RFP-CMS02009-8A-INFRA-02 Section F - Schedule of Deliverables with track changes 021809.doc

SECTION F - DELIVERIES OR PERFORMANCE tc " SECTION F - DELIVERIES OR PERFORMANCE "

F.1. CLAUSES INCORPORATED BY REFERENCE

A. FAR:

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

www.arnet.gov 52.211-16 Variation in Quantity

(Apr 1984)

52.242-15 Stop-Work Order

(Aug 1989)

52.242-17 Government Delay of Work (Apr 1984)

B. SECTION 508 COMPLIANCE

SECTION 508 COMPLIANCE

The deliverables required by this contract require full compliance with the following Subparts of the Section 508.

Subpart 1194.21 Software Applications and Operating Systems

Subpart 1194.22 Web-based Internet Information and Applications

Subpart 1194.31 Functional Performance Criteria

Subpart 1194.41 Information, Documentation and Support

The full text of these provisions may be accessed electronically at this address: http://www.section508.gov.

C. SECURITY

This clause applies to all organizations which possess or use Federal information, or which operate, use or have access to Federal information systems (whether automated or manual), on behalf of CMS.

The central tenet of the CMS Information Security (IS) Program is that all CMS information and information systems shall be protected from unauthorized access, disclosure, duplication, modification, diversion, destruction, loss, misuse, or theft—whether accidental or intentional. The security safeguards to provide this protection shall be risk-based and business-driven with implementation achieved through a multi-layered security structure. All information access shall be limited based on a least-privilege approach and a need-to-know basis, i.e., authorized user access is only to information necessary in the performance of required tasks. Most of CMS' information relates to the health care provided to the nation’s Medicare and Medicaid beneficiaries, and as such, has access restrictions as required under legislative and regulatory mandates.

The CMS IS Program has a two-fold purpose:

(1) To enable CMS’ business processes to function in an environment with commensurate security protections, and

(2) To meet the security requirements of federal laws, regulations, and directives.

The principal legislation for the CMS IS Program is Public Law (P.L.) 107-347, Title III, Federal Information Security Management Act of 2002 (FISMA), http://csrc.nist.gov/drivers/documents/FISMA-final.pdf. FISMA places responsibility and accountability for IS at all levels within federal agencies as well as those entities acting on their behalf. FISMA directs Office of Management and Budget (OMB) through the Department of Commerce, National Institute of Standards and Technology (NIST), to establish the standards and guidelines for federal agencies in implementing FISMA and managing cost-effective programs to protect their information and information systems. As a contractor acting on behalf of CMS, this legislation requires that the Contractor shall:

· Establish senior management level responsibility for IS

· Define key IS roles and responsibilities within their organization

· Comply with a minimum set of controls established for protecting all Federal information

· Act in accordance with CMS reporting rules and procedures for IS Additionally, the following laws, regulations and directives and any revisions or replacements of same have IS implications and are applicable to all CMS contractors.

· P.L.93-579,The Privacy Act of 1974, http://www.usdoj.gov/oip/privstat.htm , (as amended);

· P.L. 99-474, Computer Fraud & Abuse Act of 1986, www.usdoj.gov/criminal/cybercrime/ccmanual/01ccma.pdf P.L. 104-13, Paperwork Reduction Act of 1978, as amended in 1995, U.S. Code 44 Chapter 35, www.archives.gov/federal-register/laws/paperwork-reduction;

· P.L. 104-208, Clinger-Cohen Act of 1996 (formerly known as the Information Technology Management Reform Act), http://www.cio.gov/Documents/it_management_reform_act_Feb_1996.html;

· P.L. 104-191, Health Insurance Portability and Accountability Act of 1996 (formerly known as the Kennedy-Kassenbaum Act) http://aspe.hhs.gov/admnsimp/pl104191.htm;

· OMB Circular No. A-123, Management’s Responsibility for Internal Control, December 21, 2004, http://www.whitehouse.gov/omb/circulars/a123/a123_rev.html;

· OMB Circular A-130, Management of Federal Information Resources, Transmittal 4, November 30, 2000, http://www.whitehouse.gov/omb/circulars/a130/a130trans4.html;

· NIST standards and guidance, http://csrc.nist.gov/; and,

· Department of Health and Human Services (DHHS) regulations, policies, standards and guidance http://www.hhs.gov/policies/index.html These laws and regulations provide the structure for CMS to implement and manage a cost-effective IS program to protect its information and information systems. Therefore, the Contractor shall monitor and adhere to all IT policies, standards, procedures, directives, templates, and guidelines that govern the CMS IS Program, http://www.cms.hhs.gov/informationsecurity and the CMS System Lifecycle Framework, http://www.cms.hhs.gov/SystemLifecycleFramework.

The Contractor shall comply with the CMS IS Program requirements by performing, but not limited to, the following:

· Implement their own IS program that adheres to CMS IS policies, standards, procedures, and guidelines, as well as industry best practices;

· Participate and fully cooperate with CMS IS audits, reviews, evaluations, tests, and assessments of contractor systems, processes, and facilities;

· Provide upon request results from any other audits, reviews, evaluations, tests and/or assessments that involve CMS information or information systems;

· Report and process corrective actions for all findings, regardless of the source, in accordance with CMS procedures;

· Document its compliance with CMS security requirements and maintain such documentation in the systems security profile;

· Prepare and submit in accordance with CMS procedures, an incident report to CMS of any suspected or confirmed incidents that may impact CMS information or information systems; and

· Participate in CMS IT information conferences as directed by CMS.

If the contractor believes that an updated IS-related requirement posted to the CMS website may result in a significant cost impact, the contractor may submit a request for equitable cost adjustment before implementing change.

F.2 ITEMS TO BE FURNISHED AND DELIVERY SCHEDULE tc "F.1 ITEMS TO BE FURNISHED AND DELIVERY SCHEDULE " \l 2 The Contractor shall submit all required report(s)/deliverables in accordance with the Schedule of Deliverables as found in this section. Report(s) submitted under the contract shall reference and cite the contract number and identify CMS as the sponsoring agency.

F.3 LEGAL HOLIDAYS AND ADMINISTRATIVE LEAVE tc "F.2 LEGAL HOLIDAYS AND ADMINISTRATIVE LEAVE " \l 2 The parties hereto agree that the Contractor personnel assigned for performance of this contract shall observe the following holiday and administrative leave allowance in the same manner as CMS employees:

New Year's Day Columbus Day

Washington's Birthday Veterans' Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

Martin Luther King, Jr’s Birthday Labor Day

Any other day designated by Federal Statute, Executive Order, or President's proclamation.

When any such day falls on a Saturday, the preceding Friday is observed, when any such day falls on a Sunday, the following Monday is observed. It is understood by both contractual parties that observance of each day by Government personnel shall not upon-its-face cause for an additional period of performance or entitlement of compensation except as set forth within the contract, in the event the Contractor’s personnel work during a holiday, no form of holiday or other premium compensation shall be reimbursed either as a direct or indirect cost. However, this does not preclude reimbursement for authorized overtime work.

When CMS grants administrative leave to its Government employees, Contractor personnel assigned to CMS shall also be dismissed. However, the Contractor agrees to continue to provide sufficient personnel to perform round-the-clock requirements of critical tasks already in operation or scheduled and shall be guided by the instructions issued by the Project Officer or his/her duly appointed alternate.

F.4 FINANCIAL MANAGEMENT REPORT (GRAPH) tc "F.4 FINANCIAL MANAGEMENT REPORT (GRAPH) " \l 2

a. The Contractor shall furnish two (2) copies of a graph financial management report depicting the projected rate of expenditure under this contract. The initial report shall be delivered within fifteen (15) days after the effective date of the contract and shall contain the following:

(1) Identification - Contractor name and contract number.

(2) Vertical Axis - dollars.

(3) Horizontal Axis - time (contract period of performance in months).

b. The Contractor shall furnish two (2) copies of a monthly graph financial management report which, using the initial report submitted in compliance with a. above, relates costs incurred during the month being reported to the projected expenditures contained on the initial report. This monthly Financial Management Report shall be submitted on the 15th day of each month, following the first complete month of contract performance.

The monthly graph financial management report shall contain the data in the format required by a. above with the following additional information:

(1) Identification - add the month being reported.

(2) Vertical Axis - dotted line representing the actual cumulative costs incurred to date by month.

(3) Horizontal Axis - red line extended from the dotted line representing the current estimated cost to contract completion.

c. This Financial Management Report in no way changes the notification requirements of the "Limitation of Cost" clause, nor does submission of the report constitute notice as required by the "Limitation of Cost" clause. The notice to the Contracting Officer required by the "Limitation of Cost" clause is required as a separate notice in accordance with the provisions of said clause.

d. One (1) copy of the reports shall be submitted to the Contracting Officer and one (1) copy to the Project Officer.

F.5 REQUIRED REPORTS tc "F.5 REQUIRED REPORTS " \l 2 The Contractor shall furnish the following reports.

a. Monthly Progress Report

The Contractor shall submit one copy to the Contracting Officer and the Project Officer of a monthly progress report briefly stating the progress made, including percent completion of the contract as of the end of the reporting period. Specific areas of interest shall include difficulties encountered during the reporting period and remedial action taken and a statement of activity anticipated during the subsequent reporting period. The report shall also include any proposed changes of key personnel concerned with the contract effort. The monthly progress reports shall be submitted on or before the fifteenth day of each month, following the first complete month of contract performance.

b. Draft Final Report

(1) The Contractor shall submit to the Project Officer two (2) copies of the draft final report within forty-five (45) days prior to the completion of the period of performance set forth under Section F, "Deliveries or Performance." The Contractor shall furnish to the Contracting Officer a copy of the letter transmitting the draft to the Project Officer.

(2) The Government will review and return each submission of the Draft Final Report indicating approval or disapproval, and comments, if necessary, within fifteen (15) calendar days. In the event the Government delays review and return of any submission of the Draft Final Report beyond the period specified, the Contractor shall immediately notify the Contracting Officer in writing and the Contractor will be entitled to a day-for-day extension in submission of the approved Final Report(s). The Draft Final Report shall be typed double spaced or space-and-a-half and shall include all illustrations, tables, drawings, charts, data sheets, and other pertinent material required for an approved Final Report.

c. Computer Program

Upon request by the Project Officer, all Computer Programs developed under this contract, including the following support material, shall be delivered by the Contractor to the Project Officer:

(1) A card deck or magnetic tape containing the complete program,

(2) A listing of all nomenclature used,

(3) A listing of input data required to run the program,

(4) A description and explanation of the computer output, and

(5) Operating instructions.

d. Monthly Project Cost/Contract Status Reports

The Contractor shall submit monthly project cost/contract status reports showing the status of funding for the IT tasks for the previous month and any outstanding contract issues. The monthly project cost/contract status report shall include, at a minimum: (1) a description of work performed during the reporting period, (2) the initial budgeted task funding level, (3) the total funds remaining, (4) the percentage of funds spent on the task, (5) projected activities and spending for the next month, (6) the total projected task cost, and (7) the funding shortfall date (the date when the funding is projected to run out). The report shall also include any contract issues and describe how and when they will be resolved.

e. Weekly Master Project Plan/ Status Reports

The Contractor shall submit weekly master project plans/ status reports showing the status of all projects under management or using resources by the contractor. The weekly project plan/status report shall include, at a minimum: (1) a work breakdown structure into task for all work performed during the reporting period and three months in the future, (2) the resources assigned to each task, (3) the start and completion dates, (4) the percentage of each task completed. The Master Plan should be maintained in MS Project and copies of it placed into PDF format. The Master Plan should include all Tasks as it relates to this SOW.

f. Monthly Testing Project Plans and Schedules

The Contractor shall submit monthly testing project plans and schedules showing the status of all testing activities under management by the contractor. The monthly testing plan shall include, at a minimum: (1) a work breakdown structure into task for all work performed during the reporting period and three months in the future, (2) the resources assigned to each task, (3) the start and completion dates, (4) the percentage of each task completed. The Testing Plan should be maintained in MS Project and copies of it placed into PDF format. The monthly testing schedule shall include at a minimum: (1) A weekly view with each testing activity identified, (2) Color coded for specific status, such as Red for testing that is behind. The Schedule should be provided in MS Word or PDF format.

g. Monthly Network Utilization Report

The Contractor shall submit monthly a network utilization report for the network infrastructure supported under the SOW. The monthly report shall include, at a minimum: (1) The utilizations stats of all Wide Area Network Circuits, (2) the utilization stats of all Complex Enterprise Switches, Routers, Load Balancers and Firewalls, (3) the Port availability of Complex Switches. The report should be maintained in MS Word.

h. Monthly E-Mail Utilization Report

The Contractor shall submit monthly an E-Mail utilization report for the E-Mail infrastructure supported under the SOW. The monthly report shall include, at a minimum: (1) The utilizations stats of Complex E-Mail systems, (2) the utilization stats of all Complex Chiper Trust Appliances as Directed by CMS, (3) A graphical displace of historical analysis over 12 months for all Complex Chiper Trust Data. The report should be maintained in MS Excel.

i. Monthly Production Server Utilization Report

The Contractor shall submit monthly a Production Server utilization report for the Production Server infrastructure supported under the SOW. The monthly report shall include, at a minimum: (1) The utilizations stats, as directed by CMS, of Complex Production Servers under this SOW, (2) A graphical displace of historical analysis over 12 months for all Complex Production Server utilization. The report should be maintained in MS Excel.

j. Monthly Unscheduled Production System Downtime Report

The Contractor shall submit monthly a Production System Unscheduled Down Time report for the production infrastructure supported under the SOW. The monthly report shall include, at a minimum: (1) The unscheduled downtime stats, as directed by CMS, of production systems under this SOW, (2) A graphical displace of historical analysis over 12 months for all unscheduled production system downtime by system type. The report should be maintained in MS Excel. Starting stats should be considered system name, system type, down time in minutes and reason for downtime.

k. Semi-Annual Data Center Floor plans

The Contractor shall submit every six months a detailed data center floor plan of each complexes supported under the SOW. The floor plan shall include, at a minimum: (1) A to scale layout of the Data Centers, (2) Racks with identification numbers relating back to inventory records, (3) Other items within the data center not rack related, (4) A legend with color coded scheme for the various components on the plan, (5) A change history table that describes the change and it’s rough location on the plan. The Floor plan can be maintained in any format, but should be printed out on a large scale plotter and hard copies delivered upon request to CMS.

l. Semi-Annual Enterprise Network Topology Map

The Contractor shall submit every six months a detailed Enterprise Network Topology Map of each enterprise network supported under the SOW. The floor plan shall include, at a minimum: (1) All the network components/segments in the support enterprise, (2) the associated devices connected to the network components, (3) identification of the interfaces that connect the devices, (4) And the network flow between the devices. The Map can be maintained in any format, but should be printed out on a large scale plotter as one total MAP (Not pieces) and hard copies delivered upon request to CMS.

F.6 REPORTING REQUIREMENTS tc "F.6 REPORTING REQUIREMENTS " \l 2 Technical Progress Reports

In addition to the required reports set forth elsewhere in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. Specific content of these reports is contained in this section as well as Section G of the contract.

(x) Monthly

(x) Annually (with a requirement for a Draft Annual Report)

(x) Final - Upon final completion of the contract (with a requirement of a Draft Final Report)

In addition to those individuals listed in the Delivery Schedule (Item F.8), the Contractor shall submit electronic copies of the F.6 reports to the Contracting Officer. The monthly submissions shall be attached to the Monthly Report stated in F.5.

F.7 PERIOD OF PERFORMANCE (BASE PERIOD WITH OPTIONS) tc "F.7 PERIOD OF PERFORMANCE (BASE PERIOD WITH OPTIONS) " \l 2 The work and services required hereunder shall be completed/delivered as follows:

The Base Performance Period shall be 12 months from the award date.

Performance beyond the base period of the contract may be authorized by the Government's right to unilaterally exercise the following option periods:

Base Period – 12 months from the expiration of the base period.

Option Period 1 - 12 months from the expiration of Option Period 1.

Option Period 2 - 12 months from the expiration of Option period 2.

Option Period 3 - 12 months from the expiration of Option Period 3.

Option Period 4 – 12 months from the expiration of Option Period 4.

NOTE: The option periods delineated above are subject to the option clause in Section I of this contract.

F.8 DELIVERY SCHEDULE tc "F.8 DELIVERY SCHEDULE " \l 2

a. The supplies/services to be furnished under are to be delivered in accordance with the following schedule:

C.2.1 Network

C.2.1.2 Network Engineering

C.2.2 Microsoft Server Environment

C.2.3 Unix Environment

C.2.4 Enterprise-wide Engineering Task

C.2.5 Security

C.2.6 Testing IV&V + Stress Testing + Pre-Production

C.2.7 Configuration Management

C.2.8 Project Management (As described in Section F)

C.2.9 SAN Administration

Monthly SAN space allocation report

C.2.12 DBA Support

C.2.13 Windows Active Directory Server Environment

Monthly E-mail report

C.2.15 Network Operations Center

C.2.17 QualityNet Help Desk

C.2.18 Production

C.2.20 QIO System Administration

C.2.21 QualityNet Conference Support

C.2.24 Transition Plan

Other Tasks

PQRI

GTL

Monthly until PQRI completion

APU

OPPS

EDT

Other

b. Satisfactory performance under this contract shall be deemed to occur upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, in accordance with the delivery schedule stated above.

HCQIS Infrastructure Support

October 8, 2008