Sol_140D0421Q0267.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

D51

Herndon VA 20170 381 Elden Street, Suite 4000 IBC,AQD,Dv5,Br1,VA

CODE 16. ADMINISTERED BYCODE

X

X

X

511210

SIZE STANDARD:

100.00 % FOR:SET ASIDE:UNRESTRICTED ORD51

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

04/30/2021 1400 ES

03/30/2021

7039643562Sheila Johnson-Montalvan (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

140D0421Q0267

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 62 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

Washington DC 20002 90 K Street, NE National Indian Gaming Commission

15. DELIVER TO

Herndon VA 20170 381 Elden Street, Suite 4000

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$41.50

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

IBC,AQD,Dv5,Br1,VA

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Fingerprint System Modernization for the National Indian Gaming Commission.

See attached solicitation and Statement of Work for additional details.

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED

Shaun Marnien

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

62 2 of

Solicitation Number 140D0421Q0267

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

SECTION 1:

Request for Quotation (RFQ) – Information and Instructions

The Department of the Interior (DOI), Acquisition Services Directorate (AQD) on behalf of the National Indian Gaming Commission (NIGC) has a requirement for their fingerprint system modernization. The NAICS code is 511210 – Software Publishers.

In order to provide a total solution to complete all the requirements, other appropriate NAICS codes may apply.

If this is the case, vendors shall indicate the additional NAICS code(s) in their quote.

This RFQ is open to all small business vendors and is being advertised through beta.SAM.gov using Federal Acquisition Regulation (FAR) Part 12, Acquisition of Commercial Items.

The Government anticipates an award of a hybrid Firm-Fixed Price (FFP) and Labor Hour Task Order as a result of this RFQ. The Government reserves the right to not make an award.

This effort includes a 12-month base year and 3 one-year option periods for operations and maintenance support services, which may be unilaterally exercised by the Government.

Questions may be submitted to the Contract Specialist, Sheila Johnson at Sheila_Johnsonmontalvan@ibc.doi.gov The deadline for questions is 2:00 PM ET, April 9, 2021. Late questions may not be answered.

Quotes are due via email no later than 2:00 PM ET, April 30, 2021. Late quotation submissions will not be considered for award.

Basis for Award: Award will be based on best value. Interested vendors shall provide specifications of the products to be furnished under this effort and their project management plans to meet the Government’s requirement including services to be performed within the parameters of the RFQ. Partial quotes will not be considered for award.

The Government will evaluate the quote as follows to determine technical acceptability:

Technical: The Government will evaluate the quotation for completeness and compliance with the instructions provided in the solicitation. A technical evaluation will be performed to determine if all items are quoted as identified in the requirements, and to determine if all requirements of this solicitation have been met.

Organizational and corporate experience will be evaluated based upon demonstrated experience providing services of a similar scope to either a Government or commercial entity for a minimum of three (3) years.

Technical experience will be evaluated based upon demonstrated capability to perform work similar to the work described in the Statement of Work (SOW).

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

Past Performance: A review may be conducted of information in Past Performance Information Retrieval System (PPIRS) and the Federal Awardee Performance and Integrity Information System (FAPIIS).

Price: The Government will perform a price analysis to ensure a fair and reasonable price. Examples of such techniques include but are not limited to the following: 1) Comparison of quoted prices received in response to this solicitation; 2) Comparison of proposed prices with prices obtained through market research for the same or similar items. Vendors must provide pricing for the base year and all options.

All evaluation factors other than cost/price, when combined, are significantly more important than cost or price.

Discount: The Government requests a discount from the vendor’s regular pricing for this requirement.

Additional Information Required on Quote

The following additional information must be supplied along with your quotation. Failure to submit this information may deem your quotation technically unacceptable and your quotation may not be considered for award.

1) Federal Tax ID Number and DUNS Number

2) Business Size Classification

3) Legal business name and “Doing Business As” (DBA) Name

4) Physical street address

5) City, State, Zip Code

6) Mailing Address (if different)

7) Technical and Price Quote with specifications/descriptions of all items being submitted and the project management plan

8) Place of manufacture, if applicable.

Assumptions, Conditions, and/or exceptions

Vendors must submit, under separate cover, all (if any) assumptions, conditions, or exceptions with any of the terms and conditions of this RFQ. If not noted in this section of your quote, it will be assumed that the vendor proposes no assumptions for award and agrees to comply with all of the terms and conditions as set forth herein.

It is not the responsibility of the Government to seek out and identify assumptions, conditions, or exceptions buried within the vendor’s quote.

Notice Regarding Late Delivery/Delayed Performance

The contractor will immediately notify the Contracting Officer (CO) in writing in the event the contractor encounters difficulty in performance by giving pertinent details, including the date by which it expects to complete performance or make delivery. However, the notification will be informal only in character and will not be construed as a waiver by the Government of any contractual delivery schedule or date, or any rights or remedies provided by law or under this effort.

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

Other General Information

The Government reserves the right to ask for additional information to determine best value. Accordingly, prospective vendors should submit their quotes initially on the most favorable terms possible from both a technical and pricing standpoint.

The Government reserves the right to request additional information as may be necessary to determine the prospective vendor’s qualifications for an award or to clarify any aspects of their submissions. Such information shall be furnished promptly upon the Government’s request.

Contract Administration/Government Points of Contact

Mr. Shaun Marnien Contracting Officer U.S. Department of the Interior Interior Business Center, Acquisition Services Directorate 381 Elden Street, Ste 4000 Herndon, VA 20170 Phone Number: 703-964-8807 Email: Shaun_Marnien@ibc.doi.gov

Contracting Officer Representative - TBD National Indian Gaming Commission 90 K St., NE Washington, DC 20240 Phone: TBD Email: TBD

(End of Section 1)

SECTION 2:

Statement of Work for

Nation Indian Gaming Commission Fingerprint System Modernization and Support Services

February 2021

1. BACKGROUND

The National Indian Gaming Commission (NIGC) is an independent federal regulatory agency with the primary mission of regulating gaming activity conducted by Indian tribes on Indian lands. The Indian Gaming Regulatory Act (IGRA)was enacted by the United States Congress on October 17, 1988, to regulate the conduct of gaming on Indian Lands. IGRA establishes the National Indian Gaming Commission and the regulatory structure for Indian gaming in the United States. Public Law 100-497-Oct. 17, 1988 100th Congress Sec. 2701.

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

Some tribal gaming facility employees and managerial positions must obtain a gaming license from their tribal regulatory authority. Different tribes require different licensing based upon the specific position in the gaming facility. Part of the licensing process includes a background investigation. Under 25 CFR Part 556 & 558 of the regulation code, NIGC has established a background investigation system to monitor key employees of the tribal employment and personnel. NIGC assists tribal gaming regulatory authorities in processing over 82, 587 fingerprints submitted by the tribe in the calendar year of 2019. The fingerprint submission results are utilized by the tribes in the determination of the applicant’s suitability for a gaming license. The NIGC also conducts training for gaming facilities and tribal gaming commissions to assist with the submission of fingerprints. The current legacy fingerprint system and hardware is at its end of life and is limiting advancement of certain capabilities and protocols to remain in compliance with federal security requirements.

Fingerprinting History

Over 20 years ago, NIGC entered into an agreement with the FBI Criminal Justice Information Services (CJIS) unit and serves as the CJIS System Agency (CSA) for participating tribes. The agency managed fingerprint system provides authorized tribal personnel the ability to submit fingerprint information to the FBI through NIGC to determine applicants’ eligibility for gaming licensing and to determine suitability requirements for applicants seeking employment at the gaming operation. The submission of fingerprint information and accessing of results returned by the FBI are performed by authorized tribal personnel establishing secure encrypted connectivity to the NIGC fingerprint system using a tribal managed system supplied with the NIGC Cisco Virtual Private Network client (VPN) software. The submission process and results received from the FBI are handled by the NIGC fingerprint store and forward system utilizing a secure email messaging component. Upon connectivity to the NIGC VPN, tribes are restricted to accessing Record of Arrest and Prosecution (RAP) sheets for respective key employees submitted by the tribe.

Fingerprint System

The current store and forward fingerprint system in use by the agency is the AltaScan Store and Forward system which was originally designed, installed and currently maintained by Northrop Grumman. The NIGC fingerprint system and services are required to remain available 24x7x365 days a year. Over the years, additional custom processes and technical enhancements were developed to integrate the SQL backend database into a separate system known as Tribal Information System (TIMS) further described in the next section.

The fingerprint workflow comprises of: 1) an electronic submission by the tribe, 2) fingerprint hard card submissions to NIGC. For the tribes to submit electronically, the tribes shall purchase a fingerprint system from a FBI certified vendor’s list. NIGC shall furnish the necessary procedures and connect parameters to the tribes for their fingerprint to work under the current fingerprint system. For tribes who cannot afford to purchase an electronic submission fingerprint system, an FBI hard card is provided to the tribe. The ink-roll method of fingerprinting is done by the tribe. The completed hard card is submitted to NIGC by snail mail. In turn hard card are scanned at the NIGC headquarters in Washington DC. The FBI results are sent back to the tribe via snail mail or commercial carrier.

To date, there are approximately 250 tribal fingerprint systems that are authorized to submit fingerprint data to NIGC. In 2019, NIGC received and processed approximately 82,5870 fingerprint submissions by the tribes.

Approximately 2,043 fingerprint hard cards were submitted by the tribes to NIGC and approximately 80,544

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page were submitted electronically. Most recently in 2020, the number of fingerprint submissions significantly reduced to approximately 42,280 submissions due to the COVID-19 pandemic. It is anticipated that these numbers will continue a steady upward trend to normal levels post pandemic.

Tribal Information Management System (TIMS) (See Figure 1)

TIMS is comprised of internal and external facing web applications sourced by a compilation of data sources from Sybase and MS SQL backend databases. The TIMS functionalities comprises of the following: 1) Tribe’s demographic information; 2) Tribal Background Investigation System (TBIS), 3) Tribal Access Portal (TAP);

4) Site Visit Reporting.

1) Tribal Demographic Information The tribal demographic information that contains the tribe’s name, its operation/s and its contacts are stored and updated via a thick-client front-end (Power Builder) and stored in a legacy Sybase 6.x database.

To extract the tribe’s name, tribal operations and tribal contact information from the Sybase 6.x to the MS SQL 2012 (Central Database), custom SQL scripts and stored procedures were created to interface between the backend of the SQL 2000 (Translator) and the Sybase 6.x). Due to the legacy nature of the Sybase 6.x, a SQL 2000translator is required to translate, via ODBC between Sybase 6.x backend and the SQL 2000 MS SQL server translator The Central Database SQL server can interface directly with the MS SQL 2000 server.

2) TBIS

Together, these components automatically extract demographic information of key employees submitted by the tribes, from the fingerprint store and forward system, through custom MS SQL queries and scripts. Included in the data extractions are the names of the individuals, the tribe who submitted the individuals, and the FBI Record of Arrest and Prosecution (RAP) results. This information is provided securely via the front-end web interface on the internal intranet to eight NIGC regional offices to provide compliance officers with the capability to review daily FBI report submissions processed by the agency’s fingerprint system. This information is utilized by the regions to perform oversight responsibilities on the gaming operations and to monitor and enforce compliance by the tribes under 25 CFR Part 556 & 558 of the regulation code.

Additionally, the TBIS is utilized to provide a custom billing information system to the tribes as the FBI charges the NIGC the cost of each fingerprint submission made.

3) TAP

The TAP is a secure read-only internet facing web application for authorized tribal users. The TAP is a self-service application that provides limited view of the Tribal Background Investigation System (TBIS) information for applicants seeking employment. Due to the Privacy Act of 1974, the TAP display only the name of the applicant, alias/es if any and the contact information of other tribes who this applicant has had employment with.

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

4) Site Visit Reporting

As part of the oversight responsibilities of the Compliance officers and auditors in monitoring tribal gaming operation/s, a web form is utilized to track all audit criteria that the tribes must comply with the IGRA regulation. For every audit conducted by the compliance officer, the compliance officer shall provide detailed audits on the tribe’s operation and is approved by the regional director. The categories that the compliance officer shall perform during a site visit of the tribe’s operation are but not limited to the following: 1. Tribal Internal Control Standards (TICS) compliance, 2. Facility site licenses, 3.

Surveillance review, 4. Audit follow-up, 5. Investigation, 6. Key Employees (KE) /Primary Management Officials (PMO), 7. Background/Suitability, 7 Use of Revenue, 8. Gaming Ordinance, 9 Training, 10.

Others. Due to the complexity of key elements captured in the Site Visit, definitions shall be provided at the award of this SOW.

Figure 1

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

2. OBJECTIVE

The National Indian Gaming Commission is seeking an industry partner with expertise in the design, implementation, and operation of fingerprinting systems utilizing Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS). The objective is to modernize the agency managed fingerprint system and application services1 provided to our tribal customers. Additionally, this effort requires the replacement of existing in-house legacy applications and databases with a comprehensive set of highly available, secure, and modernized solution sets to employ automated business workflows and to enable the electronic receiving processing, storing, reporting and retrieving of tribal employee information, facility information and sensitive Personally Identifiable Information (PII) and Criminal History Record Information (CHRI) from the FBI.

3. TYPE OF CONTRACT

The government anticipates an award of Firm Fixed Price (FFP) and optional Labor Hour task orders.

Offerors will not be reimbursed for any costs incurred in developing their submission in response to this RFP.

SCOPE OF WORK

Stable and secure fingerprinting systems and services are critical in meeting the agency’s commitment to provide these services to Native American Tribes in accordance with IGRA. Equally important is maintaining compliance with FBI Criminal Justice Information Systems (CJIS) policies defined by US Government partners (e.g. FBI and DOJ) and other federal requirements set forth by the Clinger-Cohen Act, Office of Management and Budget (OMB) and Federal Information Security Modernization Act (FISMA). The NIGC provides fingerprint processing services to over 240 tribal operations in various regions in the US. These tribal fingerprint systems rely on agency services to determine employee suitability for employment at their gaming operations. This action is required for tribes to comply with CFR Part 556 & 558 regulations.

Due to evolving CJIS security policies and Electronic Biometric Transmission Specification (EBTS) specifications mandated by the FBI, the NIGC as the CSA has the responsibility to comply with current and future CJIS security policies and mandates. Many of the systems and applications supporting the NIGC Fingerprint Program have exceeded end of life, end of sale dates and are in need of critical software upgrades and redesign of supporting infrastructure and services to achieve compliance. In order to support Indian Gaming regulatory compliance and integrity, NIGC requires a comprehensive set of cloud-based solutions to modernize the agency’s fingerprint system and services to support current and future agency needs. The NIGC is currently working on establishing a Microsoft Azure environment connected to the FBI CJIS network to serve as a migration platform for the agency’s new fingerprint applications and services. The agency seeks an industry partner to propose and implement a modernized fingerprint store and forward solution in the agency’s Microsoft Azure environment to service tribal partners’ needs for fingerprint processing services. Tribal support for fingerprint submissions will be enhanced through secure web-based submissions eliminating the need for current infrastructure services supporting submissions via traditional client-based VPN architecture.

1 NIGC Fingerprint Resources and Services:

https://www.nigc.gov/finance/fingerprint-process https://www.nigc.gov/compliance/CJIS-Training-Materials https://www.nigc.gov/finance/fingerprint-process https://www.nigc.gov/compliance/CJIS-Training-Materials

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

The modernization initiative also includes the migration and replacement of the existing TIMS services to the new Azure cloud environment. The objective is to improve system availability and security while enhancing business process workflows for the agency’s fingerprint program and support provided to tribal organization through the use of advanced cloud-based applications services.

5. SPECIFIC TASKS

The contractor shall be directly responsible for ensuring the accuracy, timeliness and completion of all tasks under this effort.

Overview

The National Indian Gaming Commission (NIGC) requires contractor services to propose and implement a new CJIS compliant fingerprinting system within the agency managed Microsoft Azure Government Cloud environment. The contractor shall also provide services to include the redesign and implementation of a Customer Relationship Management solution to replace the legacy TIMS web applications and databases.

Upon completion of the system, acceptance to implement shall be conditioned to passing third party security check. Any security deficient modules in the system shall be remediated until all security weaknesses are resolved.

The scope of this modernization project includes three tasks:

1. Fingerprint System Modernization (FFP)

2. TIMS/TAP Modernization (FFP)

3. Operations & Maintenance Services (Labor Hour)

5.1 TASK 1: Fingerprint System Modernization

The contractor shall provide all services required for the design and implementation of a new modernized, CJIS compliant fingerprint system in the agency’s Microsoft Azure cloud environment. The solution shall be of Commercial Off-the-Shelf (COTS) with minimal custom coding required. Fingerprint solution shall also meet or exceed current version of the Electronic Biometric Transmission Specifications (EBTS) and FBI Criminal Justice Information Services (CJIS) standards. Migration support for tribal agencies from current client-server based architecture to a secure web-based platform for fingerprint submissions and responses. The solution must be provided as a CJIS approved Software-as-a-Service (SaaS) or software solution capable of being hosted in a CJIS compliant cloud Infrastructure-as-a-Service (IaaS) environment. Contractor shall provide all relevant documentation, knowledge transfer, and training for systems migration. Migration processes will include preservation of all applicable data elements (i.e., tribal demographic elements, TBIS and other NIGC specific functions) from legacy systems and documentation will need to meet all CJIS and FISMA related documentation for technical and security assessment and authorization requirements respectively. Additionally, one fingerprint station for processing of fingerprint hard cards currently resides in the NIGC headquarters office https://www.fbibiospecs.cjis.gov/EBTS/Approved https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page in Washington, DC. The contractor shall provide a proposal to upgrade this station complete with CJIS approved fingerprint hardware. In order to meet the FBI CJIS security mandates and to provide continuity of services for fingerprint submissions by the tribes, the solution proposed shall be turn-key and meet the following specifications at a minimum.

Fingerprint System:

The proposed fingerprint system and underlying infrastructure shall comply with the current CJIS security standards.

Solution must be compliant with FBI’s Electronic Biometric Transmission Specification (EBTS) version

10.0.0.9 and accept submissions from CD, DVD, or external storage format

The proposed fingerprint system shall provide backward compatibility with existing tribal fingerprint systems installed base (Crossmatch, Livescan, Accurate Biometrics) The proposed fingerprint system shall operate in a secure government cloud environment connected to the FBI CJIS network.

The fingerprint system shall provide the capabilities of auditing incoming and outgoing fingerprint data down to the user level and submission level of information.

The system shall have the capabilities to provide ad-hoc reports, custom reports and canned reports for auditing purposes.

System shall be support event logging for required audit and accountability controls and monitoring.

Identity Management & Access Control

Solution shall provide identity, credentialing, and access management controls and services for tribal users accessing CHRI.

Accounts shall be unique to each user and comply with CJIS password complexity requirements.

System shall employ multi-factor authentication for users.

Submission Processing and Monitoring

System shall be capable of providing verbose transaction logging and alerts when encountering errors while processing EBTS submissions

System shall provide unique transaction IDs for each submission The system shall support receiving of EBTS compliant responses from the FBI via the Criminal Justice

Information System Wide Area Network (CJIS WAN). The system(s) shall process each incoming response as follows.

A subset of the response data shall be stored in the local database and linked to the corresponding submission

A success message shall be recorded in the transaction log The response shall be processed as directed by the Customer The response shall be archived to a designated directory If an error is encountered while processing a response, the system(s) shall process the error as follows:

o An error shall be recorded in the transaction log o The response file shall be archived in a designated error directory

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page o Email notification alerts will be sent to a designated email distribution for all critical errors;

direct API support for in-house ticketing system (Samanage) highly desired

Fingerprint application must utilize multi-factor authentication for administrators and users One fingerprinting station will be provided to integrate with the fingerprint system and shall support submission and processing of scanned fingerprint hard cards and shall be on the FBI certified vendor list. Please refer to the link at https://www.fbibiospecs.cjis.gov/certifications for the most recent list.

Encryption

All CJI/CHRI data transmitted outside the approved boundary must use FIPS 140-2 certified encryption CJI/CHRI data at rest must be stored using symmetric cipher rated FIPS 197 (AES-256) certified or above The platform must have the ability for fingerprint data to be transmitted inbound/outbound and stored using FIPS 140-2 certified encryption.

Billing

Solution must be able to track the count of successful and unsuccessful electronic submissions for billing purposes

Platform must have the ability for each record to track, audit, void, run reports and bill for fingerprint transaction costs (e.g. Cost per fingerprint submission) for each tribe.

Enable electronic payment functionality for Tribal electronic payments of fingerprint submissions capability via Pay.gov, Treasury’s OCNET, or equivalent.

5.2 TASK 2: TIMS/TAP Modernization

In addition to the fingerprint system, the modernization of Sybase and its associated components contained in figure 1 of provided above shall be in this project scope. The NIGC Tribal Information Management System (TIMS) and Tribal Access Portal (TAP) applications enable the agency to service over 240 tribal organizations that operate more the 500 gaming establishments across the country. These tribal gaming operations submit thousands of applicant background approvals a year. These applications follow several complex workflows that must be streamlined and secured.

All front-facing applications provided by the vendor, shall be secure in accordance with CJIS requirements and provide a self-registration portal for account request and management to ensure minimal IT administration in the creation of user profiles and maintenance of the user accounts.

Extensive user-friendly reporting logs shall be provided that comply with the CJIS security standards.

NIGC seeks to leverage the new fingerprint system with minimal customization to consolidate and modernize these applications into one comprehensive solution which will provide automated business workflows to enable the electronic receiving processing, storing, reporting and retrieving of tribal employee information, facility information and FBI criminal history report information containing sensitive PII. Contractor shall provide all https://www.fbibiospecs.cjis.gov/certifications

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page relevant documentation, knowledge transfer, and training for systems migration. Migration processes will include preservation of all applicable data elements (i.e., tribal demographic elements, TBIS and other NIGC specific functions) from legacy systems and documentation will need to meet all CJIS and FISMA related documentation for technical and security assessment and authorization requirements respectively. Minimum specifications are listed below.

The platform must have a case management or customer relationship management (CRM) functionality to be able to add comments, upload or download PDF or MS Office files for individual tribal records

Cloud-based solutions must be FedRAMP authorized and all CJI/CHRI data shall reside in the government cloud

The application must be permissions based for external tribal access and internal NIGC access, review, edit, upload and download of data and record files.

Records must have a data auto-purge functionality based upon a timeframe stipulated and entered by NIGC. This functionality must not be hardcoded and should be editable.

The platform must have a reporting functionality to run reports on the application.

The application must have backup redundancy and the ability to failover to a region outside of the US

Eastern Zone but only within the continental United States in accordance with NIST Publication 800-53 (Rev. 4 or later).

Platform is secure, provides role-based access control, and all system components and modules shall support continued maintenance and patching of underlying operating systems, databases, web servers, programming language or application libraries, etc. in accordance with industry or US Government cybersecurity requirements and standards.

System shall be support event logging for required audit and accountability controls and monitoring

Identity Management & Access Control

Solution shall provide a secure web-based platform, support self-service user registration process with provisions to approve, deny or suspend user accounts.

Solution shall provide identity and access management controls and services for tribal users accessing

CHRI.

System shall employ multi-factor authentication access for users

Encryption

All CJI/CHRI data transmitted outside the approved boundary must use FIPS 140-2 certified encryption CJI/CHRI data at rest must be stored using symmetric cipher rated FIPS 197 (AES-256) certified or above The platform must have the ability for fingerprint data to be transmitted inbound/outbound and stored using FIPS 140-2 certified encryption.

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

5.3 TASK 3: Operations & Maintenance Services

The agency requires support to perform daily operations and maintenance services for the solutions implemented through this engagement. This will include system administration, customer support to agency and tribal users, security patching, and ongoing development support for workflow design and continued enhancement of the systems to support the agency’s fingerprint program. Contractor shall establish standard operating procedures, support documentation, and be responsible for providing end user support to internal agency users and tribal organizations utilizing the agency’s fingerprinting services. Daily activities will include participation in daily standup and operational calls for agency-wide IT support engagement.

6. DELIVERABLES

In fulfillment of this effort, the contractor shall provide the following deliverables. All deliverables shall be submitted to the Contracting Officer’s Representative (COR), unless otherwise agreed upon.

6.1. Project Plan

The contractor shall prepare a Project Management Plan describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements for this effort. The Project Management Plan shall detail the products, methods for developing the products, allocation of staff and other resources necessary to produce the products and a revised timeline for producing the products, if necessary.

6.2. Monthly Status Report

The contractor shall document the efforts performed in the completion of each task in a detailed Monthly Status Report due on or before the 10th of each month. Reporting requirements for the monthly status reports will be outlined at the initial kick-off meeting. The status report shall include, at a minimum:

Program status, including work completed, and work that remains outstanding Issues or obstacles impeding progress and recommended solution Status of deliverable / milestones Issues and resolutions Resource planning / status Topics or issues identified by the government COR

6.3. Final Report

The contractor shall provide a final report to the COR, at the conclusion of this effort. The report will include all system documentation to include the following:

Design documents System build documentation System inventory

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

Network diagrams Standard Operating Procedures for daily operations and maintenance tasks Training documentation Software licensing and maintenance agreements purchased on behalf of NIGC

The report shall also summarize objectives achieved, significant issues, problems and recommendations to improve the systems and processes in the future.

6.4. Deliverable Table

Reference Milestone/Deliverable Responsibility Date

6.1 Project Plan Contractor Draft is due at orientation

6.2 Monthly Status Report Contractor 10th of each month

6.3 Final Report Contractor 10 business days before the

period of performance end date

6.5. Deliverable Format

All deliverable shall be delivered in electronic format and use appropriate level of encryption as required for sensitive content. Electronic form of deliverables should be of standard Microsoft Office products i.e., Word, Excel, PowerPoint). The contractor shall provide sample of reporting format which will be reviewed and approved upon project kickoff.

Any software purchased for NIGC by the contractor through the vendor must have an account created under itsupport@nigc.gov only. The contractor must enable software access to NIGC IT Staff for ongoing management, maintenance and support should there be a need for additional vendor support.

6.6. Deliverable Acceptance and Review

Unless otherwise specified, the Government will have a maximum of 10 working days from the day the draft deliverable is received to review the document, provide comments back to the contractor, approve or disapprove the deliverable(s). The contractor will also have a maximum of 10 working days from the day comments are received to incorporate all changes and submit the final deliverable to the Government. All days identified below are intended to be workdays unless otherwise specified.

6.7. General Acceptance Criteria

The general quality measures set forth below will be applied to each work product received from the contractor under this statement of work.

Accuracy - Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity - Work products shall be clear and concise; diagrams shall be easy to understand and be relevant to the supporting narrative.

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

Consistency to Requirements - All work products must satisfy the requirements of this statement of work.

File Editing - All text and diagrammatic files shall be editable by the Government.

Format - Work products shall be submitted in hard copy (where applicable) and in media mutually agreed upon prior to submission. Hard copy formats shall follow any specified Directives or Manuals.

Time-lines - Work products shall be submitted on or before the due date specified in this statement of work or submitted in accordance with a later scheduled date determined by the Government.

7. PERFORMANCE

7.1. Period of Performance

The period of performance for this effort is date of award through a period of one year (the Base Period) for implementation tasks 1, 2, and 3. This effort also includes 3 option periods for task 3 for operations and maintenance support services, which may be unilaterally exercised by the Government. Each option period shall have a period of performance of one year. All terms and conditions applicable to the base period shall extend to the options unless otherwise agreed upon.

7.2. Place(s) of Performance

On-site work will be performed at NIGC headquarters located at 90 K Street NW, Washington, DC.

However, due to the COVID-19 pandemic, exceptions for remote work will apply until the agency resumes normal operations.

8. OTHER PERFORMANCE REQUIREMENTS

8.1. Orientation Briefing

Within 10 working days of award, the contractor shall conduct an orientation briefing for the Government. The intent of the briefing is to initiate the communication process between the Government and contractor by introducing key task participants and explaining their roles, reviewing communication ground rules, and assuring a common understanding of subtask requirements and objectives.

8.2. Contractor Interfaces

The contractor and/or his subcontractors may be required as part of the performance of this effort to work with other contractors working for the Government. Such other contractors shall not direct this contractor and/or their subcontractors in any manner. Also, this contractor and/or their subcontractors shall not direct the work of other contractors in any manner.

8.3. Disclosure of Information

Information made available to the contractor by the Government for the performance or administration

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the Contracting Officer (CO).

8.4. Limited Use of Data

Performance of this effort may require the contractor to access and use data and information proprietary to a government agency or government contractor which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others.

Contractor personnel shall not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorized government personnel or upon written approval of the CO. The contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort.

Nothing herein shall preclude the use of any data independently acquired by the contractor without such limitations or prohibit an agreement at no cost to the Government between the contractor and the data owner which provides for greater rights to the contractor.

8.5. Hours of Work

Contractor personnel are expected to conform to normal operating hours. The normal duty hours are 8:30am – 5pm Monday through Friday, with the exception of federal government holidays.

8.6. Productive Direct Labor Hours

The contractor can only charge the Government for “Productive Direct Labor Hours.” Productive direct labor hours are defined as those hours expended by contractor personnel in performing work under this effort. This does not include sick leave, vacation, government or contractor holidays, jury duty, military leave, or any other kind of administrative leave such as acts of God (i.e. hurricanes, snowstorms, tornadoes, etc.) Presidential funerals or any other unexpected government closures.

8.7. Government Holidays

The following government holidays are normally observed by government personnel: New Year’s Day, Martin Luther King’s Birthday, Presidential Inauguration Day (metropolitan DC area only), President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day, and any other day designated by Federal Statute, Executive Order, and/or Presidential Proclamation. Or any other kind of administrative leave such as acts of God (i.e.

hurricanes, snowstorms, tornadoes, etc.) Presidential funerals or any other unexpected government closures.

8.8. Payment for Unauthorized Work

No payments will be made for any unauthorized supplies or services or for any unauthorized changes to the work specified in this document. This includes any services performed by the contractor of their

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page own volition or at the request of an individual other than a duly appointed Contracting Officer (CO).

Only a duly appointed CO is authorized to change the specifications, terms, and conditions under this effort.

8.9. Emergency or Special Event Services

Occasionally, the contractor may be required to perform or provide services outside the normal hours of duty. These occasions will be infrequent and will require that services be performed after normal working hours in the evening and / or weekends. The COR and the contractor will mutually agree upon all deviations to the schedule.

8.10. Contractor Personnel

The contractor shall be responsible for managing and overseeing the activities of all contractor personnel, as well as subcontractors used in performance of this effort. The contractor's management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in the statement of work.

8.10.1. Project Manager

The contractor shall provide a Project Manager (PM). The PM shall be the primary technical and managerial interface between the contractor, the CO, and the COR. The PM will have full authority to act for the contractor on all contract matters relating to daily operations.

9. SECURITY REQUIREMENTS

9.1. Clearances for Contractor Personnel

The Industry Partner shall provide only fully qualified and properly cleared personnel for the work to be performed under this task order. Personnel shall have, at a minimum, the appropriate security clearance/investigation of a Tier4/SSBI. Personnel who will have access to Criminal Justice Information/Criminal History Record Information and systems involving access to (CHRI) will be subject to fingerprinting and background check. The Industry partner shall ensure all industry partner, and sub-Industry Partner personnel (hereinafter "industry partner personnel") having access to information on NIGC systems received or generated under this contract are United States citizens and specifically authorized access by the agency. Additionally, any contractor or sub-contractor with access to CHRI will be required to enter into an outsourcing agreement with NIGC per FBI Criminal Justice Information Services (CJIS) requirements and will be subject to an audit.

9.2. Access to Government Property or Facilities

The contractor will be allowed limited access to the Government's facilities, as specified below:

The Government shall provide office space as required, equipment and local telephone service for any on-site Industry Partner personnel, as appropriate. The Government shall provide system access for on-

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page site and off-site work in accordance with agency standards, local security regulations and rules of conduct.

In order to maintain a healthy and safe working environment for all employees to and to assist in preventing a pandemic, for contractor employees working at a government facility, the Government reserves the right to refuse a contractor employee access to the government facility if the individual is displaying symptoms of a contagious illness, such as the flu. If such a situation arises, the COR shall communicate the Government’s decision regarding the employee to the Project Manager.

9.3. Identification of Contractor Employees

Contractor personnel shall be easily recognized as contractor employees by wearing a security identification badge at all times while on government premises. When contractor personnel attend meetings, answer phones, and work in other situations where their status is not obvious to third parties, they must identify themselves as such to avoid creating the impression that they are government employees.

9.4. Standards of Conduct

The contractor will be responsible for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity. The contractor is also responsible for ensuring that its employees and those of its subcontractor(s) do not disturb papers on desks, open desk drawers or cabinets, use government telephones, except as authorized, or otherwise jeopardize the security and the privacy of government employees, its clientele, and the contents and property of the federal building(s) in which the task order work is performed. Each employee or supervisor of the contractor is expected to adhere to standards of behavior that reflect credit on themselves, their employer, and the federal government.

The contractor will be responsible for taking such disciplinary action, including suspension without pay or removal from the worksite, with respect to its employees, as may be necessary to enforce those standards.

Where applicable, the requirements of this clause must be expressly incorporated into subcontract(s) and must be applicable to all subcontractor employees who may perform recurring services or work at the federal building and grounds of this task order.

The Government retains the right to permanently remove any employee of the contractor from performing duties assigned under this task order at the federal building should the employee's performance so warrant. The Government will request the contractor to immediately remove any employee of the contractor from the federal building/work-site should it be determined by the CO that the individual employee of the contractor is "unsuitable" for security reasons or for otherwise being found to be unfit for performing his assigned duty at a federal building. The following areas (not all-inclusive) are considered justification for requesting the contractor to immediately remove an employee from a federal building/work site:

Document Title Fingerprint System Modernization for the National Indian Gaming Commission

Page

Neglect of assigned duty and refusing to render assistance or cooperate in upholding the integrity of the security programs at the worksite;

Falsification or unlawful concealment, removal, mutilation, or destruction of any official documents or records, or concealment of material facts by willful omissions from official documents or records;

Disorderly conduct, use of abusive or offensive language, quarreling,…