HUD_ENS_SOW_2019.docx

Statement of Work (SOW) HUD Emergency Notification System (ENS)

BACKGROUND

The mission of the U.S. Department of Housing and Urban Development (HUD) is to create strong, sustainable, inclusive communities and quality affordable homes for all. HUD is working to strengthen the housing market to bolster the economy and protect consumers; meet the need for quality affordable rental homes; utilize housing as a platform for improving quality of life; build inclusive and sustainable communities free from discrimination and transform the way HUD does business.

OBJECTIVE

To provide continued rapid emergency alert notifications to HUD staff via a Fed Ramp ready comprehensive enterprise-wide Emergency Notification Systems (ENS).

SCOPE OF WORK

The Contractor shall provide all necessary infrastructures to implement ENS services. The ENS shall provide comprehensive methods to broadcast information to pre-defined distribution groups. The system shall support local (district) groups and system-wide administrator defined groups.

The initiation process shall start from a website or telephone by authorized broadcasters. The authorized broadcaster selects predefined groups/scenarios that contain data such as phone numbers and e-mail addresses. The broadcaster initiates emergency notifications via one or multiple methods to notify users. The application attempts to contact the predefined groups by selected means.

The status of the broadcast can be seen real-time on screen and via report detailed by user and medium used. There will also be exception reports to ensure those not notified can be traced via other methods if normal notification is impossible.

Notifications shall include alerts and incident management responses and expectations during affected periods.

The ENS must be capable of notifying HUD staff in locations throughout the United States and US territories including the Virgin Islands, Puerto Rico, Guam, and the Northern Mariana Islands.

The system shall provide notifications via multiple mechanisms to HUD recipients. In addition, the system shall provide an interactive response capability so notified staff members can respond to various inquiries; for example, health and welfare status.

The system shall support alert initiation via the public telephone network and the Internet. Minimally, the system shall be able to transmit alert messages via conventional and mobile telephone, pagers, electronic mail, and Short Message Service (SMS) text.

The system shall be able to confirm notification delivery to recipients, and successively attempt delivery using available methods until notification is confirmed. There should be no expectation of data connectivity or storage on the HUD platform.

Specific tasks as described below:

1. General Requirements

a. Must meet FEDRAMP compliance.

b. Contractor shall provide an Emergency Notification System (ENS) to the Government that will provide telephone, e-mail, and SMS notifications.

c. The system shall support no less than 8,400 HUD staff.

d. The system shall be available and function 24 hours per day, 7 days per week.

e. The Government configuration and administration interface shall be web-based, enforce 128-bit SSL, provide for authentication of authorized Government users, and support at least Internet Explorer 9 or higher.

2. Data Center – requirements for the data center that will house Government provided data.

a. Physical Security

i. The data center shall be staffed or guarded 24 hours per day, seven days per week. The facility shall be alarmed for intrusion; alarms shall be monitored on an around-the-clock basis. The intrusion alarm system shall automatically notify law enforcement or a commercial monitoring service of alarms. The facility shall have access controls for personnel; all visitors shall be identified, logged, and escorted. The facility shall have low-light video monitoring of all ingress/egress points and storage vault doors. The Contractor shall maintain video for no less than 48 hours prior to overwrite.

ii. The data center that hosts the Government’s data must protect Government personally identifiable information (PII) data.

iii. The log of visitors shall be provided to the Government for inspection within 48 hours upon request.

iv. The Contractor shall maintain a data center access list. This list shall be provided to the Government within 48 hours upon request.

v. The data center facility shall have written incident response procedures. Data center personnel shall be trained on the procedures no less than annually. The Contractor shall test incident response procedures no less than annually. Training and contingency test records shall be provided to the Government for inspection within 48 hours upon request. The data center facility shall have conspicuously placed emergency contact data.

vi. The Contractor shall inform the Government of security incidents and suspected security incidents within 4 hours of detection. For any incident involving unauthorized use or disclosure of Personally Identifiable Information, the Contractor shall notify the Government immediately.

b. Personnel Security

i. All data center personnel must, at a minimum, be vetted with name and fingerprint check prior to using system.

ii. All data center personnel must know potential consequences of system misuse.

c. Identification / Authentication

i. All system users must use unique identifiers and authenticated IDs.

ii. Contractor shall have written procedures in place on how to report a security incident.

d. Media Security

i. Contractor shall provide written procedures on data center security practices that involve Government data within 48 hours upon request.

ii. Contractor data center must have at least one redundant backup facility.

e. Contingency & Disaster and Recovery Plans

i. Contractor shall test backup facility operations quarterly and provide results to the Government within 48 hours upon request.

ii. Contractor shall permit facility visits by Government security managers to all data center locations to assess practices and procedures within 48 hours upon request.

iii. Contractor must maintain and provide a contingency and disaster recovery plan to the Government within 48 hours upon request.

3. System Automation – The vendor must propose a solution that ensures the secure transfer of data and ensure current, accurate and complete data.

a. The Contractor system shall allow for a complete refresh of the notification database daily with no Government interaction.

b. Contractor system shall have ability to create groups based on a GUI interface for all imported fields.

c. Once groups are created in the system, the system shall have the ability to recreate those groups automatically after each daily refresh of the database with no Government interaction.

d. All groups created by local administrator shall be automatically refreshed daily with no interaction by Government.

e. The Contractor system shall allow secure file transfer (SFTP) of contact file to data center.

f. Contractor system must allow for mapping and remapping of data elements and importation of minimum of five phone numbers, two email addresses, complete name, district, department, title, and all Government defined data fields.

4. Scenarios (the ability to outline the actions that shall take place for specific emergency situations) – the Government must be able to create “scenarios” at the district level and top administration level. (These scenarios must only be available to the local district administrator and primary system administrator. For example, the District of Washington must have the ability to create a “snow emergency” scenario that is only seen by the district. The Southern District of California must be able to create a “fire emergency” that is only available to the district. The District of Washington cannot see the other districts contacts or scenarios and vice versa.)

a. Scenarios shall be able to refresh automatically after nightly refresh of contact information.

b. The local administrator must be able to create and modify local scenarios.

5. Administration

a. The Government must be able to create unlimited local (district) administrators.

b. The Government must be able to organize and administer data by district in at least 125 groups which require separate administration.

c. All data shall be contained in one system for top level notification and administration.

d. Regional administrators shall be allowed to only view/administer his/her regional data, unless otherwise authorized.

6. Basic Functionality

a. Allow secure URL (https) web-based communication.

b. A person using a phone/cell shall be able to trigger notifications that include existing groups and scenarios.

c. Notifications shall be deliverable to phone, SMS, and E-Mail.

d. System shall be able to specify order of notification.

e. Notifications must have text to voice capability.

7. Video Training The vendor shall provide HUD training as identified below.

a. Training shall consist of three distinct training sessions: 1) Overall system administration 2) District system administration 3) End user.

b. Each training session shall be taped at the Government’s studio in Washington, DC. The training will be given to camera in studio. Once the training is taped, it will be edited at the Government’s expense to be distributed to HUD users. The end-result shall consist of three separate videos as described below.

8. System Setup

a. Initial system setup within 14 days from date of award. Contractor shall provide initial setup of system that involves group creation, scenario creation; administer creation, SFTP, and system security setup.

b. Contractor shall work with Government to setup complete automation of import process.

10. Reporting

a. System shall have reporting capabilities that include, at a minimum, exception reports, real time monitoring, system groups, system users, scenarios, and system notification history.

b. System shall provide real time emergency notification tracking that includes, at a minimum, attempts, successes, and exceptions. This should also include the ability to sort data by office or regional areas.

DELIVERABLES

The Contractor shall provide these deliverables:

1. A web/phone-based system as defined in the Scope of Work above.

2. Written document outlining the data center security practices to ensure privacy of Government data.

3. Initial system setup within 14 days from date of award.

4. Admin / end user training completed within 30 days from award of contract.

5. Contingency and disaster recovery plan within 7 days from award of contract.

6. Contractor shall maintain a data center visitor access list. This list shall be provided to the Government within 48 hours upon request.

7. Contractor shall maintain a data center personnel access list. This list shall be provided to the Government within 48 hours upon request.

8. Contractor shall test incident response procedures no less than annually. Training and contingency test records shall be provided to the Government for inspection within 48 hours upon request.

9. Contractor shall have written procedures in place on how to report a security incident. Incident reports shall be provided to the Government within 48 hours upon request.

10. Contractor shall provide written procedures on data center security practices that involve Government data within 48 hours upon request.

11. Contractor shall provide Contingency & Disaster and Recovery Plans to Government within 48 hours upon request.

12. Contractor shall test backup facility operations quarterly and provide results to the Government within 48 hours upon request.

13. Contractor shall permit facility visits by Government security managers to all data center locations to assess practices and procedures within 48 hours upon request.

14. Training shall consist of three distinct training sessions: 1) Overall system administration 2) District system administration 3) End user.

i. Overall system administration will consist of comprehensive training for the ENS system. After training, the viewers shall be able to administer all basic and complex workings of the system. Viewers must also completely know of the notification and receipt process.

ii. Regional system administration shall give viewers an overview of administration with a focus on group creation, local scenario building, notifications, and receipt of notifications, notification tracking, and reporting and general district upkeep of the system. These viewers will be the primary group sending out district alert notifications.

iii. End user training will give viewers a general overview of the system, with a focus on alert notifications. These viewers will be the secondary group sending out alert notifications.

iv. A training manual shall be provided by the Contractor for each of the above-named classes.

PERIOD OF PERFORMANCE

The period of performance will be one 12 month base period and four 12 month option years as follows:

TECHNICAL EXHIBITS

The Government shall provide a listing all HUD staff authorized to enroll in the notification system. Employee enrollment will be voluntary.

2 | Page