NFIRS Software SOW.pdf

STATEMENT OF WORK

VA Butler Fire and Emergency Services

NFIRS Reporting Software

The Veterans Affairs (VA) Butler Fire and Emergency Services is requesting procurement of software that will enable us to report incidents to the National Fire Incident Reporting System

(NFIRS), Inventory and track equipment, document fire inspections and annual flow testing of fire hydrants, document fire hose testing IAW with NFPA 1962, track and report training classes, annual reports of response data, shift calendars, and generate daily rosters. The program must be able to work on Windows 10, and work unilaterally on all computers in the fire station. Program must allow for more than one user to be logged in at a time. Highest security settings must be maintained to protect Veteran Affairs information and assets.

DEFINITIONS

ATO - Authorization To Operate

CO - Contracting Officer

COR - Contracting Officer Representative

IAW – In accordance with

JAB - Joint Authorization Board

NEMSIS - National EMS Information System

NFIRS – National Fire Incident Reporting System

NFPA - National Fire Protection Association

VA – Veterans Affairs / Department of Veterans Affairs

FedRAMP - Federal Risk and Authorization Management Program

1. SCOPE

1.1 Provide a records management website for the storage of fire department and emergency medical records on the cloud.

1.2 Reporting and records management software can make communities safer, increase collaboration through data sharing, and ultimately make the work of data collection and reporting easier for first responders. Our comprehensive platform of Fire and EMS software solutions provides the tools needed to get the job done on the go and in the station. It includes NFIRS, NFPA, and NEMSIS 3 reporting as well as the modules you need for daily operations.

1.3 Two-day onsite training and programing at the VA Butler Fire and Emergency Services.

2. REQUIRED DOCUMENTS

2.1 Contractor shall provide an operation manual for the software.

3. BACKGROUND

3.1 The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA).

3.2 The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3.3 Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency

ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

3.4 The Contractor shall, where applicable, assist with the VA Authority to Operate (ATO)

Process to help achieve agency authorization of the cloud service or migrated application.

3.5 The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

3.6 If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security appendix B.

3.7 The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the COR/CO.

4. DELIVERABLES / PERFORMANCE

4.1 The software shall provide fire department with personal login accounts and passwords.

4.2 The software must be able to report to fire incidents to NFIRS.

4.3 The software may be cloud-based utilizing a website login with high security standards approved by the Veterans Affairs Information Security Officer’s requirements or a stand-alone product that can be installed on the VA’s local network with any department computer will be able to access the software.

4.4 The software must be capable of inventory, tracking, and documenting annual flow tests of fire hydrants IAW NFPA 291

4.5 The software must be capable of inventory, tracking, and documenting annual fire hose testing IAW NFPA 1962.

4.6 The software must be able to generate shift calendars to track leave, different pay schedules, and vehicle riding/position assignments.

5. SENSITIVE INFORMATION / VA SYSTEMS

5.1 The contractor, sub-contractor, program developers, and/or software must maintain a high level of security IAW with VA Information Security Officer requirements, VA Information

Technology policies, and any applicable high-level security certifications.

5.2 Program must be available for audit by the VA Information Technology offices at their request for integrity and security continuity.

5.3 Any cloud-based software must maintain all provisions required by the VA Federal cyber-security policies.

5.4 The contractor shall not release any data or information without expressed written consent from the VA.

5.5 The software must be able to work with the latest Windows software and future updates.

6. SOFTWARE AS A SERVICE DEFINITION

Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud

Service Customer (CSC) over the internet. (Software hosted in VAEC does not meet this definition of SaaS.) The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization

Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

• On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

• Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

• Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

• Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

• Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States.

CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP

Authorization process.