RFP 270-22-0573 Attachment 1b General Requirements.pdf

RFP No. 270-22-0573 Attachment 1b

01/17/2020 2020v1.3 Page 1

GENERAL REQUIREMENTS

TITLE: National Center on Substance Abuse and Child Welfare

OCIO INFORMATION TECHNOLOGY (IT) CONTRACT REQUIREMENTS

PROJECT MANAGEMENT

Project Management Plan

The Contractor shall develop, maintain and update a Project Management Plan (PMP). The PMP shall provide the basis for performing and controlling the project’s activities in accordance with the Task

Order. This document describes the technical approach, organizational resources, deliverables, documentation, and management controls to be employed to meet the cost, performance, and schedule requirements throughout the Task Order period of performance.

These management activities shall establish control, management, monitoring, and notification mechanisms and shall include working with and reporting to the ACF COR to ensure that tasks and their subtasks stay on track and important milestones are met. Representative activities include, but are not limited to:

• Plan, organize, secure, and manage resources with appropriate knowledge and skills to perform ongoing activities.

• Create, manage, and control work plans, project schedules, and/or WBS

• Maintain quality control through repeatable, managed processes

• Change control management

• Documentation Management, including ensuring that information is stored in the appropriate

ACF document repositories and configuration management tools

• Communications Management

• Risk Management including working with COR on timely escalation and resolution of risks

• Issue Management including working with COR on timely escalation and resolution of issues

• Quality Assurance

• Responding to general inquiries from ACF/OCIO staff overseeing program activities

• Coordinating with Government staff to ensure that tasks and their subtasks are executed in line with program direction, priorities, and processes

• Participate in meetings in different capacities, as required

• Prepare and track meeting agendas, minutes, issues, risks, and action items

• Create all required status reports and participate in progress reviews

• Track and manage cost expenditures

• Respond to ad hoc data calls

• Track monthly and cumulative performance metrics as applicable

The Contractor's Quality Assurance/ Control Plan (QCP) shall set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the Task Order. The Contractor's QCP shall set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS/SOW.

10/07/2020 Page 2

In reference to the reporting activities, the COR will monitor performance and review reports, furnished by the Contractor to determine how the Contractor is performing. The Contractor shall be responsible for making required changes in processes and practices to ensure performance is managed effectively.

Coordination and Process Compliance

The Contractor shall ensure activities corresponding to tasks and their subtasks are coordinated effectively and conducted according to the established ACF/OCIO processes. Activities include, but are not limited to:

• Ensuring the participation of staff with relevant, complete, and current information at governance meetings, including the system workgroup meetings and customer status meetings

• As requested, ensuring participation of technical staff in working sessions with OCIO and program support contractor (s), continuous enhancement planning, support for program risk management, and compliance with Program Quality Assurance (QA) and Change and Release

Management (CRM) procedures

• Identifying need for operations teams and end user communication resulting from Security and

Privacy changes or updates

• Ensuring coordination between all the tasks and subtasks of this PWS/SOW

• Ensuring staff is familiar with and adhere to OCIO processes

• Identifying the changes impacting cross system or Task areas, dependencies and risks throughout the SDLC process, and ensuring the related activities are documented and coordinated

• Coordinating cross systems or cross teams for escalations and resolutions of complex security and privacy issues

In the event performance is not corrected the first time, the contractor must provide a Corrective Action

Plan (CAP). Once approved, the Contractor shall execute the plan. If performance does not improve then the government moves to not paying for performance or termination.

Contract Kick-off Meeting

Within five (5) days of task order award, the Contractor shall coordinate with the COR to schedule the kick-off meeting. Meeting coordination including a draft agenda and suggested list of questions that will require decisions by the COR should be conducted through the

ACFOCIOContractStatusReport@acf.hhs.gov mailbox. The resulting meeting invite should be addressed to the CO, COR, representatives from the OCIO Portfolio Management and Governance (PMG) Division, and representatives from the respective Program Office leadership. The meeting shall be conducted either virtually or at the designated government offices, to review project goals, tasks, timelines, and deliverables. At least one (1) business day prior to the Kick-off Meeting, the Contractor shall prepare an agenda indicating who will attend the meeting on behalf of the Contractor and provide a list of questions that will require decisions by the COR at the time of the Kick-off Meeting. Included in this meeting will be a detailed discussion of plans for all management and reporting deliverables, including work plans and management calls, as well as details for the agenda for technical kick-off meeting. The Contractor shall prepare the kick-off meeting minutes 3 days after kickoff meeting.

During the kick-off meeting, the Contractor shall address/provide a draft schedule, transition-in approach

(if required), initial risk register, discuss compliance with the ACF OCIO Governance Framework (initial tailoring plan), performance metrics reporting, initial project staffing with approach for requesting access to/ensuring compliance with ACF/government systems, and approach for meeting support (agendas, minutes, etc.). The Contractor shall complete a Project Intake Form and submit to the ACF OCIO

Portfolio Management and Governance Division, ACF-OCIO-Project-Intake-Request@acf.hhs.gov to formalize/start the ACF OCIO Governance Framework requirements.

mailto:ACF-OCIO-Project-Intake-Request@acf.hhs.gov

01/17/2020 2020v1.3 Page 3

Program Management Meetings

In addition to the Kick-Off meeting required in the Transition-In section of the PWS/SOW, the Contractor shall participate in meetings as directed by the ACF COR. The Contractor shall prepare and track meeting agendas, minutes, notes, issues, and action items. The Contractor shall prepare and provide the

ACF COR with the meeting minutes of all status meetings. The Contractor shall prepare and provide other meetings minutes related to this Task Order as directed by the ACF COR or designated representative. Minutes shall be of sufficient detail to accurately document meeting data and location, meeting purpose, items discussed, decisions made, attendees, and action items. Meeting minutes shall be delivered within three business days following the meeting to parties as directed by the ACF COR or designated representative.

The OCIO will participate in the Contract Kick-Off Meeting and provide the Contractor with the OCIO

Intake Request Form and process which initiates participation in the mandatory IT governance process per the ACF Governance Framework (See Attachment C). The Contractor shall submit an Intake Request

Form within five (5) days of the Contract Kick-Off meeting. As part of the Governance Framework process, OCIO holds CFTs (Cross Function Team meetings) with the Program Office and Contractor to conduct strategic planning and properly prepare the Contractor prior to executing through the ACF

Governance Framework. The initial CFTs session is scheduled by the OCIO upon receipt of the Intake

Request Form submitted by the Contractor, with approval from the COR, to OCIO.

The first CFT constitutes a technical brief provided by the Contractor that will result in agreed upon tailing plan, the Contractor is not expected to conduct a separate technical brief at the Contract Kick-Off

Meeting or in another forum. The Contractor shall present the technical approach, focusing on technological aspects of the solution to guide a technical discussion. The technical brief shall be delivered in an interactive manner that enables a dialogue and agreement on required artifacts as the project progresses through the ACF Framework. As described above, the Contractor shall participate in a CFT

Technical Discussion as scheduled by the OCIO prior to commencing development.

Task Order Reporting

Weekly Task Order Status Report (WSR)

The Contractor shall submit a weekly status report in the designated template provided by the government which captures the following types of information for each task and subtask defined in the Task Order:

• Activities and Accomplishments for the Reporting Period

• Deliverables/Work Products Awaiting Government Review/Approval

• Planned Activities for the Upcoming Reporting Week

• Risks or Issues

The Contractor shall abide by a template provided by the Government. The Contractor and COR shall agree upon the weekly due date.

Monthly Contract Status Report (CSR)

The Contractor shall submit a monthly status report by the 20th calendar of every month in the designated template provided by the government which captures the following types of information for each task and subtask defined on the Task Order:

• Financial Overview for Reporting Period and Cumulative

• Activities and Accomplishments for the Reporting

• Contract Deliverable Status

10/07/2020 Page 4

• Issues, Risks, and Mitigation Plans

The Contractor shall abide by a template provided by the Government.

Contract Status and Performance Measures

The Contractor shall ensure that status and performance data is documented and tracked in a Performance

Metrics Report (PMR). The Contractor shall establish their initial set of metrics and measures (the baseline) that will be used to monitor and control the Contractor’s task execution. The Contractor’s metrics should include the Government’s minimum metrics, identified below, plus any additional ones it feels are needed to properly gauge the performance of the Contractor’s activities.

Table 1: Metrics

Activity Supported Metric

Management Plans

(Objective: 95%, Threshold: 90%)

Compare issue resolution dates versus estimated date

Compare risk resolution dates versus estimated date

Compare progress versus schedule for activities scheduled

Progress Reports

(Objective: 97%, Threshold: 90%)

Compare actual spending versus plan/limit, show variance

Track monthly ratings

Deliverables

(Objective: 97%, Threshold: 95%)

Compare completion dates versus scheduled dates

Track number of revisions after scheduled submission

Track rejected deliverables

Staffing

(Objective: 100%, Threshold: 97%)

Compare staff versus key personnel

Compare staff versus “required” personnel

Track status of staff badging

Security

(Objective: 100%, Threshold: 97%)

Compare clearances against security requirements

Track security incidents

GFE

(Objective: 100%, Threshold: 99%)

Check Asset Inventory versus Delivered GFE

Travel

(Objective: 97%, Threshold: 90%)

Track authorizations

Compare actual spending versus plan/limit

ODC

(Objective: 97%, Threshold: 90%)

Track actual ODC versus plan/limit

Track authorizations

Operations

(Objective: 99%, Threshold: 90%)

Track System uptime

Track planned change duration versus actual duration

Support for Capital Planning and Investment Control

The ACF OCIO is required to manage and produce reports to HHS and other Federal agencies. The

Contractor shall respond to ACF OCIO’s data calls, requests for input, and ad hoc support necessary for

ACF OCIO to comply with Capital Planning and Investment Control, Office of Management and Budget

(OMB) Circular A-11 requirements for ACF systems, enterprise architecture, and strategic planning that occur in differing reporting cycles. The Contractor shall support and provide data required by ACF OCIO

01/17/2020 2020v1.3 Page 5 to manage the ACF Investment Portfolio and develop operating procedures for presentation to the governance boards in accordance with the standards required by the Clinger-Cohen Act.

The contractor must create, maintain and report information in a Mid-Year Performance Summary Report to [Program Office] every six months to facilitate [Program Office] evaluation of contractor performance.

The Mid-Performance Summary Report template shall be provided by the contractor 7 days after contract award.

Deliverables: Mid-Performance Summary Report

CONTRACT TRANSITION MANAGEMENT

Contractor Transition-In

The purpose of the Transition-In period is to absorb the program’s functional and technical knowledge and program artifacts from the incumbent Contractor(s) and ACF staff, in an efficient and orderly manner. In addition, the Contractor shall provide the current functionality through a seamless transition of current design, process, and tools from the incumbent solution to its own. The Contractor shall ensure the transition of all current services from the incumbent with minimal or no disruption of service to ACF’s end-users. The transition includes the transfer of all Government furnished or funded assets including:

Hardware, Software, and Software Licenses and applicable information, including but not limited to:

Data including all Data Rights, Services, Configuration, Operational and Development Processes, Documentation, Knowledge Stores, and any other resources required to successfully execute this contract.

The transition period is from the date of award through the end of the period of performance for the incumbent. The Contractor shall not negatively interfere with work currently being done by the incumbent and is expected to keep pace with the changes made by the incumbent during the transition period. The Contractor is expected to participate in all change conversations during the transition period, to maintain their awareness.

During the first sixty (60) business days after contract award, the successor Contractor shall work with the

Government staff and incumbent Contractor(s) as applicable to gain sufficient understanding of the current ACF environment. During this period and throughout the duration of the Contract as Contractors onboard, the Vendor shall implement a mitigation strategy to protect Government information from being accessed by Contractor Personnel that have not received written confirmation from the HHS\Program

Support Center's (PSC), Intake, Suitability and Badging Services (ISBS) office that the applicants initial fitness/suitability requirements have been met and that the Contractor can begin work in accordance with the requirements of the contract.

The successor Contractor shall notify the COR immediately if major concerns are identified that require immediate attention or correction. All concerns shall be discussed during the weekly status meetings.

Transition-in activities shall include:

• Implementation of the comprehensive transition strategy

• Kickoff Meeting to define the communication process between the Government and the

Contractor, to review key tasks, project schedule, milestones, personnel, and roles and responsibilities and ensure a common understanding of task and requirements

• Participating in Transition-In meetings

10/07/2020 Page 6

• Conducting and coordinating all onboarding activities with the Government personnel, obtaining secure badging for team personnel, and ensuring the necessary training is taken to include:

o Security Awareness Training o Records Management Training o Rules of Behavior

• Ensuring staff identified as key personnel are available to work with SMEs from the

Government personnel and the incumbent Contractor immediately after TOA

• Engaging in regularly scheduled meetings

• Knowledge transfer

• Activities that will result in the successor Contractor gaining an understanding of the business objectives, processes, and requirements as related to the services required

• Activities that will result in the successor Contractor gaining an understanding of ACF system documentation and project documentation

The Contractor shall plan and participate in weekly transition meetings between the COR and other participants as identified by ACF OCIO. The meetings will be held at the ACF Switzer Building at 330 C.

Street, Washington, D.C. location or telework with COR approval.

The Contractor shall prepare and submit an agenda two (2) business days prior to each meeting and prepare and provide meeting minutes within 24 hours after the meeting. The meeting minutes, at a minimum, shall include the following:

• List of participants

• Purpose of the meeting

• Decisions reached during the meeting

• Action items identified (including the person responsible for addressing the action and the date the action is to be completed)

• Date, time, and location of next meeting

Contractor Transition-Out

Transition-Out Plan

Applicability: Transition from Contractor to incoming contractor or Government when no follow-on contract is anticipated.

The Contractor shall develop and submit a transition plan within 120 days prior to the expiration of the base and each option period. The Contractor's transition plan shall be approved by ACF OCIO and shall contain a milestone schedule of events and system turnovers. The Contractor shall transition systems with no disruption in operational services.

01/17/2020 2020v1.3 Page 7

The Contractor shall plan and participate in weekly meetings between the COR and other participants as identified by ACF OCIO. The meetings will be held at the ACF Switzer Building at 330 D Street, Washington, D.C. location, telework or another COR approved location.

The Contractor shall prepare and submit an agenda two (2) business days prior to each meeting and prepare and provide meeting minutes within 24 hours after the meeting. The meeting minutes, at a minimum, shall include the following:

1. List of participants

2. Purpose of the meeting

3. Decisions reached during the meeting

4. Action items identified (including the person responsible for addressing the action and the date the action is to be completed)

5. Date, time, and location of next meeting

The Contractor shall provide:

• Current versions of all concepts of operations, operational procedures, SOPs, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor

• “Shadowing” and other knowledge-transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor

• Full source code sets (not COTS source code) with configuration management information

• A list of all Internet Domains (including .NET, .ORG, and .COM), Domain Registrars, and

Domain Registration email addresses associated with the contract.

• A list of all Government furnished or funded assets including: Hardware, Software, Software Licenses, and Cloud Services

• Cloud Migration Strategy if applicable

• Identification of actions required of the Government in sufficient time to ensure seamless transition

• A milestone chart detailing the timelines and stages of transition from the effective date of performance of the successor until the successor assumes sole responsibility for the work

• Points of Contacts

• Provide Government Information/Equipment/Property along with full support in the reconciliation of this inventory

• Status of technical initiatives

• A communication plan and a training plan for handing over information and responsibilities in a seamless manner to the ACF/OCIO Government personnel

10/07/2020 Page 8

• Identification of the individuals (at all levels) responsible for the transition and their respective roles, detailed lines of communication, and how the incumbent Contractor will interface with ACF/OCIO during this phase of contract performance

• Lessons learned

The Contractor shall facilitate the transition of contracted activities, documentation, SOPs, source code, and all details and information for any services performed, to the federal government or to a follow-on

Contractor at the end of the contract period of performance.

Deliverable(s): Transition Plan, Meeting Agendas, Meeting Minutes, Inventory of GFI/GFE/GFP, O&M

Manual, User Manual, All System Documentation, System Design Document, Release Plan, Interface

Design Document, Data Use Agreement, Test Case Specification, Test Summary Report, User

Acceptance Testing, Training Plan, Training Materials, Implementation Plan, Test Reports, Communication Plan, Project Completion Report, Annual Operational Analysis, Disposition Plan, Project

Archives

TRANSITION PLANS AND PROCEDURES

The contractor shall work collaboratively with government personnel identified by ACF/OCIO to ensure a seamless transition of the activities included in this PWS/SOW and the respective task order and/or contract award. The contractor shall provide:

• A transition milestones and timeframes, including a detailed timeline for work-in-progress;

• A comprehensive listing of the responsibilities of all personnel participating in the transition to include the policies, practices, and procedures to be employed by the incumbent contractor to ensure there is no conflict between routine program maintenance and the activities of the transition;

• An in-depth schedule and thorough description of the methodology employed by the incumbent contractor to ensure no degradation of service during the transition period;

• A risk management plan that includes a list of the potential risks during the transition period and the plan to mitigate each;

• A complete and detailed resource-planning/resource-turnover analysis; and

• Any travel necessary to support the transition.

Deliverable(s): Timeline and Milestone; list of personnel, policies, practices and procedures, schedule and description of methodology, risk management plan, resource-planning/resource turnover analysis, travel cost

DEVELOPMENT, MODERNIZATION AND ENHANCEMENT

The purpose of this task is to provide development, modernization and enhancement to the NCSACW CC

TA Tracker and NCSACW Training Systems. This will also include new development and COTS implementations. The modernization efforts will include infusion of newer technologies in the areas including but not limited to data management, data warehouse, business intelligence and data quality, analytical tools, web services and support for handheld/mobile devices. Development, Modernization and

Enhancement to be provided may vary from one service area to another. Examples of service areas may include:

01/17/2020 2020v1.3 Page 9

• Requirement Analysis

• Design and Development

• Testing

• Implementation

Subtask 1- Requirement Analysis

The Contractor shall perform requirements analysis, as tasked. Representative activities include, but are not limited to:

• Analyze, decompose and translate the requirements into detailed functional and non-functional system requirements

• Work with the project team, including user representatives, to review and validate the system requirements

• Develop the System Requirements Specifications (SRS)

• Create/Update Concept of Operations (ConOps)

• Establish a finalized Requirements Traceability Matrix (RTM)

• Complete a successful requirements analysis stage gate review including coordination of review meeting, preparation of materials, and resolution of any issues identified by critical partners

Subtask 2- Enhancement Design and Development

The Contractor shall perform design and development activities, as tasked. Representative tasks include, but are not limited to:

• Design software enhancements based on the detail requirements identified, verified, documented and approved in the requirements analysis phase

• Develop/update the System Design Document (SDD)

• Create/Update Interface Control Document(s) to be used when interfacing with exiting reporting systems

• Test the design against the Requirements Traceability Matrix

• Develop Test artifacts: Master/Release Test Plan, Test Case Specifications

• Work with the COR and project team in the verification and approval of the design at designated milestones and update Project artifacts accordingly

• Develop/update all application/system code required to build the system according to the System

Design Document

• Construct/Update Software Application Modules

• Develop all application/system code in compliance with 508 requirements, ACF defined IT standards and approved software on ACF approved hardware.

• Use an iterative development approach supporting prototypes and demos throughout the development process

• Conduct and document unit testing

• Track and correct all defects before completion of development phase

• Complete a successful design & development stage gate review including coordination of review meeting, preparation of materials, and resolution of any issues identified by critical partners

Subtask 3 - Testing

The Contractor shall review and test the new solution to ensure that all links (new and changed features links) are functioning, and that the solution is in compliance with the project requirements. As tasked, the

10/07/2020 Page 10

Contractor shall perform Test and Evaluation Services to support all testing and evaluation phase requirements of the SDLC and as determined by ACF. Any issues identified as a result of this initial testing shall be reported to the COR and Project Manager and corrected by the Contractor.

Acceptance Testing

The Contractor shall be responsible for the support and coordination of User Acceptance Testing (UAT) activities. After training, the COR and Project Manager and the Contractor will select a set of tests to evaluate all functions, templates and options. Selected testers shall intentionally stress the system to identify weaknesses which will be reported to the Contractor for resolution.

These initial tests will not be visible to the public through this testing phase although it will be operating in the pre-production environment. Any issues identified during this process shall be addressed and resolved by the Contractor.

The UAT Test Results Report is provided to the project manager and senior project stakeholders and summarizes the UAT results and whether the UAT objectives were met. It covers:

• Achievement of UAT objectives

• Test execution results by test cycle

• Test execution statistics and trends

• A plan to address any UAT test issues still unresolved

Subtask 4 - Implementation

The Contractor shall provide full Implementation services end to end support during all phases of the implementation process with skilled resources. The Contractor shall employ a professional, implementation, and integration framework approach. The formal approach to quality assurance through the use of quality system standards such as Capability Maturity Model Integration (CMMI) level 2 or higher, ISO 9001-2001, SSAE-16 standards are required. All efforts shall support implementation/integration of system and other software.

The Contractor shall provide documentation, setup, test plans, solution demonstration, knowledge transfer sessions, conversion, and reconciliation support.

Implementation shall be conducted through a phased approach. The Contractor will work to ensure the new solution is properly installed and configured. The Contractor shall provide implementation/integration services using ACF CCB approved products and services where applicable.

Security Requirements for Development or Enhancement of a Federal IT System

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC or ACF SDLC framework and methodology in accordance with the HHS Contract Closeout Guide (2012) or current ACF frameworks and policies.

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP

800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

01/17/2020 2020v1.3 Page 11

3)The Contractor (and/or any subcontractor) shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

4) The Contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the

Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

5) The Contractor (and/or any subcontractor) shall ensure that computer software developed on behalf of

HHS or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the HHS environment. No sensitive data shall be used during software testing.

6) The Contractor (and/or any subcontractor) shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably-available information, is deemed sensitive or proprietary by HHS shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract.

Requirements for New Websites and Digital Services and Redesigns of an Existing Legacy Website or

Digital Service

An executive agency that creates a website or digital service that is intended for use by the public, or conducts a redesign of an existing legacy website or digital service that is intended for use by the public, shall ensure to the greatest extent practicable that any new or redesigned website, web-based form, web-based application, or digital service—

1) is accessible to individuals with disabilities in accordance with section 508 of the Rehabilitation Act of

1973 (29 U.S.C. 794d);

2) has a consistent appearance;

3) does not overlap with or duplicate any legacy websites and, if applicable, ensure that legacy websites are regularly reviewed, eliminated, and consolidated;

4) contains a search function that allows users to easily search content intended for public use;

5) is provided through an industry standard secure connection;

6) is designed around user needs with data-driven analysis influencing management and development decisions, using qualitative and quantitative data to determine user goals, needs, and behaviors, and continually test the website, web-based form, web-based application, or digital service to ensure that user needs are addressed;

http://uscode.house.gov/quicksearch/get.plx?title=29&section=794d

10/07/2020 Page 12

7) provides users of the new or redesigned website, web-based form, web-based application, or digital service with the option for a more customized digital experience that allows users to complete digital transactions in an efficient and accurate manner; and

8) is fully functional and usable on common mobile devices.

KEY PERSONNEL

[Applicability: If Key Personnel are required by Program Office]

Certain skilled experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” and are those persons whose resumes will be submitted and marked by the vendor as “Key Personnel.” Key personnel shall be identified by name and title/job classification for the role identified in the table below. The Contractor shall identify key personnel in the technical proposal as indicated in the instructions to offerors. For positions designated as key personnel, the Contractor shall adhere to HHSAR clause 352.237-75 – Key

Personnel. The Contractor shall obtain COR concurrence on the key personnel replacement prior to submitting to the CO for official approval. The CO is the final approving official on any changes to key personnel.

At least 20 calendar days prior to the Contractor voluntarily diverting any of the specified individuals to other programs or contracts, the Contractor shall notify the CO and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract. The Contractor shall backfill the key position within 15 calendar days from the key position becoming vacant.

The Contractor shall not divert, replace, nor remove key personnel from their role within the first 90 calendar days from contract award. If the employee of the Contractor is terminated for cause or separates from the Contractor voluntarily with less than 30 calendar days’ notice or within the first 60 calendar days, the Contractor shall provide the maximum notice practicable under the circumstances. The

Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the CO. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

The Contractor shall provide personnel with the management, technical, and subject matter expertise required to accomplish the activities and prepare the deliverables identified in this TO.

The Contractor Support personnel’s completed security packages and all onboarding documentation need to be submitted no later than three days (3) prior to beginning work and charging to the contract.

The following roles are key personnel:

01/17/2020 2020v1.3 Page 13

Labor Category Description

Number of

Years’

Experience

Additional or

Substituted

Experience

Labor Category Description B.S.

Minimum of ten

(10) years’ experience or equivalent combination of education and training that provides for the required knowledge, skills, and abilities.

Must possess two (2) years of task leader experience managing a group of engineers and the full ADP life cycle in software engineering.

Key Personnel Substitute

The Contractor shall not remove or replace any management, personnel, consultants, or subcontractors listed or described in the Contractor’s Staffing Plan without notifying and obtaining the written concurrence of the COR. The Contractor’s notification shall be NLT 10 calendar days in advance of any proposed substitution and shall include justification, including resume(s) and labor category of proposed substitution(s), in sufficient detail to permit evaluation of the impact on task order (TO) performance.

Substitute qualifications shall be equal to, or greater than, the qualifications of the personnel being substituted. If the COR determines that the proposed substitute is unacceptable, or that the reduction of effort would be so substantial as to impair the successful performance of the work, then the substitute will be denied, and the Contractor will provide another candidate.

All requests for approval of changes hereunder must be in writing, via email, and provide a detailed explanation of the circumstances necessitating the proposed change. Request for changes should be made when the need is identified. In addition to the resume, the request must also include:

• A comparison of skills and qualification of the proposed personnel substitution with those of the incumbent

• Number of hours the Contractor will provide at his/her own expense to train the proposed replacement

Any other information requested by the COR to reach a decision.

QUALITY ASSURANCE SURVEILLANCE PLAN

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance. The oversight provided for in the contract and in the QASP will help to ensure that service levels reach and maintain the required levels throughout the contract term. Further, the

QASP provides the COR with a proactive way to avoid unacceptable or deficient performance and provides verifiable input for the Contractor Performance Assessment Reporting System (CPARS). The

10/07/2020 Page 14

QASP may be updated by modification to the contract. The QASP shall provide the basis for performing and controlling the project’s activities in accordance with the Contract.

Contractor interactions and work products delivered under this contract will be evaluated using the quality assurance standards listed in Table 2.

Table 2. Quality Assurance Standards

Required

Services/Tasks Performance Standards

Methods of

Surveillance

Standard to be Met/

Allowable Deviation

Customer

Satisfaction

Contractor adheres to guidance provided by Contracting Officer

Representative.

Contracting

Officer

Representative and

ACF Feedback

Not more than 3 complaints during the contract period

Overall Contract

Management, Including

Timeliness

Contractor maintains high level of quality assurance, is responsive to Contracting

Officer Representative and

Contracts Officer, completes all tasks, contacts the Contracting

Officer Representative immediately with any issues or problems and meets time frames in the delivery schedule.

Contracting

Officer

Representative and

Contracting

Officer monitoring; review of deliverables;

review of monthly reports.

No more than 3 valid complaints during the contract period; no more than a four-week delay in the agreed upon schedule.

Written Products High quality written materials are produced.

Contract Officer

Representative monitoring and other ACF reviewers’ comments on draft and final products.

Successful review by

ACF Project Lead or designee, minimal rewriting or editing required.

Pilot Testing and

Evaluation

Pilot testing is well-organized, represents a range of human trafficking service delivery organizations and human service organizations gathers sufficient information to evaluate the data collection tools and illustrates the issues being examined.

Contract Officer

Representative and

Contracting

Officer monitoring.

ACF Project Lead or designee approval of pilot testing and evaluation plan.

Contractor results relative to performance metrics and quality assurance standards will be used by the

Government in evaluating contracts and task orders.

01/17/2020 2020v1.3 Page 15

LIST OF DELIVERABLES

The Contractor shall use ACF governance-provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate; if specific formats are not provided, the

Contractor shall deliver in its own format, as appropriate.

Deliverable Name Deliverable Title/Description Due Date

Roster Roster of all employees Within 3 days of the effective date of this contract

Contractor Employee

Non-Disclosure

Agreement (NDA)

Contractor Employee Non-

Disclosure Agreement (NDA)

Prior to performing any work on behalf of HHS

Privacy Threshold

Analysis (PTA)/

Privacy Impact

Assessment (PIA)

Assist in the completion of a

PTA/PIA form

Within 30 days after the contract award

Training Records Copy of training records for all mandatory training

In conjunction with contract award and annually thereafter or upon request

Rules of Behavior Signed ROB for all employees Initiation of contract and at least annually thereafter

Incident Response

Report

Incident Report (as incidents or breaches occur)

As soon as possible and without reasonable delay and no later than 1 hour of discovery

Incident Response Plan Incident and Breach Response

Plan

Upon request from government

Personnel Security

Responsibilities

(onboarding)

List of Personnel with defined roles and responsibilities

Within 3 days that is before an employee begins working on this contract.

Personnel Security

Responsibilities (off-boarding)

Off-boarding documentation, equipment and badge when leaving contract

Within 3 days after the

Government’s final acceptance of the work under this contract, or in the event of a termination of the contract.

Background

Investigation

Documentation

Onboarding documentation when beginning contract.

Prior to performing any work on behalf of

HHS/ACF

Certification of

Sanitization of

Government and

Government Activity-

Related Files, Information, and

Devices.

Form or deliverables required by

ACF.

At contract expiration.

10/07/2020 Page 16

Deliverable Name Deliverable Title/Description Due Date

Contract Initiation and

Expiration

If the procurement involves a system or cloud service, additional documentation will be required, such as

Disposition/Decommission Plan

At contract expiration.

Security Assessment and Authorization

(SA&A)

SA&A Package

• SSP

• SAR

• POA&M

• Authorization Letter

• CP and CPT Report

• E-Auth (if applicable)

• PTA/PIA (if applicable)

• Interconnection/Data Use

Agreements (if applicable)

• Authorization Letter

• Configuration Management

Plan (if applicable)

• Configuration Baseline

• Other ACF-specific documents

Due date to be determined and approved by ACF

OCIO based on planned deployment and ATO schedule

Reporting and

Continuous Monitoring

Revised security documentation/Agreements

As required by ACF OCIO

Security Alerts, Advisories, and

Directives

List of personnel with designated roles and responsibilities

As required by ACF OCIO

Incident Reporting

• Incident Reports (as needed)

• Incident Response Plan

Incident Response plan provided in accordance with ATO schedule and yearly thereafter (Prior to production deployment or go live date)

Incident Reports provided quarterly and upon request

Other IT Procurements

(Non-Commercial and

Open Source

Computer Software

Procurements)

• Computer Software, including the source code

Prior to performing any work on behalf of HHS

Delivery Process

The Contractor shall submit all required report(s)/deliverables in accordance with the schedule(s) outlined in the PWS/SOW.

01/17/2020 2020v1.3 Page 17

All reports shall reference and cite the contract/order number.

• The Contractor shall provide all deliverables to the COR.

• All draft deliverables shall be delivered in an editable format, such as Microsoft Word, and submitted electronically; all final deliverables will be delivered electronically in an editable format, including embedded images (e.g. Microsoft Word, Excel, Visio, Project, Adobe Acrobat, XML, etc.) or other electronic format as prescribed by the COR.

• In compliance with Section 508 of the Rehabilitation Act, final deliverables that include graphics

(e.g., pie charts, bar graphs, etc.) shall include a separate Microsoft Word file identifying the page, exhibit number/name, and narrative text in the deliverable.

• The Contractor shall not release or post live materials on any website or in any publication until after the deliverable is officially released by ACF.

• The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate; if specific formats are not provided, the Contractor shall deliver in its own format, as appropriate.

Notice Regarding Late Delivery/Problem Notification Report

The Contractor shall notify the COR, as soon as it becomes apparent to the Contractor, that a scheduled delivery will be late. The Contractor shall include in the notification the rationale for late delivery, the expected date for the delivery, and the project impact of the late delivery. The COR will review the new schedule and provide guidance to the Contractor. Such notification in no way limits the Government's right to all rights and remedies up to and including termination. Section G Inputs—Contract

Administration

TECHNICAL CONSIDERATIONS

IT Security Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information as required to perform their work. Access is contingent upon positive adjudication of background check.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the ACF mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology”

(IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information

Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal

Information and Information Systems, the Contractor (and/or any subcontractor) shall:

10/07/2020 Page 18

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of ACF regardless of location.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for

Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each

Security Objective and the Overall Risk Level, which is the highest watermark of the three factors

(Confidentiality, Integrity, and Availability) of the information or information system. The contractor shall work with the ACF security team to categorize information or information systems. The categorization can change at any time throughout the lifecycle of the system. The contractor shall ensure proper controls are implemented based on the categorization.

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or

Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed.

Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information

Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations if handled by internal Contractor system; and

d. returned to ACF control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

01/17/2020 2020v1.3 Page 19

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor

(and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor

(and/or any subcontractor) by ACF or collected by the contractor on behalf of ACF shall…