RFI 70FA3021I00000004 WebEOC SOW 2021 03 10 FINAL.pdf

SOW – FEMA Crisis Management System (CMS)

03/10/2021 1

1. PROJECT TITLE:

FEMA’s Crisis Management System (CMS)

2. BACKGROUND:

2.1 AGENCY BACKGROUND

FEMA is part of the U.S. Department of Homeland Security (DHS) and is the nation’s preeminent emergency management agency. FEMA’s primary mission is to reduce the loss of life and property and protect the Nation from all hazards, including natural disasters, acts of terrorism, and other man-made disasters, by leading and supporting the Nation in a risk-based, comprehensive emergency management system of preparedness, protection, response, recovery, and mitigation.

FEMA operates under several statutory authorities including the Robert T. Stafford Disaster Relief and

Emergency Assistance Act, PL 100-707, the Homeland Security Act of 2002, PL 107–296, and the

Homeland Security Appropriations Act of 2007, PL 109-295.

FEMA prepares the nation for all hazards and manages Federal response and recovery efforts following any national incident. FEMA works in partnership with other organizations that are part of the nation's emergency management system. These partners include state and local emergency management agencies, 27 federal agencies and the American Red Cross. FEMA established the National Response Framework to provide the guiding principles for enabling all response partners to prepare for and provide a unified national response to disasters and emergencies - from the smallest incident to the largest catastrophe.

2.2 PROGRAM BACKGROUND

In 2011 the National Level Exercise – 2011 (NLE-11) After Action Report identified a gap in FEMA’s comprehensive Situational Awareness (SA) and the Agency’s ability to communicate and disseminate reliable information to all agency programs, components, and strategic partners.

To address this gap the Office of Response and Recovery (ORR) Directorate in 2012 awarded ESI Inc.

(now Juvare) the contract to build FEMA’s Crisis Management System. The system capabilities encompass the areas of operations, planning, logistics, while also providing situational awareness to our

Federal, state, tribal and local strategic partners.

FEMA’s CMS is the common operating system for FEMA Headquarters, Regions, Field units, federal interagency members, and States, Local, Territories and Tribes (SLTT) partners during disasters and has had significant increase in users since launching in 2012 exceeding all expectations. The system is expected double in users within the next 5 years. FEMA’s CMS currently supports Response and

Recovery disaster-based operations (e.g. Stafford Act incidents) who rely on CMS 365 days a year throughout the lifecycle of disasters for the following:

• Resource Requests

• Mission Assignments (MA) that FEMA issues to other federal agency directing the completion of a specific request for assistance in response to, a Presidential declaration of an emergency or a major disaster.

• Request For Information (IAP)

• Joint Field Office/Joint Recovery Offices’ Management Records & Reports

• Disaster Relief Fund Resource Requests, Tracking, and Auditing

• Incident Action Planning (IAP), & National/Regional Support Plans (NSP/RSP)

• Situational Awareness (e.g., Lifelines, Disaster Information Collection, Resources)

• Tools that assist in the coordination of Lifeline Stabilization & Recovery via Operations, Planning, Logistics, and Finance

03/10/2021 2

• Job Aids for Just-in-Time Learning (e.g., Micro-Learning)

• Operational readiness through uninterrupted CMS service 365 days a year, 24/7

• Just-in-time on-site and virtual support to rapidly assist the disaster workforce on and implement consistent use of CMS in response and recovery operations

• Continuous enhancement of CMS through observations and user feedback regarding best practices, shortfalls, and new requirements

• Interconnection of processes and information sharing to streamline workflows, save labor hours, and increase access to data for analytical purposes outside of CMS

Historical Use of CMS:

To date, CMS has and continues to support:

• 401 Major Disasters

• 70 Emergency Declarations

• 100+ Custom Disaster Management Board Designs

• All large-scale FEMA and Interagency Disaster Exercises since its inception

2.3 CURRENT SITUATION

The current contract expires on TBD. FEMA desires to award a new contract with four option years for continued CMS operations, maintenance, support, and development.

3. SCOPE

This Statement of Work (SOW) intends to support the continuation of the successful operations, support, and system evolution of FEMA’s CMS Crisis Management System. This procurement shall include continued network systems support, installations, integrations, external interconnections, board development, maintenance, documentation, and training.

This SOW includes the annual renewal of the CMS Enterprise FEMA license with unlimited seats and users for a time period in accordance with the contract period of performance that provides web-based access to all Federal, State, local, tribal, and other partners (to include non-governmental organizations) in support of the national response to a crisis and daily response operations.

The CMS vendor and the core software shall provide a robust suite of services and capabilities that support FEMA mission goals. These capabilities and services, at a minimum, will support and deliver the following:

• Simultaneous management of multiple tiered incidents

• Tracking of Resource Requests and Mission Assignments, Interconnections with FEMA’s logistical system(s) and other partners to share information in a timely manner IAW FEMA IT

Security Requirements

• Interconnection with the other systems

• Support for the National Incident Management System (NIMS)/Incident Command System

(ICS) based reporting capability

• Support for the Incident Command System (ICS) Incident Action Planning (IAP) tool

• Support for a Mobile Application (IOS and Android) interface

• Support for the tiered FEMA Jurisdictions based on FEMA Headquarters (HQ), Regions, 03/10/2021 3

Mobile Emergency Response System (MERS) Operations Center (MOC), Interim Operating

Facility (IOF) and Joint Field Office (JFO)Support for the Approval Process for Reports

(Digital Signature)

• Support for the Simple Mail Transfer Protocol (SMTP) based alert and notification of key milestones and events capability

• Maintain CMS access to technical support from vendor engineers on a 24-hour, seven days-a-week basis

• Provide on-line training courses covering an array of topics, as defined by the COR, on how to best use the CMS software application

The contractor shall ensure the CMS software is current and up to date on versions and is in accordance with the most current DHS Sensitive Systems Security Policy Directive 4300, the HSAR Class Deviation

15-01 Safeguarding of Sensitive Information class deviation memo, and all other applicable FEMA/DHS cybersecurity requirements.

The contractor shall ensure that the system remains in compliance with all current and future Federal, DHS and FEMA published policy requirements as needed to acquire and/or maintain a current, valid

Authority to Operate certification. These are known as the ATO artifacts. This requirement includes the responsibility to develop, publish and manage as current the ATO artifacts which support the ATO accreditation process for the CMS to include: Security Plans, Configuration Management Plans, Contingency Plans, Contingency Plan Tests, Incident Response Plans, Vulnerability Remediation Plans and other artifacts as needed.

The vendor shall also acquire, operate, and maintain the DHS compliment of automated security assessment tools and use them to assess the evolving CMS system in order to identify issues and deficiencies prior to them being deployed onto the CMS Production system. The array of DHS employed automated tools currently in use is:

• Nessus Vulnerability Scanner by Tenable

• WebInspect by HP

• Fortify by HP, and

• AppDetective Pro or DBProtect by TrustWave

The vendor will fully represent the CMS/CMS’s Production environment and its Testing and

Development Laboratory (TDL) environment in the ATO artifacts where required. Additionally, the vendor will perform automated security assessments and vulnerability management practices in support of both the Production and TDL environments addressing any issues that may arise.

In addition to the procurement of the Enterprise license, the scope of this contract includes:

• The development of CMS boards,

• Administrator and user training as needed,

• Secure interconnections with other systems, when possible, and established within the constraints of FEMA/DHS cybersecurity requirements. (System interconnection costs will be developed on a case by case basis using existing CLINS.)

The Response Directorate is the owner of all the system data and maintains responsibility for the overall program and the management of this contract.

03/10/2021 4

4. APPLICABLE DOCUMENTS

The following standards are applicable to this requirement:

a. DHS Management Directive 140-01, Information Technology Systems Security July 31, 2007

b. DHS National Response Framework, Fourth edition, October 28, 2019

c. DHS Sensitive Systems Policy Directive 4300A, Version 13.0 13, July 2017

d. DHS Sensitive Systems Handbook 4300A, v12.0, November 15th, 2015

e. DHS Systems Engineering Life Cycle (SELC) (Directive 102-01, Appendix B), November 2008

f. Executive Order 12472, Assignment of National Security and Emergency Preparedness

Telecommunications Functions

g. Executive Order 13011, Federal Information Technology

h. NIST FIPS 140-2, Security Requirements for Cryptographic Modules (May 2001)

i. NIST FIPS 200, Minimum Security Requirements for Federal Information and Information

Systems March 2006

j. NIST Information Technology Laboratory (ITL) Bulletin, Secure Interconnections for

Information Technology Systems (February 2003)

k. NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems

l. NIST SP 800-53, Rev 4, Recommended Security Controls for Federal Information Systems and

Organizations April 2013, with updated errata January 15, 2015

m. NPDD 63, Critical Infrastructure Protection

n. OMB Circular A-130, Managing Information as a Strategic Resource revised, July 28, 2016

o. OMB Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act

p. OMB Circular A-123, Management Accountability and Control

q. OMB Memorandum 17-12, Preparing for and Responding to a Breach of Personally Identifiable

Information” (January 3, 2017)

r. PL 93-288, The Robert T. Stafford Disaster Relief and Emergency Assistance Act

s. PL 93-579, Privacy Act of 1974, as amended, 5 U.S.C. 552a

t. PL 97-255, Federal Managers’ Financial Integrity Act (FMFIA)

u. PL 99-474, Computer Fraud and Abuse Act 1986

v. PL 100-235, Computer Security Act of 1987

w. PL 101-56, Computer Matching and Privacy Protection Act

x. PL 103-63, Government Performance and Results Act

y. PL 104-13, Paperwork Reduction Act 1995

z. PL 104-106, Information Technology Management Reform Act (Clinger-Cohen) of 1996

aa. PL 105-220, Rehabilitation Act

bb. PL 107-296, Homeland Security Act

cc. PL 107-347, Federal Information Security Management Act

dd. Project Management Institute (PMI) Project Management Body of Knowledge (PMBOK)

ee. Software Engineering Institute (SEI) Capability Maturity Model Integration (CMMI)

5. DESCRIPTION OF WORK

The contractor shall work collaboratively with all Government personnel and other FEMA contractors to accomplish the procurement and assigned work requirements under this contract as required. However, formal technical guidance and direction will come from the Contracting Officer’s Representative (COR).

5.1 Operations and Maintenance (O&M)

Program Management Assistance and Software Configuration

The contractor shall provide a dedicated Project Manager who will support the CMS Program

03/10/2021 5

Management Staff (PMS) in addressing CMS problem reports, resolving action items, identifying, and resolving functional, operational and technical issues, developing Standard Operating Procedures, and working with the Program Management Staff to support the CMS and its stakeholders. The contractor shall ensure that appropriate project management principles, processes, and methodologies are followed in the governance of the project.

The contractor shall assist the CMS PMS who are responsible for program communications, change management activities, and the development of communications materials.

The contractor shall provide the expertise and engineering support to the PMS that enables and maintains the High Availability technologies and capabilities of the CMS.

The contractor shall coordinate and provide project management support on all release implementations.

The government will direct and lead all Project Management activities for all release implementations. It is expected that the contractor will provide all tracking, performance measurement metrics, and updating of tasks to the government lead for the respective release.

The contractor shall perform required Risk Management support activities to include the management of system security risks. The contractor shall perform manual and automated risk assessments as needed and develop mitigation strategies that will resolve all identified risks to the CMS system.

The contractor shall perform Configuration Management support activities as required. These activities include the development and maintenance of a Configuration Management Plan that addresses all components which make up the CMS system.

The contactor will deploy and maintain a Test and Development Laboratory (TDL) environment that mirrors, as closely as possible, the CMS Production Environment. This TDL environment will be used to perform successful functional, operational, and security testing of planned updates prior to them being introduced to the CMS Production environment.

The contractor shall generate and implement a Quality Assurance Plan for planned system maintenance and upgrade activities. For each planned CMS system maintenance release, the contractor shall describe the proposed system updates, review the CMS system artifacts and architectural diagrams to ensure that any impact does not degrade their completeness, consistency, quality and/or requirements traceability. The contractor shall ensure that the CMS system components work together to meet program objectives (business, technical and performance goals) as defined in the requirements for the CMS solution.

In collaboration with and support of the PMS, the contractor shall develop, document, and implement a comprehensive Project Management Plan (PMP), a Project Schedule and Project Requirements documentation for each planned major release. These plans shall organize and coordinate the work, resources, cost estimate (if requested) and schedule for each phase of the release. The Project

Management Plan shall include detailed Work Breakdown Structures of the expected work activities.

Additionally, the PMP will utilize the metrics and thresholds needed to assess and identify early indications of problems. The project timelines (planned and actual) shall include detailed milestones, level of effort (planned and actual) projections, and specialty equipment requirements with associated cost estimates.

The contractor shall provide a comprehensive Transition Plan describing in detail how it will assume the work and then transition it to an incoming Operations and Maintenance contractor at the end of this task order.

03/10/2021 6

Meetings

The contractor shall work with government personnel and involved contract staff in a teaming relationship manner to accomplish the assigned work requirements under this task order even when personnel and staff support other FEMA components. The contractor shall describe their approach for working with these contractors and entities.

The contractor shall participate in regular and/or ad hoc CMS meetings and activities, including interface with various CMS projects, oversight groups, and stakeholders.

The contractor shall participate, as needed, in other CMS projects and Integrated Project Teams (IPT) as needed.

The contractor shall lead and conduct IPT meetings, as needed, to support system release projects.

The contractor shall support and participate in the CMS IPT. The contractor shall submit a weekly systems implementation and integration IPT status report, as well as maintain a Risks, Action Items, and

Issues log.

The contractor shall attend weekly IPT meetings as scheduled. The contractor may participate by phone if approved by the System Owner.

The contractor shall participate in both formal and informal In Progress Review (IPR) meetings to brief leadership and stakeholders on the status of work being performed. Formal IPRs will be scheduled by the

Government and will be conducted in Governmental spaces.

Maintenance Activities

The contractor shall perform Go Live and post-implementation support for all new releases during for the period of performance of the contract.

The contractor shall support all new O&M release deployments.

The contractor shall participate in the evaluation, management, and the prioritization of software defect repairs. The contractor shall diagnose problems in proposed software implementation packages.

The contractor shall fix all bugs in the proposed software prior to deploying the release to the CMS Production system.

The contractor shall perform modifications on the software or system components to correct faults, improve performance or other attributes not identified in the pre-release assessments. The contractor shall adapt to a change managed environment and maintenance activities focused on anticipated problems, or preventive maintenance. This means that the contractor’s maintenance activities are expected to be proactive in preventing and addressing problems.

The contractor shall maintain existing interfaces with CMS software to include FEMA partner systems

(e.g. onboarded partners) and assist in ensuring that they operate without disruption in service.

The contractor shall assess and monitor third party software and provide solution recommendations when requested.

The contractor shall assess, test, recommend, and support implementation of solutions to address network and connectivity issues as they relate to the CMS system. The contractor will answer questions and assist with troubleshooting to determine if network and connectivity issues are related to CMS software. Reporting shall be done in accordance with approved templates.

03/10/2021 7

The contractor shall assess, test, recommend and support implementation of enhancements and solutions as they relate to CMS systems, processes, and performance. Reporting shall be done in accordance with approved templates.

The contractor shall participate in conducting data collection and performance analysis to assess progress, effectiveness, efficiency, and issues. Some key metrics are collected in support of FEMA’s FISMA scorecard reporting requirements which are typically reported on a weekly basis. Also, the Weekly Status

Reports, as specified in the deliverables section, shall include a list of recently completed and upcoming releases and patches. The contractor shall support execution of CMS systems information assurance.

Testing

The contractor shall conduct functional, unit, integration, and system (IST), regression, smoke and security tests as applicable and part of their quality assurance plan for each release, patch, and any software to changes to an existing board as well any new board developed. The contractor shall develop detailed test plans and test scripts and thorough testing documents that support test requirements. The documents are to be delivered to FEMA’s CMS PMS prior to testing activities. The contractor is required to submit all test plans, documentation, and results, to include copies of reports and screen shots, in Microsoft Word format, for the government to review. The contractor shall correct any errors identified by the government or the contractor. Each applicable test shall be identified as a milestone in the Work

Breakdown Structure (WBS) as described in the Project Management Plan (PMP). Automated testing software shall be able to handle complex changes and requirements, allow for the recording and playback of scripts, and maintain an ongoing test data suite. Regression testing shall fully test all previous functionality.

User Acceptance Testing (UAT)

User Acceptance Testing (UAT) is a critical step for identifying whether a product is ready to be deployed. The government will perform acceptance testing of the new or modified CMS code and/or database changes after successful completion of contractor testing. The contractor shall prepare or update test scenarios and scripts for users to follow during the initial structured portion of the UAT. The contractor shall assist the government during the preparation and execution of the acceptance test by establishing test data. The contractor shall provide the draft version of all documentation. The contractor shall correct any errors identified by the government or the contractor.

Independent Validation and Verification (IV&V) Testing [OPTION]

The contractor shall assist the government with Independent Validation and Verification (IV&V) testing activities by answering questions provided by the government.

Documentation

The contractor shall assist the CMS PMS and applicable personnel with the preparation for System

Engineering Life Cycle (SELC) stage gate reviews.

The contractor shall develop and maintain the appropriate Enterprise Architecture and SELC documentation in accordance with DHS and FEMA standards; Coordinate with FEMA IT Service

Delivery and OCIO to ensure compliance to DHS SELC, Enterprise Architecture (EA), and Security requirements and ensure concerns are addressed and solutions documented.

The contractor is expected to address documentation deficiencies as identified when maintaining the technical aspects of the system. For example: within the Account Management Plan, end-to-end steps to reset the password, to understand how to properly change passwords (application, schema, etc.) as to not negatively affect the application. Additionally, FEMA needs CMS Contingency Plan documentation to address and support disaster recovery. One concern would be, for example: what key stakeholders are to be notified if CMS become unavailable and needs to fail over to an alternate processing site.

03/10/2021 8

The contractor shall assist in the integration of FEMA’s existing processes and technical foundation for the CMS Program as well as with the Information Technology Service Division’s (ITSD) current processes for areas including but not limited to: Capital Planning and Investment Control (CPIC), Enterprise Architecture, Customer Advocacy, etc. This effort shall be accomplished in accordance with

Federal/DHS/FEMA System Engineering Life Cycle (SELC), security guidance (MD4300A), and the

FEMA and DHS enterprise architectures.

For CPIC, the contractor is expected to answer questions and provide allowable information when prompted, to assist FEMA in meeting reporting requirements for CPIC. For Enterprise Architecture, the contractor is expected to participate as required by the SELC and ADE life cycle process (e.g.

documentation, and reviews). For Customer Advocacy, the contractor is expected to answer questions and provide allowable information when prompted.

Document creation or maintenance may be required for SELC, ISA, ICD, and any required design documents. For other documentation activities, the contractor is expected to review documents, and provide feedback, answer questions, and provide allowable information when prompted. For every release or change to previous zero build, updated documents such as zero build document, HW/SW document, O&M document, and any other supporting documentation regarding the Operational system must be provided.

All reports shall be done in accordance with approved templates. All documents and reports, including design documents, shall include any diagrams that are relevant to the content.

Technical Requirements

The contractor shall remain knowledgeable of pertinent sections of legislation and regulations pertaining to disaster response and asset management operations in FEMA as directed by:

- The Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended by Public Law 93-288, June 2006

- The National Response Framework

Data and information created by the system must be web-accessible for FEMA Headquarters (HQ) and all regional/field activities.

Data and information created by the system must be secure with a layered scheme for access to that data/information.

Upgrades must adhere to DHS/FEMA SELC, EA, Cyber-Security, system engineering and enterprise infrastructure requirements and policies. DHS 4300 Sensitive System Handbook mandates DHS

Components procuring Commercial off the Shelf (COTS) information systems must ensure security requirement planning is built into all aspects of the System Engineering Life Cycle (SELC) process. There are numerous references applicable to ensure security planning is built into information systems acquisition activities to include: DHS4300, DHS SELC, DHS Enterprise Architecture, FEMA OCIO Standard

Operating Procedures (SOP) documents and relevant memorandums.

All system solutions must use Industry Standard telecommunications protocols, and data standards and formats in conjunction with DHS restrictions. DHS security restrictions requirements are primarily outlined in the DHS 4300 series publications, SOP documents and relevant memorandums. Additionally, DHS information system procurement activities are subject to other federal baseline security restriction requirements to include NSA, Defense Information System Agency (DISA), National Institute of Standards and Technology (NIST) and Federal Risk and Authorization Management Program (FedRAMP) security requirements. The Contractor must adhere to the higher security requirements if there are conflicts between

DHS 4300 series publications, SOP documents and relevant memorandums other federal baseline security requirements.

The system must be able to quickly scale from 1 user to 400 plus users instantaneously.

03/10/2021 9

Scanning Guidance and Requirements

In accordance with the most recently published “Safeguarding of Sensitive Information” and “Information

Technology Security and Privacy Training” policies, memorandum, and clauses, the contractor shall perform all necessary static code analysis scans and assessments on CMS/CMS custom, COTS or third-party code prior to compiling and delivering the code. All vulnerabilities detected during pre- compiled code scans shall be corrected by the contractor prior to application delivery to FEMA. When applicable, FEMA may have cause to allow the contractor an exception to this deliverable requirement. If an exception is allowed, the FEMA COR will coordinate with the appropriate technical Subject Matter

Experts and the FEMA Approving Official for final authorization of the exception. Regardless of whether an exception applies, the contractor shall provide FEMA, within a predetermined timeframe, all remediation information necessary to complete a satisfactory Plan of Actions and Milestones (POA&M) instance for the exception as required by the DHS 4300A Sensitives Systems Handbook.

All automated security assessment scanning activities, performed prior to application delivery, shall be accomplished using only FEMA approved security assessment scanning tool sets. The list of approved security assessment scanning tools is not all inclusive and the contactor shall coordinate with FEMA to ensure that the tool set(s) they wish to use is/are acceptable

FEMA may require that any scanning tool, proposed for use by the contractor, will be approved for use by the PMS and have active approval status on the General Services Administration’s (GSA) Federal Risk and Authorization Management Program (FedRAMP) website (e.g. https://www.fedramp.gov/). The

FedRAMP program is a federally recognized standardized approach to the security assessment, authorization, and continuous monitoring of Cloud-based systems.

The contractor is expected to scan source code prior to compiling and completing the COTS product delivery to the program. The FEMA CIO has directed that all programing source code, regardless of whether it is COTS or non-COTS, must be assessed using a FEMA approved tool and the results provided to FEMA for review and analysis. The contractor will provide vulnerability scan results periodically during code development to support FEMA security review and analysis. FEMA will provide the contractor with a list of FEMA approved security scanning tools that satisfy this requirement.

Not all security scanning tools used by FEMA are FedRAMP approved. The contractor is required to use

FEMA approved security scanning tools which may or may not be FedRAMP approved. The program office and the contractor must adapt to the fact that the list of FEMA approved security scanning tools are dynamic and subject to change based on the state of security vulnerabilities and the needs of the agency. FEMA will provide the contractor with a list of FEMA approved security scanning tools acceptable to meet this requirement.

The contractor shall correct all vulnerabilities detected by scans on code, applications, and/or contractor managed infrastructure (i.e., Operating Systems, platforms, appliances, and major applications, etc.)

prior to being delivered to FEMA. The contractor shall ensure all vulnerability corrections are accomplished in accordance with all Federal, DHS and FEMA security standards, policies, and reporting requirements.

The contractor shall make all vulnerability corrections in accordance with predetermined DHS and FEMA guidelines and schedules (e.g. a fifteen (15) day deadline for correcting Critical vulnerabilities, a thirty

(30) day deadline for correcting HIGH vulnerabilities, etc.).

CMS Production and Test & Development Environments

Contractor shall continue to maintain and support the following program operating environments that support the CMS mission:

http://www.fedramp.gov/)

03/10/2021 10

• The CMS Development Environment - The contractor shall provide all appropriate

03/10/2021 11 software, licenses, and sundry related items needed for FedRAMP Cloud Certified Production

Hosting Services to successfully operate the CMS Development environment.

• The CMS Test and Development Laboratory (TDL) Environment - The contractor shall provide all appropriate software, licenses and sundry related items needed for the FedRAMP Cloud

Certified Production Hosting Services to support the CMS TDL.

• CMS Production Environment - The contractor shall provide all appropriate software, licenses and sundry related items needed for Production hosting services to provide for, and maintain, a highly available and secure Production environment ready to support all identified CMS users.

• CMS Solutions Support

Technical and system support shall be provided to FEMA’s CMS PMS 365 days of the year 24 hours a day via a HELP line, at no additional cost to the Government.

System Development and Interconnection Support Expectations

The contractor shall:

• Provide continuous technical consultation services and advice on application and/or system technical matters and provide recommendations for new hardware, software, appliances, improvements, and recommendations for equipment repairs, as requested by the COR

• Develop technical, operational, and managerial documentation and presentations relevant to the

CMS application, system, capabilities, functions, or configuration as required to support project requirements. Tailoring is permitted based upon COR approval.

• Ensure compatibility between proposed or existing technologies that support interconnections with external systems using contractor provided solutions, COTS middleware technologies or

APIs as required.

• Provide technical expertise to develop, publish, modify, and maintain all required system

Certification and Accreditation (C&A) documentation in support of, or required by, the FEMA

CIO and/or the CMS Information Systems Security Officer (ISSO).

6. KEY PERSONNEL

6.1 KEY PERSONNEL Availability

The contractor shall ensure Key Personnel are able to be dedicated, full-time, to the project for one year.

The contractor shall not replace Key Personnel without prior approval of the Government.

6.2 KEY PERSONNEL – Qualifications

Job Title: Project Manager

The contractor is required to provide a Project Manager, who will manage all its contractor resources in the completion of the assigned tasks. At a minimum, the Project Manager shall be required to be certified in project management from the Project Management Institute or equivalent certifying agency and have at least 5 years of IT project management experience. The contractor Project Manager will work closely with the CMS PMS to ensure that project timelines, deliverables and milestones are being achieved. The contractor Project Manager will coordinate closely with the CMS PMS to develop required Project

Management Plans and schedules in support of CMS operations, maintenance, 03/10/2021 12 development and training efforts. Additionally, the contractor Project Manager will ensure completion of pending technical requirements and special initiatives in close coordination with other affected contractors and FEMA organizations. The contractor Project Manager is considered a Key Personnel.

Job Title: System Engineer

The senior system engineer must have expert knowledge of system development, integration, testing, deployment and operations best practices; expert knowledge of the technical architecture and capabilities of CMS software; experience implementing CMS in commercial or government hosting environments;

and experience integrating and maintaining CMS boards. The senior systems engineer must have the ability to leverage this knowledge and experience to identify and recommend architectural/technical maintenance solutions, and to guide their implementation.

The senior system engineers shall also be considered Key Personnel.

Job Title: Software Engineer

Minimum/General Experience: Five (5) years of technical and strategic experience of increasing responsibility providing software engineering, planning, design, analysis, and developing complex software models and applications across multiple hardware and software platforms with a focus on commercial Cloud systems. Excellent understanding of front-end technologies (HTML, CSS, Javascript, AJAX, JSON). Familiarity with middle-tier technologies (REST/SOAP-based web services) and relational database technologies (SQL). Demonstrates ability to work independently based on the strategic plan or under general direction. Must be able to effectively employ contemporary project management practices, methodologies, and tools, and serves as team consultant.

Functional Responsibility: The Software Engineer serves as the principal technical expert on complex and challenging information technology projects. The Software Engineer may be assigned as team leader on tasks of various technical disciplines or may work alone or as part of a team of Software Engineers, with responsibility for design and development of computer software applications and/or database systems, evaluation of computer hardware and software, planning for communications and information requirements, system test, and system security. The Software Engineer provides consulting during early planning and conceptual stages of large, complex projects. The Software Engineer may participate in any phase of major projects from problem definition through problem resolution, and from feasibility analysis through project implementation. The Software Engineer frequently supports several tasks concurrently and evaluates problems of workflow, organization, and planning, and develops appropriate corrective actions and prepares and performs presentations at technical interchange meetings and project design reviews. The Engineer reports orally and in writing to the Project Manager, contractor management, and government representatives. In the absence of the Project Manager, the Software Engineer may serve as the Contractor's authorized interface with the Contracting Officer's Representative (COR), government management personnel, and agency representatives.

Minimum Education: Bachelor's degree in Computer Science or related discipline from an accredited college or university.

The senior software engineers shall also be considered Key Personnel.

03/10/2021 13

7. DELIVERABLES AND DELIVERY SCHEDULE

The contractor will provide the deliverables described in the following table in support of the task order.

# DELIVERABLES

DUE DATES (in calendar days)

DRAFT FINAL

Weekly Status Reports: The contractor shall provide weekly status reports to the COR and CMS Project

Management Staff (PMS) in the form of a template provided to the contractor upon award. For Labor Hour

(LH) task(s), status report shall include hours and costs incurred by resource and associated work performed during the weekly reporting period.

N/A Noon every

Monday

Monthly Status Reports: The contractor shall provide monthly status reports to the COR and CMS PMS that contain: accomplishments for the month, upcoming milestones and action plans for achieving those milestones, issues/risks, and mitigation strategies. For

LH task(s), status report is to include the hours and costs incurred by resource and description of work performed during the monthly reporting period, accompanied by cumulative hours and costs by resource. Report is to also include a detailed breakout of travel and expense costs by resource.

N/A Monthly, by the

7th day of the month

Transition Plan: The contractor shall provide a transition plan indicating how it will assume the work and transition to future contractors at the end of this task order.

20 days after award

30 days after task order award

Staffing Transition Plan: The contractor shall provide a transition plan indicating how it will transition duties during turnover of key staff.

20 days after award

Quality Management Plan: The contractor shall provide the COR and CMS Program Manager a quality management plan. The Quality Management Plan shall include quality planning, assurance and control processes that will be agreed to be the government.

20 days after award

8. GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

Intermittently, the contractor may be required to work at a Government facility. FEMA will provide essential personnel who pass a background check access to computer equipment, logins, and passwords necessary to perform. The contractor shall base their price quote on off-site rates.

The contractor will be responsible for all damage or loss of government property and facilities caused by its personnel. This responsibility includes damage or loss of equipment, furniture, walls, elevators, floors, and other government-owned or leased property. The Contractor will promptly notify the COR of any damage to or loss of government property or facilities.

All products created or modifications performed in connection with this contract will become the property

03/10/2021 14 of the Government. The contractor will be required to return all Government-furnished property and equipment to FEMA upon completion or termination of this contract.

In accordance to the FEMA Property Management Program the contractor is required to provide a property management plan that addresses the following contractor responsibilities:

1. Account for all contract property in their possession, whether contractor-acquired property (CAP) or government furnished property (GFP)

2. Establish and maintain a property control system to control, protect, preserve, and maintain all contract property

a. The contractor’s property management control procedures must provide for the following functional elements in accordance with DoD “Manual for the Performance of Contract

Property Administration”:

i. Property Management

ii. Acquisition

iii. Receiving

iv. Identification

v. Records

vi. Movement

vii. Storage

viii. Physical Inventories

ix. Reports of Loss, Damaged or Destruction (LDD) property

x. Consumption

xi. Utilization

xii. Maintenance

xiii. Sub-Contractor control

xiv. Disposition; and

xv. Contract property closeout

3. Maintain and make available the records of all contract property until relieved of such responsibilities by the Contracting Officer

4. Report FEMA property or unneeded contract property as soon as it becomes known to the property administrator (PA)

5. Conduct periodic physical inventories and reporting the results to the PA no later than September

15 of each contract year and at the completion of the contract

6. Submit an annual financial report using DHS Form 700-5, “Contractor Report of Government

Property”, no later than September 15 of each contract year, and at the completion of the contract.

9. PLACE OF PERFORMANCE

The majority of the work will be performed at the contractor’s site. When the contractor personnel are required to work on Government site, the work will be located at FEMA Headquarters, 500 C Street SW, Washington, D.C. 20472, or a Federal facility designated by FEMA.

The contractor may be required to travel to FEMA or FEMA partner locations. Federal Joint Travel

Regulation will apply.

10. PERIOD OF PERFORMANCE

The performance period for this task order is estimated to be a Base of one year with four (4) one-year

Option Periods.

11. SECURITY

Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS

03/10/2021 15 mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For

Official Use Only) Information (110421), describes how contractors must handle sensitive but unclassified information. DHS MD 4300.1 Information Technology Systems Security and the DHS

Sensitive Systems Handbook (4300a) prescribe policies and procedures on security for IT resources.

Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the contractor except as specified in the task order.

Security Review

The Government may elect to conduct periodic Security Reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford to

DHS/FEMA personnel, including the organization of the Office of the Chief Information Officer, Office of the Inspector General, authorized Contracting Officer’s Representative (COR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor will contact the DHS

Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

Security Requirements for Unclassified Information Technology Resources (JUN 2006)

(a) The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency's mission.

(b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within 30 days after contract award, the contractor shall submit for approval its IT Security

Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor's IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.) (CSA 1987); the

Government Information Security Reform Act of 2000 (GISR); and the Federal Information

Security Management Act of 2002 (FISM); and with Federal policies and procedures that include, https://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_110421_safeguarding_sensitive_but_unclassified_information.pdf http://csrc.nist.gov/groups/SMA/ispab/documents/csa_87.txt http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf fismhttp://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf

03/10/2021 16 but are not limited to, OMB Circular A-130 (A-130).

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor's site (including any information stored, processed, or transmitted using the Contractor's computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) Examples of tasks that require security provisions include--

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor's copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the public (e.g., such as bypassing a firewall).

(d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(e) Within 6 months after contract award, the contractor shall submit written proof of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (Version 13.1, July 27, 2017) or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

Security Requirements

To be completed in conjunction with completion of the Statement of Work Security Requirements Review

(ER-857).

General

The Contractor must comply with the provisions of Department of Homeland Security MD 4300.

Performance of this contract may require the Contractor to gain access to Sensitive but Unclassified

(SBU) information. SBU information is classified as For Official Use Only (FOUO).

All systems are required to have successful Certification and Accreditation activities performed on them prior to receiving an Authority to Operate from FEMA. The requirements for this action must be coordinated with FEMA Cyber Security Directorate (CSD).

Employment Eligibility

The contractor will ensure that each employee and potential employee provides his/her name and social security number (not card) so that the government may verify the validity of the number. If the number is not valid that employee will not be allowed to work on the contract until the problem is resolved.

Subject to existing law, regulations and/or other provisions of this contract, illegal or undocumented aliens shall not be employed by the Contractor to perform on this contract. The Contractor shall ensure this provision is expressly incorporated into any and all subcontracts or subordinate agreements issued in support of this contract.

Continued Eligibility

The Department of Homeland Security (DHS) reserves the right to deny and/or restrict entrance to government facilities, prohibit employees from assigned work under the contract, deny and/or restrict http://www.whitehouse.gov/omb/circulars_a130

03/10/2021 17 handling of sensitive documents/material to any Contractor employee who DHS determines to present a risk of compromising classified and/or sensitive Government information.

The Contractor shall report to the FEMA Security Office any and all adverse information brought to their attention concerning employees performing under this contract.