RFI instruction and attachement.pdf

Request for Information (RFI) Instructions

1. Background:

This is Sources Sought Request for Information (RFI) to identify potential small businesses who are interested and capable to meet Food and Drug Administration’s requirements of seeking Commercial Off-the-Shelf software licenses and operations and maintenance support for the Comfort Zone™ Ergonomic Reporting Software. Please review Attachment 1

– Draft Performance Work Statement for detail information on the requirements.

2. General Instructions:

This RFI is for information, planning and market research purposes only and shall not be construed as either a solicitation or obligation on the part of FDA or its Centers.

FDA welcomes responses from all interested small businesses to submit a response to this RFI. FDA does not intend to make a selection decision or award a contract on the basis of responses nor otherwise pay for the preparation of any information submitted or FDA's

Additionally, the FDA does not intend to hold discussions concerning this RFI with any interested parties. However, FDA reserves the right to contact vendors if additional information is required.

A complete response to the RFI should include answers to all of the questions below. Please note that a respondent's failure to provide a complete response to a question will be interpreted to mean that it does not understand the question and does not demonstrate the capability to provide services required. Responses should demonstrate capability, not merely affirm the respondent's capability (e.g.: The response must go beyond the statement that, "XYZ company can provide Material characterization and Analysis Services.").

The RFI responses should be submitted via email to Min Jie Zeng at minjie.zeng@fda.hhs.gov and Lilibeth Deato at Lilibeth.Deato@fda.hhs.gov by 4PM ET on July 22, 2024. E-Mail is the only acceptable method of delivery for this notice of sources sought.

3. Questions:

1) On the FACE PAGE of your response, please provide the following:

a. Organization name

b. DUNS number

c. Organization's website

d. Contact Name

e. Contact Telephone

f. Contact E-mail address

g. Size designation and type (i.e. Small Business, etc)

h. Number of employees in your organization

i. Your organization's current and gross revenue

j. Current GSA Federal Supply Schedule number

2) Elaborate previous experience on performing similar types of tasks specified in Attachment 1 – Draft Performance Work Statement. The elaboration on each experience shall include:

a. Evidence of performing the similar types of tasks, including but not limited to the contract number, period of performance, and the Government or private entity customer POC.

b. Brief introduction of the project’s objective and scope.

c. Brief description of the methodology and equipment used to perform the similar types of tasks.

3) Do any gaps exist in the Draft Performance Work Statement? If so, what are they? What changes, additions, updates, and clarifications would you suggest?

4) What is the NAICS code would you suggest use for this requirement?

5) What contract type would you recommend to use for this requirement?

4. Attachments:

Attachment 1 – Performance Work Statement

Food and Drug Administration

Draft Performance Work Statement (PWS)

1. General

1.1 Project title

Operations, Maintenance Support and Licenses for the Comfort Zone™ Ergonomic Reporting Software.

1.2 Introduction

The purpose of this Performance Work Statement (PWS) is to outline the requirements for the operation and maintenance of Comfort Zone™ software within the Food and Drug

Administration's Amazon Web Services (AWS) environment. The Contractor shall provide all necessary personnel, materials, and services to ensure the successful operation and ongoing maintenance of the Software as a Services (SaaS) product in accordance with the specifications outlined herein.

The Contractor shall provide all license key access for Comfort Zone™ software to the

FDA for usage on the platform.

1.3 Objective

To ensure the successful implementation, maintenance, and utilization of Comfort Zone™ software within FDA's IT infrastructure, including all environments; ultimately supporting the agency's mission to protect and promote the health and safety of its employees.

1.4 Scope of Work

The scope of this contract is the complete range of services necessary to provide FDA with verification of proper installation, creation, and maintenance of ComfortZone and corresponding ancillary systems. The task areas include contract management, installation services, maintenance, and consulting services and will be detailed in individual tasks.

1.5 Background

At the Food and Drug Administration (FDA), the Center for Employee Safety and Occupational

Health (ESOH) provides a comprehensive ergonomics program with focus on a proactive approach to increase worker productivity, through the prevention of musculoskeletal disorders

MSD’s, while reducing the Agency’s liability for worker’s compensation related costs.

In 2021, ESOH embarked on an enterprise-wide modernization of their ergonomics program processes and support methodologies by purchasing Comfort Zone™ Software and having it installed in FDA’s Amazon Web Services (AWS) Cloud Environment.

1.6 Type of Contract Contemplated

Firm Fixed Price contract is appropriate for the services provided in this contract.

1.7 Period of Performance

The period of performance of this contract consists of a base year and four option years, beginning on September 30, 2024, or at the time of award.

1.8 Place of Performance

The services provided in this contract, will be provided remotely; entirely at the contractor’s facility (off site).

The installation, operation, and maintenance services on Comfort Zone™ Software shall be performed in FDA's designated AWS environment and FDA on-premise server(s).

2. Performance requirements

2.1 Verification of Software Installation and Operability

The contractor shall ensure ComfortZone is successfully operable in FDA’s AWS cloud environment.

Confirmation of successful Installation: Ensure the seamless installation and configuration of ComfortZone (CZ) software within the Food and Drug Administration's (FDA) Amazon Web Services (AWS) environment, meeting all specified requirements and compatibility standards.

The requirements shall include, but are not limited to:

Conduct thorough testing to verify the functionality and integrity of the CZ software post-installation.

Coordinate with FDA's IT Cloud teams to identify appropriate AWS instances for the CZ software installation. If needed update or correct installation configurations of the CZ software in the designated AWS instances, ensuring compatibility and optimal performance.

2.2 Cloud and IT Infrastructure Management

The FDA will provide the Amazon Cloud Platform (AWS Government, EC2) and infrastructure, including network admin access for the Comfort Zone™ (CZ) application.

The requirements shall include, but are not limited to:

Post award of the contract the contractor shall successfully obtain access through FDA IT’s approval to the cloud environment, and existing CZ databases.

Maintain the resident CZ application and its assigned resources (e.g., servers), tools, utilities, databases, and storage in the EC2 environment.

Submit internal IT request for modification to existing installation or for any newer versions of CZ prior to deployment in EC2 environment to the COR and FDA IT for approval prior to deployment.

Maintain the CZ application and the supporting infrastructure in accordance with

FDA standard information and technology infrastructure.

Maintain and perform all received FDA IT directives regarding the Infrastructure and Cloud platform (e.g., verification after software update).

Resolve infrastructure issues (servers, networks, databases).

Resolve app logic issues, including code and integration changes.

Provide cloud resource management in conjunction with FDA IT.

2.3 Comfort Zone™ Application Management

Ongoing Maintenance: Provide timely and effective maintenance and support services for the CZ software, including regular updates, patches, and bug fixes, to ensure optimal performance and minimize disruptions to FDA operations.

CZ Version Upgrades

Review available CZ Version Upgrade with COR to determine priority, value, and impact if the CZ Upgrade is installed.

Submit proposed CZ Version Upgrades to ODT/OIMT and obtain required approvals prior to performing the upgrade.

Plan and schedule deployment of FDA-approved CZ version upgrades.

Perform deployment of CZ Version update with risk mitigation processes in place

(e.g., backout deployment).

Perform operational testing followed by user acceptance testing to ensure the new version is working correctly (e.g., feature/function, stored data and content).

Upgrade CZ in accordance with all OS/Security upgrades and patches.

Maintenance

Identify and plan for infrastructure maintenance (e.g., end-of-life dates, version dependencies).

Perform CZ operational checks to ensure existing version of CZ application, including storage and presentation of user-entered data, is functional and data is accessible by end user.

Identify software issues (e.g., bugs) to be addressed and corrected to resolve the issue, followed by user acceptance testing.

Application Management

Provide timely and effective maintenance and support services for the CZ software, including regular updates, patches, and bug fixes, to ensure optimal performance and minimize disruptions to FDA operations.

The Contractor shall at time be required to modify the software code to ensure it follows FDA IT Security requirements.

Update DevOps configuration and resources as necessary with written documentation of the reconfigurations provided to the government.

Monitor Cloud resources and Infrastructure for usage trends, risk mitigation, and growth planning.

Maintain the Comfort Zone Software so it is in good working order, keeping it free from material defects and errors so that the Comfort Zone Software shall function in accordance with its specifications, and the accepted level of performance and level of use.

Maintain and update CZ software code as needed and whenever changes are needed to the infrastructure environment that require recoding of the platform.

Triage troubleshooting and updates may be performed outside of the support for ergonomic staff timeframe with prior approval of the COR.

Any coding, or environment changes shall be communicated and approved prior to changes by the CCB.

All upgrades, any major code changes, and any major maintenance work shall be done during business hours only after approval is received from ODT CCB.

FDA CZ SSO: FDA IPD SSO integration with CZ SSO offering this includes SSO definition (e.g., protocol, supported actions), SSO settings and integration testing, and adherence to FDA SSO Compliance.

o SAML protocol o IDP or SP initiated SSO process o SAML Statements for Authorize Access and Attribute Updates

FDA Application/Data Integration with CZ Software: this includes ensuring implementation of data security (e.g., sensitive data), smooth interoperability with existing FDA applications and resources (e.g., databases, storage).

FDA CZ software modifications: FDA has identified the requirement to replace CZ content (e.g., PDF header text) to be customer-defined text (e.g., ability for administrator to enter/modify presented text as part of CZ customization).

CZ Application Availability and Performance

Comfort Zone Availability and Response Time is dependent on the capabilities and performance of the FDA-provided ES2 platform and defined resources.

Target CZ Availability o 98% of FDA business window (7:00am and 7:00pm Eastern Standard Time (GMT-

5:00), Monday through Friday, excluding legal holidays in Maryland and/or the United States) o If the CZ Site is not available (e.g., site is down):

IT services must initiate issue identification/recovery and issue a progress statement within 3 hours of FDA-notification that system is down.

During the Issue Identification/Recovery process, a Progress Update should be provided to COR and to CZ End User Support every two hours or as directed by the COR.

Recovery may require work with ODT/OIMT, on an as needed base, to identify and eliminate the issue (e.g., application, network, EC2 resource).

All CZ Functions and Features in the implemented version should be fully operational.

o Identified application bugs should be documented and reviewed with COR for priority, severity, and estimated time period needed to correct bug.

o IT PM and COR will review priorities and define the order of bugs to be addressed as part of the Project Plan addressing all IT service tasks to ensure best use of resources and issue impact (e.g., severity).

Target End User Performance Criteria o Simple Actions – 10 second or less response time o Aggregated Data actions, depends on amount of data to be aggregated

Acceptable Response times Up to 2 minutes response time for large data sets average response time should be 30 seconds or less

2.4 Comfort Zone™ End User Support

Efficient Troubleshooting: Offer responsive technical support to FDA personnel, promptly addressing any issues or anomalies related to the CZ software and providing guidance on best practices for utilization.

Provide a method & procedure for end users to contact for CZ IT support.

Support is provided virtually. On-site is not required.

Provide CZ Administrator services (e.g., respond to user’s password requests, update FDA-content in categories and items) as directed by COR (e.g., defined time-period, defined actions).

2.5 Architecture and Design Support Services

Participate and contribute to cybersecurity risk management framework and information system authorization processes including Authorization to Operate

(ATO) package artifacts.

Support annual planning, which includes providing a consolidated view of current and future architectures.

Be responsible for the integration of all systems and components that become part of the FDA IT production environment, whether purchased/developed internally through the IT organization or purchased/developed by another group within FDA to ensure accessibility, availability, security, and integrity.

The Contractor shall at time be required to modify the software code to ensure it follows FDA IT Security requirements.

The software code must be altered to allow for Single Sign One (SSO) capabilities.

2.6 Cybersecurity Hygiene Support

The Contractor shall conduct periodic and recurring cybersecurity hygiene activities across all contract requirements per the NIST 800-53 control set adopted by FDA. The purpose of cybersecurity hygiene is to ensure the safe handling of critical data, ensure that all applications, systems, and networks are secure, and to proactively address risk.

The Contractor shall ensure the confidentiality, integrity, and availability of data generated by IT systems and support the assertion that systems operate as intended and that output is reliable. The Contractor shall establish and implement a baseline of practices and controls for managing the most common and pervasive cybersecurity risks

FDA may face.

The requirements shall include, but are not limited to:

Establish and maintain system and network security and monitoring.

Adhere to logical access policies, standards, and processes to manage access based on business need and on least privilege when maintaining user accounts, limiting the number of users with administrative access.

Transition to role-based access and deny privileged access unless explicitly permitted.

Target and implement multi-factor authentication for privileged access for all environments.

Implement controls to protect and recover data.

Perform vulnerability, malware, and threat monitoring and remediation.

Adhere to source code/document version control procedures to protect the integrity of program code.

Ensure the complete and accurate processing of data, from input through output.

Ensure the privacy and security of data transmitted between applications.

Ensure knowledge of cybersecurity processes and targeted controls to avoid unnecessary delays in execution.

Adhere to all FDA regulations and compliances.

Examples of FDA IT and Application Compliance include but not limited to:

o 508 Compliance o IT Security Compliance o User Device IT Security Compliance (e.g., desktop, browser, cookies) o Infrastructure Compliance o Single Sign-on (SSO) Compliance

Follow all Industry Standard guidance compliance and Government regulations

(NIST, Control SI).

Upgrade CZ in accordance with all OS/Security upgrades and patches.

Modify the software code to ensure it follows FDA IT Security requirements.

Update DevOps configuration and resources as necessary.

Monitor Cloud resources and Infrastructure for usage trends, risk mitigation, and growth planning.

2.7 Data Calls and Mandate Responses

The Contractor shall take the appropriate actions to assist with response to Government

Data Calls and Federal Mandates. The Contractor shall be prepared to support IT-related data calls, spanning all requirements of the contract.

The Contractor shall assist in responding to data calls and mandates as directed by the

Government. Examples of data calls include, but are not limited to the following:

Supporting the compilation and maintenance of information to develop responses to cybersecurity related data calls or investigations, and Authority to Operate

(ATO)/Authority to Use (ATU) status data calls or investigations.

Conducting periodic audits to verify and validate 800-53 security controls, Federal Information System Modernization Act (FISMA) compliance, information security, and Authority to Operate (ATO)/Authority to Use (ATU) status.

2.8 Training

Comprehensive Training: Develop and deliver training materials and conduct training sessions for FDA staff to ensure they are proficient in operating and administering the

CZ software, empowering them to utilize its features effectively.

The requirements shall include, but are not limited to:

Develop and deliver training materials for FDA staff on the use and administration of the CZ software.

Update training materials when CZ Version Upgrades are implemented and as needed when code changes and resolved bug issues are deployed.

Contractor will provide training to FDA end users on using, accessing, and administrative controls as per their defined user role within CZ Software.

Conduct training sessions, remotely, to ensure FDA personnel are proficient in operating the CZ software effectively.

Conduct CZ Update training sessions as needed, remotely, to ensure FDA personnel are aware of new features/functions or changes in CZ user operation.

Training provided on as needed basis (e.g. onboarding new ergonomic staff or FDA staff).

2.9 Documentation

Transparent Reporting: Provide clear and comprehensive documentation of CZ software installation procedures, configurations, maintenance activities, and training sessions conducted, facilitating transparency and accountability throughout the contract period.

The requirements shall include, but are not limited to:

Create and update all FDA required documentation as requested by FDA IT through the CPIC, EPLC, ATO review process.

Documentation of lessons learned from prototype evaluation, DEV/PROD environments.

Documentation of CZ software installation procedures and configurations

Create and update all FDA required documentation as requested by FDA’s Office of Digital Transformation (ODT).

Create and maintain CZ Project Plan, to include but not limited to planned upgrades, end-of-life dates (e.g., server operating system version), and scheduled maintenance.

Create and maintain CZ Road map: identification of FDA requested features/functions; CZ planned features/functions.

Document technical and user requirements for FDA-requested features, functions, and modifications to the CZ Application.

Work with Employee Safety and Occupational Health (ESOH) to develop and implement a backup plan in the event the CZ cloud solution goes down.

3. Deliverables

3.1 Internal FDA Network Access

The requirements shall include, but are not limited to:

Successful government provided network access to cloud environment, existing

CZ databases and any necessary administrative IT rights.

3.2 Government Acceptance Testing

The government will conduct use testing and provide feedback and/or acceptance.

Customization of CZ Software, ensure functionality post-customization and/or code base configurations/alterations.

Authorization to Operate (ATO) documentation and submission.

3.3 Status Reporting

Provide appropriate status reporting to monitor the quality assurance, configuration management, and security management of CZ Software. Define the level of quality expected using key performance indicators (KPIs), service level agreements (SLAs) or the like.

The requirements shall include, but are not limited to:

Regular maintenance reports detailing updates, patches, and any resolved issues.

Provide documentation outlining the installation process, configurations, and any necessary troubleshooting procedures.

3.4 License Keys

The FDA CZ site license is renewed or updated with additional user licenses using an AG-provided license key.

The contractor shall provide license keys for FDA’s usage for a minimum of 12 consecutive months of access per license key.

Delivery of the licenses in advance to ensure seamless transition from year-to-year service.

Provide documentation outlining the installation process, configurations, and any necessary troubleshooting procedures.

License keys – delivered to the COR 3 days after contract award any deviations from delivery timeframe require approval from the government.

Contractor IT PM to activate the license key for CZ with the presence of the

COR.

Perform user testing to ensure valid change in number of user licenses and Site License expiration date.

4. Government furnished information (GFI)

To Be Provided

5. Key Personnel

5.1 Infrastructure and Cloud Administrator

Monitors performance of CZ software and provides planning for software updates/performance.

Performs Environment Setup/changes.

Modifies CZ software code within the FDA Environment and deploys CZ code and associated resources.

5.2 Code Developer

Is authorized by Adapt Global to provide CZ code and database customization.

Provides code modifications for FDA specific CZ software customization for features/performance.

Knowledge of Federal AWS and EC2 platform, including environments, infrastructure, networks and other systems pertaining to the CZ Implementation.

5.3 IT Project Manager/End User Support Personnel

Administration Services with Comfort Zone software provided by responding to end user for help during normal business hours and on a requested basis.

Provides support to process FDA data calls or other related FDA IT document creation/submissions.

The requirements for key personnel shall include, but are not limited to:

1. Certain skilled experienced program management and/or technical personnel are essential for accomplishing the work to be performed. Key personnel shall be identified by name and title/job classification in offeror proposals.

2. The Contractor agrees that the above key personnel shall not be removed from the contract effort, replaced or added to the contract without a compelling reason and without compliance with paragraphs (3) and (4) hereof. The Government will not approve substitutions for the sole convenience of the contractor.

3. If any change to the key personnel position becomes necessary (substitutions or additions), the Contractor shall immediately notify the Contracting Officer in writing, accompanied by the resume of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individuals currently approved for that category.

4. No substitution or replacement of the key personnel shall be approved within the first ninety (90) days after contract award.

5. All requests for approval of changes hereunder must be in writing, via email, and provide a detailed explanation of circumstances necessitating the proposed change. Request for changes should be made whenever the need is identified. Beside the resume, the request must also provide:

a. A comparison of skills and qualifications to those set forth in the accepted resume proposed for substitution;

b. A signed employee procurement integrity agreement;

c. Number of hours the contractor will provide at his/her own expense to train the proposed replacement, and

d. Any other information requested by the Contracting Officer to reach a decision.

6. Constraints and Special Instructions

6.1 Comfort Zone (CZ) IT Services Agent

To perform the requirements of this contract, an authorized CZ IT Services Agent will be required and/or Services from Adapt Global, owner of the CZ software application to perform many of the above requirements.

o Contact Adapt Global to verify the authorization of a CZ IT Services Agent.

o Provide the government with documentation of the authorization, (must include

Adapt Global’s authority on official letter head with the company owner’s signature).

6.2 Comfort Zone (CZ) Authorized Reseller

Comfort Zone software code is proprietary information that is owned by Adapt Global. An authorized Comfort Zone (CZ) reseller must fulfil all below requirements to be qualified as an authorized reseller.

o Provide documented proof from Adapt Global that the Authorized Reseller is an Authorized CZ IT Services Agent.

o Provide documented proof from Adapt Global that the Authorized Reseller is authorized by Adapt Global (AG) to perform the following:

CZ Installation CZ Implementation Management CZ Application Administration Customization Must have authorization from Adapt Global, Comfort Zone software distributor to provide compiled code at any time during the duration of this contract.

Authorized by Adapt Global to performs all code changes.

o Authorized by Adapt Global to perform Comfort Zone SSO Customization o Is granted from Adapt Global a CZ Site license that allows the Authorized Reseller full access (read/write/edit) capabilities to the CZ Database.

o Authorized by Adapt Global to perform changes to the database (e.g., structure, cell value).

7. Deliverables

PWS

TASK #

DELIVERABLE TITLE # CALENDAR DAYS

AFTER TO AWARD

ACCEPTANCE

CRITERIA

6.1 Project management

plan (PMP)

Draft – 15, Final – 30 Must accurately describe the work to be performed, meet all identified standards, be free of factual and grammatical errors, and be delivered on time.

6.1.2 In-process reports Monthly, on 2nd Mondays Must accurately portray work accomplished, meet all identified standards, be free of factual and grammatical errors and delivered on time.