiving receives packages from many couriers such as UPS, FEDEX, DHL USPS, Freight companies, and other local vendors. These packages have unique barcodes and must be captured for tracking purposes.

2.0 Purpose and Objectives of the Procurement

NIST seeks a software as a service solution to support the inbound tracking and outbound mailing services to streamline our shipping, receiving, and mailroom operations at NIST Gaithersburg campus. The proposed solution will meet industry performance standards, offer the necessary redundancy and contingency features to meet NIST’s needs, and provide state-of-the-art technology enhancements to improve user performance and minimize service disruption.

3.0 Technical Specifications

3.1 Inbound Tracking Solution

The Contractor shall supply and maintain the leased hardware and software required to provide an inbound solution that aligns to the technical requirements as specified below:

· Procure an inbound tracking solution with a high degree of reliability and availability A solution that is customizable and extendable allowing additional hardware and/or functions at a later date.

· Record receipt of packages/envelopes and enter it into the data collection system via portable tracking device or keyboard.

· Auto –recognition of carrier tracking numbers

· Store up to 100,000 combined record lookup tables with the portable tracking device.

· Store up to 100,000 receipt transaction with the portable tracking device.

· Store up to 100,000 delivery transactions with signatures with the portable tracking device.

· Quick receive for large shipments

· Deliver single or multiple packages

· Several users levels

· Unlimited number of users and workstations

· Have intergraded laser scanner on the portable tracking device.

· Have intergraded camera on the portable tracking device.

· Ability to send text message if needed

· Signature must have water mark background so it cannot be altered

· Must be able to integrate with parcel lockers at later date

· Must be able to attach PDF documents to tracking history if needed

· Must use Android OS on handheld

· Real-Time Tracking

· Must be able to use remote support on the handhelds and the PC

· Create internal delivery manifest that can be stored by mailstop or delivery route.

· Require the delivery clerk to login only once into the handheld and attach the delivery clerks name to each delivery.

· Record deliveries to recipients by requiring a signature or capturing a signature through a portable tracking device.

· Record images of packages to document damages

· Group packages by location/person so only one signature is required for all delivered packages to that one location.

· Reporting and querying capability to track the status of the package.

· Scheduled emails or text message upon receipt (customizable).

· Generate internal delivery labels to include receipt, building/room, and mailstop.

· Store important notes, signatures, and photos

· Generate customized reports (how many packages received, returned, undelivered, and mis-delivered.)

· Track special requirements for package (need refrigeration, radioactive, do not tilt.

· Capture and store NIST property #, model#, serial #, and recipient’s information.

· Track the movement of packages, both purchased and non-purchased, from receipt on the NIST loading dock through re-delivery to the customer.

· Create a trackable interoffice travel document that’s scanned from pickup to delivery.

· Provide the ability to upload csv files (NIST Directory)

· Expand use of smart lockers to provide NIST secure package delivery

3.1.1 Inbound Tracking: Hardware/Software

The contractor shall supply and maintain leased hardware and software required to meet the following requirements:

3.2 Outbound Mailing Solution

The Contractor shall supply and maintain the leased equipment and multi-carrier shipping software to the requirements set forth in this Scope of Work.

The outbound mailing system shall meet the following requirements:

· Process a batch of letter mail via a postage meter, while tracking the postage used in the mailing/shipping system

· Web-based reporting to allow management to run various reports regardless of location

· Address verification which allows addresses to be cleansed/corrected prior to shipping

· Support residential delivery indicator (RDI) to determine if an address is residential

· Support USPS delivery confirmation which gives the date, zip code, and the time the article was delivered as well as attempted date and time for unsuccessful deliveries

· Maintain at least 5 years of data

· Allow archival of data

· Provide reports on the usage by mailstop, division, group, project/task or by request number

· Provide current price schedules for all the major carriers, which are updated every day. In addition, to accurately calculate shipping costs and for reporting, any specific NIST/DOC and GSA contracts that affect rates shall be loaded into the system

· Capture NIST specific data, such as directory, location; any NIST data shall be stored on a stand-alone server configuration inaccessible to other organizations hosted by the contractor

· Load current data from existing meters into the new postal meters

The outbound system shall meet the following performance specification for outbound packages:

· Secured shipping solution

· Mixed mail feeder

· 70lbs weighing platform

· Remote label dispenser

· Process up to 110 letters per minute(lpm)

· Barcode scanner that can read carriers barcodes

· Create a unique Intelligent Mail Package Barcode for packages (IMpb) per USPS requirements.

· Power conveyor stacker

· Record receipt of packages/envelopes and enter it into the data collection system via keyboard.

· Several users levels

· Retrieve delivery status from carrier websites including time, date, and receiver

· Verify real time, delivery address is correct before the package is sent to ensure timely delivery and to avoid carrier surcharges for bad addresses

· Provide performance reports which compare actual delivery date and time to committed day and time to identify performance or late packages

· Allow Shipping personnel to rate shop and correct addresses before printing the shipping form

· Provide the on-line status of shipped packages and letters

· Provide email notification to the sender and other designated people with the shipping charge and tracking number once the shipment is picked up by the carrier

3.3 Security Requirements

The proposed inbound and outbound solutions must meet the requisite security and privacy requirements defined by applicable federal laws, regulations, and standards (e.g., the Federal Information Security Modernization Act (FISMA), Office of Management and Budget (OMB) Circular A-130), and NIST Special Publication (SP) 800-53, Revision 5).

The Contractor (and/or any subcontractor) must provide evidence in support of meeting the following security requirements.

If a cloud computing solution will be used to store, process, and transmit Government information, the Contractor (and/or any subcontractor) must demonstrate that the proposed system under this contract meet the FedRAMP (www.fedramp.gov) requirements at the appropriate risk impact level (Low, Moderate, or High) before it can be used by the Government.

If a FedRAMP authorization has not been obtained, the Contractor (and/or any subcontractor) must demonstrate compliance through a FISMA authorization that has been completed by other federal agencies; or an independent third-party assessment (e.g., SOC/SSAE, PCI) and/or responses to the controls specified in NIST Special Publication (SP) 800-171. All assessment packages are required to be reviewed and approved by the Government prior to implementation of information system and/or service being acquired.

Post contract award, the Government will perform a security and privacy assessment on the proposed system, which is required for the NIST Authority to Operate (ATO), and for continuous monitoring activities thereafter. The Government will determine the risk rating of any identified vulnerabilities. The Contractor (and/or any subcontractor) shall work with the Government in a timely manner in mitigating all security/privacy risks found during assessment and authorization and information security continuous monitoring process.

The Contractor (and/or any subcontractor) must ensure that the proposed solution remains in compliance with all current and future Federal IT security requirements as needed to maintain a current, valid ATO.

3.3.1 Additional Stipulations

Secure Development Practices The proposed software products must be accompanied by a software vendor attestation that demonstrates compliance with defined secure software development practices. As part of our procurement process, the Contractor (and/or any subcontractor) providing software product must complete the Secure Software Development Attestation Form which is attached.

Multifactor Authentication The proposed solution must support a phishing-resistant multifactor authentication or utilize PIV credentials to authenticate all users (privileged and unprivileged) as required to comply with Executive Order 14028.

Data Encryption The Contractor (and/or subcontractor) shall encrypt all Government data and information in motion and at rest with FIPS 140-2 validated encryption solution as required to comply with Executive Order 14028.

Transport Layer Security (TLS) The proposed solution must be configured with HTTPS using the recent version of TLS protocol (e.g., TLSv1.3).

Event Logging/Use of Security Data Lake The Contractor (and/or any subcontractor) must configure the proposed solution to send log data to the Government security data lake as required to comply with OMB Memorandum M-21-31.

Internet Protocol Version 6 (IPv6) The Contractor (and/or any subcontractor) shall ensure the proposed solution is IPv6 compliant as mandated in the OMB Memorandum M-21-07.

4.0 General Requirements

The Contractor (and/or any subcontractor) shall be responsible for and bear all costs of software upgrade and hardware replacements as needed to remain current and effective.

The Contractor (and/or any subcontractor) shall have a process with documented procedures in place to ensure that the proposed solution is configured in the most secure manner possible, including secure configurations for all hardware, software, operating systems, databases and any other system components.

The Contractor (and/or any subcontractor) shall provide ongoing maintenance for software and hardware ensure timely arrangements to prevent any break in service.

Database transactions shall be captured on a continuous basis, replicated to a backup system during non-business hours. The Contractor shall use commercially reasonable efforts to minimize downtime for maintenance, updates and revisions to the software, hardware and equipment associated therewith.

The Contractor (and/or any subcontractor) shall provide backup and recovery for all government data. All data is and shall remain the property of the government. The Contractor (and/or any subcontractor) shall ensure that the government retains access and download capability of all data for research, investigation, transfer, or migration to other systems.

5.0 Services Availability

The Contractor shall provide a system with high availability, i.e., the system shall not be down for more than 4 business hours (7:30am – 5:00pm Monday through Friday) per quarter.

System maintenance and updates shall occur between the hours of 9:00 P.M. to 5:00 A.M. on business days and 5:00 P.M. to 7:00 A.M. on non-business days and Federal Holidays.

The Contractor shall be available for technical support during the hours of 7:00 A.M. to 4:30 P.M. for all Federal Government business days. Must be able to provide onsite support within four hours if needed during business hours.

6:30pm Monday through Friday). All work shall be pre-coordinated with customer at least 5 business days in advance.

6.0 Period of Performance

The period of performance for this contract is a 1-year Base Period with four (4) 1-year Option Periods. A 6-month Extension Period is also considered in the evaluation and award of this contract IAW FAR Clause 52.217-8.

7.0 Government Responsibilities

The Government is responsible for:

· Providing adequate power for computer and peripherals

· Providing adequate ports for installation of peripherals

· Providing application administration e.g., implementing and maintaining all user and group rights

· Providing accurate database information

· Providing in writing, with the name, email address and telephone number of NIST representative whom the contractor may contact in the event of any downtime.

8.0 Inspection and Acceptance

As duties are completed, the COR will receive, inspect and accept. Inspection and acceptance shall be conducted in accordance with FAR Clause 52.212-4(a), Inspection/Acceptance.

The Contractor shall provide a primary and secondary point of contact to resolve account issues, delivery problems, billing questions, etc. The Contractor shall provide personnel for checking back with the Government if the Government contacts them

9.0 Quality Assurance Surveillance Plan (QASP)

Objective: This plan provides a basis for the COR to evaluate the quality of the Contractor’s performance. The oversight provided for in the contract and in this plan will help to ensure that service levels reach and maintain the required levels throughout the contract term. Further, this plan provides the COTR with a proactive way to avoid unacceptable or deficient performance and provides verifiable input for the required annual past performance evaluations.

Performance Standards:

Quality Level: By monitoring the Contractor, the COR will determine whether the performance levels set forth in the contract have been attained. Quality standards (i.e. performance standards) for all tasks are specified herein.

Frequency: During the performance of this contract, the COR will take periodic measurements (i.e. conduct surveillance), as specified, and will analyze whether the negotiated frequency of measurement is appropriate for the work being performed. Adjustments may only be made by a modification to the contract.

Management Responsiveness: The COR will determine whether the Contractor has managed the contract effectively and efficiently, with successful and timely response to quality standards set forth herein. The COR will confirm whether the Contractor has satisfactorily met all reporting requirements.

Evaluation Methods: The COR will conduct performance evaluations based upon Section II above and the required performance levels set forth in the contract.

10. END OF CONTRACT DATA HANDLING

Upon termination, cancellation or conclusion of the contract, the Contractor shall return the Government data or if return is not feasible, destroy and not retain any copies of the Government data that is in the possession of the Contractor. The Contractor shall certify in writing that such return or destruction has been completed within 30 days after the conclusion of the Contract.