RFP_OPM26-12-R-0034_-_LMS_Spt_-_09-25-12.pdf

Solicitation: OPM26-12-R-0034 Learning Management System (LMS) Support (AT10142)

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1. Requirement

HRS/USA Learning® Program Office is seeking Contractor services to provide Learning Management System (LMS) support in four (4) areas: a) Integrator, b) Hosting, c) Helpdesk, and

d) IT Security Services. This procurement will lead to a single Blanket Purchase Agreement (BPA) with four (4) Contractors using the Required Service Areas (RSAs) described in Section C, Statement of Objectives.

B.2. Fixed Prices and Fixed Priced Labor Category Rates

Offerors shall propose prices necessary to fulfill the requirements of the RSAs. Offerors proposed prices shall consist of fully-loaded firm fixed prices and fully loaded fixed price labor category rates.

―Fully loaded rates‖ are defined as the price inclusive of direct wage, fringe benefits, all overhead, general and administrative (G&A) costs, profit and fees, training materials and associated shipping costs for the Contractor to provide the required services.

Offerors will provide the pricing schedule in the formats provided below for both mandatory and optional items described in the Statement of Objectives (SOO). The pricing schedule must include the RSA number and title for each proposed price. See example below for RSA / Item 01 - LMS Services.

B.2.a. Fixed Prices

All proposed fixed prices must include a description of the services/products included in the fixed price. Fixed Prices may be proposed to support RSAs 1, 2, 3 and 4. See the example of fixed prices for RSA / Item 01 - LMS Services shown below.

Solicitation OPM26-12-R-0034 Learning Management Systems (LMS) Support (AT10142)

Example of Format for Proposing Fixed Prices

RSA/Item 01 – LMS Services - LMS Implementation Services: Fully loaded fixed prices include all one-time set up charges for the LMS Services. Prices will be scaled based on a graduated number of users. Technical and other services not priced using the per user methodology is priced using fully loaded labor category rates.

RSA

No.

Item No.

Item Description Avg # of

Agency Users

Price per

User

Total Amount

0001 0001 Basic LMS Set-Up, Configuration and

Implementation: configuration includes batch integration with enterprise legacy Human Resource relational database system, determining detailed requirements, configuring the LMS to match agency-specific IT network and business rules, site branding for agency specific look and feel, migration of legacy training data into the target LMS, training of system administrators, system documentation and user manual provided in MS Word electronic format. Any additional requirements that exceed this Basic

Configuration will be separately priced using the

Offerors fully loaded labor rates.

0001 0002 * End User Licenses: Price per user includes all services needed to provide user access in an environment compatible with agency requirements, which includes general security services, annual maintenance, updates and other services needed to provide proper operations and services. Offerors must calculate a total price based on their per user price multiplied by the maximum potential number of users for the individual line item.

0001 0003 ** Other Services Set-up fee (Applicable to new implementations only)

LMS Configuration and Implementation Fully Loaded Labor Rates: Any configuration and implementation requirement that exceed the Basic LMS Set-Up, such as agency specific customizations, training and other elements not otherwise covered, shall be provided at the following rates.

* Rate includes licensing for LMS, user interface branding, discussion forums, chat capability, user defined customizable reports to be established in the BPA Call, and 24/7 support. Rate also includes licensing for LMS, LCMS, user interface branding, discussion forums, chat capability, standard reports, dynamic reporting, ILT management, eIDP, resource management, EHRI reporting, analytics tool, SF-182 module, e-commerce (optional), and 24/7 support.

** Offerors are required to submit price and technical offers on ―Other Services‖ (Item 0003 above)

B.2.b. Fixed Labor Category Rates Labor category rates may be proposed to support RSAs 3, 4, 5, 6, 7, 8, 9, 10, and 11. These rates will be used on a Fixed Price or Labor Hour basis to provide flexibility and clarity as to the price of technical support that cannot be otherwise clearly defined in firm fixed prices. Offerors must provide proposed labor categories and associated labor rates using the following format:

Format for Pricing Schedule Using Fully Loaded Labor Category Rates

RSA

No.

Labor Category Base Year

Option Year 1

Option Year 2

Option Year 3

Option Year 4

B.2.c. Contract Closeout

The Contractor shall return to the Program Office all materials provided, along with all employee training data in a file format specified by the Program Office in an electronic format that will be defined in the Close Out instructions to allow for the transfer or uploading into any successor Contractor‘s LMS. The cost of these services will be included in RSA 07/Item 07 pricing.

(End of Section B)

RSA

No.

Item No.

Item Description Avg # of

Agency

Users

Price per

User

Total

Amount

0001 0001 LMS Services (Base Year) Graduated

1-500, 501-1000, etc.

0001 1001 LMS Services (Option Year 1)

0001 2001 LMS Services (Option Year 2)

0001 3001 LMS Services (Option Year 3)

0001 4001 LMS Services (Option Year 4)

SECTION C – STATEMENT OF OBJECTIVES

C.1. Agency Information

The Office of Personnel Management‘s (OPM), Human Resources Solutions (HRS) enterprise provides services that assist the Federal Government in achieving their missions by: (1) partnering with agencies to provide effective human resource solutions that develop leaders, attract and build a high quality public sector workforce, and transform agencies into high performing organizations;

and (2) offering services that enhance agencies' ability to attract and acquire specific talent.

The Learning Management System (LMS) shared service provider, formally GoLearn®, is a Program office in the HRS Directorate of the Office of Personnel Management (OPM). GoLearn® will become USA Learning® effective October 1, 2012. The mission of the USA Learning Program Office ("Program Office") is to provide a full spectrum of web-based human capital performance (e- HCP) tools, and the full range of web-based training content, including academic, technical, executive and organizational development courses to any Government employee, industry partner, state and local government employee in any media at any time. OPM has used a similar vehicle to support this program over the past several years. However, due to the recent reorganization at OPM, is has become necessary to solidify our support and resources to sustain our obligations to existing and future customers.

C.2. Background

OPM is responsible for sustaining the goals of the e-Training initiative. This solicitation identifies requirements for services to further advance the goals of this important initiative and the President‘s Management Agenda through the USA Learning® Program. The Program Office is responsible for the thriving knowledge management portal that it originally developed.

In November 2001, OPM was designated as the managing partner of the e-Training Initiative, which was one of 24 E-Gov projects. Shortly thereafter, OPM entered into a partnership with the Department of Transportation (DOT) Transportation Administrative Service Center (TASC) organization and the Transportation Virtual University (TVU) to develop and implement what was known as GoLearn®. As the E-Gov program and initiatives matured, the Government online learning program has evolved. Contracting vehicles have been modified and redundant vehicles eliminated. Under the umbrella of GoLearn®, OPM provides educational and training services to multiple agencies to satisfy their annual training requirements through the use of this shared environment to maximize the cost savings to the Government. OPM has brought in additional client agencies that have specific needs but are currently rolled into a joint business case with a standard relationship between OPM and these agencies. This has helped to identify the need to establish a sound business model to simplify and unify the infrastructure across the Government.

This vehicle has obtained state-of-the-industry, online training services, web-based Human Capital Performance (eHCP) tools, educational instruction and the supporting technology and services needed to enable Government employees to achieve training, educational and professional development goals.

C.3. Scope

In support of its mission, the OPM USA Learning Program Office needs Contractor services to support the Government Online Learning Center, and e-Training Program by providing four (4) distinct services: Integration, IT Security, Hosting, and Helpdesk Services in multiple Required Service Areas (RSAs). The scope of specialized technical work and technology support typically involves significant information technology (IT) related requirements. The Contractor must be capable of performing and delivering services consistent with the core Required Services matrix shown below.

This requirement outlines the service areas and their typical requirements. The requirements identified within each of these areas reflect the majority of the activities anticipated under that specialty, but are not inclusive of all possible requirements within that area or under this solicitation.

The required services detailed in this section are intended to capture the known spectrum of human capital performance and e-Training tools that will be required of the Contractor providing Integration Services under RSAs 1-8 (―the Integrator‖) in achieving the goals of the e-Training initiative and support the USA Learning® Program Office objectives, OPM and HRS in the operation of the e- Training improvement program.

C.4. Requirement

HRS/USA Learning® Program Office is seeking Contractor services to provide Learning Management System (LMS) support in four (4) areas: a) Integrator, b) Hosting, c) Helpdesk, and

d) IT Security Services. This procurement will lead to a single Blanket Purchase Agreement (BPA) with four (4) Contractors—one for each of the four areas indicated— using the Required Service Areas (RSAs) listed below and described in this Section.

Integrator RSA 1 -- Learning Management Systems (LMS) Services RSA 2 -- Learning Content Management Systems (LCMS) Services RSA 3 -- Course Development RSA 4 -- Project Management (PM) Services RSA 5 -- Implementation, Customization and Integration Support Services RSA 6 -- Technical Training/Consulting and Change Management RSA 7 -- Transition Planning and Services RSA 8 -- Organizational Needs Assessment

IT Security RSA 9 -- IT Security Services

Hosting RSA 10 -- Hosting Services

Help Desk RSA 11 -- Help Desk Services

a. Required Services Areas (RSA) Matrix

Integrator Services

Required Service Area (RSA) GENERAL DESCRIPTION

1. Learning Management Systems

(LMS)

This service is to design, develop, and implement a customized Learning Management System (LMS) for a client agency. This task will evaluate the optimal LMS solution, support establishing the agency-unique LMS site customized to agency requirements, implementing custom workflow, loading historical training completions, users, and courses, and providing a real-time dashboard showing reports of user progress in a secure socket layer (SSL) encrypted environment.

2. Learning Content Management Systems (LCMS)

Analyze optimal Learning Content Management Systems (LMCS) solutions and build out an agency unique infrastructure to enable client agencies to manage their own content using the Learning Management System simplified web-publishing toolset. This task will develop the back-end infrastructure for an agency to create, manage, and deliver implement knowledge in the Learning Management System content management system. This infrastructure development will include a custom agency header, unique agency instance on the shared server environment, Admin and public URLs, and the database meta-sites. Agencies will receive access to the back-end admin sites to be able to create and edit on-line content that can be viewed in the associated public sites.

3. Course Development This service is to support new course development to include but not be limited to the following: new course development, existing instructor-based course conversion to on-line delivery, creation of domain specific Knowledge Repositories with full compliance with SCORM, AICC and Section 508, and on-line course updates employing the Learning Management System repository in a Linux, Apache, Zope, MySQL, PHP, PostGreSQL, and DTML environment.

The specific course services include:

Existing curriculum evaluation/validation

New course development

Existing course conversion to on-line delivery

Compliance with current version of SCORM and Section 508

Existing on-line course content updates

AICC Cross Domain Communications script enabled within each LMS environment.

4. Project Management Services

Provide Learning Management Systems project management, support staffing, such as business case development, SOW development, Scheduling maintenance, Financial reporting and related e-Learning consulting services.

Required Service Area (RSA) GENERAL DESCRIPTION

5. Implementation, Customization and Integration Support Services

This service will support agencies in all aspects of implementing and employing the Learning Management System implementations.

Support includes assisting in researching and troubleshooting client agency issues with on-line content, SCORM, Section 508, LMS, LCMS, cross domain communications, hosting, server, and registration to server as an expert resource as well as maintaining and managing LMS, LCMS, on-line forums and other on-line knowledge management solutions. Any and all government purchased customizations will become government owned property and shall be interoperable across all LMS implementations at no additional cost for subsequent implementations.

6. Technical Training/Consulting and Change Management

This service will provide hands-on technical training to agencies to enable them to manage all aspects of supporting the Learning Management System implementations. Training includes maintaining and managing LMS, LCMS, on-line forums and other on-line knowledge management solutions. Also Includes consulting and implementation services to integrate e-Training systems with agencies‘ existing HR and Human Capital Performance Management Systems, and win acceptance by management and the end user. Change Management and Configuration Management is critical. Configuration management (CM) is a process for establishing and maintaining consistency of a product‘s performance and functional and physical attributes with its requirements, design and operational information throughout its life. These services will be required for each operational system. For example; all like (single vendor) systems must maintain a single current version across the installed enterprise (be brought into compliance within 180 days) regardless of number of instances. These instances may contain unique agency features and functions that are maintained separately.

7. Transition Plan and Services This provision is to provide continuity of service by which OPM can continue to meet the goals and objectives established for the e- Training, eGov initiative for all existing LMS task orders to LMS BPA Calls awarded under this vehicle until each LMS task order expires.

This support shall allow a seamless and transparent transition for the client agencies.

8. Organizational Needs Assessment

This service is to conduct an organizational needs assessment to include knowledge management processes, training requirements, performance measures, and provide recommendations for best practices and technology-based solutions.

IT Security Services

9. IT Security Services This service is to provide IT Security Services in support of a fully compliant program in accordance with (IAW) National Institute of Standards and Technology (NIST) and Federal Information Security Management Act (FISMA) Guidance this will include Security Assessments, system evaluations, Program management, POA&M management, IV&V, preparation of Accreditation and Assessment documentation IAW NIST Risk Management Framework, Track security program as it is related to access and initiation in compliance with OPM FIS Requirements. Provide qualified Functional Subject Matter Experts, with appropriate industry certifications. Lead Analyst will be CISSP certified and knowledgeable of current federally mandated IT security requirement. The successful Offeror will show evidence and knowledge of application procedures to the FedRamp 3d Party Assessor Certification Program. Security program will encompass all Learning management systems under the ownership of the Office of Personnel Management. Actual details for specific LMS will be provided at the BPA Call level.

Hosting Services

10. Hosting Provide enterprise-level hosting services in support of the on-line development and knowledge delivery beginning as the infrastructure is established and continuing throughout development and delivery.

Provide high-speed high-availability hosting services running in a shared or dedicated server with the entire infrastructure, back-up, monitoring, maintenance and patching applications including Zope, PHP, MySQL, Linux, Apache, PostGreSQL and the Learning Management System Repository. Provide enterprise-level hosting on a server with a current certificate and authority to operate. Automatic on-site and off-site back up each day to a revolving series of back-up files to provide daily back-ups, a single weekly and a monthly back-up.

Provide redundant internet service providers, back-up power generator, and 24-hour access and security.

Help Desk Services

11. Help Desk Services Provide the help desk services in support of Learning Management System environment for on-line course delivery:

Hours: 8:30am to 5:30pm, EST Monday through Friday excluding holidays. Calls that go to voicemail outside of normal help desk hours will be responded to the next business day morning.

Include on-line database-driven help desk software to use trouble tickets to document issues.

Toll-free number as well as local Washington DC number

Help desk support includes assistance with registration, logging in, password resets, sending lost passwords to users, troubleshooting course access, navigation, appropriate procedures to follow, and fielding general questions regarding the course.

Real-time on-line dashboard that provides reports of numbers of help desk calls, issues, summary by issue, and detailed calls are available real-time to authorized personnel with the secure access.

Include support for help desk tiers 1 through 3 with an escalation policy.

b. Strategy

The BPA is intended to create an efficient, productive, cost-efficient alternative for our Federal clients. OPM will move from its current state (Phase 0) (see diagram below) to a transitional state (Phase 1) and ultimately to final state (Phase 2) as the periods of performance on existing contracts expire. We are seeking a technically competent Integrator(s), with demonstrated experience in providing LMS and LCMS supporting services at the enterprise level. The integrator will be responsible for providing expert project management support for the planned transition of services and for the continuity of services of the existing client base.

The Integrator provider will be responsible for the following RSAs as described above: 1 LMS , 2 LCMS, 3 Course Development , 4 Project Management , 5 Implementation, Customization and Integration Support Services, 6 Technical Training/Consulting and Change Management, 7 Transition Plan and Services, and 8 Organizational Needs Assessment.

The Hosting provider will be independent of the Integrator and directly responsible to the OPM Program Office for RSA 10 (Hosting Services).

The Help Desk provider will be responsible for supporting RSA 11 Help Desk Services. This provider will also be independent and report directly to the OPM Program office, but must coordinate with the Integrator for problem resolution and mitigation.

The IT Security Services provider will be responsible for supporting RSA 9 IT Security Services.

This provider will also be independent.

The diagram below (Figure D.2.1) is illustrative of our planned transition of the current configuration and the elements involved. Proposals must demonstrate creative technical solutions that will satisfy the client requirements and ease the management burden as we continue to grow this offering to federal entities. It is not limited to an expansion of any agency‘s future integrated system requirements.

Figure C.1

c. Transition

A smooth and orderly transition between the Contractor and the predecessor Contractor is necessary to assure minimum disruption to vital Contractor services and Government activities.

The Contractor shall not disrupt official Government business or in any way interfere with the assigned duties of the predecessor Contractor‘s employees. The Contractor may notify the predecessor Contractor‘s employees that the Contractor will be assuming services upon the Contract start date and may distribute business cards, employment applications, brochures, and other company information to the predecessor Contractor‘s employees while they are on duty, provided that there is no interference with the Contract employee‘s assigned duties (e.g., during ―off hours‖ or during relief or lunch breaks). However, the Contractor shall not interview, recruit, schedule interviews, or conduct extensive discussions with the predecessor Contractor‘s employees while they are on duty.

The Integrator will provide a documented transition plan for the successful consolidation of existing hosting facilities to one federally certified and accredited hosting facility. This effort is in support of the federally mandated Federal Data Center Consolidation Initiative (FDCCI). The transition is expected to require a minimum of one (1) year to be completed. Periods of performance, expiration dates and the complexity of the consolidation effort must be considered and incorporated into an integrated project plan. The draft project plan will require close coordination between the Hosting and IT Security Services providers, to ensure all required certifications, authorities to operate, data center moves (if required), interconnectivity agreements are orchestrated without service interruption to existing customers. The final transition plan must be approved in writing by the CO prior to implementation . The Integrator will include as a part of the integrated project plan, the critical elements (Hosting, Security, Help Desk Services) and actions required by each Contractor to smoothly implement and/or sustain continuity of services for existing clients. The Integrator will provide a draft plan within 60 days of award of the BPA. Figure D.2.1 provides a graphical representation of the anticipated tasks and preliminary phases. The Integrator may propose alternative approaches; however these alternatives must incorporate the key elements as identified within this Statement of Objectives. All awardees must address their ability and willingness to cooperate fully with the transition plans approved by the CO and will document that planned cooperation and support in their proposals in the appropriate area of the technical approach.

d. Site Visit / Survey

A Site survey will be required for those offerors seeking to propose for Hosting services. Facilities that are currently providing these services should reference the same in past performance language as a part of their technical proposal. Hosting offerors must demonstrate and document the ability to undergo assessment and accreditation within 60 days of BPA Call award and not later than 90 days thereafter. Sites will be evaluated IAW specific controls outlined in NIST SP 800-53 Rev 4, applicable to such facilities, and IAW Federal Data Center Consolidation Initiative (FDCCI). Site surveys will be coordinated and scheduled with the OPM Program Office within 30 days after BPA Call award.

e. Contractor Furnished Materials / Information

The Contractor will supply software and/or services which operates LMS databases and repositories. In the event that data is migrated from one (1) Contractor platform or system to another, the BPA Call will include specific requirements for how data will be handled, stored, secured, data schema, mapping, and provided to OPM and other Contractors. These requirements will be detailed in the BPA Call.

Included in the license agreements required to support this BPA are all the necessary rights needed to operate the specified software for its useful life in the specified environment. OPM is required to hold confidential such information as we may learn in the course of contract performance.

Contractor is required to retain a copy of the current version of the software at an independent third party with OPM the designated owner in the event of default.

Copyright Ownership

The Contractor will relinquish any and all copyrights and ownership to the U.S. Federal Government for all deliverables directly funded by the U. S. Federal Government. This includes, but is not limited to graphics, documentation, database schemas, documented source code, and unique programmatic logic and or algorithms.

Data Ownership

The U.S. Federal Government maintains ownership of all data, information, and derivative statistical information related to its personnel and organizations. This includes data either provided by the Federal Government or its employees and Contractors in support of this BPA, data collected by the Contractors‘ IT and Business systems on behalf of the Federal Government.

All Government data will be treated with confidentially, using the NIST guidelines for the security and handling of sensitive but unclassified (SBU) data. This requires that data not be released to any outside organizations, without specific written permission by authorized sources within OPM.

Information collected will be provided in a mutually agreed upon format within 7 days of a formal request either in writing to the COR.

Additionally, the Program Office will ensure that any backup data provided by the Contractor will be highly secured and released only to those persons who have a need to know.

Data Center

The Contractor will be expected to have a contingency plan in place to safeguard against disaster.

The contingency plan will ensure Government / LMS data is protected and retrievable in in case of events beyond the Contractor‘s control, such as natural disaster and terrorist activities.

f. Provide Technical Security

General Security

All Contractors operating Federal information systems on behalf of a Federal Agency (including web hosting, LMS software development, and content provider development sites) shall comply with the requirements of the Federal Information Security Management Act (FISMA). This includes, but is not limited to, ensuring compliance with the training, testing (test or developmental environment) and risk assessment requirements described herein. Compliance with FISMA shall be shown by demonstrating conformance with NIST SP 800-26, Security Self-Assessment Guide for Information

Technology Systems. In addition, any security standards or guidelines developed by NIST that are subsequently mandated as compulsory by the Secretary of Commerce for the purposes of ensuring compliance with the Federal Information Security Management Act, shall be complied with by the

Contractor. The contractor will coordinate continuously with the approved IT Security provider to ensure compliance with FISMA, NIST and OPM mandated policies.

It is recommended that Contractors familiarize themselves with the following as a minimum:

NIST SP 800-16

FISMA

NSA/CNSS Certification

OMB Circular A-130 Appendix III

NIST SP 800 series

Federal information processing Standards (FIPS)

The Contractor shall have the capability to adhere to the above security requirements for a LMS provider, LCMS provider, and systems software providers. Contractors for these products and services shall satisfy Federal regulations and guidance for protection and transmission of Sensitive but Unclassified (SBU) data. These requirements are also intended to specifically satisfy the requirements for a ―Trusted Host‖ as described in the Department of Defense (DoD) policy on the use of mobile code.

The software systems Contractor and Hosting services Contractor shall implement and maintain security measures aimed at preventing unauthorized access to the Government information systems and data, student data, infrastructure support systems, and telecommunication services supporting LMS internet web sites. Data systems shall be secured and protected from remote intrusion, hackers, virus infections and service denial schemes.

g. Hosting IT Security

The web host, LMS software, and content provider sites must implement and maintain security measures aimed at preventing unauthorized access to Federal client networks, information systems, infrastructure support systems, and telecommunication services supporting the Federal clients Internet web sites. Information systems must be secured and protected from remote intrusion, hackers, virus infections, and service denial schemes as described throughout this Specification.

The web site host system shall be configured for National Security Agency (NSA) Common Criteria Evaluation and Validation Scheme (CCEVS) security (see http://www.nsa.gov/isso/bao/cpep.html).

Access to system by Federal clients, e.g., clients responsible for the content of the web pages, files or other information or instructions shall have read-only access (or the most current specification).

Host configurations further limit permeability, for example but not limited to the following:

1) The host site must employ system controls to ensure files and directories of the system are only exported to Government-designated host systems and facilities. Re-hosting of files allowing remote log in from a trusted machine without password access control is not permitted.

2) The File Transfer Protocol (FTP) home directory and root privileges must be write-protected against anyone other than host site personnel authorized with access to root. All access shall be recorded in the audit control system for monitoring and tracking all access activities.

3) The host site shall employ system controls to ensure all system software, applications, data, hardware configuration, connectivity, and permissions settings cannot be altered in an unauthorized fashion during processing, storage, and transmission.

4) A subscription to the host security issues mailing list (electronic notification) must be maintained and aggressively acted upon by the host site (e.g., any potential security holes are identified and recommended solutions are implemented quickly).

5) All non-essential services on host site servers are removed.

6) Where UNIX or Windows-based operating systems are used, servers must be configured in accordance with NSA guidelines on server vulnerabilities. All web servers must be configured in accordance with NSA guidelines on secure Web site configurations.

7) Where available, guidance from NIST on secure implementation of operating systems and web servers must be used. Current guidance includes NIST SP 800-43, Systems Administration Guidance for Windows 2000 Professional, SP 800-40, Procedures for Handling Security Patches, and SP 800-44, Guidelines on Securing Public Web Servers.

http://www.nsa.gov/isso/bao/cpep.htm

8) The host site must notify all Federal clients‘ POCs and the COR a minimum of five (5) days in advance of any planned system downtime that will impact or diminish the performance of the system for the users. Notification shall include the reason, the start time, an estimate of the impact on the operation of the system and the time the system is to be returned to full operational status. The host site must take the necessary steps to insure that when the system is restored to full and normal operation all files, user applications, and security programs are performing properly.

9) In the event of a system failure such as an unplanned down time that disables the system having a negative impact on the users, the host site must notify the OPM Program Office by telephone and e-mail immediately. The host site must provide the reasons for the failure, steps being taken to restore the system to normal operation, and an estimate of the time the system will be out of service.

10) The host site must exercise diligent and prudent management of the system and security measures to identify and eliminate all virus attacks prior to the system becoming infected. If there is a successful virus attack, the host site shall notify the above persons immediately.

11) In the event an attack is successful the host site must take all necessary steps to disable and remove the virus, secure the system from another attack, and restore the system to normal operation

12) When an analysis of the attack indicates a planned and directed attack from an unknown but consistent source or domain, the host site must implement service denial measures to mitigate a repeat of the attack. When service denial measures are anticipated by the host, site, the host site must notify the above persons immediately and provide an explanation of the need to implement service denial steps and the potential consequences of delaying such action. The report shall identify any weaknesses in the security systems and recommend what actions should be taken to correct any deficiencies to minimize a repeat of the attack.

13) The host site must perform real-time monitoring of traffic to find possible denial of service attacks (trying to block access to a web site by flooding a site with data requests). The host site shall immediately take all necessary steps described in the preceding bullets. The host site must implement the capability to store audit logs both on and off line and provide a mechanism for remote access by appropriate Governmental law enforcement personnel as needed.

The Contractor shall correct security infractions at the cost of the responsible Contractor as determined by the Contracting Officer.

C.5. Period of Performance

The period of performance includes a base year and four (4) option periods of one (1) year each.

For estimating purposes, each period is defined as follows:

Base Year: 03/01/2013 - 02/28/2014 Option Year 1: 03/01/2014 - 02/28/2015 Option Year 2: 03/01/2015 - 02/29/2016 Option Year 3: 03/01/2016 - 02/28/2017 Option Year 4: 03/01/2017 - 02/28/2018

C.6. Place of Performance

The place of performance will be defined in the SOO/PWS for each BPA Call requested under the BPA. However, the majority of the anticipated support will be performed at the Contractor‘s facility or the client facility. Some activities may be conducted at OPM Headquarters located at1900 E Street NW Washington, DC 20415.

C.7. Ordering of Services

OPM will generally issue BPA Calls for one time (e.g. LMS system setup, pilot system setup) and monthly recurring services (e.g. hosted LMS services), however, reserves the right to place a credit card order if the need is urgent.

C.8. Ordering of Other LMS Services (in-scope)

OPM may require other LMS Services that are considered by OPM to be in-scope of this solicitation, but are not currently priced. A request for quotation (written or verbal) will be submitted to the Contractor(s) for pricing. All special pricing requests for other LMS Services will be answered within one business day of the request.

C.9. Technical Direction

Performance of the work under BPA Calls shall be subject to the technical direction of the Contracting Officer's Representative (COR). The term ―technical direction‖ is defined to comprise the following:

a. Directions to the Contractor which redirect the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual statement of objectives.

b. Provisions of information to the Contractor which assists in the interpretation of drawings, specifications or technical portions of the work description.

c. Review and, where required by the contract, approve technical reports, drawings, specifications and technical information to be delivered by the Contractor to the Government under this contract.

Technical directions must be within the general scope of work stated in the contract. The COR does not have the authority to and may not issue any direction which (1) constitutes an assignment of additional work outside the general scope of the contract; (2) constitutes a change as defined in the Changes clause (FAR 52-243-1); (3) in any manner causes an increase or decrease in the estimated cost or the time required for performance; or (4) changes any of the expressed terms, conditions, or specifications of the BPA and/or BPA Call.

The Contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed by this Section and within his authority under the provisions of this Section. If, in the opinion of the Contractor, any instruction or direction issued by the COR is within one of the categories as defined in (1) through (4) above, the Contractor shall not proceed but shall notify the Contracting Officer within five (5) working days after receipt of any such instruction or direction and shall request the Contracting

Officer to modify the contract accordingly. Upon receiving such notification from the Contractor, the Contracting Officer shall issue an appropriate contract modification or advise the Contractor in writing that, in his opinion, the technical direction is within the scope of this Section and does not constitute a change under the Changes article of the contract. The Contractor shall thereupon proceed immediately with the direction given. A failure of the parties to agree upon the nature of the instruction or direction or upon the contract action to be taken with respect thereto shall be subject to the provisions of the Disputes clause (FAR 52.233-1).

D - PACKAGING AND MARKING

D.1 Packing, Packaging and Storage of Equipment

See individual BPA Calls for Packing, Packaging and Storage of Equipment Instructions.

D.2 Markings

See individual BPA Calls for Marking Instructions.

(End of Section D)

SECTION E - INSPECTION AND ACCEPTANCE

E.1 FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text. Upon request, the CO will make their full text available. Also, the full text can be accessed electronically at the following internet address:

http://www.acquisition.gov/far.

FAR Clause

Title and Date Date

52.246-2 Inspection of Supplies – Fixed Price Aug 1996

52-246-4 Inspection of Services—Fixed Price Aug 1996

52.246-6 Inspection of Supplies – Time-and-Material and Labor-Hour May 2001

52.246-16 Responsibility for Supplies Apr 1984

E.2 OPM Responsibilities

OPM will inspect all deliverables for acceptance. Acceptance is contingent upon deliverables meeting all requirements outlined in the BPA Call. OPM will issue written comments concerning deliverables and identify all acceptance-delaying issues within five (5) workdays unless otherwise specified in the BPA Call.

Absent written notification, it is the responsibility of the contractor to confirm receipt and acceptance of the deliverable(s). All notifications of rejection will be accompanied with an explanation of the specific deficiencies causing the rejection.

Contractor Responsibilities The Contractor shall provide a final report responding to comments/issues within five (5) workdays from the date of receipt of comments/issues from OPM.

E.3 Scope of Inspection

All deliverables will be inspected for content, completeness, accuracy, and conformance to BPA Call requirements by the OPM or the customer agency, or as otherwise detailed in the requirements for individual BPA Calls. Inspection may include validation of information or software through the use of automated tools and/or testing of the deliverables, as specified in the requirements for each BPA Call. The scope and nature of this testing must be negotiated prior to award and will be sufficiently comprehensive to ensure the completeness, quality and adequacy of all deliverables.

E.4 Basis of Acceptance

The basis for acceptance shall be in compliance with the requirements set forth in the Statement of Objectives, the Contractor's proposal and other terms and conditions in the BPA.

Deliverable items rejected under any BPA Call shall be corrected in accordance with the applicable clauses.

(End of Section E) http://www.acquisition.gov/far

SECTION F - DELIVERIES OR PERFORMANCE

F.1 FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text. Upon request, the CO will make their full text available. Also, the full text can be accessed electronically at the following internet address:

http://www.acquisition.gov/far/ and http://farsite.hill.af.mil/VFHSARA.HTM

Title and Date Date

52.242-15 Stop-Work Order Aug 1989

F.2 Term of the Contract The period of performance shall include a one-year base period and four (4) one-year option periods.

F.3 Notice to the Government of Delays

In the event the Contractor encounters difficulty in meeting performance requirements, or when it anticipates difficulty in complying with the contract delivery schedule or completion date, or as soon as the Contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of requirements under this BPA, the Contractor shall immediately notify the BPA Call CO and the customer agency in writing. This notification shall give pertinent details and this data shall be informational only in character; this provision shall not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this BPA.

F.4 Deliverables

All deliverables must meet professional standards and the requirements set forth in the BPA and the resultant BPA Call(s). The Contractor will be responsible for delivering all end items specified in the requirements for BPA Call(s).

All applicable BPA Call deliverables, their required delivery dates, destination of delivery, and schedule for completion of work to be performed will be specified in requirements for BPA Calls issued under this BPA, as applicable.

Each BPA-level and BPA Call-level deliverable shall be accompanied by a cover letter from the Contractor on Company letterhead. Multiple deliverables may be delivered with a single cover letter describing the contents of the complete package.

F.5 Quality Assurance Surveillance Plan (QASP) Requirements

OPM will employ a Quality Assurance Surveillance Plan (QASP) to evaluate contractor performance under the contract. A BPA QASP is included as Attachment 1 to this solicitation;

however, OPM reserves the right to issue revised, customized QASPs for each BPA Call Proposal Request specifically addressing the requirements contained in a particular Call, or to require that the contractor to propose a QASP associated with a particular requirement as part of their response to a BPA Call Proposal Request.

http://www.acquisition.gov/far/ http://farsite.hill.af.mil/VFHSARA.HTM

In this case, a Quality Assurance Surveillance Plan (QASP) will be incorporated at the BPA Call level. The Government will evaluate the Contractor‘s performance under this contract using the method of surveillance deemed appropriate. If the CO and/or COR determines contract provisions are not being met, the discrepancy will be brought to the attention of the Contractor for correction.

If the Contractor fails to correct any deficiencies under the contract, the Government shall have the right to (1) require the Contractor to immediately take all the necessary steps to ensure performance of the service in conformity with the requirements of the contract, and (2) reduce the monthly fee payable under the contract by the amount to reflect the reduced value of the services performed, or (3) have the necessary work accomplished by the Government forces or other means, and reduce the Contractor‘s payment in the amount of the expenses incurred.

(End of Section F)

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 Primary Government Roles and Responsibilities

The following subsections describe the roles and responsibilities of individuals and/or authorized users who will be the primary Points of Contact (POC) for the Government on matters regarding contract administration as well as other administrative information. The Government reserves the right to unilaterally change any of these individual assignments at any time.

G.1.1 Government Personnel

G.1.1.1 Contracting Officer

The Contracting Officer (CO) has the overall responsibility for the administration of this BPA and BPA Calls. The CO alone, without delegation, is authorized to take actions on behalf of the Government to: amend, modify or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for nonperformance or unsatisfactory performance; terminate the contract for convenience or default; issue final decisions regarding contract questions or matters under dispute.

The CO may, however, delegate certain other responsibilities to the Contract Specialist or Contracting Officer's Representative (COR).

The Contract Specialist has the overall responsibility for the day-to-day administration of the contract including preparation of contract documents, communication with the Contractor‘s staff regarding contract administrative or performance measures, review and processing of invoices, conduct of initial negotiations on contract services when required, and issuance of delivery orders for any optional services.

Name: To Be Determined Address: Office of Personnel Management (OPM)

1900 E Street, N.W. Room 1342 Washington, DC 20415

Email: To Be Determined Telephone Number: To Be Determined

G.1.1.2 Contracting Officer’s Representative (COR) – BPA

General Responsibilities: The COR performs two critical functions on behalf of the CO: monitoring/documenting/reporting on the contractor's performance and providing expert technical advice to both the CO and the contractor on matters related to contract performance.

Name: To Be Determined Address: Office of Personnel Management (OPM)

1900 E Street, N.W. Room 1342 Washington, DC 20415

Email: To Be Determined Telephone Number: To Be Determined

G.1.1.3 Contracting Officer’s Representative (COR) – BPA Calls

General Responsibilities: For programs or contracts that require more extensive oversight, the CO may appoint a BPA Call COR. The BPA Call COR shall provide expert technical advice for the associated BPA Call. The BPA Call COR shall provide general oversight responsibilities (i.e., monitoring/documenting/reporting on contractor performance).

G.1.2 Contractor Personnel

G.1.2.1 Contractor's Program Point of Contact

Within 15 business days after award of the BPA and each BPA Call, the Contractor shall provide OPM with a primary technical and contractual points of contact (POC) and alternate POCs. The POCs will be fully qualified to represent the firm on all matters concerning the performance and management of the BPA/BPA Call. The POC or alternate POC is expected to be available on a reasonable notice to attend occasional meetings with OPM officials either in person, by phone, or other electronic media as agreed between the Government and the Contractor. The Contractor shall update their POC on annual basis or within 15 days of any change.

(End of Section G)

SECTION H – SPECIAL CONTRACTING REQUIREMENTS

H.1. Special Statutory Provisions of Client Agencies

Certain BPA Calls may include special statutory provision that affect certain client agencies that acquire LMS support under this agreement. An example of these special provisions is provided below. Special statutory provisions will be identified in the BPA Call.

Example - Department of Veterans Affairs requires Provision 38 USC 5725 as follows:

(a) Contract Requirements. If the Secretary enters into a contract for the performance of any Department function that requires access to sensitive personal information, the Secretary shall require as a condition of the contract that—

(1) the contractor shall not, directly or through an affiliate of the contractor, disclose such information to any other person unless the disclosure is lawful and is expressly permitted under the contract;

(2) the contractor, or any subcontractor for a subcontract of the contract, shall promptly notify the Secretary of any data breach that occurs with respect to such information.

(b) Liquidated Damages. Each contract subject to the requirements of subsection (a) shall provide for liquidated damages to be paid by the contractor to the Secretary in the event of a data breach with respect to any sensitive personal information processed or maintained by the contractor or any subcontractor under that contract.

(c) Provision of Credit Protection Services. Any amount collected by the Secretary under subsection

(b) shall be deposited in or credited to the Department account from which the contractor was paid and shall remain available for obligation without fiscal year limitation exclusively for the purpose of providing credit protection services pursuant to section 5724 (b) of this title.

(End of Section H)

SECTION I - CONTRACT CLAUSES

I.1 FAR 52.252-2 Clauses…