RFI Attachment 1 DRAFT Mobile App SOW as of 2.19.26 clean.pdf

Department of Homeland Security

Statement of Work

Enterprise-Wide

Mobile Wellness App

Office of Health Security Total Workforce Protection

Directorate

1. PURPOSE

The purpose of this Statement of Work (SOW) is to procure the configuration, deployment, and maintenance of an existing mobile application specifically designed to support DHS Law Enforcement Officers (LEOs). The application shall promote holistic wellness, reduce injury risk, enhance mental well-being and resilience, and optimize performance to strengthen mission readiness. Following successful initial implementation for DHS LEOs, the application may be expanded to additional Department of Homeland Security (DHS) federal employees. The application shall provide accessible, secure, and user-friendly resources, along with customized programming and support services, to advance health, resilience, and optimized performance across DHS Components.

2. AUTHORITY

5 United States Code (U.S.C.) § 7901 Health Services Programs [Public Law (PL) 79- 658]; Government Management Reform Act of 1994 (PL 103-356); the Privacy Act of 1974, Public Law 93-579 and U.S.C.

§ 552a.; and 31 U.S.C. § 1535, the Economy Act of 1932, as amended; DHS Delegation 26000, "Delegation to the Chief Medical Officer/Director of the Office of Health Security", December 14, 2022;

Department of Homeland Security Appropriations Act, 2023; The Federal Acquisitions Regulations (FAR): http://www.acquisition.gov/FAR/;Federal Acquisition Regulations (FAR) Part 24, Protection of Privacy and Freedom of Information: https://www.acquisition.gov/dars/dars-part-24-protection-privacy-and-freedom-information.

3. BACKGROUND

DHS Law Enforcement Officers (LEOs) serve on the frontline of safeguarding our nation and operate in complex, high-stress environments that require sustained performance, resilience, and adaptability. The operational tempo and physical and psychological demands placed on DHS LEOs necessitate accessible, integrated wellness resources that directly support mission readiness. Current wellness initiatives are provided across Components with limited centralized access and inconsistent data analytics capabilities.

To address this gap, DHS seeks an integrated and secure mobile platform specifically designed to support DHS LEOs by unifying wellness resources, enhancing holistic wellness, reducing injury risk, promoting mental well-being and resilience and optimizing human performance. The application shall provide a communication platform through a secure, user-centric mobile experience. This enterprise-wide mobile application shall be designed to support the well-being of DHS law enforcement personnel and allow for integration with a variety of fitness devices. Moreover, the services shall provide, at a minimum, the capabilities outlined below:

3.0 Overall DHS management of the enterprise-wide mobile wellness application, procurement, configuration, oversight, administration, supervision, quality assurance, maintenance/upkeep, and integration of existing DHS platforms (employee portals, single-sign-on, managed Derived Credentials/PIV/CAC authentication, reporting/technical evaluation requirements)

3.1 Virtual/on-demand health and wellness content (i.e. physical wellness and fitness programs, stress and fatigue management, EAP, mindfulness meditation, nutrition, sleep optimization, injury prevention, etc.) accessible to users across devices, designed to be device-agnostic and interoperable with their chosen wearable technology, dedicated mobile device, desktop, or wellness portal.

3.2 Active engagement and interactions with peers (i.e. push notifications, text, videos, etc.) to include a real time communication platform and provides education and coaching on domains of https://www.acquisition.gov/dars/dars-part-24-protection-privacy-and-freedom-information https://www.acquisition.gov/dars/dars-part-24-protection-privacy-and-freedom-information holistic health and wellness.

3.3 Data organization and management that facilitates a health practitioner or trainer to support and adjust training/workouts for tactical athletes, record keeping (i.e. monthly/quarterly reporting, diagnostics or assessments for tracking utilization, holistic well-being of the user, etc.) in real time to help measure wellness, optimize performance, and reduce injury for law enforcement, first responders, or other tactical special operation teams.

3.4 Compatible across both iOS and Android platforms in phone and tablet-based formats and physiological wearables

4. SCOPE OF WORK

The scope of this effort is to establish an enterprise-wide mobile application specifically designed to support DHS Law Enforcement Officers (LEOs), which also includes the administration of the program, marketing, and obtaining and maintaining the Authorization to Operate (ATO). The Contractor shall assist in the configuration, customization, implementation, and sustainability of an existing mobile wellness application that:

4.0 Serves initial DHS Law enforcement cohort of 106,000 personnel. Following initial implementation for DHS LEOs, the application may be expanded to additional 124,000 DHS federal employees.

4.1 Compatible with both iOS and Android platforms in phone and tablet-based formats and ability to allow DHS to manage and configure devices, phones, and assets. The enterprise-wide mobile application data shall provide an overarching leadership dashboard for OHS while also supporting multi levels across the enterprise.

4.2 The enterprise-wide mobile wellness application technical requirements shall include the capability to provide 24/7/365 virtual/on-demand health and wellness content, SMS-text-based tools (or similar functionality) or push notifications providing regular check-in with users based on past use of mobile content or decrease in application utilization, and provide multiple application configuration options based on user preferences, and the ability to form alliances with coworkers to create support for each other. The enterprise-wide mobile wellness application shall integrate existing DHS health and wellness content and provide links to mental health resources.

The application shall include access to peer support, chaplaincy, Employee Assistance Program, and peer-to-peer interaction. DHS employee resources shall be available from the application in appropriate logical places via DHS.GOV’s web addresses (e.g., URLs).

4.3 The enterprise-wide mobile wellness application shall be FedRamp or Authority to Operate (ATO) ready to supports enterprise-level security, data privacy, and accessibility standards. The enterprise-wide mobile wellness application shall provide users with a private user experience that protects Personal Identity Information (PII) and limited user location and geographic data in accordance with DHS privacy safeguards requirements, including, but not limited to DHS HSAR 3052.204-72 Safeguarding of Controlled Unclassified Information (JULY 2023). Privacy protection is required by statute, regulation, and the contract and should be protected at the highest level necessary to gain employee trust and Union approval. The enterprise-wide mobile wellness application shall be General Data Protection Regulation Complaint, with reporting segmented by location (at least the state), region, department, role (uniformed/non-uniformed), management/staff, etc. while ensuring privacy.

4.4 The enterprise-wide mobile wellness application shall be focused on proactive and preventative resources and strategies. The application should easily provide anonymous access to current DHS employee resources, web-based wellness offerings, mental health resources, and resiliency resources. Enabling location services should not be a requirement for use of the enterprise-wide mobile application.

The scope of work includes requirements analysis, configuration, system design, mobile development, integration, testing, deployment, training, user guides, communications, sustainment support features, and highly integrated services of an existing application that will include but not limited to:

4.5 Wellness Activities: Virtual mindfulness and stress reduction techniques, challenges, and achievement programs.

4.6 Lifelong Coaching: Personalized support to help you reach your personal health and nutrition goals, such as weight loss, better sleep habits, and fitness adherence.

4.7 Nutrition and Weight Management Support: Virtual health education webinars, food tracking, recipe library, and personal health and nutrition goals.

4.8 Health Education: Virtual webinars and curated library content (e.g. stress/fatigue management, nutrition, exercise and injury prevention, sleep optimization, etc.) available on demand via wearable technology, Android app, iOS app, desktop, mobile device, or wellness portal.

4.9 Psychologist Liaison Program: Connection to peer support, EAP, and embedded psychological health experts across DHS.

4.10 Workout/Physical fitness: Structured workout and physical fitness programming, including strength, mobility, endurance, and recovery exercises designed to support injury prevention, operational readiness, and overall performance.

4.11 Additional Enhancements shall include device agnostic integration with wearable fitness devices and smartwatches, AI-based detection and real-time intervention prompts, and multilingual support.

5. OBJECTIVE

The functional and technical objectives of this initiative are to:

5.0 Enhance Law Enforcement Officer wellness, resilience, and readiness.

5.1 Centralize access to health, wellness, fitness resources, articles, videos and guidance on mental, emotional, and physical well-being.

5.2 Deliver personalized content and self-service tools for mental, emotional, and physical well-being.

5.3 Provide data-driven insights to inform organizational wellness strategies.

5.4 Data protect and ensure compliance with DHS IT security, accessibility, and privacy standards (HIPAA compliant for health-related data, FISM-compliant data protection, FedRAMP moderate or higher compliance, third-party security assessments).

5.5 Authenticate single sign-on via DHS Identity Management Systems

Other preferred features include:

5.6 508 compliant.

5.7 One-click link access to DHS's Employee Resources, EAP, and hotline numbers.

5.8 Ability to upload/refresh current DHS component resources (e.g. POCs, telephone number, websites, etc.).

5.9 Ability to guide LEO’s to relevant resources based on user’s selections, preferences, and in-app interactions.

5.10 An option to set up peer support, friend, psychological health expert, health practitioner, or trainer across DHS for support.

5.11 Wellness challenges/incentive-based features, health and wellness videos, calendar of events, downloadable electronic documents, and financial wellness resources.

5.12 Data Collection/Analytics Dashboard for program administrators to aggregate trends (no PII exposure).

a. Ability to filter resources based on geographic area and component.

b. Facilitate the OHS dashboarding capability.

c. Collect and aggregate data for usage and subject matter to assess what types of events, programs, topics, resources are fueling employee engagement and identify trends.

d. Provide an algorithmic gauge to assess unique needs of employees and to assist the employee with trends and/or behaviors and interests.

6. DELIVERABLES

At a minimum, the Government requires the following deliverables. In addition, the Contractor shall propose any additional deliverables based upon their technical and management approach that collectively provide sufficient evidence of satisfactory performance of activities required. The content and format shall be mutually agreed upon by the Contractor and OHS/TWPD program office.

6.1 Deliverable Format

The presentation of deliverables, which includes texts, briefings, and any charts or other graphics shall be formatted as follows:

a. Marked with DHS logo and header.

b. Text may be formatted in any of the commonly available word processing programs marketed by the IBM®, Corel®, or Microsoft® corporations.

c. Provide a single file that contains the whole document ready for printing. It should reproduce the printed report exactly.

d. Tables and tabular material shall not be converted into graphical images but be included with the word processing files or delivered as spreadsheet files (Excel®).

e. Graphic figures such as bar and line charts, diagrams, and other drawings if required, shall be delivered in the GIF (Graphics Interchange Format) or the JPEG (Joint Photographic Experts Group) format. Graphical elements may be merged with the text to form a single file for printing purposes, or they may be delivered as separate files.

f. Adobe’s Portable Document Format (PDF®) if required may not be substituted for the above word processing formats. An unlocked PDF version may be provided in addition to the word processing version, but it is not required. Provide presentations, such as PowerPoint®, as separate files.

6.2 Period of Deliverables for Government and Contractor

a. The Government shall review all deliverables within 5 days of receipt.

b. The Government shall notify the Contractor in writing of acceptance, conditional acceptance, or rejection.

c. The Government shall ask the Contractor to revise and resubmit rejected, identified deficiencies, or conditionally accepted deliverables within 15 days. Requests by the Contractor to submit deliverables within a different timeframe shall be approved by the COR.

d. The Government shall accept final deliverables based on compliance with SOW requirements, DHS security standards, and quality expectations.

6.3 The Contractor shall prepare and provide deployment and accessibility instructions for user registrations/subscriptions within thirty (30) days of the contract award.

6.4 The Contractor shall provide technical requirements, systems security information, test case results, final deployment of enterprise-wide mobile application, and corrective action plan to OHS, the Contracting Office, Contracting Offer Representative (COR) and other interested government personnel with DHS (see table for various due dates and method of delivery).

6.5 The Contractor shall prepare and provide a monthly status reports documenting daily/weekly/monthly membership registrations, subscriptions, and user metrics. The status report shall indicate trends, and any problem areas identified in the previous month(s). The report shall be due by the end of the first week at the start of the following month.

6.6 The Contractor shall meet with the COR weekly or monthly as needed to discuss and report membership data, new developments, issues, risks, or challenges to enterprise-wide mobile application operations, its timeline, quality, or deliverables. Minutes from this meeting shall be documented by the OHS and Contractor staff.

6.7 Deliverables Table

ITEM

SOW

Reference

DELIVERABLE (D) / MILESTONE (M) DUE DATE Method of Delivery

Government/ Contractor Template/ Material

1. Sect 7 Kick-Off meeting Within 5 days of award

N/A NA

2. Sec 9 Project Management & Implementation Plan / defines approach, deployment, accessibility instructions and schedule

Within 30 days of award

Electronic copy

Contractor Platform

3. Sec 8 Requirements Analysis Report / functional technical requirements

Within 60 days of award

Electronic copy

Contractor Form

4. Sec 14 Systems Design Document / architecture, data flow, and security design

Within 90 days of award

Electronic copy

Contractor Form

5. Sec 9 Prototype/Beta Version / fully functional pilot app Within 120 days of award

N/A Contractor Form

6. Sec 14.5 Sec 20.0

User Acceptance Testing (UAT) Report / test cases, results and corrective actions

Within 150 days of award

Electronic copy

Contractor Form

7. Sec 6.4 Final Application Deployment / full operational release across DHS

Within 180 days of award

Electronic copy

Contractor Form

8. Sec 15 Sec 20.3

Training and User Guides / Administrator and end-user documentation

Within 210 days of award

Electronic copy

Contractor Form

9. Sec 6.5 Sec 8

Progress Reports / status updates, risks, meeting minutes, and metrics

Weekly or monthly as needed

Electronic copy

Contractor Form

10. Sec 14.12 Sec 19.1

Sustainment & Maintenance Plan / ongoing support and update strategy

Within 5 days of project completion or as needed

Electronic copy

Contractor Form

11. Sec 14 IT Systems Security Plan Submit at the time of proposal

Electronic copy

Contractor Form

12. Sec 14 DHS Authorization Decision Within 365 days of contract award

Electronic copy

Government Form

13. Sec 19 Section 508 Test Plans TBD Electronic copy

Contractor Form

14. Sec 20.1 Section 508 Test Results TBD Electronic copy

Contractor Form

15. Sec 19 Section 508 Accessibility Conformance Reports Upon Request Electronic copy

Government Form

16. Sec 20 Other Sectio 508 Documentation Upon Request Electronic copy

Contractor Form

17. Appendix A

Security Document Destruction Plan Submit within 180 days of awarded contract

Electronic copy

Contractor Form

7. KICK-OFF MEETING

No later than five (5) business days after the effective date of the award, key members (as designated by the Contractor) of the Contractor’s staff who will be assigned major responsibility for carrying out the tasks of the application shall meet with the Contracting Officer (CO), COR, and other interested government personnel within DHS in a Microsoft Teams meeting. This meeting will ensure the Contractor and the Government have a common understanding; in addition, they will discuss the project’s objectives, course of action plans, milestones and deliverables, and resolve any differences between the technical requirements and the Contractor’s approach. The Contractor shall first conduct a briefing (i.e.

30–45 minutes) describing the plan’s approved approach. The Contractor shall be prepared with appropriate briefing materials.

8. MONTHLY STATUS REPORTS

The Contractor shall on or before the 10th calendar day of each month by 3:00 PM EST/EDT submit the Monthly Status Report to the COR electronically. Each report shall summarize activities for the preceding month, to include total number of registrations processed, work accomplished; work planned; any problems encountered or anticipated; problems resolved; expenditure rate with corresponding roll up to major task component; and any other pertinent issues, as well as identified significant work-ahead for the next reporting period. The format should be in Microsoft (MS) Suite to include MS Word, MS Excel, MS PowerPoint, MS Access or Adobe Acrobat (PDF). Should the 10th day of the month fall on the weekend or Federal holiday, the report is to be submitted the first Federal workday preceding the weekend or Federal holiday.

At a minimum, this report shall include a narrative description of the following items:

8.0 Accomplishments made during the reporting period.

8.1 Plans for accomplishments in next reporting period.

8.2 A review of the overall progress in the conduct of this application.

8.3 Problems or delays that the Contractor has experienced in the conduct of services.

8.4 Specific action that the Contractor would like DHS to undertake to help alleviate an identified problem.

8.5 Invoices submitted and paid during the reporting period.

8.6 Enrollment status to include the number of employees registered and applications installed/uninstalled.

8.7 Application performance, user satisfaction, and corrective action tracking.

9. IMPLEMENTATION PLAN

The Contractor shall provide a detailed Implementation and Project Management Plan thirty (30) calendar days after award that includes approach, 120-day deployment of functional app, accessibility instructions and scheduled procedures for services, products and deliverables required under this SOW. The Implementation Plan’s shall include:

9.0 Transferring work to the incumbent Contractor.

9.1 Potential problems and mitigation plans.

9.2 Assumption of full mobile application responsibilities.

9.3 Transferring documentation and resources currently in process.

9.4 Document all current work and processes.

9.5 Coordinate the work with the Contractor.

The Contractor shall make all necessary preparations to begin performance in accordance with its Implementation and Project Management Plan in order to ensure no impact to daily operations or scheduled critical activities.

10. ACTIVITY MEETING

The Contractor shall meet with the COR weekly or monthly or more frequently, as needed, to discuss and report membership data, new developments, issue risks, or challenges to the enterprise-wide mobile wellness app operations, its timeline, quality, or deliverables.

11. MEETING MINUTES

Minutes from the activity meeting shall be documented by the OHS and Contractor staff. The minutes of meetings shall include attendance, issues discussed, decisions made, and action items assigned. Minutes shall be provided to the COR and Contractor electronically within five (5) business days following each meeting conducted. This will ensure that all participants are well-informed and up to date on all activities and are provided with an opportunity to identify other activities and establish priorities, as well as coordinate resolutions of identified problems.

12. PERFORMANCE PERIOD

The anticipated performance period is a 12-month base period plus four (4) 12-month option periods for continued maintenance, technical support, and enhancement services.

13. PLACE OF PERFORMANCE

Work shall be performed remotely and/or at DHS-approved facilities within the Continental United States

(CONUS). The Contractor staff shall be available during regular business hours (Monday through Friday) between the hours of 9:00 AM until 5:00 PM Eastern Standard Time to assist / answer questions and provide technical assistance.

14. IT SYSTEMS SECURITY PLAN

14.0 The Contractor shall submit a draft security plan prior to awarded contract describing how the mobile wellness app meets federal requirements and evidence of security measures as part of the proposal of this contract. This draft plan shall describe the processes and procedures that will be followed to ensure appropriate security of all systems operated and maintained in the performance of this contract.

14.1 The Contractor shall describe the existing system security architecture and environment for the mobile wellness application.

14.2 The Contractor shall identify applicable federal security standards and frameworks (e.g.

FISMA, NIST, etc.) and summarize the current security posture.

14.3 The Contractor shall describe the types of data collected, stored, or transmitted by the application and associated data protection measures (e.g. encryption, etc.)

14.4 The Contractor shall summarize identity management and user authentication methods supported by the mobile wellness application.

14.5 The Contractor shall include a final security plan, risk assessment, security testing and evaluation, disaster recovery plan, and continuity of operations plan.

14.6 This draft plan, when accepted by the Government, shall be incorporated into the contract as a compliance document. The Contractor shall comply with the criteria of DHS Policy Directive 4300A.

14.7 DHS will provide an estimated timeline for supporting DHS security assessment and Authorization to Operate (ATO) activities post awarded contract.

14.8 DHS will identify any known security risks, limitations, or dependencies that may impact deployment within a DHS environment.

14.9 The Contractor shall be responsible for providing solutions for vulnerability management, incident responses, and security monitoring for all security reviews connected to the DHS ATO process. This applies to the Contractor’s entire enterprise information technology architecture and any information technology resources or services for which the Contractor shall have physical or electronic access to sensitive information contained in DHS systems.

14.10 The Contractor shall, within thirty (30) calendar days after the post-award, provide the ATO approval of its IT System Security Plan to the contract PM, CO and COR. The Contractor’s approved IT System Security Plan shall be incorporated into the contract as a compliance document.

14.11 The Contractor’s IT Security Plan shall comply with Federal laws that include, but not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.), the Government Information Security Reform Act of 2000, the Federal Information Security Management Act of 2002, as well as Federal policies and procedures including OMB Circular A-130. The Contractor shall ensure that all systems, applications, and services used in performance of this contract meet the security and privacy controls outlined in NIST Special Publication 800-53, regardless of whether the application is federal or non-federal in origin. For cloud-based services, the Contractor shall utilize only FedRAMP-authorized service providers and shall provide evidence of high-impact baseline FedRAMP authorization. The Contractor shall support DHS in obtaining Authority to Operate by providing all necessary documentation, evidence, and support to facilitate the ATO process.

14.12 The Contractor’s IT Security Plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site, including any information stored, processed, or transmitted using the Contractor’s computer systems. The plan shall address secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems in accordance with NIST SP 800-53 controls and DHS-specific requirements. Examples of tasks that require security provisions include:

a. Acquisition, transmission, or analysis of data owned by DHS with significant replacement cost should the Contractor’s copy be corrupted, and Access to DHS networks or computers at a level beyond that is granted to the general public (e.g., such as bypassing a firewall). All such activities must be conducted using systems with implemented NIST SP 800-53 controls and, for cloud services, FedRAMP authorization.

b. At the expiration of the contract, the Contractor shall return all sensitive DHS information and IT resources provided to the Contractor and certify that all non-public DHS information has been purged from any Contractor-owned system, in accordance with DHS data sanitization and destruction requirements.

c. DHS Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced. The Contractor shall cooperate fully with DHS security reviews, audits, and assessments, and provide all requested evidence of compliance with NIST SP 800-53 and FedRAMP high impact baseline requirements, as applicable.

15. GOVERNMENT FURNISHED EQUIPMENT AND INFORMATION

DHS shall provide access to relevant DHS wellness materials, APIs, branding assets, and security documentation necessary for integration and compliance under this awarded contract. The Contractor’s access to information shall be protected under the Privacy Act and shall be required thereunder the awarded contract. The Contractor’s employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

16. INTELLECTUAL PROPERTY

All intellectual property resulting from activities undertaken in performance of this awarded contract shall be governed under the applicable FAR patent and data rights clauses incorporated therein the awarded contract, including FAR 52.227-1, 52.227-2, and FAR 52.227-17, along with any special awarded contract requirements prescribed therein Section H that relate to data and patent rights.

17. SECURITY

The Contractor’s access to unclassified, but security sensitive information, shall be required under this awarded contract. The Contractor’s employees shall safeguard this information against unauthorized disclosure or dissemination.

The work under this SOW shall be unclassified. All Contractor employees shall be required to complete a Non-Disclosure Agreement (DHS Form 11000-6) within two (5) business days after award; or prior to performing any work on this contract.

18. PRIVACY REQUIREMENTS

18.0 Compliance with DHS 4300A Sensitive Systems Policy Directive.

18.1 FedRAMP higher for cloud environments.

18.2 All data transmissions must be encrypted end-to-end.

18.3 508 Compliant.

19. SECTION 508 REQUIREMENTS

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://https://www.ecfr.gov/current/title-36/chapter-XI/part-1194 revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this SOW have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer, and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018, and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

19.0 When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

19.1 When providing maintenance upgrades, substitutions, and replacements to ICT, the Contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance. The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

19.2 When providing Platform as a Service (PaaS) or Software as a Service (SaaS), the Contractor shall ensure services conform to the applicable Section 508 standards (including the requirements in Chapter 5 for software and WCAG Level A and AA Level 2.0 success criteria for web and software. When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall ensure conformance to the Functional Performance Criteria specified in Chapter 3.) The agency reserves the right to request an Accessibility Conformance Report (ACR) for PaaS and SaaS offerings. The ACR should be created using the Voluntary Product Accessibility Template Version 2.2 508 (or later). The template can be located at https://www.itic.org/policy/accessibility/vpat.

19.3 When providing cloud hosting services (Infrastructure as a Service, Platform as a Service, https://www.ecfr.gov/current/title-36/chapter-XI/part-1194 https://www.itic.org/policy/accessibility/vpat https://www.itic.org/policy/accessibility/vpat

Software as a Service, etc.) the Contractor shall ensure user administrative screens, dashboards and portals used to configure and monitor cloud services conform to Section 508 standards.

19.4 The Contractor shall ensure cloud hosting services shall not reduce the level of Section 508 conformance for ICT migrated by DHS to the cloud hosting environment.

19.5 When providing ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements are evaluated within each iteration and release that contains user interface functionality.

19.6 When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

19.7 When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

19.8 When providing ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester.

19.9 Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this SOW.

20. SECTION 508 DELIVERABLES

20.0 Test Plans: When providing ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the life cycle of the awarded contract, who will conduct the testing, how test results will be reported, and any key assumptions.

20.1 Test Results: When providing ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

20.2 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are provided https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/trusted-tester pursuant to this contract), the Contractor shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

20.3 Documentation: The following documentation shall be provided upon request for ICT items offered through this awarded contract:

a. Documentation of features provided to help achieve accessibility and usability for people with disabilities.

b. Documentation on how to configure and install the ICT Item to support accessibility.

21. CONTRACT PERSONNEL

The Contractor shall maintain an adequate workforce to ensure uninterrupted performance of all tasks defined within this SOW.

The Contractor shall ensure that its personnel identify themselves as Contractors when attending meetings, answering telephones, providing any type of written correspondence, or working in situations where their actions could be construed as official Government acts.

22. TRAVEL

No travel is anticipated under this SOW.

23. CHANGES TO SOW

All changes to this SOW shall be authorized only by the CO as coordinated by the COR through a formal contract modification in accordance with the contract changes clause.

24. QUALITY CONTROL

The Contractor shall employ its commercial quality control program/procedures to identify, prevent, and ensure non-recurrence of defective services. Through implementation of the Contractor’s quality control program/procedures, the Government shall receive quality services meeting the requirements of this contract.

25. POINTS OF CONTACT

To be Determined

26. APPLICABLE DOCUMENTS OR REFERENCES

See Appendix A, Reference Document.

http://www.itic.org/policy/accessibility/vpat.

SOW Appendix A- Applicable Documents and References

INFORMATION SYSTEM SECURITY COMPLAINCE- AUTHORIZATION DECISION (AD)

The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor information technology system without an Authorization Decision signed by the DHS Headquarter or DHS Component Chief Information Officer (CIO), or designee, in consultation with the DHS Headquarter or DHS Component Privacy Officer. Unless otherwise specified in the Authorization Decision, the Authorization Decision is valid for one (1) year. The Contractor shall adhere to current and updated federal and DHS-specific policies, procedures, and guidance for the Security Authorization (SA) process as defined in https://www.dhs.gov/publication/security-training-contract-policy and NIST Special Publication 800-37, Revision 2, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, January 2020.

The Contractor’s Information System Security Officer (ISSO) shall coordinate all security activities with the Federal ISSO and/or System Owner. The Portfolio Management Division Information System Security Manager (ISSM) will provide guidance to the Federal ISSO for management with the Contractor ISSO where needed.

All information technology and security compliance documents shall be submitted to the Contracting Officer’s Representative (COR) and reviewed and approved by the DHS Chief Information Security Office Directorate (CISOD) upon creation and after any subsequent changes before they go into effect.

All security documentation and artifacts will be uploaded and documented in the DHS system of record.

DHS ENTERPIRSE ARCHITECTURE COMPLIANCE

The cloud-based interface and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the Contractor shall comply with the following Homeland Security (HLS) Enterprise Architecture (EA) requirements:

1. All deliverables and requirements shall be compliant with the HLS EA.

2. All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

3. Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Mobius.

4. Development of data assets, information exchanges and data standards will comply with the

DHS Data Management Policy MD 103-01, and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

5. Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement.

All EA- related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program. The http://www.dhs.gov/publication/security-training-contract-policy

Contractor shall utilize and adhere to the DHS Enterprise Security Architecture to the best of its ability and to the satisfaction of the Government. Areas of consideration could include:

6. Use of multi-tier design (separating web, application and data base) with policy enforcement between tiers.

7. Compliance with DHS Identity Credential Access Management (ICAM).

8. Security reporting to DHS central control points (i.e. the DHS Security Operations Center

(SOC) and integration into DHS Security Incident Response.

9. Integration into DHS Change Management (for example, the Infrastructure Change Control Board (ICCB) process).

10. Performance of activities per continuous monitoring requirements.

The Contractor shall participate in DHS’s Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that DHS determines acceptable. The DHS Chief Information Security Officer (CISO) issues annual updates to its Continuous Monitoring requirements via the Annual Information Security Performance Plan. At a minimum, the Contractor shall implement and maintain the following processes in accordance with the NIST Special Publication 800-137 Information Security Continuous Monitoring for Federal Information Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-137/final):

11. Asset Management

12. Vulnerability Management

13. Configuration Management

14. Malware Management

15. Log Integration

16. Security Information Event Management (STEM) Integration

17. Patch Management

18. Provie application event logs to the DHS Security Operations Center (SOC)

19. Near-real-time security status updates to the DHS SOC

The Contractor shall comply with requests to be audited and provide responses within three (3) business days to requests for data, information, and analysis from DHS and any applicable Component COR. The Contractor shall provide support during the audit activities and efforts. These audit activities may include, but are not limited to, the following: requests for system access for penetration testing, vulnerability scanning, incident response and forensic review.

DHS Application Architecture Compliance

The Contractor shall ensure that the application is designed for browser independence (i.e., the https://csrc.nist.gov/publications/detail/sp/800-137/final application will generally work with any of the major browsers). DHS HQ currently uses Microsoft Edge (Version 105.0.1343.50 (Official build) (64-bit)) configured with numerous Group Policy Objects (GPOs) as well as Firefox (102.3.0esr (64-bit)), similarly, secured with centrally managed security policies.

Browser specific implementations or limitations on browser independence shall be approved in writing by DHS OCIO prior to development. Web Applications should be designed utilizing a responsive web design (RWD) approach, to provide an optimal viewing and interaction experience, independent of that particular platform capabilities the end user is utilizing. If DHS OCIO upgrades to a newer version of Microsoft Edge or Firefox, the Contractor shall ensure the application is compatible with the future version.

DHS OPEN-SOURCE COMPLIANCE

The Contractor shall follow the DHS Reusable and Open-Source Software Policy Directive (Policy Directive 142-04) when evaluating any technologies, tools, software, and/or application programmable interfaces (APIs) to support a system.

FEDRAMP CERTIFICATION COMPLIANCE

The Contractor’s enterprise architecture shall be hosted on a FedRAMP authorized, cloud-based software as a solution (SaaS), or in one of the DHS cloud-based environments. At a minimum, the Contractor’s enterprise architecture shall have a high impact level.

CYBER-SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

1. Definitions

a. Component: a unit defined by the supplier that connects to and functions as part of the product. For software products, a component is a unit of software defined by a supplier at the time the component is built, packaged, or delivered. For hardware, a component is one hardware unit designed to connect to and function as part of a larger product.

b. End-of-Life (EOL): means that an ICT product has reached the final stage of the product life cycle in which that version of the ICT product will no longer be supported nor manufactured (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

c. End-of-Support (EOS): means that an ICT product will no longer be supported (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

d. Information and Communications Technology (ICT): encompasses the capture, storage, retrieval, processing, display, representation, presentation, organization, management, security, transfer, and interchange of data and information; includes all categories of ubiquitous technology used for the gathering, storing, transmitting, retrieving, or processing of information (e.g., microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks).

e. Product: part of the equipment (hardware, software and materials) for which usability is to be specified or evaluated.

2. Original Equipment Manufacturer (OEM) End-use Information and Communications Technology (ICT) Product.

a. The Contractor shall provide new equipment unless otherwise formally approved by the

Government, in writing. The Contractor shall provide only Original Manufacturer (OEM) end-use products to the Government. In the event that a shipped OEM product, or part or component of that product, fails, all replacements must be new (i.e., non-refurbished, not previously used) OEM.

b. The Contractor shall provide previously used OEM products only with written Government approval. Such parts shall be procured from their original source and shipped only from the manufacturer's authorized shipment points.

3. Accounting of Components in ICT Products

a. The Contractor shall provide and maintain a list of components for each product used in performance of the contract, including through subcontracts or other arrangements. This list for each product shall provide the component manufacturer's name, address, state, and/or domain of registration, and, where applicable, the Unique Entity Identifier (UEI) number, for all components comprising the ICT products.

b. The Contractor shall notify the Government when a new contractor/subcontractor/service provider is introduced to the ICT provided on this contract, or when suppliers of components or products are changed. If a software component used in the performance of the contract is updated with a new build or release, the Contractor must update the list provided in accordance with (i) above to reflect the new version of the software. This includes software builds to integrate an updated component or dependency.

c. For software products, the Contractor shall provide all OEM software updates, and patches to correct defects, for the life of the product [i.e., until the "End of Life" (EoL) or "End of Support" (EoS)]. Software updates and patches shall be made available to the government for all products procured under this Contract and replaced when End of Support (EoS) is reached.

d. A contractor using team members in performance of the contract (e.g., subcontractors or other service providers) shall ensure that the standards for the accounting of components in this subsection are met by team members.

4. Supply-Chain Transport

a. The Contractor shall use formal, documented and accountable transit, storage, and delivery procedures (i.e., the possession of the end-use product to be delivered is documented at all times from initial shipping point to final destination, and every transfer of the product from one custodian to another is fully documented and accountable) for all information and communication technology (ICT) shipments to fulfill this contract.

b. The Contractor shall maintain all records pertaining to the transit, storage, and delivery of

ICT deliverables under this contract through at least 6 months after acceptance and make available for inspection upon request of the Government.

c. The Schedule Contractor shall make use of tamper-proof or tamper-evident packaging for all shipments.

d. The Contractor shall provide a packing slip for each container or package with the information identifying the contract or order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact.

e. The Contractor shall provide a shipping notification to the intended government recipient;

with a copy transmitted to the Contracting Officer, or other designated representative. This shipping notification shall be provided electronically and identify the contract or order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

5. Changes to Ownership and Control

a. The Contractor shall immediately notify the Contracting Officer and Contracting Officer's Representative regarding any significant changes to corporate ownership or control from contract award through final delivery or the end of the period of performance.