PCCA-23-00012 CISA DTSS Statement of Work 3-9-23_.docx

PCCA-23-00012

DEPARTMENT OF HOMELAND SECURITY (DHS)

STATEMENT OF WORK (SOW)

FOR

Cybersecurity and Infrastructure Security (CISA) Digital Transformation Support Services (DTSS)

1.0 GENERAL

1.1 BACKGROUND

CISA’s mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the CISA Mission Enabling Offices (MEOs) and six Divisions: the Cybersecurity Division (CSD), the Emergency Communications Division (ECD), the Integrated Operations Division (IOD), Infrastructure Security Division (ISD), the Stakeholder Engagement Division (SED), as well as, the National Risk Management Center (NRMC), which are headquartered within the National Capital Region (NCR).

1.2 Blanket Purchase Agreement (BPA) Structure

This BPA will be fulfilled through Call Orders for support services across the various task area requirements within the Statement of Work (SOW). The following sections describe the high-level scope of the overarching BPA and task areas. Any combination and volume of functional area services may be acquired for a given Call Order according to the government’s instructions and scope of work. Individual Call Orders may include one or more task areas and may include either firm fixed price (FFP), time and materials (T&M), or labor hour (LH) orders, depending on the scope and timelines of the products and services required. Given the importance of long-term success for this effort, it is suggested that the term of the BPA would be a 12-month Base Period, followed by four 12-month option period.

1.3 SCOPE

Given the dynamic nature of the CISA mission and significant increase in both authorities and funding, the scope is intended to be both broad and flexible in accommodating unforeseen change across CISA to include CISA OCIO, MEOs and Divisions. CISA requires digital transformation support services, which include the following:

· Providing support for organizational governance and delivery of core enterprise capabilities.

· Being able to have a consistent baseline of service excellence measured by impact to productivity and responsiveness of CISA headquarters teams and CISA mission Divisions to cybersecurity and infrastructure preparedness initiatives.

· Establishing OCIO as a source for cross-agency coordination and collaboration on established and emerging technology needs that impact CISA’s mission demands.

· Having the capability for mission focused, data driven innovation, including methods for rapid evaluations, testing and adoption of new technologies.

· Having the ability to establish transparency and accountability in the planning, delivery, and completion of large-scale enterprise- wide IT initiatives.

· Giving CISA the capability for enterprise IT management practices and capabilities to reflect current trends in project management, infrastructure cybersecurity, service delivery, and cloud adoption.

· Being capable to innovate and rapidly execute as a unified agency across mission divisions.

· Being able to structure, control the process and manage the overall capability for IT infrastructure for rapid responsiveness to emerging threats and technology capabilities.

The SOW consists of five (5) Task Areas:

· Task Area 1: Program Management

· Task Area 2: Transformation Strategy, Enablement, and Service Experience Support

· Task Area 3: Digital Solution Development, Automation, and Infrastructure Support

· Task Area 4: Enterprise Data Management and Analytics Support

· Task Area 5: Operations and Sustainment

1.4 OBJECTIVE

CISA is seeking to implement innovative transformation technologies and support services to establish and acquire CISA Digital Transformation Support Services with individual Call Orders to address several current and anticipated challenges across the agency such as the following:

· Lack of CISA centrally developed and deployed digital services- As the mission and requirements of the agency continue to evolve, CISA must have the flexibility and agility to centrally innovate, and deploy digital services at speed.

· Disparate business and mission systems- Core business systems vary widely across the agency which leads to incapability and inconsistency of systems. This impacts CISA’s ability to integrate the organization, streamline business operations, and maintain visibility into the status of basic business operations.

· Disparate data management, analytics, and collaboration environments- CISA data assets are spread across and outside the agency. CISA collaboration environments vary across the agency and, in most cases are inoperable and not consistent. This impacts CISA’s ability to achieve its full mission through an operating model that enables an agency-wide approach to operational issues.

· Insufficient mechanisms to move quickly- CISA has access to commodity-type IT services but lacks a CISA owned contract vehicle with the mechanism to quickly add technical SMEs and standup digital services required to test, prototype, and transform the agency’s IT capabilities rapidly.

· Enterprise IT governance and stakeholder engagement- CISA requires the ability to engage internal agency stakeholders, identify common needs, and plan and implement enterprise-wide solutions in a coordinated manner.

1.5 PERIOD OF PERFORMANCE

1.6 PLACE OF PERFORMANCE

The primary place of performance will be a combination of the Contractor’s facilities and the CISA facilities in the Washington, DC Metro Area.

1.7 HOURS OF OPERATION

Contractor employees shall generally perform all work between the hours of 0800 and 1600 ET, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this SOW.

The Contractor shall typically work eight hours a day, 5 days a week, but may be required to work beyond this typical schedule. Any alterations to the work schedule shall be negotiated with the COR. Contractor personnel shall be available for weekend and after-hours work as directed by the COR and may be called upon for after-hours emergencies.

1.8 HOLIDAYS AND ADMINISTRATIVE LEAVE

CISA personnel observe the following days as holidays (non- business):

Independence Day

CISA personnel also observe any other day designated by Federal statute, Executive Order, or the President’s proclamation. When any observed holiday falls on a Saturday, the preceding Friday is observed. When any such day falls on a Sunday, the following Monday is observed. Observance of such days by Government personnel shall not be cause for an extension to the delivery schedule, period of performance, or adjustment to the price, except as set forth in the Call Order. Except for designated around-the-clock or emergency operations, Contractor personnel will not, without written consent from the COR, be able to perform work on-site under the Call Order with CISA on the holidays set forth above. The Contractor will not charge any holiday as a direct charge to the Call Order. In the event that Contractor personnel work during a holiday other than those listed above, no form of holiday or other premium compensation will be reimbursed as either a direct or indirect cost.

In the event CISA grants administrative leave to its Government employees at the site, on-site Contractor personnel shall also be dismissed if the site is being closed. However, the Contractor shall continue to provide sufficient personnel to perform critical efforts already in progress or scheduled and shall be guided by the instructions issued by the Call Order or her/his duly appointed representative. In each instance when the site is closed to Contractor personnel as a result of inclement weather, potentially hazardous conditions, explosions, or other special circumstances, the Contractor shall direct its staff as necessary to take actions such as reporting to its own site(s) or taking appropriate leave consistent with its policies. The cost of salaries and wages to the Contractor for the period of any such site closure are a reimbursable item of direct cost under the contract order for employees whose regular time is normally a direct charge if they continue to perform contract work; otherwise, costs incurred because of site closure are reimbursable as indirect costs in accordance with the Contractor’s established accounting policy.

Work may only be performed on a Federal holiday and/or at the Contractor’s site with prior written consent of the COR.

1.9 OVERTIME

This contract is subject to the Services Contract Act of 1965. Contractor personnel may not work more than forty (40) hours a week without prior written approval of the COR. Approved overtime hours shall be invoiced at the normal hourly rate for this effort.

1.10 TRAVEL

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

1.11 APPLICABLE DOCUMENTS

1.11.1 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this BPA:

1. Federal Information Security Management Act of 2014 https://www.gpo.gov/fdsys/pkg/PLAW-113publ283/pdf 3.pdf

2. Section 508 of the Rehabilitation Act of 1973 (amended) https://www.gpo.gov/fdsys/pkg/USCODE-2011-title29/html/USCODE-2011-title29- chap16-subchapV-sec794d.htm

3. Federal Travel Regulations, General Services Administration https://www.gsa.gov/policy- regulations/regulations/federal-travel-regulation-ftr?asset=105444

4. Government Performance Results Act of 1993 https://www.gpo.gov/fdsys/pkg/STATUTE- 107/pdf/STATUTE-107-Pg285.pdf

5. FIPS-140-2 Security Requirements for Cryptographic Modules.

6. FIPS-199 Standards for Security Categorization of Federal Information and Information systems.

7. NIST SP800-53 rev 4 Security and Privacy Controls for Federal Information Systems and Organizations.

8. DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified Information

9. DHS Management Directive 4300A Policy Directive (Version 13.2, September 20, 2022)

10. DHS Management Directive 142-02-001 Information Technology Integration & Management

11. DHS Instructions 102-01-103 System Engineering Life Cycle (SELC)

12. DHS Management Directive 140-01 Information Technology Security Program Revision 2

13. DHS Management Directive 034-01 Geospatial Management

14. DHS Section 508 Compliance Test Process for Applications https://www.dhs.gov/publication/dhs-section-508-compliance-test-processes

15. DHS Directive 102-01 Acquisition Management Policy

16. DHS Instructions 102-01-001, Rev 01 Acquisition Management Instruction

17. DHS Management Directive 11056.1, Sensitive Security Information (SSI)

18. DHS Directive Number 121-01-001, Organization of the Office of the Chief Security Officer, DHS Instruction 121-01-011 DHS Administrative Security Program

19. DHS Instruction 121-01-007-01 Department of Homeland Security Personnel Security, Suitability and Fitness Program

20. DHS Privacy Incident Handling Guide, Version 3.0, January 26, 2012

21. DHS Instruction 047-01-001 Privacy Policy and Compliance

22. DHS Privacy Policy Guidance Memorandum 2011-02 Roles and Responsibilities for Shared IT Services

23. DHS Privacy Policy Guidance Memorandum 2008-02, DHS Policy Regarding Privacy Impact Assessments, December 30, 2008

24. DHS Instruction Manual 047-01-007, Rev # 03 Handbook for Safeguarding Sensitive Personally Identifiable Information; Handbook for Safeguarding Sensitive Personally Identifiable Information March 2012

25. DHS Instruction 047-01-001 Privacy Policy and Compliance

26. Directive Memorandum 140-09 DHS Privacy Impact Assessment Guidance

27. DHS System of Records Notices Official Guidance, April 2008

28. DHS 4300a ver. 13.2, September 20, 2022-4.8.3.b Non-government furnished equipment restriction

29. DHS 4300A DHS Sensitive Systems Policy Directive, (Version 13.2, September 20, 2022)

30. DHS Instruction Number 264-01-002, Rev 01, DHS Counterintelligence Program

31. DHS Policy Directive 121-08 Requirements for Security Review of Foreign National Assignments and Overseas Employment

32. DHS Instructions Guide 026-06-001 Test and Evaluation Master Plan (TEMP)

33. DHS Procedures for Operational Test and Evaluation of Cybersecurity

34. DHS Management Directive (MD) 4010.2: Section 508 Program Management Office Electronic and Information Technology Accessibility.

35. Homeland Security Enterprise Architecture (HLS EA), current version.

36. Office of Management and Budget M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” May 22, 2007

1.11.2 Reference Documents

The following documents may be helpful to the Contractor in performing the work described in this document:

· Federal Information Technology Acquisition Reform Act (FITARA), 2015: [footnoteRef:2] [2: Title VIII, Subtitle D of the National Defense Authorization Act (NDAA) for Fiscal Year 2015, Pub. L. No. 113-291. ]

· Provides the statutory basis for Federal-wide IT reform

· Federal Information Technology Shared Services Strategy, May 2, 2012: [footnoteRef:3] [3: https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/shared_services_strategy.pdf. ]

· Provides organizations in the Executive Branch of the United States Federal Government (Federal Agencies) with policy guidance on the full range and lifecycle of intra- and inter-agency IT shared services that enable mission, administrative, and infrastructure-related IT functions.

· Federal CIO 25 Point Implementation Plan to Reform Federal Information Technology Management, Dec 9, 2010: [footnoteRef:4] [4: https://www.dhs.gov/sites/default/files/publications/digital-strategy/25-point-implementation-plan-to-reform-federal-it.pdf]

· Specifies that “Agencies must focus on consolidating existing data centers, reducing the need for infrastructure growth by implementing a Cloud First policy for services, and increasing the use of available cloud and shared services”.

· Federal Risk and Authorization Management Program (FedRAMP): [footnoteRef:5] [5: https://www.fedramp.gov/about-us/about/]

· Provides joint "provisional" authorizations and continuous security monitoring services applicable to “Executive departments and agencies procuring commercial and non-commercial cloud services that are provided by information systems that support the operations and assets of the departments and agencies, including systems provided or managed by other departments or agencies, contractors, or other sources”.

· Federal Cloud Computing Strategy, Feb 8, 2011: [footnoteRef:6] [6: https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/federal-cloud-computing-strategy.pdf]

1.11.3 DHS Enterprise Architecture Compliance

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following HLS EA requirements:

· All developed solutions and requirements shall be compliant with the HLS EA.

· All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

· Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

· Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01 and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

· Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

1.11.4 Geospatial Information System Terms and Conditions

All implementations including geospatial data, information, and services shall comply with the policies and requirements set forth in the DHS Geospatial Information Infrastructure (GII), including (but not limited to) the following:

- All data built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Data Reference Model.

- All software built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Technical Reference Model.

1.11.5 OCIO CISA CYBER-SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) TERMS & CONDITIONS

0. The Offeror understands and agrees that the Government retains the right to cancel or terminate the Contract, if the Government determines that continuing this solicitation presents an unacceptable risk to national security.

0. “Gray-Market” Equipment

1. The Offeror shall provide only new equipment unless otherwise expressly approved, in writing, by the DHS Contracting Officer. Offerors shall provide only Original Equipment Manufacturer (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

1. The Offeror shall be excused from using new OEM (i.e., "gray market”, "previously used”) components only with formal Government approval, in writing, from the DHS Contracting Officer. Such components shall be procured from their original source and shipped only from the manufacturer’s authorized shipment points.

1. All equipment obtained by the Offeror on behalf of the Government will need to be provided to OIG OCIO for review to validate requirements and approved Contractors by DHS.

0. Hardware and Software Requests

2. The contractors supply the Government hardware and software will provide the manufacturer’s name, address, state, and/or domain of registration, and the UEI number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and UEI number of those suppliers must be provided.

2. Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors will perform due diligence to ensure that these standards are met.

2. The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

2. For software products, the Offeror shall provide all OEM software updates to correct defects for the life of the product (i.e., until the “End of Life (EoL)"). Software updates and patches shall be either: made available to the government for all products procured under this Contract, replaced upon End of Support (EoS) is reached, or formally waived (in writing) by the DHS Contracting Officer.

0. Supply-Chain Transport

3. Offerors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill Contract obligations with the Government.

3. All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the Contract, the period of performance, or one calendar year from the date the activity occurred.

3. This transit process shall minimize the number of times in route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government's request, shall be able to provide shipping status at any time during transit.

3. All records pertaining to the transit, storage, and delivery shall be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

3. The Offeror is fully liable for all damage, deterioration, or losses incurred during shipping and handling, unless the damage, deterioration, or loss is due to the Government.

3. The Offeror shall provide a packing slip which shall accompany each container or package with the information identifying this solicitation number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact.

3. The Offeror shall send a shipping notification to the intended government recipient; with a copy transmitted via email to the Contracting Officer, or designated representative. This shipping notification shall be sent electronically and will state this solicitation number, the order number, a description of the hardware/software being ship (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

0. Notifications

4. The Offeror shall notify DHS Contracting Officer, COR and the Office of the Chief Information Officer and the DHS component Chief Information Officer through the Enterprise Security Operations Center (ESOC) directly of any suspected or potential violations of Section 889 of the National Defense Authorization Act (NDAA) for Information Communications Technology (ICT) at NDAA_Incidents@hq.dhs.gov.

0. Foreign Equities The Offeror shall immediately notify the DHS Contracting Officer, COR that will report to the Office of the Chief Security Officer (OCSO) or cognizant component personnel security office regarding any changes to corporate foreign ownership, control, or influence.

1.11.6 EPEAT and Energy Star Language

“All hardware procured directly or in support of this action must meet applicable and appropriate Electronic Product Environmental Assessment Tool (EPEAT) and ENERGY Star standards.”

1.11.7 THE HOMELAND SECURITY PRESIDENTIAL DIRECTIVE 12 (HSPD-12)

The Homeland Security Presidential Directive 12 (HSPD-12) requires the use of the Personal Identity Verification (PIV) credentials as the common means of authentication for access to DHS facilities, networks, and information systems. Personal Identity Verification (PIV) credentials shall be used as the primary means of logical authentication for DHS sensitive systems. The Contractor must use his or her federal issued Personal Identity Verification (PIV) credentials to access DHS resources to include IT applications and physical facility.

The DHS Security Office shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Representative (COR) all DHS issued Personal Identity Verification (PIV) credentials/identification cards and building passes that have either expired or have been collected from terminated employees. If a PIV credential/identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the PIV credential, pass or card number, name of individual to who it was issued and the last known location and disposition of the PIV credential, pass or card."

1.12 TRAINING

All contract personnel are required to complete the CISA mandatory training courses by the mandatory due date(s). The Contractor is responsible for maintaining records of contracting employees that have completed the mandatory training and provide semimonthly updates to the COR on the 1st and 15th day of each month or the next business day if the 1st or 15th is a Holiday or on the weekend. The Contractor is also responsible for providing copies of the training certificates to the COR when requested.

1.13 CLEARANCE PROCESS

The following information is provided to prospective offerors who have never worked with CISA before, or for those who do not have knowledge of the background investigation process. Information provided is based upon averages, and is meant to provide a basis for estimating the time it may take to clear resources and begin work.

The background investigation (BI) process within the CISA begins when the contractor submits the Contract Employee Initial Background Investigation Form (Form 77), Background Investigations Requirements Determinations (BIRD) form, Fair Credit Reporting Act release form and the new contractor information sheet to the Government. The Government approved paperwork is then submitted to Internal Affairs (IA) for a determination regarding whether the applicant is eligible for 1) reciprocity, or 2) needs to be invited into e-QIP. CISA IA will review the BIRD request, along with attachments, to conduct the appropriate systems check to render the appropriate determination, i.e., initiation required, reciprocity eligible, reactive, reciprocity revoked. This determination process takes approximately 1 week.

1) If candidate is eligible for reciprocity, the process to a full background investigation averages about 1 month.

2) If the determination rendered was “Initiation Required” or “Reciprocity Revoked”, the Government will be responsible for taking the appropriate action to allow the applicant access to e‐QIP. The applicant will need to complete e-QIP, financial disclosure forms and fingerprint cards. This process takes approximately one week, however the applicant has up to 30 days. All forms are submitted to the Government for review. If all forms and e-QIP are completed, the BI package is submitted to IA. If not, e-QIP is rejected and must be corrected. After submitting the BI package to IA, the BI is conducted. An Interim BI is the next step in the process and averages approximately 30-45 days. A full BI averages approximately 60-90 days after the Interim BI is granted. Please note that this is the best case scenario, applicants may drop into Delay, which means that more documentation is required for the BI to be completed. Delayed applicants can remain in delay for many months and may be found unsuitable and therefore unable to be hired onto the contract. From submission of documentation to a delay determination usually averages one to two months.

Overall, the average time to receive a Full BI, from submission of the required BI documents, is 104 days. This time estimate is furnished for the purposes of indicating the time required to obtain CISA BI cleared personnel. This is the Government’s estimate and is not intended to be binding on either party or to be the only possible scenario.

2.0 SPECIFIC REQUIREMENTS/TASKS

Contractor access to classified information is not currently required under the resulting BPA. However, the Government, at a later date, may have Call Orders that require Contractor personnel to have up to Top Secret/SCI clearances. Details will be specified in a DD Form 254 in the individual Call Order.

2.1 TASK AREA ONE. Program Management

The Contractor shall provide services to continuously manage and track adequate levels of project management, technical resources, quality assurance, scheduling, cost, budget, and financial controls throughout the performance of this BPA. The Contractor shall plan, direct, control, measure, monitor, and report to the Government on all activities of the working requirements. The Contractor shall ensure that all personnel are provided the necessary program management tools, guidance, plans, processes, procedures, and resources that shall enable the Contractor to comprehensively manage the BPA and individual Call Orders.

2.1.1 Contractor Transition-In

The Contractor transition-in period shall begin upon receipt and acceptance of the contractor’s Transition Plan by the Contracting Officer (CO). The transition-in period shall cause no disruption in development and especially Operational & Maintenance (O&M) services of existing applications.

The approved transition-in plan and schedule (updated to reflect any agreements made at the Kickoff Meeting) shall be submitted to the CO/Contracting Officer’s Representative (COR) within 10 days after Kick Off meeting unless otherwise directed by the CO. The Contractor shall account for 5 working days of Government review and approval of the transition backlogs prior to executing the transition.

The Transition Plan should include, at minimum:

· Contractor shall agree that all deliverables, products, licenses, designs, data, documentation, tests, user research notes, source code, configuration settings and files, and materials developed throught this BPA will be the property of CISA

· Transition roadmap

· Identify transition risks and risk mitigation

· Define roles and responsibilities with an initial Staffing Plan

· Define a knowledge transfer approach

· Provide checklist of transition activities and milestones

· Schedule of events and timelines

· Communication Plan/Strategy

· Innovation and Research methodology/strategy

· On-Call / Production Support Strategy

The contractor transition-in progress shall be provided in the weekly status report and provide information on all requirements in the transition-in plan. The Government reserves the right to call meetings at any time during the transition-in period to review all transition requirements.

2.1.2 Weekly Status Reporting

The Contractor shall provide a Weekly Status report to the COR and all Technical Monitors (if assigned) via electronic mail on a weekly basis (Monday from the previous week). This report shall include a summary of all Contractor work performed, an assessment of technical progress, schedule status, meetings attended, and any Contractor concerns or recommendations for the previous period.

Weekly status reports shall reflect the status of each task, at a minimum:

a) Reporting period;

b) Progress/status;

c) Current week activities;

d) Risk and Mitigation Strategy; and,

e) Forecast of next week’s activities to include any anticipated risks or problems, along with recommended mitigation strategies.

2.1.3 Monthly Financial Report:

The Contractor shall submit a Monthly Financial Report by the 25th of the month to the COR via electronic mail at the time of Invoicing.

2.1.4 Organizational Charts

The contractor shall provide and maintain an Organizational Chart monthly showing resource assignments and coverage for in-scope applications. As the priorities and requirements drive re-assignments, the Organizational Chart shall be updated and submitted to the COR by the 25th of the month.

2.1.5 Contractor Transition-Out

At the completion of performance of this BPA, the Contractor shall fully support the transition-out of the Contractor’s work that is turned over to another entity, either Government or a successor offeror(s). The Contractor shall assist with transition planning and shall comply with transition milestones and schedule of events.

The Contractor shall be responsible for the implementation of the transition and application cut over activities.

The Contractor shall be responsible for the transition-out of all technical activities identified in this BPA. As part of the transition-out, the Contractor shall be responsible for:

· Inventory and orderly transfer of all Government Furnished Property (GFP), to include hardware, software, and licenses, Contractor Acquired Government Property, and Government Furnished Information (GFI)

· Transfer of documentation currently in process

· Transfer of all software code in process

· Exchange of accounts to access software and hosted infrastructure components

· Participate in knowledge transfer activities in accordance with the transition plan

· Provide members to participate in transition management

· Identify transition risks and risk mitigation

The Contractor shall submit a Transition-Out Plan to the CO/COR, 120 days prior to the BPA or Call Order expiration date. The Transition-Out Plan shall include support activities for all transition-out efforts for follow-on requirements to minimize disruption of services. The Transition-Out Plan shall:

· Identify equipment, hardware, software, documents, and other artifacts that are included in the transition

· Establish roadmap and backlogs

· Identify transition risks and risk mitigation

· Define roles and responsibilities

· Define transition approval authorities and lines of communication

· Define a knowledge transfer approach

· Define a property inventory and transition approach

· Create bi-party or tri-party agreements

· Provide checklists

· Transition milestones and schedule of events

The Contractor shall account for a 10-business day Government review process prior to executing the transition. Upon award of a follow-on BPA or Call Order, the incumbent Contractor will work with the new Contractor to provide knowledge transfer and transition support, as required by the COR and Program Manager and/or Project Manager.

2.2 TASK AREA TWO. Transformation Strategy, Enablement, and Service Experience Support

CISA is seeking to establish cross-program consistency, reuse, common architectures, security standards and other scalable practices for solutions that are used across the agency. To maximize the potential of current and planned IT capabilities, CISA requires transformation strategy and enablement, and service experience support services to centrally establish required standards and services and enable adoption across currently disconnected programs and mission groups. The contractor will augment an existing staff of both Government and other contractors and will facilitate as integrators working together cohesively across function and organizational boundaries. The contractor shall develop and implement a standardized framework for engaging CISA teams and stakeholders, CISA information system users, and mission stakeholders to identify priorities, improve service design effectiveness, and establish consistent end user experiences. The contractor shall provide design thinking and user experience strategy, consulting, design, and implementation support to CISA teams with a concentration on organizational effectiveness, accountability, and continuous improvement in service delivery.

Except as provided under 6 U.S.C. 396, no entity performing lead system integrator functions in the acquisition of a major system (See (HSAR) 48 CFR 3002.101) by DHS may have any direct financial interest in the development or construction of any individual system or element of any system of systems under the program in which the entity is performing lead system integrator functions.

2.3 TASK AREA THREE. Digital Solution Development, Automation, and Infrastructure Support

CISA requires flexibility and agility to innovate, deploy and evolve capabilities at speed as its mission and agency requirements continue to evolve in its execution of infrastructure and system architecture, design, implementation, integration, and maintenance. The Contractor shall support CISA with the adoption of new digital solutions to support achieving the economies of scale that support the business case for digital platforms and requires support to achieve CISA’s goals. The contractor shall employ Development, Security, and Operations (DevSecOps) with the use of principles such as Infrastructure as Code (IAC) and Continuous Integration/Continuous Deployment (CI/CD) pipelines to make infrastructure environments available on demand with the necessary security accreditation built in to provide the delivery of mission and business value to end users with higher quality solutions and technical maturity. The Contractor’s software development shall be delivered in an incremental, fast-pace style to reduce the risk of failure. The Contractor shall deliver working software into users’ hands as early as possible to give the design and development team opportunities to adjust based on user feedback about the service. A critical capability is being able to automatically test and deploy the service so that new features can be added often and be put into production easily. Development practices shall employ practices such as design and code in sections, automated testing, verifying code against Common Weakness Enumeration (CWE), Common Vulnerabilities Exposures (CVE), Open Worldwide Application Security Project (OWASP) to identify and remedy code vulnerabilities, test automation, issue resolution, and prototyping.

2.4 TASK AREA FOUR. Enterprise Data Management and Analytics Support CISA requires transparency into decision-making with data-driven technical and organizational approaches. The contractor shall support establishing and implementing a comprehensive CISA data architecture, the design and engineering of consolidated and consistent cross-agency data management solutions, development and deployment of data integration analytics solutions, and the design and development of end-user data visualization capabilities for CISA stakeholder organizations. The Contractor shall provide technology solutions which enable development teams to work efficiently and enable services to scale easily and cost-effectively. Recommendations for choices for hosting infrastructure, databases, software frameworks, programming languages and the rest of the technology stack shall seek to avoid vendor lock-in and match what successful modern consumer and enterprise software companies would choose today. In particular, the vendor shall consider using open source, cloud-based, and commodity solutions across the technology stack.

2.5 TASK AREA FIVE. Operations and Sustainment

The Contractor shall perform ongoing operations and standardization of CISA Operations and Maintenance for cloud-based Software of a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) solutions, where required, to allow end-user insights and operational feedback to guide continuous improvement of the platform configurations and feature sets. Cloud-based solutions may include but is not limited to those utilizing Amazon Web Service (AWS), Microsoft Azure, Google Cloud Platform, ServiceNow, Atlassian, Appian, Apple AppStore, and Google Play Store. The Contractor shall deploy services on a flexible infrastructure, where resources can be provisioned in real-time to meet spikes traffic and user demand. The Contractor shall perform defect resolution and corrective maintenance categorized as break/fix. In instances where newly developed or enhanced applications interact with legacy systems, the Contractor is expected to collaborate with the legacy maintainer to troubleshoot issues and provide information to the Government. The Government and the Contractor shall collaborate and identify what corrective action is required.

2.6 POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the CO and COR no later than 14 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the CO, is to discuss technical and contracting objectives of this BPA and review the Contractor's draft project plan. The Post Award Conference will be via teleconference.

2.7 PROJECT PLAN

The Contractor shall provide a draft Project Plan at the Post Award Conference to the CO/COR for review and comment. The Contractor shall provide a final Project Plan to the CO/COR not later than 14 business days after the date of Post Award Conference.

2.8 BUSINESS CONTINUITY PLAN (BCP)

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the CO/COR. The BCP shall be due 15 business days after the date of award and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

· A description of the Contractor’s emergency management procedures and policy

· A description of how the Contractor will account for their employees during an emergency

· How the Contractor will communicate with the Government during emergencies

· A list of primary and alternate Contractor points of contact, each with primary and alternate:

· Telephone numbers

· E-mail addresses

2.8.1 Individual BCPs shall be activated immediately after determining that an emergency has occurred, shall be operational within 4 hours of activation or as directed by the Government, and shall be sustainable until the emergency is resolved and normal conditions are restored or the BPA is terminated, whichever comes first. In case of a life threatening emergency, the COR shall immediately make contact with the Contractor Program Manager to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, the Contractor Program Manager and the COR shall promptly open an effective means of communication and verify:

· Key points of contact (Government and contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

· Essential Contractor work products expected to be continued, by priority

2.9 The Government and Contractor Program Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances. Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this BPA. Regardless of Call Order type, and of work location, Contractors performing work in support of authorized tasks within the scope of their BPA shall charge those hours accurately in accordance with the terms of this BPA.

2.9 WEEKLY PROGRESS REPORTS (WSR)

The Program Manager shall provide a weekly progress report to COR via electronic mail no later than 2:00 PM EST. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

2.10 PROGRESS MEETINGS

The Program Manager shall be available to meet with the CO or COR upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place at the Government's facility or via teleconference.

2.11 GENERAL REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Microsoft Office Applications).

2.12 INTELLECTUAL PROPERTY

All Contractor developed information, tools, processes, procedures and other forms of intellectual property developed during this BPA shall be Government property. All documentation and electronic data and information collected by the Contractor and generated in support of this BPA shall be Government property and shall be returned to the Government at the end of the performance period or when specified in the BPA and each individual Call Order.

2.13 PROTECTION OF INFORMATION

The Government will provide all necessary information, data, and documents to the Contractor for work required under this BPA.

The Contractor shall use Government furnished information, data, and documents only for the performance of work under this BPA and shall be responsible for returning all Government furnished information, data, and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data, and documents to outside parties without the prior and explicit consent of the Contracting Officer.

Contractor access to information protected under the Privacy Act is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, Safeguarding Sensitive but Unclassified (For Official Use Only) Information. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement (DHS Form 11000-6).

2.15 RECORDS MANAGEMENT OBLIGATIONS

The term Federal record:

1. includes CISA records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their CISA BPA or Call Order.

4. may include deliverables and documentation associated with deliverables.

2.15.1 Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2.15.2 In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

2.15.3 In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the BPA and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

2.15.4 CISA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of CISA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to CISA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

2.15.5 The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the BPA and Call Order. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to CISA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the BPA or each Call Order. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

2.15.6 The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this BPA requiring the disclosure of information, documentary material and/or records generated under, or relating to, BPAs. The Contractor (and any sub-contractor) is required to abide by Government and CISA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

2.15.7 The Contractor shall only use Government Information Technology (IT) equipment for purposes specifically tied to or authorized by the BPA and in accordance with CISA policy.

2.15.8 The Contractor shall not create or maintain any records containing any non-public CISA information that are not specifically tied to or authorized by…