Statement_of_Work.pdf

STATEMENT OF WORK

Audio Conferencing

Period of Performance: The performance period for this contract is a one 12 month base period with two 12 month options. The period of performance, including options, is as follows:

Base May 14, 2015 – May 13, 3016 Option 1 May 14, 2016 – May 13, 2017 Option 2 May 14, 2017 – May 13, 2018

Place of Performance: The work shall be performed at the Contractor’s site.

Contract Type: Time & Materials

1.0 Background

The Center for Scientific Review (CSR), at the National Institutes of Health (NIH) has been using voice-over-IP (VOIP), and standard telephone based audio-conferencing to facilitate CSR’s scientific review meetings since 2006. These technologies have provided CSR with a stable platform for connecting with reviewers nationally and internationally, many times alleviating the need for travel. This technology allows CSR to improve the traditional teleconferencing that was used in the past. Using these chosen tools have provided CSR with a teleconferencing vehicle to reach out to an expanded audience of scientific reviewers who access the review meetings by dialing into a virtual conference room, regardless of their geographic location nationally or internationally.

2.0 Introduction

CSR is the focal point at the NIH in support of the conduct of initial Peer Review, and the foundation of the NIH grant and award process. CSR carries out the majority of Peer Review of research and research training applications submitted to the NIH. In addition, CSR serves as the central receipt point for all Public Health Service (PHS) applications; makes referrals to scientific review groups (SRGs) for scientific and technical merit review of applications; and, to funding components for potential award. To this end, CSR develops and implements innovative, flexible ways to conduct referral and review for all aspects of science.

CSR requires audio conferencing and web interface services to be used at meetings during its Peer Review rounds which are held throughout the year.

3.0 Scope of Work

The contractor shall have access to the required resources, labor, materials, facilities, equipment, and supplies to provide the following requirements:

Page 1 of 7 April 8, 2015

3.1 General Requirements:

1. The Contractor shall possess such expertise, experience and resources to perform the scope of services required in a diligent, timely and professional manner consistent with the highest standards of the industry.

The Contractor shall provide Technical Support, in accordance with Section 3.4, with an adequate number of well-qualified personnel to perform the work.

The Contractor shall provide a contact person available and authorized to remedy any non-conformity to this Statement of Work.

2. Equipment, Tools, Supplies:

The Contractor must have access to all equipment, tools, supplies, offices, personnel, instrumentalities, transportation, support services, and required insurance to perform the Statement of Work.

The Contractor is not required to purchase, rent or hire any equipment, tools, supplies, offices, transportation, personnel, insurance or instrumentalities for NIH/CSR.

The Contractor shall not use a Cloud or Unified Communication based solution.

3.2 Specific Requirements:

1. Unique Identifiers. There is a need for improved tracking of participants. CSR requires the capability to issue PIN numbers or passwords to participants that must be used to access the specified teleconference. This will limit attendance and provide CSR with the ability to run reports after the meeting detailing all of the participants who dialed into the meeting (based on a lookup associated with the pin).

2. Immediate meeting attendance by those dialing into a meeting. The User shall have the ability to have those dialing-in placed directly into the meeting when they answer (Call List), providing that the host/organizer is already present. Otherwise the caller will be placed in a ‘holding’ queue until the host opens the meeting.

3. Direct dialing of international numbers; or the User shall have the ability to use agency calling cards to dial out from inside the meeting to international numbers (Agency cards are domestic/international/800 #).

4. Toll-free number for international call-in participants; or the User shall have the ability to use agency calling cards to dial out from inside the meeting to international numbers (Agency cards are domestic /international/800 #).

5. Web interface for managing calls; Users should have the ability to develop and manage a phonebook in the system in order to simultaneously dial multiple contacts in the directory (Call List). Users shall also have the ability to monitor and manage in real-time participants attending the meetings.

6. Based on pin numbers or passwords specified above in #1, the system user shall have the ability to view the identity of participants in real-time.

7. The Contractor’s system shall be able to provide online-help when participants, account holders, and Scientific Review Officers (SROs) experience any problems accessing their respective meeting rooms.

8. The Contractor’s system shall provide assistance, via a toll-free number help-line, that can be used while a participant is online and the online help-link is not functioning properly. This help line should be highly visible throughout the entire system on every

Page 2 of 7 April 8, 2015 screen, with a Contractor helpdesk support person/technician who shall be readily accessible to interact with account holders.

9. Phone Directory: the Contractor shall provide CSR account holders the ability to upload multiple names via spreadsheet, CSV, or similar format at one time into the application to alleviate the need to add individual names. As well, card-holders shall have the ability to download multiple names from system’s directory list, at once, into spreadsheet, CSV, or similar format.

10. The Contractor’s system shall have seamless integration with other teleconferencing applications and resources, examples are Jabber and WebEx. Audio conferencing is one component of CSR’s electronic review initiative. The proposed system shall seamlessly integrate with Adobe Connect.

11. The Contractor’s system shall provide users with the ability to add additional callers in real-time once the call is in progress.

12. Upgrades/Changes: The Contractor shall provide technical training when there are system functionality changes or modifications, such as changes to any of the Web interface features. The Contractor shall allow CSR at least 30 days to test and validate any upgrades or functional changes to the system, prior to deploying updates or changes into production used by CSR.

13. No Recording: Under no circumstances will Contractor record any Teleconferences conducted by CSR staff. Contractor’s staff will not be given approval, or consent of any type to approve requests by CSR staff to record any of the teleconferences.

14. External system integration interface. CSR's in-house systems or applications should be able to seamlessly integrate with the Contractor’s service interface. Web service is an example of this type integration. Universal Voice Gateway Service for third party vendors such as Adobe connect and Cisco Jabber.

3.3 Technical Support:

The Contractor shall provide support to the account holders via Helpdesk staff. The account holders shall be able to contact the Contractor’s helpdesk support by e-mail, toll-free phone line, or through functionality within the system. The helpdesk shall be available 7:00am to 7:00pm, Eastern Standard Time (EST). The Contractor shall provide a resolution to a problem reported by the account holder within 20 minutes after the problem is reported. If there are problems or issues that will exceed 20 minutes to resolve, the Contractor’s helpdesk staff shall notify the account holder and the CSR Desktop Group with an update of when the problem or issue will be resolved.

The Contractor is expected to create new accounts within one business day of the request.

3.4 Business Continuity and Recovery:

The Contractor will be responsible for having a Business Continuity Plan for recovering the system in cases of system failure. The Contractor will provide the following to CSR:

Notification:

• Notify CSR of System failure.

• Perform a damage assessment and report information to CSR Desktop Group, who will be servicing as CSR’s Point of Contact (POC).

Recovery:

• CSRs’ POC will be notified of actions taken by Contractors’ recovery team and personnel to restore system operations.

Page 3 of 7 April 8, 2015

Reconstitution:

• Contractor will provide an outline of actions taken to return system to normal operating conditions to CSR’s POC.

The Contractor’s Maximum Tolerable Downtime (MTD) shall reflect the following:

• Urgent - 24 hours

• Critical-Minutes to hours

The Contractor shall provide CSR proof of proper backup plan for the system and of all data and metadata relevant to CSR’s account. Such data/metadata consists of but is not limited to:

usernames, assigned 800 numbers to CSR users, teleconference dates, minutes used, rate per minute, and phone directory contents.

3.5 Change Management

The contractor shall notify CSR’s POC of any system changes that will affect the end-user’s ability to use the audio and Web Interface of the system at least thirty (30) calendar days prior to implementing the change. A document with all expected changes shall be sent to CSR’s Desktop Group staff to review and discuss before changes are implemented. Major changes will not be performed during CSR’s peak Peer Review meeting cycles.

CSR will conduct a post-award site visit to ensure evidence of the following:

• Full System Redundancy/Mirrored in both hardware and software

(Servers/Workstations)

• Disaster Recovery Plan

• Change management and testing plan

• Customer support infrastructure

4.0 Deliverable Schedule

The contractor shall provide the following deliverables:

Item No.

Deliverable Description

Deliverable Due Date

Deliver To

1 Monthly Technical Progress Report (as described below)

Monthly, on 10th calendar day beginning the month after contract award.

Contracting Officer Contracting Officer Representative

2 Custom Monthly Report (as described below)

Monthly, on 10th calendar day beginning the month after contract award

Contracting Officer Contracting Officer Representative

3 Phone Directory Upload Tool (as described

Upon execution of award or

Contracting Officer Contracting Officer Representative

Page 4 of 7 April 8, 2015

Item No.

Deliverable Description

Deliverable Due Date

Deliver To below) within 20 days thereafter

4 Section 508 Annual Report (as described below)

Upon execution of award & each Optional Year

Contracting Officer Contracting Officer Representative

5.0 Reporting Requirements

1. Monthly Technical Progress Reports

All reports required herein shall be submitted in electronic format to the Contracting Officer and Contracting Officer’s Representative (COR) as described in the delivery schedule.

The Contractor shall provide a monthly invoice which includes the following identifying information: (1) date of use, (2) cardholder’s name, (3) conference room number, (4) CSR meeting data, (5) duration of calls, and (6) amount incurred for each call. The Contractor is expected to provide a monthly updated listing of CSR accounts with any accounts that have been removed highlighted or marked as an inactive account. The Contractor is expected to create new accounts within one business day of the request.

2. Custom Monthly Report

The CSR is in need of an advanced report or reporting tool that will provide cumulative data on all of the teleconferences held by CSR staff for various periods, during a given fiscal (FY) or calendar (CY) year. This reporting capability or tool shall have the flexibility to provide reports in several different data formats, which shall include the data below as a reference, but may not be limited to the following:

For each conference room (800#), provide:

• meeting date

• meeting time, room, total count

• meeting type

• length (in Minutes)

• accumulated minutes

For each meeting date: complete information, to include:

• connect, disconnect

• service

• access #

• participant #

• name

• length (in Minutes)

Page 5 of 7 April 8, 2015

Receipt of or the capability for accessing the above-referenced report shall be as described in the delivery schedule. Access to an online link or receipt by email of this monthly report, will be accepted as suitable forms of delivery.

Specifications for the report layout can be provided by the contractor, as long as the report layout includes all of the required data specified above.

3. Phone Directory Upload Tool

Contractor shall provide CSR with a tool for loading multiple names into the phone directory. This tool shall facilitate loading multiple names and assigning access codes to multiple entries.

4. Section 508 Annual Report

The contractor shall submit an annual Section 508 report in accordance with the schedule set forth in the DELIVERABLES / DELIVERY SCHEDULE sections of this requirement. The Section 508 Report Template and Instructions for completing the report are available at:

http://www.hhs.gov/web/508/contracting/technology/vendors.html under “Technology Products, Information for vendors for product accessibility evaluation."

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at:

http://www.hhs.gov/web/508/accessiblefiles/index.html under "Making Files Accessible."

6.0 Quality Assurance

1. During the contract period, CSR’s Desktop Group shall have the ability to monitor the quality of service provided by the Contractor and their application to ensure the best functionality for the CSR-user community. The monitoring will be accomplished by testing the key features implemented on the Contractor’s system. The Desktop Group will log any bugs/errors, downtime, and any unavailability of system and report it immediately to the Contractor.

2. Monitoring of the aforementioned fourteen (14) requirements, listed in Section 3.2

”Specific Requirements” of this Statement of Work, will be performed by obtaining feedback from CSR cardholders, who will be using the application to communicate with Program Officers and Reviewers, during scheduled study section review meetings.

The Contractor will be notified of any problems that arise during the contract period.

The Contractor will be provided with written documentation as to CSR’s acceptance or rejection of deliverables.

Page 6 of 7 April 8, 2015 http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/accessiblefiles/index.html

7.0 Security Requirements

1. The Contractor shall ensure that firewalls are in place to allow only authorized IPs and ports. Boundary protection must be in place at the contractor furnished site.

2. The Contractor shall protect against confidentiality and privacy threats by protecting against call eavesdropping, recording, voicemail tampering as well as wiretapping and sniffing of voice traffic.

3. The Contractor must protect against availability threats by defending against denial of service (DOS) floods, buffer overflow attacks and worms & viruses.

4. The Contractor must protect against authenticity threats by ensuring that no registration hijacking, caller ID spoofing, sound insertion can occur on the calls.

5. The Contractor must protect against service theft such as toll fraud, data theft such as masquerading data as voice and invading data network (contractor furnished environment; that which consists of the boundary of the contract).

6. The Contractor must protect against all spam such as spam over internet telephony (SPIT) or VoIP spam which includes unsolicited calling, voice mailbox stuffing, vishing (voice phishing).

7. Webservers must use HTTPS protocol to ensure confidentiality.

8. The Contractor shall comply with all other security requirements as outlined in

Attachment 19 “Information Security Program Requirements”.

Page 7 of 7 April 8, 2015