RFI 70FA3021I00000004 WebEOC 2021 03 10 FINAL.pdf

RFI 70FA3021I00000004 – FEMA Crisis Management System

1 Synopsis

Federal Emergency Management Agency (FEMA), a component of Department of Homeland

Security (DHS), is the nation’s preeminent emergency management agency. FEMA’s primary mission is to reduce the loss of life and property and protect the Nation from all hazards, including natural disasters, acts of terrorism, and other man-made disasters, by leading and supporting the

Nation in a risk-based, comprehensive emergency management system of preparedness, protection, response, recovery, and mitigation.

FEMA operates under several statutory authorities including the Robert T. Stafford Disaster Relief and Emergency Assistance Act, PL 100-707, the Homeland Security Act of 2002, PL 107–296, and the Homeland Security Appropriations Act of 2007, PL 109-295.

FEMA currently utilizes ESI’s WebEOC for its Crisis Management System. As part of FEMA’s ongoing market research, it is issuing this Request For Information (RFI) to gather vendor information pertaining to availability of potential Commercial off the Shelf (COTS) solutions.

In accordance with Federal Acquisition Regulation (FAR) 10.002(b)(2)(i) this notice is issued solely for the purpose of market research. This request is for planning purposes only and does not constitute a solicitation or an indication the government will contract for the items contained in this notice. This notice is not to be construed as an acquisition Request for Proposal (RFP), nor is any commitment on the part of the government to award a contract implied, nor does the government intend to pay for any information submitted as a result of this request. The government does not reimburse respondents for any cost associated with submission of the information being requested or reimburse expenses incurred to interested parties for responses to this notice. Any response received will not be used as a proposal. FEMA is not, at this time, seeking proposals and will not accept unsolicited proposals.

After reviewing responses to this RFI, FEMA may allow respondents to provide a demonstration of their devices for the purpose of market research.

2 Description of FEMA’s Web Emergency Operation Center

FEMA’s Crisis Management System (CMS) is a core DHS/FEMA mission essential system used in supporting Response and Recovery disaster-based operations by providing communications to the field 365 days a year. The system supports FEMA and its partners such as FEMA

Headquarters, Regions, Field units, all federal interagency members, and States, Local, Territories and Tribes (SLTT) partners participating in both National and Regional Disaster

Activations and National Events.

The CMS is currently securely deployed on the Amazon Cloud (but could be deployed on any

FEDRAMP Cloud platform) and provides FEMA and its strategic partners with the seamless access to time-critical event information to maintain an effective level of situational awareness.

Its web interface allows access from a wide array of internet-enabled platforms that provides response workers the flexibility needed as they respond to disasters. Authorized users can monitor and manage emergency operations during planning, mitigation, and response/recovery phases from anywhere in the world.

The system currently supports over 19,200 users. FEMA currently supports Response and

Recovery disaster-based operations 365 days a year both CONUS and OCONUS for the following:

• Resource Requests

• Mission Assignments (MA) that FEMA issues to other federal agency directing the completion of a specific request for assistance in response to, a Presidential declaration of an emergency or a major disaster.

• Request For Information (IAP)

• Joint Field Office/Joint Recovery Offices’ Management Records & Reports

• Disaster Relief Fund Resource Requests, Tracking, and Auditing

• Incident Action Planning (IAP), & National/Regional Support Plans (NSP/RSP)

• Situational Awareness (e.g., Lifelines, Disaster Information Collection, Resources)

• Tools that assist in the coordination of Lifeline Stabilization & Recovery via Operations, Planning, Logistics, and Finance

• Job Aids for Just-in-Time Learning (e.g., Micro-Learning)

• Operational readiness through uninterrupted service 365 days a year, 24/7

3 Specific Questions

1. What Commercial off the Shelf (COTS) Solution Crisis Management System (CMS) solution does your company provide?

a. Does your system have the capability of hosting more than 19,000 users in a single enterprise solution?

b. Do you have experience and the capability to seamless data transfer of numerous years of historic digital data records that includes millions of records without loss of functionality?

c. Do you have the capability to transfer hundreds of thousands of live data records from another CMS to your solution while actively supporting hundreds of active disasters with no loss of functionality?

i. Do you have any suggestions on language FEMA could include in its RFP

(Attached) to ensure that please provide any feedback to enhance the sample RFP with regards to transition?

d. Do you have experience in providing training and support 19,000+ users before and after system cross over?

e. What functionality does your system provide?

f. What services does your company provide?

g. Are you an authorized WebEOC reseller?

i. If a WebEOC reseller, does your company have the capability and experience to address all the questions outline above and provided the related services?

h. Is your system capable of addressing at an enterprise level multiple tiered operational incidents at the CONUS/OCONUS level?

i. Provide your solution proprietary rights.

j. What Software does your solution utilize?

k. Is your company a software license reseller?

2. What Development, Operations and Maintenance Support services does your company provide?

a. Does your company have government contract experience?

b. Does your company have experience in providing System Engineering Life Cycle

(SELC) process support?

3. Does your company provide a FedRAMP certified Cloud Hosting Services?

a. Which FedRAMP certified Cloud site do you utilize?

b. What services are available?

4. What Government Agencies does your company currently support?

a. Do they have current Authority to Operate (ATO)?

b. Is your company familiar with the following:

1. DHS Management Directive 11042.1 Safeguarding Sensitive But

Unclassified (for Official Use Only) Information

2. DHS Sensitive Systems Policy Directive 4300A

3. DHS 4300A Sensitive Systems Handbook and Attachments

4. DHS Security Authorization Process Guide

5. DHS Handbook for Safeguarding Sensitive Personally Identifiable

Information

6. DHS Instruction Handbook 121-01-007 Department of Homeland Security

Personnel Suitability and Security Program

7. DHS Information Security Performance Plan (current fiscal year)

8. DHS Privacy Incident Handling Guidance

9. Federal Information Processing Standard (FIPS) 140-2 Security

Requirements for Cryptographic Modules accessible htttp://csrc.nist.gov/groups/STM/cmvp/standards.html

10. National Institute of Standards and Technology (NIST) Special

Publication 800-53 Security and Privacy Controls for Federal Information

Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

11. 11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at

12. http://csrc.nist.gov/publications/PubsSPs.html.

4 RFI Response Instructions

4.1 Response Format Requested

Your responses must be provided in narrative or tabular format no later than 5:00 pm EST March

30, 2021 to Hal Vernon at hal.vernon@fema.dhs.gov and Marianne McCallum at marianne.mccallum@fema.dhs.gov.

Please answer the questions in Section 4 above. As applicable, provide any additional information on products that your company provides along with a brief description of the approach your organization would take in providing the products contemplated in this RFI.

Responses are to be a maximum of 10 pages.

The responses to this RFI will be reviewed by staff from the FEMA Response and Recovery

Directorate, Operations Division, Operations Capability Office, Crisis Management System

Program Management Team and might be used to develop requirements for future acquisitions.

4.2 Information for the Response

The release of this RFI does not guarantee that the government will complete an acquisition. This

RFI is for information and planning purposes only and does not constitute a solicitation for bids, proposals, or quotes and is not to be construed as a commitment by the government to issue a request for proposal/quote or award of a contract as a result of this request. This announcement is not a Request for Proposal (RFP) nor a Request for Quote (RFQ). The government will not reimburse respondents for any cost associated with information submitted in response to this request.

Small businesses are encouraged to provide responses to this RFI, in order to assist FEMA in determining the potential levels of interest, competition, and technical capability within the

Small Business community.

4.3 How to Deliver the Response

Questions and requests for clarifications on this RFI must be received no later than 5:00 pm EST

March 22, 2021.

Response packages should be sent via email.

Response Due Date: Responses must be submitted no later than 5:00 PM, EST March 30, 2021.

http://csrc.nist.gov/publications/PubsSPs.html mailto:hal.vernon@fema.dhs.gov mailto:marianne.mccallum@fema.dhs.gov